keys

type Config struct {
	// KeyDir is the directory containing PEM-encoded private key files.
	// All key filenames are relative to this directory.
	//
	// In Kubernetes deployments, this is typically a mounted Secret volume:
	//
	//	volumeMounts:
	//	- name: signing-keys
	//	  mountPath: /etc/toolhive/keys
	KeyDir string

	// SigningKeyFile is the filename of the primary signing key (relative to KeyDir).
	// This key is used for signing new tokens.
	// If empty with KeyDir set, NewProviderFromConfig returns an error.
	// If both KeyDir and SigningKeyFile are empty, an ephemeral key is generated.
	SigningKeyFile string

	// FallbackKeyFiles are filenames of additional keys for verification (relative to KeyDir).
	// These keys are included in the JWKS endpoint for token verification but are NOT
	// used for signing new tokens.
	//
	// Key rotation (single replica): update SigningKeyFile to the new key and move
	// the old filename here. Tokens signed with old keys remain verifiable until
	// they expire.
	//
	// Key rotation (multiple replicas): to avoid a window where one replica signs
	// with a key not yet advertised by another replica's JWKS endpoint:
	//  1. Add the new key to FallbackKeyFiles and roll out to all replicas.
	//  2. Promote it to SigningKeyFile, move the old key to FallbackKeyFiles, roll out.
	//  3. Remove the old key from FallbackKeyFiles after its tokens have expired.
	FallbackKeyFiles []string
}

type FileProvider struct {
	// contains filtered or unexported fields
}

type GeneratingProvider struct {
	// contains filtered or unexported fields
}

type KeyProvider interface {
	// SigningKey returns the current signing key.
	// Returns ErrNoSigningKey if no key is available.
	SigningKey(ctx context.Context) (*SigningKeyData, error)

	// PublicKeys returns all public keys for the JWKS endpoint.
	// May return multiple keys during rotation periods.
	PublicKeys(ctx context.Context) ([]*PublicKeyData, error)
}

type PublicKeyData struct {
	// KeyID is the unique identifier for this key (RFC 7638 thumbprint).
	KeyID string

	// Algorithm is the signing algorithm (e.g., "ES256", "RS256").
	Algorithm string

	// PublicKey is the public key for verification.
	PublicKey crypto.PublicKey

	// CreatedAt is when this key was generated or loaded.
	CreatedAt time.Time
}

type SigningKeyData struct {
	// KeyID is the unique identifier for this key (RFC 7638 thumbprint).
	KeyID string

	// Algorithm is the signing algorithm (e.g., "ES256", "RS256").
	Algorithm string

	// Key is the private key used for signing.
	Key crypto.Signer

	// CreatedAt is when this key was generated or loaded.
	CreatedAt time.Time
}