certstore

type AIAFetcher func(ctx context.Context, url string) ([]byte, error)

type BundleExportInput struct {
	Bundle     *certkit.BundleResult
	KeyPEM     []byte
	KeyType    string
	BitLength  int
	Prefix     string              // sanitized file name prefix
	SecretName string              // Kubernetes secret metadata.name
	CSRSubject *CSRSubjectOverride // optional; nil uses cert's own subject
	// P12Password controls the .p12 output file password and must be explicit.
	P12Password string
}

type BundleFile struct {
	Name      string
	Data      []byte
	Sensitive bool // true for files containing private key material (mode 0600)
}

type BundleWriter interface {
	WriteBundleFiles(folder string, files []BundleFile) error
}

type CSRSubjectOverride struct {
	Country            []string
	Province           []string
	Locality           []string
	Organization       []string
	OrganizationalUnit []string
}

type CertHandler interface {
	HandleCertificate(cert *x509.Certificate, source string) error
	HandleKey(key any, pemData []byte, source string) error
}

type CertRecord struct {
	Cert       *x509.Certificate
	SKI        string // hex-encoded RFC 7093 SKI
	CertType   string // "root", "intermediate", "leaf"
	KeyType    string // e.g. "RSA 2048 bits", "ECDSA P-256"
	NotAfter   time.Time
	NotBefore  time.Time
	Source     string // filename that contributed this cert
	BundleName string // determined by CLI bundle config matching
}

type CheckTrustChainInput struct {
	Leaf          *x509.Certificate
	Intermediates *x509.CertPool
	Roots         *x509.CertPool
	Now           time.Time
}

type ContainerContents struct {
	Leaf       *x509.Certificate
	Key        crypto.PrivateKey
	ExtraCerts []*x509.Certificate
}

type ExportMatchedBundleInput struct {
	Store         *MemStore
	SKIs          []string // matched-pair SKIs to export
	BundleOpts    certkit.BundleOptions
	Writer        BundleWriter
	CSRSubject    *CSRSubjectOverride // optional; nil uses cert's own subject
	RetryNoVerify bool                // retry bundle without verification on failure
	P12Password   string              // required for PKCS#12 output
}

type K8sMetadata struct {
	Name        string            `yaml:"name"`
	Annotations map[string]string `yaml:"annotations,omitempty"`
}

type K8sSecret struct {
	APIVersion string            `yaml:"apiVersion"`
	Kind       string            `yaml:"kind"`
	Type       string            `yaml:"type"`
	Metadata   K8sMetadata       `yaml:"metadata"`
	Data       map[string]string `yaml:"data"`
}

type KeyRecord struct {
	Key       crypto.PrivateKey
	SKI       string // hex-encoded RFC 7093 SKI
	KeyType   string // "RSA", "ECDSA", "Ed25519"
	BitLength int
	PEM       []byte // PEM-encoded key data for export
	Source    string // filename that contributed this key
}

type MemStore struct {
	// contains filtered or unexported fields
}

type ProcessInput struct {
	Data      []byte      // raw file content
	Path      string      // virtual path for logging and extension detection
	Passwords []string    // passwords to try for encrypted formats
	Handler   CertHandler // receives parsed items
}

type ResolveAIAInput struct {
	Store                *MemStore
	Fetch                AIAFetcher
	MaxDepth             int                        // 0 defaults to 5
	Concurrency          int                        // 0 defaults to 20; max parallel fetches per round
	OnProgress           func(completed, total int) // optional; called after each cert's AIA URLs are processed
	AllowPrivateNetworks bool                       // AllowPrivateNetworks allows AIA fetches to private/internal endpoints.
}

type RunValidationInput struct {
	Store    *MemStore
	SKIColon string
}

type ScanSummary struct {
	Roots                  int `json:"roots"`
	Intermediates          int `json:"intermediates"`
	Leaves                 int `json:"leaves"`
	Keys                   int `json:"keys"`
	Matched                int `json:"key_cert_pairs"`
	ExpiredRoots           int `json:"expired_roots"`
	ExpiredIntermediates   int `json:"expired_intermediates"`
	ExpiredLeaves          int `json:"expired_leaves"`
	UntrustedRoots         int `json:"untrusted_roots"`
	UntrustedIntermediates int `json:"untrusted_intermediates"`
	UntrustedLeaves        int `json:"untrusted_leaves"`
}

type ScanSummaryInput struct {
	RootPool *x509.CertPool // nil skips trust checking
}

type ValidationCheck struct {
	Name   string `json:"name"`
	Status string `json:"status"` // "pass", "fail", "warn"
	Detail string `json:"detail"`
}

type ValidationResult struct {
	Subject  string            `json:"subject"`
	SANs     []string          `json:"sans"`
	NotAfter string            `json:"not_after"`
	Valid    bool              `json:"valid"`
	Checks   []ValidationCheck `json:"checks"`
}