ca

type BundleUpdater interface {
	AppendX509Roots(ctx context.Context, roots []*x509.Certificate) error
	AppendJWTKeys(ctx context.Context, keys []*common.PublicKey) ([]*common.PublicKey, error)
	LogError(err error, msg string)
}

type CA struct {
	// contains filtered or unexported fields
}

type Config struct {
	Log           logrus.FieldLogger
	Metrics       telemetry.Metrics
	TrustDomain   spiffeid.TrustDomain
	X509SVIDTTL   time.Duration
	JWTSVIDTTL    time.Duration
	JWTIssuer     string
	Clock         clock.Clock
	CASubject     pkix.Name
	HealthChecker health.Checker
}

type JWTKey struct {
	// The signer used to sign keys
	Signer crypto.Signer

	// Kid is the JWT key ID (i.e. "kid" claim)
	Kid string

	// NotAfter is the expiration time of the JWT key.
	NotAfter time.Time
}

type JWTKeyEntry = journal.JWTKeyEntry

type JWTSVIDParams struct {
	// SPIFFE ID of the SVID
	SpiffeID spiffeid.ID

	// TTL is the desired time-to-live of the SVID. Regardless of the TTL, the
	// lifetime of the certificate will be capped to that of the signing cert.
	TTL time.Duration

	// Audience is used for audience claims
	Audience []string
}

type Journal struct {
	// contains filtered or unexported fields
}

type JournalEntries = journal.Entries

type ManagedCA interface {
	SetX509CA(*X509CA)
	SetJWTKey(*JWTKey)
}

type Manager struct {
	// contains filtered or unexported fields
}

type ManagerConfig struct {
	CA            ManagedCA
	Catalog       catalog.Catalog
	TrustDomain   spiffeid.TrustDomain
	CATTL         time.Duration
	X509CAKeyType keymanager.KeyType
	JWTKeyType    keymanager.KeyType
	CASubject     pkix.Name
	Dir           string
	Log           logrus.FieldLogger
	Metrics       telemetry.Metrics
	Clock         clock.Clock
	HealthChecker health.Checker
}

type ServerCA interface {
	SignX509SVID(ctx context.Context, params X509SVIDParams) ([]*x509.Certificate, error)
	SignX509CASVID(ctx context.Context, params X509CASVIDParams) ([]*x509.Certificate, error)
	SignJWTSVID(ctx context.Context, params JWTSVIDParams) (string, error)
}

type UpstreamClient struct {
	// contains filtered or unexported fields
}

type UpstreamClientConfig struct {
	UpstreamAuthority upstreamauthority.UpstreamAuthority
	BundleUpdater     BundleUpdater
}

type ValidateX509CAFunc = func(x509CA, x509Roots []*x509.Certificate) error

type X509CA struct {
	// Signer is used to sign child certificates.
	Signer crypto.Signer

	// Certificate is the CA certificate.
	Certificate *x509.Certificate

	// UpstreamChain contains the CA certificate and intermediates necessary to
	// chain back to the upstream trust bundle. It is only set if the CA is
	// signed by an UpstreamCA.
	UpstreamChain []*x509.Certificate
}

type X509CAEntry = journal.X509CAEntry

type X509CASVIDParams struct {
	// SPIFFE ID of the SVID
	SpiffeID spiffeid.ID

	// Public Key
	PublicKey crypto.PublicKey

	// TTL is the desired time-to-live of the SVID. Regardless of the TTL, the
	// lifetime of the certificate will be capped to that of the signing cert.
	TTL time.Duration
}

type X509CAValidator struct {
	TrustDomain spiffeid.TrustDomain
	Signer      crypto.Signer
}

type X509SVIDParams struct {
	// SPIFFE ID of the SVID
	SpiffeID spiffeid.ID

	// Public Key
	PublicKey crypto.PublicKey

	// TTL is the desired time-to-live of the SVID. Regardless of the TTL, the
	// lifetime of the certificate will be capped to that of the signing cert.
	TTL time.Duration

	// DNSList is used to add DNS SAN's to the X509 SVID. The first entry
	// is also added as the CN.
	DNSList []string

	// Subject of the SVID. Default subject is used if it is empty.
	Subject pkix.Name
}