apiv1

type CertificateAuthorityCRLGenerator interface {
	CreateCRL(req *CreateCRLRequest) (*CreateCRLResponse, error)
}

type CertificateAuthorityCreator interface {
	CreateCertificateAuthority(req *CreateCertificateAuthorityRequest) (*CreateCertificateAuthorityResponse, error)
}

type CertificateAuthorityExtension struct {
	Type          string
	CertificateID string   `asn1:"optional,omitempty"`
	KeyValuePairs []string `asn1:"optional,omitempty"`
}

type CertificateAuthorityGetter interface {
	GetCertificateAuthority(req *GetCertificateAuthorityRequest) (*GetCertificateAuthorityResponse, error)
}

type CertificateAuthorityService interface {
	CreateCertificate(req *CreateCertificateRequest) (*CreateCertificateResponse, error)
	RenewCertificate(req *RenewCertificateRequest) (*RenewCertificateResponse, error)
	RevokeCertificate(req *RevokeCertificateRequest) (*RevokeCertificateResponse, error)
}

type CertificateAuthorityServiceNewFunc func(ctx context.Context, opts Options) (CertificateAuthorityService, error)

type CertificateAuthorityType int

type CertificateIssuer struct {
	Type        string `json:"type"`
	Provisioner string `json:"provisioner,omitempty"`
	Certificate string `json:"crt,omitempty"`
	Key         string `json:"key,omitempty"`
	Password    string `json:"password,omitempty"`
}

type CreateCRLRequest struct {
	RevocationList *x509.RevocationList
}

type CreateCRLResponse struct {
	CRL []byte //the CRL in DER format
}

type CreateCertificateAuthorityRequest struct {
	Name      string
	Type      CertificateAuthorityType
	Template  *x509.Certificate
	Lifetime  time.Duration
	Backdate  time.Duration
	RequestID string
	Project   string
	Location  string

	// Parent is the signer of the new CertificateAuthority.
	Parent *CreateCertificateAuthorityResponse

	// CreateKey defines the KMS CreateKeyRequest to use when creating a new
	// CertificateAuthority. If CreateKey is nil, a default algorithm will be
	// used.
	CreateKey *CreateKeyRequest
}

type CreateCertificateAuthorityResponse struct {
	Name             string
	Certificate      *x509.Certificate
	CertificateChain []*x509.Certificate
	KeyName          string
	PublicKey        crypto.PublicKey
	PrivateKey       crypto.PrivateKey
	Signer           crypto.Signer
}

type CreateCertificateRequest struct {
	Template       *x509.Certificate
	CSR            *x509.CertificateRequest
	Lifetime       time.Duration
	Backdate       time.Duration
	RequestID      string
	Provisioner    *ProvisionerInfo
	IsCAServerCert bool
}

type CreateCertificateResponse struct {
	Certificate      *x509.Certificate
	CertificateChain []*x509.Certificate
}

type CreateKeyRequest = apiv1.CreateKeyRequest

type GetCertificateAuthorityRequest struct {
	Name string
}

type GetCertificateAuthorityResponse struct {
	RootCertificate          *x509.Certificate
	IntermediateCertificates []*x509.Certificate
}

type NotImplementedError struct {
	Message string
}

type Options struct {
	// AuthorityID is the the id oc the current authority. This is used on
	// StepCAS to add information about the origin of a certificate.
	AuthorityID string `json:"-"`

	// The type of the CAS to use.
	Type string `json:"type"`

	// CertificateAuthority reference:
	// In StepCAS the value is the CA url, e.g., "https://ca.smallstep.com:9000".
	// In CloudCAS the format is "projects/*/locations/*/certificateAuthorities/*".
	// In VaultCAS the value is the url, e.g., "https://vault.smallstep.com".
	CertificateAuthority string `json:"certificateAuthority,omitempty"`

	// CertificateAuthorityFingerprint is the root fingerprint used to
	// authenticate the connection to the CA when using StepCAS.
	CertificateAuthorityFingerprint string `json:"certificateAuthorityFingerprint,omitempty"`

	// CertificateIssuer contains the configuration used in StepCAS.
	CertificateIssuer *CertificateIssuer `json:"certificateIssuer,omitempty"`

	// Path to the credentials file used in CloudCAS. If not defined the default
	// authentication mechanism provided by Google SDK will be used. See
	// https://cloud.google.com/docs/authentication.
	CredentialsFile string `json:"credentialsFile,omitempty"`

	// CertificateChain contains the issuer certificate, along with any other
	// bundled certificates to be returned in the chain to consumers. It is used
	// used in SoftCAS and it is configured in the crt property of the ca.json.
	CertificateChain []*x509.Certificate `json:"-"`

	// Signer is the private key or a KMS signer for the issuer certificate. It
	// is used in SoftCAS and it is configured in the key property of the
	// ca.json.
	Signer crypto.Signer `json:"-"`

	// CertificateSigner combines CertificateChain and Signer in a callback that
	// returns the chain of certificate and signer used to sign X.509
	// certificates in SoftCAS.
	CertificateSigner func() ([]*x509.Certificate, crypto.Signer, error) `json:"-"`

	// IsCreator is set to true when we're creating a certificate authority. It
	// is used to skip some validations when initializing a
	// CertificateAuthority. This option is used on SoftCAS and CloudCAS.
	IsCreator bool `json:"-"`

	// IsCAGetter is set to true when we're just using the
	// CertificateAuthorityGetter interface to retrieve the root certificate. It
	// is used to skip some validations when initializing a
	// CertificateAuthority. This option is used on StepCAS.
	IsCAGetter bool `json:"-"`

	// KeyManager is the KMS used to generate keys in SoftCAS.
	KeyManager kms.KeyManager `json:"-"`

	// Project, Location, CaPool and GCSBucket are parameters used in CloudCAS
	// to create a new certificate authority. If a CaPool does not exist it will
	// be created. GCSBucket is optional, if not provided GCloud will create a
	// managed bucket.
	Project    string `json:"-"`
	Location   string `json:"-"`
	CaPool     string `json:"-"`
	CaPoolTier string `json:"-"`
	GCSBucket  string `json:"-"`

	// Generic structure to configure any CAS
	Config json.RawMessage `json:"config,omitempty"`
}

type ProvisionerInfo struct {
	ID   string
	Type string
	Name string
}

type RenewCertificateRequest struct {
	Template  *x509.Certificate
	CSR       *x509.CertificateRequest
	Lifetime  time.Duration
	Backdate  time.Duration
	Token     string
	RequestID string
}

type RenewCertificateResponse struct {
	Certificate      *x509.Certificate
	CertificateChain []*x509.Certificate
}

type RevokeCertificateRequest struct {
	Certificate  *x509.Certificate
	SerialNumber string
	Reason       string
	ReasonCode   int
	PassiveOnly  bool
	RequestID    string
}

type RevokeCertificateResponse struct {
	Certificate      *x509.Certificate
	CertificateChain []*x509.Certificate
}

type SignatureAlgorithm int

type SignatureAlgorithmGetter interface {
	SignatureAlgorithm() x509.SignatureAlgorithm
}

type Type string

type ValidationError struct {
	Message string
}