const (
    TokenExchange = "token_exchange"
    CSR           = "csr"
)

const (

    // RootCertReqResourceName is resource name of discovery request for root certificate.
    RootCertReqResourceName = "ROOTCA"

    // WorkloadKeyCertResourceName is the resource name of the discovery request for workload
    // identity.
    // TODO: change all the pilot one reference definition here instead.
    WorkloadKeyCertResourceName = "default"
)

var (
    RequestType = monitoring.MustCreateLabel("request_type")
)

type ConnKey struct {
    ConnectionID string

    // ResourceName of SDS request, get from SDS.DiscoveryRequest.ResourceName
    // Current it's `ROOTCA` for root cert request, and 'default' for normal key/cert request.
    ResourceName string
}

type SecretCache struct {
    // contains filtered or unexported fields
}

type SecretManager interface {
    // GenerateSecret generates new secret and cache the secret.
    // Current implementation constructs the SAN based on the token's 'sub'
    // claim, expected to be in the K8S format. No other JWTs are currently supported
    // due to client logic. If JWT is missing/invalid, the resourceName is used.
    GenerateSecret(ctx context.Context, connectionID, resourceName, token string) (*security.SecretItem, error)

    // ShouldWaitForGatewaySecret indicates whether a valid gateway secret is expected.
    ShouldWaitForGatewaySecret(connectionID, resourceName, token string, fileMountedCertsOnly bool) bool

    // SecretExist checks if secret already existed.
    // This API is used for sds server to check if coming request is ack request.
    SecretExist(connectionID, resourceName, token, version string) bool

    // DeleteSecret deletes a secret by its key from cache.
    DeleteSecret(connectionID, resourceName string)
}