const (
    TokenExchange = "token_exchange"
    CSR           = "csr"
)

const (

    // RootCertReqResourceName is resource name of discovery request for root certificate.
    RootCertReqResourceName = "ROOTCA"

    // WorkloadKeyCertResourceName is the resource name of the discovery request for workload
    // identity.
    // TODO: change all the pilot one reference definition here instead.
    WorkloadKeyCertResourceName = "default"
)

var (

    // ExistingRootCertFile is the well-known path for an existing root certificate file
    ExistingRootCertFile = defaultRootCertFilePath
)

var (
    RequestType = monitoring.MustCreateLabel("request_type")
)

type ConnKey struct {
    ConnectionID string

    // ResourceName of SDS request, get from SDS.DiscoveryRequest.ResourceName
    // Current it's `ROOTCA` for root cert request, and 'default' for normal key/cert request.
    ResourceName string
}

type Options struct {
    // secret TTL.
    SecretTTL time.Duration

    // The initial backoff time in millisecond to avoid the thundering herd problem.
    InitialBackoffInMilliSec int64

    // secret should be refreshed before it expired, SecretRefreshGraceDuration is the grace period;
    // secret should be refreshed if time.Now.After(secret.CreateTime + SecretTTL - SecretRefreshGraceDuration)
    SecretRefreshGraceDuration time.Duration

    // Key rotation job running interval.
    RotationInterval time.Duration

    // Cached secret will be removed from cache if (time.now - secretItem.CreatedTime >= evictionDuration), this prevents cache growing indefinitely.
    EvictionDuration time.Duration

    // TrustDomain corresponds to the trust root of a system.
    // https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
    TrustDomain string

    // authentication provider specific plugins.
    Plugins []plugin.Plugin

    // set this flag to true for if token used is always valid(ex, normal k8s JWT)
    AlwaysValidTokenFlag bool

    // set this flag to true if skip validate format for certificate chain returned from CA.
    SkipValidateCert bool

    // Whether to generate PKCS#8 private keys.
    Pkcs8Keys bool
}

type SecretCache struct {
    // contains filtered or unexported fields
}

type SecretManager interface {
    // GenerateSecret generates new secret and cache the secret.
    GenerateSecret(ctx context.Context, connectionID, resourceName, token string) (*model.SecretItem, error)

    // ShouldWaitForIngressGatewaySecret indicates whether a valid ingress gateway secret is expected.
    ShouldWaitForIngressGatewaySecret(connectionID, resourceName, token string) bool

    // SecretExist checks if secret already existed.
    // This API is used for sds server to check if coming request is ack request.
    SecretExist(connectionID, resourceName, token, version string) bool

    // DeleteSecret deletes a secret by its key from cache.
    DeleteSecret(connectionID, resourceName string)
}