certs

type Cert struct {
	// Cert is the loaded certificate.
	*tls.Certificate `json:"-"`

	// Org will be set in the CN field - should be the TrustDomain for mesh.
	Org string

	Name   string
	Domain string

	DNSSANs []string
	SPIFFE  string

	CA bool

	// If Base is set, cert will be loaded, and error generated if missing.
	// If not set and no other initialization is performed, a
	// self-signed certificate is generated.
	Base string `json:"base,omitempty"`

	// Certificates signing the private key.
	// First is the cert signing the public key, followed by any
	// certs signing previous certs. It is not required to include to
	// 'top level' root that signed the entire chain (which should be
	// in the trust roots).
	ChainPEM []byte `json:"chainPEM,omitempty"`
	KeyPEM   []byte `json:"keyPEM,omitempty"`
}

type Certs struct {
	// Local dir. If set, private key and certificates are saved there.
	// If not set, they will be loaded from SecretFS (keys), or auto-generated
	// ephemeral key are used.
	BaseDir string `json:"base,omitempty"`

	// Private key for the workload, used for signing.
	// The associated public key should be used to configure trust in this
	// workload and any identities it may use (impersonate) or delegate.
	Private crypto.PrivateKey `json:"-"`

	// CACert is a certificate associated with the private key, with the
	// CA bit set. Used to generate certificates signed by this workload.
	CACert *x509.Certificate `json:"-"`

	// FQDN is the FQDN of the workload.
	//
	// In Istio, the constant 'cluster.local' is
	// used for the mesh CA, which indicates a custom location is
	// used for the root key and use of SPIFFE certificates.
	//
	// Default to 'hostname' or env HOST and DOMAIN
	// The second component is treated as 'namespace'.
	FQDN string `json:"trustDomain,omitempty"`

	// The CA Certificate may be signed by multiple intermediaries
	// They need to be included in chains.
	// May include the top-level root - but this is not required.
	IntermediatesPEM []byte `json:"chainPEM,omitempty"`

	// For self-signed cert ('root'), this is the cert corresponding to
	// the private key. This needs to be added to the trust store.
	// This is NOT included in Intermediates - which are signatures by
	// other CAs that MUST be included in generated chains, so clients
	// can find a path to the other CAs.
	//
	// This is used if this CA is the top-level CA, signing other CAs - and
	// MUST be added to the trust store of each client.
	//
	// Since it is self-signed, the CA can re-generated this file.
	// For the chain, the signing CA (provider) must issue them again.
	CACertPEM []byte `json:"selfPEM,omitempty"`

	LoadTime time.Time `json:"-"`

	// Trust configures private CA roots as 'trusted'.
	// If no CA root is found, default is to trust the internal CA and
	// public roots.
	//
	// Each peer must have a valid certificate. If Trust is defined, the
	// cert must have a signature from one of the defined public keys.
	// This field includes CA-style keys, valid for all identities.
	Trust *MeshTrust `json:"trust"`

	// A filesystem interface for loading private keys. May also include
	// configs and certificates.
	SecretsFS fs.FS

	// A filesystem holding server certificates and configs. Loaded on-demand.
	// If a cert is not found - the internal CA will generate one.
	ConfigFS fs.FS

	// Cert is the workload certificate - should encode the primary FQDN of
	// the node.
	*Cert

	// Private key as a string (base64). EC256 is 33 bytes, ED25519 16 bytes,
	// and RSA encoded as PEM.
	PrivateString string `json:"key"`
}

type MeshTrust struct {

	// Used by mesh clients, for tickets.
	ClientSessionCache tls.ClientSessionCache `json:"-"`

	RootsPEM string `json:"roots,omitempty"`

	// This is the 'trust domain' for Istio-style certs, also
	// can be used with SERVICE.NAMESPACE.svc.DOMAIN or POD.NAMESPACE.DOMAIN
	//
	// If not set, '.local' and '.internal' are used.
	Domain []string `json:"domain"`

	// If set, limits the namespaces that are allowed to connect.
	// Same namespace and 'istio-system' are allowed by default.
	//
	// If set, no external certificates are allowed for clients.
	// Public certs for servers continue to be allowed (block internet
	// egress using network rules, not cert rules).
	AllowedNamespaces []string

	// AllowMeshExternal indicates that client certificates not signed by
	// a certPool certificare - but valid - will be allowed. The server
	// can inspect the cert chain in the connection and make
	// decisions based on the signers.
	AllowMeshExternal bool `json:"-"`
	// contains filtered or unexported fields
}

type Trust struct {
	Domain    string
	Namespace string

	RootsPEM string `json:"roots,omitempty"`

	// List of base32(public_key) to be trusted.
	RootPub32 []string

	AllowedNamespaces []string

	// If set to true, allow connections from clients not signed by the
	// trusted roots, and allow connections to servers not signed by trusted
	// roots or root CAs.
	//
	// The certificate public key will be verified out-of-band, using TOFU or
	// DNS or other mechanisms.
	AllowMeshExternal bool

	// If empty, the cluster is using system certs or SPIFFE CAs - as configured in
	// Mesh.
	//
	// Otherwise, it's the configured root certs list, in PEM format.
	// May include multiple concatenated roots.
	//
	// TODO: allow root SHA only.
	// TODO: move to trust config
	CACertPEM string `json:"ca_cert,omitempty"`

	// Expected SANs - if not set, the DNS host in the address is used.
	// For mesh FQDNs, the namespace will be checked ( second part of the FQDN )
	DNSSANs []string `json:"dns_san,omitempty"`
	//IPSANs  []string `json:"ip_san,omitempty"`
	URLSANs []string `json:"url_san,omitempty"`
	// SNI to use when making the request. Defaults to hostname in Addr
	SNI string `json:"sni,omitempty"`

	ALPN []string `json:"alpn,omitempty"`

	// Associated with a trust, used by clients.
	ClientSessionCache tls.ClientSessionCache `json:"-"`
	// contains filtered or unexported fields
}