trust

type ASLocalRecurser struct {
	IA addr.IA
}

type AuthRouter struct {
	ISD    addr.ISD
	Router snet.Router
	DB     TRCRead
}

type BaseInserter struct {
	DB ReadWrite
	// Unsafe allows inserts of base TRCs. This is used as a workaround until
	// TAAC support is implemented.
	Unsafe bool
}

type ChainID struct {
	IA      addr.IA
	Version scrypto.Version
}

type ChainRead interface {
	// GetRawChain returns the raw signed certificate chain bytes. If it is not
	// found, ErrNotFound is returned.
	GetRawChain(ctx context.Context, id ChainID) ([]byte, error)
	// ChainExists returns whether the certificate chain is found in the
	// database and the content matches. ErrContentMismatch is returned if any
	// of the two certificates exist in the database with differing contents.
	ChainExists(ctx context.Context, d decoded.Chain) (bool, error)
}

type ChainReq struct {
	IA      addr.IA
	Version scrypto.Version
}

type ChainWrite interface {
	// InsertChain inserts the certificate chain. The call returns true in the
	// first return value, if the certificate chain was inserted, or false if it
	// already existed and the contents matches. The second return value
	// indicates whether the issuer certificate was inserted, or it already
	// existed. ErrContentMismatch is returned if any of the two certificates
	// exist in the database with differing contents.
	InsertChain(ctx context.Context, d decoded.Chain) (bool, bool, error)
}

type Config struct {
	// MustHaveLocalChain states that chain requests for the trust store's own
	// IA must always return a valid chain. This is set to true on infra
	// services BS, CS, PS and false on others.
	MustHaveLocalChain bool
	// ServiceType is the type of the service that uses the store.
	ServiceType proto.ServiceType
	// Router is used to determine paths to other ASes.
	Router snet.Router
	// TopoProvider provides the local topology.
	TopoProvider topology.Provider
}

type CryptoProvider interface {
	// AnnounceTRC announces the existence of a TRC, it must be called before
	// verifying a signature based on a certificate chain to ensure the TRC in
	// the signature source is available to the CryptoProvider.
	AnnounceTRC(context.Context, TRCID, infra.TRCOpts) error
	// GetTRC asks the trust store to return a valid and active TRC for isd,
	// unless inactive TRCs are specifically allowed. The optionally configured
	// server is queried over the network if the TRC is not available locally.
	// Otherwise, the default server is queried. How the default server is
	// determined differs between implementations.
	GetTRC(context.Context, TRCID, infra.TRCOpts) (*trc.TRC, error)
	// GetRawTRC behaves the same as GetTRC, except returning the raw signed TRC.
	GetRawTRC(context.Context, TRCID, infra.TRCOpts) ([]byte, error)
	// GetRawChain asks the trust store to return a valid and active certificate
	// chain, unless inactive chains are specifically allowed. The optionally
	// configured server is queried over the network if the certificate chain is
	// not available locally. Otherwise, the default server is queried. How the
	// default server is determined differs between implementations.
	GetRawChain(context.Context, ChainID, infra.ChainOpts) ([]byte, error)
	// GetASKey returns from trust store the public key required to verify
	// signature originated from an AS.
	GetASKey(context.Context, ChainID, infra.ChainOpts) (scrypto.KeyMeta, error)
}

type DB interface {
	ReadWrite
	// BeginTransaction starts a transaction.
	BeginTransaction(ctx context.Context, opts *sql.TxOptions) (Transaction, error)
	db.LimitSetter
	io.Closer
}

type DBRead interface {
	TRCRead
	ChainRead
}

type DBWrite interface {
	TRCWrite
	ChainWrite
}

type DefaultInserter struct {
	BaseInserter
}

type DefaultInspector struct {
	Provider CryptoProvider
}

type DefaultRPC struct {
	Msgr Messenger
}

type DefaultResolver struct {
	DB       DBRead
	Inserter Inserter
	RPC      RPC
	IA       addr.IA
}

type ForwardingInserter struct {
	BaseInserter
	Router LocalRouter
	RPC    RPC
}

type Inserter interface {
	// InsertTRC verifies the signed TRC and inserts it into the database.
	// The previous TRC is queried through the provider function, when necessary.
	InsertTRC(ctx context.Context, decTRC decoded.TRC, trcProvider TRCProviderFunc) error
	// InsertChain verifies the signed certificate chain and inserts it into the
	// database. The issuing TRC is queried through the provider function, when
	// necessary.
	InsertChain(ctx context.Context, decChain decoded.Chain, trcProvider TRCProviderFunc) error
}

type Inspector interface {
	// ByAttributes returns a list of primary ASes in the specified ISD that hold
	// all the requested attributes.
	ByAttributes(ctx context.Context, isd addr.ISD, opts infra.ASInspectorOpts) ([]addr.IA, error)
	// HasAttributes indicates whether an AS holds all the specified attributes.
	// The first return value is always false for non-primary ASes.
	HasAttributes(ctx context.Context, ia addr.IA, opts infra.ASInspectorOpts) (bool, error)
}

type KeyInfo struct {
	TRC     TRCInfo
	Version scrypto.KeyVersion
}

type KeyRing interface {
	// PrivateKey returns the private key for the given usage and version. If it
	// is not in the key ring, an error is returned.
	PrivateKey(usage keyconf.Usage, version scrypto.KeyVersion) (keyconf.Key, error)
}

type LocalOnlyRecurser struct{}

type LocalRouter struct {
	IA addr.IA
}

type Messenger interface {
	GetTRC(ctx context.Context, msg *cert_mgmt.TRCReq, a net.Addr,
		id uint64) (*cert_mgmt.TRC, error)
	GetCertChain(ctx context.Context, msg *cert_mgmt.ChainReq, a net.Addr,
		id uint64) (*cert_mgmt.Chain, error)
	SendTRC(ctx context.Context, msg *cert_mgmt.TRC, a net.Addr, id uint64) error
	SendCertChain(ctx context.Context, msg *cert_mgmt.Chain, a net.Addr, id uint64) error
}

type Provider struct {
	DB       DBRead
	Recurser Recurser
	Resolver Resolver
	Router   Router
}

type RPC interface {
	GetTRC(context.Context, TRCReq, net.Addr) ([]byte, error)
	GetCertChain(context.Context, ChainReq, net.Addr) ([]byte, error)
	SendTRC(context.Context, []byte, net.Addr) error
	SendCertChain(context.Context, []byte, net.Addr) error
}

type ReadWrite interface {
	DBRead
	DBWrite
}

type Recurser interface {
	// AllowRecursion indicates whether the recursion is allowed for the
	// provided Peer. Recursions started by the local trust store have a nil
	// address and should generally be allowed. The nil value indicates
	// recursion is allowed. Non-nil return values indicate that recursion is
	// not allowed and specify the reason.
	AllowRecursion(peer net.Addr) error
}

type Resolver interface {
	// TRC resolves the decoded signed TRC. Missing links in the TRC
	// verification chain are also requested.
	TRC(ctx context.Context, req TRCReq, server net.Addr) (decoded.TRC, error)
	// Chain resolves the raw signed certificate chain. If the issuing TRC is
	// missing, it is also requested.
	Chain(ctx context.Context, req ChainReq, server net.Addr) (decoded.Chain, error)
}

type Router interface {
	// ChooseServer determines the remote server for trust material with the
	// subject in the provided ISD.
	ChooseServer(ctx context.Context, subjectISD addr.ISD) (net.Addr, error)
}

type Signer struct {
	// contains filtered or unexported fields
}

type SignerConf struct {
	ChainVer scrypto.Version
	TRCVer   scrypto.Version
	Validity scrypto.Validity
	Key      keyconf.Key
}

type SignerGen struct {
	IA       addr.IA
	KeyRing  KeyRing
	Provider CryptoProvider
}

type Store struct {
	Inspector
	CryptoProvider
	Inserter Inserter
	DB       DB
}

type TRCID struct {
	ISD     addr.ISD
	Version scrypto.Version
}

type TRCInfo struct {
	Validity    scrypto.Validity
	GracePeriod time.Duration
	Version     scrypto.Version
}

type TRCProviderFunc func(context.Context, TRCID) (*trc.TRC, error)

type TRCRead interface {
	// TRCExists returns whether the TRC is found in the database and the
	// content matches. ErrContentMismatch is returned if the TRC is in the
	// database with differing contents.
	TRCExists(ctx context.Context, d decoded.TRC) (bool, error)
	// GetTRC returns the TRC. If it is not found, ErrNotFound is returned.
	GetTRC(ctx context.Context, id TRCID) (*trc.TRC, error)
	// GetRawTRC returns the raw signed TRC bytes. If it is not found,
	// ErrNotFound is returned.
	GetRawTRC(ctx context.Context, id TRCID) ([]byte, error)
	// GetTRCInfo returns the infos for the requested TRC. If it is not found,
	// ErrNotFound is returned.
	GetTRCInfo(ctx context.Context, id TRCID) (TRCInfo, error)
	// GetIssuingGrantKeyInfo returns the infos of the requested AS. If it is
	// not found, ErrNotFound is returned.
	GetIssuingGrantKeyInfo(ctx context.Context, ia addr.IA,
		version scrypto.Version) (KeyInfo, error)
}

type TRCReq struct {
	ISD     addr.ISD
	Version scrypto.Version
}

type TRCWrite interface {
	// InsertTRC inserts the TRCs. The call returns true if the TRC was
	// inserter, or false if it already existed and the content matches.
	// ErrContentMismatch is returned if the TRC is in the database with
	// differing contents.
	InsertTRC(ctx context.Context, d decoded.TRC) (bool, error)
}

type Transaction interface {
	ReadWrite
	// Commit commits the transaction.
	Commit() error
	// Rollback rollbacks the transaction.
	Rollback() error
}