/*
 * MIT License
 *
 * Copyright (c) 2023 Open Electronic Identity
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in all
 * copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 *
 */

namespace cdoc20.recipients;

//server recipient type
union KeyDetailsUnion {
    EccKeyDetails, RsaKeyDetails
}

// Elliptic curve type enum for ECCPublicKey recipient
enum EllipticCurve:byte {
    UNKNOWN,
    secp384r1
}

table RsaKeyDetails {
    //RSA pub key in DER - RFC8017 RSA Public Key Syntax (A.1.1) https://www.rfc-editor.org/rfc/rfc8017#page-54
    recipient_public_key:   [ubyte] (required);
}

table EccKeyDetails {
     // Elliptic curve type enum
     curve:                 EllipticCurve = UNKNOWN;

     //EC pub key in TLS 1.3 format https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.8.2
     //for secp384r1 curve: 0x04 + X 48 coord bytes + Y coord 48 bytes)
     recipient_public_key:  [ubyte] (required);
}

// ECC public key recipient
table ECCPublicKeyCapsule {
    curve:                 EllipticCurve = UNKNOWN;
    recipient_public_key:  [ubyte] (required);
    sender_public_key:     [ubyte] (required);
}

table RSAPublicKeyCapsule {
    recipient_public_key:  [ubyte] (required);
    encrypted_kek:         [ubyte] (required);
}

// recipient where ephemeral key material is download from server (server scenarios)
table KeyServerCapsule {
    // recipient id - key type specific. For public key cryptography this is usually recipient public key
    recipient_key_details: KeyDetailsUnion;
    keyserver_id:          string (required);
    transaction_id:        string (required);
}

// symmetric long term crypto
table SymmetricKeyCapsule {
    salt:                 [ubyte] (required);
}

// KDF algorithm identifier enum
enum KDFAlgorithmIdentifier:byte {
    UNKNOWN,
    PBKDF2WithHmacSHA256
}

// password derived key
table PBKDF2Capsule {
    // HKDF salt to derive KEK
    salt:                     [ubyte] (required);
    password_salt:            [ubyte] (required);
    kdf_algorithm_identifier: KDFAlgorithmIdentifier = UNKNOWN;
    kdf_iterations:           int32;
}

// ShamirKeyShare share. One per key server.
table KeyShare {
    //full url of key share, ex https://cdoc2-keyserver.dev.riaint.ee:8443/key-shares/SS0123456789ABCDEF
    //url:           string (required);

    // or server URL
    // https://cdoc2-keyserver.dev.riaint.ee:8443/
    server_base_url: string (required);

    //SS0123456789ABCDEF
    share_id:  string (required);
}

enum KeyShareRecipientType:byte {
    UNKNOWN,
    SID_MID
}

enum SharesScheme:byte {
    UNKNOWN,
    N_OF_N
}

// SymmetricKey that is split between keyservers using Shamir Secret Sharing scheme
table KeySharesCapsule {
    shares:               [KeyShare] (required);
    salt:                 [ubyte] (required);
    recipient_type:       KeyShareRecipientType = UNKNOWN;
    shares_scheme:        SharesScheme = UNKNOWN;
    recipient_id:         string (required);
}
