#ifndef THIRD_PARTY_MILOTIC_EXTERNAL_CC_TLBMC_CREDENTIALS_CREDENTIAL_MANAGER_H_
#define THIRD_PARTY_MILOTIC_EXTERNAL_CC_TLBMC_CREDENTIALS_CREDENTIAL_MANAGER_H_

#include <cstdint>
#include <optional>
#include <string>
#include <string_view>
#include <tuple>
#include <vector>

#include "owner_certificate/owner_verification_cert_configuration.pb.h"
#include "absl/status/status.h"
#include "absl/status/statusor.h"
#include "absl/strings/string_view.h"
#include "resource.pb.h"
#include "zatar/g3_misc.h"
#include "openssl/evp.h"

namespace milotic_tlbmc {

class CredentialManager {
 public:
  struct CsrParams {
    std::string country;
    std::string state;
    std::string city;
    std::string organization;
    std::string organizational_unit;
    std::string common_name;
    std::vector<std::string> alternative_names;

    bool operator==(const CsrParams& other) const {
      return std::tie(country, state, city, organization, organizational_unit,
                      common_name, alternative_names) ==
             std::tie(other.country, other.state, other.city,
                      other.organization, other.organizational_unit,
                      other.common_name, other.alternative_names);
    }
  };

  // Generates a CSR (Certificate Signing Request) for the private key.
  // We will return the CSR string in PEM format and store the private key in
  // memory.
  // The old private key will be overwritten.
  virtual absl::StatusOr<std::string> GenerateCsr(
      const CsrParams& csr_params) = 0;

  virtual absl::Status InstallServerCert(std::string_view certificate) = 0;

  virtual ~CredentialManager() = default;

  virtual bssl::UniquePtr<EVP_PKEY> GetPrivateKey() const = 0;

  virtual std::optional<std::string> GetOwnerVerificationCert() const = 0;

  virtual absl::Status InstallTrustBundle(std::string_view trust_bundle,
                                          std::string_view signature) = 0;

  virtual absl::Status InstallOsVerificationCertificate(
      std::string_view cert_string) = 0;

  virtual absl::Status InstallSerialConsoleTrustedUserCAKeys(
      std::string_view trusted_user_ca_keys, std::string_view signature) = 0;

  virtual absl::Status InstallSyslogCert(std::string_view cert_string,
                                         std::string_view target_ip,
                                         int64_t target_port,
                                         SyslogProtocol protocol,
                                         SyslogTlsMode tls_mode) = 0;

  virtual std::optional<owner_certificate::OwnerVerificationCertConfiguration>
  GetOwnerVerificationCertConfiguration() const = 0;

  virtual std::optional<std::string> GetBmcSshTrustedUserCAKeysSignature()
      const = 0;

  virtual std::optional<std::string> GetTrustBundle() const = 0;

  virtual std::optional<std::string> GetTrustBundleSignature() const = 0;

  virtual std::optional<std::string> GetServerCert() const = 0;

  virtual std::optional<std::string> GetOsVerificationCert() const = 0;

  virtual std::optional<std::string> GetSerialConsoleTrustedUserCAKeys()
      const = 0;

  virtual std::optional<std::string> GetSerialConsoleDetatchedSignature()
      const = 0;

  virtual std::optional<SyslogTargetConfig> GetSyslogClientConf() const = 0;

  virtual std::optional<std::string> GetSyslogRootCert() const = 0;

  virtual bool IsFirmwareUpdateable() const = 0;

 protected:
  CredentialManager() = default;
};

}  // namespace milotic_tlbmc

#endif  // THIRD_PARTY_MILOTIC_EXTERNAL_CC_TLBMC_CREDENTIALS_CREDENTIAL_MANAGER_H_