// Copyright (c) 2021 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifndef QUICHE_QUIC_CORE_CRYPTO_CLIENT_PROOF_SOURCE_H_
#define QUICHE_QUIC_CORE_CRYPTO_CLIENT_PROOF_SOURCE_H_

#include <memory>

#include "absl/container/flat_hash_map.h"
#include "quiche/quic/core/crypto/certificate_view.h"
#include "quiche/quic/core/crypto/proof_source.h"

namespace quic {

// ClientProofSource is the interface for a QUIC client to provide client certs
// and keys based on server hostname. It is only used by TLS handshakes.
class QUIC_EXPORT_PRIVATE ClientProofSource {
 public:
  using Chain = ProofSource::Chain;

  virtual ~ClientProofSource() {}

  struct QUIC_EXPORT_PRIVATE CertAndKey {
    CertAndKey(quiche::QuicheReferenceCountedPointer<Chain> chain,
               CertificatePrivateKey private_key)
        : chain(std::move(chain)), private_key(std::move(private_key)) {}

    quiche::QuicheReferenceCountedPointer<Chain> chain;
    CertificatePrivateKey private_key;
  };

  // Get the client certificate to be sent to the server with |server_hostname|
  // and its corresponding private key. It returns nullptr if the cert and key
  // can not be found.
  //
  // |server_hostname| is typically a full domain name(www.foo.com), but it
  // could also be a wildcard domain(*.foo.com), or a "*" which will return the
  // default cert.
  virtual const CertAndKey* GetCertAndKey(
      absl::string_view server_hostname) const = 0;
};

// DefaultClientProofSource is an implementation that simply keeps an in memory
// map of server hostnames to certs.
class QUIC_EXPORT_PRIVATE DefaultClientProofSource : public ClientProofSource {
 public:
  ~DefaultClientProofSource() override {}

  // Associate all hostnames in |server_hostnames| with {|chain|,|private_key|}.
  // Elements of |server_hostnames| can be full domain names(www.foo.com),
  // wildcard domains(*.foo.com), or "*" which means the given cert chain is the
  // default one.
  // If any element of |server_hostnames| is already associated with a cert
  // chain, it will be updated to be associated with the new cert chain.
  bool AddCertAndKey(std::vector<std::string> server_hostnames,
                     quiche::QuicheReferenceCountedPointer<Chain> chain,
                     CertificatePrivateKey private_key);

  // ClientProofSource implementation
  const CertAndKey* GetCertAndKey(absl::string_view hostname) const override;

 private:
  const CertAndKey* LookupExact(absl::string_view map_key) const;
  absl::flat_hash_map<std::string, std::shared_ptr<CertAndKey>> cert_and_keys_;
};

}  // namespace quic

#endif  // QUICHE_QUIC_CORE_CRYPTO_CLIENT_PROOF_SOURCE_H_