// Copyright IBM Corp. 2020, 2026
// SPDX-License-Identifier: BUSL-1.1

syntax = "proto3";

// Package store provides protobufs for storing types in the pki package.
package controller.storage.servers.store.v1;

import "controller/storage/timestamp/v1/timestamp.proto";

option go_package = "github.com/hashicorp/boundary/internal/server/store;store";

// CertificateAuthority is a versioned entity used to lock the database when rotation RootCertificates
message CertificateAuthority {
  // @inject_tag: `gorm:"primary_key"`
  string private_id = 10;

  // version allows optimistic locking of the resource.
  // @inject_tag: `gorm:"default:null"`
  uint32 version = 20;
}

// RootCertificate contains all fields related to a RootCertificate resource
message RootCertificate {
  // The serial number of the root certificate
  // @inject_tag: `gorm:"not_null"`
  uint64 serial_number = 10;

  // Certificate is the PEM encoded certificate.
  // @inject_tag: `gorm:"not_null"`
  bytes certificate = 20;

  // Not valid before is the timestamp at which this certificate's validity period starts
  storage.timestamp.v1.Timestamp not_valid_before = 30;

  // Not valid after is the timestamp at which this certificate's validity period ends
  storage.timestamp.v1.Timestamp not_valid_after = 40;

  // The public key associated with this certificate
  // @inject_tag: `gorm:"primary_key"`
  bytes public_key = 50;

  // The plain-text private key associated with this certificate. We are not storing this
  // in the database.
  // @inject_tag: gorm:"-" wrapping:"pt,private_key"
  bytes private_key = 60;

  // The private key associated with this certificate
  // This is a ciphertext field
  // @inject_tag: gorm:"column:private_key;not_null" wrapping:"ct,private_key"
  bytes ct_private_key = 61;

  // The id of the kms database key used for encrypting this entry.
  // @inject_tag: `gorm:"not_null"`
  string key_id = 70;

  // State is an enum value indicating if this is the next or current root cert
  // @inject_tag: `gorm:"not_null"`
  string state = 80;

  // A reference to the CertificateAuthority
  // @inject_tag: `gorm:"not_null"`
  string issuing_ca = 90;
}
