// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#ifndef THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_CMS_CERTIFICATES_H_
#define THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_CMS_CERTIFICATES_H_

#include <vector>

#include "crypto/default/cms/cms_parser.h"
#include "openssl/ossl_typ.h"
#include "openssl/safestack.h"
#include "openssl/x509.h"

namespace credentio_cms {
// Parses the certificates returned in a CmsContent.
// The caller is responsible for deleting the stack returned using
// sk_X509_pop_free.
// Returns null if there is an error when parsing the certificates.
STACK_OF(X509) * GetAllCertificates(const Content& cms_content);

// Return all the embedded certificates matching the signer issuer name and
// serial number.
// The certificates are not validated so it is up to the caller to check their
// trustworthiness, if they match the sender's email address, etc.
// -  Returns the certificates matching the issuer and serial number or subject
//    key id mentioned in 'signer'.
// -  The X509 pointers returned are only valid as long as the certificates
//    stack is valid. The caller should not free them.
std::vector<X509*> GetSignerCertificates(const STACK_OF(X509) * certificates,
                                         const SignerInfo& signer);

}  // namespace credentio_cms

#endif  // THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_CMS_CERTIFICATES_H_