crypto/crypto_write_handler.h

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#ifndef THIRD_PARTY_CREDENTIO_CRYPTO_CRYPTO_WRITE_HANDLER_H_
#define THIRD_PARTY_CREDENTIO_CRYPTO_CRYPTO_WRITE_HANDLER_H_

#include <cstdint>
#include <string>
#include <vector>

#include "absl/status/statusor.h"
#include "absl/strings/string_view.h"
#include "crypto/algorithms.h"
#include "crypto/timestamp_write_handler.h"

namespace credentio {

struct SignResponse {
  // For COSE usage, this is the `signature` field of the COSE_Sign1[_Tagged]
  // structure.
  std::string signature;
};

class FixedKeySigner {
 public:
  virtual ~FixedKeySigner() = default;
  // Returns the signing algorithm.
  virtual SigningAlgorithm algorithm() const = 0;
  // Returns the expected maximum size of signatures produced by Sign().
  virtual uint64_t max_signature_byte_size() const = 0;
  // Returns the DER-encoded certificate chain.
  virtual const std::vector<std::string>& certificate_chain() const = 0;
  // Returns OCSP responses to staple, for certificates in the certificate
  // chain.
  virtual const std::vector<std::string>& ocsp_responses() const = 0;
  // For COSE usage, `to_be_signed` is the serialized Sig_Structure, as
  // specified in RFC 8152, Section 14.
  virtual absl::StatusOr<SignResponse> Sign(
      absl::string_view to_be_signed) const = 0;
};

// A handler that performs cryptographic operations required for producing
// C2PA claim signatures (specifically, signing and timestamping).
class CryptoWriteHandler : public TimestampWriteHandler {
 public:
  ~CryptoWriteHandler() override = default;
  virtual const FixedKeySigner& GetSigner() = 0;
};

}  // namespace credentio

#endif  // THIRD_PARTY_CREDENTIO_CRYPTO_CRYPTO_WRITE_HANDLER_H_