tsp/verified_timestamp.h

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#ifndef THIRD_PARTY_CREDENTIO_TSP_VERIFIED_TIMESTAMP_H_
#define THIRD_PARTY_CREDENTIO_TSP_VERIFIED_TIMESTAMP_H_

#include <string>
#include <utility>
#include <vector>

#include "absl/status/status.h"
#include "absl/status/statusor.h"
#include "absl/strings/string_view.h"
#include "absl/time/time.h"
#include "absl/types/span.h"
#include "crypto/algorithms.h"

namespace credentio {

// Represents a TimeStampToken (RFC 3161 section 2.4.2) that has passed
// signature checks. The trustworthiness of signatures is not checked, callers
// should verify this before use.
class VerifiedTimestamp final {
 public:
  static absl::StatusOr<VerifiedTimestamp> Create(
      absl::Time asserted_time, std::vector<std::string> certificate_chain,
      std::string message_imprint_hash,
      HashAlgorithm message_imprint_hash_algorithm, std::string nonce) {
    if (certificate_chain.empty()) {
      return absl::InvalidArgumentError("certificate_chain must not be empty");
    }
    return VerifiedTimestamp(asserted_time, std::move(certificate_chain),
                             std::move(message_imprint_hash),
                             message_imprint_hash_algorithm, std::move(nonce));
  }

  // The time at which the timestamp was generated (genTime in RFC 3161).
  absl::Time asserted_time() const { return asserted_time_; }

  // The signing certificate of the Time Stamping Authority (TSA), DER-encoded.
  absl::string_view tsa_certificate() const {
    return certificate_chain_.front();
  }

  // The full certificate chain of the TSA, starting with the signing
  // certificate, DER-encoded.
  absl::Span<const std::string> certificate_chain() const {
    return certificate_chain_;
  }

  // The hash value of the data that was timestamped (hashedMessage in RFC
  // 3161).
  absl::string_view message_imprint_hash() const {
    return message_imprint_hash_;
  }

  // The hash algorithm used to calculate the message imprint.
  HashAlgorithm message_imprint_hash_algorithm() const {
    return message_imprint_hash_algorithm_;
  }

  // The ASN.1 / DER INTEGER element, with tag / length prefix. May be empty if
  // the field was absent in the source TimeStampToken.
  absl::string_view nonce() const { return nonce_; }

 private:
  VerifiedTimestamp(absl::Time asserted_time,
                    std::vector<std::string>&& certificate_chain,
                    std::string&& message_imprint_hash,
                    HashAlgorithm message_imprint_hash_algorithm,
                    std::string nonce)
      : asserted_time_(asserted_time),
        certificate_chain_(std::move(certificate_chain)),
        message_imprint_hash_(std::move(message_imprint_hash)),
        message_imprint_hash_algorithm_(message_imprint_hash_algorithm),
        nonce_(std::move(nonce)) {}

  absl::Time asserted_time_;
  std::vector<std::string> certificate_chain_;
  std::string message_imprint_hash_;
  HashAlgorithm message_imprint_hash_algorithm_;
  std::string nonce_;
};

}  // namespace credentio

#endif  // THIRD_PARTY_CREDENTIO_TSP_VERIFIED_TIMESTAMP_H_