cose/ocsp_verifier.h

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#ifndef THIRD_PARTY_CREDENTIO_COSE_OCSP_VERIFIER_H_
#define THIRD_PARTY_CREDENTIO_COSE_OCSP_VERIFIER_H_

#include <string>

#include "absl/base/nullability.h"
#include "absl/time/time.h"
#include "absl/types/span.h"
#include "crypto/crypto_read_handler.h"
#include "proto/validation_status.pb.h"

namespace credentio {

// Validates the stapled OCSP responses for a certificate trust chain as
// described in
// https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html#_validate_the_credential_revocation_information.
class OcspVerifier {
 public:
  explicit OcspVerifier(
      const CryptoReadHandler* absl_nonnull crypto_read_handler)
      : crypto_read_handler_(crypto_read_handler) {}

  // Returns true and records appropriate success or informational status codes
  // if the credential status is good or unknown.
  // Returns false and records `signingCredential.ocsp.revoked` if the leaf
  // certificate is verified as revoked, or `signingCredential.untrusted` if an
  // intermediate certificate is verified as revoked.
  bool VerifyOcspResponses(absl::Span<const std::string> ocsp_responses,
                           absl::Span<const std::string> trust_chain,
                           absl::Time asserted_time,
                           ValidationStatusSet* status_set) const;

 private:
  const CryptoReadHandler* absl_nonnull crypto_read_handler_;
};

// Records that the online OCSP check was skipped.
void RecordSkippedOcspCheck(ValidationStatusSet* status_set);

}  // namespace credentio

#endif  // THIRD_PARTY_CREDENTIO_COSE_OCSP_VERIFIER_H_