// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#ifndef THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_DEFAULT_CRYPTO_READ_HANDLER_H_
#define THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_DEFAULT_CRYPTO_READ_HANDLER_H_

#include <memory>

#include "absl/base/nullability.h"
#include "absl/status/statusor.h"
#include "absl/strings/string_view.h"
#include "absl/time/clock_interface.h"
#include "crypto/crypto_read_handler.h"

namespace credentio {

struct DefaultCryptoReadHandlerOptions {
  // The content of the PEM file containing claim signer trust anchors,
  // trusted for claim signer certs containing the `c2pa-kp-claimSigning` EKU.
  //
  // At least one of `claim_signer_trust_anchors_pem` or
  // `legacy_claim_signer_trust_anchors_pem` must be nonempty unless
  // `skip_claim_signer_trust_checks_for_test` is true or `trust_environment`
  // is `TrustEnvironment::kAny`.
  absl::string_view claim_signer_trust_anchors_pem;

  // The content of the PEM file containing legacy claim signer trust anchors,
  // trusted for claim signer certs containing any of the EKUs
  // `id-kp-emailProtection`, `id-kp-documentSigning`, and
  // `c2pa-kp-claimSigning`.
  absl::string_view legacy_claim_signer_trust_anchors_pem;

  // The content of the PEM file containing TSA trust anchors.
  // Required unless `skip_tsa_trust_checks_for_test` is true or
  // `trust_environment` is `TrustEnvironment::kAny`.
  absl::string_view tsa_trust_anchors_pem;

  // Skips claim signer trust checks.
  bool skip_claim_signer_trust_checks_for_test = false;

  // Skips timestamp trust checks.
  bool skip_tsa_trust_checks_for_test = false;

  // The trust level of the handler.
  CryptoReadHandler::TrustEnvironment trust_environment =
      CryptoReadHandler::TrustEnvironment::kUnspecified;

  // Clock to use (e.g., for OCSP response validity checks).
  absl::Clock* clock = &absl::Clock::GetRealClock();
};

// Creates an implementation of CryptoReadHandler intended for use in
// production. It uses Tink, BoringSSL, and SimpleCmsParser.
absl::StatusOr<std::unique_ptr<CryptoReadHandler> absl_nonnull>
CreateDefaultCryptoReadHandler(const DefaultCryptoReadHandlerOptions& options);

}  // namespace credentio

#endif  // THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_DEFAULT_CRYPTO_READ_HANDLER_H_