tsp/test_helpers.h

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#ifndef THIRD_PARTY_CREDENTIO_TSP_TEST_HELPERS_H_
#define THIRD_PARTY_CREDENTIO_TSP_TEST_HELPERS_H_

#include <cstdint>
#include <optional>
#include <string>
#include <variant>
#include <vector>

#include "absl/base/nullability.h"
#include "absl/strings/string_view.h"
#include "absl/time/time.h"
#include "absl/types/span.h"
#include "crypto/algorithms.h"
#include "openssl/base.h"
#include "tink/public_key_sign.h"
#include "tsp/status_codes.h"

namespace credentio {

// Wraps arbitrary data in a DER SEQUENCE.
std::string WrapDerSequence(absl::string_view payload);

// Encodes a DER INTEGER (with tag and length, no wrapping structure)
std::string EncodeDerInteger(uint64_t n);

std::string CreateTimeStampResp(absl::string_view ts_token);

std::string CreateFailedTimeStampResp(
    TspPkiStatus status, absl::Span<const absl::string_view> status_string = {},
    absl::Span<const int32_t> failure_info = {});

// If `signing_certificate_attribute` holds a string, it will be taken as the
// raw attribute value. If it holds `true` the value will be generated from
// `cert_pem`. If it holds `false`, the attribute will be omitted.
std::string CreateTimeStampTokenRsa(
    absl::Span<const absl::string_view> der_data, absl::string_view key_pem,
    absl::string_view cert_pem, bool embed_cert = true,
    std::variant<absl::string_view, bool> signing_certificate_attribute = true);

// If `signing_certificate_attribute` holds a string, it will be taken as the
// raw attribute value. If it holds `true` the value will be generated from
// `cert_pem`. If it holds `false`, the attribute will be omitted.
std::string CreateTimeStampTokenEcdsa(
    absl::Span<const absl::string_view> der_data,
    const crypto::tink::PublicKeySign& signer, absl::string_view cert_pem,
    bool embed_cert,
    std::variant<absl::string_view, bool> signing_certificate_attribute = true,
    std::optional<absl::Time> signing_time = std::nullopt);

// If `signing_certificate_attribute` holds a string, it will be taken as the
// raw attribute value. If it holds `true` the value will be generated from
// `cert_pem` and `extra_certs. If it holds `false`, the attribute will be
// omitted.
// If `use_wrong_e_content_type` is true, the eContentType will be set to
// id-data instead of id-ct-tst-info.
std::string CreateTimeStampTokenEcdsa(
    absl::Span<const absl::string_view> der_data, absl::string_view key_pem,
    absl::string_view cert_pem, bool embed_cert = true,
    std::optional<std::vector<const X509*>> extra_certs = std::nullopt,
    std::variant<absl::string_view, bool> signing_certificate_attribute = true,
    bool use_wrong_e_content_type = false);

// If supplied, `nonce` will be inserted directly into the DER SEQUENCE, so it
// must contain its own headers.
std::string CreateTstInfo(
    absl::string_view gen_time, absl::string_view message_imprint_hash,
    absl::string_view message_imprint_algorithm_txt,
    std::optional<absl::string_view> nonce = std::nullopt);

std::string CreateSigningCertificateV2Attribute(
    absl::Span<X509* absl_nonnull> certs, HashAlgorithm hash_algorithm);

}  // namespace credentio

#endif  // THIRD_PARTY_CREDENTIO_TSP_TEST_HELPERS_H_