package net.siegeln.cameleer.saas.certificate;

/**
 * Provider interface for certificate file management.
 * Docker implementation writes to the certs volume.
 * K8s implementation would manage TLS Secrets.
 */
public interface CertificateManager {

    boolean isAvailable();

    /** Read metadata of the active certificate from the provider storage. */
    CertificateInfo getActive();

    /** Read metadata of the staged certificate, or null. */
    CertificateInfo getStaged();

    /** Read metadata of the archived certificate, or null. */
    CertificateInfo getArchived();

    /**
     * Write cert+key+ca to staging area and validate.
     * Does NOT activate — call {@link #activate()} to promote.
     */
    CertValidationResult stage(byte[] certPem, byte[] keyPem, byte[] caBundlePem);

    /** Promote staged -> active. Moves current active to archive (deleting previous archive). */
    void activate();

    /** Swap archived <-> active. */
    void restore();

    /** Delete staged files. */
    void discardStaged();

    /** Generate a self-signed certificate for the given hostname and store as active. */
    void generateSelfSigned(String hostname);

    /** Read the current CA bundle bytes, or null if none exists. */
    byte[] getCaBundle();
}
