// CertValidator: TLS certificate chain validation interface.

#pragma once

#include <ctime>

#include <string>

#include <vector>

struct CertInfo {

  std::string subject;    // CN of this certificate

  std::string issuer;     // CN of the issuing certificate

  time_t      notBefore;  // start of validity window (Unix epoch)

  time_t      notAfter;   // end of validity window (Unix epoch)

};

// Validates TLS certificate chains for mutual authentication.

class CertValidator {

public:

  // Parameters:

  //   chain    - certificate chain: chain[0] is leaf, chain[n-1] is root

  //   hostname - peer hostname to match against the leaf certificate

  //   now      - current time for validity checks (Unix epoch)

  // Returns: true if chain is valid and leaf matches hostname; false if any

  //          cert is expired, the hostname does not match, the chain is empty,

  //          or issuer linkage is broken. Never throws.

  bool validateChain(const std::vector<CertInfo>& chain,

                     const std::string& hostname,

                     time_t now) const;

private:

  // Parameters:

  //   certSubject - CN field from the certificate (may contain wildcard prefix)

  //   hostname    - connecting peer hostname to test

  // Returns: true if hostname matches certSubject per RFC 2818 wildcard rules

  bool isHostnameMatch(const std::string& certSubject,

                       const std::string& hostname) const;

  // Parameters:

  //   cert - certificate whose validity window should be checked

  //   now  - current time (Unix epoch)

  // Returns: true if now falls within [notBefore, notAfter] inclusive

  bool checkValidity(const CertInfo& cert, time_t now) const;

};