"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.CRL_SIGNATURE_VERIFIERS = void 0;
exports.isCrlSignatureValid = isCrlSignatureValid;
const crypto_1 = __importDefault(require("crypto"));
const asn1_js_rfc5280_1 = __importDefault(require("asn1.js-rfc5280"));
const oids_1 = require("./oids");
const rsassa_pss_parser_1 = require("./rsassa_pss_parser");
function digestVerifier(digestAlg) {
    return (crl, issuerPublicKey) => {
        const tbsEncoded = asn1_js_rfc5280_1.default.TBSCertList.encode(crl.tbsCertList, 'der');
        return crypto_1.default.verify(digestAlg, tbsEncoded, issuerPublicKey, crl.signature.data);
    };
}
function pssVerifier(crl, issuerPublicKey) {
    const pssParams = (0, rsassa_pss_parser_1.parseRSASSAPSSParams)(crl.signatureAlgorithm.parameters);
    const tbsEncoded = asn1_js_rfc5280_1.default.TBSCertList.encode(crl.tbsCertList, 'der');
    return crypto_1.default.verify(pssParams.hashAlgorithm, tbsEncoded, {
        key: issuerPublicKey,
        padding: crypto_1.default.constants.RSA_PKCS1_PSS_PADDING,
        saltLength: pssParams.saltLength,
    }, crl.signature.data);
}
exports.CRL_SIGNATURE_VERIFIERS = {
    [oids_1.ALGORITHM_OID.SHA256_WITH_RSA]: digestVerifier('sha256'),
    [oids_1.ALGORITHM_OID.SHA384_WITH_RSA]: digestVerifier('sha384'),
    [oids_1.ALGORITHM_OID.SHA512_WITH_RSA]: digestVerifier('sha512'),
    [oids_1.ALGORITHM_OID.ECDSA_WITH_SHA256]: digestVerifier('sha256'),
    [oids_1.ALGORITHM_OID.ECDSA_WITH_SHA384]: digestVerifier('sha384'),
    [oids_1.ALGORITHM_OID.ECDSA_WITH_SHA512]: digestVerifier('sha512'),
    [oids_1.ALGORITHM_OID.RSASSA_PSS]: pssVerifier,
};
function isCrlSignatureValid(crl, issuerPublicKey) {
    const signatureAlgOid = crl.signatureAlgorithm.algorithm.join('.');
    const verifier = exports.CRL_SIGNATURE_VERIFIERS[signatureAlgOid];
    if (!verifier) {
        throw new Error(`Unsupported signature algorithm: ${signatureAlgOid}`);
    }
    return verifier(crl, issuerPublicKey);
}
//# sourceMappingURL=crl_signature_verifier.js.map