"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.getCertificateCrlUrls = void 0;
exports.getCertificateDebugName = getCertificateDebugName;
exports.isShortLivedCertificate = isShortLivedCertificate;
exports.isCertificateRevoked = isCertificateRevoked;
exports.isIssuingDistributionPointExtensionValid = isIssuingDistributionPointExtensionValid;
const logger_1 = __importDefault(require("../../logger"));
function getCertificateDebugName(certificate) {
    return [
        `O:${certificate.subject.O}`,
        `CN:${certificate.subject.CN}`,
        `SN:${certificate.serialNumber}`,
    ].join(',');
}
const getCertificateCrlUrls = (certificateName, decodedCertificate) => {
    const logDebug = (msg, ...msgArgs) => (0, logger_1.default)().debug(`getCertificateCrlUrls[${certificateName}]: ${msg}`, ...msgArgs);
    const crlExtension = decodedCertificate.tbsCertificate.extensions?.find((ext) => ext.extnID === 'cRLDistributionPoints');
    if (!crlExtension) {
        logDebug('certificate doesnt have cRLDistributionPoints extension');
        return null;
    }
    const result = [];
    for (const entry of crlExtension.extnValue) {
        if (!entry.distributionPoint) {
            logDebug('skipping entry without distributionPoint %j', entry);
            continue;
        }
        for (const fullNameEntry of entry.distributionPoint.value) {
            if (fullNameEntry.type !== 'uniformResourceIdentifier') {
                logDebug('skipping non-uniformResourceIdentifier entry %j', fullNameEntry);
                continue;
            }
            if (fullNameEntry.value.startsWith('http')) {
                // Even though the spec allows multiple http urls, we only pick first one and don't handle redundancy
                result.push(fullNameEntry.value);
                break;
            }
            else {
                logDebug('skipping non-http value %j', fullNameEntry);
            }
        }
    }
    logDebug(`found URLs: ${result.join(',')}`);
    return result.length > 0 ? result : null;
};
exports.getCertificateCrlUrls = getCertificateCrlUrls;
/**
 * See Short-lived Subscriber Certificate section\
 * https://cabforum.org/working-groups/server/baseline-requirements/requirements/
 */
function isShortLivedCertificate(decodedCertificate) {
    const notBefore = new Date(decodedCertificate.tbsCertificate.validity.notBefore.value);
    const notAfter = new Date(decodedCertificate.tbsCertificate.validity.notAfter.value);
    let maximumValidityPeriod = 7 * 24 * 60 * 60 * 1000; // 7 days in milliseconds
    if (notBefore < new Date('2026-03-15T00:00:00.000Z')) {
        maximumValidityPeriod = 10 * 24 * 60 * 60 * 1000; // 10 days in milliseconds
    }
    maximumValidityPeriod += 60 * 1000; // Fix inclusion start and end time (1 minute)
    const certValidityPeriod = notAfter.getTime() - notBefore.getTime();
    return maximumValidityPeriod > certValidityPeriod;
}
function isCertificateRevoked(decodedCertificate, crl) {
    for (const revokedCert of crl.tbsCertList.revokedCertificates) {
        if (revokedCert.userCertificate.eq(decodedCertificate.tbsCertificate.serialNumber)) {
            return true;
        }
    }
    return false;
}
function isIssuingDistributionPointExtensionValid(crl, expectedCrlUrl) {
    const issuingDistributionPointExtension = crl.tbsCertList.crlExtensions?.find((ext) => ext.extnID === 'issuingDistributionPoint');
    if (!issuingDistributionPointExtension) {
        (0, logger_1.default)().debug(`CRL ${expectedCrlUrl} doesnt have issuingDistributionPoint extension, ignoring`);
        return true;
    }
    for (const fullNameEntry of issuingDistributionPointExtension.extnValue.distributionPoint.value) {
        if (fullNameEntry.type === 'uniformResourceIdentifier' &&
            fullNameEntry.value === expectedCrlUrl) {
            return true;
        }
    }
    return false;
}
//# sourceMappingURL=certificate_utils.js.map