/* SPDX-License-Identifier: GPL-3.0-only */
/* Persistent SSH host identity, separate from the HTTPS certificate key. */

#pragma once

#include <stddef.h>
#include <stdint.h>

#include "esp_err.h"

#ifdef __cplusplus
extern "C" {
#endif

#define SSH_SECURITY_NVS_NAMESPACE "ssh_sec"
#define SSH_SECURITY_NVS_BLOB_KEY "material"
#define SSH_SECURITY_PRIVATE_KEY_DER_CAPACITY 256U
#define SSH_SECURITY_SHA256_LENGTH 32U

#define SSH_SECURITY_KEY_TYPE "ecdsa-sha2-nistp256"
#define SSH_SECURITY_CURVE_NAME "nistp256"

typedef enum {
    SSH_SECURITY_LOAD_STORED = 0,
    SSH_SECURITY_LOAD_GENERATED_MISSING = 1,
} ssh_security_load_result_t;

typedef struct {
    uint32_t generation;
    uint8_t sha256_fingerprint[SSH_SECURITY_SHA256_LENGTH];
} ssh_security_metadata_t;

/* NVS and secure_random must be ready. Existing malformed material is not replaced. */
esp_err_t ssh_security_init(ssh_security_load_result_t *load_result);

/* Query with output NULL/capacity zero; the required length is always returned. */
esp_err_t ssh_security_copy_private_key(uint8_t *output, size_t capacity,
                                        size_t *output_length);
esp_err_t ssh_security_get_metadata(ssh_security_metadata_t *metadata);

/* Caller must stop SSH first. Rotation requires valid live material; reset replaces any stored state. */
esp_err_t ssh_security_rotate(void);
esp_err_t ssh_security_reset(void);

#ifdef __cplusplus
}
#endif