keystore

type HistoricalKeyInfo struct {
	KeyID     string
	CreatedAt time.Time
	ExpiresAt time.Time
	IsCurrent bool
}

type KeyStore interface {
	// GetCurrentKey returns the current active signing key
	GetCurrentKey(ctx context.Context) (*SigningKey, error)

	// GetKey retrieves a specific key by ID
	GetKey(ctx context.Context, keyID string) (*SigningKey, error)

	// ListKeys returns all available keys (current and historical)
	ListKeys(ctx context.Context) ([]*SigningKey, error)

	// RotateKey creates a new signing key and marks it as current
	RotateKey(ctx context.Context) (*SigningKey, error)

	// DeleteKey removes a key by ID (used to cleanup old keys after overlap period)
	DeleteKey(ctx context.Context, keyID string) error
}

type KubernetesKeyStore struct {
	// contains filtered or unexported fields
}

type KubernetesKeyStoreOption func(*KubernetesKeyStore)

type RotationManager struct {
	// contains filtered or unexported fields
}

type RotationManagerOption func(*RotationManager)

type RotationStatus struct {
	CurrentKeyID          string
	CurrentKeyCreatedAt   time.Time
	CurrentKeyExpiresAt   time.Time
	KeyAgeDays            int
	RotationThresholdDays int
	DaysUntilRotation     int
	IsRotationNeeded      bool
	OverlapDurationHours  int
	TotalKeysInStore      int
	HistoricalKeys        []HistoricalKeyInfo
}

type SigningKey struct {
	KeyID      string            `json:"key_id"`
	PrivateKey *ecdsa.PrivateKey `json:"-"` // Never serialize private key
	PublicKey  *ecdsa.PublicKey  `json:"public_key"`
	CreatedAt  time.Time         `json:"created_at"`
	ExpiresAt  time.Time         `json:"expires_at"`
	IsCurrent  bool              `json:"is_current"`
}