// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package nearby.internal;

import "internal/proto/credential.proto";

// option java_api_version = 2;
option java_multiple_files = true;
option java_package = "com.google.nearby.presence";
option java_outer_classname = "LocalCredentialProto";
option optimize_for = LITE_RUNTIME;

// The local credential contains information of a local device for
// identity encryption and authentication. It should never leave the generating
// device.
// NEXT_ID=14
message LocalCredential {
  // Private signing key descriptor.
  // For Ed25519PrivateKey, both `certificate_alias` and `encrypted_key` is set.
  message PrivateKey {
    // The associated alias of a X509Certificate or a SecretKey.
    string certificate_alias = 1;

    // The raw private key bytes
    bytes key = 2;

    // The encrypted Ed25519 private key bytes.
    bytes encrypted_key = 3;
  }

  // The unique id of (and hashed based on) a pair of Secret Key and
  // X509Certificate's public key.
  bytes secret_id = 1 [deprecated = true];

  // Bytes representation of an AES Key owned by local device, to encrypt
  // local device metadata.
  bytes key_seed = 2;

  // The time in millis from epoch when this credential becomes effective.
  int64 start_time_millis = 3;

  // The time in millis from epoch when this credential expires.
  int64 end_time_millis = 4;

  // The 14 bytes aes key to encrypt metadata in PublicCredential.
  bytes metadata_encryption_key_v0 = 5;

  // It is used for signing advertisement.
  PrivateKey advertisement_signing_key = 6;

  // It is used for connection authentication.
  // nit: Content not included in this doc yet, since irreverent to the OTA
  // specs. will add more details for implementations later.
  PrivateKey connection_signing_key = 7;

  // The trust type assigned to the credential.
  IdentityType identity_type = 8;

  // The set of 2-byte salts already used to encrypt the metadata key.
  map<uint32, bool> consumed_salts = 9;

  // 16 bytes of crypto-grade random data that the credential's identity
  // provider can use to encrypt metadata in a DiscoveryCredential
  // (SharedCredential).
  bytes identity_token_v1 = 10;

  // The positive unique id of (and hashed based on) a pair of Secret Key and
  // X509Certificate's public key.
  int64 id = 11;

  // Signature algorithm version. Used to determine which algorithm to use to
  // sign data.
  string signature_version = 12 [deprecated = true];

  // Credential version used to infer the expected credential material.
  int64 credential_version = 13;
}