#pragma once

#include <cstdint>
#include <string>
#include <vector>

namespace vesperos::profile {

class SignatureVerifier {
public:
    enum class TrustLevel {
        UNSIGNED   = 0,
        UNVERIFIED = 1,
        TRUSTED    = 2,
    };

    enum class VerifyResult {
        TRUSTED,
        UNVERIFIED,
        INVALID,
    };

    bool isCmsWrapped(const std::vector<uint8_t>& data);

    VerifyResult verify(const std::vector<uint8_t>& cmsData,
                        std::vector<uint8_t>& outPayload);

    // System CA trust bundle
    static constexpr const char* kTrustStorePath =
        "/etc/ssl/certs/ca-certificates.crt";

    // VesperOS profile signing CA (optional; installed by the vesperos-ca package)
    static constexpr const char* kVesperCaPath =
        "/etc/vesperprofiled/profile_ca.pem";
};

} // namespace vesperos::profile