/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "Licence").
 * You may not use this file except in compliance with the Licence.
 *
 * You can obtain a copy of the licence at @.^.^.LICENSE.
 * See the Licence for the specific language governing permissions
 * and limitations under the Licence.
 *
 * CDDL HEADER END
 *
 * Copyright (c) RISC OS Developments 2026. All rights reserved.
 * SPDX-License-Identifier: CDDL-1.0
 */

#ifndef TLSMANAGER_POLICY_H
#define TLSMANAGER_POLICY_H

#define TLSMANAGER_SHA256_SIZE 32
#define TLSMANAGER_NOT_TRUSTED 0x08u

typedef struct tlsmanager_certificate
{
    unsigned int flags;
    unsigned char fingerprint[TLSMANAGER_SHA256_SIZE];
    const struct tlsmanager_certificate *next;
} tlsmanager_certificate;

typedef struct tlsmanager_anchor
{
    unsigned char fingerprint[TLSMANAGER_SHA256_SIZE];
} tlsmanager_anchor;

int TLSManagerPolicyAccept(const tlsmanager_certificate *chain,
                           const tlsmanager_anchor *anchors,
                           unsigned int anchor_count,
                           int manifest_active);

int TLSManagerPolicyAcceptTop(
    int lower_certificates_valid,
    unsigned int top_flags,
    const unsigned char top_fingerprint[TLSMANAGER_SHA256_SIZE],
    const tlsmanager_anchor *anchors,
    unsigned int anchor_count,
    int manifest_active);

#endif
