"use strict";
/**
 * Configuration validation for certificate verification
 */
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.CRL_DEFAULTS = exports.OCSP_DEFAULTS = exports.DEFAULT_FAILURE_MODE = void 0;
exports.validateAndParseCertificateVerificationConfig = validateAndParseCertificateVerificationConfig;
const joi_1 = __importDefault(require("joi"));
exports.DEFAULT_FAILURE_MODE = 'fail-closed'; // Global default for certificate verification
// Default configuration values for OCSP
exports.OCSP_DEFAULTS = {
    timeout: 5000, // 5 seconds
    cacheTtl: 3600000, // 1 hour
    errorCacheTtl: 300000, // 5 minutes (shorter for faster recovery)
    failureMode: 'fail-closed',
};
// Default configuration values for CRL
exports.CRL_DEFAULTS = {
    timeout: 10000, // 10 seconds
    cacheTtl: 86400000, // 24 hours
    failureMode: 'fail-closed',
    gracePeriod: 86400000, // 24 hours after nextUpdate
};
const failureModeSchema = joi_1.default.string().valid('fail-open', 'fail-closed');
// CRL config schema that handles boolean shorthand and object config
const crlConfigSchema = joi_1.default.alternatives().try(
// Boolean shorthand: false = disabled, true = enabled with defaults
joi_1.default.boolean().custom((value) => {
    if (value === false) {
        return { enabled: false };
    }
    // true = enabled with all defaults
    return { enabled: true, ...exports.CRL_DEFAULTS };
}), 
// Object config with defaults applied
joi_1.default.object({
    enabled: joi_1.default.boolean().default(true),
    timeout: joi_1.default.number().min(1000).default(exports.CRL_DEFAULTS.timeout).messages({
        'number.min': 'CRL timeout must be at least 1000ms (1 second)',
    }),
    cacheTtl: joi_1.default.number().min(1000).default(exports.CRL_DEFAULTS.cacheTtl).messages({
        'number.min': 'CRL cacheTtl must be at least 1000ms (1 second)',
    }),
    failureMode: failureModeSchema.default(exports.CRL_DEFAULTS.failureMode),
    gracePeriod: joi_1.default.number().min(0).default(exports.CRL_DEFAULTS.gracePeriod).messages({
        'number.min': 'CRL gracePeriod must be at least 0ms',
    }),
}));
// OCSP config schema that handles boolean shorthand and object config
const ocspConfigSchema = joi_1.default.alternatives().try(
// Boolean shorthand: false = disabled, true = enabled with defaults
joi_1.default.boolean().custom((value) => {
    if (value === false) {
        return { enabled: false };
    }
    // true = enabled with all defaults
    return { enabled: true, ...exports.OCSP_DEFAULTS };
}), 
// Object config with defaults applied
joi_1.default.object({
    enabled: joi_1.default.boolean().default(true),
    timeout: joi_1.default.number().min(1000).default(exports.OCSP_DEFAULTS.timeout).messages({
        'number.min': 'OCSP timeout must be at least 1000ms (1 second)',
    }),
    cacheTtl: joi_1.default.number().min(1000).default(exports.OCSP_DEFAULTS.cacheTtl).messages({
        'number.min': 'OCSP cacheTtl must be at least 1000ms (1 second)',
    }),
    errorCacheTtl: joi_1.default.number().min(1000).default(exports.OCSP_DEFAULTS.errorCacheTtl).messages({
        'number.min': 'OCSP errorCacheTtl must be at least 1000ms (1 second)',
    }),
    failureMode: failureModeSchema.default(exports.OCSP_DEFAULTS.failureMode),
}));
// Main certificate verification schema
// Note: crl and ocsp default to "enabled with defaults" if not provided
const certificateVerificationSchema = joi_1.default.object({
    failureMode: failureModeSchema.default(exports.DEFAULT_FAILURE_MODE),
    crl: crlConfigSchema.default({ enabled: true, ...exports.CRL_DEFAULTS }),
    ocsp: ocspConfigSchema.default({ enabled: true, ...exports.OCSP_DEFAULTS }),
});
/**
 * Validate and parse certificate verification configuration
 * @param config - Certificate verification configuration to validate
 * @returns Validated and parsed configuration object
 * @throws {Error} If configuration is invalid
 */
function validateAndParseCertificateVerificationConfig(config) {
    const { error, value } = certificateVerificationSchema.validate(config, {
        abortEarly: false,
        allowUnknown: false,
    });
    if (error) {
        const errorMessage = error.details.map((detail) => detail.message).join('; ');
        throw new Error(`Invalid certificate verification configuration: ${errorMessage}`);
    }
    // Return the validated config (Joi has already done the parsing/validation)
    return value;
}
//# sourceMappingURL=configValidation.js.map