/*
     This file is part of GNUnet.
     Copyright (C) 2026 Taler Systems SA

     Paivana is free software; you can redistribute it and/or
     modify it under the terms of the GNU Affero General Public License
     as published by the Free Software Foundation; either version
     3, or (at your option) any later version.

     Paivana is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty
     of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
     the GNU Affero General Public License for more details.

     You should have received a copy of the GNU Affero General Public
     License along with Paivana; see the file COPYING.  If not,
     write to the Free Software Foundation, Inc., 51 Franklin
     Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/

/**
 * @author Christian Grothoff
 * @file paivana-httpd_cookie.h
 *
 * @brief cookie generation and verification logic
 */
#ifndef PAIVANA_HTTPD_COOKIE_H
#define PAIVANA_HTTPD_COOKIE_H

#include <gnunet/gnunet_util_lib.h>

/**
 * Name of the cookie in which we hand the access token to the
 * client.  It is a credential for *paivana*, not for the site we
 * proxy, and thus must never be relayed upstream.
 */
#define PAIVANA_COOKIE_NAME "Paivana-Cookie"

/**
 * Secret for the cookie generation.
 */
extern struct GNUNET_HashCode paivana_secret;


/**
 * Nonce generated client-side in Paivana protocol.
 */
struct PAIVANA_Nonce
{
  /**
   * Some 128-bit value.
   */
  uint32_t val[4];
};


/**
 * Check if the given cookie currently grants access.
 *
 * @param cookie the cookie
 * @param website URL of the site the cookie is for
 * @param ca_len number of bytes in @a ca
 * @param ca client address
 * @return true if the cookie is OK
 */
bool
PAIVANA_HTTPD_check_cookie (const char *cookie,
                            const char *website,
                            size_t ca_len,
                            const void *ca);

/**
 * Compute the `Set-Cookie` line granting access to @a website until
 * @a expiration for a client at @a ca.
 *
 * The `Path` attribute is scoped to @a website (unless
 * #PH_global_cookie), percent-encoded so that it path-matches the
 * request URI the browser will send (RFC 6265 section 5.1.4), and
 * falls back to "/" for a path that RFC 6265 section 4.1.1 cannot
 * express.  `Secure` follows #PH_base_url where that is configured.
 *
 * @param expiration expiration time of the cookie
 * @param website URL of the site the cookie is for
 * @param ca_len number of bytes in @a ca
 * @param ca client address
 * @return the value for the `Set-Cookie` header; the caller must free
 */
char *
PAIVANA_HTTPD_compute_cookie (struct GNUNET_TIME_Timestamp expiration,
                              const char *website,
                              size_t ca_len,
                              const void *ca);


/**
 * Compute the Paivana ID for the given @a expiration,
 * @a website and @a nonce.
 *
 * @param expiration end of access, as chosen by the client and bounded
 *        by the contract's `max_pickup_time`
 * @param website website to be accessed
 * @param nonce client-selected nonce
 * @return corresponding Paivana ID.
 */
char *
PAIVANA_HTTPD_compute_paivana_id (struct GNUNET_TIME_Timestamp expiration,
                                  const char *website,
                                  const struct PAIVANA_Nonce *nonce);


#endif
