/**
 * @license
 * Copyright 2022-2026 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
import { Bytes, CertificateError, Diagnostic, PublicKey } from "#general";
import { FabricId } from "#types";
import { Certificate } from "./Certificate.js";
import { ExtensionKeyUsageSchema } from "./definitions/base.js";
import { OperationalCertificate } from "./definitions/operational.js";
import { OperationalBase } from "./OperationalBase.js";
class Rcac extends OperationalBase {
  /** Construct the class from a Tlv version of the certificate */
  static fromTlv(tlv) {
    return new Rcac(OperationalCertificate.TlvRcac.decode(tlv));
  }
  static publicKeyOfTlv(tlv) {
    return Rcac.fromTlv(tlv).cert.ellipticCurvePublicKey;
  }
  /** Construct the class from an ASN.1/DER encoded certificate */
  static fromAsn1(asn1) {
    const cert = Certificate.parseAsn1Certificate(asn1);
    return new Rcac(cert);
  }
  /** Validates all basic certificate fields on construction. */
  validateFields() {
    const {
      extensions: {
        basicConstraints: { isCa }
      }
    } = this.cert;
    if (!isCa) {
      throw new CertificateError("Root certificate must be a CA.");
    }
  }
  /**
   * Encodes the certificate with the signature as Matter Tlv.
   * If the certificate is not signed, it throws a CertificateError.
   */
  asSignedTlv() {
    return OperationalCertificate.TlvRcac.encode({ ...this.cert, signature: this.signature.bytes });
  }
  /**
   * Verify requirements a Matter Root certificate must fulfill.
   * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
   */
  async verify(crypto) {
    this.generalVerify();
    const { subject, extensions } = this.cert;
    const { fabricId, rcacId } = subject;
    const { basicConstraints, subjectKeyIdentifier, authorityKeyIdentifier } = extensions;
    if ("nodeId" in subject) {
      throw new CertificateError(`Root certificate must not contain a nodeId.`);
    }
    if (fabricId !== void 0) {
      if (Array.isArray(fabricId)) {
        throw new CertificateError(`Invalid fabricId in NoC certificate: ${Diagnostic.json(fabricId)}`);
      }
      if (fabricId === FabricId(0)) {
        throw new CertificateError(`Invalid fabricId in NoC certificate: ${Diagnostic.json(fabricId)}`);
      }
    }
    if ("icacId" in subject) {
      throw new CertificateError(`Root certificate must not contain an icacId.`);
    }
    if (rcacId === void 0 || Array.isArray(rcacId)) {
      throw new CertificateError(`Invalid rcacId in Root certificate: ${Diagnostic.json(rcacId)}`);
    }
    if ("caseAuthenticatedTags" in subject) {
      throw new CertificateError(`Root certificate must not contain a caseAuthenticatedTags.`);
    }
    if ("vvsId" in subject) {
      throw new CertificateError(`Root certificate must not contain a vvsId.`);
    }
    if (basicConstraints.isCa !== true) {
      throw new CertificateError(`Root certificate must have isCa set to true.`);
    }
    const keyUsage = ExtensionKeyUsageSchema.encode(extensions.keyUsage);
    if (keyUsage !== 96 && keyUsage !== 97) {
      throw new CertificateError(
        `Root certificate keyUsage must have keyCertSign and CRLSign and optionally digitalSignature set.`
      );
    }
    if (extensions.extendedKeyUsage !== void 0) {
      throw new CertificateError(`Root certificate must not have extendedKeyUsage set.`);
    }
    if (subjectKeyIdentifier === void 0) {
      throw new CertificateError(`Root certificate must have subjectKeyIdentifier set.`);
    }
    if (subjectKeyIdentifier.byteLength !== 20) {
      throw new CertificateError(`Root certificate subjectKeyIdentifier must be 160 bit.`);
    }
    if (authorityKeyIdentifier === void 0) {
      throw new CertificateError(`Root certificate must have authorityKeyIdentifier set.`);
    }
    if (authorityKeyIdentifier.byteLength !== 20) {
      throw new CertificateError(`Root certificate authorityKeyIdentifier must be 160 bit.`);
    }
    if (!Bytes.areEqual(authorityKeyIdentifier, subjectKeyIdentifier)) {
      throw new CertificateError(
        `Root certificate authorityKeyIdentifier must be equal to subjectKeyIdentifier.`
      );
    }
    await crypto.verifyEcdsa(PublicKey(this.cert.ellipticCurvePublicKey), this.asUnsignedDer(), this.signature);
  }
}
export {
  Rcac
};
//# sourceMappingURL=Rcac.js.map
