/**
 * @license
 * Copyright 2022-2026 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
import { Bytes, CertificateError, Diagnostic, PublicKey } from "#general";
import { CaseAuthenticatedTag, FabricId, NodeId } from "#types";
import { Certificate } from "./Certificate.js";
import { OperationalCertificate } from "./definitions/operational.js";
import { OperationalBase } from "./OperationalBase.js";
class Noc extends OperationalBase {
  /** Construct the class from a Tlv version of the certificate */
  static fromTlv(tlv) {
    return new Noc(OperationalCertificate.TlvNoc.decode(tlv));
  }
  /** Construct the class from an ASN.1/DER encoded certificate */
  static fromAsn1(asn1) {
    const cert = Certificate.parseAsn1Certificate(asn1);
    return new Noc(cert);
  }
  /** Validates all basic certificate fields on construction. */
  validateFields() {
    const {
      issuer: { icacId, rcacId },
      extensions: {
        basicConstraints: { isCa }
      }
    } = this.cert;
    if (icacId === void 0 && rcacId === void 0) {
      throw new CertificateError("Issuer RCAC or ICAC ID must be defined for an operational certificate.");
    }
    if (isCa) {
      throw new CertificateError("Node operational certificate must not be a CA.");
    }
  }
  /**
   * Encodes the certificate with the signature as Matter Tlv.
   * If the certificate is not signed, it throws a CertificateError.
   */
  asSignedTlv() {
    return OperationalCertificate.TlvNoc.encode({ ...this.cert, signature: this.signature.bytes });
  }
  /**
   * Verify requirements a Matter Node Operational certificate must fulfill.
   * Rules for this are listed in @see {@link MatterSpecification.v12.Core} §6.5.x
   */
  async verify(crypto, root, ica) {
    this.generalVerify();
    const {
      subject,
      extensions: { extendedKeyUsage, subjectKeyIdentifier, authorityKeyIdentifier }
    } = this.cert;
    const { nodeId, fabricId, caseAuthenticatedTags } = subject;
    const {
      subject: { fabricId: rootFabricId }
    } = root.cert;
    const {
      subject: { fabricId: icaFabricId }
    } = ica?.cert ?? { subject: {} };
    if (nodeId === void 0 || Array.isArray(nodeId)) {
      throw new CertificateError(`Invalid nodeId in NoC certificate: ${Diagnostic.json(nodeId)}`);
    }
    if (!NodeId.isOperationalNodeId(nodeId)) {
      throw new CertificateError(`Invalid nodeId in NoC certificate: ${Diagnostic.json(nodeId)}`);
    }
    if (fabricId === void 0 || Array.isArray(fabricId)) {
      throw new CertificateError(`Invalid fabricId in NoC certificate: ${Diagnostic.json(fabricId)}`);
    }
    if (fabricId === FabricId(0)) {
      throw new CertificateError(`Invalid fabricId in NoC certificate: ${Diagnostic.json(fabricId)}`);
    }
    if ("icacId" in subject) {
      throw new CertificateError(`Noc certificate must not contain an icacId.`);
    }
    if ("rcacId" in subject) {
      throw new CertificateError(`Noc certificate must not contain an rcacId.`);
    }
    if ("vvsId" in subject) {
      throw new CertificateError(`Noc certificate must not contain a vvsId.`);
    }
    if (caseAuthenticatedTags !== void 0) {
      CaseAuthenticatedTag.validateNocTagList(caseAuthenticatedTags);
    }
    if (rootFabricId !== void 0 && rootFabricId !== fabricId) {
      throw new CertificateError(
        `FabricId in NoC certificate does not match the fabricId in the parent certificate. ${Diagnostic.json(
          rootFabricId
        )} !== ${Diagnostic.json(fabricId)}`
      );
    }
    if (icaFabricId !== void 0 && icaFabricId !== fabricId) {
      throw new CertificateError(
        `FabricId in NoC certificate does not match the fabricId in the parent certificate. ${Diagnostic.json(
          icaFabricId
        )} !== ${Diagnostic.json(fabricId)}`
      );
    }
    if (this.cert.extensions.basicConstraints.isCa) {
      throw new CertificateError(`Noc certificate must not have isCa set to true.`);
    }
    if (!this.cert.extensions.keyUsage.digitalSignature) {
      throw new CertificateError(`Noc certificate must have keyUsage set to digitalSignature.`);
    }
    if (extendedKeyUsage === void 0 || !extendedKeyUsage.includes(1) && !extendedKeyUsage.includes(2)) {
      throw new CertificateError(
        `Noc certificate must have extendedKeyUsage with serverAuth and clientAuth: ${Diagnostic.json(extendedKeyUsage)}`
      );
    }
    if (subjectKeyIdentifier === void 0) {
      throw new CertificateError(`Noc certificate must have subjectKeyIdentifier set.`);
    }
    if (subjectKeyIdentifier.byteLength !== 20) {
      throw new CertificateError(`Noc certificate subjectKeyIdentifier must be 160 bit.`);
    }
    if (authorityKeyIdentifier === void 0) {
      throw new CertificateError(`Noc certificate must have authorityKeyIdentifier set.`);
    }
    if (authorityKeyIdentifier.byteLength !== 20) {
      throw new CertificateError(`Noc certificate authorityKeyIdentifier must be 160 bit.`);
    }
    let issuer;
    if (Bytes.areEqual(authorityKeyIdentifier, root.cert.extensions.subjectKeyIdentifier)) {
      issuer = root;
    } else if (ica !== void 0 && Bytes.areEqual(authorityKeyIdentifier, ica.cert.extensions.subjectKeyIdentifier)) {
      issuer = ica;
    }
    if (issuer === void 0) {
      throw new CertificateError(
        `Noc certificate authorityKeyIdentifier must be equal to Root/Ica subjectKeyIdentifier.`
      );
    }
    await crypto.verifyEcdsa(PublicKey(issuer.cert.ellipticCurvePublicKey), this.asUnsignedDer(), this.signature);
  }
}
export {
  Noc
};
//# sourceMappingURL=Noc.js.map
