syntax = "proto3";
option go_package = "github.com/spiffe/spire/proto/private/server/journal";

message X509CAEntry {
    // Which X509 CA slot this entry occupied.
    string slot_id = 1;

    // When the CA was issued (unix epoch in seconds)
    int64 issued_at = 2;

    // DER encoded CA certificate
    bytes certificate = 3;

    // DER encoded upstream CA chain. See the X509CA struct for details.
    repeated bytes upstream_chain = 4;

    // The entry status
    Status status = 5;

    // The X.509 Subject Key Identifier (SKID)
    string authority_id = 6;
}

message JWTKeyEntry {
    // Which JWT Key slot this entry occupied.
    string slot_id = 1;

    // When the key was issued (unix epoch in seconds)
    int64 issued_at = 2;

    // When the key expires unix epoch in seconds)
    int64 not_after = 3;

    // JWT key id (i.e. "kid" claim)
    string kid = 4;

    // PKIX encoded public key
    bytes public_key = 5;

    // The entry status
    Status status = 6;

    // The JWT key ID
    string authority_id = 7;
}

enum Status {
    // Status is unknown.
    UNKNOWN = 0;
    
    // This holds a new authority that was prepared for future uses.
    PREPARED = 2;
    
    // This holds the active authority that is currently being used for
    // signing operations.
    ACTIVE = 3;
    
    // This holds an old authority that is no longer used.
    OLD = 4;
}

message Entries {
    repeated X509CAEntry x509CAs = 1;
    repeated JWTKeyEntry jwtKeys = 2;
}
