// pki.mjs: autoritate de certificare post-cuantica privata. Emite certificate X.509 v3 semnate cu ML-DSA (FIPS 204, forma "pura",
// context gol, cum cere RFC 9881 pentru certificate), liste de revocare v2 semnate la fel, si verifica un lant strict (RFC 5280, partea
// de care are nevoie un TLS privat). Numai Node 24 + OpenSSL 3.5 (node:crypto), fara dependinte.
// Ce NU face: certificate compuse (hibride clasic + PQ; sunt inca drafturi IETF), OCSP, constrangeri de nume, politici, liste delta sau
// partiale (IDP). Numele se compara pe octeti (DER identic), nu prin normalizarea completa din RFC 5280: lanturile emise aici folosesc
// aceeasi codificare.
// Revizuirea adversariala din 2026-09-25 a gasit sapte defecte, reparate aici si marcate in cod cu [A1]..[A10]: cheia pe disc sub
// PBKDF2 slab (A1), prima lista de revocare in loc de cea mai noua (A2), extensiile listei ignorate (A3), exceptie pe SPKI malformat si
// frunza cu cheie de 10 octeti admisa (A5), EKU pe autoritati neaplicat (A6), prima ancora cu acelasi nume la reinnoirea radacinii (A7),
// OID cu primul subidentificator pe mai multi octeti (A10, in der.mjs).
import crypto from 'node:crypto';
import * as D from './der.mjs';

export const ALG = {
  'ml-dsa-44': '2.16.840.1.101.3.4.3.17',
  'ml-dsa-65': '2.16.840.1.101.3.4.3.18',
  'ml-dsa-87': '2.16.840.1.101.3.4.3.19',
};
const ALG_BY_OID = Object.fromEntries(Object.entries(ALG).map(([k, v]) => [v, k]));
/** [A5] lungimea cheii publice ML-DSA, FIPS 204 tabelul 2: o cheie de alta lungime nu e o cheie, oricare ar fi OID-ul de deasupra ei. */
export const PK_LEN = { 'ml-dsa-44': 1312, 'ml-dsa-65': 1952, 'ml-dsa-87': 2592 };
const OID = {
  CN: '2.5.4.3', O: '2.5.4.10',
  basicConstraints: '2.5.29.19', keyUsage: '2.5.29.15', extKeyUsage: '2.5.29.37', subjectAltName: '2.5.29.17',
  subjectKeyIdentifier: '2.5.29.14', authorityKeyIdentifier: '2.5.29.35', crlNumber: '2.5.29.20',
  issuingDistributionPoint: '2.5.29.28', deltaCRLIndicator: '2.5.29.27',
  serverAuth: '1.3.6.1.5.5.7.3.1', clientAuth: '1.3.6.1.5.5.7.3.2',
};
const KU = { digitalSignature: 0, keyCertSign: 5, cRLSign: 6 };
const EXT_STIUTE = new Set([OID.basicConstraints, OID.keyUsage, OID.extKeyUsage, OID.subjectAltName, OID.subjectKeyIdentifier, OID.authorityKeyIdentifier]);
/** [A3] extensii de CRL pe care le intelegem (AKI, crlNumber) si extensii care schimba INTELESUL listei si pe care le refuzam oricum ar fi
 * marcate: o lista delta sau una cu punct de distributie (partiala, indirecta, numai CA, numai anumite motive) nu acopera ce pare sa acopere. */
const CRL_EXT_STIUTE = new Set([OID.authorityKeyIdentifier, OID.crlNumber]);
const CRL_EXT_REFUZATE = { [OID.issuingDistributionPoint]: 'issuingDistributionPoint', [OID.deltaCRLIndicator]: 'deltaCRLIndicator' };

export class PkiError extends Error { constructor(code, msg) { super(msg); this.code = code; } }

// ------------------------------------------------------------------------------------------------ chei

export function generateKey(alg) {
  if (!ALG[alg]) throw new PkiError('ALG', 'unsupported algorithm ' + alg + ' (ml-dsa-44, ml-dsa-65, ml-dsa-87)');
  return crypto.generateKeyPairSync(alg);
}

// [A1] Sigilarea proprie a cheii pe disc. PKCS#8 cifrat de Node (key.export cu cipher) foloseste PBKDF2 cu 2048 de iteratii, masurat la
// 3-5 ms per incercare de parola, adica o parola de 12 caractere se incearca de sute de ori pe secunda pe un singur fir. Aici cheia de
// cifrare vine din scrypt (N=2^17, r=8, p=1: 128 MiB de memorie si ~1 s per incercare pe un laptop, masurat in proba), iar DER-ul PKCS#8
// e cifrat cu AES-256-GCM, cu antetul (versiunea formatului si toti parametrii) legat ca AAD: un octet schimbat in antet sau in text
// strica eticheta de autentificare, deci "parola gresita" si "fisier atins" au acelasi raspuns, KEY_LOCKED.
//   AerePqPkiKey ::= SEQUENCE { header SEQUENCE { version INTEGER (1), kdf UTF8String "scrypt", salt OCTET STRING (16), N INTEGER,
//                     r INTEGER, p INTEGER, cipher UTF8String "aes-256-gcm", iv OCTET STRING (12) }, tag OCTET STRING (16),
//                     ciphertext OCTET STRING (PKCS#8 DER cifrat) }
// scris PEM sub eticheta KEY_LABEL. PKCS#8 clasic (cifrat sau nu) NU mai e acceptat de pe disc.
export const KEY_LABEL = 'AERE PQ PKI PRIVATE KEY';
export const SEAL = Object.freeze({ version: 1, kdf: 'scrypt', N: 2 ** 17, r: 8, p: 1, cipher: 'aes-256-gcm', saltLen: 16, ivLen: 12, tagLen: 16, maxmem: 256 * 1024 * 1024 });
const SEAL_N_MIN = 2 ** 14, SEAL_N_MAX = 2 ** 20; // la citire: sub 2^14 e prea slab ca sa fi fost scris de noi, peste 2^20 ar cere peste 1 GiB
/** Parole pe care orice dictionar le incearca primele; comparate dupa ce se scot cifrele si semnele de la coada. */
const PAROLE_EVIDENTE = new Set(['password', 'passw0rd', 'passphrase', 'qwerty', 'qwertyuiop', '123456', '12345678', '123456789', '1234567890',
  'iloveyou', 'letmein', 'welcome', 'admin', 'administrator', 'abc123', 'monkey', 'dragon', 'secret', 'changeme', 'default']);

/** [A1] Politica de parola: cel putin 12 caractere; cel putin 3 clase (minuscule, majuscule, cifre, altele) sau cel putin 20 de caractere;
 * nu toate caracterele identice; nu o parola evidenta (cu sau fara cifre/semne la coada). Arunca PkiError('PASSPHRASE'). */
export function checkPassphrase(p) {
  if (typeof p !== 'string' || p.length < 12) throw new PkiError('PASSPHRASE', 'the passphrase needs at least 12 characters');
  const clase = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/].filter((re) => re.test(p)).length;
  if (clase < 3 && p.length < 20) throw new PkiError('PASSPHRASE', 'the passphrase needs 3 character classes (lower, upper, digit, other) or at least 20 characters');
  if (/^(.)\1*$/s.test(p)) throw new PkiError('PASSPHRASE', 'a passphrase made of one repeated character is refused');
  const nucleu = p.toLowerCase().replace(/[^a-z0-9]/g, '');
  if (PAROLE_EVIDENTE.has(nucleu) || PAROLE_EVIDENTE.has(nucleu.replace(/[0-9]+$/, ''))) throw new PkiError('PASSPHRASE', 'this passphrase is on every attacker\'s first list');
  return p;
}

const sealHeader = (salt, N, r, p, iv) => D.seq(D.int(SEAL.version), D.utf8(SEAL.kdf), D.octets(salt), D.int(N), D.int(r), D.int(p), D.utf8(SEAL.cipher), D.octets(iv));

export function exportPrivateKey(key, passphrase) {
  checkPassphrase(passphrase);
  algOfKey(key);
  const salt = crypto.randomBytes(SEAL.saltLen), iv = crypto.randomBytes(SEAL.ivLen);
  const header = sealHeader(salt, SEAL.N, SEAL.r, SEAL.p, iv);
  const kek = crypto.scryptSync(passphrase, salt, 32, { N: SEAL.N, r: SEAL.r, p: SEAL.p, maxmem: SEAL.maxmem });
  const plain = key.export({ type: 'pkcs8', format: 'der' });
  const c = crypto.createCipheriv(SEAL.cipher, kek, iv, { authTagLength: SEAL.tagLen });
  c.setAAD(header);
  const ct = Buffer.concat([c.update(plain), c.final()]);
  const tag = c.getAuthTag();
  plain.fill(0); kek.fill(0);
  return pem(KEY_LABEL, D.seq(header, D.octets(tag), D.octets(ct)));
}

/** Citeste antetul unei chei sigilate fara sa o deschida (parametrii KDF, ca sa poata fi masurati). Arunca PkiError('KEY_FORMAT'). */
export function readSealedKeyHeader(pemText) {
  const blobs = unpem(pemText, KEY_LABEL);
  if (blobs.length !== 1) {
    if (/-----BEGIN (ENCRYPTED )?PRIVATE KEY-----/.test(pemText)) throw new PkiError('KEY_FORMAT', 'this is a PKCS#8 key; private keys are accepted only in the sealed "' + KEY_LABEL + '" format (scrypt + AES-256-GCM)');
    throw new PkiError('KEY_FORMAT', 'expected exactly one "' + KEY_LABEL + '" block');
  }
  let h;
  try {
    const [hdr, tagEl, ctEl, ...rest] = D.children(D.expect(D.parse(blobs[0]), D.TAG.SEQUENCE, 'sealed key'));
    if (rest.length || !ctEl) throw new Error('three parts expected');
    const [ver, kdf, salt, N, r, p, cipher, iv, ...hr] = D.children(D.expect(hdr, D.TAG.SEQUENCE, 'header'));
    if (hr.length || !iv) throw new Error('eight header fields expected');
    h = {
      version: Number(D.intToBigInt(ver)), kdf: D.expect(kdf, D.TAG.UTF8, 'kdf').content.toString('utf8'),
      salt: Buffer.from(D.expect(salt, D.TAG.OCTET_STRING, 'salt').content), N: Number(D.intToBigInt(N)), r: Number(D.intToBigInt(r)), p: Number(D.intToBigInt(p)),
      cipher: D.expect(cipher, D.TAG.UTF8, 'cipher').content.toString('utf8'), iv: Buffer.from(D.expect(iv, D.TAG.OCTET_STRING, 'iv').content),
      tag: Buffer.from(D.expect(tagEl, D.TAG.OCTET_STRING, 'tag').content), ct: Buffer.from(D.expect(ctEl, D.TAG.OCTET_STRING, 'ciphertext').content), aad: Buffer.from(hdr.raw),
    };
  } catch (e) { throw new PkiError('KEY_FORMAT', 'sealed key: ' + e.message); }
  if (h.version !== SEAL.version || h.kdf !== SEAL.kdf || h.cipher !== SEAL.cipher) throw new PkiError('KEY_FORMAT', `sealed key: unknown format (version ${h.version}, ${h.kdf}, ${h.cipher})`);
  if (h.salt.length !== SEAL.saltLen || h.iv.length !== SEAL.ivLen || h.tag.length !== SEAL.tagLen) throw new PkiError('KEY_FORMAT', 'sealed key: salt, iv or tag of the wrong length');
  if (!Number.isInteger(h.N) || h.N < SEAL_N_MIN || h.N > SEAL_N_MAX || (h.N & (h.N - 1)) !== 0 || !(h.r >= 1 && h.r <= 32) || !(h.p >= 1 && h.p <= 16)) throw new PkiError('KEY_FORMAT', `sealed key: scrypt parameters out of range (N=${h.N}, r=${h.r}, p=${h.p})`);
  return h;
}

export function importPrivateKey(pemText, passphrase) {
  const h = readSealedKeyHeader(pemText);
  if (typeof passphrase !== 'string' || !passphrase) throw new PkiError('KEY_LOCKED', 'the private key could not be opened (missing or wrong passphrase)');
  let kek;
  try { kek = crypto.scryptSync(passphrase, h.salt, 32, { N: h.N, r: h.r, p: h.p, maxmem: SEAL.maxmem }); }
  catch (e) { throw new PkiError('KEY_FORMAT', 'sealed key: scrypt refused the parameters (' + e.message + ')'); }
  let plain;
  try {
    const d = crypto.createDecipheriv(SEAL.cipher, kek, h.iv, { authTagLength: SEAL.tagLen });
    d.setAAD(h.aad); d.setAuthTag(h.tag);
    plain = Buffer.concat([d.update(h.ct), d.final()]);
  } catch { throw new PkiError('KEY_LOCKED', 'the private key could not be opened (missing or wrong passphrase)'); }
  finally { kek.fill(0); }
  try {
    const key = crypto.createPrivateKey({ key: plain, format: 'der', type: 'pkcs8' });
    algOfKey(key);
    return key;
  } catch (e) { throw new PkiError(e.code === 'ALG' ? 'ALG' : 'KEY_FORMAT', 'sealed key: the content is not an ML-DSA PKCS#8 key'); }
  finally { plain.fill(0); }
}

function algOfKey(k) {
  const t = k.asymmetricKeyType;
  if (!ALG[t]) throw new PkiError('ALG', 'key type ' + t + ' is not ML-DSA');
  return t;
}

// ------------------------------------------------------------------------------------------------ constructie

const algId = (alg) => D.seq(D.oid(ALG[alg])); // RFC 9881: parametrii LIPSESC
export function name({ cn, o }) {
  const rdn = (oid, v) => D.set(D.seq(D.oid(oid), D.utf8(v)));
  return D.seq(o ? rdn(OID.O, o) : null, rdn(OID.CN, cn));
}
function keyUsageBits(names) {
  let v = 0, hi = -1;
  for (const n of names) { const b = KU[n]; v |= 0x80 >> b; hi = Math.max(hi, b); }
  const bytes = Buffer.from([v & 0xff]);
  const unused = 7 - hi; // biti ramasi neinsemnati dupa cel mai mare bit pus (DER: fara biti zero la coada)
  return D.bits(bytes, unused);
}
const ext = (oid, critical, valueDer) => D.seq(D.oid(oid), critical ? D.bool(true) : null, D.octets(valueDer));
function keyId(spkiDer) {
  const spki = D.parse(spkiDer); const [, pk] = D.children(spki);
  return crypto.createHash('sha256').update(D.bitString(pk).bytes).digest().subarray(0, 20); // RFC 7093 metoda 1
}

function randomSerial() {
  const b = crypto.randomBytes(16);
  b[0] &= 0x7f; if (b[0] === 0) b[0] = 1;
  return b;
}

/**
 * Emite un certificat. issuer = { cert (DER) , key (KeyObject privat) } sau null pentru o radacina auto-semnata.
 * opts: { subject: {cn, o}, publicKey (KeyObject), ca: bool, pathLen?: int, days, dns?: [], ips?: [], eku?: ['serverAuth','clientAuth'], notBefore? }
 */
export function issue({ issuer, signingKey, subject, publicKey, ca = false, pathLen, days, dns = [], ips = [], eku = [], notBefore }) {
  const alg = algOfKey(signingKey);
  algOfKey(publicKey);
  const spki = publicKey.export({ type: 'spki', format: 'der' });
  const ski = keyId(spki);
  const ic = issuer ? parseCert(issuer) : null;
  const signerSpki = crypto.createPublicKey(signingKey).export({ type: 'spki', format: 'der' });
  if (ic) {
    if (!ic.isCA || !ic.keyUsage.has('keyCertSign')) throw new PkiError('ISSUER', 'the issuer certificate is not a CA with keyCertSign');
    if (!signerSpki.equals(ic.spki)) throw new PkiError('ISSUER', 'the signing key does not belong to the issuer certificate');
    if (!ic.ski) throw new PkiError('ISSUER', 'the issuer certificate has no subject key identifier');
  } else if (!signerSpki.equals(spki)) throw new PkiError('ISSUER', 'a self-signed root is signed by its own key');
  const issuerName = ic ? ic.subjectRaw : name(subject);
  const aki = ic ? ic.ski : null;
  const nb = notBefore ? new Date(notBefore) : new Date(Date.now() - 60 * 1000);
  const na = new Date(nb.getTime() + days * 86400 * 1000);
  const exts = [
    ext(OID.basicConstraints, true, D.seq(ca ? D.bool(true) : null, ca && Number.isInteger(pathLen) ? D.int(pathLen) : null)),
    ext(OID.keyUsage, true, keyUsageBits(ca ? ['digitalSignature', 'keyCertSign', 'cRLSign'] : ['digitalSignature'])),
    eku.length ? ext(OID.extKeyUsage, false, D.seq(...eku.map((e) => D.oid(OID[e])))) : null,
    dns.length || ips.length ? ext(OID.subjectAltName, false, D.seq(
      ...dns.map((d) => D.tlv(0x82, Buffer.from(d, 'ascii'))),
      ...ips.map((ip) => D.tlv(0x87, ipBytes(ip))))) : null,
    ext(OID.subjectKeyIdentifier, false, D.octets(ski)),
    aki ? ext(OID.authorityKeyIdentifier, false, D.seq(D.tlv(0x80, aki))) : null,
  ].filter(Boolean);
  const tbs = D.seq(
    D.ctx(0, D.int(2)), D.int(randomSerial()), algId(alg), issuerName,
    D.seq(D.time(nb), D.time(na)), name(subject), spki,
    D.ctx(3, D.seq(...exts)));
  const sig = crypto.sign(null, tbs, signingKey);
  return D.seq(tbs, algId(alg), D.bits(sig));
}

function ipBytes(ip) {
  const p = ip.split('.').map(Number);
  if (p.length !== 4 || p.some((x) => !(x >= 0 && x <= 255))) throw new PkiError('SAN', 'only IPv4 addresses are supported: ' + ip);
  return Buffer.from(p);
}

/** Lista de revocare v2. revoked = [{ serial (Buffer sau hex), date }]; number = numarul CRL-ului (crescator). */
export function crl({ issuer, signingKey, revoked = [], days, number, thisUpdate }) {
  const alg = algOfKey(signingKey);
  const c = parseCert(issuer);
  if (!c.isCA || !c.keyUsage.has('cRLSign')) throw new PkiError('ISSUER', 'the issuer may not sign revocation lists');
  const tu = thisUpdate ? new Date(thisUpdate) : new Date(Date.now() - 60 * 1000);
  const nu = new Date(tu.getTime() + days * 86400 * 1000);
  const rev = revoked.map((r) => D.seq(D.int(Buffer.isBuffer(r.serial) ? r.serial : Buffer.from(r.serial, 'hex')), D.time(new Date(r.date))));
  const tbs = D.seq(D.int(1), algId(alg), c.subjectRaw, D.time(tu), D.time(nu), rev.length ? D.seq(...rev) : null,
    D.ctx(0, D.seq(ext(OID.authorityKeyIdentifier, false, D.seq(D.tlv(0x80, c.ski))), ext(OID.crlNumber, false, D.int(number)))));
  return D.seq(tbs, algId(alg), D.bits(crypto.sign(null, tbs, signingKey)));
}

// ------------------------------------------------------------------------------------------------ citire

/** Extensions ::= SEQUENCE OF Extension { extnID OID, critical BOOLEAN DEFAULT FALSE, extnValue OCTET STRING }, cu forma DER ceruta. */
function parseExtensions(seqEl, what) {
  const exts = new Map();
  for (const x of D.children(D.expect(seqEl, D.TAG.SEQUENCE, what))) {
    const xs = D.children(D.expect(x, D.TAG.SEQUENCE, 'Extension'));
    const id = D.oidToString(xs[0]);
    let critical = false, val;
    if (xs.length === 3) { if (xs[1].tag !== D.TAG.BOOLEAN || xs[1].content[0] !== 0xff) throw new PkiError('DER', 'critical must be TRUE when present (DER)'); critical = true; val = xs[2]; }
    else if (xs.length === 2) val = xs[1];
    else throw new PkiError('DER', 'an Extension has two or three parts');
    if (exts.has(id)) throw new PkiError('EXT_DUP', 'extension ' + id + ' appears twice');
    exts.set(id, { critical, value: D.expect(val, D.TAG.OCTET_STRING, 'extnValue').content });
  }
  return exts;
}

export function parseCert(der) {
  const top = D.parse(der);
  D.expect(top, D.TAG.SEQUENCE, 'certificate');
  const [tbsEl, algEl, sigEl, ...rest] = D.children(top);
  if (rest.length || !sigEl) throw new PkiError('DER', 'a certificate has exactly three parts');
  const t = D.children(D.expect(tbsEl, D.TAG.SEQUENCE, 'tbsCertificate'));
  let i = 0;
  if (!t[i] || t[i].tag !== 0xa0) throw new PkiError('VERSION', 'only X.509 v3 certificates are accepted');
  const ver = D.intToBigInt(D.children(t[i++])[0]);
  if (ver !== 2n) throw new PkiError('VERSION', 'only X.509 v3 certificates are accepted');
  if (t.length < 7) throw new PkiError('DER', 'tbsCertificate is missing fields');
  const serial = t[i++].content;
  D.intToBigInt(t[i - 1]); // forma canonica si pozitiva (RFC 5280 4.1.2.2)
  const innerAlg = sigAlgOf(t[i++]);
  const issuerRaw = D.expect(t[i++], D.TAG.SEQUENCE, 'issuer').raw;
  const [nbEl, naEl] = D.children(D.expect(t[i++], D.TAG.SEQUENCE, 'validity'));
  if (!naEl) throw new PkiError('DER', 'validity has two times');
  const subjectRaw = D.expect(t[i++], D.TAG.SEQUENCE, 'subject').raw;
  const spkiEl = D.expect(t[i++], D.TAG.SEQUENCE, 'subjectPublicKeyInfo');
  // [A5] cheia publica se valideaza la citire: doua parti, BIT STRING fara biti nefolositi, si lungimea FIPS 204 a algoritmului declarat.
  // Fara asta o frunza cu o "cheie" de 10 octeti sub id-ml-dsa-65 trecea verificarea lantului (verificatorul nu foloseste cheia frunzei),
  // iar un intermediar cu aceeasi cheie arunca o exceptie din node:crypto in loc de un verdict.
  const spkiKids = D.children(spkiEl);
  if (spkiKids.length !== 2) throw new PkiError('SPKI', 'subjectPublicKeyInfo has two parts');
  const pkAlg = sigAlgOf(spkiKids[0]);
  const pkBits = D.bitString(spkiKids[1]);
  if (pkBits.unused !== 0 || pkBits.bytes.length !== PK_LEN[pkAlg]) throw new PkiError('SPKI', `the ${pkAlg} public key must be ${PK_LEN[pkAlg]} bytes, this one has ${pkBits.bytes.length}`);
  let exts = new Map();
  while (i < t.length) {
    const e = t[i++];
    if (e.tag === 0xa1 || e.tag === 0xa2) throw new PkiError('UNIQUE_ID', 'unique identifiers are not accepted');
    if (e.tag !== 0xa3 || exts.size) throw new PkiError('DER', 'unexpected field in tbsCertificate');
    const inner = D.children(e);
    if (inner.length !== 1) throw new PkiError('DER', 'extensions [3] wraps exactly one SEQUENCE');
    exts = parseExtensions(inner[0], 'extensions');
  }
  const outerAlg = sigAlgOf(algEl);
  if (outerAlg !== innerAlg) throw new PkiError('ALG_MISMATCH', 'the outer signature algorithm differs from the one inside the certificate');
  const sig = D.bitString(sigEl);
  if (sig.unused !== 0) throw new PkiError('DER', 'signature bit string has unused bits');
  const c = {
    der: Buffer.from(der), tbs: tbsEl.raw, alg: innerAlg, pkAlg, signature: sig.bytes, serial: Buffer.from(serial),
    issuerRaw: Buffer.from(issuerRaw), subjectRaw: Buffer.from(subjectRaw), spki: Buffer.from(spkiEl.raw),
    notBefore: D.timeToDate(nbEl), notAfter: D.timeToDate(naEl), exts,
    isCA: false, pathLen: undefined, keyUsage: new Set(), eku: null, dns: [], ips: [], ski: null, aki: null, unknownCritical: [],
  };
  for (const [id, x] of exts) if (x.critical && !EXT_STIUTE.has(id)) c.unknownCritical.push(id);
  const bc = exts.get(OID.basicConstraints);
  if (bc) {
    const f = D.children(D.parse(bc.value));
    if (f[0] && f[0].tag === D.TAG.BOOLEAN) { c.isCA = f[0].content[0] === 0xff; if (!c.isCA) throw new PkiError('DER', 'cA FALSE must be absent (DER)'); f.shift(); }
    if (f[0]) c.pathLen = Number(D.intToBigInt(f[0]));
  }
  const ku = exts.get(OID.keyUsage);
  if (ku) {
    const b = D.bitString(D.parse(ku.value));
    for (const [n, bit] of Object.entries(KU)) if (b.bytes.length > (bit >> 3) && (b.bytes[bit >> 3] & (0x80 >> (bit & 7)))) c.keyUsage.add(n);
  }
  const ek = exts.get(OID.extKeyUsage);
  if (ek) c.eku = new Set(D.children(D.parse(ek.value)).map((o) => D.oidToString(o)));
  const san = exts.get(OID.subjectAltName);
  if (san) for (const g of D.children(D.parse(san.value))) {
    if (g.tag === 0x82) c.dns.push(g.content.toString('ascii').toLowerCase());
    else if (g.tag === 0x87 && g.content.length === 4) c.ips.push([...g.content].join('.'));
  }
  const s = exts.get(OID.subjectKeyIdentifier);
  if (s) c.ski = Buffer.from(D.expect(D.parse(s.value), D.TAG.OCTET_STRING, 'SKI').content);
  const a = exts.get(OID.authorityKeyIdentifier);
  if (a) { const k = D.children(D.parse(a.value)).find((x) => x.tag === 0x80); if (k) c.aki = Buffer.from(k.content); }
  return c;
}

function sigAlgOf(el) {
  const f = D.children(D.expect(el, D.TAG.SEQUENCE, 'AlgorithmIdentifier'));
  if (!f.length) throw new PkiError('DER', 'empty AlgorithmIdentifier');
  const o = D.oidToString(f[0]);
  if (!ALG_BY_OID[o]) throw new PkiError('ALG', 'algorithm ' + o + ' is not ML-DSA');
  if (f.length !== 1) throw new PkiError('ALG_PARAMS', 'ML-DSA AlgorithmIdentifier must have no parameters (RFC 9881)');
  return ALG_BY_OID[o];
}

const isTime = (el) => el && (el.tag === D.TAG.UTC_TIME || el.tag === D.TAG.GEN_TIME);

/**
 * Citeste o lista de revocare v2. Intoarce { tbs, alg, signature, issuerRaw, thisUpdate, nextUpdate, revoked (Map serialHex -> Date),
 * crlNumber (BigInt|null), aki (Buffer|null), refusedExt (string|null), exts }. [A3] Extensiile listei si ale intrarilor sunt citite:
 * AKI si crlNumber sunt intelese; issuingDistributionPoint si deltaCRLIndicator sunt REFUZATE oricum ar fi marcate, si la fel orice alta
 * extensie critica (a listei sau a unei intrari). Refuzul nu e exceptie: sta in refusedExt, si verifyChain il face verdict CRL_EXT, ca o
 * lista straina cu o extensie rea sa nu opreasca verificarea unui lant pe care nu il priveste.
 */
export function parseCrl(der) {
  const top = D.parse(der);
  const [tbsEl, algEl, sigEl, ...rest] = D.children(D.expect(top, D.TAG.SEQUENCE, 'CRL'));
  if (rest.length || !sigEl) throw new PkiError('DER', 'a revocation list has exactly three parts');
  const t = D.children(D.expect(tbsEl, D.TAG.SEQUENCE, 'tbsCertList'));
  let i = 0;
  if (!t[i] || t[i].tag !== D.TAG.INTEGER || D.intToBigInt(t[i++]) !== 1n) throw new PkiError('VERSION', 'only v2 revocation lists are accepted');
  const innerAlg = sigAlgOf(t[i++]);
  const issuerRaw = D.expect(t[i++], D.TAG.SEQUENCE, 'issuer').raw;
  if (!isTime(t[i])) throw new PkiError('DER', 'thisUpdate missing');
  const thisUpdate = D.timeToDate(t[i++]);
  let nextUpdate = null;
  if (isTime(t[i])) nextUpdate = D.timeToDate(t[i++]);
  const revoked = new Map();
  let refusedExt = null;
  const refuza = (what) => { if (!refusedExt) refusedExt = what; };
  if (t[i] && t[i].tag === D.TAG.SEQUENCE) {
    for (const r of D.children(t[i++])) {
      const [s, d, ee, ...er] = D.children(D.expect(r, D.TAG.SEQUENCE, 'revoked entry'));
      if (!d || er.length) throw new PkiError('DER', 'a revoked entry has two or three parts');
      D.intToBigInt(s); // seria, in forma canonica
      if (!isTime(d)) throw new PkiError('DER', 'revocation date missing');
      revoked.set(s.content.toString('hex'), D.timeToDate(d));
      if (ee) for (const [id, x] of parseExtensions(ee, 'crlEntryExtensions')) if (x.critical) refuza(`a critical entry extension ${id}`); // reasonCode, invalidityDate: necritice, ignorate
    }
  }
  let exts = new Map(), crlNumber = null, aki = null;
  if (t[i] && t[i].tag === 0xa0) {
    const inner = D.children(t[i++]);
    if (inner.length !== 1) throw new PkiError('DER', 'crlExtensions [0] wraps exactly one SEQUENCE');
    exts = parseExtensions(inner[0], 'crlExtensions');
    for (const [id, x] of exts) {
      if (CRL_EXT_REFUZATE[id]) refuza(`${CRL_EXT_REFUZATE[id]} (${id}); delta and partial lists are not supported`);
      else if (x.critical && !CRL_EXT_STIUTE.has(id)) refuza(`an unknown critical extension ${id}`);
    }
    const n = exts.get(OID.crlNumber);
    if (n) crlNumber = D.intToBigInt(D.parse(n.value));
    const a = exts.get(OID.authorityKeyIdentifier);
    if (a) { const k = D.children(D.parse(a.value)).find((x) => x.tag === 0x80); if (k) aki = Buffer.from(k.content); }
  }
  if (i !== t.length) throw new PkiError('DER', 'unexpected field in tbsCertList');
  if (sigAlgOf(algEl) !== innerAlg) throw new PkiError('ALG_MISMATCH', 'the outer signature algorithm differs from the one inside the list');
  const sig = D.bitString(sigEl);
  if (sig.unused !== 0) throw new PkiError('DER', 'signature bit string has unused bits');
  return { tbs: tbsEl.raw, alg: innerAlg, signature: sig.bytes, issuerRaw: Buffer.from(issuerRaw), thisUpdate, nextUpdate, revoked, crlNumber, aki, refusedExt, exts };
}

// ------------------------------------------------------------------------------------------------ verificare

/** [A5] Un SPKI pe care node:crypto nu il poate importa da PkiError('SPKI'), pe care verifyChain o face verdict; niciodata exceptie bruta. */
function verifySig(tbs, signature, spkiDer, who) {
  let key;
  try { key = crypto.createPublicKey({ key: spkiDer, format: 'der', type: 'spki' }); }
  catch { throw new PkiError('SPKI', `the public key of "${who}" cannot be decoded`); }
  return crypto.verify(null, tbs, key, signature);
}

function hostMatches(pattern, host) {
  if (pattern === host) return true;
  if (pattern.startsWith('*.')) { const rest = pattern.slice(2); const dot = host.indexOf('.'); return dot > 0 && host.slice(dot + 1) === rest; }
  return false;
}

const MAX_ADANCIME = 8, MAX_DRUMURI = 32;
const cmpBig = (a, b) => ((a ?? -1n) === (b ?? -1n) ? 0 : (a ?? -1n) > (b ?? -1n) ? 1 : -1);

/**
 * Verifica un lant: leaf (DER), intermediates [DER], roots [DER] (increderea), at (Date), purpose ('serverAuth'|'clientAuth'|null),
 * host (nume sau IPv4, pentru serverAuth), crls [DER], requireCrl (fiecare emitator din lant trebuie sa aiba o lista valabila).
 * Intoarce { ok, code, reason, chain: [subject CN...] }. Intoarce intotdeauna un verdict: pe orice octeti, niciodata exceptie [A5].
 */
export function verifyChain(opts) {
  try { return verifyChainInner(opts); }
  catch (e) { return { ok: false, code: e instanceof PkiError ? e.code : 'DER', reason: String(e && e.message || e) }; }
}

function verifyChainInner({ leaf, intermediates = [], roots = [], at = new Date(), purpose = 'serverAuth', host = null, crls = [], requireCrl = false }) {
  const fail = (code, reason) => ({ ok: false, code, reason });
  let certs;
  try { certs = { leaf: parseCert(leaf), inter: intermediates.map(parseCert), roots: roots.map(parseCert) }; }
  catch (e) { return fail(e.code || 'DER', e.message); }
  const lists = [];
  try { for (const x of crls) lists.push(parseCrl(x)); } catch (e) { return fail(e.code || 'DER', 'revocation list: ' + e.message); }
  const emite = (p, c) => p.subjectRaw.equals(c.issuerRaw) && (!c.aki || (p.ski && p.ski.equals(c.aki)));

  // 1. drumurile: de la frunza in sus, emitatorul e certificatul al carui subiect e egal (pe octeti) cu emitentul si al carui SKI e AKI-ul.
  // [A7] Se incearca TOATE candidatele (intai ancorele, apoi intermediarele, fara cicluri), si primul drum care trece intreg e raspunsul:
  // la reinnoirea radacinii operatorul are doua ancore cu acelasi nume si aceeasi cheie, una expirata, si "prima gasita" refuza un lant
  // valid; la fel cu un intermediar semnat incrucisat de o radacina straina, pus inaintea celui bun.
  let blocat = certs.leaf, blocatAdancime = -1, incercate = 0; // cel mai adanc certificat fara niciun emitent candidat (pentru mesajul UNTRUSTED)
  const stiva = [certs.leaf];
  function* drumuri(cur) {
    const ancore = certs.roots.filter((r) => emite(r, cur));
    for (const r of ancore) yield [...stiva, r];
    const inter = stiva.length < MAX_ADANCIME ? certs.inter.filter((c) => c !== cur && !stiva.includes(c) && emite(c, cur)) : [];
    for (const c of inter) { stiva.push(c); yield* drumuri(c); stiva.pop(); }
    if (!ancore.length && !inter.length && stiva.length - 1 > blocatAdancime) { blocat = cur; blocatAdancime = stiva.length - 1; }
  }
  let ultimul = null;
  for (const path of drumuri(certs.leaf)) {
    if (++incercate > MAX_DRUMURI) break;
    const r = judeca(path);
    if (r.ok) return r;
    ultimul = r;
  }
  if (ultimul) return ultimul;
  return fail('UNTRUSTED', 'no trusted issuer for "' + cnOf(blocat) + '"');

  function judeca(path) {
    const top = path[path.length - 1];
    if (!top.subjectRaw.equals(top.issuerRaw) || !verifySig(top.tbs, top.signature, top.spki, cnOf(top))) return fail('ROOT', 'the trusted root is not a valid self-signed certificate');
    // 2. fiecare legatura
    for (let k = 0; k < path.length; k++) {
      const c = path[k];
      if (c.unknownCritical.length) return fail('CRITICAL_EXT', `"${cnOf(c)}" carries an unknown critical extension ${c.unknownCritical[0]}`);
      if (at < c.notBefore) return fail('NOT_YET_VALID', `"${cnOf(c)}" is not valid before ${c.notBefore.toISOString()}`);
      if (at > c.notAfter) return fail('EXPIRED', `"${cnOf(c)}" expired at ${c.notAfter.toISOString()}`);
      if (k === path.length - 1) break;
      const p = path[k + 1];
      if (!p.isCA) return fail('NOT_CA', `"${cnOf(p)}" is not a CA (basicConstraints) and cannot issue "${cnOf(c)}"`);
      if (!p.keyUsage.has('keyCertSign')) return fail('KEY_USAGE', `"${cnOf(p)}" has no keyCertSign`);
      const casBelow = path.slice(1, k + 1).filter((x) => x.isCA).length; // CA-urile intermediare de sub p, fara frunza
      if (p.pathLen !== undefined && casBelow > p.pathLen) return fail('PATH_LEN', `"${cnOf(p)}" allows ${p.pathLen} CA(s) below it, the chain has ${casBelow}`);
      // [A6] EKU pe o autoritate restrange tot ce e sub ea (OpenSSL, Chrome, Mozilla fac la fel); anyExtendedKeyUsage NU scuteste, ca la OpenSSL.
      if (purpose && p.eku && !p.eku.has(OID[purpose])) return fail('EKU', `the issuer "${cnOf(p)}" is not valid for ${purpose} (its extended key usage does not allow it)`);
      if (!verifySig(c.tbs, c.signature, p.spki, cnOf(c))) return fail('SIGNATURE', `the signature on "${cnOf(c)}" does not verify under "${cnOf(p)}"`);
      const rv = revocare(c, p);
      if (rv) return rv;
    }
    // 4. frunza
    const L = certs.leaf;
    if (purpose) {
      if (L.isCA) return fail('LEAF_IS_CA', 'a CA certificate is not accepted as an end-entity certificate');
      if (!L.keyUsage.has('digitalSignature')) return fail('KEY_USAGE', 'the end-entity certificate has no digitalSignature');
      if (L.eku && !L.eku.has(OID[purpose])) return fail('EKU', `the end-entity certificate is not valid for ${purpose}`);
    }
    if (host) {
      const h = host.toLowerCase();
      const ok = /^\d+\.\d+\.\d+\.\d+$/.test(h) ? L.ips.includes(h) : L.dns.some((d) => hostMatches(d, h));
      if (!ok) return fail('HOSTNAME', `"${cnOf(L)}" is not valid for ${host}`);
    }
    return { ok: true, code: 'OK', reason: 'valid', chain: path.map(cnOf) };
  }

  // 3. revocarea lui c de catre emitatorul p. [A2] Dintre listele emitentului care VERIFICA sub cheia lui si nu sunt datate in viitor se
  // ia cea cu thisUpdate cel mai nou (la egalitate, crlNumber cel mai mare), cum face si OpenSSL; "prima din intrare" lasa o revocare
  // proaspata sa fie ascunsa de o lista veche pusa inaintea ei. [A3] O lista cu o extensie refuzata e verdict CRL_EXT, nu e sarita.
  function revocare(c, p) {
    const ale = lists.filter((l) => l.issuerRaw.equals(p.subjectRaw));
    if (!ale.length) return requireCrl ? fail('CRL_MISSING', `no revocation list from "${cnOf(p)}"`) : null;
    const verificate = ale.filter((l) => verifySig(l.tbs, l.signature, p.spki, cnOf(p)));
    if (!verificate.length) return fail('CRL_SIGNATURE', `the revocation list of "${cnOf(p)}" does not verify`);
    const rea = verificate.find((l) => l.refusedExt);
    if (rea) return fail('CRL_EXT', `the revocation list of "${cnOf(p)}" carries ${rea.refusedExt}`);
    const curente = verificate.filter((l) => at >= l.thisUpdate);
    if (!curente.length) return fail('CRL_STALE', `the revocation list of "${cnOf(p)}" is dated in the future`);
    curente.sort((a, b) => (b.thisUpdate - a.thisUpdate) || cmpBig(b.crlNumber, a.crlNumber));
    const list = curente[0];
    if (list.nextUpdate && at > list.nextUpdate) return fail('CRL_STALE', `the revocation list of "${cnOf(p)}" is not current (nextUpdate ${list.nextUpdate.toISOString()})`);
    if (list.revoked.has(c.serial.toString('hex'))) return fail('REVOKED', `"${cnOf(c)}" is revoked by "${cnOf(p)}"`);
    return null;
  }
}

/** Semnatura unui certificat auto-semnat, verificata cu propria cheie (interoperabilitatea inversa: certificate facute de altii). */
export function selfSignatureValid(der) {
  const c = parseCert(der);
  return c.subjectRaw.equals(c.issuerRaw) && verifySig(c.tbs, c.signature, c.spki, cnOf(c));
}

export function cnOf(c) {
  try {
    for (const rdn of D.children(D.parse(c.subjectRaw))) for (const atv of D.children(rdn)) {
      const [o, v] = D.children(atv);
      if (D.oidToString(o) === OID.CN) return v.content.toString('utf8');
    }
  } catch { /* nume necitibil */ }
  return '?';
}

export const pem = (label, der) => `-----BEGIN ${label}-----\n${der.toString('base64').match(/.{1,64}/g).join('\n')}\n-----END ${label}-----\n`;
export function unpem(text, label = 'CERTIFICATE') {
  const re = new RegExp(`-----BEGIN ${label}-----([\\s\\S]*?)-----END ${label}-----`, 'g');
  const out = []; let m;
  while ((m = re.exec(text))) out.push(Buffer.from(m[1].replace(/\s+/g, ''), 'base64'));
  return out;
}