//! Credential metadata for access/secret keys

use serde::{Deserialize, Serialize};

use crate::PrincipalKind;

/// Argon2 parameters used to hash the secret key
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
pub struct Argon2Params {
    pub m_cost_kib: u32,
    pub t_cost: u32,
    pub p_cost: u32,
    /// Salt in base64
    pub salt_b64: String,
}

/// Stored record for an IAM credential
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
pub struct CredentialRecord {
    pub access_key_id: String,
    pub principal_id: String,
    pub principal_kind: PrincipalKind,
    pub org_id: Option<String>,
    pub project_id: Option<String>,
    pub created_at: u64,
    pub expires_at: Option<u64>,
    pub revoked: bool,
    pub description: Option<String>,
    pub secret_hash: String,
    pub secret_enc: String,
    pub key_id: String,
    pub version: u32,
    pub kdf: Argon2Params,
}

impl CredentialRecord {
    pub fn storage_key(access_key_id: &str) -> String {
        format!("iam/credentials/{}", access_key_id)
    }
}
