/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */


#include "nsISupports.idl"

/**
 * An interface for verifying content-signatures, inspired by
 * https://tools.ietf.org/html/draft-thomson-http-content-signature-00
 * described here https://github.com/franziskuskiefer/content-signature/tree/pki
 *
 * A new signature verifier instance should be created for each signature
 * verification - you can create these instances with do_CreateInstance.
 *
 * There are two ways to use this functionality:
 * The first allows a signature to be verified all at once by simply calling
 * verifyContentSignature.
 * The second allows for streaming; call createContext with the signature
 * information (and initial data), call update with more data as it becomes
 * available then, finally, call end to verify the signature.
 */
[scriptable, uuid(45a5fe2f-c350-4b86-962d-02d5aaaa955a)]
interface nsIContentSignatureVerifier : nsISupports
{

  /**
   * Verifies that the data matches the data that was used to generate the
   * signature.
   *
   * @param aData                   The data to be tested.
   * @param aContentSignatureHeader The content-signature header,
   *                                url-safe base64 encoded.
   * @param aCertificateChain       The certificate chain to use for verification.
   *                                PEM encoded string.
   * @param aName                   The (host)name for which the end entity must
                                    be valid.
   * @returns true if the signature matches the data and aCertificateChain is
   *          valid within aContext, false if not.
   */
  boolean verifyContentSignature(in ACString aData, in ACString aSignature,
                                 in ACString aCertificateChain,
                                 in ACString aName);

  /**
   * Creates a context to verify a content signature against data that is added
   * later with update calls.
   *
   * @param aData                   The first chunk of data to be tested.
   * @param aContentSignatureHeader The signature of the data, url-safe base64
   *                                encoded.
   * @param aCertificateChain       The certificate chain to use for
   *                                verification. PEM encoded string.
   * @param aName                   The (host)name for which the end entity must
                                    be valid.
   */
  void createContext(in ACString aData, in ACString aSignature,
                     in ACString aCertificateChain, in ACString aName);

  /**
   * Adds data to the context that was used to generate the signature.
   *
   * @param aData        More data to be tested.
   */
  void update(in ACString aData);

  /**
   * Finalises the signature and returns the result of the signature
   * verification.
   *
   * @returns true if the signature matches the data added with createContext
   *          and update, false if not.
   */
  boolean end();

};
