import {z} from 'zod'

export type GetApiV3GlobalAssetCertificateCertificateIdArgs = {organization_id?: string | undefined, 'X-Organization-ID'?: string | undefined, certificate_id: string};

export type GetApiV3GlobalAssetCertificateCertificateIdOptions = {baseUrl?: string | undefined, PersonalAccessToken?: string | undefined, fetch?: typeof fetch | undefined};

export const ctRecord = z.object({added_to_ct_at: z.string().optional(), ct_to_censys_at: z.string().optional(), index: z.number().int().optional()});

export const ct = z.object({entries: z.record(z.string(), ctRecord).optional()});

export const authorityInfoAccess = z.object({issuer_urls: z.array(z.string()).nullable().optional(), ocsp_urls: z.array(z.string()).nullable().optional()});

export const basicConstraints = z.object({is_ca: z.boolean().optional(), max_path_len: z.number().int().optional()});

export const cabfOrganizationId = z.object({country: z.string().optional(), reference: z.string().optional(), scheme: z.string().optional(), state: z.string().optional()});

export const noticeReference = z.object({notice_numbers: z.array(z.number().int()).nullable().optional(), organization: z.string().optional()});

export const userNotice = z.object({explicit_text: z.string().optional(), notice_reference: noticeReference.optional()});

export const certificatePolicy = z.object({cps: z.array(z.string()).nullable().optional(), id: z.string().optional(), user_notice: z.array(userNotice).nullable().optional()});

export const extendedKeyUsage = z.object({any: z.boolean().optional(), apple_code_signing: z.boolean().optional(), apple_code_signing_development: z.boolean().optional(), apple_code_signing_third_party: z.boolean().optional(), apple_crypto_development_env: z.boolean().optional(), apple_crypto_env: z.boolean().optional(), apple_crypto_maintenance_env: z.boolean().optional(), apple_crypto_production_env: z.boolean().optional(), apple_crypto_qos: z.boolean().optional(), apple_crypto_test_env: z.boolean().optional(), apple_crypto_tier0_qos: z.boolean().optional(), apple_crypto_tier1_qos: z.boolean().optional(), apple_crypto_tier2_qos: z.boolean().optional(), apple_crypto_tier3_qos: z.boolean().optional(), apple_ichat_encryption: z.boolean().optional(), apple_ichat_signing: z.boolean().optional(), apple_resource_signing: z.boolean().optional(), apple_software_update_signing: z.boolean().optional(), apple_system_identity: z.boolean().optional(), client_auth: z.boolean().optional(), code_signing: z.boolean().optional(), dvcs: z.boolean().optional(), eap_over_lan: z.boolean().optional(), eap_over_ppp: z.boolean().optional(), email_protection: z.boolean().optional(), ipsec_end_system: z.boolean().optional(), ipsec_intermediate_system_usage: z.boolean().optional(), ipsec_tunnel: z.boolean().optional(), ipsec_user: z.boolean().optional(), microsoft_ca_exchange: z.boolean().optional(), microsoft_cert_trust_list_signing: z.boolean().optional(), microsoft_csp_signature: z.boolean().optional(), microsoft_document_signing: z.boolean().optional(), microsoft_drm: z.boolean().optional(), microsoft_drm_individualization: z.boolean().optional(), microsoft_efs_recovery: z.boolean().optional(), microsoft_embedded_nt_crypto: z.boolean().optional(), microsoft_encrypted_file_system: z.boolean().optional(), microsoft_enrollment_agent: z.boolean().optional(), microsoft_kernel_mode_code_signing: z.boolean().optional(), microsoft_key_recovery_21: z.boolean().optional(), microsoft_key_recovery_3: z.boolean().optional(), microsoft_license_server: z.boolean().optional(), microsoft_licenses: z.boolean().optional(), microsoft_lifetime_signing: z.boolean().optional(), microsoft_mobile_device_software: z.boolean().optional(), microsoft_nt5_crypto: z.boolean().optional(), microsoft_oem_whql_crypto: z.boolean().optional(), microsoft_qualified_subordinate: z.boolean().optional(), microsoft_root_list_signer: z.boolean().optional(), microsoft_server_gated_crypto: z.boolean().optional(), microsoft_sgc_serialized: z.boolean().optional(), microsoft_smart_display: z.boolean().optional(), microsoft_smartcard_logon: z.boolean().optional(), microsoft_system_health: z.boolean().optional(), microsoft_system_health_loophole: z.boolean().optional(), microsoft_timestamp_signing: z.boolean().optional(), microsoft_whql_crypto: z.boolean().optional(), netscape_server_gated_crypto: z.boolean().optional(), ocsp_signing: z.boolean().optional(), sbgp_cert_aa_service_auth: z.boolean().optional(), server_auth: z.boolean().optional(), time_stamping: z.boolean().optional(), unknown: z.array(z.string()).nullable().optional()});

export const distinguishedName = z.object({common_name: z.array(z.string()).nullable().optional(), country: z.array(z.string()).nullable().optional(), domain_component: z.array(z.string()).nullable().optional(), email_address: z.array(z.string()).nullable().optional(), given_name: z.array(z.string()).nullable().optional(), jurisdiction_country: z.array(z.string()).nullable().optional(), jurisdiction_locality: z.array(z.string()).nullable().optional(), jurisdiction_province: z.array(z.string()).nullable().optional(), locality: z.array(z.string()).nullable().optional(), organization: z.array(z.string()).nullable().optional(), organization_id: z.array(z.string()).nullable().optional(), organizational_unit: z.array(z.string()).nullable().optional(), postal_code: z.array(z.string()).nullable().optional(), province: z.array(z.string()).nullable().optional(), serial_number: z.array(z.string()).nullable().optional(), street_address: z.array(z.string()).nullable().optional(), surname: z.array(z.string()).nullable().optional()});

export const ediPartyName = z.object({name_assigner: z.string().optional(), party_name: z.string().optional()});

export const otherName = z.object({id: z.string().optional(), value: z.string().optional()});

export const generalNames = z.object({directory_names: z.array(distinguishedName).nullable().optional(), dns_names: z.array(z.string()).nullable().optional(), edi_party_names: z.array(ediPartyName).nullable().optional(), email_addresses: z.array(z.string()).nullable().optional(), ip_addresses: z.array(z.string()).nullable().optional(), other_names: z.array(otherName).nullable().optional(), registered_ids: z.array(z.string()).nullable().optional(), uniform_resource_identifiers: z.array(z.string()).nullable().optional()});

export const keyUsage = z.object({certificate_sign: z.boolean().optional(), content_commitment: z.boolean().optional(), crl_sign: z.boolean().optional(), data_encipherment: z.boolean().optional(), decipher_only: z.boolean().optional(), digital_signature: z.boolean().optional(), encipher_only: z.boolean().optional(), key_agreement: z.boolean().optional(), key_encipherment: z.boolean().optional(), value: z.number().int().gte(0).optional()});

export const generalSubtreeIp = z.object({begin: z.string().optional(), cidr: z.string().optional(), end: z.string().optional(), mask: z.string().optional()});

export const nameConstraints = z.object({critical: z.boolean().optional(), excluded_directory_names: z.array(distinguishedName).nullable().optional(), excluded_edi_party_names: z.array(ediPartyName).nullable().optional(), excluded_email_addresses: z.array(z.string()).nullable().optional(), excluded_ip_addresses: z.array(generalSubtreeIp).nullable().optional(), excluded_names: z.array(z.string()).nullable().optional(), excluded_registered_ids: z.array(z.string()).nullable().optional(), excluded_uris: z.array(z.string()).nullable().optional(), permitted_directory_names: z.array(distinguishedName).nullable().optional(), permitted_edi_party_names: z.array(ediPartyName).nullable().optional(), permitted_email_addresses: z.array(z.string()).nullable().optional(), permitted_ip_addresses: z.array(generalSubtreeIp).nullable().optional(), permitted_names: z.array(z.string()).nullable().optional(), permitted_registered_ids: z.array(z.string()).nullable().optional(), permitted_uris: z.array(z.string()).nullable().optional()});

export const qcStatementsQCLegislation = z.object({country_codes: z.array(z.string()).nullable().optional()});

export const qcStatementsMonetaryValue = z.object({amount: z.number().int().optional(), currency: z.string().optional(), currency_number: z.number().int().optional(), exponent: z.number().int().optional()});

export const qcStatementsPdsLocation = z.object({language: z.string().optional(), url: z.string().optional()});

export const qcStatementsQcType = z.object({ids: z.array(z.string()).nullable().optional()});

export const qcStatementsParsedStatements = z.object({etsi_compliance: z.array(z.boolean()).nullable().optional(), legislation: z.array(qcStatementsQCLegislation).nullable().optional(), limit: z.array(qcStatementsMonetaryValue).nullable().optional(), pds_locations: z.array(qcStatementsPdsLocation).nullable().optional(), retention_period: z.array(z.number().int()).nullable().optional(), sscd: z.array(z.boolean()).nullable().optional(), types: z.array(qcStatementsQcType).nullable().optional()});

export const qcStatements = z.object({ids: z.array(z.string()).nullable().optional(), parsed: qcStatementsParsedStatements.optional()});

export const signedCertificateTimestampSignature = z.object({hash_algorithm: z.string().optional(), signature: z.string().optional(), signature_algorithm: z.string().optional()});

export const signedCertificateTimestamp = z.object({log_id: z.string().optional(), signature: signedCertificateTimestampSignature.optional(), timestamp: z.string().optional(), version: z.number().int().optional()});

export const torServiceDescriptor = z.object({algorithm_name: z.string().optional(), hash: z.string().optional(), hash_bits: z.number().int().optional(), onion: z.string().optional()});

export const certificateExtensions = z.object({authority_info_access: authorityInfoAccess.optional(), authority_key_id: z.string().optional(), basic_constraints: basicConstraints.optional(), cabf_organization_id: cabfOrganizationId.optional(), certificate_policies: z.array(certificatePolicy).nullable().optional(), crl_distribution_points: z.array(z.string()).nullable().optional(), ct_poison: z.boolean().optional(), extended_key_usage: extendedKeyUsage.optional(), issuer_alt_name: generalNames.optional(), key_usage: keyUsage.optional(), name_constraints: nameConstraints.optional(), qc_statements: qcStatements.optional(), signed_certificate_timestamps: z.array(signedCertificateTimestamp).nullable().optional(), subject_alt_name: generalNames.optional(), subject_key_id: z.string().optional(), tor_service_descriptors: z.array(torServiceDescriptor).nullable().optional()});

export const keyAlgorithm = z.object({name: z.string().optional(), oid: z.string().optional()});

export const signature = z.object({self_signed: z.boolean().optional(), signature_algorithm: keyAlgorithm.optional(), valid: z.boolean().optional(), value: z.string().optional()});

export const dsaPublicKey = z.object({g: z.string().optional(), p: z.string().optional(), q: z.string().optional(), y: z.string().optional()});

export const ecdsaPublicKey = z.object({b: z.string().optional(), curve: z.string().optional(), gx: z.string().optional(), gy: z.string().optional(), length: z.number().int().optional(), n: z.string().optional(), p: z.string().optional(), pub: z.string().optional(), x: z.string().optional(), y: z.string().optional()});

export const rsaPublicKey = z.object({exponent: z.number().int().optional(), length: z.number().int().optional(), modulus: z.string().optional()});

export const unrecognizedPublicKey = z.object({raw: z.string().optional()});

export const subjectKeyInfo = z.object({dsa: dsaPublicKey.optional(), ecdsa: ecdsaPublicKey.optional(), fingerprint_sha256: z.string().optional(), key_algorithm: keyAlgorithm.optional(), rsa: rsaPublicKey.optional(), unrecognized: unrecognizedPublicKey.optional()});

export const extension = z.object({critical: z.boolean().optional(), id: z.string().optional(), value: z.string().optional()});

export const validityPeriod = z.object({length_seconds: z.number().int().optional(), not_after: z.string().optional(), not_before: z.string().optional()});

export const certificateParsed = z.object({extensions: certificateExtensions.optional(), issuer: distinguishedName.optional(), issuer_dn: z.string().optional(), ja4x: z.string().optional(), redacted: z.boolean().optional(), serial_number: z.string().optional(), serial_number_hex: z.string().optional(), signature: signature.optional(), subject: distinguishedName.optional(), subject_dn: z.string().optional(), subject_key_info: subjectKeyInfo.optional(), unknown_extensions: z.array(extension).nullable().optional(), validity_period: validityPeriod.optional(), version: z.number().int().optional()});

export const certificateRevocationRevocationInfo = z.object({next_update: z.string().optional(), reason: z.enum(["", "unspecified", "key_compromise", "ca_compromise", "affiliation_changed", "superseded", "cessation_of_operation", "certificate_hold", "remove_from_crl", "privilege_withdrawn", "aa_compromise"]).optional(), revocation_time: z.string().optional(), revoked: z.boolean().optional()});

export const certificateRevocation = z.object({crl: certificateRevocationRevocationInfo.optional(), ocsp: certificateRevocationRevocationInfo.optional()});

export const rootStoreChain = z.object({sha256fp: z.array(z.string()).nullable().optional()});

export const rootStore = z.object({chains: z.array(rootStoreChain).nullable().optional(), ever_valid: z.boolean().optional(), had_trusted_path: z.boolean().optional(), has_trusted_path: z.boolean().optional(), in_revocation_set: z.boolean().optional(), is_valid: z.boolean().optional(), parents: z.array(z.string()).nullable().optional(), type: z.enum(["", "root", "intermediate", "leaf"]).optional()});

export const validation = z.object({apple: rootStore.optional(), chrome: rootStore.optional(), microsoft: rootStore.optional(), nss: rootStore.optional()});

export const zLint = z.object({errors_present: z.boolean().optional(), failed_lints: z.array(z.string()).nullable().optional(), fatals_present: z.boolean().optional(), notices_present: z.boolean().optional(), timestamp: z.string().optional(), version: z.number().int().optional(), warnings_present: z.boolean().optional()});

export const certificate = z.object({added_at: z.string().optional(), ct: ct.optional(), ever_seen_in_scan: z.boolean().optional(), fingerprint_md5: z.string().optional(), fingerprint_sha1: z.string().optional(), fingerprint_sha256: z.string().optional(), modified_at: z.string().optional(), names: z.array(z.string()).nullable().optional(), parent_spki_fingerprint_sha256: z.string().optional(), parent_spki_subject_fingerprint_sha256: z.string().optional(), parse_status: z.enum(["", "success", "fail", "corrupted"]).optional(), parsed: certificateParsed.optional(), precert: z.boolean().optional(), revocation: certificateRevocation.optional(), revoked: z.boolean().optional(), spki_fingerprint_sha256: z.string().optional(), spki_subject_fingerprint_sha256: z.string().optional(), tbs_fingerprint_sha256: z.string().optional(), tbs_no_ct_fingerprint_sha256: z.string().optional(), validated_at: z.string().optional(), validation: validation.optional(), validation_level: z.enum(["", "dv", "ov", "ev"]).optional(), zlint: zLint.optional()});

export const certificateAsset = z.object({extensions: z.record(z.string(), z.unknown()), resource: certificate});

export const responseEnvelopeCertificateAsset = z.object({result: certificateAsset.optional()});

export const validateResponse = async <Output>(
  schema: {
    readonly '~standard': {
      readonly validate: (value: unknown) => ({ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }> | undefined }> }) | Promise<{ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }> | undefined }> }>
    }
  },
  value: unknown
): Promise<Output> => {
  const result = await schema['~standard'].validate(value)

  if (result.issues !== undefined) {
    const detail = result.issues
      .map(({ message, path }) =>
        path?.length
          ? `${path.map((segment) => String(typeof segment === 'object' ? segment.key : segment)).join('.')}: ${message}`
          : message
      )
      .join('; ')

    throw new Error(`Response does not match the schema: ${detail}`, { cause: { issues: result.issues } })
  }

  return result.value
};

/**
 * Get a certificate
 * 
 * GET /v3/global/asset/certificate/{certificate_id}
 */
export const getApiV3GlobalAssetCertificateCertificateId = async (args: GetApiV3GlobalAssetCertificateCertificateIdArgs, options?: GetApiV3GlobalAssetCertificateCertificateIdOptions) => {
const {baseUrl = "https://api.platform.censys.io", fetch: fetchFn = fetch, PersonalAccessToken} = options ?? {}

const query = new URLSearchParams()
const headers = new Headers()
headers.set('accept', "application/vnd.censys.api.v3.certificate.v1+json")

if (args.organization_id != null) query.append("organization_id", String(args.organization_id))
if (args['X-Organization-ID'] != null) headers.set("X-Organization-ID", String(args['X-Organization-ID']))
if (PersonalAccessToken !== undefined) headers.set('authorization', `Bearer ${PersonalAccessToken}`)

const url = `${baseUrl.replace(/\/+$/, '')}/v3/global/asset/certificate/${encodeURIComponent(String(args.certificate_id))}${query.size > 0 ? `?${query}` : ''}`

const res = await fetchFn(url, {method: "GET", headers})

if (!res.ok) throw new Error(`Request failed with status ${res.status}`, {cause: {status: res.status, body: await res.text()}})

return validateResponse(responseEnvelopeCertificateAsset, await res.json())
};