/*
  StarForth — Steady-State Virtual Machine Runtime

  Copyright (c) 2023–2025 Robert A. James
  All rights reserved.

  Licensed under the StarForth License, Version 1.0
*/

#ifndef __STARKERNEL__
#error "vm_identity.c is kernel-only"
#endif

#include "starkernel/vm_identity.h"
#include "starkernel/x509_ed25519.h"
#include <string.h>

int vm_identity_has_cap(const VMIdentity *id, uint32_t cap) {
    if (!id || !id->installed) return 0;
    return (id->acl_caps & cap) == cap;
}

int vm_identity_from_cert(VMIdentity *out, const uint8_t *der, size_t der_len,
                           const uint8_t issuer_pubkey[32],
                           const uint8_t drive_uuid[16], uint32_t acl_caps) {
    if (!out || !der || !issuer_pubkey || !drive_uuid) return -1;

    if (x509_verify_signature(der, der_len, issuer_pubkey) != 0) return -1;

    uint8_t  serial[32];
    size_t   serial_len = 0;
    if (x509_extract_serial(der, der_len, serial, sizeof(serial), &serial_len) != 0)
        return -1;
    if (serial_len != 16 || memcmp(serial, drive_uuid, 16) != 0) return -1;

    uint8_t owner_pubkey[32];
    if (x509_extract_ed25519_pubkey(der, der_len, owner_pubkey) != 0) return -1;

    memcpy(out->owner_pubkey, owner_pubkey, 32);
    out->installed = 1;
    out->acl_caps  = acl_caps;
    return 0;
}