// Copyright (c) 2026 Alibaba Group and its affiliates

// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at

//     http://www.apache.org/licenses/LICENSE-2.0

// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Package tdx provides TDX quote generation and verification functionality without CGO dependency
package tdx

// TEE types aligned with Intel DCAP QVL constants
const (
	TEE_TYPE_SGX = 0x00000000 // SGX TEE type (DCAP QVL: TEE_TYPE_SGX)
	TEE_TYPE_TDX = 0x00000081 // TDX TEE type (DCAP QVL: TEE_TYPE_TDX)
)

// TDX RTMR constants
const (
	TDX_RTMR_COUNT                  = 4
	TDX_RTMR_LENGTH_BY_BYTES        = 48
	TDX_RTMR1_INDEX          uint32 = 2
)

// ------------------------------------------------------------
// Quote parse constants
// ------------------------------------------------------------

const QUOTE_MIN_SIZE = 1020 // Minimum quote size (DCAP QVL: sgx_qve_def.h:94)

// TEE report body types aligned with Intel DCAP QVL constants
const (
	BODY_SGX_ENCLAVE_REPORT_TYPE = 1 // SGX Enclave Report (Intel: BODY_SGX_ENCLAVE_REPORT_TYPE)
	BODY_TD_REPORT10_TYPE        = 2 // TD Report 1.0 (Intel: BODY_TD_REPORT10_TYPE)
	BODY_TD_REPORT15_TYPE        = 3 // TD Report 1.5 (Intel: BODY_TD_REPORT15_TYPE)
)

// Attestation key types aligned with Intel DCAP QVL constants
const (
	ECDSA_256_WITH_P256_CURVE = 2 // ECDSA-256-with-P-256-Curve (Intel: ECDSA_256_WITH_P256_CURVE)
	ECDSA_384_WITH_P384_CURVE = 3 // ECDSA-384-with-P-384-Curve (Intel: ECDSA_384_WITH_P384_CURVE)
)

// Quote versions aligned with Intel DCAP QVL constants
const (
	QUOTE_VERSION_3 = 3 // Quote version 3 (DCAP QVL: QUOTE_VERSION_3)
	QUOTE_VERSION_4 = 4 // Quote version 4 (DCAP QVL: QUOTE_VERSION_4)
	QUOTE_VERSION_5 = 5 // Quote version 5 (DCAP QVL: QUOTE_VERSION_5)
)

// ------------------------------------------------------------
// Quote verification constants
// ------------------------------------------------------------

const EXPECTED_CERTIFICATE_COUNT_IN_PCK_CHAIN = 3 // Expected certificate count in PCK chain (DCAP QVL: QuoteVerification.cpp:62)
const EXPECTED_CERTIFICATE_COUNT_IN_TCB_CHAIN = 2 // Expected certificate count in TCB chain (DCAP QVL: QuoteVerification.cpp:239)

// Intel Root Public Key for non-SERVTD_ATTEST mode
// Based on Intel DCAP QVL: qve.cpp:98-103 (INTEL_ROOT_PUB_KEY)
var INTEL_ROOT_PUB_KEY = []byte{
	0x04, 0x0b, 0xa9, 0xc4, 0xc0, 0xc0, 0xc8, 0x61, 0x93, 0xa3, 0xfe, 0x23, 0xd6, 0xb0, 0x2c,
	0xda, 0x10, 0xa8, 0xbb, 0xd4, 0xe8, 0x8e, 0x48, 0xb4, 0x45, 0x85, 0x61, 0xa3, 0x6e, 0x70,
	0x55, 0x25, 0xf5, 0x67, 0x91, 0x8e, 0x2e, 0xdc, 0x88, 0xe4, 0x0d, 0x86, 0x0b, 0xd0, 0xcc,
	0x4e, 0xe2, 0x6a, 0xac, 0xc9, 0x88, 0xe5, 0x05, 0xa9, 0x53, 0x55, 0x8c, 0x45, 0x3f, 0x6b,
	0x09, 0x04, 0xae, 0x73, 0x94,
}

// Collateral version constants as per DCAP QVL: sgx_qve_def.h:86-89
const (
	QVE_COLLATERAL_VERSION1  = 0x1
	QVE_COLLATERAL_VERSION3  = 0x3
	QVE_COLLATERAL_VERSION31 = 0x00010003 // Note: QVE_COLLATERAL_VERSOIN31 (typo in original)
	QVE_COLLATERAL_VERSION4  = 0x4
)

// Status represents the result of an quote verification operation (DCAP QVL Status)
type Status int

// Complete mapping from Intel DCAP QVL's Status enum (QuoteVerification.h:66-172)
const (
	STATUS_OK                                           Status = 0
	STATUS_UNSUPPORTED_CERT_FORMAT                      Status = 1
	STATUS_SGX_ROOT_CA_MISSING                          Status = 2
	STATUS_SGX_ROOT_CA_INVALID                          Status = 3
	STATUS_SGX_ROOT_CA_INVALID_EXTENSIONS               Status = 4
	STATUS_SGX_ROOT_CA_INVALID_ISSUER                   Status = 5
	STATUS_SGX_ROOT_CA_UNTRUSTED                        Status = 6
	STATUS_SGX_INTERMEDIATE_CA_MISSING                  Status = 7
	STATUS_SGX_INTERMEDIATE_CA_INVALID                  Status = 8
	STATUS_SGX_INTERMEDIATE_CA_INVALID_EXTENSIONS       Status = 9
	STATUS_SGX_INTERMEDIATE_CA_INVALID_ISSUER           Status = 10
	STATUS_SGX_INTERMEDIATE_CA_REVOKED                  Status = 11
	STATUS_SGX_PCK_MISSING                              Status = 12
	STATUS_SGX_PCK_INVALID                              Status = 13
	STATUS_SGX_PCK_INVALID_EXTENSIONS                   Status = 14
	STATUS_SGX_PCK_INVALID_ISSUER                       Status = 15
	STATUS_SGX_PCK_REVOKED                              Status = 16
	STATUS_TRUSTED_ROOT_CA_INVALID                      Status = 17
	STATUS_SGX_PCK_CERT_CHAIN_UNTRUSTED                 Status = 18
	STATUS_SGX_TCB_INFO_UNSUPPORTED_FORMAT              Status = 19
	STATUS_SGX_TCB_INFO_INVALID                         Status = 20
	STATUS_TCB_INFO_INVALID_SIGNATURE                   Status = 21
	STATUS_SGX_TCB_SIGNING_CERT_MISSING                 Status = 22
	STATUS_SGX_TCB_SIGNING_CERT_INVALID                 Status = 23
	STATUS_SGX_TCB_SIGNING_CERT_INVALID_EXTENSIONS      Status = 24
	STATUS_SGX_TCB_SIGNING_CERT_INVALID_ISSUER          Status = 25
	STATUS_SGX_TCB_SIGNING_CERT_CHAIN_UNTRUSTED         Status = 26
	STATUS_SGX_TCB_SIGNING_CERT_REVOKED                 Status = 27
	STATUS_SGX_CRL_UNSUPPORTED_FORMAT                   Status = 28
	STATUS_SGX_CRL_UNKNOWN_ISSUER                       Status = 29
	STATUS_SGX_CRL_INVALID                              Status = 30
	STATUS_SGX_CRL_INVALID_EXTENSIONS                   Status = 31
	STATUS_SGX_CRL_INVALID_SIGNATURE                    Status = 32
	STATUS_SGX_CA_CERT_UNSUPPORTED_FORMAT               Status = 33
	STATUS_SGX_CA_CERT_INVALID                          Status = 34
	STATUS_TRUSTED_ROOT_CA_UNSUPPORTED_FORMAT           Status = 35
	STATUS_MISSING_PARAMETERS                           Status = 36
	STATUS_UNSUPPORTED_QUOTE_FORMAT                     Status = 37
	STATUS_UNSUPPORTED_PCK_CERT_FORMAT                  Status = 38
	STATUS_INVALID_PCK_CERT                             Status = 39
	STATUS_UNSUPPORTED_PCK_RL_FORMAT                    Status = 40
	STATUS_INVALID_PCK_CRL                              Status = 41
	STATUS_UNSUPPORTED_TCB_INFO_FORMAT                  Status = 42
	STATUS_PCK_REVOKED                                  Status = 43
	STATUS_TCB_INFO_MISMATCH                            Status = 44
	STATUS_TCB_OUT_OF_DATE                              Status = 45
	STATUS_TCB_REVOKED                                  Status = 46
	STATUS_TCB_CONFIGURATION_NEEDED                     Status = 47
	STATUS_TCB_OUT_OF_DATE_CONFIGURATION_NEEDED         Status = 48
	STATUS_TCB_NOT_SUPPORTED                            Status = 49
	STATUS_TCB_UNRECOGNIZED_STATUS                      Status = 50
	STATUS_UNSUPPORTED_QE_CERTIFICATION                 Status = 51
	STATUS_INVALID_QE_CERTIFICATION_DATA_SIZE           Status = 52
	STATUS_UNSUPPORTED_QE_CERTIFICATION_DATA_TYPE       Status = 53
	STATUS_PCK_CERT_MISMATCH                            Status = 54
	STATUS_INVALID_QE_REPORT_SIGNATURE                  Status = 55
	STATUS_INVALID_QE_REPORT_DATA                       Status = 56
	STATUS_INVALID_QUOTE_SIGNATURE                      Status = 57
	STATUS_SGX_QE_IDENTITY_UNSUPPORTED_FORMAT           Status = 58
	STATUS_SGX_QE_IDENTITY_INVALID                      Status = 59
	STATUS_SGX_QE_IDENTITY_INVALID_SIGNATURE            Status = 60
	STATUS_SGX_ENCLAVE_REPORT_UNSUPPORTED_FORMAT        Status = 61
	STATUS_SGX_ENCLAVE_IDENTITY_UNSUPPORTED_FORMAT      Status = 62
	STATUS_SGX_ENCLAVE_IDENTITY_INVALID                 Status = 63
	STATUS_SGX_ENCLAVE_IDENTITY_UNSUPPORTED_VERSION     Status = 64
	STATUS_SGX_ENCLAVE_IDENTITY_OUT_OF_DATE             Status = 65
	STATUS_SGX_ENCLAVE_REPORT_MISCSELECT_MISMATCH       Status = 66
	STATUS_SGX_ENCLAVE_REPORT_ATTRIBUTES_MISMATCH       Status = 67
	STATUS_SGX_ENCLAVE_REPORT_MRENCLAVE_MISMATCH        Status = 68
	STATUS_SGX_ENCLAVE_REPORT_MRSIGNER_MISMATCH         Status = 69
	STATUS_SGX_ENCLAVE_REPORT_ISVPRODID_MISMATCH        Status = 70
	STATUS_SGX_ENCLAVE_REPORT_ISVSVN_OUT_OF_DATE        Status = 71
	STATUS_UNSUPPORTED_QE_IDENTITY_FORMAT               Status = 72
	STATUS_QE_IDENTITY_OUT_OF_DATE                      Status = 73
	STATUS_QE_IDENTITY_MISMATCH                         Status = 74
	STATUS_SGX_TCB_INFO_EXPIRED                         Status = 75
	STATUS_SGX_ENCLAVE_IDENTITY_INVALID_SIGNATURE       Status = 76
	STATUS_INVALID_PARAMETER                            Status = 77
	STATUS_SGX_PCK_CERT_CHAIN_EXPIRED                   Status = 78
	STATUS_SGX_CRL_EXPIRED                              Status = 79
	STATUS_SGX_SIGNING_CERT_CHAIN_EXPIRED               Status = 80
	STATUS_SGX_ENCLAVE_IDENTITY_EXPIRED                 Status = 81
	STATUS_TCB_SW_HARDENING_NEEDED                      Status = 82
	STATUS_TCB_CONFIGURATION_AND_SW_HARDENING_NEEDED    Status = 83
	STATUS_SGX_ENCLAVE_REPORT_ISVSVN_REVOKED            Status = 84
	STATUS_TDX_MODULE_MISMATCH                          Status = 85
	STATUS_SGX_ENCLAVE_REPORT_ISVSVN_NOT_SUPPORTED      Status = 86
	STATUS_TCB_TD_RELAUNCH_ADVISED                      Status = 87
	STATUS_TCB_TD_RELAUNCH_ADVISED_CONFIGURATION_NEEDED Status = 88
)

type QvResultType uint32

const (
	// Quote verification passed and is at the latest TCB level
	SGX_QL_QV_RESULT_OK  QvResultType = 0x0000
	TEE_QV_RESULT_OK     QvResultType = 0x0000
	SGX_QL_QV_RESULT_MIN QvResultType = 0xA001
	TEE_QV_RESULT_MIN    QvResultType = 0xA001

	// The Quote verification passed but further actions are required:
	// Additional configuration of the platform needed
	SGX_QL_QV_RESULT_CONFIG_NEEDED QvResultType = 0xA001
	TEE_QV_RESULT_CONFIG_NEEDED    QvResultType = 0xA001
	// TCB level out of date platform patching required
	SGX_QL_QV_RESULT_OUT_OF_DATE QvResultType = 0xA002
	TEE_QV_RESULT_OUT_OF_DATE    QvResultType = 0xA002
	// Both patching and additional configuration needed
	SGX_QL_QV_RESULT_OUT_OF_DATE_CONFIG_NEEDED QvResultType = 0xA003
	TEE_QV_RESULT_OUT_OF_DATE_CONFIG_NEEDED    QvResultType = 0xA003

	// Errors
	SGX_QL_QV_RESULT_INVALID_SIGNATURE QvResultType = 0xA004
	TEE_QV_RESULT_INVALID_SIGNATURE    QvResultType = 0xA004
	SGX_QL_QV_RESULT_REVOKED           QvResultType = 0xA005
	TEE_QV_RESULT_REVOKED              QvResultType = 0xA005
	SGX_QL_QV_RESULT_UNSPECIFIED       QvResultType = 0xA006
	TEE_QV_RESULT_UNSPECIFIED          QvResultType = 0xA006

	// Requires Software or Configuration Hardening
	// TCB level is up to date but SGX SW Hardening is needed
	SGX_QL_QV_RESULT_SW_HARDENING_NEEDED QvResultType = 0xA007
	TEE_QV_RESULT_SW_HARDENING_NEEDED    QvResultType = 0xA007
	// TCB level is up to date but both SW Hardening and additional configuration are needed
	SGX_QL_QV_RESULT_CONFIG_AND_SW_HARDENING_NEEDED QvResultType = 0xA008
	TEE_QV_RESULT_CONFIG_AND_SW_HARDENING_NEEDED    QvResultType = 0xA008

	// TDX specific results
	// All components in the TD’s TCB are latest including the TD preserving loaded TDX but the TD was launched
	// and ran for some time with out-of-date TDX Module. Relaunching or re-provisioning your TD is advised
	SGX_QL_QV_RESULT_TD_RELAUNCH_ADVISED QvResultType = 0xA009
	TEE_QV_RESULT_TD_RELAUNCH_ADVISED    QvResultType = 0xA009

	// Same as above relaunching or re-provisioning your TD is advised. In the meantime
	// additional configuration of the platform is needed
	SGX_QL_QV_RESULT_TD_RELAUNCH_ADVISED_CONFIG_NEEDED QvResultType = 0xA00A
	TEE_QV_RESULT_TD_RELAUNCH_ADVISED_CONFIG_NEEDED    QvResultType = 0xA00A

	// Maximum result value
	SGX_QL_QV_RESULT_MAX QvResultType = 0xA0FF
	TEE_QV_RESULT_MAX    QvResultType = 0xA0FF
)

// QuoteErrType represents the quote library error type (DCAP QVL quote3_error_t)
// It represents the error code returned by QVL verify function (e.g., sgx_qvl_verify_quote)
type QuoteErrType uint32

const (
	SGX_QL_SUCCESS                                   QuoteErrType = 0x00000000
	SGX_QL_ERROR_UNEXPECTED                          QuoteErrType = 0x0000E001
	SGX_QL_ERROR_INVALID_PARAMETER                   QuoteErrType = 0x0000E002
	SGX_QL_QUOTE_CERTIFICATION_DATA_UNSUPPORTED      QuoteErrType = 0x0000E01C
	SGX_QL_QUOTE_FORMAT_UNSUPPORTED                  QuoteErrType = 0x0000E01D
	SGX_QL_QE_REPORT_INVALID_SIGNATURE               QuoteErrType = 0x0000E01F
	SGX_QL_QE_REPORT_UNSUPPORTED_FORMAT              QuoteErrType = 0x0000E020
	SGX_QL_PCK_CERT_UNSUPPORTED_FORMAT               QuoteErrType = 0x0000E021
	SGX_QL_PCK_CERT_CHAIN_ERROR                      QuoteErrType = 0x0000E022
	SGX_QL_TCBINFO_UNSUPPORTED_FORMAT                QuoteErrType = 0x0000E023
	SGX_QL_TCBINFO_MISMATCH                          QuoteErrType = 0x0000E024
	SGX_QL_QEIDENTITY_UNSUPPORTED_FORMAT             QuoteErrType = 0x0000E025
	SGX_QL_QEIDENTITY_MISMATCH                       QuoteErrType = 0x0000E026
	SGX_QL_TCB_OUT_OF_DATE                           QuoteErrType = 0x0000E027
	SGX_QL_TCB_OUT_OF_DATE_CONFIGURATION_NEEDED      QuoteErrType = 0x0000E028
	SGX_QL_SGX_ENCLAVE_IDENTITY_OUT_OF_DATE          QuoteErrType = 0x0000E029
	SGX_QL_SGX_ENCLAVE_REPORT_ISVSVN_OUT_OF_DATE     QuoteErrType = 0x0000E02A
	SGX_QL_QE_IDENTITY_OUT_OF_DATE                   QuoteErrType = 0x0000E02B
	SGX_QL_SGX_TCB_INFO_EXPIRED                      QuoteErrType = 0x0000E02C
	SGX_QL_SGX_PCK_CERT_CHAIN_EXPIRED                QuoteErrType = 0x0000E02D
	SGX_QL_SGX_CRL_EXPIRED                           QuoteErrType = 0x0000E02E
	SGX_QL_SGX_SIGNING_CERT_CHAIN_EXPIRED            QuoteErrType = 0x0000E02F
	SGX_QL_SGX_ENCLAVE_IDENTITY_EXPIRED              QuoteErrType = 0x0000E030
	SGX_QL_PCK_REVOKED                               QuoteErrType = 0x0000E031
	SGX_QL_TCB_REVOKED                               QuoteErrType = 0x0000E032
	SGX_QL_TCB_CONFIGURATION_NEEDED                  QuoteErrType = 0x0000E033
	SGX_QL_UNABLE_TO_GET_COLLATERAL                  QuoteErrType = 0x0000E034
	SGX_QL_CRL_UNSUPPORTED_FORMAT                    QuoteErrType = 0x0000E038
	SGX_QL_QEIDENTITY_CHAIN_ERROR                    QuoteErrType = 0x0000E039
	SGX_QL_TCBINFO_CHAIN_ERROR                       QuoteErrType = 0x0000E03A
	SGX_QL_TCB_SW_HARDENING_NEEDED                   QuoteErrType = 0x0000E03C
	SGX_QL_TCB_CONFIGURATION_AND_SW_HARDENING_NEEDED QuoteErrType = 0x0000E03D
	SGX_QL_COLLATERAL_VERSION_NOT_SUPPORTED          QuoteErrType = 0x0000E053
	SGX_QL_TDX_MODULE_MISMATCH                       QuoteErrType = 0x0000E060
	SGX_QL_TCB_NOT_SUPPORTED                         QuoteErrType = 0x0000E066
	SGX_QL_RESULT_INVALID_SIGNATURE                  QuoteErrType = 0x0000E068
)

// String returns a string representation of the Status
func (s Status) String() string {
	switch s {
	case STATUS_OK:
		return "OK"
	case STATUS_SGX_ROOT_CA_MISSING:
		return "SGX Root CA Missing"
	case STATUS_SGX_ROOT_CA_INVALID:
		return "SGX Root CA Invalid"
	case STATUS_SGX_ROOT_CA_INVALID_ISSUER:
		return "SGX Root CA Invalid Issuer"
	case STATUS_SGX_INTERMEDIATE_CA_MISSING:
		return "SGX Intermediate CA Missing"
	case STATUS_SGX_INTERMEDIATE_CA_INVALID:
		return "SGX Intermediate CA Invalid"
	case STATUS_SGX_INTERMEDIATE_CA_INVALID_ISSUER:
		return "SGX Intermediate CA Invalid Issuer"
	case STATUS_SGX_INTERMEDIATE_CA_REVOKED:
		return "SGX Intermediate CA Revoked"
	case STATUS_SGX_PCK_MISSING:
		return "SGX PCK Missing"
	case STATUS_SGX_PCK_INVALID:
		return "SGX PCK Invalid"
	case STATUS_SGX_PCK_INVALID_ISSUER:
		return "SGX PCK Invalid Issuer"
	case STATUS_SGX_PCK_REVOKED:
		return "SGX PCK Revoked"
	case STATUS_SGX_PCK_CERT_CHAIN_UNTRUSTED:
		return "PCK Certificate Chain Untrusted"
	case STATUS_MISSING_PARAMETERS:
		return "Missing Parameters"
	case STATUS_UNSUPPORTED_QUOTE_FORMAT:
		return "Unsupported Quote Format"
	case STATUS_UNSUPPORTED_PCK_CERT_FORMAT:
		return "Unsupported PCK Certificate Format"
	case STATUS_UNSUPPORTED_PCK_RL_FORMAT:
		return "Unsupported PCK RL Format"
	case STATUS_INVALID_QUOTE_SIGNATURE:
		return "Invalid Quote Signature"
	case STATUS_INVALID_PCK_CERT:
		return "Invalid PCK Certificate"
	case STATUS_PCK_REVOKED:
		return "PCK Certificate Revoked"
	case STATUS_UNSUPPORTED_TCB_INFO_FORMAT:
		return "Unsupported TCB Info Format"
	case STATUS_INVALID_PCK_CRL:
		return "Invalid PCK CRL"
	case STATUS_TCB_OUT_OF_DATE:
		return "TCB Out of Date"
	case STATUS_TCB_REVOKED:
		return "TCB Revoked"
	case STATUS_TCB_CONFIGURATION_NEEDED:
		return "TCB Configuration Needed"
	case STATUS_TCB_OUT_OF_DATE_CONFIGURATION_NEEDED:
		return "TCB Out of Date Configuration Needed"
	case STATUS_TCB_INFO_MISMATCH:
		return "TCB Info Mismatch"
	case STATUS_TCB_SW_HARDENING_NEEDED:
		return "TCB SW Hardening Needed"
	case STATUS_TCB_CONFIGURATION_AND_SW_HARDENING_NEEDED:
		return "TCB Configuration and SW Hardening Needed"
	case STATUS_INVALID_QE_REPORT_SIGNATURE:
		return "Invalid QE Report Signature"
	case STATUS_INVALID_QE_REPORT_DATA:
		return "Invalid QE Report Data"
	case STATUS_QE_IDENTITY_MISMATCH:
		return "QE Identity Mismatch"
	case STATUS_TDX_MODULE_MISMATCH:
		return "TDX Module Mismatch"
	case STATUS_SGX_ENCLAVE_REPORT_ISVSVN_OUT_OF_DATE:
		return "SGX Enclave Report ISVSVN Out of Date"
	case STATUS_SGX_ENCLAVE_REPORT_ISVSVN_REVOKED:
		return "SGX Enclave Report ISVSVN Revoked"
	case STATUS_QE_IDENTITY_OUT_OF_DATE:
		return "QE Identity Out of Date"
	case STATUS_SGX_PCK_CERT_CHAIN_EXPIRED:
		return "SGX PCK Cert Chain Expired"
	case STATUS_SGX_CRL_EXPIRED:
		return "SGX CRL Expired"
	case STATUS_SGX_SIGNING_CERT_CHAIN_EXPIRED:
		return "SGX Signing Cert Chain Expired"
	case STATUS_SGX_TCB_INFO_EXPIRED:
		return "SGX TCB Info Expired"
	case STATUS_SGX_ENCLAVE_IDENTITY_EXPIRED:
		return "SGX Enclave Identity Expired"
	case STATUS_SGX_ENCLAVE_REPORT_MRSIGNER_MISMATCH:
		return "SGX Enclave Report MRSIGNER Mismatch"
	case STATUS_SGX_TCB_INFO_INVALID:
		return "SGX TCB Info Invalid"
	case STATUS_SGX_TCB_SIGNING_CERT_MISSING:
		return "SGX TCB Signing Certificate Missing"
	case STATUS_TCB_NOT_SUPPORTED:
		return "TCB Not Supported"
	case STATUS_TCB_UNRECOGNIZED_STATUS:
		return "TCB Unrecognized Status"
	case STATUS_UNSUPPORTED_QE_CERTIFICATION:
		return "Unsupported QE Certification"
	case STATUS_SGX_ENCLAVE_REPORT_UNSUPPORTED_FORMAT:
		return "SGX Enclave Report Unsupported Format"
	case STATUS_SGX_ENCLAVE_IDENTITY_UNSUPPORTED_FORMAT:
		return "SGX Enclave Identity Unsupported Format"
	case STATUS_SGX_ENCLAVE_IDENTITY_INVALID:
		return "SGX Enclave Identity Invalid"
	case STATUS_SGX_ENCLAVE_IDENTITY_UNSUPPORTED_VERSION:
		return "SGX Enclave Identity Unsupported Version"
	case STATUS_SGX_ENCLAVE_IDENTITY_OUT_OF_DATE:
		return "SGX Enclave Identity Out of Date"
	case STATUS_SGX_ENCLAVE_REPORT_MISCSELECT_MISMATCH:
		return "SGX Enclave Report MiscSelect Mismatch"
	case STATUS_SGX_ENCLAVE_REPORT_ATTRIBUTES_MISMATCH:
		return "SGX Enclave Report Attributes Mismatch"
	case STATUS_SGX_ENCLAVE_REPORT_MRENCLAVE_MISMATCH:
		return "SGX Enclave Report MRENCLAVE Mismatch"
	case STATUS_SGX_ENCLAVE_REPORT_ISVPRODID_MISMATCH:
		return "SGX Enclave Report ISVPRODID Mismatch"
	case STATUS_UNSUPPORTED_QE_IDENTITY_FORMAT:
		return "Unsupported QE Identity Format"
	case STATUS_SGX_ENCLAVE_IDENTITY_INVALID_SIGNATURE:
		return "SGX Enclave Identity Invalid Signature"
	case STATUS_INVALID_PARAMETER:
		return "Invalid Parameter"
	case STATUS_SGX_ENCLAVE_REPORT_ISVSVN_NOT_SUPPORTED:
		return "SGX Enclave Report ISVSVN Not Supported"
	default:
		return "Unknown Status"
	}
}

// TCBStatus represents the TCB (Trusted Compute Base) status
type TCBStatus int

// TCBStatus represents the TCB (Trusted Compute Base) status
const (
	// TCBStatusOK indicates the TCB is OK (same as UpToDate)
	TCBStatusOK TCBStatus = iota
	// TCBStatusUpToDate indicates the TCB is up to date
	TCBStatusUpToDate
	// TCBStatusSWHardeningNeeded indicates software hardening is needed
	TCBStatusSWHardeningNeeded
	// TCBStatusConfigurationNeeded indicates configuration is needed
	TCBStatusConfigurationNeeded
	// TCBStatusConfigurationAndSWHardeningNeeded indicates both configuration and software hardening are needed
	TCBStatusConfigurationAndSWHardeningNeeded
	// TCBStatusOutOfDate indicates the TCB is out of date
	TCBStatusOutOfDate
	// TCBStatusOutOfDateConfigurationNeeded indicates the TCB is out of date and configuration is needed
	TCBStatusOutOfDateConfigurationNeeded
	// TCBStatusRevoked indicates the TCB is revoked
	TCBStatusRevoked
	// TCBStatusInvalid indicates the TCB status is invalid or unknown
	TCBStatusInvalid
)

// TCB Status string constants as per Intel DCAP QVL: TcbStatus.h:52-78
const (
	TCB_STATUS_UP_TO_DATE                            = "UpToDate"
	TCB_STATUS_CONFIGURATION_NEEDED                  = "ConfigurationNeeded"
	TCB_STATUS_OUT_OF_DATE                           = "OutOfDate"
	TCB_STATUS_OUT_OF_DATE_CONFIGURATION_NEEDED      = "OutOfDateConfigurationNeeded"
	TCB_STATUS_REVOKED                               = "Revoked"
	TCB_STATUS_SW_HARDENING_NEEDED                   = "SWHardeningNeeded"
	TCB_STATUS_CONFIGURATION_AND_SW_HARDENING_NEEDED = "ConfigurationAndSWHardeningNeeded"
)

// String returns a string representation of the TCBStatus
func (s TCBStatus) String() string {
	switch s {
	case TCBStatusOK:
		return "OK"
	case TCBStatusUpToDate:
		return "Up To Date"
	case TCBStatusSWHardeningNeeded:
		return "SW Hardening Needed"
	case TCBStatusConfigurationNeeded:
		return "Configuration Needed"
	case TCBStatusConfigurationAndSWHardeningNeeded:
		return "Configuration And SW Hardening Needed"
	case TCBStatusOutOfDate:
		return "Out Of Date"
	case TCBStatusOutOfDateConfigurationNeeded:
		return "Out Of Date Configuration Needed"
	case TCBStatusRevoked:
		return "Revoked"
	case TCBStatusInvalid:
		return "Invalid"
	default:
		return "Unknown TCB Status"
	}
}

// Error constants for verification errors
const (
	ErrInvalidQuoteFormat         = "invalid quote format"
	ErrUnsupportedQuoteVersion    = "unsupported quote version"
	ErrUnsupportedTEEType         = "unsupported TEE type"
	ErrInvalidSignature           = "invalid quote signature"
	ErrCertificateChainValidation = "certificate chain validation failed"
	ErrCertificateRevoked         = "certificate is revoked"
	ErrCertificateExpired         = "certificate is expired"
	ErrInvalidTCBLevel            = "invalid TCB level"
	ErrNetworkError               = "network error during verification"
	ErrInternalError              = "internal error during verification"
)

// Certificate type identifiers based on Common Name patterns
const (
	SGX_ROOT_CA_CN_PHRASE      = "SGX Root CA"
	SGX_INTERMEDIATE_CN_PHRASE = "CA"
	SGX_PCK_CN_PHRASE          = "SGX PCK Certificate"
	SGX_TCB_SIGNING_CN_PHRASE  = "SGX TCB Signing"
)

// Certification data types aligned with Intel DCAP QVL constants
// Based on Intel DCAP QVL: QuoteConstants.h:60-65
const (
	PCK_ID_PLAIN_PPID                   = 1 // Plain PPID
	PCK_ID_ENCRYPTED_PPID_2048          = 2 // Encrypted PPID with 2048-bit RSA
	PCK_ID_ENCRYPTED_PPID_3072          = 3 // Encrypted PPID with 3072-bit RSA
	PCK_ID_PCK_CERTIFICATE              = 4 // PCK Certificate
	PCK_ID_PCK_CERT_CHAIN               = 5 // PCK Certificate Chain
	PCK_ID_QE_REPORT_CERTIFICATION_DATA = 6 // QE Report Certification Data
)

// ------------------------------------------------------------
// Event log constants
// ------------------------------------------------------------

// TCG PC Client Platform event types
// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf#page=103
const (
	EV_PREBOOT_CERT = iota
	EV_POST_CODE
	EV_UNUSED
	EV_NO_ACTION
	EV_SEPARATOR
	EV_ACTION
	EV_EVENT_TAG
	EV_S_CRTM_CONTENTS
	EV_S_CRTM_VERSION
	EV_CPU_MICROCODE
	EV_PLATFORM_CONFIG_FLAGS
	EV_TABLE_OF_DEVICES
	EV_COMPACT_HASH
	EV_IPL
	EV_IPL_PARTITION_DATA
	EV_NONHOST_CODE
	EV_NONHOST_CONFIG
	EV_NONHOST_INFO
	EV_OMIT_BOOT_DEVICE_EVENTS
)

// EFI event types
const (
	EV_EFI_EVENT_BASE uint32 = 0x80000000 + iota
	EV_EFI_VARIABLE_DRIVER_CONFIG
	EV_EFI_VARIABLE_BOOT
	EV_EFI_BOOT_SERVICES_APPLICATION
	EV_EFI_BOOT_SERVICES_DRIVER
	EV_EFI_RUNTIME_SERVICES_DRIVER
	EV_EFI_GPT_EVENT
	EV_EFI_ACTION
	EV_EFI_PLATFORM_FIRMWARE_BLOB
	EV_EFI_HANDOFF_TABLES
	EV_EFI_PLATFORM_FIRMWARE_BLOB2
	EV_EFI_HANDOFF_TABLES2
	EV_EFI_HCRTM_EVENT
	EV_EFI_VARIABLE_AUTHORITY uint32 = 0x800000E0
	EV_EFI_SPDM_FIRMWARE_BLOB
	EV_EFI_SPDM_FIRMWARE_CONFIG
	EV_EFI_SPDM_DEVICE_BLOB   = EV_EFI_SPDM_FIRMWARE_BLOB
	EV_EFI_SPDM_DEVICE_CONFIG = EV_EFI_SPDM_FIRMWARE_CONFIG
)

const AAEL_TAG_ID = 0x4141454C // "AAEL"

// TaggedEvent header: tagged_id (4B LE) + tagged_event_size (4B LE)
const AAEL_TAGGED_EVENT_HEADER_SIZE = 8

const (
	AAEL_GPU_ATTESTATION_OPERATION      = "gpu/attestation"
	AAEL_CONTAINER_IMAGE_PULL_OPERATION = "container/image-pull" // legacy / UKI form, content carries `name`
	AAEL_KANGAROO_PULL_IMAGE_OPERATION  = "kangaroo/pull-image"  // PAI form, content carries `reference`
)
