Implement scoped authority trust overlay

trustlab/sdk/plugin-api.ts

@@ -17,8 +17,17 @@ export interface CertificateFacts {
   readonly dnsNames?: readonly string[];
   readonly validFrom?: string;
   readonly validUntil?: string;
+  readonly isCa: boolean;
+  readonly keyUsages: readonly CertificateKeyUsage[];
+  readonly selfSigned: boolean;
 }
 
+export type CertificateKeyUsage =
+  | "digitalSignature"
+  | "keyEncipherment"
+  | "keyCertSign"
+  | "crlSign";
+
 export interface TlsFailure {
   readonly code: string;
   readonly certificateSha256?: string;
@@ -88,7 +97,7 @@ export interface AuthorityForHostScope {
   readonly kind: "authority-for-host";
   readonly hostname: string;
   readonly port: number | "any";
-  readonly authoritySha256: string;
+  readonly authorityCertificateSha256: string;
   readonly includeSubdomains: boolean;
 }
 
@@ -103,6 +112,7 @@ export interface TrustedVerdict {
   readonly scope: TrustScope;
   readonly lifetime: TrustLifetime;
   readonly reasonEntryIds: readonly string[];
+  readonly overriddenErrors: readonly string[];
 }
 
 export interface NotTrustedVerdict {
@@ -110,6 +120,7 @@ export interface NotTrustedVerdict {
   readonly scope: TrustScope;
   readonly lifetime: TrustLifetime;
   readonly reasonEntryIds: readonly string[];
+  readonly overriddenErrors: readonly [];
 }
 
 export type TrustVerdict = TrustedVerdict | NotTrustedVerdict;
@@ -191,4 +202,3 @@ export function exactCertificateScope(facts: TlsFacts): CertificateForHostScope
     certificateSha256: leaf.sha256,
   });
 }
-