synta 0.3.1

//! ASN.1 Object Identifier (OID).
//!
//! An OID is a sequence of non-negative integers that globally identifies an
//! object (algorithm, attribute type, certificate extension, …).
//!
//! ## Encoding rules
//!
//! The first component must be 0, 1, or 2.  When the first component is 0 or
//! 1, the second must be less than 40.  On the wire the first two components
//! are combined into a single base-128 encoded integer (first × 40 + second);
//! subsequent components are each independently base-128 encoded.
//!
//! ## Matching OIDs efficiently
//!
//! Compare [`components`](ObjectIdentifier::components) slices directly rather
//! than converting to dotted-decimal strings:
//!
//! ```
//! use synta::ObjectIdentifier;
//!
//! // SHA-256: 2.16.840.1.101.3.4.2.1
//! let sha256 = ObjectIdentifier::new(&[2, 16, 840, 1, 101, 3, 4, 2, 1]).unwrap();
//! assert!(matches!(sha256.components(), [2, 16, 840, 1, 101, 3, 4, 2, 1]));
//! ```

#[cfg(all(not(feature = "std"), feature = "serde"))]
use alloc::string::String;
#[cfg(not(feature = "std"))]
use alloc::vec::Vec;

use smallvec::SmallVec;

/// ASN.1 OBJECT IDENTIFIER
///
/// Uses SmallVec to avoid allocations for most OIDs (< 10 components)
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ObjectIdentifier {
    // Most OIDs have fewer than 10 components
    components: SmallVec<[u32; 10]>,
}

impl ObjectIdentifier {
    /// Create a new `ObjectIdentifier` from a slice of component integers.
    ///
    /// # Validation
    ///
    /// - `components` must have at least 2 elements.
    /// - `components[0]` must be 0, 1, or 2.
    /// - If `components[0]` is 0 or 1, then `components[1]` must be < 40.
    ///
    /// # Errors
    ///
    /// Returns [`Error::InvalidOid`](crate::Error::InvalidOid) if any
    /// validation rule is violated.
    ///
    /// # Example
    ///
    /// ```
    /// use synta::ObjectIdentifier;
    ///
    /// // rsadsi (1.2.840.113549)
    /// let oid = ObjectIdentifier::new(&[1, 2, 840, 113549]).unwrap();
    /// assert_eq!(oid.to_string(), "1.2.840.113549");
    /// ```
    pub fn new(components: &[u32]) -> crate::Result<Self> {
        // OID must have at least 2 components
        if components.len() < 2 {
            return Err(crate::Error::InvalidOid { position: 0 });
        }

        // First component must be 0, 1, or 2
        if components[0] > 2 {
            return Err(crate::Error::InvalidOid { position: 0 });
        }

        // If first is 0 or 1, second must be < 40
        if components[0] < 2 && components[1] >= 40 {
            return Err(crate::Error::InvalidOid { position: 0 });
        }

        Ok(Self {
            components: SmallVec::from_slice(components),
        })
    }

    /// Return the OID as a slice of component integers.
    ///
    /// The slice begins with the two top-level arc values (e.g. `[1, 2, …]`).
    /// Matching against a known OID is most efficient by comparing the slice
    /// directly rather than converting to a dotted-decimal string:
    ///
    /// ```
    /// use synta::ObjectIdentifier;
    ///
    /// let oid = ObjectIdentifier::new(&[1, 2, 840, 113549]).unwrap();
    /// assert!(matches!(oid.components(), [1, 2, 840, 113549]));
    /// ```
    pub fn components(&self) -> &[u32] {
        &self.components
    }

    /// Parse an OID from its DER/BER **content** bytes — the raw value bytes
    /// inside an OID TLV, with the tag (`0x06`) and length already stripped.
    ///
    /// This is the low-level counterpart to [`Decode`](crate::traits::Decode)
    /// for situations where the tag and length have already been consumed, for
    /// example after stripping an implicit context tag from a GeneralName
    /// `registeredID [8] IMPLICIT OID` alternative.
    ///
    /// # Errors
    ///
    /// Returns [`Error::InvalidOid`](crate::Error::InvalidOid) if `data` is
    /// empty, contains a truncated base-128 sequence, or causes a `u32`
    /// overflow in any component.
    ///
    /// # Example
    ///
    /// ```
    /// use synta::ObjectIdentifier;
    ///
    /// // commonName 2.5.4.3 — DER content bytes (tag+length stripped)
    /// let oid = ObjectIdentifier::from_content_bytes(&[0x55, 0x04, 0x03]).unwrap();
    /// assert_eq!(oid.to_string(), "2.5.4.3");
    /// ```
    pub fn from_content_bytes(data: &[u8]) -> crate::Result<Self> {
        if data.is_empty() {
            return Err(crate::Error::InvalidOid { position: 0 });
        }

        let mut components: SmallVec<[u32; 10]> = SmallVec::new();
        let mut i = 0;

        // First encoded value is base-128 and represents two OID components
        // combined as: arc0 * 40 + arc1  (with arc0 ∈ {0,1,2}).
        let mut combined: u32 = 0;
        loop {
            if i >= data.len() {
                return Err(crate::Error::InvalidOid { position: i });
            }
            let byte = data[i];
            i += 1;
            combined = combined
                .checked_mul(128)
                .and_then(|v| v.checked_add((byte & 0x7F) as u32))
                .ok_or(crate::Error::InvalidOid { position: i })?;
            if (byte & 0x80) == 0 {
                break;
            }
        }

        if combined < 40 {
            components.push(0);
            components.push(combined);
        } else if combined < 80 {
            components.push(1);
            components.push(combined - 40);
        } else {
            components.push(2);
            components.push(combined - 80);
        }

        // Remaining components, each independently base-128 encoded.
        while i < data.len() {
            let mut value: u32 = 0;
            loop {
                if i >= data.len() {
                    return Err(crate::Error::InvalidOid { position: i });
                }
                let byte = data[i];
                i += 1;
                value = value
                    .checked_mul(128)
                    .and_then(|v| v.checked_add((byte & 0x7F) as u32))
                    .ok_or(crate::Error::InvalidOid { position: i })?;
                if (byte & 0x80) == 0 {
                    break;
                }
            }
            components.push(value);
        }

        Ok(Self { components })
    }

    /// Construct an OID from an already-validated `SmallVec` of components.
    ///
    /// # Safety (logical)
    ///
    /// The caller must guarantee that `components` encodes a valid OID:
    /// - At least 2 elements
    /// - `components[0]` ∈ {0, 1, 2}
    /// - If `components[0]` < 2, then `components[1]` < 40
    ///
    /// This constructor skips the validation check and the `from_slice` copy
    /// performed by [`Self::new`].  It is `pub(crate)` to keep the unsafe
    /// contract internal.
    #[inline]
    pub(crate) fn from_components_unchecked(components: SmallVec<[u32; 10]>) -> Self {
        Self { components }
    }

    /// Encode this OID as DER **content** bytes — the raw base-128 arc bytes
    /// without the `0x06` tag byte or the length field.
    ///
    /// This is the symmetric counterpart to [`from_content_bytes`] and is
    /// useful for embedding OIDs in non-DER formats such as CBOR (RFC 9090
    /// tag 111) without going through the full DER TLV encoder.
    ///
    /// [`from_content_bytes`]: Self::from_content_bytes
    ///
    /// # Example
    ///
    /// ```
    /// use synta::ObjectIdentifier;
    ///
    /// // commonName 2.5.4.3
    /// let oid = ObjectIdentifier::new(&[2, 5, 4, 3]).unwrap();
    /// assert_eq!(oid.to_content_bytes(), &[0x55, 0x04, 0x03]);
    /// // Round-trip
    /// assert_eq!(ObjectIdentifier::from_content_bytes(&oid.to_content_bytes()).unwrap(), oid);
    /// ```
    pub fn to_content_bytes(&self) -> Vec<u8> {
        let mut out = Vec::new();
        let combined = self.components[0] * 40 + self.components[1];
        encode_base128(combined, &mut out);
        for &c in &self.components[2..] {
            encode_base128(c, &mut out);
        }
        out
    }
}

// `Display` produces canonical dotted-decimal notation, e.g. `"1.2.840.113549"`.
impl core::fmt::Display for ObjectIdentifier {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        let mut iter = self.components.iter();
        if let Some(first) = iter.next() {
            write!(f, "{}", first)?;
            for component in iter {
                write!(f, ".{}", component)?;
            }
        }
        Ok(())
    }
}

// `FromStr` parses dotted-decimal notation (`"1.2.840.113549"`) and validates
// the resulting components.  Only available with the `std` feature.
#[cfg(feature = "std")]
impl core::str::FromStr for ObjectIdentifier {
    type Err = crate::Error;

    fn from_str(s: &str) -> Result<Self, Self::Err> {
        let mut components: SmallVec<[u32; 10]> = SmallVec::new();
        for part in s.split('.') {
            let v: u32 = part
                .parse()
                .map_err(|_| crate::Error::InvalidOid { position: 0 })?;
            components.push(v);
        }
        if components.len() < 2 {
            return Err(crate::Error::InvalidOid { position: 0 });
        }
        if components[0] > 2 {
            return Err(crate::Error::InvalidOid { position: 0 });
        }
        if components[0] < 2 && components[1] >= 40 {
            return Err(crate::Error::InvalidOid { position: 0 });
        }
        Ok(Self { components })
    }
}

// Implement Decode trait for ObjectIdentifier
impl crate::traits::Decode<'_> for ObjectIdentifier {
    fn decode(decoder: &mut crate::der::decoder::Decoder) -> crate::Result<Self> {
        use crate::tag::TAG_OBJECT_IDENTIFIER;

        let tag = decoder.read_tag()?;
        let expected_tag = crate::Tag::universal(TAG_OBJECT_IDENTIFIER);

        if tag != expected_tag {
            return Err(crate::Error::UnexpectedTag {
                position: decoder.position(),
                expected: expected_tag,
                actual: tag,
            });
        }

        let length = decoder.read_length()?;
        let len = length.definite()?;

        if len == 0 {
            return Err(crate::Error::InvalidOid {
                position: decoder.position(),
            });
        }

        let bytes = decoder.read_bytes(len)?;

        ObjectIdentifier::from_content_bytes(bytes).map_err(|_| crate::Error::InvalidOid {
            position: decoder.position(),
        })
    }
}

// Implement Encode trait for ObjectIdentifier
impl crate::traits::Encode for ObjectIdentifier {
    fn encode(&self, encoder: &mut crate::der::encoder::Encoder) -> crate::Result<()> {
        use crate::tag::TAG_OBJECT_IDENTIFIER;

        if self.components.len() < 2 {
            return Err(crate::Error::InvalidOid { position: 0 });
        }

        let tag = crate::Tag::universal(TAG_OBJECT_IDENTIFIER);
        encoder.write_tag(tag)?;
        let content = self.to_content_bytes();
        encoder.write_length(content.len())?;
        encoder.write_bytes(&content);
        Ok(())
    }

    fn encoded_len(&self) -> crate::Result<usize> {
        if self.components.len() < 2 {
            return Err(crate::Error::InvalidOid { position: 0 });
        }

        let tag_len = 1;

        // Calculate content length
        // First two components are combined as: first * 40 + second
        let first = self.components[0];
        let second = self.components[1];
        let combined = first * 40 + second;
        let mut content_len = base128_len(combined);

        // Add lengths of remaining components
        for &component in &self.components[2..] {
            content_len += base128_len(component);
        }

        let length_len = crate::Length::Definite(content_len).encoded_len()?;
        Ok(tag_len + length_len + content_len)
    }
}

// Implement Tagged trait
impl crate::traits::Tagged for ObjectIdentifier {
    fn tag() -> crate::Tag {
        crate::Tag::universal(crate::tag::TAG_OBJECT_IDENTIFIER)
    }
}

// Helper function to encode a u32 in base-128
fn encode_base128(mut value: u32, buffer: &mut Vec<u8>) {
    if value == 0 {
        buffer.push(0);
        return;
    }

    // Collect bytes in reverse order
    let mut bytes = Vec::new();
    while value > 0 {
        bytes.push((value & 0x7F) as u8);
        value >>= 7;
    }

    // Write in correct order with high bit set on all but last
    for (i, &byte) in bytes.iter().rev().enumerate() {
        if i < bytes.len() - 1 {
            buffer.push(byte | 0x80);
        } else {
            buffer.push(byte);
        }
    }
}

// ---- serde support ----

/// `ObjectIdentifier` serializes as a dotted-decimal string (e.g. `"1.2.840.113549"`).
#[cfg(feature = "serde")]
impl serde::Serialize for ObjectIdentifier {
    fn serialize<S: serde::Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
        use core::fmt::Write;
        let mut buf = String::new();
        for (i, &component) in self.components().iter().enumerate() {
            if i > 0 {
                buf.push('.');
            }
            let _ = write!(buf, "{}", component);
        }
        s.serialize_str(&buf)
    }
}

#[cfg(feature = "serde")]
impl<'de> serde::Deserialize<'de> for ObjectIdentifier {
    fn deserialize<D: serde::Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
        struct OidVisitor;
        impl<'de> serde::de::Visitor<'de> for OidVisitor {
            type Value = ObjectIdentifier;
            fn expecting(&self, f: &mut core::fmt::Formatter) -> core::fmt::Result {
                write!(f, "an OID in dotted-decimal notation (e.g. \"1.2.840\")")
            }
            fn visit_str<E: serde::de::Error>(self, v: &str) -> Result<ObjectIdentifier, E> {
                let components: Result<Vec<u32>, _> =
                    v.split('.').map(|p| p.parse::<u32>()).collect();
                let components = components.map_err(|_| E::custom("invalid OID component"))?;
                ObjectIdentifier::new(&components).map_err(|_| E::custom("invalid OID"))
            }
        }
        d.deserialize_str(OidVisitor)
    }
}

// Helper function to calculate base-128 encoded length
fn base128_len(value: u32) -> usize {
    if value == 0 {
        return 1;
    }

    let mut len = 0;
    let mut v = value;
    while v > 0 {
        len += 1;
        v >>= 7;
    }
    len
}

/// ASN.1 RELATIVE-OID
///
/// A RELATIVE-OID is a sequence of integer components (arcs) that identifies
/// an object relative to some other OID. Unlike OBJECT IDENTIFIER, a RELATIVE-OID
/// can have any number of components (including zero) and does not apply special
/// encoding to the first two components.
///
/// Uses SmallVec to avoid allocations for most RELATIVE-OIDs (< 10 components)
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct RelativeOid {
    // Most RELATIVE-OIDs have fewer than 10 components
    components: SmallVec<[u32; 10]>,
}

impl RelativeOid {
    /// Create a new `RelativeOid` from a slice of component integers.
    ///
    /// Unlike OBJECT IDENTIFIER, RELATIVE-OID has no validation constraints
    /// on the component values or count. An empty RELATIVE-OID is valid.
    ///
    /// # Example
    ///
    /// ```
    /// use synta::RelativeOid;
    ///
    /// // Trust anchor ID suffix (e.g., "1" in "32473.1")
    /// let roid = RelativeOid::new(&[1]);
    /// assert_eq!(roid.to_string(), "1");
    ///
    /// // Empty RELATIVE-OID is valid
    /// let empty = RelativeOid::new(&[]);
    /// assert_eq!(empty.to_string(), "");
    /// ```
    pub fn new(components: &[u32]) -> Self {
        Self {
            components: SmallVec::from_slice(components),
        }
    }

    /// Return the RELATIVE-OID as a slice of component integers.
    ///
    /// # Example
    ///
    /// ```
    /// use synta::RelativeOid;
    ///
    /// let roid = RelativeOid::new(&[1, 2, 3]);
    /// assert!(matches!(roid.components(), [1, 2, 3]));
    /// ```
    pub fn components(&self) -> &[u32] {
        &self.components
    }

    /// Parse a RELATIVE-OID from its DER/BER **content** bytes — the raw value
    /// bytes inside a RELATIVE-OID TLV, with the tag (`0x0D`) and length already
    /// stripped.
    ///
    /// # Errors
    ///
    /// Returns [`Error::InvalidOid`](crate::Error::InvalidOid) if `data` contains
    /// a truncated base-128 sequence or causes a `u32` overflow in any component.
    ///
    /// # Example
    ///
    /// ```
    /// use synta::RelativeOid;
    ///
    /// // RELATIVE-OID with components [1, 2, 3]
    /// let roid = RelativeOid::from_content_bytes(&[0x01, 0x02, 0x03]).unwrap();
    /// assert_eq!(roid.to_string(), "1.2.3");
    /// ```
    pub fn from_content_bytes(data: &[u8]) -> crate::Result<Self> {
        let mut components: SmallVec<[u32; 10]> = SmallVec::new();
        let mut i = 0;

        // Each component is independently base-128 encoded
        while i < data.len() {
            let mut value: u32 = 0;
            loop {
                if i >= data.len() {
                    return Err(crate::Error::InvalidOid { position: i });
                }
                let byte = data[i];
                i += 1;
                value = value
                    .checked_mul(128)
                    .and_then(|v| v.checked_add((byte & 0x7F) as u32))
                    .ok_or(crate::Error::InvalidOid { position: i })?;
                if (byte & 0x80) == 0 {
                    break;
                }
            }
            components.push(value);
        }

        Ok(Self { components })
    }

    /// Encode this RELATIVE-OID as DER **content** bytes — the raw base-128 arc
    /// bytes without the `0x0D` tag byte or the length field.
    ///
    /// This is the symmetric counterpart to [`from_content_bytes`].
    ///
    /// [`from_content_bytes`]: Self::from_content_bytes
    ///
    /// # Example
    ///
    /// ```
    /// use synta::RelativeOid;
    ///
    /// let roid = RelativeOid::new(&[1, 2, 3]);
    /// assert_eq!(roid.to_content_bytes(), &[0x01, 0x02, 0x03]);
    /// // Round-trip
    /// assert_eq!(RelativeOid::from_content_bytes(&roid.to_content_bytes()).unwrap(), roid);
    /// ```
    pub fn to_content_bytes(&self) -> Vec<u8> {
        let mut out = Vec::new();
        for &component in &self.components {
            encode_base128(component, &mut out);
        }
        out
    }
}

// `Display` produces canonical dotted-decimal notation, e.g. `"1.2.3"`.
// Empty RELATIVE-OID displays as empty string.
impl core::fmt::Display for RelativeOid {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        let mut iter = self.components.iter();
        if let Some(first) = iter.next() {
            write!(f, "{}", first)?;
            for component in iter {
                write!(f, ".{}", component)?;
            }
        }
        Ok(())
    }
}

// `FromStr` parses dotted-decimal notation (`"1.2.3"`) for RELATIVE-OID.
// Empty string is valid and produces an empty RELATIVE-OID.
#[cfg(feature = "std")]
impl core::str::FromStr for RelativeOid {
    type Err = crate::Error;

    fn from_str(s: &str) -> Result<Self, Self::Err> {
        if s.is_empty() {
            return Ok(Self {
                components: SmallVec::new(),
            });
        }

        let mut components: SmallVec<[u32; 10]> = SmallVec::new();
        for part in s.split('.') {
            let v: u32 = part
                .parse()
                .map_err(|_| crate::Error::InvalidOid { position: 0 })?;
            components.push(v);
        }
        Ok(Self { components })
    }
}

// Implement Decode trait for RelativeOid
impl crate::traits::Decode<'_> for RelativeOid {
    fn decode(decoder: &mut crate::der::decoder::Decoder) -> crate::Result<Self> {
        use crate::tag::TAG_RELATIVE_OID;

        let tag = decoder.read_tag()?;
        let expected_tag = crate::Tag::universal(TAG_RELATIVE_OID);

        if tag != expected_tag {
            return Err(crate::Error::UnexpectedTag {
                position: decoder.position(),
                expected: expected_tag,
                actual: tag,
            });
        }

        let length = decoder.read_length()?;
        let len = length.definite()?;

        let bytes = decoder.read_bytes(len)?;

        RelativeOid::from_content_bytes(bytes).map_err(|_| crate::Error::InvalidOid {
            position: decoder.position(),
        })
    }
}

// Implement Encode trait for RelativeOid
impl crate::traits::Encode for RelativeOid {
    fn encode(&self, encoder: &mut crate::der::encoder::Encoder) -> crate::Result<()> {
        use crate::tag::TAG_RELATIVE_OID;

        let tag = crate::Tag::universal(TAG_RELATIVE_OID);
        encoder.write_tag(tag)?;
        let content = self.to_content_bytes();
        encoder.write_length(content.len())?;
        encoder.write_bytes(&content);
        Ok(())
    }

    fn encoded_len(&self) -> crate::Result<usize> {
        let tag_len = 1;

        // Calculate content length
        let mut content_len = 0;
        for &component in &self.components {
            content_len += base128_len(component);
        }

        let length_len = crate::Length::Definite(content_len).encoded_len()?;
        Ok(tag_len + length_len + content_len)
    }
}

// Implement Tagged trait
impl crate::traits::Tagged for RelativeOid {
    fn tag() -> crate::Tag {
        crate::Tag::universal(crate::tag::TAG_RELATIVE_OID)
    }
}

// ---- serde support ----

/// `RelativeOid` serializes as a dotted-decimal string (e.g. `"1.2.3"`).
/// Empty RELATIVE-OID serializes as empty string `""`.
#[cfg(feature = "serde")]
impl serde::Serialize for RelativeOid {
    fn serialize<S: serde::Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
        use core::fmt::Write;
        let mut buf = String::new();
        for (i, &component) in self.components().iter().enumerate() {
            if i > 0 {
                buf.push('.');
            }
            let _ = write!(buf, "{}", component);
        }
        s.serialize_str(&buf)
    }
}

#[cfg(feature = "serde")]
impl<'de> serde::Deserialize<'de> for RelativeOid {
    fn deserialize<D: serde::Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
        struct RoidVisitor;
        impl<'de> serde::de::Visitor<'de> for RoidVisitor {
            type Value = RelativeOid;
            fn expecting(&self, f: &mut core::fmt::Formatter) -> core::fmt::Result {
                write!(
                    f,
                    "a RELATIVE-OID in dotted-decimal notation (e.g. \"1.2.3\")"
                )
            }
            fn visit_str<E: serde::de::Error>(self, v: &str) -> Result<RelativeOid, E> {
                if v.is_empty() {
                    return Ok(RelativeOid::new(&[]));
                }
                let components: Result<Vec<u32>, _> =
                    v.split('.').map(|p| p.parse::<u32>()).collect();
                let components =
                    components.map_err(|_| E::custom("invalid RELATIVE-OID component"))?;
                Ok(RelativeOid::new(&components))
            }
        }
        d.deserialize_str(RoidVisitor)
    }
}