package com.yahoo.security.tls;

import java.security.cert.X509Certificate;
import java.util.List;
import java.util.Set;

/**
 * @author bjorncs
 */
public record ConnectionAuthContext(List<X509Certificate> peerCertificateChain,
                                    CapabilitySet capabilities,
                                    Set<String> matchedPolicies) {

    public ConnectionAuthContext {
        if (peerCertificateChain.isEmpty()) throw new IllegalArgumentException("Peer certificate chain is empty");
        peerCertificateChain = List.copyOf(peerCertificateChain);
        matchedPolicies = Set.copyOf(matchedPolicies);
    }

    public boolean authorized() { return !capabilities.hasNone(); }

    public X509Certificate peerCertificate() { return peerCertificateChain.get(0); }

}

@@ -37,87 +37,346 @@
 ort 
-java.security.cert.X509Certificate;%0Aimport java.util.List;%0Aimport java.util.Set
+com.yahoo.security.SubjectAlternativeName;%0Aimport com.yahoo.security.X509CertificateUtils;%0A%0Aimport java.security.cert.X509Certificate;%0Aimport java.util.List;%0Aimport java.util.Optional;%0Aimport java.util.Set;%0A%0Aimport static com.yahoo.security.SubjectAlternativeName.Type.DNS;%0Aimport static com.yahoo.security.SubjectAlternativeName.Type.URI
 ;%0A%0A/
@@ -971,16 +971,25 @@
  public 
+Optional%3C
 X509Cert
@@ -995,16 +995,17 @@
 tificate
+%3E
  peerCer
@@ -1012,24 +1012,32 @@
 tificate() %7B
+%0A       
  return peer
@@ -1057,15 +1057,1262 @@
 ain.
-get(0);
+isEmpty() ? Optional.empty() : Optional.of(peerCertificateChain.get(0));%0A    %7D%0A%0A    public Optional%3CString%3E peerCertificateString() %7B%0A        X509Certificate cert = peerCertificate().orElse(null);%0A        if (cert == null) return Optional.empty();%0A        StringBuilder b = new StringBuilder(%22X.509Cert%7B%22);%0A        String cn = X509CertificateUtils.getSubjectCommonName(cert).orElse(null);%0A        if (cn != null) %7B%0A            b.append(%22CN='%22).append(cn).append(%22'%22);%0A        %7D%0A        var sans = X509CertificateUtils.getSubjectAlternativeNames(cert);%0A        List%3CString%3E dnsNames = sans.stream()%0A                .filter(s -%3E s.getType() == DNS)%0A                .map(SubjectAlternativeName::getValue)%0A                .toList();%0A        if (!dnsNames.isEmpty()) %7B%0A            if (cn != null) b.append(%22, %22);%0A            b.append(%22SAN_DNS=%22).append(dnsNames);%0A        %7D%0A        List%3CString%3E uris = sans.stream()%0A                .filter(s -%3E s.getType() == URI)%0A                .map(SubjectAlternativeName::getValue)%0A                .toList();%0A        if (!uris.isEmpty()) %7B%0A            if (cn != null %7C%7C !dnsNames.isEmpty()) b.append(%22, %22);%0A            b.append(%22SAN_URI=%22).append(uris);%0A        %7D%0A        return Optional.of(b.append(%22%7D%22).toString());%0A   
  %7D%0A%0A

Add to-string helper to ConnectionAuthContext