"""Windows SChannel/SSPI constants from Windows SDK headers."""

from __future__ import annotations

# --- SSPI Security Package ---
UNISP_NAME = "Microsoft Unified Security Protocol Provider"
SCHANNEL_NAME = "Schannel"

# --- Credential Use ---
SECPKG_CRED_INBOUND = 0x00000001
SECPKG_CRED_OUTBOUND = 0x00000002
SECPKG_CRED_BOTH = 0x00000003

# --- InitializeSecurityContext Requirements ---
ISC_REQ_MUTUAL_AUTH = 0x00000002
ISC_REQ_REPLAY_DETECT = 0x00000004
ISC_REQ_SEQUENCE_DETECT = 0x00000008
ISC_REQ_CONFIDENTIALITY = 0x00000010
ISC_REQ_USE_SUPPLIED_CREDS = 0x00000080
ISC_REQ_ALLOCATE_MEMORY = 0x00000100
ISC_REQ_INTEGRITY = 0x00010000
ISC_REQ_STREAM = 0x00008000
ISC_REQ_MANUAL_CRED_VALIDATION = 0x00080000
ISC_REQ_USE_SUPPLIED_CREDS = 0x00000080

# Default flags for TLS client
ISC_REQ_TLS_CLIENT = (
    ISC_REQ_SEQUENCE_DETECT
    | ISC_REQ_REPLAY_DETECT
    | ISC_REQ_CONFIDENTIALITY
    | ISC_REQ_STREAM
    | ISC_REQ_ALLOCATE_MEMORY
)

ISC_REQ_TLS_CLIENT_MTLS = ISC_REQ_TLS_CLIENT | ISC_REQ_USE_SUPPLIED_CREDS

# --- SSPI Return Codes ---
SEC_E_OK = 0x00000000
SEC_I_CONTINUE_NEEDED = 0x00090312
SEC_I_COMPLETE_NEEDED = 0x00090313
SEC_I_COMPLETE_AND_CONTINUE = 0x00090314
SEC_I_CONTEXT_EXPIRED = 0x00090317
SEC_I_INCOMPLETE_CREDENTIALS = 0x00090320
SEC_I_RENEGOTIATE = 0x00090321
SEC_E_INCOMPLETE_MESSAGE = 0x80090318
SEC_E_INSUFFICIENT_MEMORY = 0x80090300
SEC_E_INTERNAL_ERROR = 0x80090304
SEC_E_INVALID_HANDLE = 0x80090301
SEC_E_INVALID_TOKEN = 0x80090308
SEC_E_LOGON_DENIED = 0x8009030C
SEC_E_NO_CREDENTIALS = 0x8009030E
SEC_E_TARGET_UNKNOWN = 0x80090303
SEC_E_UNSUPPORTED_FUNCTION = 0x80090302
SEC_E_WRONG_PRINCIPAL = 0x80090322
SEC_E_CERT_EXPIRED = 0x80090328
SEC_E_CERT_UNKNOWN = 0x80090327
SEC_E_UNTRUSTED_ROOT = 0x80090325
SEC_E_ALGORITHM_MISMATCH = 0x80090331

# --- SecBuffer Types ---
SECBUFFER_EMPTY = 0
SECBUFFER_DATA = 1
SECBUFFER_TOKEN = 2
SECBUFFER_EXTRA = 5
SECBUFFER_STREAM_TRAILER = 6
SECBUFFER_STREAM_HEADER = 7
SECBUFFER_ALERT = 17
SECBUFFER_APPLICATION_PROTOCOLS = 18

SECBUFFER_VERSION = 0

# --- SChannel Protocol Flags ---
SP_PROT_TLS1_2_CLIENT = 0x00000800
SP_PROT_TLS1_2_SERVER = 0x00000400
SP_PROT_TLS1_3_CLIENT = 0x00002000
SP_PROT_TLS1_3_SERVER = 0x00001000

SP_PROT_TLS1_2 = SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_2_SERVER
SP_PROT_TLS1_3 = SP_PROT_TLS1_3_CLIENT | SP_PROT_TLS1_3_SERVER

# Default: TLS 1.2 + 1.3 client-side
SP_PROT_TLS_CLIENT_DEFAULT = SP_PROT_TLS1_2_CLIENT | SP_PROT_TLS1_3_CLIENT

# --- SCHANNEL_CRED Flags ---
SCH_CRED_NO_DEFAULT_CREDS = 0x00000010
SCH_CRED_MANUAL_CRED_VALIDATION = 0x00000008
SCH_CRED_AUTO_CRED_VALIDATION = 0x00000020
SCH_CRED_USE_DEFAULT_CREDS = 0x00000040
SCH_CRED_REVOCATION_CHECK_CHAIN = 0x00000200

# --- SCHANNEL_CRED versions ---
SCHANNEL_CRED_VERSION = 4
SCH_CREDENTIALS_VERSION = 5  # Newer structure (Windows 10+)

# --- Context Attributes (QueryContextAttributes) ---
SECPKG_ATTR_STREAM_SIZES = 4
SECPKG_ATTR_REMOTE_CERT_CONTEXT = 0x53
SECPKG_ATTR_LOCAL_CERT_CONTEXT = 0x54
SECPKG_ATTR_CONNECTION_INFO = 0x5A
SECPKG_ATTR_CIPHER_INFO = 0x64
SECPKG_ATTR_APPLICATION_PROTOCOL = 0x23

# --- ALPN ---
SEC_APPLICATION_PROTOCOL_NEGOTIATION_EXT_ALPN = 0x02
SEC_APPLICATION_PROTOCOL_NEGOTIATION_STATUS_SUCCESS = 0x01
SEC_APPLICATION_PROTOCOL_NEGOTIATION_STATUS_NONE = 0x00

# --- Certificate Store Constants ---
CERT_STORE_PROV_SYSTEM = 10
CERT_SYSTEM_STORE_CURRENT_USER = 0x00010000
CERT_SYSTEM_STORE_LOCAL_MACHINE = 0x00020000
CERT_FIND_HASH = 0x10000
CERT_FIND_SUBJECT_STR = 0x00080007
X509_ASN_ENCODING = 0x00000001
PKCS_7_ASN_ENCODING = 0x00010000
ENCODING_DEFAULT = X509_ASN_ENCODING | PKCS_7_ASN_ENCODING

# --- CryptAcquireCertificatePrivateKey Flags ---
CRYPT_ACQUIRE_CACHE_FLAG = 0x00000001
CRYPT_ACQUIRE_SILENT_FLAG = 0x00000040
CRYPT_ACQUIRE_WINDOW_HANDLE_FLAG = 0x00000080
CRYPT_ACQUIRE_PREFER_NCRYPT_KEY_FLAG = 0x00010000

# --- Key Spec ---
CERT_NCRYPT_KEY_SPEC = 0xFFFFFFFF  # pdwKeySpec value indicating a CNG (NCrypt) key

# --- NCrypt property name for parent window handle ---
NCRYPT_WINDOW_HANDLE_PROPERTY = "UI Window Handle"

# --- PP_CLIENT_HWND: CryptSetProvParam parameter for CAPI parent window ---
PP_CLIENT_HWND = 0x00000065

# --- TLS Cipher Algorithms ---
CALG_AES_128 = 0x0000660E
CALG_AES_256 = 0x00006610
CALG_3DES = 0x00006603

# --- TLS Hash Algorithms ---
CALG_SHA_256 = 0x0000800C
CALG_SHA_384 = 0x0000800D
CALG_SHA_512 = 0x0000800E

# --- TLS Exchange Algorithms ---
CALG_ECDHE = 0x0000AE06
CALG_DH_EPHEM = 0x0000AA02

# Max TLS record size
TLS_MAX_RECORD_SIZE = 16384
