namespace NATS.Server.Tls;

// OcspMode mirrors the OCSPMode constants from the Go reference implementation (ocsp.go).
// Auto   — staple only if the certificate contains the status_request TLS extension.
// Always — always attempt stapling; warn but continue if the OCSP response cannot be obtained.
// Must   — stapling is mandatory; fail server startup if the OCSP response cannot be obtained.
// Never  — never attempt stapling regardless of certificate extensions.
public enum OcspMode
{
    Auto   = 0,
    Always = 1,
    Must   = 2,
    Never  = 3,
}

public sealed class OcspConfig
{
    public OcspMode Mode { get; init; } = OcspMode.Auto;
    public string[] OverrideUrls { get; init; } = [];
}