#ifndef __DKIMVerifier_h__
#define __DKIMVerifier_h__

#include <string>
#include <vector>

namespace mail {

   ///
   /// DKIMVerifier checks the DKIM-Signature header(s) (RFC 6376) on an
   /// already-fully-received message: for each one present, fetches the
   /// claimed signer's public key from DNS and verifies the signature
   /// against it. Exists specifically to support DMARC's DKIM-alignment
   /// check (DMARCChecker) - a signature that verifies but whose d=
   /// domain does not align with the message's From: header doesn't
   /// make the message DMARC-authenticated via DKIM, so both the
   /// cryptographic result AND the signing domain are reported back for
   /// DMARC to judge alignment itself.
   ///
   /// A message may carry more than one DKIM-Signature (e.g. one from
   /// the original sender, one added by a mailing list) - every one
   /// present is verified independently.
   ///
   /// Unlike DKIMSigner (which only ever produces relaxed/relaxed,
   /// rsa-sha256 signatures of its own), this has to interoperate with
   /// whatever a real remote sender actually used, so it supports all
   /// four canonicalization combinations (simple/relaxed for header/body)
   /// a real DKIM-Signature's c= tag can specify. Does not implement
   /// signature expiry (x=) checking or Ed25519 (RFC 8463) - both real
   /// gaps, but the overwhelming majority of real-world DKIM signatures
   /// today are plain rsa-sha256 with no expiry set.
   ///

   class DKIMVerifier {

    public:

      struct SignatureResult {
         bool valid = false;
         std::string domain;      // d= tag - the identity DMARC needs to align against
         std::string selector;    // s= tag
      };

      static std::vector<SignatureResult> verify(const std::string &message);

   };

}

#endif