// Code generated by tools/cmd/genoptions/main.go. DO NOT EDIT.

package jwe

import (
	"context"
	"io/fs"

	"github.com/lestrrat-go/jwx/v3/jwa"
	"github.com/lestrrat-go/option/v2"
)

type Option = option.Interface

// CompactOption describes options that can be passed to `jwe.Compact`
type CompactOption interface {
	Option
	compactOption()
}

type compactOption struct {
	Option
}

func (*compactOption) compactOption() {}

// DecryptOption describes options that can be passed to `jwe.Decrypt`
type DecryptOption interface {
	Option
	decryptOption()
}

type decryptOption struct {
	Option
}

func (*decryptOption) decryptOption() {}

// EncryptDecryptOption describes options that can be passed to either `jwe.Encrypt` or `jwe.Decrypt`
type EncryptDecryptOption interface {
	Option
	encryptOption()
	decryptOption()
}

type encryptDecryptOption struct {
	Option
}

func (*encryptDecryptOption) encryptOption() {}

func (*encryptDecryptOption) decryptOption() {}

// EncryptOption describes options that can be passed to `jwe.Encrypt`
type EncryptOption interface {
	Option
	encryptOption()
}

type encryptOption struct {
	Option
}

func (*encryptOption) encryptOption() {}

// GlobalDecryptOption describes options that changes global settings and for each call of the `jwe.Decrypt` function
type GlobalDecryptOption interface {
	Option
	globalOption()
	decryptOption()
}

type globalDecryptOption struct {
	Option
}

func (*globalDecryptOption) globalOption() {}

func (*globalDecryptOption) decryptOption() {}

// GlobalEncryptOption describes options that changes global settings and for each call of the `jwe.Encrypt` function
type GlobalEncryptOption interface {
	Option
	globalOption()
	encryptOption()
}

type globalEncryptOption struct {
	Option
}

func (*globalEncryptOption) globalOption() {}

func (*globalEncryptOption) encryptOption() {}

// GlobalOption describes options that changes global settings for this package
type GlobalOption interface {
	Option
	globalOption()
}

type globalOption struct {
	Option
}

func (*globalOption) globalOption() {}

// GlobalParseOption describes an Option that can be passed to `jwe.Settings()`
// and `jwe.ReadFile()`.
type GlobalParseOption interface {
	Option
	globalOption()
	readFileOption()
}

type globalParseOption struct {
	Option
}

func (*globalParseOption) globalOption() {}

func (*globalParseOption) readFileOption() {}

// ReadFileOption is a type of `Option` that can be passed to `jwe.Parse`
type ParseOption interface {
	Option
	readFileOption()
}

type parseOption struct {
	Option
}

func (*parseOption) readFileOption() {}

// ReadFileOption is a type of `Option` that can be passed to `jwe.ReadFile`
type ReadFileOption interface {
	Option
	readFileOption()
}

type readFileOption struct {
	Option
}

func (*readFileOption) readFileOption() {}

// JSONSuboption describes suboptions that can be passed to `jwe.WithJSON()` option
type WithJSONSuboption interface {
	Option
	withJSONSuboption()
}

type withJSONSuboption struct {
	Option
}

func (*withJSONSuboption) withJSONSuboption() {}

// WithKeySetSuboption is a suboption passed to the WithKeySet() option
type WithKeySetSuboption interface {
	Option
	withKeySetSuboption()
}

type withKeySetSuboption struct {
	Option
}

func (*withKeySetSuboption) withKeySetSuboption() {}

type identAuthenticateData struct{}
type identCBCBufferSize struct{}
type identCEK struct{}
type identCompress struct{}
type identContentEncryptionAlgorithm struct{}
type identContext struct{}
type identCritValidation struct{}
type identFS struct{}
type identKey struct{}
type identKeyProvider struct{}
type identKeyUsed struct{}
type identLegacyHeaderMerging struct{}
type identMaxDecompressBufferSize struct{}
type identMaxPBES2Count struct{}
type identMaxRecipients struct{}
type identMergeProtectedHeaders struct{}
type identMessage struct{}
type identMinPBES2Count struct{}
type identPBES2Count struct{}
type identPerRecipientHeaders struct{}
type identPretty struct{}
type identProtectedHeaders struct{}
type identRequireKid struct{}
type identSerialization struct{}

func (identAuthenticateData) String() string {
	return "WithAuthenticateData"
}

func (identCBCBufferSize) String() string {
	return "WithCBCBufferSize"
}

func (identCEK) String() string {
	return "WithCEK"
}

func (identCompress) String() string {
	return "WithCompress"
}

func (identContentEncryptionAlgorithm) String() string {
	return "WithContentEncryption"
}

func (identContext) String() string {
	return "WithContext"
}

func (identCritValidation) String() string {
	return "WithCritValidation"
}

func (identFS) String() string {
	return "WithFS"
}

func (identKey) String() string {
	return "WithKey"
}

func (identKeyProvider) String() string {
	return "WithKeyProvider"
}

func (identKeyUsed) String() string {
	return "WithKeyUsed"
}

func (identLegacyHeaderMerging) String() string {
	return "WithLegacyHeaderMerging"
}

func (identMaxDecompressBufferSize) String() string {
	return "WithMaxDecompressBufferSize"
}

func (identMaxPBES2Count) String() string {
	return "WithMaxPBES2Count"
}

func (identMaxRecipients) String() string {
	return "WithMaxRecipients"
}

func (identMergeProtectedHeaders) String() string {
	return "WithMergeProtectedHeaders"
}

func (identMessage) String() string {
	return "WithMessage"
}

func (identMinPBES2Count) String() string {
	return "WithMinPBES2Count"
}

func (identPBES2Count) String() string {
	return "WithPBES2Count"
}

func (identPerRecipientHeaders) String() string {
	return "WithPerRecipientHeaders"
}

func (identPretty) String() string {
	return "WithPretty"
}

func (identProtectedHeaders) String() string {
	return "WithProtectedHeaders"
}

func (identRequireKid) String() string {
	return "WithRequireKid"
}

func (identSerialization) String() string {
	return "WithSerialization"
}

// WithCBCBufferSize specifies the maximum buffer size for internal
// calculations, such as when AES-CBC is performed. The default value is 256MB.
// If set to an invalid value, the default value is used.
// In v2, this option was called MaxBufferSize.
//
// This option has a global effect.
func WithCBCBufferSize(v int64) GlobalOption {
	return &globalOption{option.New(identCBCBufferSize{}, v)}
}

// WithCEK allows users to specify a variable to store the CEK used in the
// message upon successful decryption. The variable must be a pointer to
// a byte slice, and it will only be populated if the decryption is successful.
//
// This option is currently considered EXPERIMENTAL, and is subject to
// future changes across minor/micro versions.
func WithCEK(v *[]byte) DecryptOption {
	return &decryptOption{option.New(identCEK{}, v)}
}

// WithCompress specifies the compression algorithm to use when encrypting
// a payload using `jwe.Encrypt` (Yes, we know it can only be "" or "DEF",
// but the way the specification is written it could allow for more options,
// and therefore this option takes an argument)
//
// Compression can leak information about the plaintext through message
// length, so enable it only when you understand that tradeoff.
//
// This library does not enforce an encrypt-side plaintext size limit before
// compression. Callers that accept untrusted or arbitrarily large payloads
// must bound the input size before calling `jwe.Encrypt` with this option.
//
// Recipients may independently reject compressed messages whose
// decompressed payload exceeds their `jwe.WithMaxDecompressBufferSize`
// setting.
func WithCompress(v jwa.CompressionAlgorithm) EncryptOption {
	return &encryptOption{option.New(identCompress{}, v)}
}

// WithContentEncryptionAlgorithm specifies the algorithm to encrypt the
// JWE message content with. If not provided, `jwa.A256GCM` is used.
func WithContentEncryption(v jwa.ContentEncryptionAlgorithm) EncryptOption {
	return &encryptOption{option.New(identContentEncryptionAlgorithm{}, v)}
}

// WithContext specifies the context.Context object to use when decrypting a JWE message.
// If not provided, context.Background() will be used.
func WithContext(v context.Context) DecryptOption {
	return &decryptOption{option.New(identContext{}, v)}
}

// WithCritValidation enables RFC 7516 Section 4.1.13 (via RFC 7515
// Section 4.1.11) validation of the "crit" (Critical) header parameter
// during decryption. The default is false, matching the behavior of
// v3.0.13 and earlier (the "crit" header is silently ignored).
//
// When enabled, jwe.Decrypt() will reject any JWE whose protected
// header lists "crit" entries that the recipient has not declared
// support for via jwe.WithCritExtension(). It will also reject
// structurally invalid "crit" lists: empty arrays, duplicate names,
// empty extension names, names of standard JOSE/JWE header parameters,
// and names that do not appear as header parameters in the protected
// header.
//
// Per RFC 7516 Section 4.1.13 (referencing RFC 7515 Section 4.1.11),
// recipients MUST reject a JWE whose "crit" list names extensions
// they do not understand. Enabling this option together with one or
// more jwe.WithCritExtension() calls is the only way to satisfy that
// requirement with this library.
//
// IMPORTANT: enabling this option makes the library check that every
// "crit" entry has been declared via jwe.WithCritExtension(), but the
// library cannot perform the actual extension-specific processing on
// your behalf. After jwe.Decrypt() returns successfully, your code
// MUST read each declared extension header and apply whatever check
// or side effect the extension semantics demand. If you declare an
// extension and then forget to act on its value, you have defeated
// the protection the producer was trying to obtain by marking that
// extension critical. See the documentation on jwe.WithCritExtension
// for details.
func WithCritValidation(v bool) DecryptOption {
	return &decryptOption{option.New(identCritValidation{}, v)}
}

// WithFS specifies the source `fs.FS` object to read the file from.
func WithFS(v fs.FS) ReadFileOption {
	return &readFileOption{option.New(identFS{}, v)}
}

func WithKeyProvider(v KeyProvider) DecryptOption {
	return &decryptOption{option.New(identKeyProvider{}, v)}
}

// WithKeyUsed allows you to specify the `jwe.Decrypt()` function to
// return the key used for decryption. This may be useful when
// you specify multiple key sources or if you pass a `jwk.Set`
// and you want to know which key was successful at decrypting the
// CEK.
//
// `v` must be a pointer to an empty `any`. Do not use
// `jwk.Key` here unless you are 100% sure that all keys that you
// have provided are instances of `jwk.Key` (remember that the
// jwx API allows users to specify a raw key such as *rsa.PublicKey)
func WithKeyUsed(v any) DecryptOption {
	return &decryptOption{option.New(identKeyUsed{}, v)}
}

// WithLegacyHeaderMerging specifies whether to perform legacy header merging
// when encrypting a JWE message in JSON serialization, when there is a single recipient.
// This behavior is enabled by default for backwards compatibility.
//
// When a JWE message is encrypted in JSON serialization, and there is only
// one recipient, this library automatically serializes the message in
// flattened JSON serialization format. In older versions of this library,
// the protected headers and the per-recipient headers were merged together
// before computing the AAD (Additional Authenticated Data), but the per-recipient
// headers were kept as-is in the `header` field of the recipient object.
//
// This behavior is not compliant with the JWE specification, which states that
// the headers must be disjoint.
//
// Passing this option with a value of `false` disables this legacy behavior,
// and while the per-recipient headers and protected headers are still merged
// for the purpose of computing AAD, the per-recipient headers are cleared
// after merging, so that the resulting JWE message is compliant with the
// specification.
//
// This option has no effect when there are multiple recipients, or when
// the serialization format is compact serialization. For multiple recipients
// (i.e. full JSON serialization), the protected headers and per-recipient
// headers are never merged, and it is the caller's responsibility to ensure
// that the headers are disjoint. In compact serialization, there are no per-recipient
// headers; in fact, the protected headers are the only headers that exist,
// and therefore there is no possibility of header collision after merging
// (note: while per-recipient headers do not make sense in compact serialization,
// this library does not prevent you from setting them -- they are all just
// merged into the protected headers).
//
// In future versions, the new behavior will be the default. New users are
// encouraged to set this option to `false` now to avoid future issues.
func WithLegacyHeaderMerging(v bool) EncryptOption {
	return &encryptOption{option.New(identLegacyHeaderMerging{}, v)}
}

// WithMaxDecompressBufferSize specifies the maximum buffer size for used when
// decompressing the payload of a JWE message. If a compressed JWE payload
// exceeds this amount when decompressed, jwe.Decrypt will return an error.
// The default value is 10MB.
//
// A non-positive value rejects every compressed JWE: the cap fires on
// the first byte of inflated output, so any "zip"-compressed message
// fails with an exceeds-cap error before any payload is delivered. Use
// this when the deployment refuses to accept compressed JWEs at all.
// Pass an explicit positive cap when compressed payloads are expected.
//
// This option can be used for `jwe.Settings()`, which changes the behavior
// globally, or for `jwe.Decrypt()`, which changes the behavior for that
// specific call.
func WithMaxDecompressBufferSize(v int64) GlobalDecryptOption {
	return &globalDecryptOption{option.New(identMaxDecompressBufferSize{}, v)}
}

// WithMaxPBES2Count specifies the maximum number of PBES2 iterations
// to use when decrypting a message. If not specified, the default
// value of 10,000 is used.
//
// The cap is applied per recipient. RFC 7516 §5.3 allows each
// recipient of a JSON-serialized JWE to carry its own "p2c" iteration
// count in its per-recipient unprotected header, and jwe.Decrypt
// honors that. For a JWE with N recipients, the worst-case PBKDF2
// cost is therefore on the order of N * MaxPBES2Count iterations per
// decrypt attempt. When accepting multi-recipient JSON JWEs from
// untrusted senders, also clamp jwe.WithMaxRecipients.
//
// This option can be used for `jwe.Settings()`, which changes the behavior
// globally, or for `jwe.Decrypt()`, which changes the behavior for that
// specific call.
func WithMaxPBES2Count(v int) GlobalDecryptOption {
	return &globalDecryptOption{option.New(identMaxPBES2Count{}, v)}
}

// WithMaxRecipients specifies the maximum number of recipients allowed
// in a JWE message. If a JWE message contains more recipients than this
// value, parsing or decryption will return an error. The default value
// is 100.
//
// This option can be used for `jwe.Settings()`, which changes the behavior
// globally, or for `jwe.Decrypt()`, which changes the behavior for that
// specific call.
func WithMaxRecipients(v int) GlobalDecryptOption {
	return &globalDecryptOption{option.New(identMaxRecipients{}, v)}
}

// WithMergeProtectedHeaders specify that when given multiple headers
// as options to `jwe.Encrypt`, these headers should be merged instead
// of overwritten
func WithMergeProtectedHeaders(v bool) EncryptOption {
	return &encryptOption{option.New(identMergeProtectedHeaders{}, v)}
}

// WithMessage provides a message object to be populated by `jwe.Decrypt`
// Using this option allows you to decrypt AND obtain the `jwe.Message`
// in one go.
func WithMessage(v *Message) DecryptOption {
	return &decryptOption{option.New(identMessage{}, v)}
}

// WithMinPBES2Count specifies the minimum number of PBES2 iterations
// to accept when decrypting a message. If not specified, the default
// value of 1,000 is used (RFC 7518 §4.8.1.2 floor). Set to 0 to
// disable the minimum check (NOT RECOMMENDED for untrusted issuers
// — without a floor, recipients accept arbitrarily-weak password-
// derived keys and silently spend the producer-chosen amount of
// crypto work to verify them).
//
// Threat model: a malicious or careless issuer signs a PBES2-wrapped
// JWE with a very low p2c (e.g. 100) so they spend almost no CPU on
// their side, while the recipient happily derives the wrap key with
// the same low iteration count. The result is an authenticated
// message whose key-derivation strength is well below industry
// practice (OWASP 2023 recommends ≥600,000 PBKDF2-SHA256 iterations
// for password-derived keys; the RFC floor of 1,000 is far below
// that). For receiver-side hardening against under-iteration, raise
// WithMinPBES2Count above 1,000.
//
// This option can be used for `jwe.Settings()`, which changes the behavior
// globally, or for `jwe.Decrypt()`, which changes the behavior for that
// specific call.
func WithMinPBES2Count(v int) GlobalDecryptOption {
	return &globalDecryptOption{option.New(identMinPBES2Count{}, v)}
}

// WithPBES2Count specifies the number of PBKDF2 iterations to use when
// encrypting a key with the PBES2 family of algorithms. If not specified,
// the default value of 10,000 is used. Modern guidance (OWASP 2023)
// recommends 600,000 or more for PBKDF2-HMAC-SHA256.
//
// This option only affects encryption. Iteration counts on incoming
// messages are validated separately on decrypt via WithMinPBES2Count
// and WithMaxPBES2Count.
//
// This option can be used for `jwe.Settings()`, which changes the behavior
// globally, or for `jwe.Encrypt()`, which changes the behavior for that
// specific call.
func WithPBES2Count(v int) GlobalEncryptOption {
	return &globalEncryptOption{option.New(identPBES2Count{}, v)}
}

// WithPretty specifies whether the JSON output should be formatted and
// indented
func WithPretty(v bool) WithJSONSuboption {
	return &withJSONSuboption{option.New(identPretty{}, v)}
}

// WithRequiredKid specifies whether the keys in the jwk.Set should
// only be matched if the target JWE message's Key ID and the Key ID
// in the given key matches.
func WithRequireKid(v bool) WithKeySetSuboption {
	return &withKeySetSuboption{option.New(identRequireKid{}, v)}
}

// WithCompact specifies that the result of `jwe.Encrypt()` is serialized in
// compact format.
//
// By default `jwe.Encrypt()` will opt to use compact format, so you usually
// do not need to specify this option other than to be explicit about it
func WithCompact() EncryptOption {
	return &encryptOption{option.New(identSerialization{}, fmtCompact)}
}