#include <sys/ioctl.h>
#include <fcntl.h>
#include "keyvault.h"

int fd = open("/dev/keyvault", O_RDWR);

// Generate a key
struct kv_genkey_req gen = {
    .algorithm = KV_ALG_AES256_GCM,
    .key_bits = 256
};
ioctl(fd, KV_IOC_GENKEY, &gen);
uint64_t key_id = gen.key_id;

// Encrypt data
const char *data = "Hello, World!";
size_t data_len = strlen(data);

// Buffers: ciphertext is same size as plaintext for GCM
uint8_t ciphertext[128];          // Must be >= data_len
uint8_t nonce[KV_AEAD_NONCE_SIZE]; // 12 bytes, filled by kernel
uint8_t tag[KV_AEAD_TAG_SIZE];     // 16 bytes, auth tag output

struct kv_aead_encrypt_req enc = {
    .key_id = key_id,
    .plaintext = data,
    .plaintext_len = data_len,
    .ciphertext = ciphertext,
    .ciphertext_len = sizeof(ciphertext),
    .nonce = NULL,                 // NULL = kernel generates random nonce
    .nonce_out = nonce,            // Kernel writes nonce here (12 bytes)
    .tag = tag                     // Kernel writes tag here (16 bytes)
};
ioctl(fd, KV_IOC_AEAD_ENCRYPT, &enc);
// enc.ciphertext_len now contains actual ciphertext length (== data_len)
// nonce[] and tag[] are filled by kernel - save these for decryption!

// Process A: Create key and restrict capabilities
int fd = open("/dev/keyvault", O_RDWR);
ioctl(fd, KV_IOC_GENKEY, &gen);

// Remove dangerous capabilities before passing fd
struct kv_restrict_req restrict = {
    .caps = KV_CAP_READONLY  // Only encrypt/decrypt/hash/mac
};
ioctl(fd, KV_IOC_RESTRICT, &restrict);

// Pass fd to Process B via Unix socket (SCM_RIGHTS)
sendmsg(sock, &msg, 0);

// Process B receives fd and can:
// - Encrypt/decrypt with existing keys
// - Compute MACs and hashes
// Process B CANNOT:
// - Generate new keys
// - Destroy or revoke keys