//! Mutual TLS (mTLS) and X.509 Certificate Validation Module
//!
//! This module provides comprehensive mTLS support for the API Gateway:
//!
//! ## 6-Layer Security Validation
//!
//! 1. **Certificate Expiry Check** - Validates certificate is within valid time period
//! 2. **Revocation Check** - CRL and OCSP certificate revocation status
//! 3. **Certificate Chain Verification** - Validates signature chain to CA
//! 4. **Extended Key Usage** - Ensures certificate has TLS Client Authentication purpose
//! 5. **Signature Verification** - Validates certificate cryptographic signature
//! 6. **Hostname Verification** - Validates Subject Alternative Names (SAN)
//!
//! ## Architecture
//!
//! - **validator.rs**: X509CertificateValidator with 6-layer validation
//! - **revocation.rs**: CRL/OCSP revocation checking
//! - **tls_config.rs**: TLS server configuration and identity extraction
//!
//! ## Usage
//!
//! ```rust,no_run
//! use api::auth::mtls::{ApiGatewayTlsConfig, TlsInterceptor};
//! use config::manager::ConfigManager;
//! use std::sync::Arc;
//!
//! # async fn example() -> anyhow::Result<()> {
//! // Load TLS configuration from config crate
//! let config_manager = ConfigManager::new().await?;
//! let tls_config = ApiGatewayTlsConfig::from_config(&config_manager).await?;
//! let tls_config = Arc::new(tls_config);
//!
//! // Create TLS interceptor for gRPC requests
//! let interceptor = TlsInterceptor::new(tls_config.clone());
//!
//! // Convert to tonic ServerTlsConfig
//! let server_tls = tls_config.to_server_tls_config();
//! # Ok(())
//! # }
//! ```
//!
//! ## TLS 1.3 Enforcement
//!
//! The API Gateway enforces TLS 1.3 by default for maximum security and performance.
//! TLS 1.2 is supported but not recommended for production use.
//!
//! ## Certificate Requirements
//!
//! Client certificates must:
//! - Be issued by a trusted CA
//! - Have Extended Key Usage with TLS Client Authentication (1.3.6.1.5.5.7.3.2)
//! - Have valid Organizational Unit (OU): trading, admin, analytics, risk, or compliance
//! - Not be marked as a CA certificate (Basic Constraints: CA=false)
//! - Not be revoked (if revocation checking enabled)
//! - Be within valid time period (not before/not after)
//!
//! ## Role-Based Access Control (RBAC)
//!
//! User roles are derived from certificate Organizational Unit (OU):
//! - **admin**: Full system access with configuration permissions
//! - **trading**: Order submission, modification, and cancellation
//! - **analytics**: Data analysis and backtesting
//! - **risk**: Position viewing and risk limit management
//! - **compliance**: Audit reports and regulatory compliance
//!

pub mod revocation;
pub mod tls_config;
pub mod validator;

// Re-export primary types
pub use validator::{ClientIdentity, UserRole, X509CertificateValidator};

pub use revocation::RevocationChecker;

pub use common::tls::TlsProtocolVersion;
pub use tls_config::{ApiGatewayTlsConfig, TlsInterceptor};
