module infix-keystore {
  yang-version 1.1;
  namespace "urn:infix:keystore:ns:yang:1.0";
  prefix infix-ks;
  import ietf-keystore {
    prefix ks;
  }
  import ietf-crypto-types {
    prefix ct;
  }
  import infix-crypto-types {
    prefix infix-ct;
  }
  revision 2025-06-17 {
    description "Add Wi-Fi secrets support";
  }
  revision 2025-02-04 {
    description "Initial";
  }
  deviation "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key/ks:public-key-format" {
    deviate replace {
      type identityref {
        base infix-ct:public-key-format;
      }
    }
  }
  deviation "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key/ks:private-key-format" {
    deviate replace {
      type identityref {
        base infix-ct:private-key-format;
      }
    }
  }
  deviation "/ks:keystore/ks:symmetric-keys/ks:symmetric-key/ks:key-format" {
    deviate not-supported;
  }
  augment "/ks:keystore/ks:symmetric-keys/ks:symmetric-key" {
    leaf key-format {
      type identityref {
        base infix-ct:symmetric-key-format;
      }
      description
        "Identifies the symmetric key's format

        Valid symmetric key formats are:
        wifi-preshared-key-format  - WiFi preshared key";
    }
  }
  deviation "/ks:keystore/ks:symmetric-keys/ks:symmetric-key/ks:key-type/ks:cleartext-key/ks:cleartext-key" {
    deviate not-supported;
  }
  augment "/ks:keystore/ks:symmetric-keys/ks:symmetric-key/ks:key-type" {
    case cleartext-key {
      leaf cleartext-key {
        type string;
        must "../../ks:key-format != 'infix-ct:wifi-preshared-key-format' or " +
          "(string-length(.) >= 8 and string-length(.) <= 63)" {
          error-message "WiFi pre-shared key must be 8-63 characters long";
        }
        description "WiFi pre-shared key: 8-63 printable ASCII characters";

      }
    }
  }
}
