feat: port el-ui vessels — rename crates→vessels, add El source + manifests

ui/vessels/el-publish/src/cert.rs

@@ -0,0 +1,157 @@
+//! Certificate management — load, save, check expiry, generate renewal warnings.
+
+use crate::{PublishError, PublishResult};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// Info about a code signing certificate.
+#[derive(Debug, Clone)]
+pub struct CertInfo {
+    pub name: String,
+    pub team_id: String,
+    pub serial: String,
+    /// Certificate type: "Distribution", "Development", "Push", etc.
+    pub cert_type: String,
+    /// Expiry as Unix timestamp (seconds since epoch).
+    pub expires_at: u64,
+    /// Whether the certificate is currently valid.
+    pub is_valid: bool,
+}
+
+impl CertInfo {
+    pub fn new(
+        name: impl Into<String>,
+        team_id: impl Into<String>,
+        serial: impl Into<String>,
+        cert_type: impl Into<String>,
+        expires_at: u64,
+    ) -> Self {
+        let now = unix_now();
+        Self {
+            name: name.into(),
+            team_id: team_id.into(),
+            serial: serial.into(),
+            cert_type: cert_type.into(),
+            expires_at,
+            is_valid: expires_at > now,
+        }
+    }
+
+    /// Days until expiry (0 if already expired).
+    pub fn days_until_expiry(&self) -> u64 {
+        let now = unix_now();
+        if self.expires_at <= now {
+            return 0;
+        }
+        (self.expires_at - now) / 86400
+    }
+
+    /// Whether the cert expires within `days` days.
+    pub fn expires_soon(&self, days: u64) -> bool {
+        self.days_until_expiry() <= days
+    }
+
+    pub fn is_expired(&self) -> bool {
+        unix_now() >= self.expires_at
+    }
+}
+
+/// Certificate store — loads, caches, and checks expiry of code signing certs.
+pub struct CertStore {
+    certs: Vec<CertInfo>,
+    /// How many days before expiry to warn (default: 30).
+    pub warn_days: u64,
+}
+
+impl CertStore {
+    pub fn new() -> Self {
+        Self { certs: Vec::new(), warn_days: 30 }
+    }
+
+    pub fn with_warn_days(mut self, days: u64) -> Self {
+        self.warn_days = days;
+        self
+    }
+
+    /// Add a certificate to the store.
+    pub fn add(&mut self, cert: CertInfo) {
+        self.certs.push(cert);
+    }
+
+    /// Find a certificate by team ID and type.
+    pub fn find(&self, team_id: &str, cert_type: &str) -> Option<&CertInfo> {
+        self.certs.iter().find(|c| {
+            c.team_id == team_id && c.cert_type == cert_type && !c.is_expired()
+        })
+    }
+
+    /// Get all certificates expiring soon (within `warn_days`).
+    pub fn expiring_soon(&self) -> Vec<&CertInfo> {
+        self.certs
+            .iter()
+            .filter(|c| c.expires_soon(self.warn_days))
+            .collect()
+    }
+
+    /// Generate renewal warnings for expiring certificates.
+    pub fn renewal_warnings(&self) -> Vec<String> {
+        self.expiring_soon()
+            .iter()
+            .map(|c| {
+                if c.is_expired() {
+                    format!(
+                        "EXPIRED: {} ({}) — team {}. Renew immediately.",
+                        c.name, c.cert_type, c.team_id
+                    )
+                } else {
+                    format!(
+                        "EXPIRING SOON: {} ({}) expires in {} days — team {}. Renew before publishing.",
+                        c.name, c.cert_type, c.days_until_expiry(), c.team_id
+                    )
+                }
+            })
+            .collect()
+    }
+
+    /// Check that a valid distribution certificate exists for the given team.
+    pub fn validate_for_distribution(&self, team_id: &str) -> PublishResult<()> {
+        let cert = self.find(team_id, "Distribution");
+        match cert {
+            None => Err(PublishError::Certificate(format!(
+                "no valid Distribution certificate found for team {}. Run: el auth add-apple",
+                team_id
+            ))),
+            Some(c) if c.expires_soon(7) => Err(PublishError::Certificate(format!(
+                "Distribution certificate for team {} expires in {} days. Renew now.",
+                team_id,
+                c.days_until_expiry()
+            ))),
+            _ => Ok(()),
+        }
+    }
+
+    /// Load certificates from a JSON file (stub — real impl would parse
+    /// Apple's certificate PEM files or keychain API).
+    pub fn load_from_file(_path: &str) -> PublishResult<Self> {
+        // TODO: parse certificate PEM/P12 files, extract expiry via x509-parser
+        Ok(Self::new())
+    }
+
+    /// Save certificate metadata to a JSON cache file.
+    pub fn save_to_file(&self, _path: &str) -> PublishResult<()> {
+        // TODO: serialize cert metadata to JSON
+        Ok(())
+    }
+}
+
+impl Default for CertStore {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+fn unix_now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+}