Index: creddy/creddy.hh
===================================================================
--- creddy/creddy.hh	(revision 45d9cedb4afae41dbac79aa92e655283b4a81659)
+++ creddy/creddy.hh	(revision 45d9cedb4afae41dbac79aa92e655283b4a81659)
@@ -0,0 +1,106 @@
+#ifndef __CREDDY_HH__
+#define __CREDDY_HH__
+
+#include <cstdio>
+#include <stdexcept>
+
+namespace Creddy {
+    extern "C" {
+        #include <creddy.h>
+    }
+
+    class ID {
+        public:
+            ID() : m_id(NULL) { } // do not use: required by swig
+
+            // load an ID from a file
+            ID(char *filename) : m_id(NULL) {
+                m_id = creddy_id_from_file(filename);
+                if (m_id == NULL)
+                    throw std::invalid_argument("Could not load ID cert");
+            }
+
+            // generate an ID with a given CN and validity
+            ID(char *cn, int validity) : m_id(NULL) {
+                int ret = creddy_id_generate(&m_id, cn, validity);
+                if (ret == CREDDY_GENERATE_INVALID_CN)
+                    throw std::invalid_argument("CN must be alphanumeric and start with a letter");
+                if (ret == CREDDY_GENERATE_INVALID_VALIDITY)
+                    throw std::invalid_argument("Validity must be > 0 days");
+            }
+
+            ~ID() { creddy_id_free(m_id); }
+
+            // load private key from a file
+            void load_privkey(char *filename) {
+                int ret = creddy_id_load_privkey(m_id, filename);
+                if (!ret)
+                    throw std::invalid_argument("Could not load private key");
+            }
+
+            char *keyid() { return creddy_id_keyid(m_id); }
+            char *cert_filename() { return creddy_id_cert_filename(m_id); }
+            void write_cert(std::FILE *out) { creddy_id_write_cert(m_id, out); }
+            char *privkey_filename() { return creddy_id_privkey_filename(m_id); }
+            void write_privkey(std::FILE *out) { creddy_id_write_privkey(m_id, out); }
+
+            friend class Attribute;
+
+        private:
+            creddy_id_t *m_id;
+    };
+
+    class Attribute {
+        public:
+            Attribute() : m_attr(NULL) { } // do not use: required by swig
+
+            // create a cert
+            Attribute(ID &issuer, char *role, int validity) : m_attr(NULL) {
+                int ret = creddy_attribute_create(&m_attr, issuer.m_id, role, validity);
+                if (ret == CREDDY_ATTRIBUTE_ISSUER_NOKEY)
+                    throw std::invalid_argument("Issuer has no private key");
+                if (ret == CREDDY_ATTRIBUTE_INVALID_ROLE)
+                    throw std::invalid_argument("Role name must be alphanumeric");
+                if (ret == CREDDY_ATTRIBUTE_INVALID_VALIDITY)
+                    throw std::invalid_argument("Validity must be > 0 days");
+            }
+
+            ~Attribute() { creddy_attribute_free(m_attr); }
+
+            // these return false if there's a bad keyid or role name
+            // they'll throw a std::logic_error if the cert's been baked
+            bool principal(char *keyid) {
+                if (baked()) throw std::logic_error("Cert is already baked");
+                return creddy_attribute_principal(m_attr, keyid);
+            }
+            bool role(char *keyid, char *role) {
+                if (baked()) throw std::logic_error("Cert is already baked");
+                return creddy_attribute_role(m_attr, keyid, role);
+            }
+            bool linking_role(char *keyid, char *role, char *linked) {
+                if (baked()) throw std::logic_error("Cert is already baked");
+                return creddy_attribute_linking_role(m_attr, keyid, role, linked);
+            }
+
+            // returns false if there are no subjects or libstrongswan fails
+            // throws a std::logic_error if the cert's already been baked
+            bool bake() {
+                if (baked()) throw std::logic_error("Cert is already baked");
+                return creddy_attribute_bake(m_attr);
+            }
+
+            // returns true iff the cert's been baked
+            bool baked() { return creddy_attribute_baked(m_attr); }
+
+            // throws a std::logic_error if the cert isn't baked
+            void write(std::FILE *out) {
+                int ret = creddy_attribute_write(m_attr, out);
+                if (!ret) throw std::logic_error("Cert is not baked");
+            }
+
+        private:
+            creddy_attribute_t *m_attr;
+    };
+}
+
+#endif /* __CREDDY_HH__ */
