class X509CertRequest {

    boolean validateSpiffeURI(final String domain, final String name, final String value) {

        // the expected default format is
        // spiffe://[<provider-cluster>/ns/]<athenz-domain>/sa/<athenz-service>
        // spiffe://[<provider-cluster>/ns/]<athenz-domain>/ra/<athenz-role>
        //
        // so we'll be validating that our request has:
        // spiffe://<provider-cluster>/ns/<domain>/<name>/<value> or
        // spiffe://<domain>/<name>/<value> or

        if (spiffeUri == null) {
            return true;
        }

        URI uri;
        try {
            uri = new URI(spiffeUri);
        } catch (URISyntaxException ex) {
            LOGGER.error("validateSpiffeURI: Unable to parse {}: {}", spiffeUri, ex.getMessage());
            return false;
        }

        final String uriPath = uri.getPath();
        final String uriHost = uri.getHost();

        if (uriPath == null || uriPath.isEmpty() || uriHost == null || uriHost.isEmpty()) {
            LOGGER.error("validateSpiffeURI: invalid uri {}", spiffeUri);
            return false;
        }

        // let's check to see if our path starts with our
        // namespace ns field and thus which format we're using

        boolean uriVerified = false;
        if (uriPath.startsWith("/ns/")) {
            final String path = "/ns/" + domain + "/" + name + "/" + value;
            uriVerified = uriPath.equalsIgnoreCase(path);
        } else {
            final String path = "/" + name + "/" + value;
            uriVerified = uriHost.equalsIgnoreCase(domain) && uriPath.equalsIgnoreCase(path);
        }

        if (!uriVerified) {
            LOGGER.error("validateSpiffeURI: invalid uri path/host: {}", spiffeUri);
        }

        return uriVerified;
    }

    public  X509CertRequest(String csr);

}