@eudiplo/cli 7.0.1 → 7.1.0

package/templates/schemas/IssuanceConfig.schema.json

@@ -0,0 +1,492 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "batchSize": {
+      "description": "Optional issuance batch size.",
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 9007199254740991
+    },
+    "dPopRequired": {
+      "description": "Require DPoP proofs for issuance endpoints.",
+      "type": "boolean"
+    },
+    "walletAttestationRequired": {
+      "description": "Require wallet attestation in issuance flows.",
+      "type": "boolean"
+    },
+    "walletProviderTrustLists": {
+      "description": "Optional wallet provider trust list references.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "url": {
+            "type": "string",
+            "format": "uri",
+            "description": "URL of the wallet provider trust list."
+          },
+          "verifierKey": {
+            "description": "Optional verifier key material used for trust list verification.",
+            "type": "object",
+            "propertyNames": {
+              "type": "string"
+            },
+            "additionalProperties": {}
+          },
+          "verifierX509Der": {
+            "description": "Optional verifier certificate in DER/base64 form.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "url"
+        ],
+        "additionalProperties": false
+      }
+    },
+    "signingKeyId": {
+      "description": "Default signing key chain id for credential issuance.",
+      "type": "string",
+      "minLength": 1
+    },
+    "authorizationServers": {
+      "minItems": 1,
+      "type": "array",
+      "items": {
+        "oneOf": [
+          {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "const": "external",
+                "description": "Use an externally managed authorization server."
+              },
+              "id": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Authorization server identifier."
+              },
+              "issuer": {
+                "type": "string",
+                "format": "uri",
+                "description": "Issuer URL for the external authorization server."
+              },
+              "label": {
+                "description": "Optional display label for UI selection.",
+                "type": "string"
+              },
+              "enabled": {
+                "description": "Whether this authorization server entry is enabled.",
+                "type": "boolean"
+              }
+            },
+            "required": [
+              "type",
+              "id",
+              "issuer"
+            ],
+            "additionalProperties": false
+          },
+          {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "const": "oid4vp",
+                "description": "Use OID4VP-based authorization server chaining."
+              },
+              "id": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Authorization server identifier."
+              },
+              "presentationConfigId": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Presentation configuration id used during authorization."
+              },
+              "immediateWalletRedirect": {
+                "description": "Redirect wallets immediately after authorization response creation.",
+                "type": "boolean"
+              },
+              "token": {
+                "description": "Optional token issuance settings.",
+                "type": "object",
+                "properties": {
+                  "lifetimeSeconds": {
+                    "description": "Access token lifetime in seconds.",
+                    "type": "number",
+                    "minimum": 60
+                  },
+                  "signingKeyId": {
+                    "description": "Optional key chain id used to sign issued tokens.",
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "refreshTokenEnabled": {
+                    "description": "Enable issuing refresh tokens.",
+                    "type": "boolean"
+                  },
+                  "refreshTokenExpiresInSeconds": {
+                    "description": "Refresh token lifetime in seconds.",
+                    "type": "number",
+                    "minimum": 60
+                  }
+                },
+                "additionalProperties": false
+              },
+              "requireDPoP": {
+                "description": "Require DPoP proofs for token/credential requests.",
+                "type": "boolean"
+              },
+              "label": {
+                "description": "Optional display label for UI selection.",
+                "type": "string"
+              },
+              "enabled": {
+                "description": "Whether this authorization server entry is enabled.",
+                "type": "boolean"
+              }
+            },
+            "required": [
+              "type",
+              "id",
+              "presentationConfigId"
+            ],
+            "additionalProperties": false
+          },
+          {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "const": "chained",
+                "description": "Use upstream OIDC as authorization source."
+              },
+              "id": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Authorization server identifier."
+              },
+              "upstream": {
+                "type": "object",
+                "properties": {
+                  "issuer": {
+                    "type": "string",
+                    "format": "uri",
+                    "description": "Upstream OIDC issuer URL."
+                  },
+                  "clientId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Client id for upstream OIDC authentication."
+                  },
+                  "clientSecret": {
+                    "description": "Optional client secret for upstream OIDC authentication.",
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "scopes": {
+                    "description": "Optional scopes requested from the upstream issuer.",
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "minLength": 1
+                    }
+                  }
+                },
+                "required": [
+                  "issuer",
+                  "clientId"
+                ],
+                "additionalProperties": false,
+                "description": "Upstream OIDC connection settings."
+              },
+              "token": {
+                "description": "Optional token issuance settings.",
+                "type": "object",
+                "properties": {
+                  "lifetimeSeconds": {
+                    "description": "Access token lifetime in seconds.",
+                    "type": "number",
+                    "minimum": 60
+                  },
+                  "signingKeyId": {
+                    "description": "Optional key chain id used to sign issued tokens.",
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "refreshTokenEnabled": {
+                    "description": "Enable issuing refresh tokens.",
+                    "type": "boolean"
+                  },
+                  "refreshTokenExpiresInSeconds": {
+                    "description": "Refresh token lifetime in seconds.",
+                    "type": "number",
+                    "minimum": 60
+                  }
+                },
+                "additionalProperties": false
+              },
+              "requireDPoP": {
+                "description": "Require DPoP proofs for token/credential requests.",
+                "type": "boolean"
+              },
+              "label": {
+                "description": "Optional display label for UI selection.",
+                "type": "string"
+              },
+              "enabled": {
+                "description": "Whether this authorization server entry is enabled.",
+                "type": "boolean"
+              }
+            },
+            "required": [
+              "type",
+              "id",
+              "upstream"
+            ],
+            "additionalProperties": false
+          },
+          {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "const": "built-in",
+                "description": "Use EUDIPLO built-in authorization server."
+              },
+              "id": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Authorization server identifier."
+              },
+              "token": {
+                "description": "Optional token issuance settings.",
+                "type": "object",
+                "properties": {
+                  "lifetimeSeconds": {
+                    "description": "Access token lifetime in seconds.",
+                    "type": "number",
+                    "minimum": 60
+                  },
+                  "signingKeyId": {
+                    "description": "Optional key chain id used to sign issued tokens.",
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "refreshTokenEnabled": {
+                    "description": "Enable issuing refresh tokens.",
+                    "type": "boolean"
+                  },
+                  "refreshTokenExpiresInSeconds": {
+                    "description": "Refresh token lifetime in seconds.",
+                    "type": "number",
+                    "minimum": 60
+                  }
+                },
+                "additionalProperties": false
+              },
+              "requireDPoP": {
+                "description": "Require DPoP proofs for token/credential requests.",
+                "type": "boolean"
+              },
+              "label": {
+                "description": "Optional display label for UI selection.",
+                "type": "string"
+              },
+              "enabled": {
+                "description": "Whether this authorization server entry is enabled.",
+                "type": "boolean"
+              }
+            },
+            "required": [
+              "type",
+              "id"
+            ],
+            "additionalProperties": false
+          }
+        ],
+        "description": "Supported authorization server configurations."
+      },
+      "description": "Configured authorization server entries."
+    },
+    "federation": {
+      "description": "Optional OpenID Federation settings.",
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "role": {
+              "description": "Federation role for this issuer.",
+              "type": "string",
+              "enum": [
+                "trust_anchor",
+                "intermediate",
+                "leaf"
+              ]
+            },
+            "mode": {
+              "description": "Federation operation mode.",
+              "type": "string",
+              "enum": [
+                "federation-only",
+                "hybrid"
+              ]
+            },
+            "entityId": {
+              "description": "Optional local federation entity id.",
+              "type": "string"
+            },
+            "enforceSigningPolicy": {
+              "description": "Enforce strict signing policy checks.",
+              "type": "boolean"
+            },
+            "cacheTtlSeconds": {
+              "description": "Cache time-to-live for federation metadata in seconds.",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 9007199254740991
+            },
+            "trustAnchors": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "entityId": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Federation trust anchor entity id."
+                  },
+                  "entityConfigurationUri": {
+                    "type": "string",
+                    "format": "uri",
+                    "description": "Entity configuration URI for the trust anchor."
+                  }
+                },
+                "required": [
+                  "entityId",
+                  "entityConfigurationUri"
+                ],
+                "additionalProperties": false
+              },
+              "description": "Federation trust anchors."
+            }
+          },
+          "required": [
+            "trustAnchors"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "registrationCertificate": {
+      "description": "Optional registration certificate settings.",
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "description": "Enable issuer registration certificate support.",
+              "type": "boolean"
+            },
+            "mode": {
+              "description": "How registration certificate data is provided.",
+              "type": "string",
+              "enum": [
+                "import",
+                "generate"
+              ]
+            },
+            "jwt": {
+              "description": "Optional registration certificate JWT when using import mode.",
+              "type": "string"
+            },
+            "privacyPolicy": {
+              "description": "Optional privacy policy URI.",
+              "type": "string"
+            },
+            "supportUri": {
+              "description": "Optional support URI.",
+              "type": "string"
+            }
+          },
+          "additionalProperties": false
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "display": {
+      "description": "Localized issuer metadata shown to wallets.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "Issuer display name.",
+            "type": "string"
+          },
+          "locale": {
+            "description": "Locale tag for this display entry.",
+            "type": "string"
+          },
+          "logo": {
+            "description": "Optional issuer logo metadata.",
+            "type": "object",
+            "properties": {
+              "uri": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Logo URI."
+              },
+              "alt_text": {
+                "description": "Optional localized alternative text.",
+                "type": "string"
+              }
+            },
+            "required": [
+              "uri"
+            ],
+            "additionalProperties": {}
+          }
+        },
+        "additionalProperties": {}
+      }
+    },
+    "credentialResponseEncryption": {
+      "description": "Enable encrypted credential responses.",
+      "type": "boolean"
+    },
+    "credentialRequestEncryption": {
+      "description": "Require encrypted credential requests.",
+      "type": "boolean"
+    },
+    "txCodeMaxAttempts": {
+      "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
+      "anyOf": [
+        {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 9007199254740991
+        },
+        {
+          "type": "null"
+        }
+      ]
+    }
+  },
+  "required": [
+    "authorizationServers"
+  ],
+  "additionalProperties": false,
+  "$id": "./IssuanceConfig.schema.json",
+  "title": "IssuanceConfig"
+}

package/templates/schemas/KeyChainImportDto.schema.json

@@ -0,0 +1,111 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "id": {
+      "description": "Optional key chain id. If omitted, one is generated.",
+      "type": "string"
+    },
+    "key": {
+      "type": "object",
+      "properties": {
+        "kty": {
+          "type": "string",
+          "description": "Key type (for example EC)."
+        },
+        "x": {
+          "type": "string",
+          "description": "Elliptic curve public x coordinate."
+        },
+        "y": {
+          "type": "string",
+          "description": "Elliptic curve public y coordinate."
+        },
+        "crv": {
+          "type": "string",
+          "description": "Elliptic curve name."
+        },
+        "d": {
+          "type": "string",
+          "description": "Private key value."
+        },
+        "alg": {
+          "description": "Optional algorithm hint.",
+          "type": "string"
+        },
+        "kid": {
+          "description": "Optional key identifier.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "kty",
+        "x",
+        "y",
+        "crv",
+        "d"
+      ],
+      "additionalProperties": false,
+      "description": "Private key material in JWK format."
+    },
+    "description": {
+      "description": "Optional key chain description.",
+      "type": "string"
+    },
+    "usageType": {
+      "type": "string",
+      "enum": [
+        "access",
+        "attestation",
+        "trustList",
+        "statusList",
+        "encrypt"
+      ],
+      "description": "Key usage category for the imported key chain."
+    },
+    "crt": {
+      "description": "Optional certificate chain values in PEM or base64 DER.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "kmsProvider": {
+      "description": "Optional KMS provider id.",
+      "type": "string"
+    },
+    "rotationPolicy": {
+      "description": "Optional rotation policy for imported key chains.",
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable automatic rotation for imported key chains."
+        },
+        "intervalDays": {
+          "description": "Rotation interval in days.",
+          "type": "number",
+          "minimum": 1,
+          "maximum": 3650
+        },
+        "certValidityDays": {
+          "description": "Certificate validity period in days.",
+          "type": "number",
+          "minimum": 1,
+          "maximum": 3650
+        }
+      },
+      "required": [
+        "enabled"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "required": [
+    "key",
+    "usageType"
+  ],
+  "additionalProperties": false,
+  "$id": "./KeyChainImportDto.schema.json",
+  "title": "KeyChainImportDto"
+}