@eudiplo/cli 9.1.0-main.b08ff89 → 9.1.0-main.b4a1a8d

package/templates/schemas/CreateFederationTrustAnchorDto.schema.json

@@ -0,0 +1,82 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 255,
+      "pattern": "^[A-Za-z0-9._-]+$",
+      "description": "Unique identifier of the trust anchor in the tenant."
+    },
+    "entityId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 2048,
+      "description": "Entity identifier of the trust anchor, exactly as configured in `federation.trustAnchors` and DCQL `openid_federation` values."
+    },
+    "description": {
+      "anyOf": [
+        {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 1000
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "Optional description of the trust anchor."
+    },
+    "jwks": {
+      "type": "object",
+      "properties": {
+        "keys": {
+          "minItems": 1,
+          "maxItems": 20,
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "kty": {
+                "type": "string",
+                "enum": [
+                  "EC",
+                  "RSA",
+                  "OKP"
+                ],
+                "description": "Key type of the public federation key."
+              },
+              "kid": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 256,
+                "description": "Key ID. Federation statements name their signing key with `kid`."
+              }
+            },
+            "required": [
+              "kty",
+              "kid"
+            ],
+            "additionalProperties": {},
+            "description": "Public federation key of the trust anchor as a JWK."
+          },
+          "description": "The trust anchor's federation keys."
+        }
+      },
+      "required": [
+        "keys"
+      ],
+      "additionalProperties": false,
+      "description": "JWK set with the federation keys of the trust anchor, obtained out of band (OpenID Federation 1.0 Section 10.2)."
+    }
+  },
+  "required": [
+    "id",
+    "entityId",
+    "jwks"
+  ],
+  "additionalProperties": false,
+  "$id": "./CreateFederationTrustAnchorDto.schema.json",
+  "title": "CreateFederationTrustAnchorDto"
+}

package/templates/schemas/CreateRegistrarConfigDto.schema.json

@@ -46,6 +46,35 @@
           "type": "null"
         }
       ]
+    },
+    "relyingPartyContact": {
+      "description": "Contact of the relying party, sent when EUDIPLO registers the relying party at the registrar. The registrar needs at least one contact value to issue access certificates. A relying party that is already registered keeps its contact.",
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "supportUri": {
+              "description": "https URL where the relying party can be contacted.",
+              "type": "string",
+              "format": "uri"
+            },
+            "email": {
+              "description": "Email address of the relying party.",
+              "type": "string",
+              "pattern": "^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}$"
+            },
+            "phone": {
+              "description": "Phone number of the relying party.",
+              "type": "string",
+              "pattern": "^[+0-9()\\-\\s]{5,40}$"
+            }
+          },
+          "additionalProperties": false
+        },
+        {
+          "type": "null"
+        }
+      ]
     }
   },
   "required": [

package/templates/schemas/CreateTenantDto.schema.json

@@ -4,8 +4,8 @@
   "properties": {
     "id": {
       "type": "string",
-      "minLength": 1,
-      "description": "Unique tenant identifier."
+      "pattern": "^[a-z0-9][a-z0-9_-]{0,62}$",
+      "description": "Unique tenant identifier: lowercase letters, digits, `-` and `_`, starting with a letter or digit, at most 63 characters. It is also the name of the tenant's configuration folder."
     },
     "name": {
       "default": "EUDIPLO",
@@ -19,7 +19,7 @@
       "minLength": 1
     },
     "roles": {
-      "description": "Optional default role assignments for the tenant.",
+      "description": "Roles of the tenant's admin client `<id>-admin`, which also gets clients:manage. They are all that client can grant, unless they include tenant:admin. Without roles, no admin client is created.",
       "type": "array",
       "items": {
         "type": "string",
@@ -32,7 +32,11 @@
           "clients:manage",
           "users:manage",
           "registrar:manage",
-          "tenant:admin"
+          "tenant:admin",
+          "audit:read",
+          "sessions:read",
+          "credentials:status",
+          "keys:manage"
         ]
       }
     },

package/templates/schemas/CredentialConfigCreate.schema.json

@@ -33,24 +33,26 @@
               "locale": {
                 "type": "string",
                 "minLength": 1,
-                "description": "Locale tag for the display entry."
+                "description": "Language tag of this entry, for example en-US. Each locale may appear once."
               },
               "name": {
                 "type": "string",
                 "minLength": 1,
-                "description": "Human-readable field name."
+                "description": "Credential name shown by wallets."
               },
               "description": {
-                "description": "Optional field description for this locale.",
+                "description": "Optional description of the credential for this locale.",
                 "type": "string"
               },
               "background_color": {
-                "description": "Optional background color for card-style rendering.",
-                "type": "string"
+                "description": "Optional background color for card-style rendering, as a CSS Color Level 3 numerical value: #rgb, #rrggbb, transparent, or lowercase rgb(), rgba(), hsl() or hsla() with comma-separated values. Without it, wallets use their own.",
+                "type": "string",
+                "pattern": "^(?:#(?:[0-9a-fA-F]{3}){1,2}|rgb\\( *[+-]?\\d+ *, *[+-]?\\d+ *, *[+-]?\\d+ *\\)|rgb\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *\\)|rgba\\( *[+-]?\\d+ *, *[+-]?\\d+ *, *[+-]?\\d+ *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *\\)|rgba\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *\\)|hsl\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *\\)|hsla\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *\\)|transparent)$"
               },
               "text_color": {
-                "description": "Optional text color for card-style rendering.",
-                "type": "string"
+                "description": "Optional text color for card-style rendering, as a CSS Color Level 3 numerical value: #rgb, #rrggbb, transparent, or lowercase rgb(), rgba(), hsl() or hsla() with comma-separated values. Without it, wallets use their own.",
+                "type": "string",
+                "pattern": "^(?:#(?:[0-9a-fA-F]{3}){1,2}|rgb\\( *[+-]?\\d+ *, *[+-]?\\d+ *, *[+-]?\\d+ *\\)|rgb\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *\\)|rgba\\( *[+-]?\\d+ *, *[+-]?\\d+ *, *[+-]?\\d+ *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *\\)|rgba\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *\\)|hsl\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *\\)|hsla\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *\\)|transparent)$"
               },
               "background_image": {
                 "description": "Optional background image.",
@@ -89,7 +91,7 @@
             ],
             "additionalProperties": false
           },
-          "description": "Display metadata shown by wallets."
+          "description": "Display metadata shown by wallets, one entry per locale."
         },
         "scope": {
           "description": "Optional OAuth scope associated with this credential type.",
@@ -209,7 +211,7 @@
       ]
     },
     "webhookEndpointId": {
-      "description": "Optional webhook endpoint id notified during issuance events.",
+      "description": "Not used for notifications: they go to the webhook endpoint of the offer.",
       "type": [
         "string",
         "null"
@@ -303,7 +305,7 @@
       ]
     },
     "iaeActions": {
-      "description": "Optional in-app experience actions for wallet flows.",
+      "description": "Interactive authorization steps (a presentation or a web flow) that the wallet completes, in order, before the credential is issued.",
       "anyOf": [
         {
           "type": "array",
@@ -479,16 +481,17 @@
                     "type": "string"
                   },
                   "frameworkType": {
-                    "description": "Trust framework type.",
+                    "description": "Trust framework type. `x509` takes a root certificate in `value` and no `verificationMethod`.",
                     "type": "string",
                     "enum": [
                       "aki",
                       "etsi_tl",
-                      "openid_federation"
+                      "openid_federation",
+                      "x509"
                     ]
                   },
                   "value": {
-                    "description": "Framework-specific authority value.",
+                    "description": "Framework-specific authority value, for example the trust list URL for `etsi_tl` or the root certificate (base64 DER or PEM) for `x509`.",
                     "type": "string"
                   },
                   "verificationMethod": {
@@ -713,12 +716,8 @@
           }
         },
         "constraints": {
-          "description": "Optional validation constraints for the claim value.",
-          "type": "object",
-          "propertyNames": {
-            "type": "string"
-          },
-          "additionalProperties": {}
+          "description": "Optional JSON Schema 2020-12 validation keywords for the claim value. Only the JSON Schema keywords listed under Constraints in the claims documentation are accepted (validation keywords such as pattern, minLength or enum, subschemas such as items or properties, and annotations); other keys, such as format or $ref, are refused.",
+          "$ref": "#/$defs/ClaimConstraints"
         },
         "children": {
           "description": "Nested child claim definitions for object or array fields.",
@@ -733,6 +732,240 @@
         "type"
       ],
       "additionalProperties": false
+    },
+    "ClaimConstraints": {
+      "type": "object",
+      "properties": {
+        "type": {},
+        "enum": {},
+        "const": {},
+        "multipleOf": {},
+        "maximum": {},
+        "exclusiveMaximum": {},
+        "minimum": {},
+        "exclusiveMinimum": {},
+        "maxLength": {},
+        "minLength": {},
+        "pattern": {},
+        "maxItems": {},
+        "minItems": {},
+        "uniqueItems": {},
+        "maxContains": {},
+        "minContains": {},
+        "maxProperties": {},
+        "minProperties": {},
+        "required": {},
+        "dependentRequired": {},
+        "title": {},
+        "description": {},
+        "default": {},
+        "examples": {},
+        "deprecated": {},
+        "readOnly": {},
+        "writeOnly": {},
+        "$comment": {},
+        "items": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "contains": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "additionalProperties": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "propertyNames": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "not": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "if": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "then": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "else": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "unevaluatedItems": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "unevaluatedProperties": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "prefixItems": {
+          "type": "array",
+          "items": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        },
+        "allOf": {
+          "type": "array",
+          "items": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        },
+        "anyOf": {
+          "type": "array",
+          "items": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        },
+        "oneOf": {
+          "type": "array",
+          "items": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        },
+        "properties": {
+          "type": "object",
+          "propertyNames": {
+            "type": "string"
+          },
+          "additionalProperties": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        },
+        "patternProperties": {
+          "type": "object",
+          "propertyNames": {
+            "type": "string"
+          },
+          "additionalProperties": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        },
+        "dependentSchemas": {
+          "type": "object",
+          "propertyNames": {
+            "type": "string"
+          },
+          "additionalProperties": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        }
+      },
+      "additionalProperties": false
     }
   },
   "$id": "./CredentialConfigCreate.schema.json",