@eudiplo/cli 9.1.0-main.b3aa53d → 9.1.0-main.b97c2d6

package/templates/schemas/RegistrarConfigFile.schema.json

@@ -9,7 +9,7 @@
       "properties": {
         "$schema": {
           "type": "string",
-          "const": "https://eudiplo.dev/schemas/v1/RegistrarConfigFile.schema.json"
+          "const": "https://eudiplo.dev/schemas/v2/RegistrarConfigFile.schema.json"
         },
         "metadata": {
           "type": "object",
@@ -39,6 +39,106 @@
         "spec"
       ],
       "additionalProperties": false
+    },
+    {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://eudiplo.dev/schemas/v1/RegistrarConfigFile.schema.json",
+      "title": "RegistrarConfigFile",
+      "type": "object",
+      "properties": {
+        "$schema": {
+          "type": "string",
+          "const": "https://eudiplo.dev/schemas/v1/RegistrarConfigFile.schema.json"
+        },
+        "metadata": {
+          "type": "object",
+          "properties": {
+            "generation": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "Monotonically increasing configuration generation."
+            },
+            "ownership": {
+              "type": "string",
+              "enum": [
+                "unmanaged",
+                "file-managed"
+              ],
+              "description": "Requested ownership recorded when the document is applied."
+            }
+          },
+          "additionalProperties": false
+        },
+        "spec": {
+          "$ref": "#/$defs/CreateRegistrarConfigDto"
+        }
+      },
+      "required": [
+        "$schema",
+        "spec"
+      ],
+      "additionalProperties": false,
+      "$defs": {
+        "CreateRegistrarConfigDto": {
+          "type": "object",
+          "properties": {
+            "registrarUrl": {
+              "type": "string",
+              "format": "uri",
+              "description": "Base URL of the registrar service."
+            },
+            "oidcUrl": {
+              "type": "string",
+              "format": "uri",
+              "description": "OIDC discovery or issuer URL used for authentication."
+            },
+            "clientId": {
+              "type": "string",
+              "minLength": 1,
+              "description": "OAuth client ID used against the registrar."
+            },
+            "clientSecret": {
+              "description": "Optional OAuth client secret for registrar authentication.",
+              "type": "string",
+              "minLength": 1
+            },
+            "username": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Username used for registrar authentication."
+            },
+            "password": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Password used for registrar authentication."
+            },
+            "registrationCertificateDefaults": {
+              "description": "Optional default registration certificate values.",
+              "anyOf": [
+                {
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {}
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            }
+          },
+          "required": [
+            "registrarUrl",
+            "oidcUrl",
+            "clientId",
+            "username",
+            "password"
+          ],
+          "additionalProperties": false,
+          "title": "CreateRegistrarConfigDto"
+        }
+      }
     }
   ]
 }

package/templates/schemas/TenantConfigFile.schema.json

@@ -5,6 +5,144 @@
   "description": "Configuration file identified by its $schema URL.",
   "oneOf": [
     {
+      "type": "object",
+      "properties": {
+        "$schema": {
+          "type": "string",
+          "const": "https://eudiplo.dev/schemas/v3/TenantConfigFile.schema.json"
+        },
+        "metadata": {
+          "type": "object",
+          "properties": {
+            "generation": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 9007199254740991
+            },
+            "ownership": {
+              "type": "string",
+              "enum": [
+                "unmanaged",
+                "file-managed"
+              ]
+            }
+          },
+          "additionalProperties": false
+        },
+        "spec": {
+          "type": "object",
+          "properties": {
+            "name": {
+              "default": "EUDIPLO",
+              "description": "Display name of the tenant.",
+              "type": "string",
+              "minLength": 1
+            },
+            "description": {
+              "description": "Optional tenant description.",
+              "type": "string",
+              "minLength": 1
+            },
+            "sessionConfig": {
+              "description": "Optional tenant-specific session storage configuration.",
+              "type": "object",
+              "properties": {
+                "ttlSeconds": {
+                  "description": "Session time-to-live in seconds.",
+                  "type": "integer",
+                  "minimum": 60,
+                  "maximum": 9007199254740991
+                },
+                "cleanupMode": {
+                  "description": "Whether to fully delete or anonymize expired sessions.",
+                  "type": "string",
+                  "enum": [
+                    "full",
+                    "anonymize"
+                  ]
+                }
+              },
+              "additionalProperties": false
+            },
+            "statusListConfig": {
+              "description": "Optional tenant-specific status list defaults.",
+              "type": "object",
+              "properties": {
+                "capacity": {
+                  "description": "Default status list capacity.",
+                  "type": "integer",
+                  "minimum": 100,
+                  "maximum": 9007199254740991
+                },
+                "bits": {
+                  "description": "Bits-per-status setting (1, 2, 4, or 8).",
+                  "anyOf": [
+                    {
+                      "type": "number",
+                      "const": 1
+                    },
+                    {
+                      "type": "number",
+                      "const": 2
+                    },
+                    {
+                      "type": "number",
+                      "const": 4
+                    },
+                    {
+                      "type": "number",
+                      "const": 8
+                    }
+                  ]
+                },
+                "ttl": {
+                  "description": "JWT TTL for status list tokens in seconds.",
+                  "type": "integer",
+                  "minimum": 60,
+                  "maximum": 9007199254740991
+                },
+                "immediateUpdate": {
+                  "description": "Regenerate status list JWTs immediately after status updates.",
+                  "type": "boolean"
+                },
+                "enableAggregation": {
+                  "description": "Include aggregation_uri in generated status list JWTs.",
+                  "type": "boolean"
+                }
+              },
+              "additionalProperties": false
+            },
+            "defaultKeyChains": {
+              "type": "object",
+              "properties": {
+                "access": {
+                  "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+                  "type": "string",
+                  "minLength": 1
+                }
+              },
+              "additionalProperties": false,
+              "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "additionalProperties": false,
+          "description": "Payload used when importing tenant metadata from config files."
+        }
+      },
+      "required": [
+        "$schema",
+        "metadata",
+        "spec"
+      ],
+      "additionalProperties": false
+    },
+    {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://eudiplo.dev/schemas/v1/TenantConfigFile.schema.json",
+      "title": "TenantConfigFile",
       "type": "object",
       "properties": {
         "$schema": {
@@ -127,6 +265,137 @@
       ],
       "additionalProperties": false
     },
+    {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://eudiplo.dev/schemas/v2/TenantConfigFile.schema.json",
+      "title": "TenantConfigFile",
+      "type": "object",
+      "properties": {
+        "$schema": {
+          "type": "string",
+          "const": "https://eudiplo.dev/schemas/v2/TenantConfigFile.schema.json"
+        },
+        "metadata": {
+          "type": "object",
+          "properties": {
+            "generation": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 9007199254740991
+            },
+            "ownership": {
+              "type": "string",
+              "enum": [
+                "unmanaged",
+                "file-managed"
+              ]
+            }
+          },
+          "additionalProperties": false
+        },
+        "spec": {
+          "type": "object",
+          "properties": {
+            "name": {
+              "default": "EUDIPLO",
+              "description": "Display name of the tenant.",
+              "type": "string",
+              "minLength": 1
+            },
+            "description": {
+              "description": "Optional tenant description.",
+              "type": "string",
+              "minLength": 1
+            },
+            "sessionConfig": {
+              "description": "Optional tenant-specific session storage configuration.",
+              "type": "object",
+              "properties": {
+                "ttlSeconds": {
+                  "description": "Session time-to-live in seconds.",
+                  "type": "integer",
+                  "minimum": 60,
+                  "maximum": 9007199254740991
+                },
+                "cleanupMode": {
+                  "description": "Whether to fully delete or anonymize expired sessions.",
+                  "type": "string",
+                  "enum": [
+                    "full",
+                    "anonymize"
+                  ]
+                }
+              },
+              "additionalProperties": false
+            },
+            "statusListConfig": {
+              "description": "Optional tenant-specific status list defaults.",
+              "type": "object",
+              "properties": {
+                "capacity": {
+                  "description": "Default status list capacity.",
+                  "type": "integer",
+                  "minimum": 100,
+                  "maximum": 9007199254740991
+                },
+                "bits": {
+                  "description": "Bits-per-status setting (1, 2, 4, or 8).",
+                  "anyOf": [
+                    {
+                      "type": "number",
+                      "const": 1
+                    },
+                    {
+                      "type": "number",
+                      "const": 2
+                    },
+                    {
+                      "type": "number",
+                      "const": 4
+                    },
+                    {
+                      "type": "number",
+                      "const": 8
+                    }
+                  ]
+                },
+                "ttl": {
+                  "description": "JWT TTL for status list tokens in seconds.",
+                  "type": "integer",
+                  "minimum": 60,
+                  "maximum": 9007199254740991
+                },
+                "immediateUpdate": {
+                  "description": "Regenerate status list JWTs immediately after status updates.",
+                  "type": "boolean"
+                },
+                "enableAggregation": {
+                  "description": "Include aggregation_uri in generated status list JWTs.",
+                  "type": "boolean"
+                }
+              },
+              "additionalProperties": false
+            },
+            "defaultAccessKeyChainId": {
+              "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "additionalProperties": false,
+          "description": "Payload used when importing tenant metadata from config files."
+        }
+      },
+      "required": [
+        "$schema",
+        "metadata",
+        "spec"
+      ],
+      "additionalProperties": false
+    },
     {
       "type": "object",
       "properties": {
@@ -209,6 +478,18 @@
             }
           },
           "additionalProperties": false
+        },
+        "defaultKeyChains": {
+          "type": "object",
+          "properties": {
+            "access": {
+              "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "additionalProperties": false,
+          "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
         }
       },
       "required": [

package/templates/schemas/UpdateFederationTrustAnchorDto.schema.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "entityId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 2048,
+      "description": "Entity identifier of the trust anchor, exactly as configured in `federation.trustAnchors` and DCQL `openid_federation` values."
+    },
+    "description": {
+      "anyOf": [
+        {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 1000
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "Optional description of the trust anchor."
+    },
+    "jwks": {
+      "type": "object",
+      "properties": {
+        "keys": {
+          "minItems": 1,
+          "maxItems": 20,
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "kty": {
+                "type": "string",
+                "enum": [
+                  "EC",
+                  "RSA",
+                  "OKP"
+                ],
+                "description": "Key type of the public federation key."
+              },
+              "kid": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 256,
+                "description": "Key ID. Federation statements name their signing key with `kid`."
+              }
+            },
+            "required": [
+              "kty",
+              "kid"
+            ],
+            "additionalProperties": {},
+            "description": "Public federation key of the trust anchor as a JWK."
+          },
+          "description": "The trust anchor's federation keys."
+        }
+      },
+      "required": [
+        "keys"
+      ],
+      "additionalProperties": false,
+      "description": "JWK set with the federation keys of the trust anchor, obtained out of band (OpenID Federation 1.0 Section 10.2)."
+    }
+  },
+  "additionalProperties": false,
+  "$id": "./UpdateFederationTrustAnchorDto.schema.json",
+  "title": "UpdateFederationTrustAnchorDto"
+}

package/templates/schemas/UpdateTenantDto.schema.json

@@ -87,6 +87,26 @@
         }
       },
       "additionalProperties": false
+    },
+    "defaultKeyChains": {
+      "description": "The tenant's key chain per usage type, used where no configuration names one. Replaces the stored entries; omit to keep them, or set to null to remove them.",
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "access": {
+              "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "additionalProperties": false,
+          "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
+        },
+        {
+          "type": "null"
+        }
+      ]
     }
   },
   "additionalProperties": false,

package/templates/schemas.manifest.json

@@ -6,6 +6,7 @@
   "ConfigDocumentMetadata.schema.json",
   "CreateAttributeProviderDto.schema.json",
   "CreateClientDto.schema.json",
+  "CreateFederationTrustAnchorDto.schema.json",
   "CreateRegistrarConfigDto.schema.json",
   "CreateStatusListDto.schema.json",
   "CreateTenantDto.schema.json",
@@ -14,6 +15,7 @@
   "CredentialConfigFile.schema.json",
   "DCQL.schema.json",
   "EmbeddedDisclosurePolicy.schema.json",
+  "FederationTrustAnchorConfigFile.schema.json",
   "ImportTenantDto.schema.json",
   "IssuanceConfig.schema.json",
   "IssuanceConfigFile.schema.json",
@@ -38,6 +40,7 @@
   "TrustListCreateDto.schema.json",
   "UpdateAttributeProviderDto.schema.json",
   "UpdateClientDto.schema.json",
+  "UpdateFederationTrustAnchorDto.schema.json",
   "UpdateStatusListConfigDto.schema.json",
   "UpdateStatusListDto.schema.json",
   "UpdateTenantDto.schema.json",