@eudiplo/cli 9.1.0-main.db0db97 → 9.1.0-main.de3d6a5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/dist/commands/config/portability/migrations.spec.js +3 -2
  2. package/dist/commands/config/portability/migrations.spec.js.map +1 -1
  3. package/dist/commands/config/portability/upgrade.d.ts.map +1 -1
  4. package/dist/commands/config/portability/upgrade.js +6 -2
  5. package/dist/commands/config/portability/upgrade.js.map +1 -1
  6. package/dist/index.js +5064 -1754
  7. package/dist/services/diagnostics.js +1 -1
  8. package/dist/services/diagnostics.js.map +1 -1
  9. package/package.json +1 -1
  10. package/templates/demo-config/clients/presentation-test.json +1 -1
  11. package/templates/demo-config/clients/test.json +7 -2
  12. package/templates/demo-config/key-chains/attestation.json +2 -1
  13. package/templates/demo-config/key-chains/status-list.json +2 -1
  14. package/templates/docker-compose.yml +2 -2
  15. package/templates/schemas/ClientConfigFile.schema.json +134 -1
  16. package/templates/schemas/CreateClientDto.schema.json +5 -1
  17. package/templates/schemas/CreateTenantDto.schema.json +6 -2
  18. package/templates/schemas/CredentialConfigCreate.schema.json +6 -5
  19. package/templates/schemas/CredentialConfigFile.schema.json +796 -1
  20. package/templates/schemas/IssuanceConfig.schema.json +43 -0
  21. package/templates/schemas/IssuanceConfigFile.schema.json +696 -1
  22. package/templates/schemas/KeyChainConfigFile.schema.json +136 -119
  23. package/templates/schemas/KeyChainCreateDto.schema.json +10 -1
  24. package/templates/schemas/KeyChainImportDto.schema.json +8 -0
  25. package/templates/schemas/KmsConfigDto.schema.json +186 -0
  26. package/templates/schemas/KmsConfigFile.schema.json +1026 -1
  27. package/templates/schemas/RotationPolicyCreateDto.schema.json +1 -1
  28. package/templates/schemas/TenantConfigFile.schema.json +4 -129
  29. package/templates/schemas/UpdateClientDto.schema.json +5 -1
  30. package/templates/schemas/UpdateStatusListConfigDto.schema.json +5 -5
package/templates/schemas/KeyChainConfigFile.schema.json CHANGED
@@ -1,12 +1,15 @@
1
1
  {
2
2
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3
- "anyOf": [
3
+ "$id": "./KeyChainConfigFile.schema.json",
4
+ "title": "KeyChainConfigFile",
5
+ "description": "Configuration file identified by its $schema URL.",
6
+ "oneOf": [
4
7
  {
5
8
  "type": "object",
6
9
  "properties": {
7
10
  "$schema": {
8
11
  "type": "string",
9
- "const": "https://eudiplo.dev/schemas/v1/KeyChainConfigFile.schema.json"
12
+ "const": "https://eudiplo.dev/schemas/v2/KeyChainConfigFile.schema.json"
10
13
  },
11
14
  "metadata": {
12
15
  "type": "object",
@@ -45,6 +48,14 @@
45
48
  "encrypt"
46
49
  ]
47
50
  },
51
+ "type": {
52
+ "description": "Key chain type. For a `private-jwk` key source without `activeJwk`, `standalone` makes `jwk` the signing key and `crt` its chain, leaf first; `internalChain` makes `jwk` a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted), and the import generates a new signing key with a certificate issued by it. Without `type`, `jwk` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA. For `regenerate`, it is the type of the new key chain and must equal `keySource.keyChainType` if both are set. For the other key sources, it must match the key chain they describe.",
53
+ "type": "string",
54
+ "enum": [
55
+ "standalone",
56
+ "internalChain"
57
+ ]
58
+ },
48
59
  "keySource": {
49
60
  "oneOf": [
50
61
  {
@@ -358,123 +369,9 @@
358
369
  "additionalProperties": false
359
370
  },
360
371
  {
361
- "type": "object",
362
- "properties": {
363
- "id": {
364
- "description": "Optional key chain id. If omitted, one is generated.",
365
- "type": "string"
366
- },
367
- "key": {
368
- "description": "Private key material in JWK format.",
369
- "type": "object",
370
- "properties": {
371
- "kty": {
372
- "type": "string",
373
- "description": "Key type (for example EC)."
374
- },
375
- "x": {
376
- "type": "string",
377
- "description": "Elliptic curve public x coordinate."
378
- },
379
- "y": {
380
- "type": "string",
381
- "description": "Elliptic curve public y coordinate."
382
- },
383
- "crv": {
384
- "type": "string",
385
- "description": "Elliptic curve name."
386
- },
387
- "d": {
388
- "type": "string",
389
- "description": "Private key value."
390
- },
391
- "alg": {
392
- "description": "Optional algorithm hint.",
393
- "type": "string"
394
- },
395
- "kid": {
396
- "description": "Optional key identifier.",
397
- "type": "string"
398
- }
399
- },
400
- "required": [
401
- "kty",
402
- "x",
403
- "y",
404
- "crv",
405
- "d"
406
- ],
407
- "additionalProperties": false
408
- },
409
- "keyPem": {
410
- "description": "PKCS#8 PEM-encoded EC private key material.",
411
- "type": "string",
412
- "minLength": 1
413
- },
414
- "description": {
415
- "description": "Optional key chain description.",
416
- "type": "string"
417
- },
418
- "usageType": {
419
- "type": "string",
420
- "enum": [
421
- "access",
422
- "attestation",
423
- "trustList",
424
- "statusList",
425
- "encrypt"
426
- ],
427
- "description": "Key usage category for the imported key chain."
428
- },
429
- "crt": {
430
- "description": "Optional certificate chain values in PEM or base64 DER.",
431
- "type": "array",
432
- "items": {
433
- "type": "string"
434
- }
435
- },
436
- "kmsProvider": {
437
- "description": "Optional KMS provider id.",
438
- "type": "string"
439
- },
440
- "rotationPolicy": {
441
- "description": "Optional rotation policy for imported key chains.",
442
- "type": "object",
443
- "properties": {
444
- "enabled": {
445
- "type": "boolean",
446
- "description": "Enable automatic rotation for imported key chains."
447
- },
448
- "intervalDays": {
449
- "description": "Rotation interval in days.",
450
- "type": "number",
451
- "minimum": 1,
452
- "maximum": 3650
453
- },
454
- "certValidityDays": {
455
- "description": "Certificate validity period in days.",
456
- "type": "number",
457
- "minimum": 1,
458
- "maximum": 3650
459
- }
460
- },
461
- "required": [
462
- "enabled"
463
- ],
464
- "additionalProperties": false
465
- }
466
- },
467
- "required": [
468
- "usageType"
469
- ],
470
- "additionalProperties": false
471
- }
472
- ],
473
- "$id": "./KeyChainConfigFile.schema.json",
474
- "title": "KeyChainConfigFile",
475
- "description": "Configuration file identified by its $schema URL.",
476
- "oneOf": [
477
- {
372
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
373
+ "$id": "https://eudiplo.dev/schemas/v1/KeyChainConfigFile.schema.json",
374
+ "title": "KeyChainConfigFile",
478
375
  "type": "object",
479
376
  "properties": {
480
377
  "$schema": {
@@ -829,6 +726,126 @@
829
726
  "spec"
830
727
  ],
831
728
  "additionalProperties": false
729
+ },
730
+ {
731
+ "type": "object",
732
+ "properties": {
733
+ "id": {
734
+ "description": "Optional key chain id. If omitted, one is generated.",
735
+ "type": "string"
736
+ },
737
+ "key": {
738
+ "description": "Private key material in JWK format.",
739
+ "type": "object",
740
+ "properties": {
741
+ "kty": {
742
+ "type": "string",
743
+ "description": "Key type (for example EC)."
744
+ },
745
+ "x": {
746
+ "type": "string",
747
+ "description": "Elliptic curve public x coordinate."
748
+ },
749
+ "y": {
750
+ "type": "string",
751
+ "description": "Elliptic curve public y coordinate."
752
+ },
753
+ "crv": {
754
+ "type": "string",
755
+ "description": "Elliptic curve name."
756
+ },
757
+ "d": {
758
+ "type": "string",
759
+ "description": "Private key value."
760
+ },
761
+ "alg": {
762
+ "description": "Optional algorithm hint.",
763
+ "type": "string"
764
+ },
765
+ "kid": {
766
+ "description": "Optional key identifier.",
767
+ "type": "string"
768
+ }
769
+ },
770
+ "required": [
771
+ "kty",
772
+ "x",
773
+ "y",
774
+ "crv",
775
+ "d"
776
+ ],
777
+ "additionalProperties": false
778
+ },
779
+ "keyPem": {
780
+ "description": "PKCS#8 PEM-encoded EC private key material.",
781
+ "type": "string",
782
+ "minLength": 1
783
+ },
784
+ "description": {
785
+ "description": "Optional key chain description.",
786
+ "type": "string"
787
+ },
788
+ "usageType": {
789
+ "type": "string",
790
+ "enum": [
791
+ "access",
792
+ "attestation",
793
+ "trustList",
794
+ "statusList",
795
+ "encrypt"
796
+ ],
797
+ "description": "Key usage category for the imported key chain."
798
+ },
799
+ "type": {
800
+ "description": "Key chain type. `standalone`: `key` is the signing key and `crt` its chain, leaf first. `internalChain`: `key` is a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted); the import generates a new signing key with a certificate issued by it. Without `type`, `key` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA.",
801
+ "type": "string",
802
+ "enum": [
803
+ "standalone",
804
+ "internalChain"
805
+ ]
806
+ },
807
+ "crt": {
808
+ "description": "Optional certificate chain values in PEM or base64 DER.",
809
+ "type": "array",
810
+ "items": {
811
+ "type": "string"
812
+ }
813
+ },
814
+ "kmsProvider": {
815
+ "description": "Optional KMS provider id.",
816
+ "type": "string"
817
+ },
818
+ "rotationPolicy": {
819
+ "description": "Optional rotation policy for imported key chains.",
820
+ "type": "object",
821
+ "properties": {
822
+ "enabled": {
823
+ "type": "boolean",
824
+ "description": "Enable automatic rotation for imported key chains."
825
+ },
826
+ "intervalDays": {
827
+ "description": "Rotation interval in days.",
828
+ "type": "number",
829
+ "minimum": 1,
830
+ "maximum": 3650
831
+ },
832
+ "certValidityDays": {
833
+ "description": "Certificate validity period in days.",
834
+ "type": "number",
835
+ "minimum": 1,
836
+ "maximum": 3650
837
+ }
838
+ },
839
+ "required": [
840
+ "enabled"
841
+ ],
842
+ "additionalProperties": false
843
+ }
844
+ },
845
+ "required": [
846
+ "usageType"
847
+ ],
848
+ "additionalProperties": false
832
849
  }
833
850
  ]
834
851
  }
package/templates/schemas/KeyChainCreateDto.schema.json CHANGED
@@ -29,6 +29,15 @@
29
29
  "description": "Optional KMS provider id for key storage operations.",
30
30
  "type": "string"
31
31
  },
32
+ "alg": {
33
+ "description": "Signing algorithm, which also selects the curve: ES256 (P-256), ES384 (P-384) or ES512 (P-521). Must be one of the KMS provider's supportedAlgs; defaults to its defaultAlg. Rotation keeps it.",
34
+ "type": "string",
35
+ "enum": [
36
+ "ES256",
37
+ "ES384",
38
+ "ES512"
39
+ ]
40
+ },
32
41
  "rotationPolicy": {
33
42
  "description": "Optional rotation policy.",
34
43
  "type": "object",
@@ -38,7 +47,7 @@
38
47
  "description": "Enable or disable automatic key rotation."
39
48
  },
40
49
  "intervalDays": {
41
- "description": "Rotation interval in days.",
50
+ "description": "Rotation interval in days. Required when `enabled` is true.",
42
51
  "type": "number",
43
52
  "minimum": 1,
44
53
  "maximum": 3650
package/templates/schemas/KeyChainImportDto.schema.json CHANGED
@@ -68,6 +68,14 @@
68
68
  ],
69
69
  "description": "Key usage category for the imported key chain."
70
70
  },
71
+ "type": {
72
+ "description": "Key chain type. `standalone`: `key` is the signing key and `crt` its chain, leaf first. `internalChain`: `key` is a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted); the import generates a new signing key with a certificate issued by it. Without `type`, `key` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA.",
73
+ "type": "string",
74
+ "enum": [
75
+ "standalone",
76
+ "internalChain"
77
+ ]
78
+ },
71
79
  "crt": {
72
80
  "description": "Optional certificate chain values in PEM or base64 DER.",
73
81
  "type": "array",
package/templates/schemas/KmsConfigDto.schema.json CHANGED
@@ -64,6 +64,37 @@
64
64
  "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
65
65
  }
66
66
  ]
67
+ },
68
+ "algorithms": {
69
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
70
+ "examples": [
71
+ [
72
+ "ES256",
73
+ "ES384"
74
+ ]
75
+ ],
76
+ "minItems": 1,
77
+ "type": "array",
78
+ "items": {
79
+ "type": "string",
80
+ "enum": [
81
+ "ES256",
82
+ "ES384",
83
+ "ES512"
84
+ ]
85
+ }
86
+ },
87
+ "defaultAlgorithm": {
88
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
89
+ "examples": [
90
+ "ES256"
91
+ ],
92
+ "type": "string",
93
+ "enum": [
94
+ "ES256",
95
+ "ES384",
96
+ "ES512"
97
+ ]
67
98
  }
68
99
  },
69
100
  "required": [
@@ -115,6 +146,37 @@
115
146
  }
116
147
  ]
117
148
  },
149
+ "algorithms": {
150
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
151
+ "examples": [
152
+ [
153
+ "ES256",
154
+ "ES384"
155
+ ]
156
+ ],
157
+ "minItems": 1,
158
+ "type": "array",
159
+ "items": {
160
+ "type": "string",
161
+ "enum": [
162
+ "ES256",
163
+ "ES384",
164
+ "ES512"
165
+ ]
166
+ }
167
+ },
168
+ "defaultAlgorithm": {
169
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
170
+ "examples": [
171
+ "ES256"
172
+ ],
173
+ "type": "string",
174
+ "enum": [
175
+ "ES256",
176
+ "ES384",
177
+ "ES512"
178
+ ]
179
+ },
118
180
  "vaultUrl": {
119
181
  "anyOf": [
120
182
  {
@@ -199,6 +261,37 @@
199
261
  }
200
262
  ]
201
263
  },
264
+ "algorithms": {
265
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
266
+ "examples": [
267
+ [
268
+ "ES256",
269
+ "ES384"
270
+ ]
271
+ ],
272
+ "minItems": 1,
273
+ "type": "array",
274
+ "items": {
275
+ "type": "string",
276
+ "enum": [
277
+ "ES256",
278
+ "ES384",
279
+ "ES512"
280
+ ]
281
+ }
282
+ },
283
+ "defaultAlgorithm": {
284
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
285
+ "examples": [
286
+ "ES256"
287
+ ],
288
+ "type": "string",
289
+ "enum": [
290
+ "ES256",
291
+ "ES384",
292
+ "ES512"
293
+ ]
294
+ },
202
295
  "region": {
203
296
  "anyOf": [
204
297
  {
@@ -298,6 +391,37 @@
298
391
  }
299
392
  ]
300
393
  },
394
+ "algorithms": {
395
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
396
+ "examples": [
397
+ [
398
+ "ES256",
399
+ "ES384"
400
+ ]
401
+ ],
402
+ "minItems": 1,
403
+ "type": "array",
404
+ "items": {
405
+ "type": "string",
406
+ "enum": [
407
+ "ES256",
408
+ "ES384",
409
+ "ES512"
410
+ ]
411
+ }
412
+ },
413
+ "defaultAlgorithm": {
414
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
415
+ "examples": [
416
+ "ES256"
417
+ ],
418
+ "type": "string",
419
+ "enum": [
420
+ "ES256",
421
+ "ES384",
422
+ "ES512"
423
+ ]
424
+ },
301
425
  "library": {
302
426
  "anyOf": [
303
427
  {
@@ -400,6 +524,37 @@
400
524
  }
401
525
  ]
402
526
  },
527
+ "algorithms": {
528
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
529
+ "examples": [
530
+ [
531
+ "ES256",
532
+ "ES384"
533
+ ]
534
+ ],
535
+ "minItems": 1,
536
+ "type": "array",
537
+ "items": {
538
+ "type": "string",
539
+ "enum": [
540
+ "ES256",
541
+ "ES384",
542
+ "ES512"
543
+ ]
544
+ }
545
+ },
546
+ "defaultAlgorithm": {
547
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
548
+ "examples": [
549
+ "ES256"
550
+ ],
551
+ "type": "string",
552
+ "enum": [
553
+ "ES256",
554
+ "ES384",
555
+ "ES512"
556
+ ]
557
+ },
403
558
  "baseUrl": {
404
559
  "anyOf": [
405
560
  {
@@ -713,6 +868,37 @@
713
868
  }
714
869
  ]
715
870
  },
871
+ "algorithms": {
872
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
873
+ "examples": [
874
+ [
875
+ "ES256",
876
+ "ES384"
877
+ ]
878
+ ],
879
+ "minItems": 1,
880
+ "type": "array",
881
+ "items": {
882
+ "type": "string",
883
+ "enum": [
884
+ "ES256",
885
+ "ES384",
886
+ "ES512"
887
+ ]
888
+ }
889
+ },
890
+ "defaultAlgorithm": {
891
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
892
+ "examples": [
893
+ "ES256"
894
+ ],
895
+ "type": "string",
896
+ "enum": [
897
+ "ES256",
898
+ "ES384",
899
+ "ES512"
900
+ ]
901
+ },
716
902
  "baseUrl": {
717
903
  "anyOf": [
718
904
  {