@eudiplo/cli 9.1.0-main.e4e29b5 → 9.1.0-main.e69fe20

package/templates/schemas/RegistrarConfigFile.schema.json

@@ -9,7 +9,7 @@
       "properties": {
         "$schema": {
           "type": "string",
-          "const": "https://eudiplo.dev/schemas/v1/RegistrarConfigFile.schema.json"
+          "const": "https://eudiplo.dev/schemas/v2/RegistrarConfigFile.schema.json"
         },
         "metadata": {
           "type": "object",
@@ -39,6 +39,106 @@
         "spec"
       ],
       "additionalProperties": false
+    },
+    {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://eudiplo.dev/schemas/v1/RegistrarConfigFile.schema.json",
+      "title": "RegistrarConfigFile",
+      "type": "object",
+      "properties": {
+        "$schema": {
+          "type": "string",
+          "const": "https://eudiplo.dev/schemas/v1/RegistrarConfigFile.schema.json"
+        },
+        "metadata": {
+          "type": "object",
+          "properties": {
+            "generation": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "Monotonically increasing configuration generation."
+            },
+            "ownership": {
+              "type": "string",
+              "enum": [
+                "unmanaged",
+                "file-managed"
+              ],
+              "description": "Requested ownership recorded when the document is applied."
+            }
+          },
+          "additionalProperties": false
+        },
+        "spec": {
+          "$ref": "#/$defs/CreateRegistrarConfigDto"
+        }
+      },
+      "required": [
+        "$schema",
+        "spec"
+      ],
+      "additionalProperties": false,
+      "$defs": {
+        "CreateRegistrarConfigDto": {
+          "type": "object",
+          "properties": {
+            "registrarUrl": {
+              "type": "string",
+              "format": "uri",
+              "description": "Base URL of the registrar service."
+            },
+            "oidcUrl": {
+              "type": "string",
+              "format": "uri",
+              "description": "OIDC discovery or issuer URL used for authentication."
+            },
+            "clientId": {
+              "type": "string",
+              "minLength": 1,
+              "description": "OAuth client ID used against the registrar."
+            },
+            "clientSecret": {
+              "description": "Optional OAuth client secret for registrar authentication.",
+              "type": "string",
+              "minLength": 1
+            },
+            "username": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Username used for registrar authentication."
+            },
+            "password": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Password used for registrar authentication."
+            },
+            "registrationCertificateDefaults": {
+              "description": "Optional default registration certificate values.",
+              "anyOf": [
+                {
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {}
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            }
+          },
+          "required": [
+            "registrarUrl",
+            "oidcUrl",
+            "clientId",
+            "username",
+            "password"
+          ],
+          "additionalProperties": false,
+          "title": "CreateRegistrarConfigDto"
+        }
+      }
     }
   ]
 }

package/templates/schemas/RotationPolicyCreateDto.schema.json

@@ -7,7 +7,7 @@
       "description": "Enable or disable automatic key rotation."
     },
     "intervalDays": {
-      "description": "Rotation interval in days.",
+      "description": "Rotation interval in days. Required when `enabled` is true.",
       "type": "number",
       "minimum": 1,
       "maximum": 3650

package/templates/schemas/TenantConfigFile.schema.json

@@ -1,12 +1,15 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "anyOf": [
+  "$id": "./TenantConfigFile.schema.json",
+  "title": "TenantConfigFile",
+  "description": "Configuration file identified by its $schema URL.",
+  "oneOf": [
     {
       "type": "object",
       "properties": {
         "$schema": {
           "type": "string",
-          "const": "https://eudiplo.dev/schemas/v1/TenantConfigFile.schema.json"
+          "const": "https://eudiplo.dev/schemas/v3/TenantConfigFile.schema.json"
         },
         "metadata": {
           "type": "object",
@@ -108,6 +111,18 @@
                 }
               },
               "additionalProperties": false
+            },
+            "defaultKeyChains": {
+              "type": "object",
+              "properties": {
+                "access": {
+                  "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+                  "type": "string",
+                  "minLength": 1
+                }
+              },
+              "additionalProperties": false,
+              "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
             }
           },
           "required": [
@@ -125,106 +140,140 @@
       "additionalProperties": false
     },
     {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://eudiplo.dev/schemas/v1/TenantConfigFile.schema.json",
+      "title": "TenantConfigFile",
       "type": "object",
       "properties": {
-        "name": {
-          "default": "EUDIPLO",
-          "description": "Display name of the tenant.",
-          "type": "string",
-          "minLength": 1
-        },
-        "description": {
-          "description": "Optional tenant description.",
+        "$schema": {
           "type": "string",
-          "minLength": 1
+          "const": "https://eudiplo.dev/schemas/v1/TenantConfigFile.schema.json"
         },
-        "sessionConfig": {
-          "description": "Optional tenant-specific session storage configuration.",
+        "metadata": {
           "type": "object",
           "properties": {
-            "ttlSeconds": {
-              "description": "Session time-to-live in seconds.",
+            "generation": {
               "type": "integer",
-              "minimum": 60,
+              "minimum": 1,
               "maximum": 9007199254740991
             },
-            "cleanupMode": {
-              "description": "Whether to fully delete or anonymize expired sessions.",
+            "ownership": {
               "type": "string",
               "enum": [
-                "full",
-                "anonymize"
+                "unmanaged",
+                "file-managed"
               ]
             }
           },
           "additionalProperties": false
         },
-        "statusListConfig": {
-          "description": "Optional tenant-specific status list defaults.",
+        "spec": {
           "type": "object",
           "properties": {
-            "capacity": {
-              "description": "Default status list capacity.",
-              "type": "integer",
-              "minimum": 100,
-              "maximum": 9007199254740991
+            "name": {
+              "default": "EUDIPLO",
+              "description": "Display name of the tenant.",
+              "type": "string",
+              "minLength": 1
             },
-            "bits": {
-              "description": "Bits-per-status setting (1, 2, 4, or 8).",
-              "anyOf": [
-                {
-                  "type": "number",
-                  "const": 1
+            "description": {
+              "description": "Optional tenant description.",
+              "type": "string",
+              "minLength": 1
+            },
+            "sessionConfig": {
+              "description": "Optional tenant-specific session storage configuration.",
+              "type": "object",
+              "properties": {
+                "ttlSeconds": {
+                  "description": "Session time-to-live in seconds.",
+                  "type": "integer",
+                  "minimum": 60,
+                  "maximum": 9007199254740991
                 },
-                {
-                  "type": "number",
-                  "const": 2
+                "cleanupMode": {
+                  "description": "Whether to fully delete or anonymize expired sessions.",
+                  "type": "string",
+                  "enum": [
+                    "full",
+                    "anonymize"
+                  ]
+                }
+              },
+              "additionalProperties": false
+            },
+            "statusListConfig": {
+              "description": "Optional tenant-specific status list defaults.",
+              "type": "object",
+              "properties": {
+                "capacity": {
+                  "description": "Default status list capacity.",
+                  "type": "integer",
+                  "minimum": 100,
+                  "maximum": 9007199254740991
                 },
-                {
-                  "type": "number",
-                  "const": 4
+                "bits": {
+                  "description": "Bits-per-status setting (1, 2, 4, or 8).",
+                  "anyOf": [
+                    {
+                      "type": "number",
+                      "const": 1
+                    },
+                    {
+                      "type": "number",
+                      "const": 2
+                    },
+                    {
+                      "type": "number",
+                      "const": 4
+                    },
+                    {
+                      "type": "number",
+                      "const": 8
+                    }
+                  ]
                 },
-                {
-                  "type": "number",
-                  "const": 8
+                "ttl": {
+                  "description": "JWT TTL for status list tokens in seconds.",
+                  "type": "integer",
+                  "minimum": 60,
+                  "maximum": 9007199254740991
+                },
+                "immediateUpdate": {
+                  "description": "Regenerate status list JWTs immediately after status updates.",
+                  "type": "boolean"
+                },
+                "enableAggregation": {
+                  "description": "Include aggregation_uri in generated status list JWTs.",
+                  "type": "boolean"
                 }
-              ]
-            },
-            "ttl": {
-              "description": "JWT TTL for status list tokens in seconds.",
-              "type": "integer",
-              "minimum": 60,
-              "maximum": 9007199254740991
-            },
-            "immediateUpdate": {
-              "description": "Regenerate status list JWTs immediately after status updates.",
-              "type": "boolean"
-            },
-            "enableAggregation": {
-              "description": "Include aggregation_uri in generated status list JWTs.",
-              "type": "boolean"
+              },
+              "additionalProperties": false
             }
           },
-          "additionalProperties": false
+          "required": [
+            "name"
+          ],
+          "additionalProperties": false,
+          "description": "Payload used when importing tenant metadata from config files."
         }
       },
       "required": [
-        "name"
+        "$schema",
+        "metadata",
+        "spec"
       ],
-      "additionalProperties": false,
-      "description": "Payload used when importing tenant metadata from config files."
-    }
-  ],
-  "$id": "./TenantConfigFile.schema.json",
-  "title": "TenantConfigFile",
-  "description": "Configuration file identified by its $schema URL.",
-  "oneOf": [
+      "additionalProperties": false
+    },
     {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://eudiplo.dev/schemas/v2/TenantConfigFile.schema.json",
+      "title": "TenantConfigFile",
       "type": "object",
       "properties": {
         "$schema": {
           "type": "string",
-          "const": "https://eudiplo.dev/schemas/v1/TenantConfigFile.schema.json"
+          "const": "https://eudiplo.dev/schemas/v2/TenantConfigFile.schema.json"
         },
         "metadata": {
           "type": "object",
@@ -326,6 +375,11 @@
                 }
               },
               "additionalProperties": false
+            },
+            "defaultAccessKeyChainId": {
+              "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+              "type": "string",
+              "minLength": 1
             }
           },
           "required": [
@@ -341,6 +395,108 @@
         "spec"
       ],
       "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "name": {
+          "default": "EUDIPLO",
+          "description": "Display name of the tenant.",
+          "type": "string",
+          "minLength": 1
+        },
+        "description": {
+          "description": "Optional tenant description.",
+          "type": "string",
+          "minLength": 1
+        },
+        "sessionConfig": {
+          "description": "Optional tenant-specific session storage configuration.",
+          "type": "object",
+          "properties": {
+            "ttlSeconds": {
+              "description": "Session time-to-live in seconds.",
+              "type": "integer",
+              "minimum": 60,
+              "maximum": 9007199254740991
+            },
+            "cleanupMode": {
+              "description": "Whether to fully delete or anonymize expired sessions.",
+              "type": "string",
+              "enum": [
+                "full",
+                "anonymize"
+              ]
+            }
+          },
+          "additionalProperties": false
+        },
+        "statusListConfig": {
+          "description": "Optional tenant-specific status list defaults.",
+          "type": "object",
+          "properties": {
+            "capacity": {
+              "description": "Default status list capacity.",
+              "type": "integer",
+              "minimum": 100,
+              "maximum": 9007199254740991
+            },
+            "bits": {
+              "description": "Bits-per-status setting (1, 2, 4, or 8).",
+              "anyOf": [
+                {
+                  "type": "number",
+                  "const": 1
+                },
+                {
+                  "type": "number",
+                  "const": 2
+                },
+                {
+                  "type": "number",
+                  "const": 4
+                },
+                {
+                  "type": "number",
+                  "const": 8
+                }
+              ]
+            },
+            "ttl": {
+              "description": "JWT TTL for status list tokens in seconds.",
+              "type": "integer",
+              "minimum": 60,
+              "maximum": 9007199254740991
+            },
+            "immediateUpdate": {
+              "description": "Regenerate status list JWTs immediately after status updates.",
+              "type": "boolean"
+            },
+            "enableAggregation": {
+              "description": "Include aggregation_uri in generated status list JWTs.",
+              "type": "boolean"
+            }
+          },
+          "additionalProperties": false
+        },
+        "defaultKeyChains": {
+          "type": "object",
+          "properties": {
+            "access": {
+              "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "additionalProperties": false,
+          "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "additionalProperties": false,
+      "description": "Payload used when importing tenant metadata from config files."
     }
   ]
 }

package/templates/schemas/UpdateClientDto.schema.json

@@ -22,7 +22,11 @@
           "users:manage",
           "tenants:manage",
           "tenant:admin",
-          "registrar:manage"
+          "registrar:manage",
+          "audit:read",
+          "sessions:read",
+          "credentials:status",
+          "keys:manage"
         ]
       }
     },

package/templates/schemas/UpdateFederationTrustAnchorDto.schema.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "entityId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 2048,
+      "description": "Entity identifier of the trust anchor, exactly as configured in `federation.trustAnchors` and DCQL `openid_federation` values."
+    },
+    "description": {
+      "anyOf": [
+        {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 1000
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "Optional description of the trust anchor."
+    },
+    "jwks": {
+      "type": "object",
+      "properties": {
+        "keys": {
+          "minItems": 1,
+          "maxItems": 20,
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "kty": {
+                "type": "string",
+                "enum": [
+                  "EC",
+                  "RSA",
+                  "OKP"
+                ],
+                "description": "Key type of the public federation key."
+              },
+              "kid": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 256,
+                "description": "Key ID. Federation statements name their signing key with `kid`."
+              }
+            },
+            "required": [
+              "kty",
+              "kid"
+            ],
+            "additionalProperties": {},
+            "description": "Public federation key of the trust anchor as a JWK."
+          },
+          "description": "The trust anchor's federation keys."
+        }
+      },
+      "required": [
+        "keys"
+      ],
+      "additionalProperties": false,
+      "description": "JWK set with the federation keys of the trust anchor, obtained out of band (OpenID Federation 1.0 Section 10.2)."
+    }
+  },
+  "additionalProperties": false,
+  "$id": "./UpdateFederationTrustAnchorDto.schema.json",
+  "title": "UpdateFederationTrustAnchorDto"
+}

package/templates/schemas/UpdateStatusListConfigDto.schema.json

@@ -3,7 +3,7 @@
   "type": "object",
   "properties": {
     "capacity": {
-      "description": "Capacity override. Set null to reset to defaults.",
+      "description": "Capacity override. Omit or set null to follow STATUS_CAPACITY.",
       "anyOf": [
         {
           "type": "integer",
@@ -16,7 +16,7 @@
       ]
     },
     "bits": {
-      "description": "Bits-per-status override. Set null to reset to defaults.",
+      "description": "Bits-per-status override. Omit or set null to follow STATUS_BITS.",
       "anyOf": [
         {
           "anyOf": [
@@ -44,7 +44,7 @@
       ]
     },
     "ttl": {
-      "description": "JWT TTL override in seconds. Set null to reset.",
+      "description": "JWT TTL override in seconds. Omit or set null to follow STATUS_TTL.",
       "anyOf": [
         {
           "type": "integer",
@@ -57,14 +57,14 @@
       ]
     },
     "immediateUpdate": {
-      "description": "Immediate regeneration toggle. Set null to reset.",
+      "description": "Immediate regeneration toggle. Omit or set null to follow STATUS_IMMEDIATE_UPDATE.",
       "type": [
         "boolean",
         "null"
       ]
     },
     "enableAggregation": {
-      "description": "Aggregation URI toggle. Set null to reset.",
+      "description": "Aggregation URI toggle. Omit or set null to follow STATUS_ENABLE_AGGREGATION.",
       "type": [
         "boolean",
         "null"

package/templates/schemas/UpdateTenantDto.schema.json

@@ -87,6 +87,26 @@
         }
       },
       "additionalProperties": false
+    },
+    "defaultKeyChains": {
+      "description": "The tenant's key chain per usage type, used where no configuration names one. Replaces the stored entries; omit to keep them, or set to null to remove them.",
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "access": {
+              "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "additionalProperties": false,
+          "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
+        },
+        {
+          "type": "null"
+        }
+      ]
     }
   },
   "additionalProperties": false,

package/templates/schemas.manifest.json

@@ -6,6 +6,7 @@
   "ConfigDocumentMetadata.schema.json",
   "CreateAttributeProviderDto.schema.json",
   "CreateClientDto.schema.json",
+  "CreateFederationTrustAnchorDto.schema.json",
   "CreateRegistrarConfigDto.schema.json",
   "CreateStatusListDto.schema.json",
   "CreateTenantDto.schema.json",
@@ -14,6 +15,7 @@
   "CredentialConfigFile.schema.json",
   "DCQL.schema.json",
   "EmbeddedDisclosurePolicy.schema.json",
+  "FederationTrustAnchorConfigFile.schema.json",
   "ImportTenantDto.schema.json",
   "IssuanceConfig.schema.json",
   "IssuanceConfigFile.schema.json",
@@ -38,6 +40,7 @@
   "TrustListCreateDto.schema.json",
   "UpdateAttributeProviderDto.schema.json",
   "UpdateClientDto.schema.json",
+  "UpdateFederationTrustAnchorDto.schema.json",
   "UpdateStatusListConfigDto.schema.json",
   "UpdateStatusListDto.schema.json",
   "UpdateTenantDto.schema.json",