@opensoha/contracts 0.1.27 → 0.2.0

package/network/radius-password-verifier.schema.json

@@ -0,0 +1,263 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.opensoha.dev/network/radius-password-verifier.schema.json",
+  "title": "Restricted TTLS PAP password verifier",
+  "description": "POST /api/network-control/v1/runtimes/{runtimeId}/radius:verify-password. Dedicated enrolled NAS mTLS, verifier capability and allowed direct peer required. Passwords never enter ordinary runtime envelopes. A success is authentication only, not NAS authorization. HTTP 200 returns the RADIUSSuccess attribute map for rlm_rest (no DTO envelope). Authentication failure returns HTTP 401 with no body. Result is the internal semantic result, not an HTTP success response.",
+  "oneOf": [
+    {
+      "$ref": "#/$defs/Request"
+    },
+    {
+      "$ref": "#/$defs/Result"
+    },
+    {
+      "$ref": "#/$defs/RADIUSSuccess"
+    }
+  ],
+  "$defs": {
+    "Request": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "requestId",
+        "nasId",
+        "stationId",
+        "login",
+        "passwordBase64",
+        "eapMethod",
+        "innerMethod"
+      ],
+      "properties": {
+        "requestId": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+        },
+        "nasId": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+        },
+        "stationId": {
+          "type": "string",
+          "pattern": "^[A-Fa-f0-9]{2}(?::[A-Fa-f0-9]{2}){5}$"
+        },
+        "login": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$",
+          "description": "Exact Soha subject ID from trusted AdmissionProfile.identity, never a username/email alias. Resolve only by account ID; receipt subject must match."
+        },
+        "passwordBase64": {
+          "type": "string",
+          "minLength": 4,
+          "maxLength": 96,
+          "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$",
+          "writeOnly": true,
+          "description": "Secret transport encoding, not encryption. Strict canonical standard Base64; runtime must additionally require 1-72 decoded bytes. Never log, persist or echo."
+        },
+        "eapMethod": {
+          "const": "ttls"
+        },
+        "innerMethod": {
+          "const": "pap"
+        },
+        "runtimeProof": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "poolId",
+            "memberId",
+            "credentialId",
+            "processEpoch",
+            "ownerEpoch",
+            "controlRevision",
+            "configurationRevision",
+            "configurationHash"
+          ],
+          "properties": {
+            "poolId": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128,
+              "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$"
+            },
+            "memberId": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128,
+              "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$"
+            },
+            "credentialId": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128,
+              "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$"
+            },
+            "processEpoch": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128,
+              "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$"
+            },
+            "ownerEpoch": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 9007199254740991
+            },
+            "controlRevision": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 9007199254740991
+            },
+            "configurationRevision": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 9007199254740991
+            },
+            "configurationHash": {
+              "type": "string",
+              "pattern": "^sha256:[a-f0-9]{64}$"
+            }
+          }
+        }
+      }
+    },
+    "Result": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "authenticated"
+      ],
+      "properties": {
+        "authenticated": {
+          "type": "boolean"
+        },
+        "subjectId": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+        },
+        "authenticationReceipt": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_-]{43}$"
+        },
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "reasonCode": {
+          "const": "authentication_failed"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "authenticated": {
+                "const": true
+              }
+            },
+            "required": [
+              "authenticated"
+            ]
+          },
+          "then": {
+            "required": [
+              "subjectId",
+              "authenticationReceipt",
+              "expiresAt"
+            ],
+            "not": {
+              "required": [
+                "reasonCode"
+              ]
+            }
+          },
+          "else": {
+            "required": [
+              "reasonCode"
+            ],
+            "not": {
+              "anyOf": [
+                {
+                  "required": [
+                    "subjectId"
+                  ]
+                },
+                {
+                  "required": [
+                    "authenticationReceipt"
+                  ]
+                },
+                {
+                  "required": [
+                    "expiresAt"
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "RADIUSSuccess": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "control:Tmp-String-4",
+        "control:Tmp-String-5"
+      ],
+      "properties": {
+        "control:Tmp-String-4": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "do_xlat",
+            "op",
+            "value"
+          ],
+          "properties": {
+            "do_xlat": {
+              "const": false
+            },
+            "op": {
+              "const": ":="
+            },
+            "value": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 1,
+              "items": {
+                "type": "string",
+                "pattern": "^[A-Za-z0-9_-]{43}$"
+              }
+            }
+          }
+        },
+        "control:Tmp-String-5": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "do_xlat",
+            "op",
+            "value"
+          ],
+          "properties": {
+            "do_xlat": {
+              "const": false
+            },
+            "op": {
+              "const": ":="
+            },
+            "value": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 1,
+              "items": {
+                "type": "string",
+                "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}