@openvtc/trust-tasks 0.20.8 → 0.21.0

package/src/auth/passkey/revoke/start/0.2/payload.ts

@@ -0,0 +1,349 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/auth/passkey/revoke/start/0.2/payload.schema.json
+ */
+
+import type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions } from "../../../../../_shared/components.js";
+
+
+/**
+ * Ask the auth service to begin revoking a passkey — the subject's own, or, for an administrator, another subject's. The response carries PublicKeyCredentialRequestOptions for a fresh user-verification ceremony over the producer's credentials; nothing is removed until the matching auth/passkey/revoke/finish presents the assertion.
+ */
+export interface AuthPasskeyRevokeStart {
+  /**
+   * The credential to revoke, as returned by auth/passkey/list. Opaque to the producer.
+   */
+  credentialId: string;
+  /**
+   * New in 0.2. Whose credential it is, when the producer is not its owner: an administrator revoking another subject's credential. Absent: the producer's own. The user-verification ceremony is always over the PRODUCER's credentials — the person acting proves they are present, whoever owns the credential.
+   */
+  subject?: string;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * Server-issued re-authentication options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/revoke/start/0.2#response.
+ */
+export interface AuthPasskeyRevokeStartResponsePayload {
+  /**
+   * Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim. The consumer binds it to the target credentialId server-side, so the finish carries no target of its own.
+   */
+  revocationId: string;
+  /**
+   * PublicKeyCredentialRequestOptions for navigator.credentials.get — a fresh user-verification ceremony proving a human with an enrolled authenticator is present right now. userVerification SHOULD be "required".
+   */
+  uvOptions: PublicKeyCredentialRequestOptions;
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext, PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/auth/passkey/revoke/start/0.2" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = AuthPasskeyRevokeStart;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/auth/passkey/revoke/start/0.2#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = AuthPasskeyRevokeStartResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/auth/passkey/revoke/start/0.2",
+  "title": "Auth — Passkey Revoke (start)",
+  "description": "Ask the auth service to begin revoking a passkey — the subject's own, or, for an administrator, another subject's. The response carries PublicKeyCredentialRequestOptions for a fresh user-verification ceremony over the producer's credentials; nothing is removed until the matching auth/passkey/revoke/finish presents the assertion.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "credentialId"
+  ],
+  "properties": {
+    "credentialId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The credential to revoke, as returned by auth/passkey/list. Opaque to the producer."
+    },
+    "subject": {
+      "type": "string",
+      "minLength": 1,
+      "description": "New in 0.2. Whose credential it is, when the producer is not its owner: an administrator revoking another subject's credential. Absent: the producer's own. The user-verification ceremony is always over the PRODUCER's credentials — the person acting proves they are present, whoever owns the credential."
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth Passkey Revoke Start — response payload",
+      "description": "Server-issued re-authentication options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/revoke/start/0.2#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "revocationId",
+        "uvOptions"
+      ],
+      "properties": {
+        "revocationId": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim. The consumer binds it to the target credentialId server-side, so the finish carries no target of its own."
+        },
+        "uvOptions": {
+          "$ref": "#/$defs/CredentialRequestOptions",
+          "description": "PublicKeyCredentialRequestOptions for navigator.credentials.get — a fresh user-verification ceremony proving a human with an enrolled authenticator is present right now. userVerification SHOULD be \"required\"."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "CredentialRequestOptions": {
+      "$anchor": "credentialRequestOptions",
+      "title": "PublicKeyCredentialRequestOptions",
+      "description": "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "challenge"
+      ],
+      "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
+        "challenge": {
+          "type": "string",
+          "description": "base64url-encoded one-time nonce."
+        },
+        "timeout": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "rpId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "allowCredentials": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/CredentialDescriptor"
+          }
+        },
+        "userVerification": {
+          "enum": [
+            "discouraged",
+            "preferred",
+            "required"
+          ]
+        }
+      }
+    },
+    "CredentialDescriptor": {
+      "$anchor": "credentialDescriptor",
+      "title": "PublicKeyCredentialDescriptor",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "id"
+      ],
+      "properties": {
+        "type": {
+          "const": "public-key"
+        },
+        "id": {
+          "type": "string",
+          "description": "base64url-encoded credential id."
+        },
+        "transports": {
+          "type": "array",
+          "items": {
+            "enum": [
+              "usb",
+              "nfc",
+              "ble",
+              "internal",
+              "hybrid"
+            ]
+          }
+        }
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "Response": {
+      "$anchor": "response",
+      "title": "Auth Passkey Revoke Start — response payload",
+      "description": "Server-issued re-authentication options. Carried in a Trust Task document whose type is https://trusttasks.org/spec/auth/passkey/revoke/start/0.2#response.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "revocationId",
+        "uvOptions"
+      ],
+      "properties": {
+        "revocationId": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Opaque server handle correlating this start with the matching finish. The producer MUST echo it verbatim. The consumer binds it to the target credentialId server-side, so the finish carries no target of its own."
+        },
+        "uvOptions": {
+          "$ref": "#/$defs/CredentialRequestOptions",
+          "description": "PublicKeyCredentialRequestOptions for navigator.credentials.get — a fresh user-verification ceremony proving a human with an enrolled authenticator is present right now. userVerification SHOULD be \"required\"."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext",
+          "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    },
+    "CredentialRequestOptions": {
+      "$anchor": "credentialRequestOptions",
+      "title": "PublicKeyCredentialRequestOptions",
+      "description": "Server-issued options for `navigator.credentials.get({ publicKey: ... })`.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "challenge"
+      ],
+      "properties": {
+        "extensions": {
+          "type": "object",
+          "description": "Client extension inputs, per the WebAuthn Level 2 `AuthenticationExtensionsClientInputs` dictionary.\n\nThis component states that it mirrors the W3C dictionary, and that dictionary defines `extensions`. Omitting it while closing the object with `additionalProperties: false` made the two claims contradict each other: a server emitting standard WebAuthn options could not conform, and the widely-used server libraries emit this member by default.\n\nStructure is deliberately unconstrained. The set of extensions is open and registered outside this framework, so enumerating them here would date the schema against a registry it does not own — and a closed list would reproduce the original defect one revision later."
+        },
+        "challenge": {
+          "type": "string",
+          "description": "base64url-encoded one-time nonce."
+        },
+        "timeout": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "rpId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "allowCredentials": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/CredentialDescriptor"
+          }
+        },
+        "userVerification": {
+          "enum": [
+            "discouraged",
+            "preferred",
+            "required"
+          ]
+        }
+      }
+    },
+    "CredentialDescriptor": {
+      "$anchor": "credentialDescriptor",
+      "title": "PublicKeyCredentialDescriptor",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "id"
+      ],
+      "properties": {
+        "type": {
+          "const": "public-key"
+        },
+        "id": {
+          "type": "string",
+          "description": "base64url-encoded credential id."
+        },
+        "transports": {
+          "type": "array",
+          "items": {
+            "enum": [
+              "usb",
+              "nfc",
+              "ble",
+              "internal",
+              "hybrid"
+            ]
+          }
+        }
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;