@eudiplo/backend documentation
  1. Miscellaneous
  2. Variables

Index

src/audit-log/dto/audit-log-response.dto.ts

ACTION_TYPE_VALUES
Type : AuditActionTypeLiteral[]
Default value : [ "tenant_created", "tenant_updated", "tenant_deleted", "presentation_config_created", "presentation_config_updated", "presentation_config_deleted", "issuance_config_updated", "credential_config_created", "credential_config_updated", "credential_config_deleted", "status_list_config_updated", "status_list_config_reset", "webhook_endpoint_created", "webhook_endpoint_updated", "webhook_endpoint_deleted", "attribute_provider_created", "attribute_provider_updated", "attribute_provider_deleted", "config_bundle_exported", "config_bundle_imported", "config_client_secret_generated", "config_resource_detached", ]

src/verifier/iso18013/hpke.ts

AEAD_ID
Type : number
Default value : 0x0001
enc
Type : unknown
Default value : new TextEncoder()
hpkeSuiteId
Type : unknown
Default value : concat( enc.encode("HPKE"), i2osp(KEM_ID, 2), i2osp(KDF_ID, 2), i2osp(AEAD_ID, 2), )
KDF_ID
Type : number
Default value : 0x0001
KEM_ID
Type : number
Default value : 0x0010
kemSuiteId
Type : unknown
Default value : concat(enc.encode("KEM"), i2osp(KEM_ID, 2))
Nk
Type : number
Default value : 16
Nn
Type : number
Default value : 12
Nsecret
Type : number
Default value : 32
SHA256_LEN
Type : number
Default value : 32

src/crypto/key/kms/kms-crypto-provider.ts

ALG_TO_WEBCRYPTO
Type : Record<KmsSigningAlg, KeyAlgorithm>
Default value : { ES256: { name: "ECDSA", // @ts-expect-error - WebCrypto KeyAlgorithm doesn't include namedCurve in its type namedCurve: "P-256", }, }

src/issuer/configuration/credentials/schemas/credential-config.schema.ts

AllowListPolicySchema
Type : unknown
Default value : z .object({ policy: z .literal("allowList") .describe("Allow-list based policy discriminator."), values: z .array(z.string()) .describe("Allowed values for policy checks."), }) .describe("Allow-list disclosure policy.") .strict()
AttestationBasedPolicySchema
Type : unknown
Default value : z .object({ policy: z .literal("attestationBased") .describe("Attestation-based policy discriminator."), values: z .array(PolicyCredentialSchema) .describe("Attestation requirements used for policy enforcement."), }) .describe("Attestation-based disclosure policy.") .strict()
ClaimFieldDefinitionSchema
Type : z.ZodTypeAny
Default value : z.lazy(() => z .object({ path: z .array(z.union([z.string(), z.number(), z.null()])) .describe("Path to this claim inside the credential payload."), type: z .enum([ "string", "number", "integer", "boolean", "object", "array", ]) .describe("Data type of the claim value."), defaultValue: z .unknown() .optional() .describe("Optional default value for this field."), mandatory: z .boolean() .optional() .describe("Whether the field is required at issuance time."), disclosable: z .boolean() .optional() .describe("Whether the claim is selectively disclosable."), namespace: z .string() .optional() .describe("Optional namespace for claim grouping."), display: z .array(FieldDisplaySchema) .optional() .describe("Localized display metadata for this field."), constraints: z .record(z.string(), z.unknown()) .optional() .describe( "Optional validation constraints for the claim value.", ), children: z .array(ClaimFieldDefinitionSchema) .optional() .describe( "Nested child claim definitions for object or array fields.", ), }) .describe("Claim field definition.") .strict(), )
CredentialConfigCreateSchema
Type : unknown
Default value : z .object({ id: z.string().min(1).describe("Credential configuration identifier."), description: z .string() .nullable() .optional() .describe("Optional description for operators and tooling."), config: IssuerMetadataCredentialConfigSchema.describe( "Issuer metadata-facing credential configuration.", ), fields: z .array(ClaimFieldDefinitionSchema) .describe("Claim field definitions for credential issuance."), attributeProviderId: z .string() .nullable() .optional() .describe( "Optional attribute provider id used to resolve claim values.", ), webhookEndpointId: z .string() .nullable() .optional() .describe( "Optional webhook endpoint id notified during issuance events.", ), vct: z .union([z.string(), VctSchema, z.null()]) .optional() .describe("Optional VCT value or structured VCT metadata."), keyBinding: z .boolean() .optional() .describe("Enable key binding requirements."), keyChainId: z .string() .min(1) .optional() .describe("Optional key chain id used for credential signing."), statusManagement: z .boolean() .optional() .describe("Enable status management for issued credentials."), iaeActions: z .array(IaeActionSchema) .nullable() .optional() .describe("Optional in-app experience actions for wallet flows."), sdJwtTrustFormat: z .enum(["x5c", "federation"]) .nullable() .optional() .describe("Trust format used for SD-JWT verification metadata."), lifeTime: z.coerce .number() .int() .min(1) .optional() .describe("Credential lifetime in seconds."), schemaMeta: SchemaMetaConfigSchema.nullable() .optional() .describe("Optional schema metadata and trust bindings."), embeddedDisclosurePolicy: EmbeddedDisclosurePolicySchema.nullable() .optional() .describe("Optional embedded disclosure policy."), }) .describe("Payload for creating credential issuance configuration.") .strict()
CredentialDisplaySchema
Type : unknown
Default value : FieldDisplaySchema.extend({ background_color: z .string() .optional() .describe("Optional background color for card-style rendering."), text_color: z .string() .optional() .describe("Optional text color for card-style rendering."), background_image: DisplayImageSchema.optional().describe( "Optional background image.", ), logo: DisplayImageSchema.optional().describe("Optional logo image."), }).strict()
CredentialReusePolicyOptionSchema
Type : unknown
Default value : z .object({ details: z .array( z.enum([ "once_only", "limited_time", "limited-time", "rotating-batch", "per-relying-party", ]), ) .min(1), batch_size: z.number().int().min(2).optional(), reissue_trigger_unused: z.number().int().min(0).optional(), reissue_trigger_lifetime_left: z.number().int().min(0).optional(), }) .strict() .superRefine((option, context) => { const details = new Set(option.details); if ( (details.has("once_only") || details.has("rotating-batch") || details.has("per-relying-party")) && option.batch_size === undefined ) { context.addIssue({ code: z.ZodIssueCode.custom, path: ["batch_size"], message: "batch_size is required for this reuse policy", }); } if (details.has("once_only")) { if (option.reissue_trigger_unused === undefined) { context.addIssue({ code: z.ZodIssueCode.custom, path: ["reissue_trigger_unused"], message: "reissue_trigger_unused is required for once_only", }); } else if ( option.batch_size !== undefined && option.reissue_trigger_unused >= option.batch_size ) { context.addIssue({ code: z.ZodIssueCode.custom, path: ["reissue_trigger_unused"], message: "must be lower than batch_size", }); } } if ( (details.has("limited_time") || details.has("limited-time") || details.has("rotating-batch") || details.has("per-relying-party")) && option.reissue_trigger_lifetime_left === undefined ) { context.addIssue({ code: z.ZodIssueCode.custom, path: ["reissue_trigger_lifetime_left"], message: "reissue_trigger_lifetime_left is required for this reuse policy", }); } })
CredentialReusePolicySchema
Type : unknown
Default value : z .object({ id: z.string().min(1), options: z.array(CredentialReusePolicyOptionSchema).optional(), }) .strict() .superRefine((policy, context) => { if (policy.id === "arf_annex_ii" && !policy.options) { context.addIssue({ code: z.ZodIssueCode.custom, path: ["options"], message: "options is required for arf_annex_ii", }); } })
DisplayImageSchema
Type : unknown
Default value : z .object({ uri: z.string().min(1).describe("Image URI."), }) .describe("Display image reference.") .strict()
EmbeddedDisclosurePolicySchema
Type : unknown
Default value : z .discriminatedUnion("policy", [ AttestationBasedPolicySchema, NoneTrustPolicySchema, AllowListPolicySchema, RootOfTrustPolicySchema, ]) .describe("Embedded disclosure policy configuration.")
FieldDisplaySchema
Type : unknown
Default value : z .object({ locale: z.string().min(1).describe("Locale tag for the display entry."), name: z.string().min(1).describe("Human-readable field name."), description: z .string() .optional() .describe("Optional field description for this locale."), }) .describe("Localized display metadata for a claim field.") .strict()
IaeActionOpenid4vpPresentationSchema
Type : unknown
Default value : z .object({ type: z .literal("openid4vp_presentation") .describe("Trigger an OpenID4VP presentation action."), label: z .string() .optional() .describe("Optional UI label for the action."), presentationConfigId: z .string() .min(1) .describe("Presentation configuration id to execute."), }) .describe("IAE action to request a presentation.") .strict()
IaeActionRedirectToWebSchema
Type : unknown
Default value : z .object({ type: z .literal("redirect_to_web") .describe("Trigger a redirect-to-web action."), label: z .string() .optional() .describe("Optional UI label for the action."), url: z.url().describe("Destination URL for the redirect action."), callbackUrl: z .url() .optional() .describe("Optional callback URL after redirect completion."), description: z .string() .optional() .describe("Optional action description."), }) .describe("IAE action to redirect to an external web flow.") .strict()
IaeActionSchema
Type : unknown
Default value : z .discriminatedUnion("type", [ IaeActionOpenid4vpPresentationSchema, IaeActionRedirectToWebSchema, ]) .describe("In-app experience action definitions.")
IssuerMetadataCredentialConfigSchema
Type : unknown
Default value : z .object({ format: z .enum(["mso_mdoc", "dc+sd-jwt"]) .describe("Credential format emitted by this configuration."), display: z .array(CredentialDisplaySchema) .describe("Display metadata shown by wallets."), scope: z .string() .optional() .describe( "Optional OAuth scope associated with this credential type.", ), docType: z.string().optional().describe("Optional mDoc document type."), keyAttestationsRequired: KeyAttestationsRequiredSchema.optional().describe( "Optional key attestation requirements.", ), proofTypesSupported: z .array(z.enum(["jwt", "attestation"])) .optional() .describe("Supported proof types for issuance requests."), credentialReusePolicy: CredentialReusePolicySchema.optional().describe( "Optional PID/EAA reuse policy published in credential metadata.", ), }) .describe("Credential metadata configuration exposed by issuer metadata.") .strict()
KeyAttestationsRequiredSchema
Type : unknown
Default value : z .object({ key_storage: z .array(z.string()) .optional() .describe("Required key storage attestations."), user_authentication: z .array(z.string()) .optional() .describe("Required user authentication attestations."), }) .describe("Required key attestation capabilities.") .strict()
NoneTrustPolicySchema
Type : unknown
Default value : z .object({ policy: z.literal("none").describe("No disclosure policy enforcement."), }) .describe("No disclosure policy.") .strict()
PolicyCredentialSchema
Type : unknown
Default value : z .object({ claims: z .array(z.unknown()) .optional() .describe("Claims constraints considered by policy evaluation."), credentials: z .array(z.unknown()) .describe( "Credential constraints considered by policy evaluation.", ), credential_sets: z .array(z.unknown()) .optional() .describe("Optional credential set constraints."), }) .describe("Credential policy requirement entry.") .strict()
RootOfTrustPolicySchema
Type : unknown
Default value : z .object({ policy: z .literal("rootOfTrust") .describe("Root-of-trust policy discriminator."), values: z.string().describe("Root-of-trust identifier or reference."), }) .describe("Root-of-trust disclosure policy.") .strict()
SchemaMetaConfigSchema
Type : unknown
Default value : z .object({ id: z .string() .optional() .describe("Optional schema metadata identifier."), name: z.string().optional().describe("Optional schema metadata name."), version: z.string().describe("Schema metadata version."), rulebookURI: z .string() .optional() .describe("Optional rulebook URI reference."), attestationLoS: z .enum([ "iso_18045_high", "iso_18045_moderate", "iso_18045_enhanced-basic", "iso_18045_basic", ]) .describe("Assurance level for attestation requirements."), bindingType: z .enum(["claim", "key", "biometric", "none"]) .describe("Subject binding type."), schemaURIs: z .array(SchemaUriEntrySchema) .optional() .describe("Optional schema URI entries."), trustedAuthorities: z .array(TrustAuthorityEntrySchema) .optional() .describe("Optional trusted authority entries."), }) .describe("Schema metadata configuration.") .strict()
SchemaUriEntrySchema
Type : unknown
Default value : z .object({ credentialConfigId: z .string() .optional() .describe( "Optional credential configuration id this schema URI applies to.", ), format: z .string() .optional() .describe("Optional credential format for this schema URI."), uri: z.string().optional().describe("Schema URI reference."), meta: z .record(z.string(), z.unknown()) .optional() .describe("Optional metadata attached to the schema URI."), }) .describe("Schema URI mapping entry.") .strict()
TrustAuthorityEntrySchema
Type : unknown
Default value : z .object({ trustListId: z.string().optional().describe("Optional trust list id."), frameworkType: z .enum(["aki", "etsi_tl", "openid_federation"]) .optional() .describe("Trust framework type."), value: z .string() .optional() .describe("Framework-specific authority value."), verificationMethod: z .union([z.record(z.string(), z.unknown()), z.string()]) .optional() .describe("Verification method descriptor."), }) .describe("Trusted authority mapping entry.") .strict()
VctSchema
Type : unknown
Default value : z .object({ vct: z.string().optional().describe("VCT identifier."), name: z.string().optional().describe("Human-readable VCT name."), description: z .string() .optional() .describe("Optional VCT description."), extends: z.string().optional().describe("Optional base VCT reference."), "extends#integrity": z .string() .optional() .describe("Integrity hash for the extends reference."), schema_uri: z .string() .optional() .describe("Optional schema URI for the VCT."), "schema_uri#integrity": z .string() .optional() .describe("Integrity hash for schema_uri."), }) .describe("Structured VCT metadata.") .strict()

src/auth/roles/role.enum.ts

allRoles
Type : []
Default value : [ Role.Tenants, Role.IssuanceOffer, Role.Issuances, Role.PresentationRequest, Role.Presentations, Role.Clients, Role.Users, Role.Registrar, ]

List of all roles

src/issuer/configuration/attribute-provider/schemas/attribute-provider.schema.ts

ApiKeyAuthSchema
Type : unknown
Default value : z .object({ type: z.literal("apiKey").describe("Use API key authentication."), config: z .object({ headerName: z .string() .min(1) .describe("HTTP header name carrying the API key."), value: z.string().min(1).describe("API key value."), }) .describe("API key authentication settings."), }) .describe("API key authentication variant.")
AttributeProviderAuthSchema
Type : unknown
Default value : z .discriminatedUnion("type", [NoneAuthSchema, ApiKeyAuthSchema]) .describe("Authentication method used to call the attribute provider.")
CreateAttributeProviderSchema
Type : unknown
Default value : z .object({ id: z.string().min(1).describe("Unique attribute provider identifier."), name: z .string() .min(1) .describe("Display name of the attribute provider."), description: z .string() .min(1) .optional() .nullable() .describe("Optional attribute provider description."), url: z.url().describe("Base URL of the attribute provider endpoint."), auth: AttributeProviderAuthSchema.describe( "Authentication configuration for outbound provider requests.", ), }) .describe("Payload for creating an attribute provider configuration.") .strict()
NoneAuthSchema
Type : unknown
Default value : z .object({ type: z .literal("none") .describe("Disable authentication for attribute provider calls."), }) .describe("No authentication variant.")
UpdateAttributeProviderSchema
Type : unknown
Default value : CreateAttributeProviderSchema.partial() .describe( "Payload for partially updating an attribute provider configuration.", ) .strict()

src/webhook/webhook.dto.ts

ApiKeyConfigSchema
Type : unknown
Default value : z .object({ headerName: z.string(), value: z.string(), }) .strict()

Configuration for API key authentication in webhooks.
WebHookAuthConfigHeaderSchema
Type : unknown
Default value : z .object({ type: z.literal(AuthConfig.API_KEY), config: ApiKeyConfigSchema, }) .strict()

Configuration for webhook authentication.
WebHookAuthConfigNoneSchema
Type : unknown
Default value : z .object({ type: z.literal(AuthConfig.NONE), }) .strict()
WebHookAuthConfigSchema
Type : unknown
Default value : z.discriminatedUnion("type", [ WebHookAuthConfigNoneSchema, WebHookAuthConfigHeaderSchema, ])
WebhookConfigSchema
Type : unknown
Default value : z .object({ url: z.string(), auth: WebHookAuthConfigSchema, includeRawTokensFor: z.array(z.string()).optional(), }) .strict()

src/webhook/webhook.schema.ts

ApiKeyConfigSchema
Type : unknown
Default value : z .object({ headerName: z .string() .min(1) .describe("The header name used to send the API key."), value: z.string().min(1).describe("The API key value."), }) .describe("Configuration for API key authentication.") .strict()
WebHookAuthConfigHeaderSchema
Type : unknown
Default value : z .object({ type: z.literal("apiKey").describe("Use API key authentication."), config: ApiKeyConfigSchema.describe("API key authentication settings."), }) .describe("Webhook API key authentication variant.") .strict()
WebHookAuthConfigNoneSchema
Type : unknown
Default value : z .object({ type: z.literal("none").describe("Disable authentication."), }) .describe("Webhook no-authentication variant.") .strict()
WebHookAuthConfigSchema
Type : unknown
Default value : z .discriminatedUnion("type", [ WebHookAuthConfigNoneSchema, WebHookAuthConfigHeaderSchema, ]) .describe("Webhook authentication configuration.")
WebhookConfigSchema
Type : unknown
Default value : z .object({ url: z .string() .min(1) .describe("The URL to which the webhook will send notifications."), auth: WebHookAuthConfigSchema.describe( "Webhook authentication strategy.", ), includeRawTokensFor: z .array(z.string()) .optional() .describe( "List of credential IDs to include raw tokens for (for example ['sca_credential']).", ), }) .describe("Webhook configuration used in issuance and presentation flows.") .strict()

src/database/data-source.ts

AppDataSource
Type : unknown
Default value : new DataSource(dataSourceOptions)
commonOptions
Type : Partial<DataSourceOptions>
Default value : { synchronize: false, logging: process.env.DB_LOGGING === "true", migrations: [join(__dirname, "migrations", "*.{ts,js}")], migrationsTableName: "typeorm_migrations", // Entity patterns - TypeORM CLI needs explicit patterns entities: [join(__dirname, "..", "**", "*.entity.{ts,js}")], }
dataSourceOptions
Type : DataSourceOptions
dbType
Type : unknown
Default value : process.env.DB_TYPE as "sqlite" | "postgres" | undefined

src/registrar/schema-metadata/dto/schema-metadata.dto.ts

ATTESTATION_LOS_VALUES
Type : unknown
Default value : [ "iso_18045_high", "iso_18045_moderate", "iso_18045_enhanced-basic", "iso_18045_basic", ] as const
BINDING_TYPE_VALUES
Type : unknown
Default value : ["claim", "key", "biometric", "none"] as const
CATEGORY_VALUES
Type : unknown
Default value : [ "identity", "health", "finance", "education", "mobility", "employment", "other", ] as const
DeprecateSchemaMetadataSchema
Type : unknown
Default value : z .object({ deprecated: z.boolean(), message: z.string().optional(), supersededByVersion: z.string().optional(), }) .strict()
FORMAT_VALUES
Type : unknown
Default value : ["dc+sd-jwt", "mso_mdoc"] as const
TAG_VALUES
Type : unknown
Default value : [ "pid", "eudi", "kyc", "aml", "age-verification", "residency", "membership", "education", "employment", "mobility", ] as const
UpdateIssuerOfferSchema
Type : unknown
Default value : z .object({ credentialOfferUrl: z.string().optional(), description: z.string().optional(), }) .strict()
UpdateSchemaMetadataSchema
Type : unknown
Default value : z .object({ category: z.enum(CATEGORY_VALUES).optional(), tags: z.array(z.enum(TAG_VALUES)).optional(), displayName: z.string().optional(), issuerOffers: z.array(UpdateIssuerOfferSchema).optional(), }) .strict()
VOCABULARY_STATUS_VALUES
Type : unknown
Default value : ["active", "deprecated"] as const

src/issuer/configuration/credentials/entities/policies.dto.ts

AttestationBasedPolicySchema
Type : unknown
Default value : z .object({ policy: z.literal("attestationBased"), values: z.array(PolicyCredentialSchema), }) .strict()
EmbeddedDisclosurePolicySchema
Type : unknown
Default value : z .object({ policy: z.string(), }) .strict()
PolicyCredentialSchema
Type : unknown
Default value : z .object({ claims: z.array(z.any()).optional(), credentials: z.array(z.any()), credential_sets: z.array(z.any()).optional(), }) .strict()

src/issuer/issuance/oid4vci/dto/offer-request.dto.ts

AttributeProviderClaimsSourceSchema
Type : unknown
Default value : z .object({ type: z.literal("attributeProvider"), attributeProviderId: z.string(), }) .strict()
ClaimsSourceSchema
Type : unknown
Default value : z.union([ InlineClaimsSourceSchema, AttributeProviderClaimsSourceSchema, WebhookClaimsSourceSchema, ])
FlowType
Type : unknown
Default value : { AUTH_CODE: "authorization_code", PRE_AUTH_CODE: "pre_authorized_code", } as const
InlineClaimsSourceSchema
Type : unknown
Default value : z .object({ type: z.literal("inline"), claims: z.record(z.string(), z.unknown()), }) .strict()
OfferRequestBase
Type : OfferRequestConstructor
Default value : createZodDto( OfferRequestSchema, ) as OfferRequestConstructor
OfferRequestSchema
Type : unknown
Default value : z .object({ response_type: z.union([ z.literal(ResponseType.URI), z.literal(ResponseType.DC_API), z.literal(ResponseType.ISO_18013_7), ]), flow: z.union([ z.literal(FlowType.AUTH_CODE), z.literal(FlowType.PRE_AUTH_CODE), ]), tx_code: z.string().optional(), tx_code_description: z.string().optional(), credentialConfigurationIds: z.array(z.string()), authorization_server: z.string().optional(), credentialClaims: z.record(z.string(), ClaimsSourceSchema).optional(), webhookEndpointId: z.string().optional(), }) .strict() .superRefine((data, ctx) => { if (!data.credentialClaims) { return; } const allowed = new Set(data.credentialConfigurationIds); const invalidKeys = Object.keys(data.credentialClaims).filter( (key) => !allowed.has(key), ); if (invalidKeys.length > 0) { ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["credentialClaims"], message: `credentialClaims contains keys [${invalidKeys.join(", ")}] that are not in credentialConfigurationIds [${data.credentialConfigurationIds.join(", ")}]`, }); } })
WebhookClaimsSourceSchema
Type : unknown
Default value : z .object({ type: z.literal("webhook"), webhook: WebhookConfigSchema, }) .strict()

src/issuer/configuration/attribute-provider/schemas/attribute-provider-editor-schema.bundle.ts

attributeProviderEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "attribute-provider", schemas: [ defineEditorSchema({ name: "CreateAttributeProviderDto", schema: CreateAttributeProviderSchema, }), defineEditorSchema({ name: "UpdateAttributeProviderDto", schema: UpdateAttributeProviderSchema, }), defineEditorSchema({ name: "AttributeProviderAuth", schema: AttributeProviderAuthSchema, }), ], })

src/audit-log/audit-log-validation.schema.ts

AUDIT_LOG_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ AUDIT_LOG_RETENTION_DAYS: Joi.number() .integer() .min(0) .default(0) .description( "Delete tenant activity audit log entries older than N days. Set to 0 to disable time-based pruning.", ) .meta({ group: "log", order: 80 }), AUDIT_LOG_MAX_ENTRIES_PER_TENANT: Joi.number() .integer() .min(0) .default(0) .description( "Keep only the newest N tenant activity audit log entries per tenant. Set to 0 to disable count-based pruning.", ) .meta({ group: "log", order: 90 }), })

src/auth/auth-validation.schema.ts

AUTH_VALIDATION_SCHEMA
Type : Joi.ObjectSchema
Default value : Joi.object({ OIDC: Joi.string() .description("Enable OIDC mode") .meta({ group: "auth", order: 10 }), OIDC_INTERNAL_ISSUER_URL: Joi.string() .uri() .when("OIDC", { is: Joi.exist(), then: Joi.string().default((config) => config.OIDC), otherwise: Joi.optional(), }) .description("Internal issuer URL in OIDC mode") .meta({ group: "auth", order: 20 }), OIDC_CLIENT_ID: Joi.when("OIDC", { is: Joi.exist(), then: Joi.string().required(), otherwise: Joi.optional(), }) .description("Client ID for OIDC") .meta({ group: "auth", order: 25 }), OIDC_CLIENT_SECRET: Joi.when("OIDC", { is: Joi.exist(), then: Joi.string().required(), otherwise: Joi.optional(), }) .description("Client secret for OIDC") .meta({ group: "auth", order: 26 }), OIDC_SUB: Joi.when("OIDC", { is: Joi.exist(), then: Joi.string().default("tenant_id"), otherwise: Joi.optional(), }) .description("Claim to use as subject") .meta({ group: "auth", order: 30 }), OIDC_ALGORITHM: Joi.when("OIDC", { is: Joi.exist(), then: Joi.string().valid("RS256", "PS256", "ES256").default("RS256"), otherwise: Joi.optional(), }) .description("Expected JWT alg") .meta({ group: "auth", order: 40 }), MASTER_SECRET: Joi.when("OIDC", { is: Joi.exist(), then: Joi.string().optional(), otherwise: Joi.string().min(32).required(), }) .description( "Master secret for JWT signing and encryption key derivation - required, minimum 32 characters", ) .meta({ group: "auth", order: 50 }), JWT_ISSUER: Joi.when("OIDC", { is: Joi.exist(), then: Joi.string().optional(), otherwise: Joi.string().default("eudiplo-service"), }) .description("Local JWT issuer") .meta({ group: "auth", order: 60 }), JWT_EXPIRES_IN: Joi.when("OIDC", { is: Joi.exist(), then: Joi.string().optional(), otherwise: Joi.string().default("24h"), }) .description("Local JWT expiration") .meta({ group: "auth", order: 70 }), AUTH_CLIENT_SECRET: Joi.when("OIDC", { is: Joi.exist(), then: Joi.string().optional(), otherwise: Joi.string().required(), }) .description( "Client secret (local auth). In OIDC mode, optional bootstrap secret used to create/update a Keycloak admin/root client when AUTH_CLIENT_ID is also set", ) .meta({ group: "auth", order: 80 }), AUTH_CLIENT_ID: Joi.when("OIDC", { is: Joi.exist(), then: Joi.string().optional(), otherwise: Joi.string().required(), }) .description( "Client ID (local auth). In OIDC mode, optional bootstrap client ID used to create/update a Keycloak admin/root client when AUTH_CLIENT_SECRET is also set", ) .meta({ group: "auth", order: 90 }), OIDC_UI_CLIENT_ID: Joi.when("OIDC", { is: Joi.exist(), then: Joi.string().default("eudiplo-ui"), otherwise: Joi.optional(), }) .description( "Public client ID for the Angular UI in OIDC mode. Used to register a public Keycloak client for Authorization Code + PKCE login.", ) .meta({ group: "auth", order: 95 }), }).unknown(true)

src/issuer/configuration/issuance/dto/authentication-config.dto.ts

AuthenticationMethodAuthSchema
Type : unknown
Default value : z .object({ method: z.literal("auth"), config: AuthenticationUrlConfigSchema, }) .strict()
AuthenticationMethodNoneSchema
Type : unknown
Default value : z .object({ method: z.literal("none"), }) .strict()
AuthenticationMethodPresentationSchema
Type : unknown
Default value : z .object({ method: z.literal("presentationDuringIssuance"), config: PresentationDuringIssuanceConfigSchema, }) .strict()
AuthenticationUrlConfigSchema
Type : unknown
Default value : z .object({ url: z.string(), webhook: WebhookConfigSchema.optional(), }) .strict()
PresentationDuringIssuanceConfigSchema
Type : unknown
Default value : z .object({ type: z.string(), }) .strict()

src/issuer/issuance/oid4vci/authorization/shared/dto/chained-as.dto.ts

authorizationDetailsSchema
Type : unknown
Default value : z.preprocess( (value) => { if (typeof value === "string") { try { return JSON.parse(value); } catch { return value; } } return value; }, z.array(z.record(z.string(), z.unknown())), )
ChainedAsAuthorizeQuerySchema
Type : unknown
Default value : z .object({ client_id: z.string(), request_uri: z.string(), state: z.string().optional(), }) .strict()
ChainedAsParRequestSchema
Type : unknown
Default value : z .object({ response_type: z.string(), client_id: z.string(), redirect_uri: z.string(), code_challenge: z.string().optional(), code_challenge_method: z.string().optional(), state: z.string().optional(), scope: z.string().optional(), issuer_state: z.string().optional(), authorization_details: authorizationDetailsSchema.optional(), }) .strict()
ChainedAsTokenRequestSchema
Type : unknown
Default value : z .object({ grant_type: z.string(), code: z.string().optional(), refresh_token: z.string().optional(), client_id: z.string().optional(), redirect_uri: z.string().optional(), code_verifier: z.string().optional(), }) .strict()

src/issuer/issuance/oid4vci/authorization/authorize/dto/interactive-authorization.dto.ts

AuthorizationDetailsSchema
Type : unknown
Default value : z .object({ type: z.string(), format: z.string().optional(), vct: z.string().optional(), credential_configuration_id: z.string().optional(), }) .strict()
InteractiveAuthorizationRequestSchema
Type : unknown
Default value : z .object({ response_type: z.string().optional(), client_id: z.string().optional(), interaction_types_supported: z.string().optional(), redirect_uri: z.string().optional(), scope: z.string().optional(), code_challenge: z.string().optional(), code_challenge_method: z.string().optional(), authorization_details: z .union([z.array(AuthorizationDetailsSchema), z.string()]) .optional(), state: z.string().optional(), issuer_state: z.string().optional(), auth_session: z.string().optional(), openid4vp_response: z.string().optional(), code_verifier: z.string().optional(), request: z.string().optional(), request_uri: z.string().optional(), }) .strict()
Openid4vpRequestSchema
Type : unknown
Default value : z .object({ request: z.string(), client_id: z.string().optional(), }) .strict()

src/verifier/oid4vp/dto/authorization-response.dto.ts

AuthorizationResponseSchema
Type : unknown
Default value : z .object({ response: z.string().optional(), sendResponse: z.boolean().optional(), error: z.string().optional(), error_description: z.string().optional(), error_uri: z.string().optional(), state: z.string().optional(), }) .strict()

DTO for the authorization response containing either a VP token (success) or an OAuth 2.0 error response (when wallet cannot fulfill the request).

Per OID4VP spec section 6.2, wallets can return error responses with:

  • error (required)
  • error_description (optional)
  • error_uri (optional)
  • state (required if present in the request)

src/issuer/issuance/oid4vci/authorization/authorize/dto/authorize-request.dto.ts

AuthorizeQueriesSchema
Type : unknown
Default value : z .object({ issuer_state: z.string().optional(), response_type: z.string().optional(), client_id: z.string().optional(), redirect_uri: z.string().optional(), resource: z.string().optional(), scope: z.string().optional(), code_challenge: z.string().optional(), code_challenge_method: z.string().optional(), dpop_jkt: z.string().optional(), request_uri: z.string().optional(), auth_session: z.string().optional(), state: z.string().optional(), authorization_details: z .union([z.string(), z.array(z.unknown())]) .optional(), }) .strict()

src/verifier/presentations/dto/auth-response.dto.ts

AuthResponseSchema
Type : unknown
Default value : z .object({ vp_token: z.record(z.string(), z.array(z.string())), state: z.string().optional(), iat: z.number().optional(), exp: z.number().optional(), }) .strict()

src/crypto/key/schemas/kms-config.schema.ts

AwsKmsConfigSchema
Type : unknown
Default value : BaseKmsProviderConfigSchema.extend({ type: withMeta(z.literal("aws-kms"), { description: "Type of the KMS provider.", examples: ["aws-kms"], }), region: textField( "AWS region for KMS. Supports ${ENV_VAR} placeholders.", "${AWS_REGION}", ), accessKeyId: optionalTextField( "AWS access key ID. Optional — uses SDK credential chain if not provided. Supports ${ENV_VAR} placeholders.", "${AWS_ACCESS_KEY_ID}", ), secretAccessKey: optionalTextField( "AWS secret access key. Optional — uses SDK credential chain if not provided. Supports ${ENV_VAR} placeholders.", "${AWS_SECRET_ACCESS_KEY}", ), })
BaseKmsProviderConfigSchema
Type : unknown
Default value : z.strictObject({ id: textField( "Unique identifier for this provider instance. Used when generating keys to specify which provider to use.", "main-vault", ), type: withMeta(z.enum(KMS_PROVIDER_TYPES), { description: "Type of the KMS provider. Must match a supported adapter type.", examples: ["vault"], }), description: optionalTextField( "Human-readable description of this provider instance.", "Production HashiCorp Vault for signing keys", ), })
CscAuthorizeAuthDataSchema
Type : unknown
Default value : z.strictObject({ id: textField( "Authentication factor identifier expected by the CSC provider (e.g., PIN, OTP).", "PIN", ), value: textField( "Authentication factor value sent to CSC credentials/authorize.", "123456", ), })
CscKmsConfigSchema
Type : unknown
Default value : BaseKmsProviderConfigSchema.extend({ type: withMeta(z.literal("csc"), { description: "Type of the KMS provider.", examples: ["csc"], }), baseUrl: urlField( "Base URL of the CSC service (without trailing slash). Supports ${ENV_VAR} placeholders.", "${CSC_URL}", ), tokenUrl: urlField( "OAuth2 token endpoint URL for client-credentials flow. Supports ${ENV_VAR} placeholders.", "${CSC_TOKEN_URL}", ), clientId: textField( "OAuth2 client ID. Supports ${ENV_VAR} placeholders.", "${CSC_CLIENT_ID}", ), clientSecret: textField( "OAuth2 client secret. Supports ${ENV_VAR} placeholders.", "${CSC_CLIENT_SECRET}", ), scope: optionalTextField( "OAuth2 scope to request during token acquisition.", "service", ), credentialId: optionalTextField( "Default CSC credential ID. If omitted, the adapter calls credentials/list and picks the first entry.", "[INTESIQCSEALEC]_SEAL_351_SIGN_1781018892758", ), userId: optionalTextField( "Optional CSC user ID used in credentials/list requests.", "eudiplo_user", ), apiPath: optionalTextField( "CSC API path prefix appended to baseUrl. Defaults to /csc/v2.", "/csc/v2", ), hashAlgorithmOid: optionalTextField( "Hash algorithm OID for signatures/signHash and credentials/authorize. Defaults to SHA-256 OID.", "2.16.840.1.101.3.4.2.1", ), signAlgorithmOid: optionalTextField( "Signature algorithm OID for signatures/signHash. Defaults to ecdsa-with-SHA256 OID.", "1.2.840.10045.4.3.2", ), sad: optionalTextField( "Static SAD token. If set, the adapter sends it directly in signatures/signHash requests.", ), useAuthorizeEndpoint: booleanField( "When true and no static SAD is provided, the adapter calls credentials/authorize to obtain SAD before signatures/signHash.", false, ), authorizeAuthData: withMeta( z.array(CscAuthorizeAuthDataSchema).optional(), { description: "Optional authData array passed to credentials/authorize (e.g., PIN/OTP factors).", }, ), })
DbKmsConfigSchema
Type : unknown
Default value : BaseKmsProviderConfigSchema.extend({ type: withMeta(z.literal("db"), { description: "Type of the KMS provider.", examples: ["db"], }), })
HttpAuthBearerConfigSchema
Type : unknown
Default value : z.strictObject({ type: withMeta(z.literal("bearer"), { description: "Static Bearer token sent as Authorization: Bearer <token>.", examples: ["bearer"], }), token: textField( "Bearer token value. Supports ${ENV_VAR} placeholders.", "${KMS_API_KEY}", ), })
HttpAuthMtlsConfigSchema
Type : unknown
Default value : z.strictObject({ type: withMeta(z.literal("mtls"), { description: "Mutual TLS — EUDIPLO presents a client certificate on every connection.", examples: ["mtls"], }), certFile: textField( "Absolute path to the PEM-encoded client certificate file. Supports ${ENV_VAR} placeholders.", "/etc/certs/eudiplo.crt", ), keyFile: textField( "Absolute path to the PEM-encoded private key file for the client certificate. Supports ${ENV_VAR} placeholders.", "/etc/certs/eudiplo.key", ), caFile: optionalTextField( "Absolute path to the PEM-encoded CA bundle to trust for the remote server's certificate. Omit to use the system CA store.", "/etc/certs/ca.crt", ), })
HttpAuthNoneConfigSchema
Type : unknown
Default value : z.strictObject({ type: withMeta(z.literal("none"), { description: "No authentication — suitable for services on a trusted private network.", examples: ["none"], }), })
HttpAuthOauth2ConfigSchema
Type : unknown
Default value : z.strictObject({ type: withMeta(z.literal("oauth2-client-credentials"), { description: "OAuth 2.0 Client Credentials — EUDIPLO fetches and caches short-lived tokens.", examples: ["oauth2-client-credentials"], }), tokenUrl: urlField( "Token endpoint URL (e.g. Keycloak, Entra ID). Supports ${ENV_VAR} placeholders.", "${IAM_TOKEN_URL}", ), clientId: textField( "OAuth 2.0 client ID. Supports ${ENV_VAR} placeholders.", "${KMS_CLIENT_ID}", ), clientSecret: textField( "OAuth 2.0 client secret. Supports ${ENV_VAR} placeholders.", "${KMS_CLIENT_SECRET}", ), scope: optionalTextField( "Space-separated list of OAuth 2.0 scopes to request. Optional.", "kms:sign kms:admin", ), })
HttpKmsAuthConfigSchema
Type : unknown
Default value : z.discriminatedUnion("type", [ HttpAuthNoneConfigSchema, HttpAuthBearerConfigSchema, HttpAuthOauth2ConfigSchema, HttpAuthMtlsConfigSchema, ])
HttpKmsConfigSchema
Type : unknown
Default value : BaseKmsProviderConfigSchema.extend({ type: withMeta(z.literal("http"), { description: "Type of the KMS provider.", examples: ["http"], }), baseUrl: urlField( "Base URL of the remote KMS microservice (no trailing slash). Supports ${ENV_VAR} placeholders.", "${KMS_SERVICE_URL}", ), auth: withMeta(HttpKmsAuthConfigSchema.optional(), { description: 'Authentication method for the remote KMS service. Supports bearer token, OAuth 2.0 client credentials, and mutual TLS. Omit (or set type to "none") for unauthenticated services.', }), keysPath: optionalTextField( "Path prefix for key endpoints on the remote service. Defaults to /keys.", "/v1/keys", ), healthPath: optionalTextField( "Path for the health check endpoint on the remote service. Defaults to /health.", "/health", ), canImport: booleanField( "Whether the remote service supports key import via POST {keysPath}/{kid}/import. Defaults to false.", false, ), })
KMS_PROVIDER_TYPES
Type : unknown
Default value : [ "db", "vault", "aws-kms", "pkcs11", "http", "csc", ] as const
KmsConfigSchema
Type : unknown
Default value : z .strictObject({ defaultProvider: optionalTextField( 'ID of the default KMS provider. Defaults to "db" if not set.', "main-vault", ), providers: withMeta(z.array(KmsProviderConfigSchema), { description: "List of KMS provider configurations. Each provider must have a unique id and a type.", examples: [ [ { id: "db", type: "db", description: "Default database provider", }, { id: "main-vault", type: "vault", description: "Production Vault", vaultUrl: "${VAULT_URL}", vaultToken: "${VAULT_TOKEN}", }, { id: "aws", type: "aws-kms", description: "AWS KMS", region: "${AWS_REGION}", }, ], ], }), }) .superRefine((config, ctx) => { const providerIds = new Map<string, number>(); for (const [index, provider] of config.providers.entries()) { const previousIndex = providerIds.get(provider.id); if (previousIndex !== undefined) { ctx.addIssue({ code: "custom", path: ["providers", index, "id"], message: `Duplicate KMS provider id '${provider.id}' already used at providers[${previousIndex}]`, }); continue; } providerIds.set(provider.id, index); } if ( config.defaultProvider !== undefined && !providerIds.has(config.defaultProvider) ) { ctx.addIssue({ code: "custom", path: ["defaultProvider"], message: `defaultProvider '${config.defaultProvider}' does not match any configured provider id`, }); } })
KmsProviderConfigSchema
Type : unknown
Default value : z.discriminatedUnion("type", [ DbKmsConfigSchema, VaultKmsConfigSchema, AwsKmsConfigSchema, Pkcs11KmsConfigSchema, HttpKmsConfigSchema, CscKmsConfigSchema, ])
Pkcs11KmsConfigSchema
Type : unknown
Default value : BaseKmsProviderConfigSchema.extend({ type: withMeta(z.literal("pkcs11"), { description: "Type of the KMS provider.", examples: ["pkcs11"], }), library: textField( "Absolute path to the PKCS#11 module library (.so/.dll/.dylib). Supports ${ENV_VAR} placeholders.", "${PKCS11_LIBRARY}", ), slot: withMeta(z.union([z.number(), z.string()]), { description: "Slot selection. Either the numeric slot index (as a string for ENV interpolation, or a number) or the token label. Supports ${ENV_VAR} placeholders.", examples: ["${PKCS11_SLOT}"], }), pin: textField( "User PIN used for C_Login. Supports ${ENV_VAR} placeholders.", "${PKCS11_PIN}", ), readOnly: booleanField( "Open the PKCS#11 session in read-only mode. Defaults to false.", false, ), })
VaultKmsConfigSchema
Type : unknown
Default value : BaseKmsProviderConfigSchema.extend({ type: withMeta(z.literal("vault"), { description: "Type of the KMS provider.", examples: ["vault"], }), vaultUrl: urlField( "URL of the HashiCorp Vault instance. Supports ${ENV_VAR} placeholders.", "${VAULT_URL}", ), vaultToken: textField( "Authentication token for HashiCorp Vault. Supports ${ENV_VAR} placeholders.", "${VAULT_TOKEN}", ), })

src/platform/config/validation.schema.ts

BASE_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ FOLDER: Joi.string() .default("../../tmp") .description("Root working folder for temp files") .meta({ group: "general", order: 10 }), GRAFANA_URL: Joi.string() .uri({ scheme: ["http", "https"] }) .optional() .allow("") .description( "Base URL of the Grafana instance for deep linking from the dashboard UI", ) .meta({ group: "observability", order: 10 }), GRAFANA_DATASOURCE_TEMPO_UID: Joi.string() .default("tempo") .description("UID of the Tempo data source in Grafana") .meta({ group: "observability", order: 20 }), GRAFANA_DATASOURCE_LOKI_UID: Joi.string() .default("loki") .description("UID of the Loki data source in Grafana") .meta({ group: "observability", order: 30 }), }).unknown(true)

Validation schema for base configuration

src/auth/client/adapters/internal-clients.service.ts

BCRYPT_ROUNDS
Type : number
Default value : 10

src/issuer/configuration/issuance/dto/authorization-server-config.dto.ts

BuiltInAuthorizationServerConfigSchema
Type : unknown
Default value : z .object({ type: z.literal("built-in"), id: z.string(), token: ChainedAsTokenConfigSchema.optional(), requireDPoP: z.boolean().optional(), label: z.string().optional(), enabled: z.boolean().optional(), }) .strict()
ChainedAuthorizationServerConfigSchema
Type : unknown
Default value : z .object({ type: z.literal("chained"), id: z.string(), upstream: UpstreamOidcConfigSchema, token: ChainedAsTokenConfigSchema.optional(), requireDPoP: z.boolean().optional(), label: z.string().optional(), enabled: z.boolean().optional(), }) .strict()
ExternalAuthorizationServerConfigSchema
Type : unknown
Default value : z .object({ type: z.literal("external"), id: z.string(), issuer: z.string(), sessionBinding: z .object({ method: z.literal("access_token_claim"), claim: z.string().min(1), }) .optional(), label: z.string().optional(), enabled: z.boolean().optional(), }) .strict()
ManagedAuthorizationServerConfigSchema
Type : unknown
Default value : z .object({ type: z.enum(["external", "oid4vp", "chained", "built-in"]), id: z.string(), label: z.string().optional(), enabled: z.boolean().optional(), }) .strict()
Oid4VpAuthorizationServerConfigSchema
Type : unknown
Default value : z .object({ type: z.literal("oid4vp"), id: z.string(), presentationConfigId: z.string(), immediateWalletRedirect: z.boolean().optional(), token: ChainedAsTokenConfigSchema.optional(), requireDPoP: z.boolean().optional(), label: z.string().optional(), enabled: z.boolean().optional(), }) .strict()

src/issuer/configuration/issuance/schemas/issuance.schema.ts

BuiltInAuthorizationServerConfigSchema
Type : unknown
Default value : z .object({ type: z .literal("built-in") .describe("Use EUDIPLO built-in authorization server."), id: z.string().min(1).describe("Authorization server identifier."), token: ChainedAsTokenConfigSchema.optional().describe( "Optional token issuance settings.", ), requireDPoP: z .boolean() .optional() .describe("Require DPoP proofs for token/credential requests."), label: z .string() .optional() .describe("Optional display label for UI selection."), enabled: z .boolean() .optional() .describe("Whether this authorization server entry is enabled."), }) .describe("Built-in authorization server configuration.") .strict()
ChainedAsTokenConfigSchema
Type : unknown
Default value : z .object({ lifetimeSeconds: z.coerce .number() .min(60) .optional() .describe("Access token lifetime in seconds."), signingKeyId: z .string() .min(1) .optional() .describe("Optional key chain id used to sign issued tokens."), refreshTokenEnabled: z .boolean() .optional() .describe("Enable issuing refresh tokens."), refreshTokenExpiresInSeconds: z.coerce .number() .min(60) .optional() .describe("Refresh token lifetime in seconds."), }) .describe("Token issuance settings for authorization servers.") .strict()
ChainedAuthorizationServerConfigSchema
Type : unknown
Default value : z .object({ type: z .literal("chained") .describe("Use upstream OIDC as authorization source."), id: z.string().min(1).describe("Authorization server identifier."), upstream: UpstreamOidcConfigSchema.describe( "Upstream OIDC connection settings.", ), token: ChainedAsTokenConfigSchema.optional().describe( "Optional token issuance settings.", ), requireDPoP: z .boolean() .optional() .describe("Require DPoP proofs for token/credential requests."), label: z .string() .optional() .describe("Optional display label for UI selection."), enabled: z .boolean() .optional() .describe("Whether this authorization server entry is enabled."), }) .describe("Chained authorization server configuration.") .strict()
DisplayInfoSchema
Type : unknown
Default value : z .object({ name: z.string().optional().describe("Issuer display name."), locale: z .string() .optional() .describe("Locale tag for this display entry."), logo: DisplayLogoSchema.optional().describe( "Optional issuer logo metadata.", ), }) .describe("Localized issuer display metadata.") .catchall(z.unknown())
DisplayLogoSchema
Type : unknown
Default value : z .object({ uri: z.string().min(1).describe("Logo URI."), alt_text: z .string() .optional() .describe("Optional localized alternative text."), }) .describe("Display logo metadata.") .catchall(z.unknown())
ExternalAuthorizationServerConfigSchema
Type : unknown
Default value : z .object({ type: z .literal("external") .describe("Use an externally managed authorization server."), id: z.string().min(1).describe("Authorization server identifier."), issuer: z .url() .describe("Issuer URL for the external authorization server."), sessionBinding: z .object({ method: z .literal("access_token_claim") .describe( "Read the correlation value from a configured access-token claim.", ), claim: z .string() .min(1) .describe( "Claim name that contains the issuance-session correlation value.", ), }) .optional() .describe( "Explicit mapping from an external access-token claim to an existing issuance session.", ), label: z .string() .optional() .describe("Optional display label for UI selection."), enabled: z .boolean() .optional() .describe("Whether this authorization server entry is enabled."), }) .describe("External authorization server configuration.") .strict()
FederationConfigSchema
Type : unknown
Default value : z .object({ role: z .enum(["trust_anchor", "intermediate", "leaf"]) .optional() .describe("Federation role for this issuer."), mode: z .enum(["federation-only", "hybrid"]) .optional() .describe("Federation operation mode."), entityId: z .string() .optional() .describe("Optional local federation entity id."), enforceSigningPolicy: z .boolean() .optional() .describe("Enforce strict signing policy checks."), cacheTtlSeconds: z.coerce .number() .int() .min(1) .optional() .describe("Cache time-to-live for federation metadata in seconds."), trustAnchors: z .array(FederationTrustAnchorConfigSchema) .describe("Federation trust anchors."), }) .describe("OpenID Federation configuration.") .strict()
FederationTrustAnchorConfigSchema
Type : unknown
Default value : z .object({ entityId: z .string() .min(1) .describe("Federation trust anchor entity id."), entityConfigurationUri: z .url() .describe("Entity configuration URI for the trust anchor."), }) .describe("Trust anchor reference for OpenID Federation.") .strict()
IssuanceConfigSchema
Type : unknown
Default value : z .object({ batchSize: z.coerce .number() .int() .min(1) .optional() .describe("Optional issuance batch size."), dPopRequired: z .boolean() .optional() .describe("Require DPoP proofs for issuance endpoints."), walletAttestationRequired: z .boolean() .optional() .describe("Require wallet attestation in issuance flows."), walletProviderTrustLists: z .array(WalletProviderTrustListRefSchema) .optional() .describe("Optional wallet provider trust list references."), signingKeyId: z .string() .min(1) .optional() .describe("Default signing key chain id for credential issuance."), authorizationServers: z .array(ManagedAuthorizationServerSchema) .min(1) .describe("Configured authorization server entries."), federation: FederationConfigSchema.nullable() .optional() .describe("Optional OpenID Federation settings."), registrationCertificate: IssuerRegistrationCertificateConfigSchema.nullable() .optional() .describe("Optional registration certificate settings."), display: z .array(DisplayInfoSchema) .optional() .describe("Localized issuer metadata shown to wallets."), notificationEndpointEnabled: z .boolean() .optional() .describe( "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.", ), credentialResponseEncryption: z .boolean() .optional() .describe("Enable encrypted credential responses."), credentialRequestEncryption: z .boolean() .optional() .describe("Require encrypted credential requests."), txCodeMaxAttempts: z.coerce .number() .int() .min(1) .nullable() .optional() .describe( "Maximum verification attempts for transaction codes. Null resets to defaults.", ), }) .describe("Issuer issuance configuration.") .strict()
IssuerRegistrationCertificateConfigSchema
Type : unknown
Default value : z .object({ enabled: z .boolean() .optional() .describe("Enable issuer registration certificate support."), mode: z .enum(["import", "generate"]) .optional() .describe("How registration certificate data is provided."), jwt: z .string() .optional() .describe( "Optional registration certificate JWT when using import mode.", ), privacyPolicy: z .string() .optional() .describe("Optional privacy policy URI."), supportUri: z.string().optional().describe("Optional support URI."), }) .describe("Issuer registration certificate settings.") .strict()
ManagedAuthorizationServerSchema
Type : unknown
Default value : z .discriminatedUnion("type", [ ExternalAuthorizationServerConfigSchema, Oid4VpAuthorizationServerConfigSchema, ChainedAuthorizationServerConfigSchema, BuiltInAuthorizationServerConfigSchema, ]) .describe("Supported authorization server configurations.")
Oid4VpAuthorizationServerConfigSchema
Type : unknown
Default value : z .object({ type: z .literal("oid4vp") .describe("Use OID4VP-based authorization server chaining."), id: z.string().min(1).describe("Authorization server identifier."), presentationConfigId: z .string() .min(1) .describe( "Presentation configuration id used during authorization.", ), immediateWalletRedirect: z .boolean() .optional() .describe( "Redirect wallets immediately after authorization response creation.", ), token: ChainedAsTokenConfigSchema.optional().describe( "Optional token issuance settings.", ), requireDPoP: z .boolean() .optional() .describe("Require DPoP proofs for token/credential requests."), label: z .string() .optional() .describe("Optional display label for UI selection."), enabled: z .boolean() .optional() .describe("Whether this authorization server entry is enabled."), }) .describe("OID4VP authorization server configuration.") .strict()
UpstreamOidcConfigSchema
Type : unknown
Default value : z .object({ issuer: z.url().describe("Upstream OIDC issuer URL."), clientId: z .string() .min(1) .describe("Client id for upstream OIDC authentication."), clientSecret: z .string() .min(1) .optional() .describe( "Optional client secret for upstream OIDC authentication.", ), scopes: z .array(z.string().min(1)) .optional() .describe("Optional scopes requested from the upstream issuer."), }) .describe("OIDC upstream settings for chained authorization server mode.") .strict()
WalletProviderTrustListRefSchema
Type : unknown
Default value : z .object({ url: z.url().describe("URL of the wallet provider trust list."), verifierKey: z .record(z.string(), z.unknown()) .optional() .describe( "Optional verifier key material used for trust list verification.", ), verifierX509Der: z .string() .optional() .describe("Optional verifier certificate in DER/base64 form."), }) .describe("Wallet provider trust list reference.") .strict()

src/crypto/key/schemas/cert-editor-schema.bundle.ts

certEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "cert", schemas: [ defineEditorSchema({ name: "CertImportDto", schema: CertImportSchema, }), ], })

src/verifier/presentations/mdoc-context.ts

certificateIdentifiers
Type : unknown
Default value : async (cert: X509Certificate) => { const thumbprint = hex.encode( new Uint8Array(await cert.getThumbprint("SHA-256")), ); return { subject: cert.subject, issuer: cert.issuer, thumbprint, ski: extractExtensionKeyId(cert.getExtension("2.5.29.14") as any), aki: extractExtensionKeyId(cert.getExtension("2.5.29.35") as any), }; }
chainLinkDiagnostics
Type : unknown
Default value : async (chain: X509Certificate[]) => { const links = [] as Array<{ childIndex: number; parentIndex: number; childSubject: string; childAki?: string; parentSubject: string; parentSki?: string; keyIdMatches: boolean; issuerSubjectMatches: boolean; }>; for (let i = 0; i < chain.length - 1; i++) { const child = chain[i]; const parent = chain[i + 1]; const childAki = extractExtensionKeyId( child.getExtension("2.5.29.35") as any, ); const parentSki = extractExtensionKeyId( parent.getExtension("2.5.29.14") as any, ); links.push({ childIndex: i, parentIndex: i + 1, childSubject: child.subject, childAki, parentSubject: parent.subject, parentSki, keyIdMatches: childAki !== undefined && parentSki !== undefined && childAki === parentSki, issuerSubjectMatches: child.issuer === parent.subject, }); } return links; }
configuredLogLevel
Type : unknown
Default value : ( process.env.LOG_LEVEL ?? (process.env.NODE_ENV === "production" ? "warn" : "debug") ).toLowerCase()
extractExtensionKeyId
Type : unknown
Default value : ( extension: { keyId?: string } | undefined, ): string | undefined => { const keyId = extension?.keyId; return typeof keyId === "string" && keyId.length > 0 ? keyId.toLowerCase() : undefined; }
mdocContext
Type : MdocContext
Default value : { fetch, crypto: { digest: async ({ digestAlgorithm, bytes }) => { const digest = await webCrypto.subtle.digest( digestAlgorithm, toBuffer(bytes), ); return new Uint8Array(digest); }, random: (length: number) => { return webCrypto.getRandomValues(new Uint8Array(length)); }, hdkf: async (input) => { const { digestAlgorithm: da, salt, info, publicKey, privateKey, } = input; const ikm = p256 .getSharedSecret(privateKey, publicKey, true) .slice(1); let digestAlgorithm: "sha256" | "sha384" | "sha512" = "sha256"; if (da === "SHA-384") { digestAlgorithm = "sha384"; } else if (da === "SHA-512") { digestAlgorithm = "sha512"; } return hkdf(digestAlgorithm, ikm, salt, info, 32); }, }, cose: { mac0: { authenticate: async (input) => { const { key, toBeAuthenticated } = input; const keyBytes = key instanceof CoseKey ? key.privateKey : key; return hmac(sha256, keyBytes, toBeAuthenticated); }, verify: async (input) => { const { tag, toBeAuthenticated, key } = input; const keyBytes = key instanceof CoseKey ? key.privateKey : key; const expectedTag = hmac(sha256, keyBytes, toBeAuthenticated); if (tag.length !== expectedTag.length) { return false; } return timingSafeEqual(tag, expectedTag); }, }, sign1: { sign: async (input) => { const { key, toBeSigned } = input; return p256.sign(toBeSigned, key.privateKey, { format: "compact", }); }, verify: async (input) => { const { signature, key, toBeVerified } = input; // lowS is needed after upgrade of @noble/curves to keep existing tests passing return p256.verify(signature, toBeVerified, key.publicKey, { lowS: false, }); }, }, }, x509: { getIssuerNameField: (input: { certificate: Uint8Array; field: string; }) => { const certificate = new X509Certificate( toBuffer(input.certificate), ); return certificate.issuerName.getField(input.field); }, getPublicKey: async (input: { certificate: Uint8Array; algorithm?: NonNullable< Parameters<typeof coseKeyToJwkClaim.algorithm>[0] >; }) => { const certificate = new X509Certificate( toBuffer(input.certificate), ); const alg = input.algorithm ? coseKeyToJwkClaim.algorithm(input.algorithm) : "ES256"; const key = await importX509(certificate.toString(), alg, { extractable: true, }); return CoseKey.fromJwk( (await exportJWK(key)) as unknown as Record<string, unknown>, ); }, verifyCertificateChain: async (input: { trustedCertificates: Array<Uint8Array>; x5chain: Array<Uint8Array>; now?: Date; }) => { const { trustedCertificates, x5chain: certificateChain, now, } = input; if (certificateChain.length === 0) { throw new Error("Certificate chain is empty"); } const parsedLeafCertificate = new x509.X509Certificate( toBuffer(certificateChain[0]), ); const certificatesToBuildChain = toX509Certificates([ ...certificateChain, ...(trustedCertificates ?? []), ]); const certificateChainBuilder = new x509.X509ChainBuilder({ certificates: certificatesToBuildChain, }); const chain = await certificateChainBuilder.build( parsedLeafCertificate, ); // x5c is leaf-first, but chain builder returns root-first. let parsedChain = chain.reverse(); if (parsedChain.length < certificateChain.length) { throw new Error( "Could not parse the full chain. Likely due to incorrect ordering", ); } const trimmed = await trimChainToTrustedAnchor( parsedChain, trustedCertificates, ); parsedChain = trimmed.parsedChain; await verifyChainSignatures( parsedChain, trustedCertificates, now, trimmed.previousCertificate, ); if (X509_CHAIN_TRACE) { const [chainDiagnostics, links] = await Promise.all([ Promise.all( parsedChain.map((cert) => certificateIdentifiers(cert)), ), chainLinkDiagnostics(parsedChain), ]); console.debug( "mdocContext.x509.verifyCertificateChain diagnostics", JSON.stringify({ chainDiagnostics, links }), ); } return { chain: parsedChain.map((cert) => new Uint8Array(cert.rawData)), }; }, getCertificateData: async (input: { certificate: Uint8Array }) => { const certificate = new X509Certificate( toBuffer(input.certificate), ); const thumbprint = await certificate.getThumbprint(); const thumbprintHex = hex.encode(new Uint8Array(thumbprint)); return { issuerName: certificate.issuerName.toString(), subjectName: certificate.subjectName.toString(), pem: certificate.toString(), serialNumber: certificate.serialNumber, thumbprint: thumbprintHex, notBefore: certificate.notBefore, notAfter: certificate.notAfter, }; }, }, }
toX509Certificates
Type : unknown
Default value : (certificates: Uint8Array[]) => certificates.map( (certificate) => new x509.X509Certificate(toBuffer(certificate)), )
trimChainToTrustedAnchor
Type : unknown
Default value : async ( parsedChain: X509Certificate[], trustedCertificates: Uint8Array[] | undefined, ): Promise<{ parsedChain: X509Certificate[]; previousCertificate: X509Certificate | undefined; }> => { if (!trustedCertificates) { return { parsedChain, previousCertificate: undefined, }; } const parsedTrustedCertificates = trustedCertificates.map( (trustedCertificate) => new X509Certificate(toBuffer(trustedCertificate)), ); const trustedCertificateIndex = parsedChain.findIndex((cert) => parsedTrustedCertificates.some((trustedCert) => cert.equal(trustedCert), ), ); if (trustedCertificateIndex === -1) { if (X509_CHAIN_DEBUG) { const [chainDiagnostics, trustedDiagnostics] = await Promise.all([ Promise.all( parsedChain.map((cert) => certificateIdentifiers(cert)), ), Promise.all( parsedTrustedCertificates.map((cert) => certificateIdentifiers(cert), ), ), ]); throw new Error( `No trusted certificate was found while validating the X.509 chain. chain=${JSON.stringify(chainDiagnostics)} trusted=${JSON.stringify(trustedDiagnostics)}`, ); } throw new Error( "No trusted certificate was found while validating the X.509 chain", ); } if (trustedCertificateIndex > 0) { return { parsedChain: parsedChain.slice(trustedCertificateIndex), previousCertificate: parsedChain[trustedCertificateIndex - 1], }; } return { parsedChain, previousCertificate: undefined, }; }
verifyChainSignatures
Type : unknown
Default value : async ( parsedChain: X509Certificate[], trustedCertificates: Uint8Array[] | undefined, now: Date | undefined, startingPreviousCertificate: X509Certificate | undefined, ) => { let previousCertificate = startingPreviousCertificate; for (let i = 0; i < parsedChain.length; i++) { const cert = parsedChain[i]; const publicKey = previousCertificate?.publicKey; const skipSignatureVerification = i === 0 && Boolean(trustedCertificates) && !publicKey; if (!skipSignatureVerification) { try { await cert.verify({ publicKey, date: now ?? new Date(), }); } catch (error: any) { const [currentCert, previousCert, links] = await Promise.all([ certificateIdentifiers(cert), previousCertificate ? certificateIdentifiers(previousCertificate) : Promise.resolve(undefined), chainLinkDiagnostics(parsedChain), ]); throw new Error( `X.509 chain verification failed at index=${i}. current=${JSON.stringify(currentCert)} previous=${JSON.stringify(previousCert)} links=${JSON.stringify(links)} cause=${error?.message ?? error}`, ); } } previousCertificate = cert; } }
webCrypto
Type : unknown
Default value : globalThis.crypto
X509_CHAIN_DEBUG
Type : unknown
Default value : X509_CHAIN_TRACE || configuredLogLevel === "debug"
X509_CHAIN_TRACE
Type : unknown
Default value : configuredLogLevel === "trace"

src/crypto/key/schemas/cert.schema.ts

CertImportSchema
Type : unknown
Default value : z .object({ id: z .string() .min(1) .optional() .describe( "Optional certificate id. If omitted, one may be generated.", ), keyId: z .string() .min(1) .optional() .describe( "Optional key chain id associated with this certificate chain.", ), description: z .string() .optional() .describe("Optional certificate description."), crt: z .array(z.string().min(1)) .min(1) .describe( "Certificate chain entries, typically PEM-encoded certificates.", ), }) .describe("Payload for importing certificate chains.") .strict()

src/issuer/configuration/issuance/dto/chained-as-config.dto.ts

ChainedAsConfigSchema
Type : unknown
Default value : z .object({ enabled: z.boolean(), upstream: UpstreamOidcConfigSchema.optional(), vp: ChainedAsVpConfigSchema.optional(), token: ChainedAsTokenConfigSchema.optional(), requireDPoP: z.boolean().optional(), }) .strict()
ChainedAsTokenConfigSchema
Type : unknown
Default value : z .object({ lifetimeSeconds: z.number().min(60).optional(), signingKeyId: z.string().optional(), refreshTokenEnabled: z.boolean().optional(), refreshTokenExpiresInSeconds: z.number().min(60).optional(), }) .strict()
ChainedAsVpConfigSchema
Type : unknown
Default value : z .object({ enabled: z.boolean(), presentationConfigId: z.string(), }) .strict()
UpstreamOidcConfigSchema
Type : unknown
Default value : z .object({ issuer: z.string(), clientId: z.string(), clientSecret: z.string().optional(), scopes: z.array(z.string()).optional(), }) .strict()

src/issuer/configuration/credentials/dto/claim-field-definition.dto.ts

ClaimFieldDefinitionSchema
Type : z.ZodType<any>
Default value : z.lazy(() => z .object({ path: z.array(z.union([z.string(), z.number(), z.null()])), type: z.enum([ "string", "number", "integer", "boolean", "object", "array", ]), defaultValue: z.unknown().optional(), mandatory: z.boolean().optional(), disclosable: z.boolean().optional(), namespace: z.string().optional(), display: z.array(FieldDisplaySchema).optional(), constraints: z.record(z.string(), z.unknown()).optional(), children: z.array(ClaimFieldDefinitionSchema).optional(), }) .strict(), )
FieldDisplaySchema
Type : unknown
Default value : z .object({ locale: z.string(), name: z.string(), description: z.string().optional(), }) .strict()

src/verifier/presentations/schemas/presentation-config.schema.ts

ClaimsQuerySchema
Type : unknown
Default value : z .object({ id: z.string().optional().describe("Optional claim query id."), path: z .array(z.union([z.string(), z.number()])) .describe("Path to the claim value in presented credentials."), values: z .array(z.string()) .optional() .describe("Optional allowed values for the claim."), }) .describe("Claim query constraint.") .strict()
CredentialIdSchema
Type : unknown
Default value : z .string() .min(1) .regex(/^[A-Za-z0-9_-]+$/, { message: "Credential id must contain only alphanumeric, underscore (_), or hyphen (-) characters", })
CredentialQueryBaseSchema
Type : unknown
Default value : z .object({ id: CredentialIdSchema.describe("Credential query identifier."), multiple: z .boolean() .optional() .describe("Allow multiple matching credentials."), claim_sets: z .array(z.array(z.string())) .optional() .describe("Optional claim set constraints."), trusted_authorities: z .array( z.discriminatedUnion("type", [ TrustedAuthorityQueryEtsiTlSchema, TrustedAuthorityQueryOpenIdFederationSchema, ]), ) .optional() .describe("Optional trusted authority constraints."), }) .describe("Base credential query structure.") .strict()
CredentialQueryDcSdJwtSchema
Type : unknown
Default value : CredentialQueryBaseSchema.extend({ format: z.literal("dc+sd-jwt").describe("Credential format discriminator."), meta: z .object({ vct_values: z .array(z.string()) .min(1) .describe("Accepted VCT values."), }) .describe("Format-specific metadata for dc+sd-jwt queries.") .strict(), claims: z .array(ClaimsQuerySchema) .optional() .describe("Optional claim-level constraints."), }) .strict() .superRefine((credential, ctx) => validateClaimSets(credential, ctx))
CredentialQueryMsoMdocSchema
Type : unknown
Default value : CredentialQueryBaseSchema.extend({ format: z.literal("mso_mdoc").describe("Credential format discriminator."), meta: z .object({ doctype_value: z .string() .min(1) .describe("Expected mDoc doctype value."), }) .describe("Format-specific metadata for mso_mdoc queries.") .strict(), claims: z .array(MsoMdocClaimsQuerySchema) .optional() .describe("Optional mDoc claim-level constraints."), }) .strict() .superRefine((credential, ctx) => validateClaimSets(credential, ctx))
CredentialSetQuerySchema
Type : unknown
Default value : z .object({ options: z .array(z.array(z.string()).min(1)) .min(1) .describe("Alternative credential query id combinations."), required: z .boolean() .optional() .describe("Whether this credential set is mandatory."), }) .describe("Credential set query constraints.") .strict()
DCQLSchema
Type : unknown
Default value : z .object({ credentials: z .array( z.discriminatedUnion("format", [ CredentialQueryDcSdJwtSchema, CredentialQueryMsoMdocSchema, ]), ) .min(1) .describe("Credential queries requested by the verifier."), credential_sets: z .array(CredentialSetQuerySchema) .optional() .describe("Optional higher-level credential set requirements."), }) .describe("Digital Credential Query Language payload.") .strict() .superRefine((dcql, ctx) => { const seen = new Map<string, number>(); dcql.credentials.forEach((credential, index) => { const firstIndex = seen.get(credential.id); if (firstIndex !== undefined) { ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["credentials", index, "id"], message: `Duplicate credential id '${credential.id}' already used at credentials[${firstIndex}]`, }); return; } seen.set(credential.id, index); }); })
MsoMdocClaimsQuerySchema
Type : unknown
Default value : ClaimsQuerySchema.extend({ intent_to_retain: z .boolean() .optional() .describe("Whether relying party intends to retain the claim."), }).strict()
PresentationAttachmentSchema
Type : unknown
Default value : z .object({ format: z.string().describe("Attachment format identifier."), data: z.unknown().describe("Attachment payload."), credential_ids: z .array(z.string()) .optional() .describe( "Optional credential query ids bound to this attachment.", ), }) .describe("Additional presentation attachment.") .strict()
PresentationConfigCreateSchema
Type : unknown
Default value : z .object({ id: z .string() .min(1) .describe("Presentation configuration identifier."), description: z .string() .nullable() .optional() .describe("Optional presentation configuration description."), lifeTime: z.coerce .number() .int() .min(1) .optional() .describe("Presentation request lifetime in seconds."), skewSeconds: z.coerce .number() .int() .min(0) .optional() .describe("Clock skew tolerance in seconds."), statusCheckMode: z .enum(["strict", "best_effort", "disabled"]) .optional() .describe("Revocation/status check mode."), dcql_query: DCQLSchema.describe( "DCQL query defining requested credentials and claims.", ), transaction_data: z .array(TransactionDataSchema) .optional() .describe("Optional transaction data descriptors."), registration_cert: RegistrationCertificateRequestSchema.nullable() .optional() .describe("Optional registration certificate request settings."), webhookEndpointId: z .string() .nullable() .optional() .describe( "Optional webhook endpoint id for presentation callbacks.", ), attached: z .array(PresentationAttachmentSchema) .nullable() .optional() .describe( "Optional attachments included with presentation requests.", ), redirectUri: z .string() .nullable() .optional() .describe("Optional redirect URI after presentation completion."), accessKeyChainId: z .string() .nullable() .optional() .describe( "Optional key chain id for access token/auth operations.", ), readerAuth: z .boolean() .nullable() .optional() .describe( "Whether reader authentication is required for mDoc requests.", ), }) .describe("Payload for creating presentation verifier configuration.") .strict()
PresentationConfigUpdateSchema
Type : unknown
Default value : PresentationConfigCreateSchema.partial() .describe("Payload for updating presentation verifier configuration.") .strict()
TenantUrlPlaceholderSchema
Type : unknown
Default value : z .string() .regex(/^<TENANT_URL>(?:\/.*)?$/, "expected a URL")
TransactionDataSchema
Type : unknown
Default value : z .object({ type: z.string().describe("Transaction data type identifier."), credential_ids: z .array(z.string()) .describe("Credential query ids this transaction data applies to."), }) .describe("Transaction data request descriptor.") .catchall(z.unknown())
TrustedAuthorityQueryEtsiTlSchema
Type : unknown
Default value : z .object({ type: z .literal("etsi_tl") .describe( "Trusted authority type discriminator for ETSI trust lists.", ), values: z .array(TrustListRefSchema) .describe("Trust list references for ETSI TL verification."), }) .describe("ETSI trusted authority query.") .strict()
TrustedAuthorityQueryOpenIdFederationSchema
Type : unknown
Default value : z .object({ type: z .literal("openid_federation") .describe( "Trusted authority type discriminator for OpenID Federation.", ), values: z .array(z.string()) .describe("OpenID Federation authority identifiers."), }) .describe("OpenID Federation trusted authority query.") .strict()
TrustListRefSchema
Type : unknown
Default value : z .object({ trustListId: z .string() .optional() .describe("Optional trust list id reference."), url: TrustListUrlSchema.optional().describe( "Optional trust list URL reference.", ), verifierKey: z .record(z.string(), z.unknown()) .optional() .describe("Optional verifier key material."), verifierX509Der: z .string() .optional() .describe("Optional verifier certificate in DER/base64 form."), }) .describe("Reference to a trust list used for authority verification.") .strict()
TrustListUrlSchema
Type : unknown
Default value : z.union([z.url(), TenantUrlPlaceholderSchema])

src/auth/dto/client-credentials.schema.ts

ClientCredentialsSchema
Type : unknown
Default value : z.strictObject({ grant_type: z.string().trim().min(1).optional(), client_id: z.string().trim().min(1).optional(), client_secret: z.string().trim().min(1).optional(), })

src/auth/client/schemas/client-editor-schema.bundle.ts

clientEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "client", schemas: [ defineEditorSchema({ name: "CreateClientDto", schema: CreateClientSchema, }), defineEditorSchema({ name: "UpdateClientDto", schema: UpdateClientSchema, }), ], })

src/auth/client/schemas/client.schema.ts

clientIdSchema
Type : unknown
Default value : z .string() .trim() .min(1) .regex( /^[A-Za-z0-9._:-]+$/, "Client ID must contain only letters, numbers, and . _ : -", ) .describe("Unique client identifier.")
CreateClientSchema
Type : unknown
Default value : z .object({ clientId: clientIdSchema, secret: z .string() .min(1) .optional() .describe("Optional client secret for confidential clients."), description: z .string() .min(1) .optional() .describe("Optional human-readable client description."), roles: rolesSchema, allowedPresentationConfigs: z .array(z.string().min(1)) .nullable() .optional() .describe( "Optional allow-list of presentation config ids this client can use.", ), allowedIssuanceConfigs: z .array(z.string().min(1)) .nullable() .optional() .describe( "Optional allow-list of issuance config ids this client can use.", ), }) .describe("Payload for creating a client configuration.") .strict()
rolesSchema
Type : unknown
Default value : z .array(z.enum(Role)) .min(1) .describe("Roles assigned to the client. At least one role is required.")
UpdateClientSchema
Type : unknown
Default value : z .object({ description: z .string() .min(1) .optional() .describe("Optional updated description."), roles: rolesSchema .optional() .describe("Optional replacement roles for the client."), allowedPresentationConfigs: z .array(z.string().min(1)) .nullable() .optional() .describe( "Optional replacement allow-list of presentation config ids.", ), allowedIssuanceConfigs: z .array(z.string().min(1)) .nullable() .optional() .describe( "Optional replacement allow-list of issuance config ids.", ), }) .describe("Payload for partially updating a client configuration.") .strict()

src/auth/client/client.provider.ts

CLIENTS_PROVIDER
Type : string
Default value : "CLIENTS_PROVIDER"

src/issuer/issuance/oid4vci/dto/complete-deferred.dto.ts

CompleteDeferredSchema
Type : unknown
Default value : z .object({ claims: z.record(z.string(), z.unknown()), }) .strict()
FailDeferredSchema
Type : unknown
Default value : z .object({ error: z.string().optional(), }) .strict()

src/platform/config-portability/config-resource.types.ts

CONFIG_RESOURCE_KINDS
Type : unknown
Default value : [ "Tenant", "Client", "KmsConfig", "KeyChain", "RegistrarConfig", "IssuanceConfig", "CredentialConfig", "PresentationConfig", "AttributeProvider", "WebhookEndpoint", "TrustList", "StatusList", ] as const

src/platform/config/config-validation.schema.ts

CONFIG_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ CONFIG_IMPORT_MODE: Joi.string() .valid("disabled", "create", "upsert", "replace") .description( "Startup configuration reconciliation mode. Replaces CONFIG_IMPORT and CONFIG_IMPORT_FORCE.", ) .meta({ group: "config", order: 10 }), CONFIG_IMPORT: Joi.boolean() .default(false) .description( "Deprecated: enable startup config import when CONFIG_IMPORT_MODE is unset", ) .meta({ group: "config", order: 20 }), CONFIG_IMPORT_FORCE: Joi.boolean() .default(false) .description( "Deprecated: select upsert instead of create when CONFIG_IMPORT_MODE is unset", ) .meta({ group: "config", order: 30 }), CONFIG_FOLDER: Joi.string() .default(resolve(__dirname + "/../../../../assets/config")) .description("Path to config import folder") .meta({ group: "config", order: 40 }), CONFIG_VARIABLE_STRICT: Joi.alternatives() .try(Joi.string().valid("abort", "skip", "ignore"), Joi.boolean()) .default("skip") .description("Strict mode for config import.") .meta({ group: "config", order: 50 }), })

Validation schema for configuration

src/shared/utils/media-type/media-type.decorator.ts

ContentType
Type : unknown
Default value : createParamDecorator( (data: unknown, ctx: ExecutionContext) => { const request = ctx.switchToHttp().getRequest(); return request.headers["accept"] as string | undefined; }, )

Decorator to extract the content type from the request headers. This decorator can be used to determine the media type of the request.

src/registrar/schemas/registrar.schema.ts

CreateAccessCertificateSchema
Type : unknown
Default value : z .object({ keyId: z .string() .min(1) .describe("Key chain id used to issue the access certificate."), }) .describe("Payload for creating an access certificate.") .strict()
CreateRegistrarConfigSchema
Type : unknown
Default value : z .object({ registrarUrl: z.url().describe("Base URL of the registrar service."), oidcUrl: z .url() .describe("OIDC discovery or issuer URL used for authentication."), clientId: z .string() .min(1) .describe("OAuth client ID used against the registrar."), clientSecret: z .string() .min(1) .optional() .describe( "Optional OAuth client secret for registrar authentication.", ), username: z .string() .min(1) .describe("Username used for registrar authentication."), password: z .string() .min(1) .describe("Password used for registrar authentication."), registrationCertificateDefaults: RegistrationCertificateDefaultsSchema.describe( "Optional default registration certificate values.", ), }) .describe("Payload for creating registrar integration settings.") .strict()
RegistrationCertificateDefaultsSchema
Type : unknown
Default value : z .record(z.string(), z.unknown()) .nullable() .optional() .describe( "Optional default values used when generating registration certificates.", )
UpdateRegistrarConfigSchema
Type : unknown
Default value : CreateRegistrarConfigSchema.partial() .describe("Payload for partially updating registrar integration settings.") .strict()

src/platform/observability/logger.factory.ts

createLoggerOptions
Type : unknown
Default value : (configService: ConfigService) => { // Disable pino-http's autoLogging - we handle HTTP logging explicitly const enableHttpLogger = configService.getOrThrow<boolean>( "LOG_ENABLE_HTTP_LOGGER", ); // Opt-in response body capture. Disabled by default because response bodies // can contain access tokens, credentials, and other secrets. const captureResponseBody = configService.getOrThrow<boolean>( "LOG_HTTP_RESPONSE_BODY", ); // Check if file logging is enabled const logToFile = configService.getOrThrow<boolean>("LOG_TO_FILE"); const logFilePath = configService.getOrThrow<string>("LOG_FILE_PATH"); const logHttpResponseBodyMaxLength = configService.getOrThrow<number>( "LOG_HTTP_RESPONSE_BODY_MAX_LENGTH", ); const redactSensitiveData = configService.getOrThrow<boolean>( "LOG_REDACT_SENSITIVE_DATA", ); const maxLoggedResponseBodyLength = logHttpResponseBodyMaxLength > 0 ? logHttpResponseBodyMaxLength : undefined; // Check if OTel is disabled const otelDisabled = configService.getOrThrow<boolean>("OTEL_SDK_DISABLED"); const logLevel = configService.getOrThrow("LOG_LEVEL"); // Build transport targets array const targets: any[] = [ // Console pretty logging (always enabled) { target: "pino-pretty", level: logLevel, options: { colorize: true, singleLine: false, translateTime: "yyyy-mm-dd HH:MM:ss", ignore: "pid,hostname,req,res,responseTime,context", messageFormat: "{if context}[{context}] {end}{msg}", }, }, ]; // Optional: File logging if (logToFile && logFilePath) { targets.push({ target: "pino/file", level: logLevel, options: { destination: logFilePath, mkdir: true, sync: true, // Use synchronous writes to ensure message order }, }); } // Optional: OpenTelemetry transport (sends logs to OTel Collector → Loki) // This is how pino logs get trace correlation and appear in Grafana/Loki if (!otelDisabled) { targets.push({ target: "pino-opentelemetry-transport", level: logLevel, options: { // Resource attributes must be explicitly passed to the transport // (it doesn't inherit from the OTel SDK automatically) resourceAttributes: { "service.name": configService.get("OTEL_SERVICE_NAME") || "eudiplo-backend", "service.version": configService.get("VERSION") || "unknown", }, }, }); } const redact = redactSensitiveData ? { paths: [ "req.headers.authorization", "req.headers.cookie", "req.headers.dpop", 'req.headers["oauth-client-attestation"]', 'req.headers["oauth-client-attestation-pop"]', 'res.headers["set-cookie"]', "res.body.access_token", "res.body.refresh_token", "res.body.id_token", "res.body.c_nonce", "res.body.credential", "res.body.credentials", "res.body.attestation_challenge", ], censor: "[redacted]", } : undefined; return { pinoHttp: { level: logLevel, autoLogging: { ignore: (req: IncomingMessage) => { if (!enableHttpLogger) { return true; } // Parse the pathname so query strings and substrings like // "/foo/api-docs" don't accidentally match. const pathname = new URL(req.url ?? "", "http://localhost") .pathname; return ( pathname.startsWith("/api") || pathname === "/health" || pathname === "/metrics" ); }, }, // Redact sensitive request/response fields unless explicitly disabled. redact, transport: { targets, }, // Put request/response essentials directly into `msg` so they // remain visible after pino-pretty ignores nested req/res fields. customReceivedMessage: (req: IncomingMessage) => `--> ${req.method} ${req.url}`, customSuccessMessage: ( req: IncomingMessage, res: { statusCode: number }, responseTime: number, ) => `<-- ${req.method} ${req.url} ${res.statusCode} ${Math.round(responseTime)}ms`, customErrorMessage: ( req: IncomingMessage, res: { statusCode: number }, err: Error, ) => `<-- ${req.method} ${req.url} ${res.statusCode} ${err.message}`, formatters: { log: (object: any) => { object.hostname = undefined; return object; }, }, customProps: (req: any, res: any) => { if (captureResponseBody) { attachResponseBodyCapture( req, res, maxLoggedResponseBodyLength, ); } return { sessionId: req.params?.session, }; }, serializers: { req: (req: SerializedRequest) => ({ method: req.method, url: req.url, headers: { "user-agent": req.headers["user-agent"], "content-type": req.headers["content-type"], }, sessionId: req.params?.session, tenantId: req.params?.tenantId, }), res: (res: SerializedResponse & { raw?: any }) => { return { statusCode: res.statusCode, body: captureResponseBody ? res.raw?.__eudiploLoggedResponseBody : undefined, }; }, }, }, forRoutes: ["*splat"], } as Params; }

Factory function for configuring the logger module

Logging targets:

  • Console: pino-pretty for human-readable output
  • File: JSON logs (optional, via LOG_TO_FILE)
  • OpenTelemetry: pino-opentelemetry-transport sends logs to OTel Collector

Trace correlation:

src/issuer/status-list/dto/status-list.schema.ts

CreateStatusListSchema
Type : unknown
Default value : z .object({ credentialConfigurationId: z .string() .min(1) .optional() .describe("Optional credential configuration binding."), keyChainId: z .string() .min(1) .optional() .describe("Optional key chain to sign the list with."), bits: z .union([z.literal(1), z.literal(2), z.literal(4), z.literal(8)]) .optional() .describe("Optional bits-per-status value."), capacity: z.coerce .number() .int() .min(1000) .optional() .describe("Optional status list capacity."), }) .describe("Payload for creating a status list.") .strict()
StatusListImportSchema
Type : unknown
Default value : z .object({ id: z.string().min(1).describe("Status list identifier."), credentialConfigurationId: z .string() .min(1) .nullable() .optional() .describe( "Optional credential configuration binding. Null means shared list.", ), keyChainId: z .string() .min(1) .optional() .describe("Optional key chain used for signing this status list."), capacity: z.coerce .number() .int() .min(100) .optional() .describe("Optional list capacity override."), bits: z .union([z.literal(1), z.literal(2), z.literal(4), z.literal(8)]) .optional() .describe("Optional bits-per-status override."), }) .describe("Payload for importing status lists from JSON config files.") .strict()
UpdateStatusListConfigSchema
Type : unknown
Default value : z .object({ capacity: z.coerce .number() .int() .min(100) .nullable() .optional() .describe("Capacity override. Set null to reset to defaults."), bits: z .union([z.literal(1), z.literal(2), z.literal(4), z.literal(8)]) .nullable() .optional() .describe( "Bits-per-status override. Set null to reset to defaults.", ), ttl: z.coerce .number() .int() .min(60) .nullable() .optional() .describe("JWT TTL override in seconds. Set null to reset."), immediateUpdate: z .boolean() .nullable() .optional() .describe("Immediate regeneration toggle. Set null to reset."), enableAggregation: z .boolean() .nullable() .optional() .describe("Aggregation URI toggle. Set null to reset."), }) .describe("Payload for updating tenant status list configuration defaults.") .strict()
UpdateStatusListSchema
Type : unknown
Default value : z .object({ credentialConfigurationId: z .string() .min(1) .nullable() .optional() .describe( "Updated credential configuration binding. Null means shared list.", ), keyChainId: z .string() .min(1) .nullable() .optional() .describe("Updated key chain id. Null means use tenant default."), }) .describe("Payload for updating status list bindings.") .strict()

src/auth/tenant/schemas/create-tenant.schema.ts

CreateTenantSchema
Type : unknown
Default value : z .strictObject({ id: NonBlankStringSchema.describe("Unique tenant identifier."), name: NonBlankStringSchema.default("EUDIPLO").describe( "Display name of the tenant.", ), description: NonBlankStringSchema.optional().describe( "Optional tenant description.", ), roles: z .array(RoleSchema) .optional() .describe("Optional default role assignments for the tenant."), sessionConfig: SessionStorageConfigSchema.optional().describe( "Optional tenant-specific session storage configuration.", ), statusListConfig: StatusListConfigSchema.optional().describe( "Optional tenant-specific status list defaults.", ), }) .describe("Payload for creating a tenant.")
ImportTenantSchema
Type : unknown
Default value : CreateTenantSchema.pick({ name: true, description: true, sessionConfig: true, statusListConfig: true, }).describe("Payload used when importing tenant metadata from config files.")
NonBlankStringSchema
Type : unknown
Default value : z.string().trim().min(1)
RoleSchema
Type : unknown
Default value : z.enum( allRoles as [(typeof allRoles)[number], ...(typeof allRoles)[number][]], )
UpdateTenantSchema
Type : unknown
Default value : z .strictObject({ name: NonBlankStringSchema.optional().describe( "Display name of the tenant.", ), description: NonBlankStringSchema.nullable() .optional() .describe( "Tenant description. Omit to keep the current value or set to null to remove it.", ), sessionConfig: SessionStorageConfigSchema.optional().describe( "Optional tenant-specific session storage configuration.", ), statusListConfig: StatusListConfigSchema.optional().describe( "Optional tenant-specific status list defaults.", ), }) .describe("Payload for partially updating tenant metadata.")

src/auth/user/schemas/create-user.schema.ts

CreateUserSchema
Type : unknown
Default value : z.strictObject({ username: z.string().trim().min(1), email: z.string().trim().email().optional(), roles: z.array(RoleSchema), enabled: z.boolean().optional(), })
RoleSchema
Type : unknown
Default value : z.enum( allRoles as [(typeof allRoles)[number], ...(typeof allRoles)[number][]], )
UpdateUserSchema
Type : unknown
Default value : CreateUserSchema.partial().extend({ password: z.string().min(8).optional(), })

src/issuer/configuration/webhook-endpoint/schemas/webhook-endpoint.schema.ts

CreateWebhookEndpointSchema
Type : unknown
Default value : z .object({ id: z.string().min(1).describe("Unique webhook endpoint identifier."), name: z .string() .min(1) .describe("Display name of the webhook endpoint."), description: z .string() .min(1) .optional() .nullable() .describe("Optional webhook endpoint description."), url: z.url().describe("Destination URL for webhook delivery."), auth: WebhookAuthSchema.describe( "Authentication configuration applied to outgoing webhook requests.", ), }) .describe("Payload for creating a webhook endpoint configuration.") .strict()
UpdateWebhookEndpointSchema
Type : unknown
Default value : CreateWebhookEndpointSchema.partial() .describe( "Payload for partially updating a webhook endpoint configuration.", ) .strict()
WebhookAuthApiKeySchema
Type : unknown
Default value : z .object({ type: z .literal("apiKey") .describe("Use API key authentication for webhook requests."), config: z .object({ headerName: z .string() .min(1) .describe("HTTP header name for the API key."), value: z .string() .min(1) .describe("API key value sent with webhook requests."), }) .describe("API key webhook authentication settings."), }) .describe("API key webhook authentication variant.")
WebhookAuthNoneSchema
Type : unknown
Default value : z .object({ type: z.literal("none").describe("Disable webhook authentication."), }) .describe("No webhook authentication variant.")
WebhookAuthSchema
Type : unknown
Default value : z .discriminatedUnion("type", [ WebhookAuthNoneSchema, WebhookAuthApiKeySchema, ]) .describe("Authentication strategy for webhook delivery.")

src/issuer/configuration/credentials/schemas/credential-editor-schema.bundle.ts

credentialEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "credential", schemas: [ defineEditorSchema({ name: "EmbeddedDisclosurePolicy", schema: EmbeddedDisclosurePolicySchema, }), defineEditorSchema({ name: "VCT", schema: VctSchema, }), defineEditorSchema({ name: "CredentialConfigCreate", schema: CredentialConfigCreateSchema, }), ], })

src/verifier/iso18013/cbor-request.ts

CRV_P256
Type : number
Default value : 1
KTY_EC
Type : number
Default value : 2

src/crypto/key/crypto-implementation/crypto-validation.schema.ts

CRYPTO_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ CRYPTO_ALG: Joi.string() .valid("ES256") .default("ES256") .description("The signing algorithm to use") .meta({ group: "crypto", order: 10 }), CRYPTO_TOLERANCE: Joi.number() .default(5) .description("Clock tolerance in seconds for JWT verification") .meta({ group: "crypto", order: 20 }), })

src/database/database-validation.schema.ts

DB_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ DB_TYPE: Joi.string() .valid("sqlite", "postgres") .default("sqlite") .description("Database type") .meta({ group: "database", order: 10 }), DB_HOST: Joi.string() .when("DB_TYPE", { is: "sqlite", then: Joi.optional().allow(""), otherwise: Joi.required(), }) .description("Database host") .meta({ group: "database", order: 15 }), DB_PORT: Joi.number() .when("DB_TYPE", { is: "sqlite", then: Joi.optional().allow(""), otherwise: Joi.required(), }) .description("Database port") .meta({ group: "database", order: 20 }), DB_USERNAME: Joi.string() .when("DB_TYPE", { is: "sqlite", then: Joi.optional().allow(""), otherwise: Joi.required(), }) .description("Database username") .meta({ group: "database", order: 30 }), DB_PASSWORD: Joi.string() .when("DB_TYPE", { is: "sqlite", then: Joi.optional().allow(""), otherwise: Joi.required(), }) .description("Database password") .meta({ group: "database", order: 40 }), DB_DATABASE: Joi.string() .when("DB_TYPE", { is: "sqlite", then: Joi.optional().allow(""), otherwise: Joi.required(), }) .description("Database name") .meta({ group: "database", order: 50 }), DB_SSL: Joi.boolean() .default(false) .description("Enable SSL/TLS for PostgreSQL database connections") .meta({ group: "database", order: 55 }), DB_SSL_REJECT_UNAUTHORIZED: Joi.boolean() .default(true) .description( "Reject PostgreSQL TLS certificates that cannot be validated against trusted CAs", ) .meta({ group: "database", order: 56 }), DB_SSL_CA_PATH: Joi.string() .optional() .allow("") .description( "Path to CA certificate file used to validate PostgreSQL TLS certificates", ) .meta({ group: "database", order: 57 }), DB_SSL_CERT_PATH: Joi.string() .optional() .allow("") .description("Path to client certificate file for PostgreSQL TLS") .meta({ group: "database", order: 58 }), DB_SSL_KEY_PATH: Joi.string() .optional() .allow("") .description("Path to client private key file for PostgreSQL TLS") .meta({ group: "database", order: 59 }), DB_SSL_KEY_PASSPHRASE: Joi.string() .optional() .allow("") .description("Passphrase for encrypted DB_SSL_KEY_PATH private key") .meta({ group: "database", order: 60 }), DB_SYNCHRONIZE: Joi.boolean() .default(true) .description( "Enable TypeORM schema synchronization. Set to false in production after initial setup and rely on migrations instead.", ) .meta({ group: "database", order: 70 }), DB_MIGRATIONS_RUN: Joi.boolean() .default(true) .description("Run pending database migrations automatically on startup") .meta({ group: "database", order: 80 }), })

src/verifier/presentations/entities/presentation-config.entity.ts

DCQL_CREDENTIAL_FORMATS
Type : unknown
Default value : ["dc+sd-jwt", "mso_mdoc"] as const

src/crypto/key/kms/adapters/csc-kms.adapter.ts

DEFAULT_API_PATH
Type : string
Default value : "/csc/v2"
DEFAULT_HASH_ALGORITHM_OID
Type : string
Default value : "2.16.840.1.101.3.4.2.1"
DEFAULT_SIGN_ALGORITHM_OID
Type : string
Default value : "1.2.840.10045.4.3.2"

src/issuer/issuance/oid4vci/authorization/shared/authorization-server-metadata.util.ts

DEFAULT_CLIENT_ATTESTATION_SIGNING_ALG_VALUES_SUPPORTED
Type : unknown
Default value : [ "ES256", ] as const
DEFAULT_CODE_CHALLENGE_METHODS_SUPPORTED
Type : unknown
Default value : ["S256"] as const
DEFAULT_DPOP_SIGNING_ALG_VALUES_SUPPORTED
Type : unknown
Default value : [ "ES256", "ES384", "ES512", ] as const
DEFAULT_TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED
Type : unknown
Default value : [ "attest_jwt_client_auth", "none", ] as const

src/issuer/trust-list/trustlist.service.ts

DEFAULT_LANG
Type : string
Default value : "en"

Default language for trust list entries

src/crypto/key/kms/kms-config.service.ts

DEFAULT_PROVIDER_ID
Type : string
Default value : "db"

src/crypto/key/kms/kms-provider.registry.ts

DEFAULT_PROVIDER_ID
Type : string
Default value : "db"

src/trust/revocation-policy.util.ts

DEFAULT_REVOCATION_POLICY
Type : NonNullable<VerifyPolicy['revocation']>
Default value : { enabled: true, failClosed: true, }

src/trust/types.ts

DEFAULT_VERIFIER_SKEW_SECONDS
Type : number
Default value : 60
ServiceTypeIdentifiers
Type : unknown
Default value : { EaaIssuance: "http://uri.etsi.org/19602/SvcType/EAA/Issuance", EaaRevocation: "http://uri.etsi.org/19602/SvcType/EAA/Revocation", WalletSolution: "http://uri.etsi.org/19602/SvcType/WalletSolution", WalletSolutionIssuance: "http://uri.etsi.org/19602/SvcType/WalletSolution/Issuance", WalletSolutionRevocation: "http://uri.etsi.org/19602/SvcType/WalletSolution/Revocation", } as const

Well-known service type identifiers from ETSI TS 119 602
walletSolutionServiceTypes
Type : unknown
Default value : [ ServiceTypeIdentifiers.WalletSolution, ServiceTypeIdentifiers.WalletSolutionIssuance, ServiceTypeIdentifiers.WalletSolutionRevocation, ] as const

src/issuer/issuance/oid4vci/dto/deferred-credential-request.dto.ts

DeferredCredentialRequestSchema
Type : unknown
Default value : z .object({ transaction_id: z.string(), }) .strict()

src/platform/config-portability/config-resource.registry.ts

DEFINITIONS
Type : ConfigResourceDefinition[]
Default value : [ { kind: "Tenant", slug: "tenant", currentVersion: 1, importPhase: 0, dependsOn: [], legacyFolders: ["info.json"], bundlePath: "info.json", singletonId: "tenant", sensitivePaths: [], }, { kind: "Client", slug: "client", currentVersion: 1, importPhase: 30, dependsOn: ["Tenant"], legacyFolders: ["clients"], sensitivePaths: ["secret"], }, { kind: "KmsConfig", slug: "kms-config", currentVersion: 1, importPhase: 10, dependsOn: ["Tenant"], legacyFolders: ["kms.json"], bundlePath: "kms.json", singletonId: "kms", sensitivePaths: [ "providers.*.vaultToken", "providers.*.secretAccessKey", "providers.*.pin", "providers.*.clientSecret", "providers.*.sad", "providers.*.authorizeAuthData.*.value", "providers.*.auth.token", "providers.*.auth.clientSecret", ], }, { kind: "KeyChain", slug: "key-chain", currentVersion: 2, importPhase: 20, dependsOn: ["Tenant", "KmsConfig"], legacyFolders: ["key-chains"], sensitivePaths: ["keySource.jwk"], }, { kind: "RegistrarConfig", slug: "registrar-config", currentVersion: 1, importPhase: 40, dependsOn: ["Tenant", "KeyChain"], legacyFolders: ["registrar.json"], bundlePath: "registrar.json", singletonId: "registrar", sensitivePaths: ["clientSecret", "password"], }, { kind: "IssuanceConfig", slug: "issuance-config", currentVersion: 2, importPhase: 70, dependsOn: [ "Tenant", "KeyChain", "AttributeProvider", "WebhookEndpoint", ], legacyFolders: ["issuance"], bundlePath: "issuance/config.json", singletonId: "issuance", sensitivePaths: [], }, { kind: "CredentialConfig", slug: "credential-config", currentVersion: 1, importPhase: 80, dependsOn: [ "Tenant", "KeyChain", "AttributeProvider", "WebhookEndpoint", ], legacyFolders: ["issuance/credentials"], sensitivePaths: [], }, { kind: "PresentationConfig", slug: "presentation-config", currentVersion: 2, importPhase: 100, dependsOn: ["Tenant", "KeyChain", "WebhookEndpoint", "TrustList"], legacyFolders: ["presentation"], sensitivePaths: [], }, { kind: "AttributeProvider", slug: "attribute-provider", currentVersion: 1, importPhase: 50, dependsOn: ["Tenant"], legacyFolders: ["attribute-providers"], sensitivePaths: ["auth.config.value"], }, { kind: "WebhookEndpoint", slug: "webhook-endpoint", currentVersion: 1, importPhase: 60, dependsOn: ["Tenant"], legacyFolders: ["webhook-endpoints"], sensitivePaths: ["auth.config.value"], }, { kind: "TrustList", slug: "trust-list", currentVersion: 1, importPhase: 90, dependsOn: ["Tenant", "KeyChain"], legacyFolders: ["trust-lists"], sensitivePaths: [], }, { kind: "StatusList", slug: "status-list", currentVersion: 1, importPhase: 110, dependsOn: ["Tenant", "KeyChain", "CredentialConfig"], legacyFolders: ["issuance/status-lists"], sensitivePaths: [], }, ]

src/issuer/configuration/issuance/dto/display.dto.ts

DisplayInfoSchema
Type : unknown
Default value : z .object({ name: z.string().optional(), locale: z.string().optional(), logo: DisplayLogoSchema.optional(), }) .catchall(z.unknown())
DisplayLogoSchema
Type : unknown
Default value : z .object({ uri: z.string(), alt_text: z.string().optional(), }) .catchall(z.unknown())

src/crypto/key/cert/certificate-builder.service.ts

ECDSA_P256_SIGNATURE_ALG
Type : object
Default value : { name: "ECDSA", hash: "SHA-256" as const, }

src/crypto/key/schemas/key-chain.schema.ts

EcJwkSchema
Type : unknown
Default value : z .object({ kty: z.string().describe("Key type (for example EC)."), x: z.string().describe("Elliptic curve public x coordinate."), y: z.string().describe("Elliptic curve public y coordinate."), crv: z.string().describe("Elliptic curve name."), d: z.string().describe("Private key value."), alg: z.string().optional().describe("Optional algorithm hint."), kid: z.string().optional().describe("Optional key identifier."), }) .describe("EC private key in JWK format.") .strict()
KeyChainCreateSchema
Type : unknown
Default value : z .object({ usageType: z .enum(KeyUsageType) .describe("Key usage category for the key chain."), type: z .enum(["standalone", "internalChain"]) .describe("Key chain mode."), description: z .string() .optional() .describe("Optional key chain description."), kmsProvider: z .string() .optional() .describe("Optional KMS provider id for key storage operations."), rotationPolicy: RotationPolicyCreateSchema.optional().describe( "Optional rotation policy.", ), }) .describe("Payload for creating a key chain.") .strict()
KeyChainImportSchema
Type : unknown
Default value : z .object({ id: z .string() .optional() .describe("Optional key chain id. If omitted, one is generated."), key: EcJwkSchema.describe("Private key material in JWK format."), description: z .string() .optional() .describe("Optional key chain description."), usageType: z .enum(KeyUsageType) .describe("Key usage category for the imported key chain."), crt: z .array(z.string()) .optional() .describe( "Optional certificate chain values in PEM or base64 DER.", ), kmsProvider: z .string() .optional() .describe("Optional KMS provider id."), rotationPolicy: RotationPolicyImportSchema.optional().describe( "Optional rotation policy for imported key chains.", ), }) .describe("Payload for importing key chains from JSON configuration.") .strict()
KeyChainUpdateSchema
Type : unknown
Default value : z .object({ description: z .string() .optional() .describe("Optional replacement description."), rotationPolicy: RotationPolicyUpdateSchema.optional().describe( "Optional rotation policy updates.", ), activeCertificate: z .string() .optional() .describe("Optional active certificate override."), }) .describe("Payload for updating key chain metadata and rotation settings.") .strict()
RotationPolicyCreateSchema
Type : unknown
Default value : z .object({ enabled: z .boolean() .describe("Enable or disable automatic key rotation."), intervalDays: z .number() .min(1) .max(3650) .optional() .describe("Rotation interval in days."), certValidityDays: z .number() .min(1) .max(3650) .optional() .describe( "Certificate validity period in days for generated leaf certificates.", ), }) .describe("Rotation policy used when creating key chains.") .strict()
RotationPolicyImportSchema
Type : unknown
Default value : z .object({ enabled: z .boolean() .describe("Enable automatic rotation for imported key chains."), intervalDays: z .number() .min(1) .max(3650) .optional() .describe("Rotation interval in days."), certValidityDays: z .number() .min(1) .max(3650) .optional() .describe("Certificate validity period in days."), }) .describe("Rotation policy used when importing key chains.") .strict()
RotationPolicyUpdateSchema
Type : unknown
Default value : z .object({ enabled: z .boolean() .optional() .describe("Optional replacement for rotation enabled flag."), intervalDays: z .number() .min(1) .max(3650) .optional() .describe("Optional replacement for rotation interval in days."), certValidityDays: z .number() .min(1) .max(3650) .optional() .describe( "Optional replacement for certificate validity period in days.", ), }) .describe("Payload fragment for updating key chain rotation policy.") .strict()

src/platform/editor-schema.registry.ts

editorSchemaBundles
Type : readonly EditorSchemaBundle[]
Default value : [ clientEditorSchemaBundle, tenantEditorSchemaBundle, attributeProviderEditorSchemaBundle, webhookEndpointEditorSchemaBundle, keyChainEditorSchemaBundle, kmsEditorSchemaBundle, certEditorSchemaBundle, statusListEditorSchemaBundle, registrarEditorSchemaBundle, issuanceEditorSchemaBundle, credentialEditorSchemaBundle, presentationEditorSchemaBundle, trustListEditorSchemaBundle, webhookEditorSchemaBundle, ]

src/platform/data-encryption/encrypted-column.transformer.ts

EncryptedJsonTransformer
Type : ValueTransformer
Default value : { /** * Transform value when writing to database. * Encrypts the JSON value. */ to(value: unknown): string | null { if (value === null || value === undefined) { return null; } return getEncryptionService().encryptJson(value); }, /** * Transform value when reading from database. * Decrypts the encrypted value back to JSON. */ from(value: string | null): unknown { if (value === null || value === undefined) { return null; } const service = getEncryptionService(); // Handle migration: if value is not encrypted, return as-is (parsed JSON) // This allows existing unencrypted data to be read during migration if (!service.isEncrypted(value)) { // Try to parse as JSON (for existing unencrypted data) try { return typeof value === "string" ? JSON.parse(value) : value; } catch { return value; } } return service.decryptJson(value); }, }

TypeORM column transformer for encrypting JSON data at rest. Encrypts on write (to database) and decrypts on read (from database).

Usage:
EncryptedStringTransformer
Type : ValueTransformer
Default value : { /** * Transform value when writing to database. */ to(value: string | null): string | null { if (value === null || value === undefined) { return null; } return getEncryptionService().encrypt(value); }, /** * Transform value when reading from database. */ from(value: string | null): string | null { if (value === null || value === undefined) { return null; } const service = getEncryptionService(); // Handle migration: if value is not encrypted, return as-is if (!service.isEncrypted(value)) { return value; } return service.decrypt(value); }, }

TypeORM column transformer for encrypting string data at rest. Use for non-JSON string values.

Usage:
encryptionServiceInstance
Type : DataEncryptionService | null
Default value : null

Singleton holder for the encryption service instance. This is necessary because TypeORM transformers don't support dependency injection.

src/platform/data-encryption/providers/encryption-key-provider.interface.ts

ENCRYPTION_KEY_PROVIDER
Type : string
Default value : "ENCRYPTION_KEY_PROVIDER"

Injection token for the encryption key provider.

src/platform/data-encryption/encryption-validation.schema.ts

ENCRYPTION_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ ENCRYPTION_KEY_SOURCE: Joi.string() .valid("env", "vault", "aws", "azure") .default("env") .description( "Source for encryption key: env (dev), vault/aws/azure (prod - key only in RAM)", ) .meta({ group: "encryption", order: 10 }), // Vault-related config (reuses VAULT_ADDR from key-validation.schema.ts) VAULT_ENCRYPTION_KEY_PATH: Joi.string() .when("ENCRYPTION_KEY_SOURCE", { is: "vault", then: Joi.optional().default("secret/data/eudiplo/encryption-key"), otherwise: Joi.optional(), }) .description("Path to encryption key in Vault KV secrets engine") .meta({ group: "encryption", order: 20 }), // AWS Secrets Manager config AWS_ENCRYPTION_SECRET_NAME: Joi.string() .when("ENCRYPTION_KEY_SOURCE", { is: "aws", then: Joi.required(), otherwise: Joi.optional(), }) .description("Name of the encryption key secret in AWS Secrets Manager") .meta({ group: "encryption", order: 30 }), AWS_ENCRYPTION_SECRET_KEY: Joi.string() .when("ENCRYPTION_KEY_SOURCE", { is: "aws", then: Joi.optional().default("key"), otherwise: Joi.optional(), }) .description("JSON key within the AWS secret (if secret is JSON)") .meta({ group: "encryption", order: 40 }), // Azure Key Vault config AZURE_KEYVAULT_URL: Joi.string() .uri() .when("ENCRYPTION_KEY_SOURCE", { is: "azure", then: Joi.required(), otherwise: Joi.optional(), }) .description( "Azure Key Vault URL (e.g., https://myvault.vault.azure.net)", ) .meta({ group: "encryption", order: 50 }), AZURE_ENCRYPTION_SECRET_NAME: Joi.string() .when("ENCRYPTION_KEY_SOURCE", { is: "azure", then: Joi.required(), otherwise: Joi.optional(), }) .description("Name of the encryption key secret in Azure Key Vault") .meta({ group: "encryption", order: 60 }), })

Validation schema for encryption key source configuration.

Configures where the encryption key for data at rest is fetched from:

  • env (default): Derived from MASTER_SECRET (development only)
  • vault: Fetched from HashiCorp Vault (production)
  • aws: Fetched from AWS Secrets Manager (production)
  • azure: Fetched from Azure Key Vault (production)

src/shared/common/zod/zod-schema.util.ts

ENV_PLACEHOLDER_REGEX
Type : unknown
Default value : /^\$\{([A-Z0-9_]+)\}$/

src/issuer/trust-list/schemas/trust-list.schema.ts

ExternalTrustListEntitySchema
Type : unknown
Default value : z .object({ type: z .literal("external") .describe("Provide external PEM certificates directly."), issuerCertPem: z .string() .min(1) .describe("Issuer certificate in PEM format."), revocationCertPem: z .string() .min(1) .describe("Revocation/status certificate in PEM format."), info: TrustListEntityInfoSchema.describe("Entity metadata."), }) .describe("Trust list entity using externally supplied PEM certificates.") .strict()
InternalTrustListEntitySchema
Type : unknown
Default value : z .object({ type: z .literal("internal") .describe("Use locally managed key chains for trust material."), issuerKeyChainId: z .string() .min(1) .describe("Key chain id for issuer certificate material."), revocationKeyChainId: z .string() .min(1) .describe( "Key chain id for revocation/status list certificate material.", ), info: TrustListEntityInfoSchema.describe("Entity metadata."), }) .describe("Trust list entity referencing internal key chains.") .strict()
TrustListCreateSchema
Type : unknown
Default value : z .object({ id: z .string() .min(1) .optional() .describe( "Optional trust list id. If omitted, one may be generated.", ), description: z .string() .optional() .describe("Optional trust list description."), keyChainId: z .string() .min(1) .optional() .describe( "Optional key chain id used to sign trust list payloads.", ), entities: z .array( z.discriminatedUnion("type", [ InternalTrustListEntitySchema, ExternalTrustListEntitySchema, ]), ) .min(1) .describe("One or more entities included in this trust list."), data: z .record(z.string(), z.unknown()) .optional() .describe("Optional additional custom payload data."), }) .describe("Payload for creating a trust list configuration.") .strict()
TrustListEntityInfoSchema
Type : unknown
Default value : z .object({ name: z.string().min(1).describe("Display name of the trusted entity."), lang: z .string() .optional() .describe("Optional language tag for entity info."), locale: z.string().optional().describe("Optional locale identifier."), uri: z.string().optional().describe("Optional entity URI."), country: z .string() .optional() .describe("Optional country name or code."), locality: z.string().optional().describe("Optional locality or city."), postalCode: z.string().optional().describe("Optional postal code."), streetAddress: z .string() .optional() .describe("Optional street address."), contactUri: z .string() .optional() .describe("Optional contact URI for the entity."), }) .describe("Human-readable metadata for a trust list entity.") .strict()

src/issuer/configuration/issuance/dto/federation-config.dto.ts

FederationConfigSchema
Type : unknown
Default value : z .object({ role: z.enum(FederationEntityRole).optional(), mode: z.enum(FederationTrustMode).optional(), entityId: z.string().optional(), enforceSigningPolicy: z.boolean().optional(), cacheTtlSeconds: z.number().optional(), trustAnchors: z.array(FederationTrustAnchorConfigSchema), }) .strict()
FederationTrustAnchorConfigSchema
Type : unknown
Default value : z .object({ entityId: z.string(), entityConfigurationUri: z.string(), }) .strict()

src/storage/storage.types.ts

FILE_STORAGE
Type : unknown
Default value : Symbol("FILE_STORAGE")

src/platform/config-portability/config-folder-bundle.service.ts

FOLDER_RESOURCES
Type : FolderResource[]
Default value : [ { kind: "KmsConfig", file: "kms.json" }, { kind: "Client", directory: "clients" }, { kind: "KeyChain", directory: "key-chains" }, { kind: "RegistrarConfig", file: "registrar.json" }, { kind: "AttributeProvider", directory: "attribute-providers" }, { kind: "WebhookEndpoint", directory: "webhook-endpoints" }, { kind: "IssuanceConfig", file: "issuance/issuance.json" }, { kind: "CredentialConfig", directory: "issuance/credentials" }, { kind: "TrustList", directory: "trust-lists" }, { kind: "PresentationConfig", directory: "presentation" }, { kind: "StatusList", directory: "issuance/status-lists" }, ]
MIME_TYPES
Type : Record<string, string>
Default value : { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".svg": "image/svg+xml", ".webp": "image/webp", ".ico": "image/x-icon", ".bmp": "image/bmp", }

src/main.helpers.ts

GLOBAL_PREFIX_EXCLUSIONS
Type : literal type[]
Default value : [ // Infrastructure { path: "/", method: RequestMethod.GET }, { path: "health", method: RequestMethod.ALL }, // Admin authentication { path: "api/oauth2/{*path}", method: RequestMethod.ALL }, // Discovery { path: ".well-known/{*path}", method: RequestMethod.ALL }, // OID4VCI Protocol { path: "issuers/:tenantId/vci/{*path}", method: RequestMethod.ALL }, { path: "issuers/:tenantId/authorize", method: RequestMethod.ALL }, { path: "issuers/:tenantId/authorize/{*path}", method: RequestMethod.ALL }, { path: "issuers/:tenantId/authorization-servers/{*path}", method: RequestMethod.ALL, }, { path: "issuers/:tenantId/credentials-metadata/{*path}", method: RequestMethod.ALL, }, { path: "issuers/:tenantId/chained-as/{*path}", method: RequestMethod.ALL }, // OID4VP Protocol { path: "presentations/:sessionId/oid4vp", method: RequestMethod.ALL }, { path: "presentations/:sessionId/oid4vp/{*path}", method: RequestMethod.ALL, }, // ISO 18013-7 Annex C Protocol (org-iso-mdoc via DC API) { path: "presentations/:sessionId/iso-18013-7", method: RequestMethod.ALL, }, // Public Status & Trust Lists { path: "issuers/:tenantId/status-management/{*path}", method: RequestMethod.ALL, }, { path: "issuers/:tenantId/trust-list/{*path}", method: RequestMethod.ALL }, // Public Storage (credential images, logos) { path: "storage/:key", method: RequestMethod.GET }, ]

Routes excluded from the automatic /api global prefix. Wallet-facing and infrastructure endpoints stay at the root path for protocol compliance and discoverability. The integrated OAuth2 token endpoint is already mounted under /api so firewalls can treat it as part of the admin surface without receiving a duplicate /api/api prefix.

src/issuer/configuration/credentials/entities/iae-action.dto.ts

IaeActionOpenid4vpPresentationSchema
Type : unknown
Default value : z .object({ type: z.literal(IaeActionType.OPENID4VP_PRESENTATION), label: z.string().optional(), presentationConfigId: z.string(), }) .strict()
IaeActionRedirectToWebSchema
Type : unknown
Default value : z .object({ type: z.literal(IaeActionType.REDIRECT_TO_WEB), label: z.string().optional(), url: z.url(), callbackUrl: z.url().optional(), description: z.string().optional(), }) .strict()

src/auth/public.decorator.ts

IS_PUBLIC_KEY
Type : string
Default value : "isPublic"
Public
Type : unknown
Default value : () => SetMetadata(IS_PUBLIC_KEY, true)

src/issuer/configuration/issuance/schemas/issuance-editor-schema.bundle.ts

issuanceEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "issuance", schemas: [ defineEditorSchema({ name: "IssuanceConfig", schema: IssuanceConfigSchema, }), ], })

src/issuer/issuer-validation.schema.ts

ISSUER_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ PUBLIC_URL: Joi.string() .default("http://localhost:3000") .description("The public URL of the issuer") .meta({ group: "general", order: 10 }), OUTBOUND_URL_ALLOW_HTTP: Joi.boolean() .optional() .description("Allow HTTP (non-TLS) for outbound webhook calls") .meta({ group: "issuer", order: 20 }), OUTBOUND_URL_ALLOW_PRIVATE_NETWORK: Joi.boolean() .optional() .description( "Allow outbound webhook calls to private, loopback, or link-local IP ranges", ) .meta({ group: "issuer", order: 30 }), OUTBOUND_URL_ALLOWED_HOSTS: Joi.string() .allow("") .optional() .description( "Comma-separated hostname allowlist for outbound webhook calls (supports exact host and subdomains)", ) .meta({ group: "issuer", order: 40 }), ISSUER_MULTI_CONSUMPTION: Joi.boolean() .default(false) .description("Enable or disable multi-consumption for the issuer") .meta({ group: "issuer", order: 50 }), })

src/issuer/configuration/issuance/dto/issuer-registration-certificate.dto.ts

IssuerProvidedAttestationSchema
Type : unknown
Default value : z .object({ credentialConfigId: z.string().optional(), format: z.string().optional(), meta: z.record(z.string(), z.unknown()).optional(), }) .strict()
IssuerRegistrationCertificateCacheSchema
Type : unknown
Default value : z .object({ jwt: z.string(), fingerprint: z.string(), issuedAt: z.number().optional(), expiresAt: z.number().optional(), }) .strict()
IssuerRegistrationCertificateConfigSchema
Type : unknown
Default value : z .object({ enabled: z.boolean().optional(), mode: z.enum(IssuerRegistrationCertificateMode).optional(), jwt: z.string().optional(), privacyPolicy: z.string().optional(), supportUri: z.string().optional(), }) .strict()

src/crypto/key/crypto-implementation/crypto-implementation.service.ts

JOSE_TO_CLASSIC_COSE_ALG
Type : Record<JoseAlgorithm, number>
Default value : { ES256: -7, ES384: -35, ES512: -36, }

src/issuer/configuration/credentials/utils/derive.ts

JSON_SCHEMA_DRAFT_2020_12
Type : string
Default value : "https://json-schema.org/draft/2020-12/schema"

src/issuer/configuration/issuance/dto/key-attestations-required.dto.ts

KeyAttestationsRequiredSchema
Type : unknown
Default value : z .object({ key_storage: z.array(z.string()).optional(), user_authentication: z.array(z.string()).optional(), }) .strict()

src/crypto/key/schemas/key-chain-editor-schema.bundle.ts

keyChainEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "key-chain", schemas: [ defineEditorSchema({ name: "KeyChainImportDto", schema: KeyChainImportSchema, }), defineEditorSchema({ name: "KeyChainCreateDto", schema: KeyChainCreateSchema, }), defineEditorSchema({ name: "KeyChainUpdateDto", schema: KeyChainUpdateSchema, }), defineEditorSchema({ name: "RotationPolicyCreateDto", schema: RotationPolicyCreateSchema, }), defineEditorSchema({ name: "RotationPolicyUpdateDto", schema: RotationPolicyUpdateSchema, }), ], })

src/crypto/key/schemas/kms-editor-schema.bundle.ts

kmsEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "kms", schemas: [ defineEditorSchema({ name: "KmsConfigDto", schema: KmsConfigSchema, }), ], })

src/platform/observability/log-validation.schema.ts

LOG_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ LOG_LEVEL: Joi.string() .valid("trace", "debug", "info", "warn", "error", "fatal") .default(process.env.NODE_ENV === "production" ? "warn" : "debug") .description("Application log level") .meta({ group: "log", order: 10 }), LOG_ENABLE_HTTP_LOGGER: Joi.boolean() .default(false) .description("Enable HTTP request logging") .meta({ group: "log", order: 20 }), LOG_HTTP_RESPONSE_BODY: Joi.boolean() .default(false) .description( "Capture and log HTTP response bodies (buffered up to LOG_HTTP_RESPONSE_BODY_MAX_LENGTH bytes). " + "Disabled by default because response bodies may contain access tokens, " + "credentials, or other sensitive data.", ) .meta({ group: "log", order: 25 }), LOG_HTTP_RESPONSE_BODY_MAX_LENGTH: Joi.number() .integer() .min(0) .default(4096) .description( "Maximum number of bytes to capture for HTTP response bodies. Set to 0 to disable truncation.", ) .meta({ group: "log", order: 27 }), LOG_REDACT_SENSITIVE_DATA: Joi.boolean() .default(true) .description( "Redact sensitive request/response fields from logs. Disable only for debugging.", ) .meta({ group: "log", order: 28 }), LOG_ENABLE_SESSION_LOGGER: Joi.boolean() .default(false) .description("Enable session flow logging") .meta({ group: "log", order: 30 }), LOG_SESSION_STORE: Joi.string() .valid("off", "errors", "all", "verbose") .default("off") .description( "Controls whether session log entries are persisted to the database. " + "'off' disables storage, 'errors' stores only warn/error entries, " + "'all' stores everything, 'verbose' stores everything including full request/response bodies and error stacks.", ) .meta({ group: "log", order: 35 }), LOG_TO_FILE: Joi.boolean() .default(false) .description("Enable logging to file in addition to console") .meta({ group: "log", order: 60 }), LOG_FILE_PATH: Joi.string() .default("./logs/session.log") .description("File path for log output when LOG_TO_FILE is enabled") .meta({ group: "log", order: 70 }), OTEL_SDK_DISABLED: Joi.boolean() .default(false) .description("Disable OpenTelemetry SDK (and OTel log forwarding)") .meta({ group: "log", order: 80 }), })

Validation schema for logging configuration

src/platform/config-portability/config-migration.service.ts

migrateTrustListRefs
Type : unknown
Default value : ( spec: Spec, kind: ConfigResourceKind, resourceId: string, ): ConfigMigrationIssue[] => { const issues: ConfigMigrationIssue[] = []; const refs = spec.walletProviderTrustLists; if (Array.isArray(refs)) { spec.walletProviderTrustLists = refs.map( (entry: unknown, index: number) => { if (typeof entry !== "string") return entry; issues.push({ severity: "required-input", code: "TRUST_LIST_VERIFIER_REQUIRED", path: `/spec/walletProviderTrustLists/${index}`, message: "Provide verifierKey or verifierX509Der before import.", resource: { kind, id: resourceId }, }); return { url: entry }; }, ); } return issues; }
MIGRATIONS
Type : ConfigMigration[]
Default value : [ { id: "IssuanceConfig/1-to-2", kind: "IssuanceConfig", from: 1, to: 2, migrate(spec) { const clone = structuredClone(spec); return { spec: clone, issues: migrateTrustListRefs( clone, "IssuanceConfig", "issuance", ), }; }, }, { id: "PresentationConfig/1-to-2", kind: "PresentationConfig", from: 1, to: 2, migrate(spec) { const clone = structuredClone(spec); const issues: ConfigMigrationIssue[] = []; if (clone.webhook !== undefined) { issues.push({ severity: "required-input", code: "WEBHOOK_ENDPOINT_REFERENCE_REQUIRED", path: "/spec/webhook", message: "Create or select a webhook endpoint, set webhookEndpointId, and remove webhook.", resource: { kind: "PresentationConfig", id: String(clone.id ?? "unknown"), }, }); } const credentials = clone.dcql_query?.credentials; if (Array.isArray(credentials)) { for ( let credentialIndex = 0; credentialIndex < credentials.length; credentialIndex++ ) { const authorities = credentials[credentialIndex]?.trusted_authorities; if (!Array.isArray(authorities)) continue; for ( let authorityIndex = 0; authorityIndex < authorities.length; authorityIndex++ ) { const authority = authorities[authorityIndex]; if ( authority?.type !== "etsi_tl" || !Array.isArray(authority.values) ) { continue; } authority.values = authority.values.map( (entry: unknown, valueIndex: number) => { if (typeof entry !== "string") return entry; issues.push({ severity: "required-input", code: "TRUST_LIST_VERIFIER_REQUIRED", path: `/spec/dcql_query/credentials/${credentialIndex}/trusted_authorities/${authorityIndex}/values/${valueIndex}`, message: "Provide verifierKey, verifierX509Der, or replace the URL with trustListId before import.", resource: { kind: "PresentationConfig", id: String(clone.id ?? "unknown"), }, }); return { url: entry }; }, ); } } } return { spec: clone, issues }; }, }, { id: "KeyChain/1-to-2", kind: "KeyChain", from: 1, to: 2, migrate(spec) { const clone = structuredClone(spec); const key = clone.key; delete clone.key; clone.keySource = { type: "private-jwk", jwk: key }; return { spec: clone }; }, }, ]

src/storage/files.service.ts

MIME_TYPES
Type : Record<string, string>
Default value : { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".svg": "image/svg+xml", ".webp": "image/webp", ".ico": "image/x-icon", ".bmp": "image/bmp", }

src/issuer/configuration/credentials/types/credential-config-types.ts

MSO_MDOC_FORMAT
Type : MsoMdocFormatIdentifier
Default value : "mso_mdoc"

Format identifier constants for runtime checks
SD_JWT_DC_FORMAT
Type : unknown
Default value : "dc+sd-jwt" as const

src/issuer/issuance/oid4vci/dto/notification-request.dto.ts

NotificationRequestSchema
Type : unknown
Default value : z .object({ notification_id: z.string(), event: z.enum([ "credential_accepted", "credential_failure", "credential_deleted", ]), }) .strict()

src/platform/config-portability/config-bundle.service.ts

OMITTED_FIELDS
Type : unknown
Default value : new Set([ "tenant", "tenantId", "createdAt", "updatedAt", "registrationCertificateCache", "readerAuthCache", "jwt", "cwt", "list", "statusList", "previousJwk", "previousCertificate", "previousKeyExpiry", "lastRotatedAt", ])

src/tracing.ts

otelSDK
Type : unknown
Default value : new NodeSDK({ resource: resourceFromAttributes({ [ATTR_SERVICE_NAME]: process.env.OTEL_SERVICE_NAME || "eudiplo-backend", [ATTR_SERVICE_VERSION]: process.env.VERSION || "unknown", }), traceExporter: new OTLPTraceExporter(), metricReader: new PeriodicExportingMetricReader({ exporter: new OTLPMetricExporter(), exportIntervalMillis: 30_000, }), logRecordProcessors: [ new BatchLogRecordProcessor({ exporter: new OTLPLogExporter(), }), ], instrumentations: [ getNodeAutoInstrumentations({ // fs instrumentation is very noisy and adds little value "@opentelemetry/instrumentation-fs": { enabled: false }, // Enable HTTP metrics (server request duration, etc.) "@opentelemetry/instrumentation-http": { enabled: true, }, }), ], })

OpenTelemetry SDK bootstrap — must be started BEFORE NestJS initializes.

All three signals (metrics, traces, logs) are exported via OTLP to an OpenTelemetry Collector. Configure the collector endpoint via:

OTEL_EXPORTER_OTLP_ENDPOINT (default: http://localhost:4318)

To disable OTel entirely (e.g. local dev without collector), set:

OTEL_SDK_DISABLED=true

src/crypto/key/kms/adapters/pkcs11-kms.adapter.ts

P256_OID_DER
Type : unknown
Default value : Buffer.from([ 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, ])
pkcs11ModulePromise
Type : Promise | undefined

src/verifier/presentations/schemas/presentation-editor-schema.bundle.ts

presentationEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "presentation", schemas: [ defineEditorSchema({ name: "DCQL", schema: DCQLSchema, }), defineEditorSchema({ name: "TransactionData", schema: TransactionDataSchema, }), defineEditorSchema({ name: "PresentationConfigCreateDto", schema: PresentationConfigCreateSchema, }), ], })

src/verifier/oid4vp/dto/presentation-request.dto.ts

PresentationRequestBase
Type : PresentationRequestConstructor
Default value : createZodDto( PresentationRequestSchema, ) as PresentationRequestConstructor
PresentationRequestSchema
Type : unknown
Default value : z .object({ response_type: z.union([ z.literal(ResponseType.URI), z.literal(ResponseType.DC_API), z.literal(ResponseType.ISO_18013_7), ]), requestId: z.string(), webhook: WebhookConfigSchema.optional(), redirectUri: z.string().optional(), expected_origin: z.string().optional(), transaction_data: z.array(z.record(z.string(), z.unknown())).optional(), skewSeconds: z.number().min(0).optional(), }) .strict()

DTO for the presentation request containing the response type and request ID.
ResponseType
Type : unknown
Default value : { URI: "uri", DC_API: "dc-api", ISO_18013_7: "iso-18013-7", } as const

Values for the type of response expected from the presentation request.

src/registrar/schemas/registrar-editor-schema.bundle.ts

registrarEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "registrar", schemas: [ defineEditorSchema({ name: "CreateRegistrarConfigDto", schema: CreateRegistrarConfigSchema, }), ], })

src/verifier/presentations/dto/vp-request.dto.ts

RegistrationCertificateBodySchema
Type : unknown
Default value : z .object({ privacy_policy: z.string().optional(), support_uri: z.string().optional(), intermediary: z.string().optional(), purpose: z.array(RegistrationCertificatePurposeSchema).optional(), credentials: z.array(z.record(z.string(), z.unknown())).optional(), provided_attestations: z .array(z.record(z.string(), z.unknown())) .optional(), }) .strict()
RegistrationCertificatePurposeSchema
Type : unknown
Default value : z .object({ lang: z.string(), content: z.string(), }) .strict()
RegistrationCertificateRequestSchema
Type : unknown
Default value : z .object({ id: z.string().optional(), body: RegistrationCertificateBodySchema.optional(), jwt: z.string().optional(), }) .strict()

src/verifier/presentations/dto/resolve-issuer-metadata.dto.ts

ResolveIssuerMetadataSchema
Type : unknown
Default value : z .object({ issuerUrl: z.url(), }) .strict()

src/verifier/presentations/dto/resolve-schema-metadata-jwt.dto.ts

ResolveSchemaMetadataJwtSchema
Type : unknown
Default value : z .object({ signedJwt: z.string(), }) .strict()

src/verifier/presentations/dto/resolve-schema-metadata.dto.ts

ResolveSchemaMetadataSchema
Type : unknown
Default value : z .object({ schemaMetadataUrl: z.url(), }) .strict()

src/auth/roles/roles.decorator.ts

Roles
Type : unknown
Default value : (...roles: Role[]) => SetMetadata(ROLES_KEY, roles)
ROLES_KEY
Type : string
Default value : "roles"

src/issuer/configuration/credentials/dto/schema-meta-config.dto.ts

SchemaMetaConfigSchema
Type : unknown
Default value : z .object({ id: z.string().optional(), name: z.string().optional(), version: z.string(), rulebookURI: z.string().optional(), attestationLoS: z.enum(AttestationLoS), bindingType: z.enum(SchemaMetaBindingType), schemaURIs: z.array(SchemaUriEntrySchema).optional(), trustedAuthorities: z.array(TrustAuthorityEntrySchema).optional(), }) .strict()
SchemaUriEntrySchema
Type : unknown
Default value : z .object({ credentialConfigId: z.string().optional(), format: z.string().optional(), uri: z.string().optional(), meta: z.record(z.string(), z.unknown()).optional(), }) .strict()
SignSchemaMetaConfigSchema
Type : unknown
Default value : z .object({ config: SchemaMetaConfigSchema, credentialConfigId: z.string().optional(), pinMode: z.enum(SchemaMetadataPinMode).optional(), }) .strict()
SignVersionSchemaMetaConfigSchema
Type : unknown
Default value : z .object({ config: SchemaMetaConfigSchema, credentialConfigId: z.string().optional(), pinMode: z.enum(SchemaMetadataPinMode).optional(), }) .strict()
TrustAuthorityEntrySchema
Type : unknown
Default value : z .object({ trustListId: z.string().optional(), frameworkType: z.enum(SchemaMetaFrameworkType).optional(), value: z.string().optional(), verificationMethod: z .union([z.record(z.string(), z.unknown()), z.string()]) .optional(), }) .strict()

src/session/session-events.service.ts

SESSION_STATUS_CHANGED
Type : string
Default value : "session.status.changed"

src/session/session-validation.schema.ts

SESSION_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ SESSION_TIDY_UP_INTERVAL: Joi.number() .default(60 * 60) .description("Interval in seconds to run session tidy up") .meta({ group: "session", order: 10 }), SESSION_TTL: Joi.number() .default(24 * 60 * 60) .description( "Default time to live for sessions in seconds. Can be overridden per tenant.", ) .meta({ group: "session", order: 20 }), SESSION_CLEANUP_MODE: Joi.string() .valid("full", "anonymize") .default("full") .description( "Default cleanup mode when sessions expire. 'full' deletes the entire session, 'anonymize' keeps metadata but removes personal data. Can be overridden per tenant.", ) .meta({ group: "session", order: 30 }), })

Module for managing user sessions.

src/auth/tenant/schemas/session-storage-config.schema.ts

SessionCleanupModeSchema
Type : unknown
Default value : z .enum(["full", "anonymize"]) .describe("Cleanup strategy for expired sessions.")
SessionStorageConfigSchema
Type : unknown
Default value : z .strictObject({ ttlSeconds: z.coerce .number() .int() .min(60) .optional() .describe("Session time-to-live in seconds."), cleanupMode: SessionCleanupModeSchema.optional().describe( "Whether to fully delete or anonymize expired sessions.", ), }) .describe("Tenant session storage configuration.")

src/session/dto/session-query.dto.ts

SessionQuerySchema
Type : unknown
Default value : z .object({ page: z.coerce.number().int().min(1).default(1), pageSize: z.coerce.number().int().min(1).max(100).default(25), status: z.enum(SessionStatus).optional(), type: z.enum(["issuance", "presentation"]).optional(), sortBy: z.enum(["id", "status", "createdAt", "requestId"]).optional(), sortOrder: z.enum(["asc", "desc"]).optional(), }) .strict()

src/platform/config-portability/config-bundle-archive.service.ts

sha256
Type : unknown
Default value : (value: Uint8Array): string => createHash("sha256").update(value).digest("hex")

src/issuer/status-list/status-list-validation.schema.ts

STATUS_LIST_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ STATUS_CAPACITY: Joi.number() .default(10000) .description( "The default capacity of the status list. Can be overridden per tenant.", ) .meta({ group: "status", order: 10 }), STATUS_BITS: Joi.number() .valid(1, 2, 4, 8) .default(1) .description( "The default number of bits used per status entry. Can be overridden per tenant.", ) .meta({ group: "status", order: 20 }), STATUS_TTL: Joi.number() .min(60) .default(3600) .description( "The default TTL in seconds for status list JWTs. Verifiers can cache the JWT until expiration. Can be overridden per tenant.", ) .meta({ group: "status", order: 30 }), STATUS_IMMEDIATE_UPDATE: Joi.boolean() .default(false) .description( "If true, regenerate status list JWT immediately on every status change. If false (default), use lazy regeneration when TTL expires. Can be overridden per tenant.", ) .meta({ group: "status", order: 40 }), STATUS_ENABLE_AGGREGATION: Joi.boolean() .default(true) .description( "If true (default), include aggregation_uri in status list JWTs. This allows relying parties to pre-fetch all status lists for offline validation per RFC draft-ietf-oauth-status-list Section 9. Can be overridden per tenant.", ) .meta({ group: "status", order: 50 }), })

src/auth/tenant/schemas/status-list-config.schema.ts

StatusListConfigSchema
Type : unknown
Default value : z .strictObject({ capacity: z.coerce .number() .int() .min(100) .optional() .describe("Default status list capacity."), bits: z .union([z.literal(1), z.literal(2), z.literal(4), z.literal(8)]) .optional() .describe("Bits-per-status setting (1, 2, 4, or 8)."), ttl: z.coerce .number() .int() .min(60) .optional() .describe("JWT TTL for status list tokens in seconds."), immediateUpdate: z .boolean() .optional() .describe( "Regenerate status list JWTs immediately after status updates.", ), enableAggregation: z .boolean() .optional() .describe("Include aggregation_uri in generated status list JWTs."), }) .describe( "Tenant defaults for status list generation and publishing behavior.", )

src/issuer/status-list/dto/status-list-editor-schema.bundle.ts

statusListEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "status-list", schemas: [ defineEditorSchema({ name: "StatusListImportDto", schema: StatusListImportSchema, }), defineEditorSchema({ name: "CreateStatusListDto", schema: CreateStatusListSchema, }), defineEditorSchema({ name: "UpdateStatusListDto", schema: UpdateStatusListSchema, }), defineEditorSchema({ name: "UpdateStatusListConfigDto", schema: UpdateStatusListConfigSchema, }), ], })

src/issuer/status-list/dto/status-update.dto.ts

StatusUpdateSchema
Type : unknown
Default value : z .object({ sessionId: z .string() .min(1) .describe( "Session identifier used to locate credentials for status updates.", ), credentialConfigurationId: z .string() .min(1) .optional() .describe( "Optional credential configuration id. If omitted, all credentials linked to the session are updated.", ), status: z .number() .int() .min(0) .max(2) .describe( "New credential status: 0 = valid, 1 = revoked, 2 = suspended.", ), }) .describe( "Request payload for updating credential status entries by session.", ) .strict()

src/storage/storage-validation.schema.ts

STORAGE_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ STORAGE_DRIVER: Joi.string() .valid("local", "s3") .default("local") .description("The storage driver to use") .meta({ group: "storage", order: 10 }), LOCAL_STORAGE_DIR: Joi.string() .when(Joi.ref("STORAGE_DRIVER"), { is: "local", then: Joi.string().default((parent) => join(parent.FOLDER, "uploads"), ), }) .description("The directory to store files in when using local storage") .meta({ group: "storage", order: 20 }), S3_REGION: Joi.string() .when(Joi.ref("STORAGE_DRIVER"), { is: "s3", then: Joi.required(), }) .description("The AWS region for the S3 bucket") .meta({ group: "storage", order: 30 }), S3_BUCKET: Joi.string() .when(Joi.ref("STORAGE_DRIVER"), { is: "s3", then: Joi.required(), }) .description("The name of the S3 bucket") .meta({ group: "storage", order: 40 }), S3_ACCESS_KEY_ID: Joi.string() .when(Joi.ref("STORAGE_DRIVER"), { is: "s3", then: Joi.required(), }) .description("The access key ID for the S3 bucket") .meta({ group: "storage", order: 50 }), S3_SECRET_ACCESS_KEY: Joi.string() .when(Joi.ref("STORAGE_DRIVER"), { is: "s3", then: Joi.required(), }) .description("The secret access key for the S3 bucket") .meta({ group: "storage", order: 60 }), S3_ENDPOINT: Joi.string() .when(Joi.ref("STORAGE_DRIVER"), { is: "s3", then: Joi.optional(), }) .description( "The endpoint URL for the S3 service (for S3-compatible services)", ) .meta({ group: "storage", order: 70 }), S3_FORCE_PATH_STYLE: Joi.boolean() .when(Joi.ref("STORAGE_DRIVER"), { is: "s3", then: Joi.boolean().default(false), }) .description("Whether to force path-style URLs for S3") .meta({ group: "storage", order: 80 }), })

src/shared/utils/dto-omit-fields.ts

TENANT_RELATION_FIELDS
Type : unknown
Default value : ["tenantId", "tenant"] as const

src/auth/tenant/dto/tenant-response.dto.ts

TenantBaseResponseDto
Type : unknown
Default value : OmitType(TenantEntity, ["clients"] as const)

src/auth/tenant/schemas/tenant-editor-schema.bundle.ts

tenantEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "tenant", schemas: [ defineEditorSchema({ name: "CreateTenantDto", schema: CreateTenantSchema, }), defineEditorSchema({ name: "ImportTenantDto", schema: ImportTenantSchema, }), defineEditorSchema({ name: "UpdateTenantDto", schema: UpdateTenantSchema, }), defineEditorSchema({ name: "SessionStorageConfig", schema: SessionStorageConfigSchema, }), defineEditorSchema({ name: "StatusListConfig", schema: StatusListConfigSchema, }), ], })

src/shared/utils/buffer.util.ts

toBuffer
Type : unknown
Default value : (bytes: Uint8Array): Uint8Array<ArrayBuffer> => { return new Uint8Array(bytes) as unknown as Uint8Array<ArrayBuffer>; }

Helper to convert Uint8Array to Uint8Array This is needed due to TypeScript version differences where newer TS versions use Uint8Array which is not assignable to BufferSource.

Used primarily for mDOC operations where the

src/auth/token.decorator.ts

Token
Type : unknown
Default value : createParamDecorator( (data: unknown, ctx: ExecutionContext) => { const request = ctx.switchToHttp().getRequest(); return request.user as TokenPayload; // Access the token payload on the request object }, )

Token decorator

src/issuer/trust-list/schemas/trust-list-editor-schema.bundle.ts

trustListEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "trust-list", schemas: [ defineEditorSchema({ name: "TrustListCreateDto", schema: TrustListCreateSchema, }), ], })

src/session/dto/update-session-config.dto.ts

UpdateSessionConfigSchema
Type : unknown
Default value : z .object({ ttlSeconds: z.coerce.number().int().min(60).nullable().optional(), cleanupMode: z.enum(SessionCleanupMode).optional(), }) .strict()

src/auth/user/user.provider.ts

USERS_PROVIDER
Type : string
Default value : "USERS_PROVIDER"

src/platform/config/combined.schema.ts

VALIDATION_SCHEMA
Type : unknown
Default value : BASE_VALIDATION_SCHEMA.concat( AUTH_VALIDATION_SCHEMA, ) .concat(DB_VALIDATION_SCHEMA) .concat(CONFIG_VALIDATION_SCHEMA) .concat(LOG_VALIDATION_SCHEMA) .concat(CRYPTO_VALIDATION_SCHEMA) .concat(ISSUER_VALIDATION_SCHEMA) .concat(SESSION_VALIDATION_SCHEMA) .concat(STORAGE_VALIDATION_SCHEMA) .concat(STATUS_LIST_VALIDATION_SCHEMA) .concat(AUDIT_LOG_VALIDATION_SCHEMA) .concat(ENCRYPTION_VALIDATION_SCHEMA) .concat(VERIFIER_VALIDATION_SCHEMA) .concat(WEBHOOK_VALIDATION_SCHEMA)

Combined validation schema for the application configuration

src/issuer/issuance/oid4vci/metadata/dto/vct.dto.ts

VctSchema
Type : unknown
Default value : z .object({ vct: z.string().optional(), name: z.string().optional(), description: z.string().optional(), extends: z.string().optional(), "extends#integrity": z.string().optional(), schema_uri: z.string().optional(), "schema_uri#integrity": z.string().optional(), }) .strict()

src/verifier/verifier-validation.schema.ts

VERIFIER_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ VP_REMOVE_TA: Joi.boolean() .default(false) .description( "If true, strip trusted_authorities from the DCQL query sent to wallets in OID4VP authorization requests. Use this as an escape hatch for wallets that do not yet handle trusted_authorities correctly.", ) .meta({ group: "verifier", order: 10 }), })

Validation schema for verifier / OID4VP configuration

src/webhook/webhook-validation.schema.ts

WEBHOOK_VALIDATION_SCHEMA
Type : unknown
Default value : Joi.object({ OUTBOUND_URL_ALLOW_HTTP: Joi.boolean() .optional() .description("Allow HTTP (non-TLS) for outbound webhook calls") .meta({ group: "webhook", order: 10 }), OUTBOUND_URL_ALLOW_PRIVATE_NETWORK: Joi.boolean() .optional() .description( "Allow outbound webhook calls to private, loopback, or link-local IP ranges", ) .meta({ group: "webhook", order: 20 }), OUTBOUND_URL_ALLOWED_HOSTS: Joi.string() .allow("") .optional() .description( "Comma-separated hostname allowlist for outbound webhook calls (supports exact host and subdomains)", ) .meta({ group: "webhook", order: 30 }), })

Validation schema for outbound webhook configuration

src/webhook/webhook-editor-schema.bundle.ts

webhookEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "webhook", schemas: [ defineEditorSchema({ name: "WebhookConfig", schema: WebhookConfigSchema, }), ], })

src/issuer/configuration/webhook-endpoint/schemas/webhook-endpoint-editor-schema.bundle.ts

webhookEndpointEditorSchemaBundle
Type : unknown
Default value : defineEditorSchemaBundle({ domain: "webhook-endpoint", schemas: [ defineEditorSchema({ name: "CreateWebhookEndpointDto", schema: CreateWebhookEndpointSchema, }), defineEditorSchema({ name: "UpdateWebhookEndpointDto", schema: UpdateWebhookEndpointSchema, }), ], })

results matching ""

    No results matching ""