model

type APIAuth struct {
	// JWKS holds the static JWKS Bearer token authentication configuration
	// When enabled, requests are validated against a manually configured JWKS URL
	JWKS APIAuthJWKS `yaml:"jwks"`
	// OIDC holds the OIDC Bearer token authentication configuration
	// When enabled, the JWKS endpoint is auto-discovered from the issuer's
	// .well-known/openid-configuration and Bearer JWTs are validated locally
	// The RP fields (client_id, redirect_uri, etc.) also enable the admin UI
	// login flow via OIDC redirect
	OIDC APIAuthOIDC `yaml:"oidc"`
	// Rules are SPOCP S-expression authorization rules loaded into an in-process engine.
	// All six parts (service, method, path, subject, authentic_source, scope) are mandatory
	// in every rule — use * for wildcards.
	// Rules apply regardless of whether JWKS or OIDC is the active auth method
	Rules []string `` /* 149-byte string literal not displayed */
	// RulesFile is an optional path to a file containing SPOCP rules (one per line)
	// Rules from this file are loaded in addition to the inline Rules list
	RulesFile string `yaml:"rules_file,omitempty"`
}

type APIAuthJWKS struct {
	// Enable enables static JWKS Bearer token authentication
	Enable bool `yaml:"enable" default:"false"`
	// JWKSURL is the URL of the JSON Web Key Set used to validate token signatures.
	JWKSURL string `` /* 132-byte string literal not displayed */
	// JWKSFilePath is a local file path to a JWKS JSON file used to validate token signatures.
	JWKSFilePath string `yaml:"jwks_file_path" validate:"excluded_with=JWKSURL,omitempty"`
	// Issuer is the expected "iss" claim. Tokens with a different issuer are rejected
	Issuer string `yaml:"issuer" validate:"required_if=Enable true"`
	// Audience is the expected "aud" claim. Tokens that do not contain this audience are rejected
	Audience string `yaml:"audience" validate:"required_if=Enable true"`
}

type APIAuthOIDC struct {
	// Enable enables OIDC authentication
	Enable bool `yaml:"enable" default:"false"`
	// IssuerURL is the OIDC provider's issuer URL used for discovery and "iss" claim validation.
	IssuerURL string `yaml:"issuer_url" validate:"required_if=Enable true,omitempty,url" doc_example:"\"https://auth.example.com\""`
	// Audience is the expected "aud" claim. Tokens that do not contain this audience are rejected.
	Audience string `yaml:"audience" validate:"required_if=Enable true"`
	// ClientID is the OAuth2 client identifier registered with the OIDC provider.
	ClientID string `yaml:"client_id" validate:"required_if=Enable true"`
	// ClientSecret is the OAuth2 client secret. May be empty for public clients.
	ClientSecret string `yaml:"client_secret"`
	// RedirectURI is the callback URL for the admin UI OIDC login flow.
	RedirectURI string `yaml:"redirect_uri" validate:"required_if=Enable true,omitempty,url" doc_example:"\"https://apigw.example.com/ui/callback\""`
	// Scopes are the OAuth2/OIDC scopes to request (default: ["openid"]).
	Scopes []string `yaml:"scopes"`
}

type APIAuthSecrets struct {
	OIDC OIDCAuthSecrets `yaml:"oidc,omitempty"`
}

type APIGW struct {
	// APIServer is the HTTP API server configuration
	APIServer APIServer `yaml:"api_server" validate:"required"`
	// AdminUIEnable enables the admin web UI. When false (default), the /ui routes are not registered.
	// This must be explicitly set to true to enable the admin interface.
	AdminUIEnable bool `yaml:"admin_ui_enable" default:"false"`
	// KeyConfig is the signing key configuration
	KeyConfig *pki.KeyConfig `yaml:"key_config" validate:"required"`
	// DataSources maps credential types to their data sources
	DataSources DataSources `yaml:"data_sources,omitempty" validate:"required"`
	// AuthProviders configures how users authenticate (SAML, OIDC)
	AuthProviders APIGWAuthProviders `yaml:"auth_providers,omitempty"`
	// Remotes defines named external API connections referenced by DataSources.ExternalAPI
	Remotes map[string]Remote `yaml:"remotes,omitempty" doc_key:"remote name" doc_example:"\"ladok\""`
	// Delivery groups credential delivery to wallets (OpenID4VCI, credential offers)
	Delivery APIGWDelivery `yaml:"delivery" validate:"required"`
	// IssuerMetadata holds the OpenID4VCI issuer metadata
	IssuerMetadata IssuerMetadata `yaml:"issuer_metadata" validate:"omitempty"`
	// PublicURL is the public URL of this service (must be valid HTTP/HTTPS URL)
	PublicURL string `yaml:"public_url" validate:"required,httpurl" doc_example:"\"https://issuer.sunet.se\""`
	// IssuerClient is the gRPC client config for issuer
	IssuerClient GRPCClientTLS `yaml:"issuer_client" validate:"required"`
	// RegistryClient is the gRPC client config for registry
	RegistryClient GRPCClientTLS `yaml:"registry_client" validate:"required"`
	// IdentityMappingImport configures automatic import of identity mappings from JSON files at startup.
	// When configured, APIGW reads JSON files and imports them into the
	// identity mappings collection on first startup (skipped if data already exists).
	IdentityMappingImport *IdentityMappingImport `yaml:"identity_mapping_import,omitempty"`
	// Trust holds the trust evaluation configuration for OpenID4VP credential validation.
	// When configured, credentials presented via VP are validated against a PDP.
	Trust TrustConfig `yaml:"trust,omitempty"`
	// OpenIDFederation holds the OpenID Federation entity configuration.
	// When enabled, serves /.well-known/openid-federation as a self-signed JWT.
	OpenIDFederation *openidfederation.Config `yaml:"federation,omitempty"`
	// RateLimit configures per-endpoint rate limiting for the APIGW.
	RateLimit *APIGWRateLimit `yaml:"rate_limit,omitempty"`
}

type APIGWAuthProviders struct {
	// SAML configures the SAML SP auth provider
	SAML SAMLSP `yaml:"saml,omitempty" validate:"omitempty"`
	// OIDC configures the OIDC RP auth provider
	OIDC OIDCRP `yaml:"oidc,omitempty" validate:"omitempty"`
}

type APIGWDelivery struct {
	// OpenID4VCI configures the OpenID4VCI Authorization Server for wallet credential issuance
	OpenID4VCI OAuthServer `yaml:"openid4vci" validate:"required"`
	// CredentialOffers holds credential offer wallet configurations
	CredentialOffers CredentialOffers `yaml:"credential_offers" validate:"required"`
}

type APIGWRateLimit struct {
	// TokenRequestsPerMinute is the maximum token endpoint requests per minute per IP. Default: 20
	TokenRequestsPerMinute int `yaml:"token_requests_per_minute" default:"20"`
	// CredentialRequestsPerMinute is the maximum credential endpoint requests per minute per IP. Default: 30
	CredentialRequestsPerMinute int `yaml:"credential_requests_per_minute" default:"30"`
	// DatastoreRequestsPerMinute is the maximum datastore endpoint requests per minute per IP. Default: 60
	DatastoreRequestsPerMinute int `yaml:"datastore_requests_per_minute" default:"60"`
}

type APIGWSecrets struct {
	APIServer     APIServerSecrets     `yaml:"api_server,omitempty"`
	AuthProviders AuthProvidersSecrets `yaml:"auth_providers,omitempty"`
}

type APIServer struct {
	// Addr is the listen address for the HTTP server
	Addr string `yaml:"addr" validate:"required" default:":8080"`
	// ServedByHeader sets the X-Served-By response header value for HA troubleshooting.
	// Empty (default): header is not set. "hostname": uses os.Hostname().
	// Any other value is used as-is.
	ServedByHeader string  `yaml:"served_by_header,omitempty"`
	TLS            TLS     `yaml:"tls" validate:"omitempty"`
	APIAuth        APIAuth `yaml:"api_auth"`
	CORS           *CORS   `yaml:"cors,omitempty" validate:"omitempty"`
	// TrustProxyTLS forces the Secure flag on session cookies even when TLS is not
	// enabled on this server. Use this when running behind a TLS-terminating reverse proxy.
	TrustProxyTLS bool `yaml:"trust_proxy_tls" default:"false"`
}

type APIServerSecrets struct {
	APIAuth APIAuthSecrets `yaml:"api_auth,omitempty"`
}

type AccessCertificate struct {
	// Validate enforces the WRPAC certificate profile at startup: keyUsage
	// must include nonRepudiation (contentCommitment), subjectAltName must
	// carry contact information (URI or email), and certificatePolicies must
	// contain a WRPAC policy OID. Startup fails when the certificate does
	// not conform.
	Validate bool `yaml:"validate,omitempty"`
	// AllowedPolicyOIDs optionally narrows which WRPAC certificate policy
	// OIDs are accepted, for a deployment that must assert a specific
	// assurance level (e.g. only the qualified policies). When empty, all
	// four TS 119 411-8 WRPAC policy OIDs are accepted.
	AllowedPolicyOIDs []string `yaml:"allowed_policy_oids,omitempty" doc_example:"[\"0.4.0.194118.1.3\",\"0.4.0.194118.1.4\"]"`
}

type AdminGUI struct {
	// Enable enables the admin GUI
	Enable *bool `yaml:"enable" default:"false"`
	// Username is the admin username
	Username string `yaml:"username" validate:"required_if=Enable true" default:"admin"`
	// Password is the admin password
	Password string `yaml:"password" validate:"required_if=Enable true"`
}

type AdminGUISecrets struct {
	// Password is the admin GUI login password
	Password string `yaml:"password"`
}

type AssertionConfig struct {
	// Scopes maps credential scope names to their assertion configuration
	Scopes map[string]AssertionScope `yaml:"scopes,omitempty" doc_key:"credential scope"`
}

type AssertionScope struct {
	// AuthProvider is the auth provider for this credential type (saml or oidc)
	AuthProvider string `yaml:"auth_provider" validate:"required,oneof=saml oidc"`
}

type AttributeConfig struct {
	// Claim is the target claim name (supports dot-notation for nesting)
	Claim string `yaml:"claim" validate:"required" doc_example:"\"identity.given_name\""`

	// Required indicates if this attribute must be present in the assertion/response
	Required bool `yaml:"required" default:"false"`

	// Transform is an optional transformation to apply
	// Supported: "lowercase", "uppercase", "trim", "country_alpha2", "country_alpha3"
	Transform string `yaml:"transform,omitempty" validate:"omitempty,oneof=lowercase uppercase trim country_alpha2 country_alpha3"`

	// Default is an optional default value if attribute is missing
	Default string `yaml:"default,omitempty"`

	// AsArray wraps a scalar value in a single-element array before setting the claim.
	// No-op when the value is already a slice (e.g. multi-valued OIDC claim).
	AsArray bool `yaml:"as_array,omitempty"`
}

type AttributeMapping map[string]AttributeConfig

type AuditLog struct {
	// Enable enables audit logging
	Enable bool `yaml:"enable" default:"false"`
	// Destinations is the list of log destinations (console/stdout, file path, or HTTP URL)
	Destinations []string `` /* 147-byte string literal not displayed */
	// FileSyncInterval controls fsync behavior for file destinations.
	// 0 = fsync after every write (strict durability, lower throughput).
	// >0 = periodic batched fsync at the given interval (better throughput, bounded data-loss window).
	// Has no effect on console or webhook destinations.
	FileSyncInterval time.Duration `yaml:"file_sync_interval" default:"5s"`
}

type AuthProvidersSecrets struct {
	OIDC OIDCRPSecrets `yaml:"oidc,omitempty"`
}

type AuthScopeEntry struct {
	// AuthClaims lists the identity claims to extract from this credential type.
	AuthClaims []string `yaml:"auth_claims" validate:"required,min=1" doc_example:"[given_name, family_name, birth_date]"`
}

type AuthorizationPageCSSConfig struct {
	// CustomCSS is inline CSS that will be injected into the authorization page
	// Allows deployers to override default styling without modifying templates
	CustomCSS string `yaml:"custom_css,omitempty"`

	// CSSFile is a path to an external CSS file to include
	// If both CustomCSS and CSSFile are provided, both are included
	CSSFile string `yaml:"css_file,omitempty"`

	// Theme sets predefined color scheme: "light" (default), "dark", "blue", "purple"
	Theme string `yaml:"theme,omitempty" validate:"omitempty,oneof=light dark blue purple" default:"light"`

	// PrimaryColor overrides the primary brand color
	PrimaryColor string `yaml:"primary_color,omitempty" doc_example:"\"#667eea\""`

	// SecondaryColor overrides the secondary brand color
	SecondaryColor string `yaml:"secondary_color,omitempty" doc_example:"\"#764ba2\""`

	// LogoURL provides a URL to a custom logo image
	LogoURL string `yaml:"logo_url,omitempty"`

	// Title overrides the page title (default: "Wallet Authorization")
	Title string `yaml:"title,omitempty"`

	// Subtitle overrides the page subtitle
	Subtitle string `yaml:"subtitle,omitempty"`
}

type Branding struct {
	// LogoPath is the file path to a custom logo PNG image; when empty, the built-in SUNET logo is used
	LogoPath string `yaml:"logo_path,omitempty" validate:"omitempty,image_png"`
	// FaviconPath is the file path to a custom favicon PNG image; when empty, the built-in SUNET favicon is used
	FaviconPath string `yaml:"favicon_path,omitempty" validate:"omitempty,image_png"`
}

type CORS struct {
	// AllowedOrigins is the list of allowed CORS origins
	AllowedOrigins []string `` /* 126-byte string literal not displayed */
}

type Cfg struct {
	Common   *Common   `yaml:"common"`
	APIGW    *APIGW    `yaml:"apigw" validate:"omitempty"`
	Issuer   *Issuer   `yaml:"issuer" validate:"omitempty"`
	Verifier *Verifier `yaml:"verifier" validate:"omitempty"`
	Registry *Registry `yaml:"registry" validate:"omitempty"`
}

type Common struct {
	// Production enables production mode
	Production *bool `yaml:"production" default:"true"`
	// Log is the logging configuration
	Log Log `yaml:"log"`
	// Mongo is the MongoDB configuration
	Mongo Mongo `yaml:"mongo" validate:"omitempty"`
	// SQL is the relational database configuration, used by services that
	// support a relational storage backend as an alternative to MongoDB.
	SQL sqlstore.SQL `yaml:"sql" validate:"omitempty"`
	// Tracing is the OpenTelemetry tracing configuration
	Tracing OTEL `yaml:"tracing" validate:"omitempty"`
	// Metrics is the OpenTelemetry metrics configuration
	Metrics OTEL `yaml:"metrics" validate:"omitempty"`
	// Kafka is the Kafka message broker configuration
	Kafka Kafka `yaml:"kafka" validate:"omitempty"`
	// SecretFilePath is the path to a separate YAML file containing secrets; when set, secret values in config.yaml are cleared and only non-empty fields from the secrets file are applied.
	SecretFilePath string `yaml:"secret_file_path,omitempty" doc_example:"\"/etc/vc/secrets.yaml\""`
	// SkipSecretsPermCheck disables file permission validation on the secrets file. Required for platforms like Fly.io that mount files as 0755.
	SkipSecretsPermCheck bool `yaml:"skip_secrets_perm_check" default:"false"`
	// HA configures high-availability mode. When Enable is true, caches use MongoDB
	// (Common.Mongo.URI) instead of in-memory storage so state is shared across instances.
	HA HAConfig `yaml:"ha" validate:"omitempty"`
	// CredentialRegistry configures an optional TS11 credential metadata
	// registry client, used as an add-on to (not a replacement for) the
	// existing vctm_file_path/vctm_url/mddl_file_path/mddl_url per-scope
	// configuration: disabled by default, so existing deployments are
	// unaffected until this is explicitly enabled and at least one scope
	// sets vct or doctype instead of a file/URL.
	CredentialRegistry CredentialRegistry `yaml:"credential_registry" validate:"omitempty"`

	// Branding holds custom branding configuration (logo and favicon paths)
	Branding Branding `yaml:"branding"`

	// CredentialMetadata maps OAuth2 scope values to their credential configuration, required by apigw, issuer, and verifier
	// Key: OAuth2 scope (e.g., "pid", "ehic", "diploma") - matches AuthorizationContext.Scope
	// Each entry contains the VCTM reference, format, and other configuration for that credential type
	CredentialMetadata map[string]*CredentialMetadata `yaml:"credential_metadata" validate:"omitempty,dive" doc_key:"credential scope"`
}

type CommonSecrets struct {
	Mongo MongoSecrets `yaml:"mongo,omitempty"`
	SQL   SQLSecrets   `yaml:"sql,omitempty"`
}

type CompleteDocument struct {
	Meta               *MetaData      `json:"meta,omitempty" bson:"meta" validate:"required"`
	IdentityMappingIDs []string       `json:"identity_mapping_ids,omitempty" bson:"identity_mapping_ids" validate:"required,min=1"`
	DocumentData       map[string]any `json:"document_data,omitempty" bson:"document_data" validate:"required"`
}

type CredentialDisplayConfig struct {
	// Enable allows users to optionally view credential details before completing authorization
	// When enabled, a checkbox appears on the authorization page
	Enable bool `yaml:"enable" default:"false"`

	// RequireConfirmation forces users to review credentials before proceeding
	// When true, the credential display step is mandatory (checkbox is pre-checked and disabled)
	RequireConfirmation bool `yaml:"require_confirmation" default:"false"`

	// ShowRawCredential displays the raw VP token/credential in the display page
	// Useful for debugging and technical users
	ShowRawCredential bool `yaml:"show_raw_credential" default:"false"`

	// ShowClaims displays the parsed claims that will be sent to the RP
	// Recommended for transparency and user consent
	ShowClaims *bool `yaml:"show_claims" default:"true"`

	// AllowEdit allows users to redact certain claims before sending to RP (future feature)
	// Currently not implemented
	AllowEdit bool `yaml:"allow_edit,omitempty" default:"false"`
}

type CredentialMetadata struct {
	// VCTMFilePath is the path to a local VCTM JSON file.
	// When set, apigw will publish the VCTM at /type-metadata/:scope.
	// Used for every format except mso_mdoc.
	VCTMFilePath string `yaml:"vctm_file_path" json:"-" validate:"required_without_all=VCTMUrl MDDLFilePath MDDLUrl VCT Doctype"`
	// VCTMUrl is the URL where the VCTM is already published externally.
	// When set, the VCTM is fetched from this URL at startup for internal use
	// but NOT re-published by apigw.
	// Used for every format except mso_mdoc.
	VCTMUrl string `yaml:"vctm_url" json:"-" validate:"required_without_all=VCTMFilePath MDDLFilePath MDDLUrl VCT Doctype,omitempty,url"`

	// VCT is the vct claim value to resolve via Common.CredentialRegistry
	// (a TS11 registry client), used only when neither VCTMFilePath nor
	// VCTMUrl is set. Requires Common.CredentialRegistry.Enable - this
	// field being present in a scope's config does not itself turn
	// registry lookups on. Used for every format except mso_mdoc.
	VCT string `yaml:"vct,omitempty" json:"-" validate:"required_without_all=VCTMFilePath VCTMUrl MDDLFilePath MDDLUrl Doctype"`

	VCTM *sdjwtvc.VCTM `yaml:"-" json:"-"`

	// MDDLFilePath is the path to a local MDDL (mso_mdoc) schema JSON file,
	// as produced by registry-cli's mddl format generator.
	MDDLFilePath string `yaml:"mddl_file_path" json:"-" validate:"required_without_all=VCTMFilePath VCTMUrl MDDLUrl VCT Doctype"`
	// MDDLUrl is the URL where the MDDL schema is already published
	// externally. The mso_mdoc analogue of vctm_url.
	MDDLUrl string `yaml:"mddl_url" json:"-" validate:"required_without_all=VCTMFilePath VCTMUrl MDDLFilePath VCT Doctype,omitempty,url"`

	// Doctype is the mdoc doctype value to resolve via
	// Common.CredentialRegistry, used only when neither MDDLFilePath nor
	// MDDLUrl is set. Requires Common.CredentialRegistry.Enable, same as
	// VCT. Used only for mso_mdoc.
	Doctype string `yaml:"doctype,omitempty" json:"-" validate:"required_without_all=VCTMFilePath VCTMUrl MDDLFilePath MDDLUrl VCT"`

	MDDL *mdoc.MDDLSchema `yaml:"-" json:"-"`

	// MDDLRaw holds the raw JSON bytes of the MDDL document, passed inline
	// to the issuer at issuance time (mirrors VCTMRaw/VCTM for sd-jwt).
	MDDLRaw []byte `yaml:"-" json:"-"`

	// Format is the credential format to issue
	Format string `yaml:"format" json:"format" validate:"required" default:"dc+sd-jwt" doc_example:"\"dc+sd-jwt\""`
	// DisclosurePolicy configures the embedded disclosure policy for this credential type.
	// Per ARF 3.0 §6.6.2.8 and CIR 2024/2979 Annex III. Only applicable to QEAAs and PuB-EAAs (not PIDs).
	// When omitted, the metadata publishes policy_type "none" (no restrictions).
	DisclosurePolicy *openid4vci.EmbeddedDisclosurePolicy `yaml:"disclosure_policy,omitempty" json:"-" validate:"omitempty"`
	// Attributes maps claim names to their source fields and transformation rules for credential issuance
	Attributes map[string]map[string][]*string `yaml:"attributes" json:"attributes_v2" validate:"omitempty,dive,required"`

	// VCTMRaw holds the raw JSON bytes of the VCTM document for serving
	// via /type-metadata/:scope. Only populated for local VCTMs (VCTMFilePath).
	VCTMRaw []byte `yaml:"-" json:"-"`

	// Integrity is the SRI hash of the VCTM or MDDL document (e.g. "sha256-...").
	// Computed once in LoadCredentialSchema and used for vct#integrity in issued credentials.
	Integrity string `yaml:"-" json:"-"`

	// VCTURL is the published URL where the VCTM is served.
	// Set by ResolveVCTUrls for both local and external VCTMs.
	VCTURL string `yaml:"-" json:"-"`
	// contains filtered or unexported fields
}

type CredentialOfferWallets struct {
	// Label is the display label for the wallet
	Label string `yaml:"label" validate:"required"`
	// RedirectURI is the wallet redirect URI
	RedirectURI string `yaml:"redirect_uri" validate:"required" doc_example:"\"eudi-wallet://credential-offer\""`
}

type CredentialOffers struct {
	// IssuerURL is the issuer URL for credential offers
	IssuerURL string `yaml:"issuer_url" validate:"required"`
	// Wallets holds wallet redirect configurations
	Wallets map[string]CredentialOfferWallets `yaml:"wallets" validate:"required" doc_key:"wallet name"`
}

type CredentialRegistry struct {
	// Enable turns on registry-backed resolution for any scope that sets
	// vct or doctype instead of a local file/URL. Existing
	// vctm_file_path/vctm_url/mddl_file_path/mddl_url-configured scopes
	// are entirely unaffected either way.
	Enable bool `yaml:"enable" default:"false"`
	// Registries is an ordered list of logical (independent) registries.
	// A later entry overrides an earlier one for the same vct/doctype.
	// Required if Enable is true.
	Registries []CredentialRegistryLogical `yaml:"registries" validate:"required_if=Enable true,omitempty,dive"`
	// RefreshInterval controls how long a registry's discovery index is
	// trusted before being re-fetched. Zero means fetch once and cache
	// forever for the lifetime of this process.
	RefreshInterval time.Duration `yaml:"refresh_interval" default:"1h"`
}

type CredentialRegistryEndpoint struct {
	// BaseURL is the registry's origin, e.g. "https://registry.siros.org".
	BaseURL string `yaml:"base_url" validate:"required,url" doc_example:"\"https://registry.siros.org\""`
	// Timeout bounds each HTTP request to this registry.
	Timeout time.Duration `yaml:"timeout" default:"10s"`
}

type CredentialRegistryLogical struct {
	// Mirrors is the set of endpoints serving this logical registry's
	// content. At least one is required.
	Mirrors []CredentialRegistryEndpoint `yaml:"mirrors" validate:"required,min=1,dive"`
}

type CredentialSource struct {
	DataSource   DataSourceType
	AuthProvider string
	RemoteName   string // only for external_api
}

type DataSourceType string

type DataSources struct {
	// Datastore configures credential types backed by a pre-loaded datastore (e.g. MongoDB)
	Datastore DatastoreConfig `yaml:"datastore,omitempty"`

	// Assertion configures credential types backed by authentication assertions
	// (SAML attributes or OIDC claims)
	Assertion AssertionConfig `yaml:"assertion,omitempty"`

	// ExternalAPI configures credential types backed by an external API
	// Each credential references a named remote defined in APIGW.Remotes
	ExternalAPI ExternalAPIConfig `yaml:"external_api,omitempty"`
}

type DatastoreConfig struct {
	// Scopes maps credential scope names to their datastore configuration
	Scopes map[string]DatastoreScope `yaml:"scopes,omitempty" doc_key:"credential scope"`

	// Import configures automatic data import from JSON files at startup.
	// When configured, APIGW reads JSON files and imports them into the
	// datastore on first startup (skipped if data already exists).
	Import *DatastoreImport `yaml:"import,omitempty"`
}

type DatastoreImport struct {
	// FilePaths lists JSON files to import into the datastore.
	// Each JSON file should contain a map of person IDs to CompleteDocument objects.
	// Import is skipped if the datastore already contains data.
	FilePaths []string `yaml:"file_paths" validate:"required,min=1" doc_example:"[\"./bootstrapping/pid.json\", \"./bootstrapping/ehic.json\"]"`

	// Users limits which person IDs to import. If empty, all persons are imported.
	Users []string `yaml:"users,omitempty" doc_example:"[\"100\", \"102\"]"`
}

type DatastoreScope struct {
	// AuthProvider is the auth provider for this credential type (openid4vp, saml, or oidc)
	AuthProvider string `yaml:"auth_provider" validate:"required,oneof=openid4vp saml oidc"`

	// AuthClaims lists the normalized claim names used for datastore identity lookup
	// when auth_provider is saml or oidc. Not used for openid4vp (use AuthScopes instead).
	// These names must match the BSON field names under "identities." in the datastore.
	// Use attribute_mappings (in auth_providers) to normalize provider-specific attribute
	// names (e.g. SAML urn:oid:2.5.4.42, eIDAS date_of_birth) to these canonical names.
	// Available identity fields: given_name, family_name, birth_date, birth_place,
	// authentic_source_person_id, personal_administrative_number.
	AuthClaims []string `yaml:"auth_claims,omitempty" doc_example:"[given_name, family_name, birth_date]"`

	// AuthScopes maps credential scope keys to their per-scope authentication config.
	// Used only for openid4vp: the wallet must present a credential matching any one
	// of the listed scopes (OR logic). Each entry specifies which claims to extract
	// from that particular credential type.
	AuthScopes map[string]AuthScopeEntry `yaml:"auth_scopes,omitempty"`
}

type DigitalCredentialsConfig struct {
	// Enable toggles W3C Digital Credentials API support in browser
	Enable bool `yaml:"enable" default:"false"`

	// UseJAR enables JWT Authorization Request (JAR) for wallet communication
	// When true, request objects are signed JWTs instead of plain JSON
	UseJAR bool `yaml:"use_jar" default:"false"`

	// PreferredFormats specifies the order of preference for credential formats
	// Supported values: "vc+sd-jwt", "dc+sd-jwt", "mso_mdoc"
	// Default: ["vc+sd-jwt", "dc+sd-jwt", "mso_mdoc"]
	PreferredFormats []string `yaml:"preferred_formats,omitempty" default:"[\"vc+sd-jwt\", \"dc+sd-jwt\", \"mso_mdoc\"]"`

	// ResponseMode specifies the OpenID4VP response mode for DC API flows
	// Supported values: "dc_api.jwt" (encrypted), "direct_post.jwt" (signed), "direct_post"
	// Default: "dc_api.jwt"
	ResponseMode string `yaml:"response_mode,omitempty" validate:"omitempty,oneof=dc_api.jwt direct_post.jwt direct_post" default:"dc_api.jwt"`

	// AllowQRFallback enables automatic fallback to QR code if DC API is unavailable
	// Default: true
	AllowQRFallback *bool `yaml:"allow_qr_fallback" default:"true"`

	// DeepLinkScheme for mobile wallet integration
	DeepLinkScheme string `yaml:"deep_link_scheme,omitempty" doc_example:"\"eudi-wallet://\""`
}

type Document struct {
	Meta         *MetaData `json:"meta,omitempty" bson:"meta" validate:"required"`
	DocumentData any       `json:"document_data" bson:"document_data" validate:"required"`
}

type DocumentList struct {
	Meta *MetaData `json:"meta,omitempty" bson:"meta" validate:"required"`
}

type ExternalAPIConfig struct {
	// Scopes maps credential scope names to their external API configuration
	Scopes map[string]ExternalAPIScope `yaml:"scopes,omitempty" doc_key:"credential scope"`
}

type ExternalAPIScope struct {
	// Remote is the name of a remote defined in Remotes
	Remote string `yaml:"remote" validate:"required"`

	// AuthProvider is the auth provider to identify the user (saml or oidc)
	AuthProvider string `yaml:"auth_provider" validate:"required,oneof=saml oidc"`

	// AttributeMapping defines how to map API response data to credential claims
	AttributeMapping AttributeMapping `yaml:"attribute_mapping,omitempty" doc_key:"attribute"`
}

type GRPCClientTLS struct {
	// Addr is the gRPC server address
	Addr string `yaml:"addr" validate:"required" doc_example:"\"issuer:8090\""`
	// TLS enables TLS
	TLS bool `yaml:"tls" default:"false"`
	// CertFilePath is the client certificate for mTLS
	CertFilePath string `yaml:"cert_file_path"`
	// KeyFilePath is the client private key for mTLS
	KeyFilePath string `yaml:"key_file_path"`
	// CAFilePath is the CA certificate to verify the server
	CAFilePath string `yaml:"ca_file_path"`
	// ServerName is the server name for TLS verification (optional)
	ServerName string `yaml:"server_name"`
}

type GRPCServer struct {
	// Addr is the gRPC server listen address
	Addr string `yaml:"addr" validate:"required" default:":8090"`
	// TLS holds the mTLS configuration
	TLS GRPCTLS `yaml:"tls,omitempty"`
}

type GRPCTLS struct {
	Enable                    bool              `yaml:"enable" default:"false"`
	CertFilePath              string            `yaml:"cert_file_path" validate:"required_if=Enable true" default:"/pki/grpc_server.crt"` // Server certificate
	KeyFilePath               string            `yaml:"key_file_path" validate:"required_if=Enable true" default:"/pki/grpc_server.key"`  // Server private key
	ClientCAPath              string            `yaml:"client_ca_path" validate:"required_if=Enable true" default:"/pki/client_ca.crt"`   // CA to verify client certificates (for mTLS)
	AllowedClientFingerprints map[string]string `yaml:"allowed_client_fingerprints" doc_example:"a1b2c3...: issuer-prod"`                 // SHA256 fingerprint -> friendly name
	AllowedClientDNs          map[string]string `yaml:"allowed_client_dns" doc_example:"apigw-prod: CN=apigw,O=SUNET"`                    // Friendly name -> Certificate Subject DN
}

type HAConfig struct {
	// Enable enables HA mode; when true caches are backed by MongoDB instead of in-memory storage.
	Enable bool `yaml:"enable" default:"false"`
	// CacheDatabaseName is the MongoDB database name used for caches.
	CacheDatabaseName string `yaml:"cache_database_name" default:"vc_cache"`
}

type Identity struct {
	// required: true
	// example: 65636cbc-c03f-11ee-8dc4-67135cc9bd8a
	AuthenticSourcePersonID string `json:"authentic_source_person_id,omitempty" bson:"authentic_source_person_id" validate:"required,max=128,printascii"`

	// required: true
	// example: Svensson
	FamilyName string `json:"family_name" bson:"family_name" validate:"required,min=1,max=100,printascii"`

	// required: true
	// example: Magnus
	GivenName string `json:"given_name" bson:"given_name" validate:"required,min=1,max=100,printascii"`

	// required: true
	// example: 1970-01-01 TODO: Day, month, and year?
	BirthDate string `json:"birth_date" bson:"birth_date" validate:"required,datetime=2006-01-02,printascii"`

	// required: true
	// example: Stockholm
	BirthPlace string `json:"birth_place,omitempty" bson:"birth_place,omitempty" validate:"omitempty,min=2,max=100,printascii"`

	// required: true
	// example: SE
	Nationality []string `json:"nationality,omitempty" bson:"nationality,omitempty" validate:"omitempty,dive,iso3166_1_alpha2"`

	// required: false
	// example: <personnummer>
	PersonalAdministrativeNumber string `` /* 140-byte string literal not displayed */

	// required: false
	// example: facial image compliant with ISO 19794-5 or ISO 39794 specifications
	Picture string `json:"picture,omitempty" bson:"picture,omitempty"`

	BirthFamilyName string `json:"birth_family_name,omitempty" bson:"birth_family_name,omitempty" validate:"omitempty,min=1,max=100,printascii"`

	BirthGivenName string `json:"birth_given_name,omitempty" bson:"birth_given_name,omitempty" validate:"omitempty,min=1,max=100,printascii"`

	// required: false
	// example: 0 = not known, 1 = male, 2 = female, ...
	Sex string `json:"sex,omitempty" bson:"sex,omitempty" validate:"omitempty,oneof=0 1 2 3 4 5 6 7 8 9"`

	// required: false
	// example: <email-address>
	EmailAddress string `json:"email_address,omitempty" bson:"email_address,omitempty" validate:"omitempty,email"`

	// required: false
	// example: <+mobile-phone-number>
	MobilePhoneNumber string `json:"mobile_phone_number,omitempty" bson:"mobile_phone_number,omitempty" validate:"omitempty,e164"`

	// required: false
	// example: 221b Baker street
	ResidentAddress string `json:"resident_address,omitempty" bson:"resident_address,omitempty" validate:"omitempty,printascii"`

	// required: false
	// example: Baker street
	ResidentStreetAddress string `` /* 127-byte string literal not displayed */

	// required: false
	// example: 221b
	ResidentHouseNumber string `json:"resident_house_number,omitempty" bson:"resident_house_number,omitempty" validate:"omitempty,printascii"`

	// required: false
	// example: W1U 6SG
	ResidentPostalCode string `json:"resident_postal_code,omitempty" bson:"resident_postal_code,omitempty" validate:"omitempty,printascii"`

	// required: false
	// example: London
	ResidentCity string `json:"resident_city,omitempty" bson:"resident_city,omitempty" validate:"omitempty,printascii"`
	// required: false
	// example: england
	ResidentState string `json:"resident_state,omitempty" bson:"resident_state,omitempty" validate:"omitempty,printascii"`
	// required: false
	// example: England
	ResidentCountry string `json:"resident_country,omitempty" bson:"resident_country,omitempty" validate:"omitempty,iso3166_1_alpha2"`

	AgeOver14 string `json:"age_over_14,omitempty" bson:"age_over_14,omitempty"`

	AgeOver16 bool `json:"age_over_16,omitempty" bson:"age_over_16,omitempty"`

	AgeOver18 bool `json:"age_over_18,omitempty" bson:"age_over_18,omitempty"`

	AgeOver21 bool `json:"age_over_21,omitempty" bson:"age_over_21,omitempty"`

	AgeOver65 bool `json:"age_over_65,omitempty" bson:"age_over_65,omitempty"`

	AgeInYears int `json:"age_in_years,omitempty" bson:"age_in_years,omitempty"`

	AgeBirthYear int `json:"age_birth_year,omitempty" bson:"age_birth_year,omitempty"`

	// required: false
	// example:
	IssuingAuthority string `json:"issuing_authority,omitempty" bson:"issuing_authority,omitempty" validate:"omitempty,printascii"`
	// required: false
	// example:
	IssuingCountry string `json:"issuing_country,omitempty" bson:"issuing_country,omitempty" validate:"omitempty,iso3166_1_alpha2"`

	// required: false
	// example: Date (and if possible time)
	ExpiryDate string `json:"expiry_date,omitempty" bson:"expiry_date,omitempty" validate:"omitempty,datetime=2006-01-02"`

	IssuanceDate string `json:"issuance_date,omitempty" bson:"issuance_date,omitempty"`

	// required: false
	// example:
	DocumentNumber string `json:"document_number,omitempty" bson:"document_number,omitempty" validate:"omitempty,max=128,printascii"`

	// required: false
	// example:
	IssuingJurisdiction string `json:"issuing_jurisdiction,omitempty" bson:"issuing_jurisdiction,omitempty" validate:"omitempty,max=128,printascii"`
}

type IdentityMapping struct {
	// AuthenticSourcePersonID is the unique identifier for this entity within the authentic source
	AuthenticSourcePersonID string `json:"authentic_source_person_id" bson:"authentic_source_person_id" validate:"required,max=128,printascii"`

	// AuthenticSource is the source system that owns this identity
	AuthenticSource string `json:"authentic_source" bson:"authentic_source" validate:"required,max=128,printascii"`

	// Attributes holds identity attributes used for resolution (e.g. family_name, given_name, birth_date)
	Attributes map[string]string `json:"attributes,omitempty" bson:"attributes" validate:"omitempty,dive,keys,safe_key,endkeys"`

	// CreatedAt is the timestamp when the mapping was created
	CreatedAt time.Time `json:"created_at" bson:"created_at"`
}

type IdentityMappingImport struct {
	// FilePaths lists JSON files containing identity mappings to import.
	// Each JSON file should contain a map of person IDs to arrays of IdentityMapping objects.
	// Import is skipped if the identity mappings collection already contains data.
	FilePaths []string `yaml:"file_paths" validate:"required,min=1" doc_example:"[\"./bootstrapping/identity_mappings.json\"]"`

	// Users limits which person IDs to import. If empty, all persons are imported.
	Users []string `yaml:"users,omitempty" doc_example:"[\"100\", \"102\"]"`
}

type Issuer struct {
	// APIServer is the HTTP API server configuration
	APIServer APIServer `yaml:"api_server" validate:"required"`
	// GRPCServer is the gRPC server configuration
	GRPCServer GRPCServer `yaml:"grpc_server" validate:"required"`
	// KeyConfig is the signing key configuration
	KeyConfig *pki.KeyConfig `yaml:"key_config" validate:"required"`
	// JWTAttribute holds the JWT credential attribute configuration
	JWTAttribute JWTAttribute `yaml:"jwt_attribute" validate:"required"`
	// IssuerURL is the issuer identifier URL
	IssuerURL string `yaml:"issuer_url" validate:"required" doc_example:"\"https://issuer.sunet.se\""`
	// RegistryClient is the registry gRPC client config
	RegistryClient GRPCClientTLS `yaml:"registry_client" validate:"omitempty"`
	// MDoc holds mDL/mdoc configuration
	MDoc *MDocConfig `yaml:"mdoc" validate:"omitempty"`
	// AuditLog holds audit log configuration
	AuditLog *AuditLog `yaml:"audit_log" validate:"omitempty"`
	// SignMetadataRateLimit configures the rate limiter for the SignMetadata gRPC endpoint.
	// In HA setups each APIGW node refreshes two documents (VCI+OAuth2), so the defaults
	// should accommodate the expected cluster size. Default: 2 req/s, burst 20.
	SignMetadataRateLimit SignMetadataRateLimitConfig `yaml:"sign_metadata_rate_limit"`
	// PseudonymSeed, if true, makes the issuer attach a random seed as the pseudonym_seed claim.
	PseudonymSeed *bool `yaml:"pseudonym_seed" validate:"omitempty"`
	// AccessCertificate configures the EUDI access certificate (WRPAC) the issuer presents to wallets, optionally with its own key separate from KeyConfig. Off by default; deployments outside an ARF trust framework are unaffected.
	AccessCertificate *IssuerAccessCertificate `yaml:"access_certificate,omitempty"`
}

type IssuerAccessCertificate struct {
	// Validate enforces the WRPAC certificate profile at startup: keyUsage
	// must include nonRepudiation (contentCommitment), subjectAltName must
	// carry contact information (URI or email), and certificatePolicies must
	// contain a WRPAC policy OID. Startup fails when the certificate does
	// not conform.
	Validate bool `yaml:"validate,omitempty"`
	// AllowedPolicyOIDs optionally narrows which WRPAC certificate policy
	// OIDs are accepted, for a deployment that must assert a specific
	// assurance level. When empty, all four TS 119 411-8 WRPAC policy OIDs
	// are accepted.
	AllowedPolicyOIDs []string `yaml:"allowed_policy_oids,omitempty" doc_example:"[\"0.4.0.194118.1.3\",\"0.4.0.194118.1.4\"]"`
	// KeyConfig is the signing key and certificate chain for the access
	// certificate. When set, issuer metadata is signed with this key and
	// the chain is advertised in the JWT's x5c header; credentials continue
	// to be signed with Issuer.KeyConfig.
	KeyConfig *pki.KeyConfig `yaml:"key_config,omitempty" validate:"omitempty"`
}

type IssuerMetadata struct {
	// RegistrationCertificate optionally points at a Registrar-issued WRPRC to advertise in the issuer_info metadata parameter, attesting what this Credential Issuer is registered to provide.
	//
	// Under CIR (EU) 2025/848 a PID or attestation provider is a registered
	// wallet-relying party in its own right, so the document is the same kind
	// a verifier presents in verifier_info - see Verifier.RegistrationCertificate.
	// The signature and the issuing chain are verified at startup, exactly as
	// on the verifier. The ARF RPRC_16 binding is not: it compares this
	// document against the presenting party's access certificate, which the
	// issuer service holds rather than the apigw, and the rule is not settled
	// enough to justify a cross-service check. A correctly-signed certificate
	// naming a different organisation would therefore be accepted, so
	// configure one that describes this deployment.
	//
	// Left unset by deployments outside an ARF trust framework.
	RegistrationCertificate *RegistrationCertificate `yaml:"registration_certificate,omitempty"`
	// AuthorizationServers lists the authorization server URLs
	AuthorizationServers []string `yaml:"authorization_servers" validate:"omitempty"`
	// DeferredCredentialEndpoint is the deferred credential endpoint
	DeferredCredentialEndpoint string `yaml:"deferred_credential_endpoint" validate:"omitempty"`
	// NotificationEndpoint is the notification endpoint
	NotificationEndpoint string `yaml:"notification_endpoint" validate:"omitempty"`
	// CryptographicBindingMethodsSupported lists the supported binding methods
	CryptographicBindingMethodsSupported []string `yaml:"cryptographic_binding_methods_supported" validate:"omitempty"`
	// CredentialSigningAlgValuesSupported lists the supported signing algorithms
	CredentialSigningAlgValuesSupported []string `yaml:"credential_signing_alg_values_supported" validate:"omitempty"`
	// ProofSigningAlgValuesSupported lists the supported proof algorithms
	ProofSigningAlgValuesSupported []string `yaml:"proof_signing_alg_values_supported" validate:"omitempty"`
	// CredentialResponseEncryption holds the response encryption configuration
	CredentialResponseEncryption *openid4vci.MetadataCredentialResponseEncryption `yaml:"credential_response_encryption" validate:"omitempty"`
	// BatchCredentialIssuance holds the batch issuance configuration
	BatchCredentialIssuance *openid4vci.BatchCredentialIssuance `yaml:"batch_credential_issuance" validate:"omitempty"`
	// Display holds the display metadata
	Display []openid4vci.MetadataDisplay `yaml:"display" validate:"omitempty"`
	// MdocIacasURI is the URL where IACA certificates are published for mDOC verification.
	// When configured, this is included in .well-known/openid-credential-issuer metadata
	// so verifiers can dynamically discover trust anchors for ISO 18013-5 credentials.
	MdocIacasURI string `yaml:"mdoc_iacas_uri" validate:"omitempty,url"`
}

type JWTAttribute struct {
	// Issuer of the token
	Issuer string `yaml:"issuer" validate:"required" doc_example:"https://issuer.sunet.se"`

	// StaticHost is the static host of the issuer, expose static files, like pictures.
	StaticHost string `yaml:"static_host" validate:"omitempty"`

	// EnableNotBefore states the time not before which the token is valid
	EnableNotBefore bool `yaml:"enable_not_before" default:"false"`

	// Valid duration of the token in seconds
	ValidDuration int64 `yaml:"valid_duration" validate:"required_with=EnableNotBefore" default:"3600"`

	// VerifiableCredentialType URL
	VerifiableCredentialType string `yaml:"verifiable_credential_type" validate:"required" doc_example:"https://credential.sunet.se/identity_credential"`

	// Status status of the Verifiable Credential
	Status string `yaml:"status"`

	// Kid key id of the signing key
	Kid string `yaml:"kid"`
}

type Kafka struct {
	// Enable enables Kafka integration
	Enable bool `yaml:"enable" default:"false"`
	// Brokers is the list of Kafka broker addresses
	Brokers []string `yaml:"brokers" validate:"required_if=Enable true" doc_example:"[\"kafka0:9092\", \"kafka1:9092\"]"`
	// SASL configures SASL authentication for Kafka connections
	SASL *KafkaSASL `yaml:"sasl,omitempty"`
	// MTLS configures mutual TLS (mTLS) for Kafka broker connections
	MTLS MTLS `yaml:"mtls" validate:"omitempty"`
}

type KafkaSASL struct {
	// Enable activates SASL authentication
	Enable bool `yaml:"enable" default:"false"`
	// Mechanism is the SASL mechanism (PLAIN, SCRAM-SHA-256, SCRAM-SHA-512)
	Mechanism string `yaml:"mechanism" validate:"required_if=Enable true,omitempty,oneof=PLAIN SCRAM-SHA-256 SCRAM-SHA-512" default:"SCRAM-SHA-512"`
	// Username is the SASL username
	Username string `yaml:"username" validate:"required_if=Enable true"`
	// Password is the SASL password
	Password string `yaml:"password" validate:"required_if=Enable true"`
}

type LoadedRegistrationCertificate struct {
	// JWT is the compact rc-wrp+jwt exactly as issued by the Registrar.
	JWT string
	// Format is the verifier_info format identifier to advertise.
	Format string
	// Claims is what the Registrar attested, extracted after the signature
	// was verified. Always populated for a successfully loaded certificate.
	Claims *WRPRCClaims
	// TrustEvaluated reports whether the issuing chain was actually checked
	// against configured Registrar roots. False means the document is
	// authentic but nothing establishes that we accept its issuer.
	TrustEvaluated bool
}

type Log struct {
	// FolderPath is the path to the log folder
	FolderPath string `yaml:"folder_path" doc_example:"\"/var/log/vc\""`
}

type MDocConfig struct {
	// CertificateChainPath is the path to the PEM certificate chain
	// TODO(pki): Consider folding into pki.KeyConfig.ChainPath to unify certificate
	// chain loading with the standard key material configuration pattern.
	CertificateChainPath string `yaml:"certificate_chain_path" validate:"required"`
	// DefaultValidity is the default credential validity (default: 365 days)
	DefaultValidity time.Duration `yaml:"default_validity" default:"8760h"`
	// DigestAlgorithm is the digest algorithm: "SHA-256", "SHA-384", or "SHA-512"
	DigestAlgorithm string `yaml:"digest_algorithm" default:"SHA-256"`
}

type MTLS struct {
	// Enable enables mTLS for the connection
	Enable bool `yaml:"enable" default:"false"`
	// CACertPath is the path to a CA certificate for verifying the remote peer (optional; uses system roots if empty)
	CACertPath string `yaml:"ca_cert_path,omitempty"`
	// CertFilePath is the path to a client certificate for mutual authentication
	CertFilePath string `yaml:"cert_file_path" validate:"required_if=Enable true"`
	// KeyFilePath is the path to the client private key
	KeyFilePath string `yaml:"key_file_path" validate:"required_if=Enable true"`
	// InsecureSkipVerify disables certificate verification (TESTING ONLY — never use in production)
	InsecureSkipVerify bool `yaml:"insecure_skip_verify" default:"false"`
}

type MariaDBSecrets struct {
	// Password is the MariaDB connection password
	Password string `yaml:"password"`
}

type MetaData struct {
	// required: true
	// example: SUNET
	AuthenticSource string `json:"authentic_source,omitempty" bson:"authentic_source" validate:"required,max=128,printascii"`

	// Scope is the credential configuration ID scope
	// required: false
	// example: "ehic", "pda1"
	Scope string `json:"scope,omitempty" bson:"scope" validate:"required,max=128,printascii"`

	// required: false
	// example: 5e7a981c-c03f-11ee-b116-9b12c59362b9
	DocumentID string `json:"document_id,omitempty" bson:"document_id" validate:"omitempty,max=128,printascii"`

	// required: false
	// example: file://path/to/schema.json or http://example.com/schema.json
	// format: string
	DocumentDataValidationRef string `json:"document_data_validation,omitempty" bson:"document_data_validation" validate:"omitempty,max=128,printascii"`

	// CreatedAt is the timestamp when the document was created
	CreatedAt time.Time `json:"created_at" bson:"created_at"`

	// ValidNotAfter is an optional expiration timestamp for administrative purposes.
	// Documents past this time should not be used.
	ValidNotAfter *time.Time `json:"valid_not_after,omitempty" bson:"valid_not_after,omitempty"`
}

type Mongo struct {
	// URI is the MongoDB connection URI. Required when Common.SQL.Backend is
	// "mongo" (the default primary-store backend) or when Common.HA.Enable is
	// true (pkg/cache has no relational backend yet, so HA caching always
	// uses Mongo regardless of the primary store's backend). Enforced by a
	// Common-level struct validation rather than a plain "required" tag here,
	// since the requirement depends on sibling fields of Common, not of Mongo.
	URI string `yaml:"uri" validate:"omitempty" doc_example:"\"mongodb://user:password@mongo:27017/vc\""`
	// TLS enables TLS for the MongoDB connection.
	// Can also be enabled via the connection URI parameter "tls=true".
	TLS bool `yaml:"tls" default:"false"`
	// CAFilePath is the path to a PEM-encoded CA certificate used to verify
	// the MongoDB server's certificate. When empty, the system root CAs are used.
	CAFilePath string `yaml:"ca_file_path" validate:"omitempty"`
	// CertFilePath is the path to a PEM-encoded client certificate for mutual TLS (mTLS).
	CertFilePath string `yaml:"cert_file_path" validate:"required_with=KeyFilePath"`
	// KeyFilePath is the path to a PEM-encoded client private key for mutual TLS (mTLS).
	KeyFilePath string `yaml:"key_file_path" validate:"required_with=CertFilePath"`
}

type MongoSecrets struct {
	// URI is the MongoDB connection string, which may include authentication credentials
	URI string `yaml:"uri"`
}

type OAuthServer struct {
	// TokenEndpoint is the OAuth2 token endpoint URL
	TokenEndpoint string `yaml:"token_endpoint" validate:"required" doc_example:"\"https://verifier.sunet.se/token\""`
	// Clients holds the OAuth2 client configurations
	Clients oauth2.Clients `yaml:"clients" validate:"required" doc_key:"client id"`
	// AllowUnverifiedClientAssertion enables accepting client_assertion (private_key_jwt)
	// WITHOUT signature verification. This is INSECURE and only intended for conformance
	// testing environments. When false (default), client_assertion is rejected.
	// TODO(security): Remove this flag once full RFC 7523 verification is implemented.
	AllowUnverifiedClientAssertion bool `yaml:"allow_unverified_client_assertion" default:"false"`
	// GrantTypes is the list of grant types this issuer supports.
	// Supported values: authorization_code, urn:ietf:params:oauth:grant-type:pre-authorized_code, refresh_token
	GrantTypes []string `` /* 239-byte string literal not displayed */
	// RefreshTokenDuration is the refresh token duration in seconds.
	// Only applicable when grant_types includes "refresh_token".
	RefreshTokenDuration int `yaml:"refresh_token_duration,omitempty" default:"86400"`
}

type OIDCAuthSecrets struct {
	// ClientSecret is the OAuth2 client secret for the OIDC provider
	ClientSecret string `yaml:"client_secret,omitempty"`
}

type OIDCOP struct {
	// Issuer is the OIDC Provider identifier that appears in ID tokens and discovery metadata.
	// This identifies the verifier as an OpenID Provider.
	// Must match the 'iss' claim in all issued ID tokens.
	Issuer string `yaml:"issuer" validate:"required" doc_example:"\"https://verifier.sunet.se\""`
	// SessionDuration is the session duration in seconds
	SessionDuration int `yaml:"session_duration" validate:"required" default:"3600"`
	// CodeDuration is the authorization code duration in seconds
	CodeDuration int `yaml:"code_duration" validate:"required" default:"300"`
	// AccessTokenDuration is the access token duration in seconds
	AccessTokenDuration int `yaml:"access_token_duration" validate:"required" default:"3600"`
	// IDTokenDuration is the ID token duration in seconds
	IDTokenDuration int `yaml:"id_token_duration" validate:"required" default:"3600"`
	// RefreshTokenDuration is the refresh token duration in seconds
	RefreshTokenDuration int `yaml:"refresh_token_duration" validate:"required" default:"86400"`
	// SubjectType is the subject type: "public" or "pairwise"
	SubjectType string `yaml:"subject_type" validate:"required,oneof=public pairwise"`
	// SubjectSalt is the salt for pairwise subject generation
	SubjectSalt string `yaml:"subject_salt" validate:"required"`
	// EnableUserInfo controls whether the verifier-OP advertises a userinfo_endpoint
	// in its discovery metadata and issues JWT access tokens (RFC 9068 at+jwt).
	// When true (default), the OP advertises userinfo_endpoint in discovery and
	// returns an access token alongside the ID token. The userinfo endpoint
	// is stateless: it validates the JWT signature and returns the embedded claims.
	// When false, only ID tokens are returned — no access_token or userinfo endpoint.
	EnableUserInfo bool `yaml:"enable_userinfo" default:"true"`
	// StaticClients is a list of pre-configured OIDC clients
	// These clients are checked in addition to dynamically registered clients
	StaticClients []StaticOIDCClient `yaml:"static_clients,omitempty"`
}

type OIDCOPSecrets struct {
	// SubjectSalt is a secret value used to derive pairwise subject identifiers for OIDC clients
	SubjectSalt string `yaml:"subject_salt"`
	// StaticClients maps client_id to client_secret for static OIDC clients.
	// Only clients listed here will have their secrets applied; clients not
	// present in this map keep whatever value the main config provides (which
	// will be empty after ApplySecrets clears them).
	StaticClients map[string]string `yaml:"static_clients,omitempty" doc_example:"<client_id>: \"<client_secret>\""`
}

type OIDCRP struct {
	// Enable turns on OIDC RP support (default: false)
	Enable bool `yaml:"enable" default:"false"`

	// Registration configures how the client obtains credentials from the OIDC Provider.
	// Exactly one of preconfigured or dynamic must be set:
	//   - preconfigured: pre-registered client_id and client_secret
	//   - dynamic: RFC 7591 dynamic client registration (credentials obtained at startup)
	Registration *OIDCRPRegistrationConfig `yaml:"registration" validate:"required_if=Enable true"`

	// RedirectURI is the callback URL where the OIDC Provider sends the authorization response
	RedirectURI string `yaml:"redirect_uri" validate:"required_if=Enable true" doc_example:"\"https://issuer.sunet.se/oidcrp/callback\""`

	// IssuerURL is the OIDC Provider's issuer URL for discovery
	// Used for .well-known/openid-configuration discovery
	IssuerURL string `yaml:"issuer_url" validate:"required_if=Enable true" doc_example:"\"https://accounts.google.com\""`

	// Scopes are the OAuth2/OIDC scopes to request
	Scopes []string `yaml:"scopes" validate:"required,min=1,dive,required" default:"[\"openid\", \"profile\", \"email\"]"`

	// SessionDuration is the maximum time in seconds an in-flight OIDC authorization flow
	// (state, nonce, PKCE verifier) may remain active before it expires
	SessionDuration int `yaml:"session_duration" validate:"required" default:"300"`

	// ClientName is a human-readable name for the OIDC client, shown during dynamic registration or consent
	ClientName string `yaml:"client_name,omitempty"`
	// ClientURI is a URL to the client's homepage, used for display during consent
	ClientURI string `yaml:"client_uri,omitempty"`
	// LogoURI is a URL to the client's logo image, shown during consent screens
	LogoURI string `yaml:"logo_uri,omitempty"`
	// Contacts is a list of email addresses for responsible parties of this client
	Contacts []string `yaml:"contacts,omitempty"`
	// TosURI is a URL to the client's Terms of Service document
	TosURI string `yaml:"tos_uri,omitempty"`
	// PolicyURI is a URL to the client's Privacy Policy document
	PolicyURI string `yaml:"policy_uri,omitempty"`

	// AttributeMapping normalizes OIDC claim names to canonical claim names.
	// Optional: when omitted, OIDC claims pass through as-is (standard names already match).
	// Which normalized attributes are used depends on the data source:
	//   - assertion: VCTM determines which go into the credential
	//   - datastore: auth_claims determines which are used for DB identity lookup
	AttributeMapping AttributeMapping `yaml:"attribute_mapping,omitempty" doc_key:"attribute"`
}

type OIDCRPDynamicRegistrationConfig struct {
	// Enable activates dynamic client registration
	Enable bool `yaml:"enable"`

	// InitialAccessToken is a bearer token for registration
	// Required by some OIDC Providers (e.g., Keycloak)
	InitialAccessToken string `yaml:"initial_access_token,omitempty" validate:"required_if=Enable true"`
}

type OIDCRPDynamicSecrets struct {
	// InitialAccessToken is the bearer token required by the OP for dynamic client registration
	InitialAccessToken string `yaml:"initial_access_token"`
}

type OIDCRPPreconfiguredConfig struct {
	// Enable activates preconfigured client credentials
	Enable bool `yaml:"enable"`

	// ClientID is the OIDC client identifier
	ClientID string `yaml:"client_id" validate:"required_if=Enable true"`

	// ClientSecret is the OIDC client secret
	ClientSecret string `yaml:"client_secret" validate:"required_if=Enable true"`
}

type OIDCRPPreconfiguredSecrets struct {
	// ClientSecret is the shared secret for the pre-configured OIDC RP client
	ClientSecret string `yaml:"client_secret"`
}

type OIDCRPRegistrationConfig struct {
	// Preconfigured uses pre-registered client credentials.
	// Set this when the client is already registered with the OIDC Provider.
	Preconfigured *OIDCRPPreconfiguredConfig `yaml:"preconfigured,omitempty" validate:"required_without=Dynamic,excluded_with=Dynamic"`

	// Dynamic uses RFC 7591 dynamic client registration.
	// Set this when the client should register itself at startup.
	Dynamic *OIDCRPDynamicRegistrationConfig `yaml:"dynamic,omitempty" validate:"required_without=Preconfigured,excluded_with=Preconfigured"`
}

type OIDCRPRegistrationSecrets struct {
	Preconfigured *OIDCRPPreconfiguredSecrets `yaml:"preconfigured,omitempty"`
	Dynamic       *OIDCRPDynamicSecrets       `yaml:"dynamic,omitempty"`
}

type OIDCRPSecrets struct {
	Registration OIDCRPRegistrationSecrets `yaml:"registration,omitempty"`
}

type OTEL struct {
	// Enable activates OpenTelemetry tracing
	Enable bool `yaml:"enable" default:"false"`
	// Addr is the OTEL collector address
	Addr string `yaml:"addr" validate:"required_if=Enable true" doc_example:"\"jaeger:4318\""`
	// Timeout is the timeout in seconds
	Timeout int64 `yaml:"timeout" default:"10"`
}

type OpenID4VPConfig struct {
	// PresentationTimeout is the presentation timeout in seconds
	PresentationTimeout int `yaml:"presentation_timeout" validate:"required" default:"300"`
	// SupportedCredentials holds the supported credential configurations
	SupportedCredentials []SupportedCredentialConfig `yaml:"supported_credentials" validate:"required"`
	// PresentationRequestsDir is an optional directory with presentation request templates
	PresentationRequestsDir string `yaml:"presentation_requests_dir,omitempty"`
	// TokenEndpoint is the OAuth2 token endpoint URL used for VP token exchange
	TokenEndpoint string `yaml:"token_endpoint" validate:"required" doc_example:"\"https://verifier.sunet.se/token\""`
	// Clients holds the OAuth2 client configurations for RP interactions
	Clients oauth2.Clients `yaml:"clients" validate:"required" doc_key:"client id"`
}

type OpenID4VPCredentialAuth struct {
	// AuthScopes maps credential scope keys to per-scope auth config (claims to extract)
	AuthScopes map[string]AuthScopeEntry
}

type PKCS11 struct {
	// ModulePath is the path to the PKCS#11 module
	ModulePath string `yaml:"module_path" default:"/usr/lib/softhsm/libsofthsm2.so"`
	// SlotID is the HSM slot ID
	SlotID uint `yaml:"slot_id" default:"0"`
	// PIN is the PIN for HSM access
	PIN string `yaml:"pin" validate:"required"`
	// KeyLabel is the key label in HSM
	KeyLabel string `yaml:"key_label" validate:"required"`
	// KeyID is the key ID in HSM
	KeyID string `yaml:"key_id" validate:"required"`
}

type PostgresSecrets struct {
	// Password is the Postgres connection password
	Password string `yaml:"password"`
}

type RegistrationCertificate struct {
	// FilePath is the path to the Registrar-issued WRPRC, a compact JWT with
	// media type "rc-wrp+jwt".
	FilePath string `yaml:"file_path,omitempty" doc_example:"\"/etc/vc/registration-certificate.jwt\""`
	// Format is the format identifier advertised alongside the certificate
	// in the verifier_info parameter. Defaults to "rc-wrp+jwt"; override
	// only for an ecosystem that has profiled a different identifier for
	// the same document.
	Format string `yaml:"format,omitempty" doc_example:"\"rc-wrp+jwt\""`
	// TrustedRootsPath optionally points at a PEM bundle of the Registrar's
	// root certificates. When set, the certificate's own x5c chain is
	// evaluated against it at startup. When unset, the document is still
	// signature-checked and parsed, but nothing establishes that its issuer
	// is a Registrar we accept.
	//
	// The ARF RPRC_16 binding needs both this and an access certificate:
	// it compares the two documents' organisation identifiers, so it is
	// skipped when key_config supplies no certificate chain to compare
	// against.
	TrustedRootsPath string `yaml:"trusted_roots_path,omitempty"`
}

type Registry struct {
	// APIServer is the HTTP API server configuration
	APIServer APIServer `yaml:"api_server" validate:"required"`
	// PublicURL is the public URL of this service (must be valid HTTP/HTTPS URL)
	PublicURL string `yaml:"public_url" validate:"required,httpurl" doc_example:"\"https://registry.sunet.se\""`
	// GRPCServer is the gRPC server configuration
	GRPCServer GRPCServer `yaml:"grpc_server" validate:"required"`
	// TokenStatusLists holds the Token Status List configuration
	TokenStatusLists *TokenStatusLists `yaml:"token_status_lists" validate:"required"`
	// AdminGUI holds the admin GUI configuration
	AdminGUI AdminGUI `yaml:"admin_gui,omitempty" validate:"omitempty"`
}

type RegistrySecrets struct {
	AdminGUI AdminGUISecrets `yaml:"admin_gui,omitempty"`
}

type Remote struct {
	// Type is the API protocol type
	Type RemoteType `yaml:"type" validate:"required,oneof=eduapi ooapi"`

	// BaseURL is the base URL of the API endpoint
	BaseURL string `yaml:"base_url" validate:"required,url" doc_example:"\"https://api.ladok.se/eduapi\""`

	// TokenURL is the OAuth 2.0 token endpoint for Client Credentials Grant
	TokenURL string `yaml:"token_url" validate:"required,url" doc_example:"\"https://api.ladok.se/oauth2/token\""`

	// ClientID is the OAuth 2.0 client identifier
	ClientID string `yaml:"client_id" validate:"required"`

	// ClientSecret is the OAuth 2.0 client secret
	ClientSecret string `yaml:"client_secret" validate:"required"`

	// Scopes are the OAuth 2.0 scopes to request
	Scopes []string `yaml:"scopes,omitempty"`

	// Timeout is the HTTP client timeout
	Timeout time.Duration `yaml:"timeout" default:"10s"`
}

type RemoteType string

type RevocationConfig struct {
	// Enabled activates revocation status checking for presented credentials.
	Enabled bool `yaml:"enabled" json:"enabled"`
	// CacheTTL is the duration in seconds to cache fetched status list tokens.
	CacheTTL int `yaml:"cache_ttl" json:"cache_ttl" default:"300"`
	// FailOpen determines behavior when the status list is unreachable or unparseable:
	//   - true: log warning and allow the credential through (fail-open)
	//   - false: reject the credential (fail-closed)
	// Note: explicitly revoked/suspended credentials are always rejected regardless of this setting.
	FailOpen bool `yaml:"fail_open" json:"fail_open" default:"true"`
	// SkipScopes lists credential scopes exempt from revocation checking
	// (e.g., short-lived credentials valid < 24 hours per ARF 3.0 §6.6.3.7).
	SkipScopes []string `yaml:"skip_scopes,omitempty" json:"skip_scopes,omitempty"`
}

type SAMLSP struct {
	// Enable turns on SAML support (default: false)
	Enable bool `yaml:"enable" default:"false"`

	// EntityID is the SAML SP entity identifier (typically the metadata URL)
	EntityID string `yaml:"entity_id" validate:"required_if=Enable true" doc_example:"\"https://issuer.sunet.se/saml/metadata\""`

	// MetadataURL is the public URL where SP metadata is served (optional, auto-generated if empty)
	MetadataURL string `yaml:"metadata_url,omitempty"`

	// MDQServer is the base URL for MDQ (Metadata Query Protocol) server (must end with /)
	MDQServer string `yaml:"mdq_server,omitempty" validate:"excluded_with=StaticIDPMetadata" doc_example:"\"https://md.sunet.se/entities/\""`

	// StaticIDPMetadata configures a single static IdP as alternative to MDQ
	StaticIDPMetadata *StaticIDPConfig `yaml:"static_idp_metadata,omitempty" validate:"excluded_with=MDQServer"`

	// CertificatePath is the path to X.509 certificate for SAML signing/encryption
	// TODO(pki): Migrate to pki.KeyConfig for consistency with other services and
	// to enable HSM-backed SAML signing keys in the future.
	CertificatePath string `yaml:"certificate_path" validate:"required_if=Enable true"`

	// PrivateKeyPath is the path to private key for SAML signing/encryption
	// TODO(pki): See CertificatePath TODO — both fields would be replaced by a single KeyConfig.
	PrivateKeyPath string `yaml:"private_key_path" validate:"required_if=Enable true"`

	// ACSEndpoint is the Assertion Consumer Service URL where IdP sends SAML responses
	ACSEndpoint string `yaml:"acs_endpoint" validate:"required_if=Enable true" doc_example:"\"https://issuer.sunet.se/saml/acs\""`

	// SessionDuration is the maximum time in seconds an in-flight SAML authentication flow
	// (AuthnRequest → Response) may remain active before it expires
	SessionDuration int `yaml:"session_duration" validate:"required" default:"300"`

	// AttributeMapping normalizes provider-specific attribute names (e.g. SAML OIDs)
	// to canonical claim names. Applied to ALL attributes in the assertion.
	// Which normalized attributes are used depends on the data source:
	//   - assertion: VCTM determines which go into the credential
	//   - datastore: auth_claims determines which are used for DB identity lookup
	AttributeMapping AttributeMapping `yaml:"attribute_mapping" validate:"required_if=Enable true" doc_key:"attribute"`

	// MetadataSigningCertPath is the path to the X.509 certificate used to verify
	// metadata signatures. When set, all fetched metadata (MDQ and static) must
	// carry a valid XML signature from this certificate.
	MetadataSigningCertPath string `yaml:"metadata_signing_cert_path,omitempty"`

	// AllowUnsignedMetadata permits MDQ/URL metadata without signature verification.
	// This is INSECURE (MITM → fake IdP) and should only be used in development.
	// When false (default), MDQ and URL metadata sources require MetadataSigningCertPath.
	// Local metadata files are allowed unsigned regardless (with a startup warning).
	AllowUnsignedMetadata bool `yaml:"allow_unsigned_metadata" default:"false"`

	// MetadataCacheTTL in seconds (default: 3600) - how long to cache IdP metadata from MDQ
	MetadataCacheTTL int `yaml:"metadata_cache_ttl"`
}

type SQLSecrets struct {
	// Postgres holds the Postgres connection password
	Postgres PostgresSecrets `yaml:"postgres,omitempty"`
	// MariaDB holds the MariaDB connection password
	MariaDB MariaDBSecrets `yaml:"mariadb,omitempty"`
}

type SearchDocumentsReply struct {
	Documents      []*CompleteDocument `json:"documents"`
	HasMoreResults bool                `json:"has_more_results"`
}

type SearchDocumentsRequest struct {
	AuthenticSource string `json:"authentic_source,omitempty" validate:"omitempty,max=1000,excludesall=${}[]"`
	Scope           string `json:"scope,omitempty" validate:"omitempty,max=1000,excludesall=${}[]"`
	DocumentID      string `json:"document_id,omitempty" validate:"omitempty,max=1000,excludesall=${}[]"`
	CollectID       string `json:"collect_id,omitempty" validate:"omitempty,max=1000,excludesall=${}[]"`

	AuthenticSourcePersonID string `json:"authentic_source_person_id,omitempty" validate:"omitempty,max=1000,excludesall=${}[]"`

	Limit      int64          `json:"limit,omitempty" validate:"omitempty,min=0,max=1000"`
	Fields     []string       `json:"fields,omitempty" validate:"omitempty,dive,max=100,excludesall=${}[]"`
	SortFields map[string]int `json:"sort_fields,omitempty" validate:"omitempty,dive,keys,max=100,endkeys,oneof=1 -1"`
}

type Secrets struct {
	Common   *CommonSecrets   `yaml:"common,omitempty"`
	APIGW    *APIGWSecrets    `yaml:"apigw,omitempty"`
	Registry *RegistrySecrets `yaml:"registry,omitempty"`
	Verifier *VerifierSecrets `yaml:"verifier,omitempty"`
}

type SignMetadataRateLimitConfig struct {
	// RequestsPerSecond is the sustained rate limit in requests per second. Default: 2
	RequestsPerSecond float64 `yaml:"requests_per_second" default:"2" validate:"gt=0"`
	// Burst is the maximum number of requests allowed in a single burst. Default: 20
	Burst int `yaml:"burst" default:"20" validate:"gt=0"`
}

type StaticIDPConfig struct {
	// EntityID is the IdP entity identifier
	EntityID string `yaml:"entity_id" validate:"required"`

	// MetadataPath is the file path to IdP metadata XML
	MetadataPath string `yaml:"metadata_path,omitempty" validate:"required_without=MetadataURL,excluded_with=MetadataURL"`

	// MetadataURL is the HTTP(S) URL to fetch IdP metadata from (mutually exclusive with MetadataPath)
	MetadataURL string `yaml:"metadata_url,omitempty"`
}

type StaticOIDCClient struct {
	// ClientID is the unique identifier for the client
	ClientID string `yaml:"client_id" validate:"required"`
	// ClientSecret is the client secret for authentication.
	// Can be defined in the secrets file under verifier.oidc_op.static_clients
	// as a map of client_id to client_secret.
	ClientSecret string `yaml:"client_secret" validate:"required_unless=TokenEndpointAuthMethod none"`
	// RedirectURIs is the list of allowed redirect URIs for this client
	RedirectURIs []string `yaml:"redirect_uris" validate:"required,min=1,dive,redirect_uri"`
	// AllowedScopes is the list of scopes this client is allowed to request.
	// If empty, defaults to standard OIDC scopes (openid, profile, email, address, phone).
	AllowedScopes []string `yaml:"allowed_scopes,omitempty"`
	// TokenEndpointAuthMethod is the authentication method for the token endpoint.
	// Supported values: client_secret_basic, client_secret_post, none (public client)
	// Default: "client_secret_basic"
	TokenEndpointAuthMethod string `` /* 144-byte string literal not displayed */
	// GrantTypes is the list of allowed grant types.
	// Supported values: authorization_code, refresh_token
	// Default: ["authorization_code"]
	GrantTypes []string `` /* 128-byte string literal not displayed */
	// ResponseTypes is the list of allowed response types.
	// Supported values: code
	// Default: ["code"]
	ResponseTypes []string `yaml:"response_types,omitempty" default:"[\"code\"]" validate:"omitempty,dive,oneof=code"`
	// ClientName is an optional human-readable name for the client
	ClientName string `yaml:"client_name,omitempty"`
}

type SupportedCredentialConfig struct {
	// VCT is the verifiable credential type
	VCT string `yaml:"vct" validate:"required" doc_example:"\"urn:eudi:pid:1\""`
	// Scopes are the OIDC scopes that grant access to this credential
	Scopes []string `yaml:"scopes" validate:"required"`
}

type TLS struct {
	// Enable enables TLS
	Enable bool `yaml:"enable" default:"false"`
	// CertFilePath is the path to the TLS certificate
	CertFilePath string `yaml:"cert_file_path" validate:"required_if=Enable true"`
	// KeyFilePath is the path to the TLS private key
	KeyFilePath string `yaml:"key_file_path" validate:"required_if=Enable true"`
}

type TokenStatusLists struct {
	// KeyConfig holds the key configuration for signing Token Status List tokens.
	KeyConfig *pki.KeyConfig `yaml:"key_config" validate:"required"`
	// TokenRefreshInterval is how often (in seconds) new Token Status List tokens are generated. Default: 43200 (12 hours). Min: 301 (>5 minutes), Max: 86400 (24 hours)
	TokenRefreshInterval int64 `yaml:"token_refresh_interval" validate:"min=301,max=86400" default:"43200"`
	// SectionSize is the number of entries (decoys) per section. Default: 1000000 (1 million)
	SectionSize int64 `yaml:"section_size" default:"1000000"`
	// RateLimitRequestsPerMinute is the maximum requests per minute per IP for token status list endpoints. Default: 60
	RateLimitRequestsPerMinute int `yaml:"rate_limit_requests_per_minute" default:"60"`
}

type TrustConfig struct {
	// PDPURL is the URL of the AuthZEN PDP (Policy Decision Point) service for trust evaluation.
	// When set, operates in "default deny" mode - trust decisions require PDP approval.
	// When empty, operates in "allow all" mode - resolved keys are always considered trusted.
	PDPURL string `yaml:"pdp_url,omitempty" doc_example:"\"https://trust.sunet.se/pdp\""`

	// LocalDIDMethods specifies which DID methods can be resolved locally without go-trust.
	// Self-contained methods like "did:key" and "did:jwk" are always resolved locally.
	LocalDIDMethods []string `yaml:"local_did_methods,omitempty" default:"[\"did:key\", \"did:jwk\"]"`

	// TrustPolicies configures per-role trust evaluation policies.
	// The key is the role (e.g., "issuer", "verifier") and the value contains policy settings.
	TrustPolicies map[string]TrustPolicyConfig `yaml:"trust_policies,omitempty" doc_key:"role"`

	// AllowedSignatureAlgorithms restricts which JWT signature algorithms are accepted.
	// If empty, defaults to a secure set: ES256, ES384, ES512, RS256, RS384, RS512, PS256, PS384, PS512, EdDSA.
	// The "none" algorithm is NEVER allowed regardless of configuration.
	AllowedSignatureAlgorithms []string `yaml:"allowed_signature_algorithms,omitempty" doc_example:"[\"ES256\", \"ES384\", \"ES512\", \"EdDSA\"]"`

	// WalletAttestation configures wallet attestation-based client authentication.
	// This is a trust-evaluation mechanism (delegates to the PDP above), so it
	// lives here rather than under delivery.openid4vci.
	WalletAttestation WalletAttestationConfig `yaml:"wallet_attestation,omitempty"`
}

type TrustPolicyConfig struct {
	// TrustFrameworks lists the accepted trust frameworks for this role.
	TrustFrameworks []string `yaml:"trust_frameworks,omitempty" doc_example:"[\"did:web\", \"did:ebsi\", \"etsi-tl\", \"openid-federation\", \"x509\"]"`

	// TrustAnchors specifies trusted root entities for this role.
	// Format depends on the trust framework (e.g., DID for did:web, federation entity for OpenID Fed).
	TrustAnchors []string `yaml:"trust_anchors,omitempty"`

	// RequireRevocationCheck enforces revocation status checking for this role.
	// Default: false
	RequireRevocationCheck bool `yaml:"require_revocation_check,omitempty" default:"false"`
}

type VerificationPreset map[string]*VerificationPresetScope

type VerificationPresetClaim struct {
	// Path is the claim path segments
	Path []string `yaml:"path" validate:"required,min=1,dive,required" doc_example:"[\"birthdate\"], [\"address\", \"locality\"]"`
}

type VerificationPresetScope struct {
	// Claims lists specific claims to request. If empty, all VCTM claims are used.
	Claims []VerificationPresetClaim `yaml:"claims,omitempty" validate:"omitempty,dive"`
	// ExcludeClaims lists claims to exclude from the DCQL query.
	ExcludeClaims []VerificationPresetClaim `yaml:"exclude_claims,omitempty" validate:"omitempty,dive"`
	// Validations are optional rules applied server-side after claims extraction
	Validations []openid4vp.ClaimValidation `yaml:"validations,omitempty" validate:"omitempty,dive"`
}

type Verifier struct {
	// APIServer is the HTTP API server configuration
	APIServer APIServer `yaml:"api_server" validate:"required"`
	// PublicURL is the public URL of this service (must be valid HTTP/HTTPS URL)
	PublicURL string `yaml:"public_url" validate:"required,httpurl" doc_example:"\"https://verifier.sunet.se\""`
	// KeyConfig is the signing key configuration
	KeyConfig *pki.KeyConfig `yaml:"key_config" validate:"required"`
	// ClientIDScheme determines how the verifier identifies itself to wallets.
	// Supported values: "x509_san_dns" (default), "x509_hash", "did".
	// When "did", the DID field must be set and /.well-known/did.json is served.
	// When "x509_hash" (the scheme the EUDI ARF mandates for Relying Party
	// authentication), the client_id is the base64url SHA-256 of the signing
	// certificate, so key_config must supply one and it is always sent in x5c.
	ClientIDScheme string `yaml:"client_id_scheme,omitempty" default:"x509_san_dns" validate:"omitempty,oneof=x509_san_dns x509_hash did"`
	// DID is the verifier's DID identity.
	DID string `yaml:"did,omitempty" validate:"required_if=ClientIDScheme did" doc_example:"\"did:web:verifier.example.com\""`
	// AccessCertificate validates the verifier's own wallet-facing certificate as an EUDI Relying Party access certificate (WRPAC, ETSI TS 119 411-8). Off by default; deployments outside an ARF trust framework are unaffected.
	AccessCertificate *AccessCertificate `yaml:"access_certificate,omitempty"`
	// RegistrationCertificate points at a Relying Party registration certificate (WRPRC, ETSI TS 119 475) issued to this verifier by a national Registrar, to be presented to wallets in the OpenID4VP verifier_info parameter. vc does not issue these.
	RegistrationCertificate *RegistrationCertificate `yaml:"registration_certificate,omitempty"`
	// PreferredVPFormats specifies informational VP formats and algorithms supported by wallets
	PreferredVPFormats *openid4vp.VPFormatsSupported `yaml:"preferred_vp_formats,omitempty"`
	// SupportedWallets holds supported wallet configurations
	SupportedWallets map[string]string `yaml:"supported_wallets" validate:"omitempty"`
	// Inbound groups inbound credential verification
	Inbound VerifierInbound `yaml:"inbound,omitempty"`
	// Outbound groups outbound identity assertion
	Outbound VerifierOutbound `yaml:"outbound,omitempty"`
	// DigitalCredentials holds the W3C Digital Credentials API configuration
	DigitalCredentials DigitalCredentialsConfig `yaml:"digital_credentials,omitempty"`
	// AuthorizationPageCSS holds the authorization page styling configuration
	AuthorizationPageCSS AuthorizationPageCSSConfig `yaml:"authorization_page_css,omitempty"`
	// CredentialDisplay holds the credential display settings
	CredentialDisplay CredentialDisplayConfig `yaml:"credential_display,omitempty"`
	// Trust holds the trust evaluation configuration
	Trust TrustConfig `yaml:"trust,omitempty"`
	// OpenIDFederation holds the OpenID Federation entity configuration.
	// When enabled, serves /.well-known/openid-federation as a self-signed JWT.
	OpenIDFederation *openidfederation.Config `yaml:"federation,omitempty"`
	// Presets holds predefined verification request presets shown in the UI.
	// The map key is the human-readable label.
	// Each preset maps credential_metadata scopes to optional claim overrides.
	// A nil scope value requests all VCTM claims; use claims/exclude_claims to narrow.
	Presets map[string]VerificationPreset `` /* 181-byte string literal not displayed */
	// CombinedPresentation configures combined presentation verification (ARF 3.0 §6.6.3.10).
	// When multiple credentials are presented, this verifies they belong to the same holder.
	CombinedPresentation *openid4vp.CombinedPresentationConfig `yaml:"combined_presentation,omitempty"`
	// Revocation configures credential revocation checking at presentation time (ARF 3.0 §6.6.3.7).
	// When enabled, the Verifier checks Token Status List references in presented credentials.
	Revocation *RevocationConfig `yaml:"revocation,omitempty"`
	// ZkCircuits configures the zk-circuits catalog service used to resolve
	// "mso_mdoc_zk" (Longfellow ZK/PPID) proof circuits for native
	// verification. Only consulted by builds with the "zknative" Go build
	// tag (see pkg/mdoc/zk_native_cgo.go) - ignored by the default build.
	ZkCircuits ZkCircuitsConfig `yaml:"zk_circuits,omitempty"`
}

type VerifierInbound struct {
	// OpenID4VP holds the OpenID4VP configuration for accepting wallet presentations
	OpenID4VP *OpenID4VPConfig `yaml:"openid4vp" validate:"required"`
}

type VerifierOutbound struct {
	// OIDCProvider holds the OIDC Provider configuration for asserting verified identity to downstream RPs
	OIDCProvider *OIDCOP `yaml:"oidc_provider,omitempty" validate:"omitempty"`
}

type VerifierOutboundSecrets struct {
	OIDCProvider OIDCOPSecrets `yaml:"oidc_provider,omitempty"`
}

type VerifierSecrets struct {
	Outbound VerifierOutboundSecrets `yaml:"outbound,omitempty"`
}

type WRPRCClaims struct {
	// SubjectID is the semantic organisation identifier, e.g.
	// "NTRDE-BD7070256AF93987". It is what binds this document to an access
	// certificate.
	SubjectID string
	// LegalName is the registered legal name of the Relying Party.
	LegalName string
	// TradeName is the user-facing name, from the `name` claim.
	TradeName string
	// Country is the ISO 3166-1 code where the RP is established.
	Country string
	// EntitlementURIs are the Annex A role entitlements the Registrar granted.
	EntitlementURIs []string
	// AllowedAttributes are the top-level claim names this RP is registered
	// to request, flattened from the DCQL credential queries. Used for
	// over-request detection.
	AllowedAttributes []string
	// Purpose holds the multi-language purpose descriptions shown to users.
	Purpose []WRPRCLocalizedText
	// PrivacyPolicyURI, InfoURI and RegistryURI are display/reference links.
	PrivacyPolicyURI string
	InfoURI          string
	RegistryURI      string
}

type WRPRCLocalizedText struct {
	Lang  string `json:"lang"`
	Value string `json:"value"`
}

type WalletAttestationConfig struct {
	// Enabled enables wallet attestation-based authentication.
	// When true and PDPURL is configured, wallets can authenticate using
	// a provider-signed attestation JWT instead of pre-registration in Clients.
	// The PDP validates the wallet provider against configured trust lists/federation.
	// PKCE remains mandatory as the primary code-binding mechanism.
	Enabled bool `yaml:"enabled" default:"false"`

	// Policy configures SPOCP-based authorization for wallet attestation.
	// When configured, after the PDP validates the wallet provider, the SPOCP engine
	// checks whether the attestation tier (attestation_source) is authorized for the
	// requested scope. When empty, all trusted wallets are authorized (default open).
	Policy WalletAttestationPolicy `yaml:"policy,omitempty"`

	// Mode restricts which WIA trust model this deployment accepts, matching
	// the same "etsi"/"ietf" terminology used by go-wallet-backend's
	// WIAConfig.Mode:
	//
	//   - "etsi": require x5c (EC TS03 v1.5.2 / ETSI TS 119 472-3 model,
	//     identity verified against the Trusted List for Wallet Providers).
	//     A WIA without x5c is rejected before signature verification.
	//   - "ietf": require iss + no x5c (the plain IETF
	//     draft-ietf-oauth-attestation-based-client-auth format, resolved via
	//     JWKS discovery — no ARF/ETSI counterpart). A WIA with x5c is
	//     rejected before signature verification.
	//   - "" (default): accept either format, as determined by whether the
	//     WIA carries an x5c header or an iss claim — preserves pre-Mode
	//     behavior for deployments that haven't opted into pinning one trust
	//     model.
	//
	// Any other value is treated the same as "" (a warning is logged, not a
	// startup failure — this package has no config.Validate() convention to
	// hard-fail against).
	//
	// Pinning this matters beyond documentation: without it, an operator
	// expecting only ARF-conformant ("etsi") wallets would still silently
	// accept an iss/JWKS-based ("ietf") WIA from a misconfigured or
	// malicious wallet, trusting a JWKS discovery chain instead of the
	// Trusted List for Wallet Providers PKI anchor.
	Mode string `yaml:"mode,omitempty"`
}

type WalletAttestationPolicy struct {
	// Rules are inline SPOCP rules.
	Rules []string `yaml:"rules,omitempty"`
	// RulesFile is a path to a file containing SPOCP rules (one per line, # comments).
	RulesFile string `yaml:"rules_file,omitempty"`
}

type ZkCircuitsConfig struct {
	// Sources are zk-circuits catalog mirror base URLs, tried in order
	// until one succeeds (see pkg/mdoc/zkcircuit.Client - these are
	// mirrors of the SAME catalog, not distinct registries). Defaults to
	// the live deployed service if empty.
	Sources []string `yaml:"sources,omitempty" default:"[\"https://zk-circuits.fly.dev\"]" doc_example:"[\"https://zk-circuits.fly.dev\"]"`
}