@credo-ts/core
Version:
<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1
1 lines • 3.6 kB
Source Map (JSON)
{"version":3,"file":"X509ValidationOptions.mjs","names":[],"sources":["../../../src/modules/x509/X509ValidationOptions.ts"],"sourcesContent":["import type { X509RevocationReason } from './X509CrlDistributionPoint'\n\n/**\n * Revocation checking mode based on Java PKIXRevocationChecker.Option patterns\n */\nexport enum X509RevocationCheckMode {\n /**\n * Completely disable revocation checking\n */\n Disabled = 'Disabled',\n\n /**\n * Check revocation status but allow validation to succeed if:\n * - CRL cannot be obtained due to network error\n * This is the RECOMMENDED default for production systems\n */\n SoftFail = 'SoftFail',\n\n /**\n * Require successful revocation check - fail if network unavailable or service errors\n * Use with caution in production as network failures will block certificate validation\n */\n Require = 'Require',\n}\n\nexport interface X509RevocationCheckOptions {\n /**\n * Mode for revocation checking\n * @default {@link X509RevocationCheckMode.SoftFail}\n *\n * Note: Currently defaults to 'SoftFail' to provide enhanced security\n * without breaking existing functionality in network failure scenarios\n */\n mode?: X509RevocationCheckMode\n\n /**\n * Whether to check revocation for all certificates in the chain (except the root).\n *\n * Defaults to `true`, so every certificate in the chain (the end-entity and any intermediate CAs)\n * is checked, as RFC 5280 expects. Set to `false` to only check the end-entity/leaf certificate,\n * which is faster but weaker.\n *\n * @default true\n */\n checkFullChain?: boolean\n\n /**\n * Timeout in milliseconds for CRL fetches\n * @default 5000\n */\n timeoutMs?: number\n\n /**\n * Maximum size in bytes for CRL downloads\n * @default 10485760 (10 MB)\n */\n maxCrlSizeBytes?: number\n\n /**\n * How long (in seconds) a verified CRL is served from the cache without contacting the\n * distribution point. After this period the CRL bytes are fetched again: when unchanged (same\n * SHA-256) the cached CRL is reused without re-parsing or re-verifying, otherwise it is fully\n * re-verified. Independently of this period, a cached CRL is never served past its own\n * `nextUpdate`. When unset in per-call revocation options, the value configured on the X509\n * module's `revocationCheck` applies.\n *\n * @default 3600 (1 hour)\n */\n crlCacheExpirySeconds?: number\n\n /**\n * The date/time to use for revocation checking\n * Used to verify CRL validity (thisUpdate/nextUpdate) and revocation dates\n * @default new Date() (current time)\n */\n verificationDate?: Date\n\n /**\n * Specific revocation reasons that must be covered by CRLs\n * If a certificate has no reasons specified in its CRL distribution points (a \"full\" DP),\n * it covers all reasons automatically.\n *\n * If a certificate only has distribution points with specific reasons, this array determines\n * which reasons must be covered for the check to be considered complete.\n *\n * @default The reasons actually published across the certificate's CRL distribution points.\n * There is no point requiring coverage of reasons the issuer never published a distribution point\n * for, so by default only the reasons present in the certificate's DPs are required.\n *\n * Set to a subset to only require coverage of specific reasons.\n */\n requiredReasons?: X509RevocationReason[]\n}\n"],"mappings":";;;;AAKA,IAAY,0BAAL,yBAAA,yBAAA;;;;CAIL,wBAAA,cAAA;;;;;;CAOA,wBAAA,cAAA;;;;;CAMA,wBAAA,aAAA;;AACF,EAAA,CAAA,CAAA"}