first

2026-06-18 11:05:46 +02:00
parent f44ffae9fc
commit 09db30a3ca
84 changed files with 3952 additions and 15 deletions
@@ -0,0 +1,44 @@
+namespace Csob.Credentials;
+
+/// <summary>
+/// Names of the HTTP headers that carry per-request ČSOB credentials and context.
+///
+/// This service is multi-tenant: it stores no credentials itself. Every sensitive value is
+/// supplied per request in a header (never the query string or body) and is forwarded to ČSOB.
+/// Headers must therefore only be sent over TLS. Nothing here is logged or persisted.
+/// </summary>
+public static class CredentialConstants
+{
+    /// <summary>
+    /// eIDAS client certificate (QWAC) as a Base64-encoded PKCS#12 / PFX bundle, including the
+    /// private key and the full chain. Used to establish the mutual-TLS connection to ČSOB.
+    /// Analogous to Node's <c>https.Agent({ pfx, passphrase })</c>.
+    /// </summary>
+    public const string CertificateHeader = "X-CSOB-Certificate";
+
+    /// <summary>Optional passphrase protecting the PFX in <see cref="CertificateHeader"/>.</summary>
+    public const string CertificatePasswordHeader = "X-CSOB-Certificate-Password";
+
+    /// <summary>OAuth2 Bearer access token obtained for the PSU; forwarded as <c>Authorization: Bearer</c>.</summary>
+    public const string AccessTokenHeader = "X-Access-Token";
+
+    /// <summary>ČSOB application API key; forwarded as the <c>APIKEY</c> header.</summary>
+    public const string ApiKeyHeader = "X-API-Key";
+
+    /// <summary>TPP (third-party provider) organisation name; forwarded as the <c>TPP-Name</c> header.</summary>
+    public const string TppNameHeader = "X-TPP-Name";
+
+    /// <summary>OAuth2 client id of the registered TPP application (used by the OAuth helper endpoints).</summary>
+    public const string ClientIdHeader = "X-CSOB-Client-Id";
+
+    /// <summary>OAuth2 client secret of the registered TPP application (used by the OAuth helper endpoints).</summary>
+    public const string ClientSecretHeader = "X-CSOB-Client-Secret";
+
+    // Optional PSU (end-user) context, forwarded verbatim to ČSOB when present.
+
+    /// <summary>Whether the PSU is online/involved in the request; forwarded as <c>User-Involved</c> (default false).</summary>
+    public const string UserInvolvedHeader = "X-User-Involved";
+
+    /// <summary>PSU IP address; forwarded as <c>User-IP-Address</c>.</summary>
+    public const string UserIpAddressHeader = "X-User-IP-Address";
+}