first

Credentials/CsobCredentials.cs

@@ -0,0 +1,31 @@
+using System.Security.Cryptography.X509Certificates;
+
+namespace Csob.Credentials;
+
+/// <summary>
+/// Fully resolved set of per-request credentials and PSU context used to call the ČSOB PSD2 API.
+/// Built from request headers by <see cref="RequestCredentialsProvider"/>; never logged.
+/// </summary>
+public sealed record CsobCredentials
+{
+    /// <summary>OAuth2 Bearer access token (forwarded as <c>Authorization: Bearer</c>).</summary>
+    public required string AccessToken { get; init; }
+
+    /// <summary>ČSOB application API key (forwarded as <c>APIKEY</c>).</summary>
+    public required string ApiKey { get; init; }
+
+    /// <summary>TPP organisation name (forwarded as <c>TPP-Name</c>).</summary>
+    public required string TppName { get; init; }
+
+    /// <summary>
+    /// eIDAS client certificate (with private key) for mutual TLS. Optional at the type level so
+    /// metadata endpoints can resolve context, but required for any real upstream call.
+    /// </summary>
+    public X509Certificate2? Certificate { get; init; }
+
+    /// <summary>Whether the PSU is online for this request (<c>User-Involved</c>); defaults to false.</summary>
+    public bool UserInvolved { get; init; }
+
+    /// <summary>Optional PSU IP address (<c>User-IP-Address</c>).</summary>
+    public string? UserIpAddress { get; init; }
+}