first

2026-06-18 11:05:46 +02:00
parent f44ffae9fc
commit 09db30a3ca
84 changed files with 3952 additions and 15 deletions
@@ -0,0 +1,70 @@
+using Microsoft.OpenApi.Any;
+using Microsoft.OpenApi.Models;
+using Swashbuckle.AspNetCore.SwaggerGen;
+using Csob.Controllers;
+using Csob.Credentials;
+
+namespace Csob.Infrastructure;
+
+/// <summary>
+/// Documents the per-request credential headers in Swagger. Metadata endpoints need none; the
+/// OAuth helper needs the certificate + client id/secret; every other (AISP/PISP/consent) endpoint
+/// needs the certificate + access token + API key + TPP name. Headers are marked optional at the
+/// schema level (the service validates them at runtime) but the descriptions state what is required.
+/// </summary>
+public sealed class CredentialHeadersOperationFilter : IOperationFilter
+{
+    public void Apply(OpenApiOperation operation, OperationFilterContext context)
+    {
+        var declaringType = context.MethodInfo.DeclaringType;
+
+        // Metadata endpoints (health/version/status) do not talk to ČSOB.
+        if (declaringType == typeof(MetaController))
+        {
+            return;
+        }
+
+        operation.Parameters ??= new List<OpenApiParameter>();
+
+        AddHeader(operation, CredentialConstants.CertificateHeader,
+            "eIDAS client certificate (QWAC) as a Base64-encoded PFX/PKCS#12 bundle incl. private key and chain. Used for mutual TLS to ČSOB. SENSITIVE — TLS only.");
+        AddHeader(operation, CredentialConstants.CertificatePasswordHeader,
+            "Passphrase protecting the PFX in X-CSOB-Certificate (omit if the PFX has no password). SENSITIVE.");
+
+        if (declaringType == typeof(OAuthController))
+        {
+            AddHeader(operation, CredentialConstants.ClientIdHeader,
+                "OAuth2 client id of the registered TPP application. Required.");
+            AddHeader(operation, CredentialConstants.ClientSecretHeader,
+                "OAuth2 client secret of the registered TPP application. Required for token/refresh. SENSITIVE.");
+            return;
+        }
+
+        AddHeader(operation, CredentialConstants.AccessTokenHeader,
+            "OAuth2 Bearer access token obtained for the PSU. Forwarded as 'Authorization: Bearer'. Required. SENSITIVE.");
+        AddHeader(operation, CredentialConstants.ApiKeyHeader,
+            "ČSOB application API key. Forwarded as 'APIKEY'. Required.");
+        AddHeader(operation, CredentialConstants.TppNameHeader,
+            "TPP organisation name. Forwarded as 'TPP-Name'. Required.");
+        AddHeader(operation, CredentialConstants.UserInvolvedHeader,
+            "Optional. 'true' if the PSU is online for this request (forwarded as 'User-Involved'). Defaults to false.", example: "false");
+        AddHeader(operation, CredentialConstants.UserIpAddressHeader,
+            "Optional. PSU IP address (forwarded as 'User-IP-Address').");
+    }
+
+    private static void AddHeader(OpenApiOperation operation, string name, string description, string? example = null)
+    {
+        operation.Parameters.Add(new OpenApiParameter
+        {
+            Name = name,
+            In = ParameterLocation.Header,
+            Required = false,
+            Description = description,
+            Schema = new OpenApiSchema
+            {
+                Type = "string",
+                Example = example is null ? null : new OpenApiString(example),
+            },
+        });
+    }
+}