develop merge#42
Merged
Merged
Conversation
Bumps [dotnet-sdk](https://github.com/dotnet/sdk) from 10.0.0 to 10.0.300. - [Release notes](https://github.com/dotnet/sdk/releases) - [Commits](https://github.com/dotnet/sdk/commits/v10.0.300) --- updated-dependencies: - dependency-name: dotnet-sdk dependency-version: 10.0.300 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Udap.Client minor updates and continued work on the Sigil CA tool.
Scaffolds Sigil.Did and Sigil.Vc projects so DID/VC business logic and its NuGet deps (SimpleBase, JsonSchema.Net, Microsoft.IdentityModel.Tokens 8+) stay isolated from X.509 code. Entity POCOs stay in Sigil.Common to keep SigilDbContext single without circular project references. Adds 5 entities (DidTemplate, DidDocument, VerificationMethod, CredentialSchema, IssuedCredential) plus migration AddDidAndVcEntities. TrustDomain gains DidDocuments + IssuedCredentials collections. Extends ISigningProvider with GetRawPublicKeyAsync (needed for did:key multicodec encoding) and Ed25519 in LocalSigningProvider via BouncyCastle. Vault and GCP providers stub Ed25519 with NotSupportedException pending Phase C wiring. Sets up Phase A (did:key) + Phase D (JWT-VC). Services, DI, UI, and tests land in subsequent commits. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
DID + VC services - Sigil.Did: DidTemplateService, DidIssuanceService, DidKeyMethodProvider (did:key with Ed25519 + multibase), DidDocumentBuilder, IDidMethodProvider - Sigil.Vc: CredentialSchemaService, CredentialIssuanceService, CredentialVerifier, CredentialJwtBuilder - Program.cs: register DID/VC services and seed did:key preset template + MemberCredential schema; project refs from Sigil, Sigil.UI, tests - 4 new test files covering DID issuance, did:key minting, credential issuance, and credential verification UI pages - Dids, DidTemplates, Credentials, CredentialSchemas pages with Class="multiline-text" on long-value columns and Wrap="true" on Actions stacks so buttons flow instead of overlapping FluentDataGrid UX fixes (all grids) - sigilFreezeResizableGrids JS helper in App.razor invoked from MainLayout.OnAfterRenderAsync: walks each fluent-data-grid with ResizableColumns and rewrites GridTemplateColumns from minmax/fr/auto to fixed pixel widths, matching what Fluent does internally on first drag. Resize handles now grab from first render. - Restored Fluent's 16px horizontal cell padding (site.css had been overriding it to 0); rows no longer touch adjacent column text - Wrap="true" added to Actions FluentStacks in TrustDomains, SanLists, Dids, Credentials, DidTemplates, CredentialSchemas Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Introduce ServerSettings.IncludeCommunityClaim (default false). When enabled, registration writes the community name to the client's community property, and token issuance adds a udap_community claim to access tokens on both client_credentials and authorization_code flows. The claim value is resolved from the stored community id at token time so a later community rename is reflected automatically. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Explain the param-name-as-org encoding, the aud/POST-URL source, the DefaultOrgMap "empty" default, and registration-only scope. Add guidance on choosing one shared client_id (same org=data_holder key, one scope set) vs. separate client_ids (different key, independent scopes) across endpoints. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…umentation-for-ai-tone # Conflicts: # Udap.Server/docs/README.md
…r-ai-tone Refine Udap.Server docs tone and copy accuracy
…otnet-sdk-10.0.300 Bump dotnet-sdk from 10.0.0 to 10.0.300
Sigil (examples/CA) was renamed to Sigyll and moved to its own repository at https://github.com/JoeShook/Sigyll with full git history preserved. - Remove all Sigil project files from examples/CA - Remove the 11 Sigil project entries from Udap.sln - Keep examples/CA as a pointer (README.md -> Sigyll repo) - Update CLAUDE.md example-projects list Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps [dotnet-sdk](https://github.com/dotnet/sdk) from 10.0.300 to 10.0.301. - [Release notes](https://github.com/dotnet/sdk/releases) - [Commits](dotnet/sdk@v10.0.300...v10.0.301) --- updated-dependencies: - dependency-name: dotnet-sdk dependency-version: 10.0.301 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…pper The Tiered OAuth challenge built the IdP /connect/authorize redirect without a client_id because the registration-store lookup returned a phantom non-null TieredClient on a no-match: - UdapClientRegistrationStore.FindTieredClientById did entity.ToModel(), and TieredClientMapper.ToModel(null) returns a non-null empty object, so 'not found' read as 'found' with a null ClientId. - The challenge also looked up by the wrong column (ClientId) while passing the IdP base URL. The phantom object made idpClient != null, so the handler skipped copying the freshly issued client_id (the 'if (idpClient == null)' guard), and the authorize URL went out without client_id. Fixes: - FindTieredClientById maps only when found (entity?.ToModel()). - Add FindTieredClientByIdPBaseUrl (matches the key UpsertTieredClient stores under) to the interface, EF store, and in-memory store. - TieredOAuthAuthenticationHandler resolves the existing tiered client by IdP base URL. Also adds a TODO noting the missing regression coverage (EF-store tests, a shared InMemory/EF store-contract test, and a tiered re-login test) that let this ship.
Add markdown conversions of Exchange Purposes SOP v5.1, Treatment XP Implementation SOP v2.0, and IAS XP Implementation SOP v3.0 final (all published July 2026). Source PDFs are kept locally only (*.pdf is gitignored repo-wide). Findings in TEFCA-SOP-July-2026-Impact.md: - XP code set is stale: v5.1 adds T-HCO-QAI/POP/PTSAFETY/PERF and T-GOVDTRM-SSD/ACP, removes T-HCO-QM (SDK implements v4.0's 12 codes) - Conformance bug: SDK uses extension key "tefca-ias" but Facilitated FHIR SOP v2.0 Table 4 defines "tefca_ias" (underscore) - Treatment XP SOP v2.0 6.2 adds hl7-b2b content rules (NPI/TIN in organization_name, RCE Directory ResourceID as organization_id) Implementation deferred until Duende upgrade lands. The udaped UI tool (separate repo) also needs the extension key and XP code updates. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… net10.0 Duende IdentityServer 8.x targets .NET 10 only, so Udap.Server, Udap.Server.Storage, Udap.UI, Udap.Ssraa.Server, and Udap.Tefca.Server drop net8.0/net9.0 (client-side libraries keep multi-targeting since Duende.IdentityModel 8.1.0 still supports net8.0). Also removes the now-dead net8/net9 conditional package pins and updates dotnet-ef to 10.0.9 for EF Core 10 migrations. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- All Duende store/service/validator interfaces gained required CancellationToken parameters; return types moved to IReadOnlyCollection<T> (UdapInMemoryResourceStore, UdapInMemoryIdentityProviderStore, UdapJwtSecretValidator, UdapJwtBearerClientAssertionSecretParser, UdapCustomTokenRequestValidator, UdapDiscoveryEndpoint). - UdapTokenResponseGenerator: IClock -> TimeProvider in the base TokenResponseGenerator constructor; override signature takes ct. - UdapAuthorizationResponseMiddleware now matches HTTP 303 (See Other) in addition to 302 - Duende 8 emits 303 unconditionally for authorization endpoint redirects (FAPI 2.0), which would otherwise bypass the UDAP error-transform on response start. - Inline replacements for Duende extension helpers internalized in v8 (IsNullOrEmpty, HasDuplicates). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Mechanical updates across Udap.UI and both Udap.Identity.Provider examples: pass HttpContext.RequestAborted to IIdentityServerInteractionService / IEventService / IIdentityProviderStore / IBackchannelAuthenticationInteractionService / ISessionManagementService / IClientStore calls (GrantConsentAsync and DenyAuthorizationAsync take the token before their trailing optional parameter), and rename AuthorizationError -> InteractionError. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ConfigurationDb_v7Tov8 adds the 8 SAML configuration tables and PersistedGrantDb_v7Tov8 adds the 3 SAML operational tables introduced by Duende IdentityServer 8, for both UdapDb.SqlServer and UdapDb.Postgres (snake_cased via the Npgsql contexts). The migration hosts register TimeProvider.System, required by v8''s TokenCleanupService at design time. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Test doubles updated: StubClock extends TimeProvider (IClock removed), TestReplayCache/TestEventService take CancellationToken, ClientStore no longer takes ICancellationTokenProvider. - Vendored pipeline helpers pass ct to interaction service calls. - Redirect assertions reclassified: responses from Duende''s authorize endpoint (including redirect-to-login and /connect/authorize/callback) now expect 303 SeeOther; redirects issued by UdapAuthorizationResponseMiddleware, ASP.NET Challenge, login pages, and the federation signin handler remain 302. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Firely.Fhir.Packages 4.9.1 crashes with a duplicate-key error when two manifests declare the same missing package at different versions, which happens when ~/.fhir/packages contains us.core but not hl7.terminology.r4 / hl7.fhir.uv.extensions.r4. Records the local fix and why the upstream fix (5.0.2) is blocked on the deferred Hl7.Fhir 6.x migration. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Duende IdentityServer 7.4.7 -> 8.0.2 upgrade: net10.0-only server libraries, v8 API migration, SAML table EF migrations, and test updates for the new 303 authorization redirects. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…otnet-sdk-10.0.301 Bump dotnet-sdk from 10.0.300 to 10.0.301
…nd Treatment checks Conformance fix (breaking): the TEFCA IAS authorization extension key is "tefca_ias" per Facilitated FHIR SOP v2.0 Table 4; the SDK used "tefca-ias". Renamed TefcaConstants.UdapAuthorizationExtensions.TEFCAIAS and all docs, config, and test references. No legacy-key tolerance. Exchange Purposes SOP v5.1 (breaking): add T-HCO-QAI, T-HCO-POP, T-HCO-PTSAFETY, T-HCO-PERF, T-GOVDTRM-SSD, T-GOVDTRM-ACP; remove retired T-HCO-QM. New TefcaConstants.ExchangePurposeCodes.All is the single authoritative list; TefcaTokenValidator and TefcaRegistrationValidator now derive from it instead of keeping hand-maintained copies. New validations in TefcaTokenValidator: - tefca_ias extension must carry a non-empty id_token (SOP v2.0 Table 4) - Opt-in Treatment XP SOP v2.0 Section 6.2 checks via TefcaValidationOptions.EnforceTreatmentOrganizationIdentifiers: NPI/TIN appended to organization_name and organization_id present for T-TREAT/T-TRTMNT token requests Also: PKI generator TEFCA client cert SANs updated to the v5.1 code set; Udap.Tefca.Server docs README XP code list corrected (previously listed draft-era names). Tests: UdapServer.Tests 295 passed, Udap.Common.Tests 416 passed (both TFMs), UdapMetadata.Tests 55 passed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bumps [dotnet-sdk](https://github.com/dotnet/sdk) from 10.0.301 to 10.0.302. - [Release notes](https://github.com/dotnet/sdk/releases) - [Commits](dotnet/sdk@v10.0.301...v10.0.302) --- updated-dependencies: - dependency-name: dotnet-sdk dependency-version: 10.0.302 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…otnet-sdk-10.0.302 Bump dotnet-sdk from 10.0.301 to 10.0.302
TrustChainValidationResult.MatchedAnchor tells you the specific anchor the metadata chained to — the root the chain actually terminated at — plus its CommunityId/CommunityName.
develop merge
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several important updates across dependency management, feature enhancements, and documentation improvements. The main highlights are the upgrade to Duende IdentityServer 8.x, support for a new "community" claim in access tokens, and the removal of the Sigil (now Sigyll) PKI management tool from the repository. Additionally, there are updates to TEFCA extension naming and documentation to reflect recent standards changes.
Dependency and Compatibility Updates:
Duende.IdentityServerand related packages (includingDuende.IdentityServer.Storage,Duende.IdentityServer.EntityFramework.Storage, andDuende.IdentityServer.AspNetIdentity) from version 7.4.7 to 8.0.2 in bothDirectory.Packages.propsandUdap.Server.Storage/Udap.Server.Storage.csproj. Updated conditional package references to unconditional for .NET 10.0 only. ([[1]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-5baf5f9e448ad54ab25a091adee0da05d4d228481c9200518fcb1b53a65d4156L10-R10),[[2]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-5baf5f9e448ad54ab25a091adee0da05d4d228481c9200518fcb1b53a65d4156L26-R28),[[3]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-5baf5f9e448ad54ab25a091adee0da05d4d228481c9200518fcb1b53a65d4156L52-R52),[[4]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-bdd864c61752cd55b1719e51ebc32a2f29a594f928fe17273fe3b6af25767358L24-R28),[[5]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-bdd864c61752cd55b1719e51ebc32a2f29a594f928fe17273fe3b6af25767358L4-R4)).config/dotnet-tools.jsonto usedotnet-efversion 10.0.9 and added therollForwardproperty. ([.config/dotnet-tools.jsonL6-R10](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-7afd3bcf0d0c06d6f87c451ef06b321beef770ece4299b3230bb280470ada2f6L6-R10))Feature Additions and Enhancements:
communityproperty on the client and audap_communityclaim in access tokens, controlled by the newServerSettings.IncludeCommunityClaimoption. Constants and documentation were updated accordingly. ([[1]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b1241229fcfe143330957523056d5f9634e598e0419f572fbdeca2626e79db7eR95-R104),[[2]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-fff32d406f9cda3773001ac9bb118cfabcb58e839165ae8b166272a494ed9e48R213-R218),[[3]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-a4d509d0c36ae5ee6e8ff4ab00228cd134a68fd36fadff1aeee6011b74b5c8a0R26))IUdapClientRegistrationStoreand its implementation to support lookup of tiered clients by IdP base URL, which is now used in tiered OAuth challenges. ([[1]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-8d5aa57d61fe52989121e7d378f9c05b8c21b0f74a85d586447783e84e0c3797R36-R43),[[2]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b01c6a86942dfe04981f1e680aff04a25bebc3806479ac9c2fcf97f160a3b403L167-R176))Project Structure and Build:
[[1]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b1a9e11b184ddf93715fab5ae64a5857e7ded352fc53d85f42904b7e71a295ffL65-L74),[[2]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b1a9e11b184ddf93715fab5ae64a5857e7ded352fc53d85f42904b7e71a295ffL90),[[3]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-6ebdb617a8104a7756d0cf36578ab01103dc9f07e4dc6feb751296b9c402faf7L116-R143))Udap.Server/Hosting/DynamicProviders/Store/UdapInMemoryIdentityProviderStore.csto require a cancellation token for its async methods and clarified return types. ([Udap.Server/Hosting/DynamicProviders/Store/UdapInMemoryIdentityProviderStore.csL24-R38](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-50a5d8dc1f45795d2c407bfb24a2c109fe65eff037484e02b62bb77342ce0165L24-R38))TEFCA and Extension Naming Consistency:
tefca-iastotefca_iasthroughout the codebase and documentation for consistency with the latest standards. Updated references in extension models, metadata, and interface documentation. ([[1]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L75-R79),[[2]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L88-R93),[[3]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L117-R118),[[4]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-dbe50335d3441ace231976cbb21a32414ac5b9ffa84845cc4cd4084aa6ca65a8L95-R95),[[5]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-7c4b43b994eac4c659719f37907a4a4ed3395e53dd90d462edf0721d164de8f9L15-R20),[[6]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-2328aaab2aec678e8c9d44d9283d355a875f19aea992e7f0d1a10c02a6104827L15-R15))Documentation Improvements:
[[1]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L75-R79),[[2]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L88-R93),[[3]](https://github.com/udap-tools/udap-dotnet/pull/42/files#diff-6ebdb617a8104a7756d0cf36578ab01103dc9f07e4dc6feb751296b9c402faf7R56-R82))These changes collectively improve standards compliance, add new features for community identification, and streamline the repository by removing deprecated components.
Expose matched trust anchor from ValidateResource