Issuer Registry — Service Reference

message RegisterIssuerRequest {
  string name = 1;
  string website_url = 2;
  bytes public_key = 3;       // BYOK only
  string key_algorithm = 4;   // "Ed25519"
  string contact_email = 5;
  string country_code = 6;
  bool byok = 7;               // false (default) = CUSTODIAL
}
 
message RegisterIssuerResponse {
  string issuer_id = 1;
  string issuer_did = 2;
  string status = 3;           // always "PENDING_APPROVAL"
  string error_message = 4;
  bytes public_key = 5;
  string signing_mode = 6;     // "CUSTODIAL" or "BYOK"
}

message ListIssuersRequest {
  string status_filter = 1;  // e.g. "PENDING_APPROVAL"; empty = all
  int32 page = 2;
  int32 page_size = 3;       // 0 = unpaged
}

{
  "@context": "https://www.w3.org/ns/did/v1",
  "id": "did:key:z...",
  "publicKey": [{
    "id": "did:key:z...#key-1",
    "type": "Ed25519VerificationKey2020",
    "controller": "did:key:z...",
    "publicKeyMultibase": "base64(publicKey)"
  }],
  "authentication": ["did:key:z...#key-1"],
  "assertionMethod": ["did:key:z...#key-1"],
  "updated": "2025-02-27T10:30:00Z"
}

CREATE TABLE authority.issuers (
    issuer_id       UUID            PRIMARY KEY DEFAULT gen_random_uuid(),
    did             VARCHAR(512)    NOT NULL UNIQUE,
    name            VARCHAR(255)    NOT NULL,
    public_key      BYTEA           NOT NULL,
    status          VARCHAR(50)     NOT NULL DEFAULT 'PENDING_APPROVAL'
                        CHECK (status IN ('ACTIVE', 'SUSPENDED', 'REVOKED', 'PENDING_APPROVAL', 'REJECTED')),
    signing_mode    VARCHAR(20)     NOT NULL DEFAULT 'CUSTODIAL'
                        CHECK (signing_mode IN ('CUSTODIAL', 'BYOK')),
    organization_url VARCHAR(512),
    contact_email   VARCHAR(255),
    country_code    VARCHAR(2),
    created_at      TIMESTAMP       NOT NULL DEFAULT CURRENT_TIMESTAMP,
    updated_at      TIMESTAMP       NOT NULL DEFAULT CURRENT_TIMESTAMP
);
 
CREATE TABLE authority.did_registry (
    did               VARCHAR(512)  NOT NULL,
    issuer_id         UUID          NOT NULL REFERENCES authority.issuers(issuer_id) ON DELETE CASCADE,
    public_key        BYTEA         NOT NULL,
    key_version       INT           NOT NULL DEFAULT 1 CHECK (key_version > 0),
    key_algorithm     VARCHAR(50)   NOT NULL DEFAULT 'Ed25519',
    is_current        BOOLEAN       NOT NULL DEFAULT TRUE,
    created_at        TIMESTAMP     NOT NULL DEFAULT CURRENT_TIMESTAMP,
    key_rotation_date TIMESTAMP,
    PRIMARY KEY (did, key_version)
);
-- unique index: (did) WHERE is_current — at most one current key version per DID
 
CREATE TABLE authority.signing_keys (
    did                    VARCHAR(512)  NOT NULL REFERENCES authority.issuers(did) ON DELETE CASCADE,
    key_version            INT           NOT NULL DEFAULT 1 CHECK (key_version > 0),
    public_key             BYTEA         NOT NULL,
    encrypted_private_key  BYTEA         NOT NULL,   -- AES-256-GCM ciphertext
    encryption_nonce       VARCHAR(24)   NOT NULL,
    algorithm              VARCHAR(50)   NOT NULL DEFAULT 'Ed25519',
    is_current             BOOLEAN       NOT NULL DEFAULT TRUE,
    created_at             TIMESTAMP     NOT NULL DEFAULT CURRENT_TIMESTAMP,
    PRIMARY KEY (did, key_version)
);
 
CREATE TABLE authority.issuer_sso_config (
    sso_config_id         UUID          PRIMARY KEY DEFAULT gen_random_uuid(),
    issuer_id             UUID          NOT NULL UNIQUE REFERENCES authority.issuers(issuer_id) ON DELETE CASCADE,
    protocol              VARCHAR(10)   NOT NULL CHECK (protocol IN ('SAML2.0', 'OIDC')),
    provider              VARCHAR(100)  NOT NULL,
    status                VARCHAR(30)   NOT NULL DEFAULT 'PENDING_VALIDATION'
                              CHECK (status IN ('PENDING_VALIDATION', 'VALIDATED', 'ACTIVE', 'INACTIVE', 'FAILED')),
    validation_error      TEXT,
    validated_at          TIMESTAMP,
    created_at            TIMESTAMP     NOT NULL DEFAULT CURRENT_TIMESTAMP,
    updated_at            TIMESTAMP     NOT NULL DEFAULT CURRENT_TIMESTAMP
);