Masv status list db #231

masv3971 · 2025-12-15T12:59:31Z

No description provided.

…eaning.

Copilot

Pull request overview

This PR implements a Token Status List (TSL) database and service per draft-ietf-oauth-status-list specification, replacing the previous Sparse Merkle Tree registry implementation with a MongoDB-based status list system.

Key Changes:

Replaces Merkle tree registry with Token Status List implementation supporting JWT/CWT formats
Adds MongoDB collections for status lists, metadata, and credential subjects
Implements mTLS support for gRPC communications with certificate fingerprint validation
Adds admin GUI for searching and updating credential status entries

Reviewed changes

Copilot reviewed 89 out of 227 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
proto/v1-registry.proto	Replaces registry RPCs with TSL operations (add/update status, save credential subjects)
proto/v1-issuer.proto	Adds TSL section/index fields to credential replies
pkg/tsl/*.go	New package implementing TSL types, JWT/CWT token generation, compression/encoding
pkg/grpchelpers/*.go	New helpers for gRPC mTLS server/client configuration with fingerprint validation
internal/registry/db/*.go	MongoDB collections for TSL entries, metadata, and credential subjects
internal/registry/tslissuer/*.go	Service for TSL token generation with caching and refresh
internal/registry/httpserver/*.go	HTTP endpoints for status lists and admin GUI
internal/registry/grpcserver/*.go	gRPC endpoints for TSL operations
internal/registry/apiv1/*.go	API handlers for TSL operations, search, and status updates

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/tokenstatuslist/types.go

Copilot · 2025-12-16T09:45:13Z

pkg/tokenstatuslist/jwt.go

+}
+
+// JWTConfig holds JWT-specific configuration for generating a Status List Token.
+// Deprecated: Use StatusList.GenerateJWT with JWTSigningConfig instead.


The deprecation notice says 'Use StatusList.GenerateJWT with JWTSigningConfig instead' but doesn't explain the migration path. Consider adding an example or more detail about how to migrate existing code.

Suggested change

// Deprecated: Use StatusList.GenerateJWT with JWTSigningConfig instead.

// Deprecated: Use StatusList.GenerateJWT with JWTSigningConfig instead.

//

// Migration example:

// // Old usage:

// cfg := JWTConfig{

// SigningKey: myKey,

// SigningMethod: jwt.SigningMethodES256,

// // ... other fields ...

// }

// token, err := statusList.GenerateJWT(cfg)

//

// // New usage:

// signingCfg := JWTSigningConfig{

// SigningKey: cfg.SigningKey,

// SigningMethod: cfg.SigningMethod,

// }

// token, err := statusList.GenerateJWT(signingCfg)

pkg/grpchelpers/server.go

Copilot · 2025-12-16T09:45:14Z

internal/registry/db/methods_token_status_list.go

+	for i := int64(0); i < sectionSize; i++ {
+		docs = append(docs, &TSLDoc{
+			Index:   i,
+			Status:  uint8(rand.IntN(3)),


Magic number 3 for random status generation. Consider using a constant like const MaxStatusValue = 3 or referencing tsl.StatusSuspended + 1 to make the upper bound explicit and maintainable.

Copilot · 2025-12-16T09:45:14Z

internal/registry/db/methods_token_status_list.go

+		}
+
+		filter := bson.M{"index": decoy.Index, "section": section}
+		updateDoc := bson.M{"$set": bson.M{"status": rand.Int64N(3)}}


Type mismatch: using rand.Int64N(3) which returns int64, but status field is uint8. This could cause data corruption. Use rand.IntN(3) and cast to uint8 like line 142.

Suggested change

updateDoc := bson.M{"$set": bson.M{"status": rand.Int64N(3)}}

updateDoc := bson.M{"$set": bson.M{"status": uint8(rand.IntN(3))}}

Copilot · 2025-12-16T09:45:15Z

internal/registry/httpserver/admin_templates.go

+	s = strings.ReplaceAll(s, `"`, "&quot;")
+	s = strings.ReplaceAll(s, "'", "&#39;")


The escapeHTML function implements custom HTML escaping instead of using html.EscapeString from the standard library. This is error-prone and may miss edge cases. Use the standard library function instead.

Copilot · 2025-12-16T09:45:15Z

internal/registry/apiv1/handlers_admin.go

+	if c.tslIssuer != nil {
+		if invalidator, ok := c.tslIssuer.(interface{ InvalidateSection(int64) }); ok {
+			invalidator.InvalidateSection(req.Section)
+		}
+	}


The InvalidateSection method is called via type assertion but is not defined in the TSLIssuer interface. Either add this method to the interface or document why the optional behavior is needed.

pkg/pki/pki.go

internal/registry/db/methods_token_status_list.go

Copilot · 2025-12-16T09:45:16Z

internal/apigw/db/methods_vc_concent.go

-		Options: &options.IndexOptions{
-			Unique: &[]bool{true}[0],
-		},
+		Options: options.Index().SetUnique(true),


Corrected spelling of 'concent' to 'consent' in filename.

leifj · 2025-12-16T12:33:47Z

Looks reasonable. I think most integrators will use the API to revoke but the GUI is a nice touch.

leifj

I think the TSL/CSL thing is pretty risky

leifj · 2025-12-16T12:36:27Z

docs/adr/08-function-return.md

+
+## Decision
+
+We want to return a variable, if applicable named reply


Suggested new language:

When returning a single variable use the name "reply" unless the context makes this inappropriate.

leifj · 2025-12-16T12:39:12Z

internal/apigw/apiv1/handlers_tsl.go

+	"strconv"
+
+	"vc/internal/gen/registry/apiv1_registry"
+	"vc/pkg/tsl"


I am a bit uneasy about the term "tsl" here. I think there is a risk to confuse ourselves with "TSL" as in trust status list (ie etsi ts 119 612 trust status lists). If the intent is to model credential status lists then maybe CSL is the appropriate abreviation.

I just took the name from https://drafts.oauth.net/draft-ietf-oauth-status-list/draft-ietf-oauth-status-list.html#name-historical-resolution-2. How about to rename tsl -> token status list, than it will be pretty clear what's indented.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…tatus-list-db

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

masv3971 added 18 commits October 27, 2025 12:28

Vendoring.

7833aa0

Make statusissuer to a service.

ee45193

Try some different approches to store the list.

2752afd

Service status issuer, removed testdata bin files.

6f95fa3

Merge branch 'main' into masv_status-list-db

4a39105

Move status issuer to apigw, update to mongodb v2 and some smaller cl…

b0d27ac

…eaning.

Merge branch 'main' into masv_status-list-db

d4b7387

Trying to make up a test for binding.

b8bcdea

Spelling.

2f89072

Merge branch 'main' into masv_status-list-db

d3d42d5

Vendoring.

8c2ad73

spelling.

c9f8b7d

Update of pki script.

8e788bc

Bootstrapping.

a9623da

New registry with Token status list and a admin gui.

43f0b7e

Add hostname to containers.

f31a8fa

New ADRs.

17b69ec

Merge branch 'main' into masv_status-list-db

1c83a0a

leifj requested a review from Copilot December 16, 2025 09:32

Copilot AI reviewed Dec 16, 2025

View reviewed changes

leifj self-requested a review December 16, 2025 12:32

leifj requested changes Dec 16, 2025

View reviewed changes

masv3971 and others added 7 commits December 16, 2025 17:11

Rename tsl to token status lists for clarity.

6b1d928

Update pkg/tokenstatuslist/types.go

246c7e5

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update pkg/grpchelpers/server.go

a2d077a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Add const per review.

4dbe261

Merge branch 'masv_status-list-db' of github.com:dc4eu/vc into masv_s…

4d06556

…tatus-list-db

Change to html escapre per review.

b16ca00

Update pkg/pki/pki.go

ba6da36

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

masv3971 and others added 2 commits December 16, 2025 19:52

Update internal/registry/db/methods_token_status_list.go

ca50430

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update per review.

03bdb2c

masv3971 merged commit e3a9e04 into main Dec 17, 2025
2 checks passed

masv3971 deleted the masv_status-list-db branch December 17, 2025 13:41

-// Deprecated: Use StatusList.GenerateJWT with JWTSigningConfig instead.
+// Deprecated: Use StatusList.GenerateJWT with JWTSigningConfig instead.
+//
+// Migration example:
+//   // Old usage:
+//   cfg := JWTConfig{
+//       SigningKey:    myKey,
+//       SigningMethod: jwt.SigningMethodES256,
+//       // ... other fields ...
+//   }
+//   token, err := statusList.GenerateJWT(cfg)
+//
+//   // New usage:
+//   signingCfg := JWTSigningConfig{
+//       SigningKey:    cfg.SigningKey,
+//       SigningMethod: cfg.SigningMethod,
+//   }
+//   token, err := statusList.GenerateJWT(signingCfg)

	updateDoc := bson.M{"$set": bson.M{"status": rand.Int64N(3)}}
	updateDoc := bson.M{"$set": bson.M{"status": uint8(rand.IntN(3))}}

		s = strings.ReplaceAll(s, `"`, """)
		s = strings.ReplaceAll(s, "'", "'")


		## Decision

		We want to return a variable, if applicable named reply

Masv status list db #231

Masv status list db #231

Uh oh!

Conversation

masv3971 commented Dec 15, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

leifj commented Dec 16, 2025

Uh oh!

leifj left a comment

Choose a reason for hiding this comment

Uh oh!

leifj Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

leifj Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

masv3971 Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants