{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "vaultfire.trusted-identities.v2.schema.json",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "$schema",
    "schemaVersion",
    "status",
    "subjectOrganizationId",
    "partnerOrganizationId",
    "externalTrustRootId",
    "registryAttestation",
    "legalEntities",
    "identities"
  ],
  "properties": {
    "$schema": {
      "const": "../schemas/trusted-identities.schema.json"
    },
    "schemaVersion": {
      "const": "2.0.0"
    },
    "status": {
      "enum": [
        "unconfigured",
        "external-human-attested"
      ]
    },
    "subjectOrganizationId": {
      "type": [
        "string",
        "null"
      ],
      "pattern": "^organization:[0-9a-f]{64}$"
    },
    "partnerOrganizationId": {
      "type": [
        "string",
        "null"
      ],
      "pattern": "^organization:[0-9a-f]{64}$"
    },
    "externalTrustRootId": {
      "type": [
        "string",
        "null"
      ],
      "pattern": "^trust-root:[0-9a-f]{64}$"
    },
    "registryAttestation": {
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": false,
      "required": [
        "registryPayloadSha256",
        "issuedAtUtc",
        "expiresAtUtc",
        "signatureBase64"
      ],
      "properties": {
        "registryPayloadSha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$"
        },
        "issuedAtUtc": {
          "type": "string",
          "format": "date-time"
        },
        "expiresAtUtc": {
          "type": "string",
          "format": "date-time"
        },
        "signatureBase64": {
          "type": "string",
          "pattern": "^[A-Za-z0-9+/]{86}==$"
        }
      }
    },
    "identities": {
      "type": "array",
      "uniqueItems": true,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "identityId",
          "identityClass",
          "organizationId",
          "allowedRoles",
          "publicKeyBase64",
          "membershipEvidenceId",
          "keyOwnershipEvidenceId",
          "keyOwnershipPayloadSha256",
          "keyOwnershipSignatureBase64",
          "authorityEvidenceId",
          "externalAttestationId"
        ],
        "properties": {
          "identityId": {
            "type": "string",
            "pattern": "^identity:[0-9a-f]{64}$"
          },
          "identityClass": {
            "enum": [
              "internal-human",
              "partner-human"
            ]
          },
          "organizationId": {
            "type": "string",
            "pattern": "^organization:[0-9a-f]{64}$"
          },
          "allowedRoles": {
            "type": "array",
            "minItems": 1,
            "uniqueItems": true,
            "items": {
              "$ref": "#/$defs/role"
            }
          },
          "publicKeyBase64": {
            "type": "string",
            "pattern": "^[A-Za-z0-9+/]{43}=$"
          },
          "membershipEvidenceId": {
            "enum": [
              "ROLE-ASSIGNMENTS",
              "PARTNER-ACCEPTANCE"
            ]
          },
          "keyOwnershipEvidenceId": {
            "const": "SIGNATURES"
          },
          "keyOwnershipPayloadSha256": {
            "type": "string",
            "pattern": "^[0-9a-f]{64}$"
          },
          "keyOwnershipSignatureBase64": {
            "type": "string",
            "pattern": "^[A-Za-z0-9+/]{86}==$"
          },
          "authorityEvidenceId": {
            "enum": [
              "AUTHORIZED-SIGNATORY",
              "ROLE-ASSIGNMENTS",
              "PARTNER-ACCEPTANCE",
              "COUNSEL-SIGNOFF",
              "PRIVACY-SIGNOFF",
              "ACTUAL-CONTACTS",
              "SUPPORT-SLA-SELECTION",
              "CHANGE-RACI-ACCEPTANCE",
              "CANDIDATE-BINDING"
            ]
          },
          "externalAttestationId": {
            "type": "string",
            "pattern": "^external-attestation:[0-9a-f]{64}$"
          }
        }
      }
    },
    "legalEntities": {
      "type": "array",
      "maxItems": 2,
      "uniqueItems": true,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "organizationId",
          "legalName",
          "jurisdiction",
          "registrationReference",
          "verificationEvidencePath",
          "verificationEvidenceSha256"
        ],
        "properties": {
          "organizationId": {
            "type": "string",
            "pattern": "^organization:[0-9a-f]{64}$"
          },
          "legalName": {
            "type": "string",
            "minLength": 3,
            "maxLength": 256
          },
          "jurisdiction": {
            "type": "string",
            "minLength": 3,
            "maxLength": 128
          },
          "registrationReference": {
            "type": "string",
            "minLength": 5,
            "maxLength": 128
          },
          "verificationEvidencePath": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1024
          },
          "verificationEvidenceSha256": {
            "type": "string",
            "pattern": "^[0-9a-f]{64}$"
          }
        }
      }
    }
  },
  "$defs": {
    "role": {
      "type": "string",
      "enum": [
        "authorized-signatory",
        "change-approver",
        "commercial-owner",
        "incident-commander",
        "independent-reviewer",
        "legal-reviewer",
        "partner-authorized-signatory",
        "privacy-reviewer",
        "release-manager",
        "security-contact",
        "support-owner"
      ]
    }
  }
}
