PD-82 — Plan d'implémentation¶

@Entity({ name: 'dual_validation_request', schema: 'vault_secure' })
export class DualValidationRequest {
  @PrimaryGeneratedColumn('uuid')
  id!: string;

  @Column({ type: 'uuid', name: 'delegation_id', unique: true })
  delegationId!: string;  // PRE delegation target

  @Column({ type: 'uuid', name: 'minor_vault_id' })
  minorVaultId!: string;

  @Column({ type: 'uuid', name: 'parent_user_id' })
  parentUserId!: string;

  @Column({ type: 'uuid', name: 'authority_id', nullable: true })
  authorityId?: string;  // Resolved from internal registry

  @Column({ type: 'varchar', length: 20, name: 'state' })
  state!: ValidationState;  // PENDING_BOTH, PENDING_AUTHORITY, etc.

  @Column({ type: 'timestamptz', precision: 3, name: 'created_at' })
  createdAt!: Date;

  @Column({ type: 'timestamptz', precision: 3, name: 'first_validation_at', nullable: true })
  firstValidationAt?: Date;  // TTL starts here

  @Column({ type: 'timestamptz', precision: 3, name: 'activated_at', nullable: true })
  activatedAt?: Date;

  @Column({ type: 'timestamptz', precision: 3, name: 'expires_at', nullable: true })
  expiresAt?: Date;  // firstValidationAt + 168h

  @OneToMany(() => ValidationRecord, (v) => v.request)
  validations!: ValidationRecord[];
}

@Entity({ name: 'validation_record', schema: 'vault_secure' })
export class ValidationRecord {
  @PrimaryGeneratedColumn('uuid')
  id!: string;

  @ManyToOne(() => DualValidationRequest, (r) => r.validations)
  @JoinColumn({ name: 'request_id' })
  request!: DualValidationRequest;

  @Column({ type: 'uuid', name: 'request_id' })
  requestId!: string;

  @Column({ type: 'varchar', length: 20, name: 'validator_type' })
  validatorType!: 'PARENT' | 'AUTHORITY';

  @Column({ type: 'uuid', name: 'validator_id' })
  validatorId!: string;

  @Column({ type: 'timestamptz', precision: 3, name: 'validated_at' })
  validatedAt!: Date;  // Probatory timestamp

  @Column({ type: 'bytea', name: 'signature' })
  signature!: Buffer;  // Cryptographic signature

  @Column({ type: 'varchar', length: 32, name: 'signature_algorithm' })
  signatureAlgorithm!: string;  // e.g., 'Ed25519', 'ECDSA-P256'

  @Column({ type: 'text', name: 'certificate_chain' })
  certificateChain!: string;  // X.509v3 PEM chain

  @Column({ type: 'varchar', length: 20, name: 'eidas_level' })
  eidasLevel!: 'substantial' | 'high';

  @Column({ type: 'boolean', name: 'revoked', default: false })
  revoked!: boolean;

  @Column({ type: 'timestamptz', precision: 3, name: 'revoked_at', nullable: true })
  revokedAt?: Date;

  @Column({ type: 'char', length: 64, name: 'event_hash' })
  eventHash!: string;  // Link to audit log
}

export enum ValidationState {
  PENDING_BOTH = 'PENDING_BOTH',
  PENDING_AUTHORITY = 'PENDING_AUTHORITY',
  PENDING_PARENT = 'PENDING_PARENT',
  ACTIVATED = 'ACTIVATED',
  REJECTED = 'REJECTED',
  EXPIRED = 'EXPIRED',
}

export enum ValidationEventType {
  REQUEST_CREATED = 'DVAL_REQUEST_CREATED',
  PARENT_VALIDATED = 'DVAL_PARENT_VALIDATED',
  AUTHORITY_VALIDATED = 'DVAL_AUTHORITY_VALIDATED',
  VALIDATION_REVOKED = 'DVAL_VALIDATION_REVOKED',
  REQUEST_ACTIVATED = 'DVAL_REQUEST_ACTIVATED',
  REQUEST_EXPIRED = 'DVAL_REQUEST_EXPIRED',
  INVALID_ATTEMPT = 'DVAL_INVALID_ATTEMPT',
}

export interface IDualValidationService {
  /**
   * Creates a new dual-validation request for PRE activation.
   * INV-82-11: No PRE keys activated at creation.
   */
  createRequest(params: CreateRequestParams): Promise<DualValidationRequest>;

  /**
   * Submits a validation from parent or authority.
   * INV-82-06: Validation timestamped with probatory timestamp.
   * INV-82-09: Signature cryptographically verified.
   * INV-82-10: Identity non-contestable (X.509v3/eIDAS).
   */
  submitValidation(params: SubmitValidationParams): Promise<ValidationResult>;

  /**
   * Revokes own validation before activation.
   * INV-82-04: Revocation leads to REJECTED state.
   */
  revokeValidation(params: RevokeValidationParams): Promise<RevocationResult>;

  /**
   * Gets request status for tracking.
   */
  getRequestStatus(requestId: string): Promise<RequestStatusDto>;

  /**
   * Processes TTL expiration (called by scheduler).
   * INV-82-03: After 7 days, state becomes EXPIRED.
   */
  processExpirations(): Promise<number>;
}

export interface IStateMachineService {
  /**
   * Computes next state based on current state and event.
   * INV-82-01: Single validation never triggers activation.
   * INV-82-08: Order of validations is irrelevant.
   */
  transition(current: ValidationState, event: StateEvent): ValidationState;

  /**
   * Checks if a transition is valid.
   * INV-82-04: No transition from terminal states.
   */
  canTransition(current: ValidationState, target: ValidationState): boolean;

  /**
   * Returns terminal states.
   */
  getTerminalStates(): ValidationState[];
}

// Extension interface pour PD-82
export interface IPreActivationService {
  /**
   * Activates PRE delegation after 2-of-2 validation.
   * Called by DualValidationService when state === ACTIVATED.
   * Must be idempotent (HYP-82-01).
   */
  activatePRE(delegationId: string): Promise<PreActivationResult>;
}

private async triggerActivation(request: DualValidationRequest): Promise<void> {
  // INV-82-01: Verify both validations present
  const validations = await this.getValidValidations(request.id);
  if (validations.length !== 2) {
    throw new DualValidationError('ACTIVATION_REQUIRES_TWO_VALIDATIONS');
  }

  // INV-82-11: Only activate if state is ACTIVATED
  if (request.state !== ValidationState.ACTIVATED) {
    throw new DualValidationError('INVALID_STATE_FOR_ACTIVATION');
  }

  // Call PD-41 PRE module
  await this.preService.activatePRE(request.delegationId);

  // Log activation event (CA-82-09)
  await this.auditWriter.write({
    eventType: ValidationEventType.REQUEST_ACTIVATED,
    eventPayloadCanonical: {
      requestId: request.id,
      delegationId: request.delegationId,
      validationIds: validations.map(v => v.id),
    },
  });
}

export enum AuthEventType {
  // ... existing types ...
  DVAL_REQUEST_CREATED = 'DVAL_REQUEST_CREATED',
  DVAL_PARENT_VALIDATED = 'DVAL_PARENT_VALIDATED',
  DVAL_AUTHORITY_VALIDATED = 'DVAL_AUTHORITY_VALIDATED',
  DVAL_VALIDATION_REVOKED = 'DVAL_VALIDATION_REVOKED',
  DVAL_REQUEST_ACTIVATED = 'DVAL_REQUEST_ACTIVATED',
  DVAL_REQUEST_EXPIRED = 'DVAL_REQUEST_EXPIRED',
  DVAL_INVALID_ATTEMPT = 'DVAL_INVALID_ATTEMPT',
}

interface DvalEventPayload {
  requestId: string;
  delegationId: string;
  minorVaultId: string;
  validatorType?: 'PARENT' | 'AUTHORITY';
  validatorId?: string;
  validationIds?: string[];  // For activation event
  reason?: string;           // For invalid attempts
  previousState?: ValidationState;
  newState?: ValidationState;
}