انتقل إلى المحتوى الرئيسي

Interface: Pkcs11KeyCustodianOptions

Defined in: packages/key-custodian/src/pkcs11/adapter.ts:127

What createPkcs11KeyCustodian needs. library, tokenLabel, pin, maxSessions and the three expected* fields spread in from keyCustodian.pkcs11; the rest come from the service.

Extends​

Properties​

environment​

readonly environment: "staging" | "development" | "ci" | "integration" | "production"

Defined in: packages/key-custodian/src/pkcs11/adapter.ts:129

The environment class, from validated configuration and never from NODE_ENV.

expectedManufacturer?​

readonly optional expectedManufacturer?: string

Defined in: packages/key-custodian/src/policy.ts:102

CK_TOKEN_INFO.manufacturerID the token must report, such as Thales.

Inherited from​

ExpectedToken.expectedManufacturer

expectedModel?​

readonly optional expectedModel?: string

Defined in: packages/key-custodian/src/policy.ts:104

CK_TOKEN_INFO.model the token must report.

Inherited from​

ExpectedToken.expectedModel

expectedSerial?​

readonly optional expectedSerial?: string

Defined in: packages/key-custodian/src/policy.ts:109

CK_TOKEN_INFO.serialNumber the token must report. Handles address a token by label, and two tokens can share a label; the serial pins the one the handles were minted on.

Inherited from​

ExpectedToken.expectedSerial

library​

readonly library: string

Defined in: packages/key-custodian/src/pkcs11/adapter.ts:134

Absolute path of the PKCS#11 module, such as /usr/lib/softhsm/libsofthsm2.so. This is code: the process loads and runs it, so it must come from read-only configuration.

loadLibrary?​

readonly optional loadLibrary?: Pkcs11LibraryLoader

Defined in: packages/key-custodian/src/pkcs11/adapter.ts:157

Replaces the native binding, for tests. Default: pkcs11js.

log​

readonly log: KeyCustodianLog

Defined in: packages/key-custodian/src/pkcs11/adapter.ts:143

Receives the staging notice. Required, so the notice cannot be skipped by omission.

maxSessions?​

readonly optional maxSessions?: number

Defined in: packages/key-custodian/src/pkcs11/adapter.ts:145

The session pool's size. Default DEFAULT_MAX_SESSIONS.

pin​

readonly pin: Secret<string>

Defined in: packages/key-custodian/src/pkcs11/adapter.ts:141

The user PIN, resolved from the secret store. Revealed only inside C_Login.

purposes?​

readonly optional purposes?: readonly KeyPurpose[]

Defined in: packages/key-custodian/src/pkcs11/adapter.ts:155

The purposes this process will generate keys for, of either family. Default: every purpose, which a deployable should not rely on: name the ones it needs, so that the audit deployable cannot be asked for a trust-chain key. An empty list is refused as invalid_request: a custodian that may generate nothing has no reason to log in.

The list limits generation only. Using a key (signing, wrapping, unwrapping) is limited by which handles the caller holds and by what the token lets the key do.

tokenLabel​

readonly tokenLabel: string

Defined in: packages/key-custodian/src/pkcs11/adapter.ts:139

The label of the token to use. Every handle minted carries it. Labels are not unique across tokens; expectedSerial pins the one meant.