Pkcs11ex.Config (pkcs11ex v0.1.0)

Copy Markdown View Source

Configuration schema and validator for pkcs11ex.

See docs/specs/api.md §1 for the canonical schema. This module is the authoritative implementation of that schema. Boot-time validation runs from Pkcs11ex.Application.start/2; bad configuration prevents the OTP application from starting.

Two-stage validation:

  1. Schema validation via NimbleOptions — type-checks every key.
  2. Cross-field invariants — the eleven rules documented in api.md §1.5 (allowlist non-empty, default_slot exists, pin_callback rules, key/cert exclusivity, driver existence, driver pin SHA-256 match, etc.).

All failures raise Pkcs11ex.Error with reason: :invalid_config and a :path indicating the offending config key.

Summary

Types

alg()
slot_type()
t()

Functions

load!(opts \\ [])

Loads, validates, and structures the configuration.

schema()

Returns the canonical NimbleOptions schema (top-level only).

Types

alg()

@type alg() :: :PS256 | :RS256 | :ES256 | :EdDSA

slot_type()

@type slot_type() :: :cloud_hsm | :token | :soft_hsm

t()

@type t() :: %Pkcs11ex.Config{
  algorithms: %{optional(atom()) => module()},
  allowed_algs: [alg(), ...],
  default_slot: atom() | nil,
  driver_pins: %{optional(String.t()) => String.t()},
  session_timeout: non_neg_integer(),
  signature_header: String.t(),
  slots: keyword(),
  telemetry_prefix: [atom()],
  trust_policy: module()
}

Functions

load!(opts \\ [])

@spec load!(opts :: keyword()) :: t()

Loads, validates, and structures the configuration.

Options

  • :env — keyword list to validate. Defaults to Application.get_all_env(:pkcs11ex).
  • :check_files — when true (default), validates that each slot's driver exists on disk and that any :driver_pins SHA-256 matches the on-disk file. Tests pass false to skip these checks.

Errors

Raises Pkcs11ex.Error with reason: :invalid_config on any failure. The exception's :path indicates the offending config key.

schema()

@spec schema() :: keyword()

Returns the canonical NimbleOptions schema (top-level only).