Udap.Client minor updates and continued work on the Sigil CA tool.

.gitignore

@@ -225,5 +225,6 @@ examples/clients/UdapEd/Client/wwwroot/temp/MudBlazor.min.css
 /examples/Udap.Proxy.Server/CertStore/issued/fhirLabsApiClientLocalhostCert.pfx
 /examples/Udap.Proxy.Server/CertStore/issued/gfhirlabs.healthcare.client.pfx
 /coverage-results
-/.claude
+# Ignore .claude directories (Claude Code per-project settings) anywhere in the tree
+.claude/
 docs/specifications/SSRAA/V2.0.0/ssraa_full-ig_v2.0.0.zip

Directory.Packages.props

@@ -3,101 +3,99 @@
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
     <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
-
   <!-- Framework-independent packages -->
   <ItemGroup>
     <!-- https://learn.microsoft.com/en-us/nuget/concepts/package-versioning#version-ranges -->
     <PackageVersion Include="BouncyCastle.Cryptography" Version="2.6.2" />
-    <PackageVersion Include="Duende.IdentityServer.Storage" Version="7.4.6" />
+    <PackageVersion Include="Duende.IdentityServer.Storage" Version="7.4.7" />
     <PackageVersion Include="Google.Apis.Auth" Version="1.73.0" />
     <PackageVersion Include="Google.Cloud.Storage.Control.V2" Version="1.7.0" />
     <PackageVersion Include="Google.Cloud.Storage.V1" Version="4.14.0" />
-    <PackageVersion Include="Hl7.Fhir.Base" Version="5.13.2" />
-    <PackageVersion Include="Hl7.Fhir.R4B" Version="5.13.2" />
+    <PackageVersion Include="Hl7.Fhir.Base" Version="5.13.3" />
+    <PackageVersion Include="Hl7.Fhir.R4B" Version="5.13.3" />
     <PackageVersion Include="LazyCache" Version="2.4.0" />
     <PackageVersion Include="AspNetCoreRateLimit" Version="5.0.0" />
-    <PackageVersion Include="Hl7.Fhir.Specification.R4B" Version="5.13.2" />
+    <PackageVersion Include="Hl7.Fhir.Specification.R4B" Version="5.13.3" />
     <PackageVersion Include="Microsoft.AspNetCore.Mvc" Version="2.2.0" />
-    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.16.0" />
-    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.103" />
+    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.18.0" />
+    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.300" />
     <PackageVersion Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" Version="1.23.0" />
     <PackageVersion Include="MSTest.TestAdapter" Version="4.1.0" />
     <PackageVersion Include="MSTest.TestFramework" Version="4.1.0" />
-    <PackageVersion Include="Duende.IdentityModel" Version="8.0.0" />
-    <PackageVersion Include="Duende.IdentityServer" Version="7.4.6" />
-    <PackageVersion Include="Duende.IdentityServer.AspNetIdentity" Version="7.4.6" />
-    <PackageVersion Include="Duende.IdentityServer.EntityFramework.Storage" Version="7.4.6" />
-    <PackageVersion Include="OpenTelemetry" Version="1.15.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.15.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.0" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.15.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.15.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.15.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.SqlClient" Version="1.15.0" />
+    <PackageVersion Include="Duende.IdentityModel" Version="8.1.0" />
+    <PackageVersion Include="Duende.IdentityServer" Version="7.4.7" />
+    <PackageVersion Include="Duende.IdentityServer.AspNetIdentity" Version="7.4.7" />
+    <PackageVersion Include="Duende.IdentityServer.EntityFramework.Storage" Version="7.4.7" />
+    <PackageVersion Include="OpenTelemetry" Version="1.15.3" />
+    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.15.3" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.15.3" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.15.2" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.15.1" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.SqlClient" Version="1.15.2" />
     <PackageVersion Include="Hangfire.Core" Version="1.8.20" />
     <PackageVersion Include="Hangfire.AspNetCore" Version="1.8.20" />
     <PackageVersion Include="Hangfire.PostgreSql" Version="1.20.10" />
     <PackageVersion Include="Serilog.AspNetCore" Version="10.0.0" />
     <PackageVersion Include="Serilog.Enrichers.Thread" Version="4.0.0" />
-    <PackageVersion Include="Spectre.Console" Version="0.54.0" />
-    <PackageVersion Include="Spectre.Console.Cli" Version="0.53.1" />
-    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.16.0" />
+    <PackageVersion Include="Spectre.Console" Version="0.55.2" />
+    <PackageVersion Include="Spectre.Console.Cli" Version="0.55.0" />
+    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.18.0" />
     <PackageVersion Include="Udap.Metadata.Server" Version="0.3.24" />
     <PackageVersion Include="Yarp.ReverseProxy" Version="2.3.0" />
-    <PackageVersion Include="ZiggyCreatures.FusionCache" Version="2.5.0" />
-
+    <PackageVersion Include="ZiggyCreatures.FusionCache" Version="2.6.0" />
     <!-- UDAP AI CLI -->
     <PackageVersion Include="Microsoft.SemanticKernel" Version="1.74.0" />
     <PackageVersion Include="Microsoft.SemanticKernel.Connectors.AzureOpenAI" Version="1.74.0" />
     <PackageVersion Include="Terminal.Gui" Version="2.0.0-develop.5203" />
-
     <!-- Unconditional: Hl7.Fhir 6.x requires Extensions.Caching.Memory 10.x which cascades to require
-         these at >= 10.0.1 for all TFMs. Duende.IdentityServer.Storage 7.4.6 requires
+         these at >= 10.0.1 for all TFMs. Duende.IdentityServer.Storage 7.4.7 requires
          DataProtection.Abstractions >= 10.0.0 for all TFMs. -->
-    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.Abstractions" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.Bcl.Memory" Version="10.0.5" />
+    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.Abstractions" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Bcl.Memory" Version="10.0.8" />
   </ItemGroup>
-
   <!-- net8.0 ASP.NET Core framework-versioned packages -->
   <ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="8.0.19" />
-    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="8.0.19" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="8.0.27" />
+    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="8.0.27" />
   </ItemGroup>
-
   <!-- net9.0 ASP.NET Core framework-versioned packages -->
   <ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="9.0.8" />
-    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="9.0.8" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="9.0.16" />
+    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="9.0.16" />
   </ItemGroup>
-
-  <!-- net8.0 and net9.0 shared runtime-versioned packages -->
-  <!-- EFCore 9.0.9 required: Duende.IdentityServer.EntityFramework.Storage 7.4.6 pulls in EFCore.Relational 9.0.9 -->
-  <ItemGroup Condition="'$(TargetFramework)' == 'net8.0' Or '$(TargetFramework)' == 'net9.0'">
-    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="9.0.9" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.9" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="9.0.9" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.9" />
+  <!-- net8.0 EF Core packages (pinned to 9.0.x; Duende.IdentityServer.EntityFramework.Storage 7.4.7 requires >= 9.0.9) -->
+  <ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="9.0.16" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.16" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="9.0.16" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.16" />
+  </ItemGroup>
+  <!-- net9.0 EF Core packages -->
+  <ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="9.0.16" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.16" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="9.0.16" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.16" />
   </ItemGroup>
-
   <!-- net10.0 runtime-versioned packages -->
   <ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.4" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.4" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.8" />
   </ItemGroup>
-
-</Project>
+</Project>

Dockerfile.gcp

@@ -62,7 +62,16 @@ COPY ["examples/Udap.Auth.Server.Admin/Udap.Auth.Server.Admin.csproj", "examples
 COPY ["examples/Udap.Identity.Provider/Udap.Identity.Provider.csproj", "examples/Udap.Identity.Provider/"]
 COPY ["examples/Udap.Identity.Provider.2/Udap.Identity.Provider.2.csproj", "examples/Udap.Identity.Provider.2/"]
 COPY ["examples/Udap.Proxy.Server/Udap.Proxy.Server.csproj", "examples/Udap.Proxy.Server/"]
-COPY ["examples/Udap.CA/Udap.CA.csproj", "examples/Udap.CA/"]
+COPY ["examples/CA/Sigil/Sigil.csproj", "examples/CA/Sigil/"]
+COPY ["examples/CA/Sigil.Common/Sigil.Common.csproj", "examples/CA/Sigil.Common/"]
+COPY ["examples/CA/Sigil.UI/Sigil.UI.csproj", "examples/CA/Sigil.UI/"]
+COPY ["examples/CA/Sigil.Certificate.Server/Sigil.Certificate.Server.csproj", "examples/CA/Sigil.Certificate.Server/"]
+COPY ["examples/CA/Sigil.Vault/Sigil.Vault.csproj", "examples/CA/Sigil.Vault/"]
+COPY ["examples/CA/Sigil.Vault.Hosting/Sigil.Vault.Hosting.csproj", "examples/CA/Sigil.Vault.Hosting/"]
+COPY ["examples/CA/Sigil.Gcp/Sigil.Gcp.csproj", "examples/CA/Sigil.Gcp/"]
+COPY ["examples/CA/Sigil.FileSystem/Sigil.FileSystem.csproj", "examples/CA/Sigil.FileSystem/"]
+COPY ["examples/CA/Sigil.AppHost/Sigil.AppHost.csproj", "examples/CA/Sigil.AppHost/"]
+COPY ["examples/CA/Sigil.ServiceDefaults/Sigil.ServiceDefaults.csproj", "examples/CA/Sigil.ServiceDefaults/"]
 COPY ["examples/Udap.Pki.Cli/Udap.Pki.Cli.csproj", "examples/Udap.Pki.Cli/"]
 COPY ["examples/Udap.Certificates.Server/Udap.Certificates.Server.csproj", "examples/Udap.Certificates.Server/"]
 COPY ["examples/mTLS.Proxy.Server/mTLS.Proxy.Server.csproj", "examples/mTLS.Proxy.Server/"]
@@ -78,7 +87,7 @@ COPY ["_tests/Udap.Support.Tests/Udap.Support.Tests.csproj", "_tests/Udap.Suppor
 COPY ["_tests/Udap.PKI.Generator/Udap.PKI.Generator.csproj", "_tests/Udap.PKI.Generator/"]
 COPY ["_tests/UdapServer.Tests/UdapServer.Tests.csproj", "_tests/UdapServer.Tests/"]
 COPY ["_tests/UdapMetadata.Tests/UdapMetadata.Tests.csproj", "_tests/UdapMetadata.Tests/"]
-COPY ["_tests/Udap.CA.Tests/Udap.CA.Tests.csproj", "_tests/Udap.CA.Tests/"]
+COPY ["examples/CA/_tests/Sigil.Signing.Tests/Sigil.Signing.Tests.csproj", "examples/CA/_tests/Sigil.Signing.Tests/"]
 COPY ["_tests/Udap.Client.System.Tests/Udap.Client.System.Tests.csproj", "_tests/Udap.Client.System.Tests/"]
 COPY ["_tests/Udap.Idi.Patient.Match.Tests/Udap.Idi.Patient.Match.Tests.csproj", "_tests/Udap.Idi.Patient.Match.Tests/"]
 

README.md

@@ -73,7 +73,6 @@ UDAP is a PKI extension profile to OAuth 2.0. One or more PKIs can be hosted by
 | `hl7-b2b` | SSRAA / TEFCA | :white_check_mark: | B2B extension for client_credentials — purpose_of_use enforcement |
 | `hl7-b2b-user` | SSRAA | :white_check_mark: | B2B extension for authorization_code with user context (FHIR Person) |
 | `tefca-ias` | TEFCA | :white_check_mark: | Individual Access Services — patient/user info, consent, id_token |
-| `tefca_smart` | TEFCA | :black_square_button: | Constants defined; model and validation not yet implemented |
 
 **Pluggable validation** via `IUdapAuthorizationExtensionValidator` with per-community rules:
 - **SSRAA** — validates against HL7 v3 PurposeOfUse value set (60+ codes)
@@ -115,7 +114,7 @@ UDAP is a PKI extension profile to OAuth 2.0. One or more PKIs can be hosted by
 | Package | Description |
 |:---|:---|
 | [![Udap.Ssraa.Server](https://img.shields.io/nuget/v/Udap.Ssraa.Server?label=Udap.Ssraa.Server)](https://www.nuget.org/packages/Udap.Ssraa.Server) | SSRAA community validation (purpose_of_use value set, required extensions) |
-| [![Udap.Tefca.Model](https://img.shields.io/nuget/v/Udap.Tefca.Model?label=Udap.Tefca.Model)](https://www.nuget.org/packages/Udap.Tefca.Model) | TEFCA extension models (`tefca-ias`, `tefca_smart`, XP constants) |
+| [![Udap.Tefca.Model](https://img.shields.io/nuget/v/Udap.Tefca.Model?label=Udap.Tefca.Model)](https://www.nuget.org/packages/Udap.Tefca.Model) | TEFCA extension models (`tefca-ias`, XP constants) |
 | [![Udap.Tefca.Server](https://img.shields.io/nuget/v/Udap.Tefca.Server?label=Udap.Tefca.Server)](https://www.nuget.org/packages/Udap.Tefca.Server) | TEFCA community validation (XP codes, SAN matching) |
 
 ### Configuration Docs

Udap.Client/Client/DiscoveryEndpoint.cs

@@ -6,7 +6,7 @@
 using Udap.Common.Extensions;
 using Udap.Model;
 
-namespace Udap.Client.Client;
+namespace Udap.Client;
 
 /// <summary>
 /// Represents a URL to a discovery endpoint - parsed to separate the URL and authority

Udap.Client/Client/DiscoveryPolicy.cs

@@ -6,7 +6,7 @@
 using Duende.IdentityModel.Client;
 using Udap.Model;
 
-namespace Udap.Client.Client;
+namespace Udap.Client;
 
 /// <summary>
 /// Security policy for retrieving a discovery document

Udap.Client/Client/Extensions/HttpClientTokenRequestExtensions.cs

@@ -24,7 +24,7 @@
 using Udap.Model.Access;
 using TokenResponse = Duende.IdentityModel.Client.TokenResponse;
 
-namespace Udap.Client.Client.Extensions;
+namespace Udap.Client.Extensions;
 
 /// <summary>
 /// HttpClient extensions for UDAP extended OAuth token requests
@@ -57,12 +57,12 @@ public static Task<TokenResponse> UdapRequestClientCredentialsTokenAsync(
     /// </summary>
     /// <param name="client">The client.</param>
     /// <param name="tokenRequest">The request.</param>
-    /// <param name="token">The cancellation token.</param>
+    /// <param name="cancellationToken">The cancellation token.</param>
     /// <returns></returns>
     public static Task<TokenResponse> ExchangeCodeForTokenResponse(
-        this HttpMessageInvoker client, 
+        this HttpMessageInvoker client,
         AuthorizationCodeTokenRequest tokenRequest,
-        CancellationToken token = default)
+        CancellationToken cancellationToken = default)
     {
         var clone = tokenRequest.Clone();
 
@@ -81,7 +81,7 @@ public static Task<TokenResponse> ExchangeCodeForTokenResponse(
             clone.Parameters.AddRequired(OidcConstants.TokenRequest.Resource, resource, allowDuplicates: true);
         }
 
-        return client.RequestTokenAsync(clone, token);
+        return client.RequestTokenAsync(clone, cancellationToken);
     }
 
     internal static async Task<TokenResponse> RequestTokenAsync(this HttpMessageInvoker client, ProtocolRequest request, CancellationToken cancellationToken = default)
@@ -151,9 +151,7 @@ public static async Task<OAuthTokenResponse> ExchangeCodeForAuthTokenResponse(
             false => PrepareFailedOAuthTokenResponse(JsonDocument.Parse(body))
         };
     }
-
-    //TODO: how can I refactor out the OAuthTokenResponse?  It requires the Microsoft.AspNetCore.App framework to be included.
-    // I need a Udap.TieredOauth package so simple clients do not need this reference.
+
     private static OAuthTokenResponse PrepareFailedOAuthTokenResponse(JsonDocument jsonDocument)
     {
         var root = jsonDocument.RootElement;

Udap.Client/Client/Extensions/HttpUdapClientDiscoveryExtensions.cs

@@ -13,10 +13,10 @@
 #endregion
 
 using Duende.IdentityModel.Client;
-using Udap.Client.Client.Messages;
+using Udap.Client.Messages;
 using Udap.Common.Extensions;
 
-namespace Udap.Client.Client.Extensions
+namespace Udap.Client.Extensions
 {
     /// <summary>
     /// HttpClient extensions for UDAP discovery