Description
CreateOptions.signers is part of the public OpenTDF.createTDF() API but is never read or forwarded. Supplying it has no runtime effect.
Assertion signing currently uses assertionConfigs[].signingKey. DPoP signing uses dpopKeys. The vendored JOSE helpers do not consume CreateOptions.signers.
Expected outcome
Choose one:
- Remove
CreateOptions.signers as dead API, with the appropriate compatibility plan.
- Implement and document how
signers maps into the TDF creation and assertion-signing flow.
Add coverage proving the selected behavior.
Description
CreateOptions.signersis part of the publicOpenTDF.createTDF()API but is never read or forwarded. Supplying it has no runtime effect.Assertion signing currently uses
assertionConfigs[].signingKey. DPoP signing usesdpopKeys. The vendored JOSE helpers do not consumeCreateOptions.signers.Expected outcome
Choose one:
CreateOptions.signersas dead API, with the appropriate compatibility plan.signersmaps into the TDF creation and assertion-signing flow.Add coverage proving the selected behavior.