<?xml version="1.0" encoding="utf-8"?>
<!--
  DESCRIPTION: XML Schema Definition (XSD) for TSL extensions provided VDSIC.
  LAST UPDATED: 2025-05-21
-->
<xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" targetNamespace="https://trust.vdsic.org/schemas/04"
  xmlns="https://trust.vdsic.org/schemas/04"
  xmlns:xs="http://www.w3.org/2001/XMLSchema">

  <xs:import namespace="http://www.w3.org/XML/1998/namespace" schemaLocation="http://www.w3.org/2009/01/xml.xsd"/>

  <!-- 
    The VDSOperatorID extension uniquely identifies each Trust Service Operator (TSO) managing a subordinate List of Trusted Lists (LoTL). 
    This Issuing Authority Code (IAC), defined in accordance with ISO/IEC 15459-2, ensures unambiguous recognition and interoperability across multiple networks and jurisdictions. 
    This extension shall only be used in TSL and not in LoTL.
  -->
  <xs:simpleType name="VDSOperatorID">
    <xs:restriction base="xs:string">
      <xs:enumeration value="KFR"/>
      <xs:enumeration value="VDS"/>
    </xs:restriction>
  </xs:simpleType>

  <!-- 
    The VDSIssuerID extension identifies the Trust Service Provider (TSP) that issues VDSs.
    The identifier is a 3-character string included in the VDS header version 4 and in the VDS prefix.
  -->
  <xs:simpleType name="VDSIssuerID">
    <xs:restriction base="xs:string">
      <xs:pattern value="[A-Z]{2}[0-9]{1}"/>
    </xs:restriction>
  </xs:simpleType>

  <!--
    The VDSManifestScope extension specifies the manifest ID range assigned to each ESEDS issuer.
    It defines the type and scope of manifests a TSO or subordinate LoTL is authorized to issue and manage. 
    This extension shall only be used in TSL and not in LoTL. 
  -->
  <xs:complexType name="VDSManifestScope">
    <xs:sequence>
      <xs:element name="ManifestType">
        <xs:simpleType>
          <xs:restriction base="xs:string">
            <xs:enumeration value="Otentik VDS"/>
          </xs:restriction>
        </xs:simpleType>
      </xs:element>
      <xs:element name="Range">
        <xs:complexType>
          <xs:sequence>
            <xs:element type="ManifestIdType" name="From"/>
            <xs:element type="ManifestIdType" name="To"/>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
    </xs:sequence>
  </xs:complexType>

  <xs:simpleType name="ManifestIdType">
    <xs:annotation>
      <xs:documentation>Use case unique identifier. Restriction: 6 chars hexadecimal (uppercase and lowercase allowed).</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="[0-9a-fA-F]{6}"/>
    </xs:restriction>
  </xs:simpleType>

  <!-- 
    The VDSAuthorityID extension identifies the certificate authority (CA) that issues VDS signing certificates.
    The Certificate Authority reference is a 4-character string included in the VDS header 
    to locate the signing certificate and to ensure the CA validity in the TSL.   
  -->
  <xs:simpleType name="VDSAuthorityID">
    <xs:restriction base="xs:string">
      <xs:pattern value="[A-Za-z]{2}[0-9]{2}"/>
    </xs:restriction>
  </xs:simpleType>

  <!-- 
    The VDSCertResource extension provides the location of public certificates necessary for verifying digital seals.
    The VDS certificate resource is a URI pointing to a directory containing the VDS signing certificates. 
  -->
  <xs:simpleType name="VDSCertResource">
    <xs:restriction base="xs:anyURI"/>
  </xs:simpleType>

  <!--
    The VDSManifestCertificates extension defines the list of valid certificates that can sign a manifest.
    This extension shall only be used in TSL and not in LoTL. 
  -->
  <xs:complexType name="VDSManifestCertificates">
    <xs:sequence>
      <xs:element name="X509Certificate" type="xs:base64Binary" maxOccurs="unbounded" minOccurs="1"/>       
    </xs:sequence>
  </xs:complexType>

  <!-- 
    The VDSManifestResource extension includes a URI to the manifest directory within the Trust Service List (TSL).
    This directory is required to resolve the complete URI for retrieving specific use-case manifests, 
    defined by concatenating the directory URI and the manifest ID (hexadecimal).
  -->
  <xs:simpleType name="VDSManifestResource">
    <xs:restriction base="xs:anyURI"/>
  </xs:simpleType>

</xs:schema>