Build an OID4VP mso_mdoc presentation - a full ISO 18013-5
DeviceResponse - the holder-side mirror of
Attesto.Mdoc.verify_device_response/4.
build_device_response/4 re-embeds the held credential's IssuerSigned
structure unchanged, signs DeviceAuthentication as a detached ES256
COSE_Sign1 over the OID4VP SessionTranscript/OpenID4VPHandover
(draft-ietf-oauth-openid4vp "Handover and SessionTranscript
Definitions", redirect-flow form - the same construction
Attesto.Mdoc.verify_device_response/4 expects), and assembles the
DeviceResponse. DeviceNameSpaces (the device-signed, as opposed to
issuer-signed, namespace) is always empty: this slice presents the
credential's issuer-signed claims as a whole and does not filter
individual IssuerSigned items to the requested claim set. Only
unencrypted direct_post is supported - the handover's JWK thumbprint is
always absent (nil), matching direct_post.jwt being out of scope for
AttestoClient.Wallet.Presentation in this slice.
Summary
Functions
Build a base64url-encoded DeviceResponse for a single held mso_mdoc
credential.
Types
Functions
@spec build_device_response( map(), map(), JOSE.JWK.t() | map() | String.t(), keyword() ) :: {:ok, String.t()} | {:error, error()}
Build a base64url-encoded DeviceResponse for a single held mso_mdoc
credential.
held is the entry AttestoClient.Wallet.request_credential/3 returned
for an mso_mdoc credential (:credential the base64url IssuerSigned
structure, :doc_type the verified document type). holder_key is the
device's private key (a JOSE.JWK, a JWK map, or a PEM string) matching
the public device key the issuer bound in the credential's MSO -
ES256/P-256 only, per Attesto.Cose. request supplies :client_id,
:nonce, and :response_uri for the OpenID4VPHandover (a
AttestoClient.Wallet.PresentationRequest struct or an equivalent map).