AttestoClient.Wallet.Presentation.Mdoc (AttestoClient v2.9.0)

Build an OID4VP mso_mdoc presentation - a full ISO 18013-5 DeviceResponse - the holder-side mirror of Attesto.Mdoc.verify_device_response/4.

build_device_response/4 preserves the issuer signature and selected issuer-signed items, then signs DeviceAuthentication as a detached ES256 COSE_Sign1 over the OID4VP 1.0 redirect-flow session transcript. :claim_paths selects issuer-signed namespace elements; omitted paths include all elements. Device-signed namespaces are empty.

For encrypted responses, :response_encryption_jwk supplies the exact recipient public key selected from authenticated request metadata. Its SHA-256 JWK thumbprint binds the handover to the encryption recipient. Unencrypted responses use a null thumbprint.

Summary

Types

error()

Functions

build_device_response(held, request, holder_key, opts \\ [])

Build a base64url-encoded DeviceResponse for a single held mso_mdoc credential.

Types

error()

@type error() :: :invalid_credential | :invalid_key

Functions

build_device_response(held, request, holder_key, opts \\ [])

@spec build_device_response(
  map(),
  map(),
  JOSE.JWK.t() | map() | String.t(),
  keyword()
) ::
  {:ok, String.t()} | {:error, error()}

Build a base64url-encoded DeviceResponse for a single held mso_mdoc credential.

held is the entry AttestoClient.Wallet.request_credential/3 returned for an mso_mdoc credential (:credential the base64url IssuerSigned structure, :doc_type the verified document type). holder_key is the device's private key (a JOSE.JWK, a JWK map, or a PEM string) matching the public device key the issuer bound in the credential's MSO - ES256/P-256 only, per Attesto.Cose. request supplies :client_id, :nonce, and :response_uri for the OpenID4VPHandover (a AttestoClient.Wallet.PresentationRequest struct or an equivalent map).