AttestoClient.Wallet.Presentation (AttestoClient v2.9.0)

Copy Markdown View Source

OID4VP 1.0 wallet presentations for SD-JWT VC and ISO mdoc.

present/3 selects credentials satisfying a verified request, builds holder proofs, and submits the response. direct_post.jwt encrypts the complete response to a public key from authenticated client metadata. The encryption key also binds the mdoc session transcript. direct_post remains supported.

Requested nested claims, claim alternatives, and credential sets are evaluated before disclosure. An explicit :selection remains subject to those constraints. Omitted claim queries disclose no selectively disclosable claims; otherwise only requested disclosures and their necessary parents are included. Public issuer claims remain visible because they cannot be removed from the signed credential. Aggregate VP-token data and the encoded response are bounded to 1 MiB, including caller-built responses, before encryption or HTTP submission. Both response modes use nonempty presentation arrays. The verifier must advertise the selected format in vp_formats_supported; any advertised issuer/holder algorithm lists also constrain generation and submission. build_response/3 checks those advertisements and the response envelope; it does not replace credential signature verification during issuance.

The host owns consent, credential storage, issuer trust and browser navigation. A successful response may contain redirect_uri; the host must open it in the user's browser, rather than fetch it as a back-channel HTTP request.

Summary

Types

opt()

Functions

build_response(request, vp_token, opts \\ [])

Build the form body without network access, including an encrypted response when requested.

build_vp_token(selection, request, opts \\ [])

Build presentations without sending them. Entries are nonempty arrays in both response modes.

present(request, held, opts \\ [])

Select, build and submit presentations. The host must obtain user consent first.

select(query, held)

Select held credentials satisfying a DCQL query.

submit(request, vp_token, opts \\ [])

Submit an already-built response. Encrypted mode never sends credentials or state in plaintext.

Types

opt()

@type opt() ::
  {:selection, map()}
  | {:holder_keys, map()}
  | {:alg, String.t()}
  | {:kid, String.t()}
  | {:now, integer()}
  | {:req_options, keyword()}
  | {:timeout, pos_integer()}

Functions

build_response(request, vp_token, opts \\ [])

Build the form body without network access, including an encrypted response when requested.

build_vp_token(selection, request, opts \\ [])

Build presentations without sending them. Entries are nonempty arrays in both response modes.

present(request, held, opts \\ [])

Select, build and submit presentations. The host must obtain user consent first.

select(query, held)

Select held credentials satisfying a DCQL query.

submit(request, vp_token, opts \\ [])

Submit an already-built response. Encrypted mode never sends credentials or state in plaintext.