AttestoClient.Wallet.PresentationRequest (AttestoClient v2.9.0)

Copy Markdown View Source

Verify signed OID4VP 1.0 wallet authorization requests.

from_uri/3 binds the outer client_id to the signed request and ignores other outer authorization parameters. Request URI POST sends a fresh wallet nonce, which must be echoed in the signed object. Requests using x509_hash require explicit DER trust anchors in :trusted_certificates; the embedded leaf certificate supplies the signing key, never the trust decision. An optional :certificate_trust callback adds ecosystem/revocation policy.

Pre-registered signed requests retain the temporal verification options from Attesto.RequestObject. All signed requests require oauth-authz-req+jwt; iss is ignored and the verified client_id identifies the verifier. Algorithm policies must be nonempty and can only narrow supported algorithms. HAIP retains the wallet signature and key-strength policy. An explicit enforce_fapi_alg_policy: true additionally narrows algorithms to FAPI. This module supports direct_post and encrypted direct_post.jwt. Unsupported transaction data fails closed before credential selection.

Verifier metadata must contain a nonempty vp_formats_supported object. Registered clients may supply authoritative metadata through :verifier_metadata; its fields take precedence over the signed metadata. For x509_hash, all metadata must come from the signed client_metadata. Advertised issuer and holder algorithms constrain the actual presentation.

Summary

Types

error()
t()

Functions

fetch(uri, trusted, opts \\ [])

Fetch and verify a request URI; :request_uri_method may be get or post.

from_uri(uri, trusted, opts \\ [])

Parse an authorization deep link and verify its by-value or by-reference signed request.

verify(jwt, trusted, opts \\ [])

Verify a compact request JWT. Pass :client_id to bind an outer authorization request.

Types

error()

@type error() :: atom() | term()

t()

@type t() :: %AttestoClient.Wallet.PresentationRequest{
  client_id: String.t(),
  client_metadata: map(),
  dcql_query: map(),
  nonce: String.t(),
  profile: :generic | :haip,
  response_mode: String.t(),
  response_uri: String.t(),
  state: String.t() | nil
}

Functions

fetch(uri, trusted, opts \\ [])

Fetch and verify a request URI; :request_uri_method may be get or post.

from_uri(uri, trusted, opts \\ [])

Parse an authorization deep link and verify its by-value or by-reference signed request.

verify(jwt, trusted, opts \\ [])

Verify a compact request JWT. Pass :client_id to bind an outer authorization request.