AttestoPhoenix.
Copy Markdown
View Source
OID4VCI Deferred Credential Endpoint (draft-ietf-oauth-openid4vci §9).
Completes a credential whose issuance was deferred at the Credential
endpoint. The wallet polls this endpoint with the same access token and the
transaction_id it was given at deferral. The library owns access-token
verification (RFC 6750 bearer / RFC 9449 DPoP via
AttestoPhoenix.ProtectedResource) and SD-JWT VC signing/response framing,
and passes the token's verified subject to the host callback.
Issuance completion is host policy through :build_deferred_credential.
Bearer auth alone is NOT sufficient authorization here: it proves the caller
holds some valid token, not that the transaction_id is theirs. The host
callback MUST bind the transaction_id to that subject and refuse a
mismatch — otherwise any authenticated wallet can poll another's
transaction_id and receive its credential (IDOR). See
t:AttestoPhoenix.Config's :build_deferred_credential for the contract.
Summary
Functions
Complete a deferred credential for an authenticated wallet.
Functions
@spec create(Plug.Conn.t(), map()) :: Plug.Conn.t()
Complete a deferred credential for an authenticated wallet.
Returns the same immediate-issuance response shape as the Credential
endpoint (Attesto.CredentialResponse.build/2) once the host reports the
credential is ready. {:error, :issuance_pending} from the host's
:build_deferred_credential callback is reported as the OID4VCI
issuance_pending error (status 400) so the wallet retries later; any
other host error maps to invalid_credential_request.