Support request byValue and byReference and presentationDefinition #57

wistefan · 2025-05-02T14:31:57Z

Requires CredentialConfigService > 3.x

pulledtim · 2025-05-06T08:02:20Z

README.md

@@ -165,6 +208,11 @@ In order to ease the integration into frontends, VCVerifier offers a login-page

 In order to start a ```same-device```-flow(e.g. the credential is hold by the requestor, instead of an additional device like a mobile wallet) call:
 ```shell
+            # scope to be requested from the wallet


Misplaced C&P?

pulledtim · 2025-05-06T08:04:06Z

README.md

@@ -258,7 +311,12 @@ configRepo:

 ### Gaia-X Registry

-When using the [Gaia-X Digital Clearing House's](https://gaia-x.eu/services-deliverables/digital-clearing-house/) Registry Services, the issuer to be checked needs to fullfill the requirements of a Gaia-X participant. Thus, only did:web is supported for such and they need to provide a valid ```x5u``` location as part of their ```publicKeyJwk```. Usage of such registries can than be configured as following:
+When using the [Gaia-X Digital Clearing House's](https://gaia-x.eu/services-deliverables/digital-clearing-house/) Registry Services, the issuer to be checked needs to fullfill the requirements of 
+            # scope to be requested from the wallet


Again C&P? 😅

pulledtim · 2025-05-06T08:05:56Z

README.md

+```
+    openid4vp://?client_id=did:key:verifier&request_uri=verifier.org/api/v1/request/randomState&request_uri_method=get"
+```
+The object than can be retrived via:


Suggested change

The object than can be retrived via:

The object than can be retrieved via:

pulledtim · 2025-05-06T08:06:40Z

README.md

+The object than can be retrived via:
+```shell
+    curl https://verifier.org/api/v1/request/randomState
+```


Would it help to show an example value of the retrieved data here?

pulledtim · 2025-05-06T08:10:08Z

api/api.yaml

@@ -18,6 +18,7 @@ paths:
        - $ref: '#/components/parameters/QueryState'
        - $ref: '#/components/parameters/ClientCallback'
        - $ref: '#/components/parameters/ClientId'
+        - $ref: '#/components/parameters/RequestMode'
      operationId: VerifierPageDisplayQRSIOP
      summary: Presents a qr as starting point for the auth process
      description: Returns a rendered html with a QR encoding the login-starting point for the siop flow - e.g. 'openid://?scope=somethign&response_type=rt&response_mode=rm&client_id=ci&redirect_uri=uri&state=state&nonce=nonce'


Suggested change

description: Returns a rendered html with a QR encoding the login-starting point for the siop flow - e.g. 'openid://?scope=somethign&response_type=rt&response_mode=rm&client_id=ci&redirect_uri=uri&state=state&nonce=nonce'

description: Returns a rendered html with a QR encoding the login-starting point for the siop flow - e.g. 'openid://?scope=somethign&response_type=rt&response_mode=rm&client_id=ci&redirect_uri=uri&state=state&nonce=nonce&request_mode=urlEncoded'

pulledtim · 2025-05-06T08:11:45Z

api/api.yaml

+      required: false
+      schema:
+        type: string
+        enum: 


byReference missing?

pulledtim · 2025-05-06T08:12:25Z

config/config.go

@@ -58,6 +58,10 @@ type Logging struct {
 type Verifier struct {
 	// did to be used by the verifier
 	Did string `mapstructure:"did"`
+	// Identification to be used for the verifier
+	ClientIdentification ClientIdentification `mapstructure:"clientIdentification"`
+	// supported request modes - currently 'urlEncoded', 'byValue' an 'byReference' are available. In case of byValue, the keyPath has to be set.


Suggested change

// supported request modes - currently 'urlEncoded', 'byValue' an 'byReference' are available. In case of byValue, the keyPath has to be set.

// supported request modes - currently 'urlEncoded', 'byValue' and 'byReference' are available. In case of byValue, the keyPath has to be set.

pulledtim · 2025-05-06T08:16:38Z

config/configClient.go

+}
+
+func (cs ConfiguredService) GetPresentationDefinition(scope string) PresentationDefinition {
+	logging.Log().Warnf("The ScopeEntry %s", logging.PrettyPrintObject(cs.GetScope(scope)))


I know its highly unlikely but what if the config from the CCS get updated between these two calls and we return a different config than we log here

pulledtim · 2025-05-06T08:22:12Z

verifier/credentialsConfig.go

+	cacheEntry, hit := common.GlobalCache.ServiceCache.Get(serviceIdentifier)
+	if hit {
+
+		logging.Log().Warnf("The definition %s", logging.PrettyPrintObject(presentationDefinition))


Suggested change

logging.Log().Warnf("The definition %s", logging.PrettyPrintObject(presentationDefinition))

logging.Log().Debugf("The definition %s", logging.PrettyPrintObject(presentationDefinition))

pulledtim · 2025-05-06T08:24:40Z

verifier/verifier.go

+
+	didSigningKey, err := getRequestSigningKey(verifierConfig.ClientIdentification.KeyPath, verifierConfig.ClientIdentification.Id)
+	if (slices.Contains(verifierConfig.SupportedModes, REQUEST_MODE_BY_VALUE) || slices.Contains(verifierConfig.SupportedModes, REQUEST_MODE_BY_REFERENCE)) && err != nil {
+		logging.Log().Errorf("Was not able to get a signing key, despite mode %s supported. Err: %v", REQUEST_MODE_BY_VALUE, err)


Would it make sense to wrap the error with the additional description and return it?

pulledtim · 2025-05-06T08:26:22Z

verifier/verifier.go

+	} else {
+		err = nil
+	}
+
 	logging.Log().Warnf("Initiated key %s.", logging.PrettyPrintObject(key))


can you move this line over the new code so its with the init of the field "key"?

pulledtim · 2025-05-06T08:29:02Z

verifier/verifier.go

+		requestObject, err := v.createAuthenticationRequestObject(redirectUri, state, clientId)
+		loginSession.requestObject = string(requestObject[:])
+
+		logging.Log().Infof("Store session with id %s", state)


Suggested change

logging.Log().Infof("Store session with id %s", state)

logging.Log().Debugf("Store session with id %s", state)

pulledtim · 2025-05-06T08:32:30Z

verifier/verifier.go

+		logging.Log().Errorf("Was not able to get the presentationDefintion for %s. Err: %v", clientId, err)
+		return requestObject, err
+	}
+	logging.Log().Warnf("The definition %s", logging.PrettyPrintObject(presentationDefinition))


Suggested change

logging.Log().Warnf("The definition %s", logging.PrettyPrintObject(presentationDefinition))

logging.Log().Debugf("The definition %s", logging.PrettyPrintObject(presentationDefinition))

pulledtim · 2025-05-06T08:33:28Z

verifier/verifier.go

+	}
+
+	headers := jws.NewHeaders()
+	headers.Set("typ", REQUEST_OBJECT_TYP)


Is the header key correct?

Yes. (even thought, I'm also always confused about the missing "e")

wistefan added 2 commits May 2, 2025 15:57

presentation definition and request modes

d43bbcb

extend doc

e585024

wistefan added the major Should be applied for all breaking changes. label May 2, 2025

fix test

27ff5d2

wistefan requested a review from pulledtim May 2, 2025 14:40

Merge branch 'main' into sd-jwt

e6b54ae

pulledtim reviewed May 6, 2025

View reviewed changes

api/api.yaml

required: false

schema:

type: string

enum:

Copy link

Contributor

pulledtim May 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

byReference missing?

pulledtim reviewed May 6, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support request byValue and byReference and presentationDefinition #57

Support request byValue and byReference and presentationDefinition #57

wistefan commented May 2, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

pulledtim May 6, 2025

wistefan May 6, 2025

	The object than can be retrived via:
	The object than can be retrieved via:

	description: Returns a rendered html with a QR encoding the login-starting point for the siop flow - e.g. 'openid://?scope=somethign&response_type=rt&response_mode=rm&client_id=ci&redirect_uri=uri&state=state&nonce=nonce'
	description: Returns a rendered html with a QR encoding the login-starting point for the siop flow - e.g. 'openid://?scope=somethign&response_type=rt&response_mode=rm&client_id=ci&redirect_uri=uri&state=state&nonce=nonce&request_mode=urlEncoded'

	// supported request modes - currently 'urlEncoded', 'byValue' an 'byReference' are available. In case of byValue, the keyPath has to be set.
	// supported request modes - currently 'urlEncoded', 'byValue' and 'byReference' are available. In case of byValue, the keyPath has to be set.

	logging.Log().Warnf("The definition %s", logging.PrettyPrintObject(presentationDefinition))
	logging.Log().Debugf("The definition %s", logging.PrettyPrintObject(presentationDefinition))

	logging.Log().Infof("Store session with id %s", state)
	logging.Log().Debugf("Store session with id %s", state)

Support request byValue and byReference and presentationDefinition #57

Are you sure you want to change the base?

Support request byValue and byReference and presentationDefinition #57

Conversation

wistefan commented May 2, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment