vck-openid-ktor/at.asitplus.wallet.lib.ktor.openid

Package-level declarations

Types

@Serializable

data class CredentialIdentifierInfo(val issuerMetadata: IssuerMetadata, val credentialIdentifier: String, val supportedCredentialFormat: SupportedCredentialFormat)

Gets parsed from the credential issuer's metadata, essentially an entry from IssuerMetadata.supportedCredentialConfigurations

CredentialIssuanceResult

sealed interface CredentialIssuanceResult

Result of the credential issuance process: Either open an authentication request URL externally (i.e. the browser), or store the received credentials.

HttpErrorResponseException

class HttpErrorResponseException(response: HttpResponse, val responseBody: String, val oauth2Error: OAuth2Error?, val problemDetails: ProblemDetails?) : ResponseException

A non-success HTTP response with its OAuth or RFC 9457 error details, when available.

KtorSdJwtTypeMetadataDocumentRetriever

class KtorSdJwtTypeMetadataDocumentRetriever(val httpClient: HttpClient, val clock: Clock, val locateUrl: (SdJwtVcType) -> String?, val json: Json = Json.Default, val integrityChecker: SdJwtTypeMetadataDocumentIntegrityChecker = SdJwtTypeMetadataDocumentIntegrityChecker.DEFAULT) : SdJwtTypeMetadataDocumentRetriever

OAuth2KtorClient

class OAuth2KtorClient(engine: HttpClientEngine, cookiesStorage: CookiesStorage? = null, httpClientConfig: HttpClientConfig<*>.() -> Unit? = null, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), signDpop: SignJwtFun<JsonWebToken> = SignJwt(EphemeralKeyWithoutCert(), JwsHeaderCertOrJwk()), val oAuth2Client: OAuth2Client, randomSource: RandomSource = RandomSource.Secure, verifyTokenIntrospectionJwt: suspend (JwsCompactTyped<TokenIntrospectionResponse>) -> Boolean = { true }, val loadInstanceAttestation: suspend (OAuth2KtorClient.LoadInstanceAttestationInput) -> KmmResult<JwsCompactTyped<JsonWebToken>>? = null)

Implements the client side of OAuth2

OpenId4VciClient

class OpenId4VciClient(engine: HttpClientEngine, cookiesStorage: CookiesStorage? = null, httpClientConfig: HttpClientConfig<*>.() -> Unit? = null, oid4vciService: WalletService = WalletService(), oauth2InternalClient: OAuth2Client = OAuth2Client(clientId = oid4vciService.clientId), oauth2Client: OAuth2KtorClient = OAuth2KtorClient( engine = engine, cookiesStorage = cookiesStorage, httpClientConfig = httpClientConfig, oAuth2Client = oauth2InternalClient, ))

Implements the client side of OpenID for Verifiable Credential Issuance 1.0 from 2025-09-16. Supported features:

OpenId4VpSuccess

@Serializable

data class OpenId4VpSuccess(val redirectUri: String)

OpenId4VpWallet

class OpenId4VpWallet(engine: HttpClientEngine, httpClientConfig: HttpClientConfig<*>.() -> Unit? = null, keyMaterial: KeyMaterial, holderAgent: HolderAgent, randomSource: RandomSource = RandomSource.Secure, allowedDcApiOriginSchemes: suspend () -> Set<String> = { OpenId4VpHolder.DEFAULT_ALLOWED_DC_API_ORIGIN_SCHEMES })

Implements the wallet side of Self-Issued OpenID Provider v2 and OpenID for Verifiable Presentations

ProblemDetails

data class ProblemDetails(val type: String = "about:blank", val status: Int? = null, val title: String? = null, val detail: String? = null, val instance: String? = null, val extensions: JsonObject = JsonObject(emptyMap()))

Standard members of an RFC 9457 problem details object. type defaults to about:blank; problem-specific members are retained in extensions.

ProvisioningContext

@Serializable

data class ProvisioningContext(val state: String, val credential: CredentialIdentifierInfo, val oauthMetadata: OAuth2AuthorizationServerMetadata, val issuerMetadata: IssuerMetadata, val reissuingStoreEntryId: Long? = null)

Gets stored before jumping into the web browser (with the authorization request), so that we can load it back when we resume the issuing process with the auth code

RemoteCredentialMetadataRegistry

class RemoteCredentialMetadataRegistry @JvmOverloads constructor(httpClient: HttpClient, clock: Clock, val documentUrls: MutableMap<SdJwtVcType, String> = mutableMapOf(), aliases: Map<CredentialMetadataLookup, SdJwtVcType> = emptyMap(), integrityMetadata: Map<SdJwtVcType, W3cSubresourceIntegrityMetadata> = emptyMap(), json: Json = Json.Default, integrityChecker: SdJwtTypeMetadataDocumentIntegrityChecker = SdJwtTypeMetadataDocumentIntegrityChecker.DEFAULT) : CredentialMetadataRegistry

A CredentialMetadataRegistry that fetches metadata documents over HTTP, mirroring at.asitplus.wallet.lib.data.StaticCredentialMetadataRegistry but with remote retrieval.

RemoteOAuth2AuthorizationServerAdapter

class RemoteOAuth2AuthorizationServerAdapter(val publicContext: String, engine: HttpClientEngine, cookiesStorage: CookiesStorage? = null, httpClientConfig: HttpClientConfig<*>.() -> Unit? = null, scope: CoroutineScope = CoroutineScope(Dispatchers.IO), oauth2Client: OAuth2KtorClient = OAuth2KtorClient( engine = engine, cookiesStorage = cookiesStorage, httpClientConfig = httpClientConfig, oAuth2Client = OAuth2Client(), ), val internalTokenVerificationService: TokenVerificationService, val dpopNonceService: NonceService = DefaultNonceService()) : OAuth2AuthorizationServerAdapter

Uses an external OAuth 2.0 Authorization Server with a at.asitplus.wallet.lib.oidvci.CredentialIssuer, i.e., delegate authorization to the external AS, and load user info from there (after performing token exchange with the Wallet's access token to get a fresh one). Make sure to configure oauth2Client to use the correct OAuth2KtorClient.loadInstanceAttestation.

TokenResponseWithDpopNonce

data class TokenResponseWithDpopNonce(val params: TokenResponseParameters, val dpopNonce: String?)

Properties

DPoP

val HttpHeaders.DPoP: String

DPoPNonce

val HttpHeaders.DPoPNonce: String

OAuthClientAttestation

val HttpHeaders.OAuthClientAttestation: String

OAuthClientAttestationPop

val HttpHeaders.OAuthClientAttestationPop: String

Functions

dpopNonce

fun HttpErrorResponseException.dpopNonce(): String?

fun OAuth2Error?.dpopNonce(response: HttpResponse): String?

Extracts the header DPoP-Nonce if the error is use_dpop_nonce.

lazyDeferred

fun <T> CoroutineScope.lazyDeferred(block: suspend CoroutineScope.() -> T): Lazy<Deferred<T>>