vck-openid-ktor/at.asitplus.wallet.lib.ktor.openid

Package-level declarations

Types

typealias ~~CredentialIdentifierInfo~~ = at.asitplus.wallet.lib.oidvci.CredentialIdentifierInfo

sealed interface CredentialIssuanceResult

Result of the credential issuance process: Either open an authentication request URL externally (i.e. the browser), or store the received credentials.

HttpErrorResponseException

typealias ~~HttpErrorResponseException~~ = at.asitplus.wallet.lib.HttpErrorResponseException

A non-success HTTP response with its OAuth or RFC 9457 error details, when available, as thrown by the ktor-based clients in this module.

IssuedCredentials

data class IssuedCredentials(val credentialIdentifierInfo: CredentialIdentifierInfo, val receivedCredentials: List<ReceivedCredential>, val scheme: CredentialScheme, val refreshToken: CredentialRenewalInfo?)

The credentials issued for one requested credential configuration, see CredentialIssuanceResult.Success.issued.

KtorSdJwtTypeMetadataDocumentRetriever

class KtorSdJwtTypeMetadataDocumentRetriever(val httpClient: HttpClient, val clock: Clock, val locateUrl: (SdJwtVcType) -> String?, val json: Json = Json.Default, val integrityChecker: SdJwtTypeMetadataDocumentIntegrityChecker = SdJwtTypeMetadataDocumentIntegrityChecker.DEFAULT) : SdJwtTypeMetadataDocumentRetriever

OAuth2KtorClient

class OAuth2KtorClient

Implements the client side of OAuth2 with ktor, by sending the requests of OAuth2ProtocolClient, which implements the protocol.

OpenId4VciClient

typealias ~~OpenId4VciClient~~ = OpenId4VciKtorClient

OpenId4VciKtorClient

class OpenId4VciKtorClient

Implements the client side of OpenID for Verifiable Credential Issuance 1.0 from 2025-09-16 with ktor, by sending the requests of OpenId4VciProtocolClient and at.asitplus.wallet.lib.oauth2.OAuth2ProtocolClient, which implement the protocols, in the order of each flow. Supported features:

OpenId4VpKtorHolder

class OpenId4VpKtorHolder(httpClient: HttpClient, keyMaterial: KeyMaterial, holder: Holder, encryptJarm: EncryptJweFun = EncryptJwe(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), clientId: String = "https://wallet.a-sit.at/", authorizationEndpoint: String = "openid4vp:", walletNonceMapStore: MapStore<String, String> = DefaultMapStore(), randomSource: RandomSource = RandomSource.Secure, lookupJsonWebKeysForClient: (OpenId4VpHolder.JsonWebKeyLookupInput) -> JsonWebKeySet? = { null }, allowedDcApiOriginSchemes: suspend () -> Set<String> = { OpenId4VpHolder.DEFAULT_ALLOWED_DC_API_ORIGIN_SCHEMES }, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService? = null, supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet(), requireEncryptedRequests: Boolean = false, relyingPartyValidator: RelyingPartyValidator = RelyingPartyValidator())

Implements the wallet side of Self-Issued OpenID Provider v2 and OpenID for Verifiable Presentations with ktor, by sending the requests of OpenId4VpProtocolClient, which implements the protocol.

OpenId4VpSuccess

typealias ~~OpenId4VpSuccess~~ = at.asitplus.wallet.lib.openid.OpenId4VpSuccess

OpenId4VpWallet

typealias ~~OpenId4VpWallet~~ = OpenId4VpKtorHolder

ProblemDetails

typealias ~~ProblemDetails~~ = at.asitplus.wallet.lib.ProblemDetails

ProvisioningContext

@Serializable

data class ProvisioningContext(val state: String, val credential: CredentialIdentifierInfo, val credentials: List<CredentialIdentifierInfo> = listOf(credential), val oauthMetadata: OAuth2AuthorizationServerMetadata, val issuerMetadata: IssuerMetadata, val reissuingStoreEntryId: Long? = null)

Gets stored before jumping into the web browser (with the authorization request), so that we can load it back when we resume the issuing process with the auth code

RemoteCredentialMetadataRegistry

class RemoteCredentialMetadataRegistry @JvmOverloads constructor(httpClient: HttpClient, clock: Clock, val documentUrls: MutableMap<SdJwtVcType, String> = mutableMapOf(), aliases: Map<CredentialMetadataLookup, SdJwtVcType> = emptyMap(), integrityMetadata: Map<SdJwtVcType, W3cSubresourceIntegrityMetadata> = emptyMap(), json: Json = Json.Default, integrityChecker: SdJwtTypeMetadataDocumentIntegrityChecker = SdJwtTypeMetadataDocumentIntegrityChecker.DEFAULT) : CredentialMetadataRegistry

A CredentialMetadataRegistry that fetches metadata documents over HTTP, mirroring at.asitplus.wallet.lib.data.StaticCredentialMetadataRegistry but with remote retrieval.

RemoteOAuth2AuthorizationServerAdapter

class RemoteOAuth2AuthorizationServerAdapter : OAuth2AuthorizationServerAdapter

Uses an external OAuth 2.0 Authorization Server with a at.asitplus.wallet.lib.oidvci.OpenId4VciServer, i.e., delegate authorization to the external AS, and load user info from there (after performing token exchange with the Wallet's access token to get a fresh one). Authenticates with the clientAttestation the remote authorization server expects, if any.

TokenResponseWithDpopNonce

typealias ~~TokenResponseWithDpopNonce~~ = at.asitplus.wallet.lib.oauth2.TokenResponseWithDpopNonce

Functions

attestationChallenge

fun HttpErrorResponseException.~~attestationChallenge~~(): String?

fun OAuth2Error?.attestationChallenge(response: HttpResponse): String?

Extracts the header OAuth-Client-Attestation-Challenge if the error is use_attestation_challenge.

dpopNonce

fun HttpErrorResponseException.~~dpopNonce~~(): String?

fun OAuth2Error?.dpopNonce(response: HttpResponse): String?

Extracts the header DPoP-Nonce if the server asked for it with use_dpop_nonce.

lazyDeferred

fun <T> CoroutineScope.lazyDeferred(block: suspend CoroutineScope.() -> T): Lazy<Deferred<T>>

toRequestInfo

fun HttpRequestData.toRequestInfo(): RequestInfo