class CredentialIssuer @JvmOverloads constructor(statusListTokenResolver: StatusListTokenResolver? = null, authorizationService: OAuth2AuthorizationServerAdapter, issuer: Issuer, keyMaterial: Set<KeyMaterial> = setOf(issuer.keyMaterial), cryptoAlgorithms: Set<SignatureAlgorithm> = keyMaterial.map { it.signatureAlgorithm }.toSet(), credentialSchemes: Set<CredentialScheme>, publicContext: String = "https://wallet.a-sit.at/credential-issuer", credentialEndpointPath: String = "/credential", nonceEndpointPath: String = "/nonce", requireKeyAttestation: Boolean = false, proofValidator: ProofValidator = ProofValidator( publicContext = publicContext, requireKeyAttestation = requireKeyAttestation, statusListTokenResolver = statusListTokenResolver ), signMetadata: SignJwtFun<IssuerMetadata> = SignJwt(EphemeralKeyWithoutCert(), JwsHeaderCertOrJwk()), encryptionService: IssuerEncryptionService = IssuerEncryptionService(), credentialSchemeMapper: CredentialSchemeMapper = DefaultCredentialSchemeMapper(), preferredClientStatusPeriod: Duration? = 31.days, displayProperties: Set<DisplayProperties>? = null, clock: Clock = Clock.System)

Server implementation to issue credentials using OID4VCI.

CredentialSchemeMapper

interface CredentialSchemeMapper

Defines mapping of CredentialScheme to identifiers used in OID4VCI in CredentialIssuer (keys in at.asitplus.openid.IssuerMetadata.supportedCredentialConfigurations, and SupportedCredentialFormat.scope) and CredentialAuthorizationServiceStrategy (in at.asitplus.openid.OpenIdAuthorizationDetails.credentialConfigurationId).

DefaultCodeService

class DefaultCodeService @JvmOverloads constructor(nonceService: NonceService = DefaultNonceService()) : CodeService

Holds valid codes in memory, delegating to nonceService, i.e. entries are protected with a mutex and expire after the lifetime of that service.

DefaultCredentialSchemeMapper

class DefaultCredentialSchemeMapper : CredentialSchemeMapper

IssuerEncryptionService

class IssuerEncryptionService @JvmOverloads constructor(encryptCredentialResponse: EncryptJweFun = EncryptJwe(), requireResponseEncryption: Boolean = false, supportedJweAlgorithms: Set<JweAlgorithm> = setOf(JweAlgorithm.ECDH_ES), supportedJweEncryptionAlgorithms: Set<JweEncryption> = setOf(JweEncryption.A256GCM), requireRequestEncryption: Boolean = false, decryptionKeyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), decryptCredentialRequest: DecryptJweFun? = DecryptJwe(decryptionKeyMaterial))

Server implementation to handle credential request decryption and credential response encryption using OID4VCI.

OAuth2AuthorizationServerAdapter

interface OAuth2AuthorizationServerAdapter

Used in OID4VCI by CredentialIssuer to obtain user data when issuing credentials using OID4VCI.

OAuth2Error

@Serializable

data class OAuth2Error(val error: String, val errorDescription: String? = null, val errorUri: String? = null, val state: String? = null)

The OAuth 2.0 Authorization Framework: Error responses, see RFC 6749.

OAuth2Exception

@Serializable

sealed class OAuth2Exception : Throwable

OAuth2/OIDC error representation for issuer and wallet flows. Use to model protocol errors and serialize them for responses.

OAuth2ExceptionSerializer

object OAuth2ExceptionSerializer : JsonContentPolymorphicSerializer<OAuth2Exception>

OAuth2LoadUserFun

fun interface OAuth2LoadUserFun

Interface used in at.asitplus.wallet.lib.oauth2.AuthorizationService to actually load user data during the OAuth 2.0 flow, after an authn request (see AuthenticationRequestParameters) has been validated.

OAuth2LoadUserFunInput

data class OAuth2LoadUserFunInput(val request: AuthenticationRequestParameters)

OAuthAuthorizationError

interface OAuthAuthorizationError

Parameters

typealias ~~Parameters~~ = FormParameters

Names and values of an application/x-www-form-urlencoded payload.

ProofValidator

class ProofValidator @JvmOverloads constructor(publicContext: String = "https://wallet.a-sit.at/credential-issuer", verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), verifyJwsSignatureWithKey: VerifyJwsSignatureWithKeyFun = VerifyJwsSignatureWithKey(), supportedAlgorithms: Collection<JwsAlgorithm.Signature> = SimpleAuthorizationService.DEFAULT_WALLET_ATTESTATION_ALGORITHMS, clock: Clock = Clock.System, timeLeeway: Duration = 5.minutes, verifyAttestationProof: suspend (JwsCompactTyped<KeyAttestationJwt>) -> Boolean = { true }, requireKeyAttestation: Boolean = false, clientNonceService: NonceService = DefaultNonceService(), statusListTokenResolver: StatusListTokenResolver? = null, verifyKeyAttestationSignature: VerifyJwsObjectFun = VerifyJwsObjectFun { KmmResult.failure(IllegalStateException("No trusted key attestation verifier configured")) })

Server implementation to issue credentials using OID4VCI.

TokenInfo

@Serializable

data class TokenInfo(val token: String, val authorizationDetails: Set<AuthorizationDetails>? = null, val scope: String? = null)

Internal data class for a token introspection result

WalletEncryptionService

class WalletEncryptionService @JvmOverloads constructor(requestResponseEncryption: Boolean = false, requireRequestEncryption: Boolean = false, encryptCredentialRequest: EncryptJweFun = EncryptJwe(), supportedJweAlgorithm: JweAlgorithm = JweAlgorithm.ECDH_ES, fallbackJweEncryptionAlgorithm: JweEncryption = JweEncryption.A256GCM, decryptionKeyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), ephemeralEncryptionKeyService: EphemeralEncryptionKeyService = EphemeralEncryptionKeyService(), decryptCredentialResponse: DecryptJweFun? = DecryptJweWithEphemeralKey(ephemeralEncryptionKeyService))

Wallet implementation to handle credential request encryption and credential response decryption using OID4VCI.

WalletService

class WalletService @JvmOverloads constructor(val clientId: String = "https://wallet.a-sit.at/app", keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), remoteResourceRetriever: RemoteResourceRetrieverFunction = { null }, encryptionService: WalletEncryptionService = WalletEncryptionService(), loadKeyAttestation: suspend (WalletService.KeyAttestationInput) -> KmmResult<JwsCompactTyped<KeyAttestationJwt>>? = null, selectProofJwtKeyBinding: suspend (KeyMaterial) -> Pair<JsonWebKey?, String?> = { key -> Pair(key.jsonWebKey, null) })

Client service to retrieve credentials using OID4VCI

Properties

jsonForParameters

val ~~jsonForParameters~~: Json

Json instance for FormParameters, lenient so that it can decode the unquoted values of URL query parameters.

Functions

decode

inline fun <T> FormParameters.~~decode~~(): T

fun <T> FormParameters.~~decode~~(deserializer: DeserializationStrategy<T>): T

decodeFromPostBody

inline fun <T> String.~~decodeFromPostBody~~(): T

Deserializes the percent-encoded parameters of a POST body into T.

decodeFromUrlQuery

inline fun <T> String.~~decodeFromUrlQuery~~(): T

Deserializes a percent-encoded URL query into T.

inline fun <T> FormParameters.~~decodeFromUrlQuery~~(): T

Deserializes already-decoded FormParameters into T, decoding percent-encoding once more.

encodeToParameters

inline fun <T> T.~~encodeToParameters~~(): FormParameters

formUrlEncode

fun FormParameters.~~formUrlEncode~~(): String

isStringElement

fun SerialDescriptor.~~isStringElement~~(name: String): Boolean

Whether the member serialized as name is a string, for descriptors that have members at all.

matches

fun OpenIdAuthorizationDetails.matches(other: AuthorizationDetails): Boolean

Returns true if the other authorization detail is semantically the same, i.e., it has the same OpenIdAuthorizationDetails.credentialConfigurationId.

safeDecodeUrlQueryComponent

fun String.~~safeDecodeUrlQueryComponent~~(plusIsSpace: Boolean = false): String

Empty strings can not be decoded by io.ktor.http.decodeURLQueryComponent, so we'll need to filter it.

toCredentialResponseParameters

fun Collection<Issuer.IssuedCredential>.toCredentialResponseParameters(): CredentialResponseParameters

toCredentialResponseSingleCredential

fun Issuer.IssuedCredential.toCredentialResponseSingleCredential(): CredentialResponseSingleCredential

toFormat

fun CredentialRepresentation.toFormat(): CredentialFormatEnum

toIsoMdocSupportedCredentialFormat

fun IsoMdocCredentialScheme.toIsoMdocSupportedCredentialFormat(identifier: String): Pair<String, SupportedCredentialFormat>

toPlainJwtSupportedCredentialFormat

fun VcJwtCredentialScheme.toPlainJwtSupportedCredentialFormat(identifier: String): Pair<String, SupportedCredentialFormat>

toRepresentation

fun CredentialFormatEnum.toRepresentation(): ConstantIndex.CredentialRepresentation

toSdJwtSupportedCredentialFormat

fun SdJwtCredentialScheme.toSdJwtSupportedCredentialFormat(identifier: String): Pair<String, SupportedCredentialFormat>