vck-openid/at.asitplus.wallet.lib.openid

Package-level declarations

Types

AuthenticationResponse

sealed class AuthenticationResponse

Intermediate DTO to hold the response to be sent from an OpenId4VpHolder to an OpenId4VpVerifier or DcApiVerifier.

AuthenticationResponseResult

sealed class AuthenticationResponseResult

Possible outcomes of creating an OpenID Authentication Response, to be sent back to the verifier.

AuthnResponseResult

data class AuthnResponseResult(val idTokenValidationResult: KmmResult<IdToken>?, val vpTokenValidationResult: KmmResult<VpTokenValidationResult>?, val request: AuthenticationRequestParameters?) : DcApiResponseResult

Result of validating an OpenID authentication response. Use to inspect how a wallet response was parsed and whether presentation validation succeeded.

AuthorizationResponsePreparationState

@Serializable

data class AuthorizationResponsePreparationState(val request: RequestParametersFrom<AuthenticationRequestParameters>, val credentialPresentationRequest: CredentialPresentationRequest?, val clientMetadata: RelyingPartyMetadata?, val jsonWebKeys: Collection<JsonWebKey>?, val requestObjectVerified: Boolean?, val verifierInfo: List<VerifierInfo>?, val audience: String)

Intermediate result class to display information about the authentication process to the user, i.e., to let them make an informed decision.

ClientIdScheme

sealed class ClientIdScheme

Represents the OpenID client identifier scheme used to validate verifier identity. Use to select the client-id flavor (redirect URI, X.509, attestation) and derive IDs/URIs accordingly.

CreatedRequest

data class CreatedRequest(val url: String, val loadRequestObject: suspend (RequestObjectParameters?) -> KmmResult<String>? = null)

CreationOptions

sealed class CreationOptions

Options for creating authorization requests (query, by value, or by reference). Use to control how the verifier delivers the request to the wallet.

CredentialMatchingResult

sealed interface CredentialMatchingResult<Credential : Any>

This interface represents the result of matching a CredentialPresentationRequest against a list of available credentials

CredentialPresentationRequestBuilder

data class CredentialPresentationRequestBuilder(val credentials: Collection<RequestOptionsCredential>)

This is a helper class to build a CredentialPresentationRequest from a collection of RequestOptionsCredential to be used in OpenId4VpRequestOptions.

DcApiCreationOptions

sealed class DcApiCreationOptions

Options for creating requests for the W3C Digital Credentials API in DcApiVerifier.createAuthnRequest, reflecting the exchange protocols available over that API, see at.asitplus.dcapi.request.ExchangeProtocolIdentifier.

DcApiHolder

class DcApiHolder @JvmOverloads constructor(keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), holder: Holder = HolderAgent(keyMaterial), openId4VpHolder: OpenId4VpHolder = OpenId4VpHolder( keyMaterial = keyMaterial, holder = holder, ), iso180137AnnexCHolder: Iso180137AnnexCHolder = Iso180137AnnexCHolder( keyMaterial = keyMaterial, holder = holder, ))

Handles requests received through the W3C Digital Credentials API, similar to DcApiVerifier on the relying party side.

DcApiPreparationState

sealed class DcApiPreparationState

Opaque continuation state for a two-step DcApiHolder flow.

DcApiResponseResult

sealed interface DcApiResponseResult

Result of validating a DCAPI response, see DcApiVerifier.validateAuthnResponse

DcApiVerifier

class DcApiVerifier @JvmOverloads constructor(clientIdScheme: ClientIdScheme, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), val verifier: Verifier = VerifierAgent(identifier = clientIdScheme.clientId), decryptionKeyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), decryptJwe: DecryptJweFun = DecryptJwe(decryptionKeyMaterial), signAuthnRequest: SignJwtFun<AuthenticationRequestParameters> = SignJwt(keyMaterial, JwsHeaderClientIdScheme(clientIdScheme)), verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), verifyCoseSignature: VerifyCoseSignatureWithKeyFun<ByteArray> = VerifyCoseSignatureWithKey(), nonceService: NonceService = DefaultNonceService(), stateToAuthnRequestStore: MapStore<String, AuthenticationRequestParameters> = DefaultMapStore(), stateToIsoMdocRequestStore: MapStore<String, IsoMdocRequest> = DefaultMapStore(), supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet())

Implements a verifier for the Digital Credentials API, similar to OpenId4VpVerifier for OpenID4VP.

DCQLMatchingResult

data class DCQLMatchingResult<Credential : Any>(val presentationRequest: CredentialPresentationRequest.DCQLRequest, val matchingResult: HolderDCQLQueryMatchingResult<Credential>) : CredentialMatchingResult<Credential>

Iso180137AnnexCHolder

class Iso180137AnnexCHolder @JvmOverloads constructor(keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), holder: Holder = HolderAgent(keyMaterial), signDeviceAuthDetached: SignCoseDetachedFun<ByteArray> = SignCoseDetached(keyMaterial, CoseHeaderNone(), CoseHeaderNone()))

Handles ISO/IEC 18013-7 Annex C requests received through the W3C Digital Credentials API.

Iso180137AnnexCWrapper

data class Iso180137AnnexCWrapper(val documents: Collection<IsoDocumentParsed>) : DcApiResponseResult

Result of validating an ISO 18013-7 Annex C response, see DcApiVerifier.validateAuthnResponse and DcApiCreationOptions.Iso180137AnnexC

IsoMdocDcapiResponseBuilder

object IsoMdocDcapiResponseBuilder

Low-level ISO/IEC 18013-7 Annex C device-response construction used by Iso180137AnnexCHolder.

JwsHeaderClientIdScheme

class JwsHeaderClientIdScheme(val clientIdScheme: ClientIdScheme) : JwsHeaderIdentifierFun

OpenId4VpHolder

class OpenId4VpHolder @JvmOverloads constructor(keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), holder: Holder = HolderAgent(keyMaterial), signIdToken: SignJwtFun<IdToken> = SignJwt(keyMaterial, JwsHeaderCertOrJwk()), encryptJarm: EncryptJweFun = EncryptJwe(keyMaterial), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), signDeviceAuthDetached: SignCoseDetachedFun<ByteArray> = SignCoseDetached(keyMaterial, CoseHeaderNone(), CoseHeaderNone()), clock: Clock = Clock.System, clientId: String = "https://wallet.a-sit.at/", authorizationEndpoint: String = "openid4vp:", remoteResourceRetriever: RemoteResourceRetrieverFunction = { null }, requestObjectJwsVerifier: RequestObjectJwsVerifier = RequestObjectJwsVerifier { _ -> true }, walletNonceMapStore: MapStore<String, String> = DefaultMapStore(), randomSource: RandomSource = RandomSource.Secure, lookupJsonWebKeysForClient: (OpenId4VpHolder.JsonWebKeyLookupInput) -> JsonWebKeySet? = { null }, allowedDcApiOriginSchemes: suspend () -> Set<String> = { DEFAULT_ALLOWED_DC_API_ORIGIN_SCHEMES })

Combines Verifiable Presentations with OAuth 2.0. Implements OpenID4VP (1.0, 2025-07-09) as well as SIOP V2 (D13, 2023-11-28).

OpenId4VpRequestOptions

data class OpenId4VpRequestOptions(val presentationRequest: CredentialPresentationRequest?, val responseMode: OpenIdConstants.ResponseMode = ResponseMode.Fragment, val responseUrl: String? = null, val responseType: String = VP_TOKEN, val state: String = uuid4().toString(), val transactionData: List<TransactionData>? = null, val expectedOrigins: List<String>? = null, val populateClientId: Boolean = true, val verifierMetadataMode: VerifierMetadataMode = VerifierMetadataMode.AUTO) : RequestOptions

OpenId4VpVerifier

class OpenId4VpVerifier @JvmOverloads constructor(clientIdScheme: ClientIdScheme, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), val verifier: Verifier = VerifierAgent(identifier = clientIdScheme.clientId), decryptionKeyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), decryptJwe: DecryptJweFun = DecryptJwe(decryptionKeyMaterial), signAuthnRequest: SignJwtFun<AuthenticationRequestParameters> = SignJwt(keyMaterial, JwsHeaderClientIdScheme(clientIdScheme)), verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), verifyCoseSignature: VerifyCoseSignatureWithKeyFun<ByteArray> = VerifyCoseSignatureWithKey(), timeLeewaySeconds: Long = 300, clock: Clock = Clock.System, nonceService: NonceService = DefaultNonceService(), stateToAuthnRequestStore: MapStore<String, AuthenticationRequestParameters> = DefaultMapStore(), supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet())

Combines Verifiable Presentations with OAuth 2.0. Implements OpenID4VP (1.0, 2025-07-09) as well as SIOP V2 (D13, 2023-11-28).

PresentationExchangeMatchingResult

data class PresentationExchangeMatchingResult<Credential : Any>(val presentationRequest: CredentialPresentationRequest.PresentationExchangeRequest, val matchingResult: HolderPresentationExchangeQueryMatchingResult<Credential>) : CredentialMatchingResult<Credential>

PresentationMechanismEnum

enum PresentationMechanismEnum : Enum<PresentationMechanismEnum>

RequestParser

class RequestParser(remoteResourceRetriever: RemoteResourceRetrieverFunction = { null }, requestObjectJwsVerifier: RequestObjectJwsVerifier = RequestObjectJwsVerifier { _: Any -> true }, buildRequestObjectParameters: suspend () -> RequestObjectParameters? = { null })

ResponseParser

class ResponseParser @JvmOverloads constructor(decryptJwe: DecryptJweFun = DecryptJwe(EphemeralKeyWithoutCert()), verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject())

Parses authentication responses for OpenId4VpVerifier

VerifierMetadataMode

enum VerifierMetadataMode : Enum<VerifierMetadataMode>

VpTokenValidationResult

sealed interface VpTokenValidationResult

VpTokenValidationResultDCQL

data class VpTokenValidationResultDCQL(val credentialQueryResponseValidations: Map<DCQLCredentialQueryIdentifier, List<KmmResult<Verifier.VerifyPresentationResult>>>, val submissionRequirementsValidationResult: KmmResult<Unit>) : VpTokenValidationResult

VpTokenValidationResultPresentationExchange

data class VpTokenValidationResultPresentationExchange(val inputDescriptorResponseValidations: Map<String, KmmResult<Verifier.VerifyPresentationResult>>) : VpTokenValidationResult

Functions

toOAuth2Error

fun Throwable.toOAuth2Error(request: RequestParametersFrom<*>): OAuth2Error

fun Throwable.toOAuth2Error(state: String?): OAuth2Error