vck-openid/at.asitplus.wallet.lib.openid

Package-level declarations

Types

AuthenticationResponse

sealed class AuthenticationResponse

Intermediate DTO to hold the response to be sent from an OpenId4VpHolder to an OpenId4VpVerifier or DcApiVerifier.

AuthenticationResponseResult

sealed class AuthenticationResponseResult

Possible outcomes of creating an OpenID Authentication Response, to be sent back to the verifier.

AuthnResponseResult

data class AuthnResponseResult(val idTokenValidationResult: KmmResult<IdToken>?, val vpTokenValidationResult: KmmResult<VpTokenValidationResult>?, val request: AuthenticationRequestParameters?) : DcApiResponseResult

Result of validating an OpenID authentication response. Use to inspect how a wallet response was parsed and whether presentation validation succeeded.

AuthorizationResponsePreparationState

@Serializable

data class AuthorizationResponsePreparationState(val request: RequestParametersFrom<AuthenticationRequestParameters>, val credentialPresentationRequest: CredentialPresentationRequest?, val clientMetadata: RelyingPartyMetadata?, val jsonWebKeys: Collection<JsonWebKey>?, val verifierInfo: NonEmptyList<VerifierInfo>?, val audience: String)

Intermediate result class to display information about the authentication process to the user, i.e., to let them make an informed decision.

ClientIdScheme

sealed class ClientIdScheme

Represents the OpenID client identifier scheme used to validate verifier identity. Use to select the client-id flavor (redirect URI, X.509, attestation) and derive IDs/URIs accordingly.

CoseHeaderClientIdScheme

class CoseHeaderClientIdScheme(val clientIdScheme: ClientIdScheme) : CoseHeaderIdentifierFun<KeyMaterial>

Sets x5chain to the certificate chain of clientIdScheme, e.g. for ISO mdoc reader authentication, falling back to the certificate of the key material for schemes without a chain.

CreatedRequest

data class CreatedRequest(val url: String, val loadRequestObject: suspend (RequestObjectParameters?) -> KmmResult<String>? = null)

CreationOptions

sealed class CreationOptions

Options for creating authorization requests (query, by value, or by reference). Use to control how the verifier delivers the request to the wallet.

CredentialMatchingResult

typealias ~~CredentialMatchingResult~~<Credential> = at.asitplus.wallet.lib.agent.CredentialMatchingResult<Credential>

CredentialPresentationRequestBuilder

data class CredentialPresentationRequestBuilder(val credentials: Collection<RequestOptionsCredential>)

This is a helper class to build a CredentialPresentationRequest from a collection of RequestOptionsCredential to be used in OpenId4VpRequestOptions.

DcApiCreationOptions

sealed class DcApiCreationOptions

Options for creating requests for the W3C Digital Credentials API in DcApiVerifier.createAuthnRequest, reflecting the exchange protocols available over that API, see at.asitplus.dcapi.request.ExchangeProtocolIdentifier.

DcApiHolder

class DcApiHolder @JvmOverloads constructor(keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), holder: Holder = HolderAgent(keyMaterial), openId4VpHolder: OpenId4VpHolder = OpenId4VpHolder( keyMaterial = keyMaterial, holder = holder, ), iso180137AnnexCHolder: Iso180137AnnexCHolder = Iso180137AnnexCHolder( keyMaterial = keyMaterial, holder = holder, ))

Handles requests received through the W3C Digital Credentials API, similar to DcApiVerifier on the relying party side.

DcApiPreparationState

sealed class DcApiPreparationState

Opaque continuation state for a two-step DcApiHolder flow.

DcApiResponseResult

sealed interface DcApiResponseResult

Result of validating a DCAPI response, see DcApiVerifier.validateAuthnResponse

DcApiVerifier

class DcApiVerifier @JvmOverloads constructor(clientIdScheme: ClientIdScheme, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), val verifier: Verifier = VerifierAgent(identifier = clientIdScheme.clientId), decryptionKeyMaterial: KeyMaterial? = null, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService = EphemeralEncryptionKeyService(), decryptJwe: DecryptJweFun = DecryptJweWithEphemeralKey(ephemeralEncryptionKeyService, decryptionKeyMaterial), signAuthnRequest: SignJwtFun<AuthenticationRequestParameters> = SignJwt(keyMaterial, JwsHeaderClientIdScheme(clientIdScheme)), verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), verifyCoseSignature: VerifyCoseSignatureWithKeyFun<ByteArray> = VerifyCoseSignatureWithKey(), nonceService: NonceService = DefaultNonceService(), stateToAuthnRequestStore: MapStore<String, AuthenticationRequestParameters> = DefaultMapStore(), stateToIsoMdocRequestStore: MapStore<String, IsoMdocRequest> = DefaultMapStore(), supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet(), signReaderAuth: SignCoseDetachedFun<ByteArray> = SignCoseDetached( keyMaterial = keyMaterial, unprotectedHeaderModifier = CoseHeaderClientIdScheme(clientIdScheme), ))

Implements a verifier for the Digital Credentials API, similar to OpenId4VpVerifier for OpenID4VP.

DCQLMatchingResult

typealias ~~DCQLMatchingResult~~<Credential> = at.asitplus.wallet.lib.agent.DCQLMatchingResult<Credential>

Iso180137AnnexCHolder

class Iso180137AnnexCHolder @JvmOverloads constructor(keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), holder: Holder = HolderAgent(keyMaterial))

Handles ISO/IEC 18013-7 Annex C requests received through the W3C Digital Credentials API.

Iso180137AnnexCWrapper

data class Iso180137AnnexCWrapper(val documents: Collection<IsoDocumentParsed>) : DcApiResponseResult

Result of validating an ISO 18013-7 Annex C response, see DcApiVerifier.validateAuthnResponse and DcApiCreationOptions.Iso180137AnnexC

IsoDeviceRetrievalMatchingResult

typealias ~~IsoDeviceRetrievalMatchingResult~~<Credential> = at.asitplus.wallet.lib.agent.IsoDeviceRetrievalMatchingResult<Credential>

IsoMdocDcapiResponseBuilder

object IsoMdocDcapiResponseBuilder

Low-level ISO/IEC 18013-7 Annex C device-response construction used by Iso180137AnnexCHolder.

JwsHeaderClientIdScheme

class JwsHeaderClientIdScheme(val clientIdScheme: ClientIdScheme) : JwsHeaderIdentifierFun

OpenId4VpHolder

class OpenId4VpHolder @JvmOverloads constructor(keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), holder: Holder = HolderAgent(keyMaterial), signIdToken: SignJwtFun<IdToken> = SignJwt(keyMaterial, JwsHeaderCertOrJwk()), encryptJarm: EncryptJweFun = EncryptJwe(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), signDeviceAuthDetached: SignCoseDetachedFun<ByteArray> = SignCoseDetached(keyMaterial, CoseHeaderNone(), CoseHeaderNone()), clock: Clock = Clock.System, clientId: String = "https://wallet.a-sit.at/", authorizationEndpoint: String = "openid4vp:", remoteResourceRetriever: RemoteResourceRetrieverFunction = { null }, requestObjectJwsVerifier: RequestObjectJwsVerifier? = null, relyingPartyTrust: Set<RelyingPartyTrust>? = null, walletNonceMapStore: MapStore<String, String> = DefaultMapStore(), randomSource: RandomSource = RandomSource.Secure, lookupJsonWebKeysForClient: (OpenId4VpHolder.JsonWebKeyLookupInput) -> JsonWebKeySet? = { null }, allowedDcApiOriginSchemes: suspend () -> Set<String> = { DEFAULT_ALLOWED_DC_API_ORIGIN_SCHEMES }, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService? = null, supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet(), requireEncryptedRequests: Boolean = false)

Combines Verifiable Presentations with OAuth 2.0. Implements OpenID4VP (1.0, 2025-07-09).

OpenId4VpRequestOptions

data class OpenId4VpRequestOptions(val presentationRequest: CredentialPresentationRequest?, val responseMode: OpenIdConstants.ResponseMode = ResponseMode.Fragment, val responseUrl: String? = null, val responseType: String = VP_TOKEN, val state: String = uuid4().toString(), val transactionData: List<TransactionData>? = null, val expectedOrigins: List<String>? = null, val verifierInfo: NonEmptyList<VerifierInfo>? = null, val populateClientId: Boolean = true, val verifierMetadataMode: VerifierMetadataMode = VerifierMetadataMode.AUTO, val euWrprc: ByteArray? = null) : RequestOptions

OpenId4VpVerifier

class OpenId4VpVerifier @JvmOverloads constructor(clientIdScheme: ClientIdScheme, keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), val verifier: Verifier = VerifierAgent(identifier = clientIdScheme.clientId), decryptionKeyMaterial: KeyMaterial? = null, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService = EphemeralEncryptionKeyService(), decryptJwe: DecryptJweFun = DecryptJweWithEphemeralKey(ephemeralEncryptionKeyService, decryptionKeyMaterial), signAuthnRequest: SignJwtFun<AuthenticationRequestParameters> = SignJwt(keyMaterial, JwsHeaderClientIdScheme(clientIdScheme)), verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), supportedAlgorithms: Set<SignatureAlgorithm> = setOf(SignatureAlgorithm.ECDSAwithSHA256), verifyCoseSignature: VerifyCoseSignatureWithKeyFun<ByteArray> = VerifyCoseSignatureWithKey(), timeLeewaySeconds: Long = 300, clock: Clock = Clock.System, nonceService: NonceService = DefaultNonceService(), stateToAuthnRequestStore: MapStore<String, AuthenticationRequestParameters> = DefaultMapStore(), supportedJweEncryptionAlgorithms: Set<JweEncryption> = JweEncryption.entries.toSet())

Combines Verifiable Presentations with OAuth 2.0. Implements OpenID4VP (1.0, 2025-07-09).

PresentationExchangeMatchingResult

typealias ~~PresentationExchangeMatchingResult~~<Credential> = at.asitplus.wallet.lib.agent.PresentationExchangeMatchingResult<Credential>

PresentationMechanismEnum

enum PresentationMechanismEnum : Enum<PresentationMechanismEnum>

RelyingPartyTrust

sealed interface RelyingPartyTrust

A single source of trust in the relying party sending an authorization request, for one client identifier scheme, see OpenID4VP, Client Identifier Prefixes.

RequestParser

class RequestParser(remoteResourceRetriever: RemoteResourceRetrieverFunction = { null }, requestObjectJwsVerifier: RequestObjectJwsVerifier = RequestObjectJwsVerifier { _: Any -> true }, ephemeralEncryptionKeyService: EphemeralEncryptionKeyService? = null, decryptRequestObject: DecryptJweFun? = ephemeralEncryptionKeyService?.let { DecryptJweWithEphemeralKey(it) }, requireEncryptedRequests: Boolean = false, buildRequestObjectParameters: suspend () -> RequestObjectParameters? = { null })

ResponseParser

class ResponseParser @JvmOverloads constructor(decryptJwe: DecryptJweFun = DecryptJwe(EphemeralKeyWithoutCert()), verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject())

Parses authentication responses for OpenId4VpVerifier

VerifierMetadataMode

enum VerifierMetadataMode : Enum<VerifierMetadataMode>

VpTokenValidationResult

sealed interface VpTokenValidationResult

VpTokenValidationResultDCQL

data class VpTokenValidationResultDCQL(val credentialQueryResponseValidations: Map<DCQLCredentialQueryIdentifier, List<KmmResult<Verifier.VerifyPresentationResult>>>, val submissionRequirementsValidationResult: KmmResult<Unit>) : VpTokenValidationResult

VpTokenValidationResultPresentationExchange

data class ~~VpTokenValidationResultPresentationExchange~~(val inputDescriptorResponseValidations: Map<String, KmmResult<Verifier.VerifyPresentationResult>>) : VpTokenValidationResult

Functions

toOAuth2Error

fun Throwable.toOAuth2Error(request: RequestParametersFrom<*>): OAuth2Error

fun Throwable.toOAuth2Error(state: String?): OAuth2Error

validateWrpAuthenticationRequest

suspend fun RequestParametersFrom.IsoMdocDcApi.validateWrpAuthenticationRequest(): KmmResult<WrpRequestData>

Validates reader authentication using the DC API session transcript bound to this request and calling origin.