CredentialValidator
Validates a single credential, in the format it declares, under an explicit ValidationPolicy, and reports every check: parsing, the issuer signature, issuer trust per credential type, semantics, every supplied disclosed item, the claims its type requires, holder binding, time, and status.
The validated credential is only returned for an accepted report, see CredentialValidationResult.
Constructors
Functions
The result of a presentation the protocol layer could not decode, e.g. an mdoc DeviceResponse that is no valid CBOR: it is rejected like one that can not be parsed, without credentials.
The result of a credential the protocol layer could not decode from its transfer encoding, e.g. the base64url encoding of an mdoc in an OpenID4VCI credential response: it is rejected like one that can not be parsed.
Reports a protocol response with its checks, made by the protocol layer, and the reports of the presentations it contains, at the time of this validator's clock, see ValidationReport.protocolResponse.
Validates input under policy, whose ValidationPolicy.holderBinding decides whether it has to be bound to CredentialValidationContext.expectedHolderKey. The clock is read once, all checks use that time.
Validates the presentation input against the request it answers, see PresentationContext, under policy: the holder's proof (key binding JWT, VP-JWT, or mdoc device authentication), and every credential it contains. The clock is read once, all checks use that time. The presentation decides the holder binding of its credentials, so ValidationPolicy.holderBinding does not apply, and it discloses claims selectively, so ValidationPolicy.requiredClaims does not either.