credential

func ApplyDerivations ¶ added in v0.7.21

func ApplyDerivations(list []primitives.Derivation, claims map[string]any, now time.Time) (map[string]any, error)

ApplyDerivations runs each configured derivation against `claims` and returns the accumulated derived claims (empty map when `list` is empty). A per-derivation failure short-circuits with a wrapped error naming the offending index.

Each derivation's inputs include both the original claims and every claim produced by earlier list entries, so a pipeline such as

yyyymmdd_to_iso(birthdate_raw -> birthdate) followed by
age_over_thresholds(birthdate -> age_over_*)

works without a caller having to pre-merge intermediates.

Intermediate accumulation uses a path-aware deep merge rather than maps.Copy so a derivation that targets a nested path (e.g. identity.email -> {"identity": {"email": "x"}}) does not replace a sibling nested claim (identity.name) produced by an earlier step.

func CloneNestedClaims ¶ added in v0.7.21

func CloneNestedClaims(src map[string]any) map[string]any

CloneNestedClaims returns a copy of src with nested map[string]any values cloned recursively so later in-place merges on the working map do not mutate the caller's original claims map.

func FilterAgainstVCTM ¶ added in v0.7.21

func FilterAgainstVCTM(doc map[string]any, vctm *sdjwtvc.VCTM) map[string]any

FilterAgainstVCTM returns a copy of doc containing only the keys declared by the VCTM's claim paths, recursively into nested maps and arrays. Keys the VCTM does not list are dropped. This is the anti-PII-leak choke point for credentials whose document data is assembled from an external source (e.g. a presented credential's own claims): even if upstream forwards more claims than intended, only VCTM-declared paths reach the issuer.

A VCTM claim with an empty path is skipped defensively. A nil segment in the middle of a path is treated as "descend into every array element".

Sibling keys inside a nested object are dropped when the VCTM only declares specific children — e.g. a VCTM path [address, locality] lets address.locality through but drops address.street.

func GetNestedValue ¶

func GetNestedValue(doc map[string]any, path string) (any, bool)

GetNestedValue retrieves a value from a map using dot-notation path.

func MergeDefaults ¶ added in v0.7.19

func MergeDefaults(doc, defaults map[string]any) error

MergeDefaults injects default claim values into doc for any claim path whose key is not already present, treating each defaults key as a dot-notation claim path (matching the AttributeMapping Claim field). Existing values — including nested ones — always win. Overlapping default paths ("identity" and "identity.country") are rejected because merging them is otherwise order-dependent on Go map iteration.

func MergeNestedClaims ¶ added in v0.7.21

func MergeNestedClaims(dst, src map[string]any)

MergeNestedClaims deep-merges src into dst. When both dst[k] and src[k] are map[string]any, their contents are merged recursively; otherwise src[k] replaces dst[k]. This preserves sibling nested claims when a derivation produces only a subset of a parent map's keys.

func SetNestedValue ¶

func SetNestedValue(doc map[string]any, path string, value any) error

SetNestedValue sets a value in a map using dot-notation path. Example: "identity.family_name" creates map[identity][family_name] = value