verifier

package
v0.0.0-...-e9052da Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 7, 2026 License: Apache-2.0 Imports: 47 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// ContentTypeCredentialJson is the MIME type for JSON-LD encoded
	// Verifiable Credentials, per the W3C VC Data Model 2.0.
	ContentTypeCredentialJson = "application/vc+ld+json"

	// ContentTypeCredentialJWT is the MIME type for JWT-encoded Verifiable
	// Credentials, per the W3C VC Data Model 2.0.
	ContentTypeCredentialJWT = "application/vc+jwt"

	// AcceptHeaderStatusListCredential is the Accept header value sent when
	// fetching a W3C status-list credential. It advertises both JSON-LD and
	// JWT formats so issuers with strict content negotiation can respond
	// with either representation.
	AcceptHeaderStatusListCredential = ContentTypeCredentialJson + ", " + ContentTypeCredentialJWT

	// StatusListCacheCleanupMultiplier scales the configured cache expiry to
	// obtain the go-cache janitor cleanup interval. A value of 2 matches the
	// 2×expiry pattern used by the existing caches in common/cache.go and
	// verifier/caching_client.go.
	StatusListCacheCleanupMultiplier = 2
)

Named constants consumed by the status-list client. The values are kept in one place so reviewers can audit the Accept header and the cache cleanup cadence without hunting through the implementation.

View Source 
const (
	ValidationModeNone        = "none"
	ValidationModeCombined    = "combined"
	ValidationModeJsonLd      = "jsonLd"
	ValidationModeBaseContext = "baseContext"
)

Validation mode constants.

View Source 
const (
	TypeVerifiableCredential   = "VerifiableCredential"
	TypeVerifiablePresentation = "VerifiablePresentation"
)

W3C base context credential types.

View Source 
const (
	CROSS_DEVICE_V1 = iota
	CROSS_DEVICE_V2
	SAME_DEVICE
)
View Source 
const CACHE_EXPIRY = CacheExpiry

Deprecated: Use CacheExpiry instead. Kept for backward compatibility.

View Source 
const CacheExpiry = 60

CacheExpiry is the default cache expiry time in seconds for service configuration entries.

View Source 
const DEFAULT_AUTHORIZATION_PATH = "/api/v1/authorization"
View Source 
const DEFAULT_SERIVCE_AUTHORIZATION_TYPE = "FRONTEND_V2"
View Source 
const DidElsiPrefix = "did:elsi:"
View Source 
const DidPartsSeparator = ":"
View Source 
const (
	GAIA_X_COMPLIANCE_SUBJECT_TYPE = "gx:compliance"
)
View Source 
const JWSHeaderX5C = "x5c"
View Source 
const OPENID4VP_PROTOCOL = "openid4vp"
View Source 
const REDIRECT_PROTOCOL = "redirect"
View Source 
const REQUEST_MODE_BY_REFERENCE = "byReference"
View Source 
const REQUEST_MODE_BY_VALUE = "byValue"
View Source 
const REQUEST_OBJECT_TYP = "oauth-authz-req+jwt"
View Source 
const WILDCARD_TIL = "*"

Variables

View Source 
var (
	// ErrorCredentialRevoked is returned when the bit referenced by a
	// credential's status-list entry is set, indicating that the issuer has
	// revoked (or, depending on purpose, suspended) the credential.
	ErrorCredentialRevoked = errors.New("credential_revoked")
	// ErrorStatusMissing is returned when a credential is required (via
	// config.CredentialStatus.RequireStatus) to carry a `credentialStatus`
	// entry but does not.
	ErrorStatusMissing = errors.New("credential_status_missing")
	// ErrorStatusListPurposeMismatch is returned when a fetched status-list
	// credential declares a `statusPurpose` that does not match the purpose
	// declared on the referencing credential's status-list entry.
	ErrorStatusListPurposeMismatch = errors.New("status_list_purpose_mismatch")
)

Typed errors returned by the CredentialStatusValidationService. They are exported so callers can match them with errors.Is when they need to distinguish a revoked credential from, for example, a missing credentialStatus entry.

View Source 
var (
	// ErrorStatusListHttpFailure is returned when the HTTP request to fetch
	// a status-list credential cannot be executed or returns a non-2xx
	// status code.
	ErrorStatusListHttpFailure = errors.New("status_list_http_failure")
	// ErrorStatusListUnparseable is returned when the fetched response body
	// is not a recognisable Verifiable Credential (neither a JSON-LD object
	// nor a decodable JWT).
	ErrorStatusListUnparseable = errors.New("status_list_unparseable")
	// ErrorStatusListSubjectMismatch is returned when the `sub` claim of a
	// fetched IETF Token Status List JWT does not match the `uri` from the
	// credential's status reference, per draft-ietf-oauth-status-list §8.3
	// step 4a.
	ErrorStatusListSubjectMismatch = errors.New("status_list_subject_mismatch")
	// ErrorStatusListExpired is returned when the `exp` claim of a fetched
	// IETF Token Status List JWT is in the past, per
	// draft-ietf-oauth-status-list §8.3 step 4c.
	ErrorStatusListExpired = errors.New("status_list_expired")
	// ErrorStatusListInvalidTyp is returned when the JWT `typ` header is
	// not `statuslist+jwt`, per draft-ietf-oauth-status-list §5.1.
	ErrorStatusListInvalidTyp = errors.New("status_list_invalid_typ")
)

Typed errors returned by the status-list client. Exported so callers can match them with errors.Is when the verifier's validation service needs to distinguish a network failure from a parse failure.

View Source 
var (
	ErrorNoVerificationKey               = errors.New("no_verification_key")
	ErrorNotAValidVerficationMethod      = errors.New("not_a_valid_verfication_method")
	ErrorNoOriginalCredential            = errors.New("no_original_credential_for_validation")
	ErrorCredentialMissingIssuer         = errors.New("credential_missing_issuer")
	ErrorCredentialMissingType           = errors.New("credential_missing_type")
	ErrorCredentialNonBaseType           = errors.New("credential_contains_non_base_context_type")
	ErrorCredentialExpired               = errors.New("credential_expired")
	ErrorCredentialNotYetValid           = errors.New("credential_not_yet_valid")
	ErrorCredentialInvalidValidityPeriod = errors.New("credential_invalid_validity_period")
)
View Source 
var ErrorCannotConverContext = errors.New("cannot_convert_context")
View Source 
var ErrorCertHeaderEmpty = errors.New("cert_header_is_empty")
View Source 
var ErrorCnfKeyMismatch = errors.New("cnf_key_does_not_match_vp_signer")
View Source 
var ErrorEmptyTilList = errors.New("empty_til_list")
View Source 
var ErrorForbiddenClaims = errors.New("forbidden_claim_or_value")
View Source 
var ErrorInvalidCredential = errors.New("invalid_trusted_participant_type")
View Source 
var ErrorInvalidJAdESSignature = errors.New("invalid_jades_signature")
View Source 
var ErrorInvalidJWT = errors.New("invalid_jwt")
View Source 
var ErrorInvalidJWTFormat = errors.New("invalid_jwt_format")
View Source 
var ErrorInvalidKeyConfig = errors.New("invalid_key_config")
View Source 
var ErrorInvalidKid = errors.New("invalid_kid")
View Source 
var ErrorInvalidNonce = errors.New("invalid_nonce")
View Source 
var ErrorInvalidProof = errors.New("invalid_vp_proof")
View Source 
var ErrorInvalidSdJwt = errors.New("credential_is_not_sd_jwt")
View Source 
var ErrorInvalidTil = errors.New("invalid_til_configured")
View Source 
var ErrorInvalidVC = errors.New("invalid_vc")
View Source 
var ErrorInvalidVCHolder = errors.New("invalid_vc_holder")
View Source 
var ErrorIssuerValidationFailed = errors.New("isser_validation_failed")
View Source 
var ErrorNoCertInHeader = errors.New("no_certificate_found_in_jwt_header")
View Source 
var ErrorNoComplianceID = errors.New("no compliance subject found for credential")
View Source 
var ErrorNoDID = errors.New("no_did_configured")
View Source 
var ErrorNoDIDInJWT = errors.New("no_did_found_in_jwt")
View Source 
var ErrorNoDefaultScope = errors.New("no_default_scope_configured")

ErrorNoDefaultScope is returned when no default OIDC scope is configured for a service.

View Source 
var ErrorNoExpiration = errors.New("no_jwt_expiration_set")
View Source 
var ErrorNoHolderClaim = errors.New("credential has not holder claim")
View Source 
var ErrorNoKeyId = errors.New("no_key_id_available")
View Source 
var ErrorNoRequestObject = errors.New("no_request_object_available")
View Source 
var ErrorNoRequestObjectReturned = errors.New("no_request_object")
View Source 
var ErrorNoSignatures = errors.New("no_signatures_in_jwt")
View Source 
var ErrorNoSigningKey = errors.New("no_signing_key_available")
View Source 
var ErrorNoSuchCode = errors.New("no_such_code")
View Source 
var ErrorNoSuchSession = errors.New("no_such_session")
View Source 
var ErrorNoTIR = errors.New("no_tir_configured")
View Source 
var ErrorNoTilDefined = errors.New("no_til_defined_for_credential_type")
View Source 
var ErrorNoTilForType = errors.New("no_til_defined_for_credential_type")
View Source 
var ErrorNoTrustedIssuer = errors.New("issuer is not in trusted issuer list")
View Source 
var ErrorNoValidCredentialTypeProvided = errors.New("no_valid_credential_type_provided")
View Source 
var ErrorNoValidationEndpoint = errors.New("no_validation_endpoint_configured")
View Source 
var ErrorNoValidationHost = errors.New("no_validation_host_configured")
View Source 
var ErrorPemDecodeFailed = errors.New("failed_to_decode_pem_from_header")
View Source 
var ErrorPresentationNoCredentials = errors.New("presentation_not_contains_credentials")
View Source 
var ErrorRedirectUriMismatch = errors.New("redirect_uri_does_not_match")
View Source 
var ErrorRefreshTokenDisabled = errors.New("refresh_token_not_enabled")
View Source 
var ErrorRefreshTokenExpired = errors.New("refresh_token_expired")
View Source 
var ErrorRefreshTokenInvalidSignature = errors.New("refresh_token_invalid_signature")
View Source 
var ErrorRefreshTokenNotFound = errors.New("refresh_token_not_found")
View Source 
var ErrorRequiredCredentialNotProvided = errors.New("required_credential_not_provided")
View Source 
var ErrorSupportedModesNotSet = errors.New("no_supported_request_mode_set")
View Source 
var ErrorTokenUnparsable = errors.New("unable_to_parse_token")
View Source 
var ErrorUnsupportedKeyAlgorithm = errors.New("unsupported_key_algorithm")
View Source 
var ErrorUnsupportedRequestMode = errors.New("unsupported_request_mode")
View Source 
var ErrorUnsupportedValidationMode = errors.New("unsupported_validation_mode")
View Source 
var ErrorVCNotArray = errors.New("verifiable_credential_not_array")
View Source 
var ErrorVerficationContextSetup = errors.New("no_valid_verification_context")
View Source 
var ErrorWrongGrantType = errors.New("wrong_grant_type")
View Source 
var SupportedModes = []string{ValidationModeNone, ValidationModeCombined, ValidationModeJsonLd, ValidationModeBaseContext}

Functions

func InitPresentationParser 

func InitPresentationParser(config *configModel.Configuration, healthCheck *health.Health) error

init the presentation parser depending on the config, either with or without did:elsi support

func InitVerifier 

func InitVerifier(config *configModel.Configuration, repo database.ServiceRepository) (err error)

InitVerifier initializes the verifier and all its components from the configuration. When repo is non-nil, the verifier uses a database-backed credentials config; otherwise it falls back to the HTTP-based or static config mode.

func NewCachingDocumentLoader 

func NewCachingDocumentLoader(defaultLoader ld.DocumentLoader) ld.DocumentLoader

func SetRefreshTokenRepo 

func SetRefreshTokenRepo(repo database.RefreshTokenRepository)

SetRefreshTokenRepo configures the database-backed refresh token repository. It must be called after InitVerifier when RefreshTokenEnabled is true. The verifier is stored as a package-level singleton, so this method updates that instance via a type assertion on the concrete CredentialVerifier.

Types

type CachingDocumentLoader 

type CachingDocumentLoader struct {
	// contains filtered or unexported fields
}

func (CachingDocumentLoader) LoadDocument 

func (cdl CachingDocumentLoader) LoadDocument(u string) (document *ld.RemoteDocument, err error)

type CachingIETFStatusListClient 

type CachingIETFStatusListClient struct {
	// contains filtered or unexported fields
}

CachingIETFStatusListClient is the default IETFStatusListClient implementation with in-memory caching and JWT signature verification.

func NewCachingIETFStatusListClient 

func NewCachingIETFStatusListClient(timeout time.Duration, cacheExpiry time.Duration, jwtVerifier StatusListJWTVerifier, clock common.Clock) *CachingIETFStatusListClient

NewCachingIETFStatusListClient constructs a CachingIETFStatusListClient. The jwtVerifier is used to verify the signature of fetched status list JWTs. When nil, JWT signatures are not verified (not recommended for production). The clock is used to check the `exp` claim; pass nil to use the real system clock.

func (*CachingIETFStatusListClient) FetchIETF 

func (c *CachingIETFStatusListClient) FetchIETF(uri string) (*common.IETFStatusList, error)

FetchIETF retrieves the IETF Token Status List JWT from the given URI. The JWT signature is verified using the configured StatusListJWTVerifier, then the `status_list` payload is extracted and cached.

func (*CachingIETFStatusListClient) InvalidateIETF 

func (c *CachingIETFStatusListClient) InvalidateIETF(uri string)

InvalidateIETF removes the cached status list for the given URI so the next FetchIETF call fetches a fresh copy from the origin server.

type CachingStatusListClient 

type CachingStatusListClient struct {
	// contains filtered or unexported fields
}

CachingStatusListClient is the default StatusListCredentialClient implementation. It uses patrickmn/go-cache to avoid repeated network calls for the same URL and a configurable http.Client timeout to protect the verifier from slow status-list issuers.

func NewCachingStatusListClient 

func NewCachingStatusListClient(timeout time.Duration, cacheExpiry time.Duration, jwtVerifier StatusListJWTVerifier) *CachingStatusListClient

NewCachingStatusListClient constructs a CachingStatusListClient using the supplied HTTP timeout and cache TTL. Both values are typically taken from config.Verifier.StatusListHttpTimeout / config.Verifier.StatusListCacheExpiry.

The cache janitor's cleanup interval is derived from cacheExpiry via StatusListCacheCleanupMultiplier so evicted entries are reaped on a cadence that matches the rest of the codebase.

func (*CachingStatusListClient) Fetch 

func (c *CachingStatusListClient) Fetch(url string) (*common.Credential, error)

Fetch retrieves the status-list credential at url. A cached copy is returned when available; otherwise the credential is fetched, parsed with the existing VC parser, stored in the cache and returned.

The returned error is wrapped with ErrorStatusListHttpFailure for transport or non-2xx responses, and with ErrorStatusListUnparseable when the body does not parse as a Verifiable Credential.

type ClientRequestObject 

type ClientRequestObject struct {
	Iss          string   `json:"iss"`
	Aud          []string `json:"aud"`
	ResponseType string   `json:"response_type,omitempty"`
	ClientId     string   `json:"client_id,omitempty"`
	RedirectUri  string   `json:"redirect_uri,omitempty"`
	Scope        string   `json:"scope,omitempty"`
	Nonce        string   `json:"nonce,omitempty"`
	State        string   `json:"state,omitempty"`
}

type ComplianceSubject 

type ComplianceSubject struct {
	Type                   string `json:"type"`
	Id                     string `json:"id"`
	Integrity              string `json:"gx:integrity"`
	IntegrityNormalization string `json:"gx:integrityNormalization"`
	Version                string `json:"gx:version"`
	GxType                 string `json:"gx:type"`
}

type ComplianceValidationContext 

type ComplianceValidationContext struct {
	// contains filtered or unexported fields
}

type ComplianceValidationService 

type ComplianceValidationService struct{}

func (*ComplianceValidationService) ValidateVC 

func (cvs *ComplianceValidationService) ValidateVC(verifiableCredential *common.Credential, validationContext ValidationContext) (result bool, err error)

check that the given credential is refernced by one of the compliance-credentials and that the signature of the compliance credential matches the given credential

type ConfigurablePresentationParser 

type ConfigurablePresentationParser struct {
	ProofChecker *JWTProofChecker
}

func (*ConfigurablePresentationParser) ParsePresentation 

func (cpp *ConfigurablePresentationParser) ParsePresentation(tokenBytes []byte) (*common.Presentation, error)

ParsePresentation parses a VP from JWT or JSON-LD format.

type ConfigurableSdJwtParser 

type ConfigurableSdJwtParser struct {
	ProofChecker *JWTProofChecker
}

func (*ConfigurableSdJwtParser) ClaimsToCredential 

func (sjp *ConfigurableSdJwtParser) ClaimsToCredential(claims map[string]interface{}) (credential *common.Credential, err error)

func (*ConfigurableSdJwtParser) Parse 

func (sjp *ConfigurableSdJwtParser) Parse(tokenString string) (map[string]interface{}, error)

func (*ConfigurableSdJwtParser) ParseWithSdJwt 

func (sjp *ConfigurableSdJwtParser) ParseWithSdJwt(tokenBytes []byte) (presentation *common.Presentation, err error)

type CredentialStatusValidationContext 

type CredentialStatusValidationContext struct {
	// PerType maps a credential type to its status-list configuration. A
	// credential with no matching entry — or only entries with
	// Enabled == false — is accepted without any network call.
	PerType map[string]configModel.CredentialStatus
}

CredentialStatusValidationContext carries the resolved per-credential-type configuration for the revocation-list check. The map key is the credential `type` value as it appears in the presented VC (for example "VerifiableCredential" or a custom type). The shape mirrors TrustRegistriesValidationContext.trustedIssuersLists so callers can build the context the same way for both services.

type CredentialStatusValidationService 

type CredentialStatusValidationService struct {
	// contains filtered or unexported fields
}

CredentialStatusValidationService is the ValidationService responsible for enforcing credential revocation via W3C Bitstring Status List / StatusList2021 credentials and IETF OAuth 2.0 Token Status Lists.

The service is safe for concurrent use as long as the configured clients are.

func NewCredentialStatusValidationService 

func NewCredentialStatusValidationService(client StatusListCredentialClient, ietfClient IETFStatusListClient, clock common.Clock) CredentialStatusValidationService

NewCredentialStatusValidationService constructs a ready-to-use validation service backed by the supplied status-list credential client, IETF status list client, and clock. The clock is retained for future use and defaults to common.RealClock when nil.

func (*CredentialStatusValidationService) ValidateVC 

func (s *CredentialStatusValidationService) ValidateVC(verifiableCredential *common.Credential, validationContext ValidationContext) (result bool, err error)

ValidateVC enforces the per-credential-type revocation-list check against the supplied credential.

The method:

  • casts the validation context to CredentialStatusValidationContext; returns ErrorCannotConverContext on any other type;
  • is a no-op (returns true, nil) when none of the credential's declared types has config.CredentialStatus.IsEnabled() == true;
  • extracts the `credentialStatus` field from the credential's raw JSON and parses it with common.ParseStatusListEntries;
  • returns ErrorStatusMissing when the credential must carry a status entry but does not (merged RequireStatus across matching configs);
  • for every recognised status-list entry whose purpose is accepted, fetches the referenced status-list credential, decodes the bitstring and inspects the bit at the entry's index;
  • returns ErrorCredentialRevoked as soon as a bit is found set;
  • logs and skips entries whose type is not recognised so the verifier remains forward-compatible with future status-list flavours.

type CredentialValidator 

type CredentialValidator struct {
	// contains filtered or unexported fields
}

CredentialValidator validates credential content (not signatures — those are checked by JWTProofChecker).

func (CredentialValidator) ValidateVC 

func (cv CredentialValidator) ValidateVC(verifiableCredential *common.Credential, verificationContext ValidationContext) (result bool, err error)

ValidateVC validates credential content. Signature verification is handled separately by JWTProofChecker. Temporal validity (validFrom/validUntil) is always enforced regardless of mode.

type CredentialVerifier 

type CredentialVerifier struct {
	// contains filtered or unexported fields
}

CredentialVerifier implements the Verifier interface using gaia-x compliance issuers registry as a validation backend.

func (*CredentialVerifier) AuthenticationResponse 

func (v *CredentialVerifier) AuthenticationResponse(state string, verifiablePresentation *common.Presentation) (sameDevice Response, err error)

* * Receive credentials and verify them in the context of an already present login-session. Will return either an error if failed, a sameDevice response to be used for * redirection or notify the original initiator(in case of a cross-device flow) *

func (*CredentialVerifier) CreateRefreshToken 

func (v *CredentialVerifier) CreateRefreshToken(clientId string, signedJWT string) (string, error)

CreateRefreshToken generates a new opaque refresh token, stores the raw JWT claims (not the signed access token) in the database, and returns the token string. Returns ErrorRefreshTokenDisabled when the feature is off.

func (*CredentialVerifier) ExchangeRefreshToken 

func (v *CredentialVerifier) ExchangeRefreshToken(refreshToken string) (jwtString string, expiration int64, newRefreshToken string, err error)

ExchangeRefreshToken atomically consumes a refresh token and returns a new signed access token JWT, its expiration in seconds, and a rotated refresh token. Returns ErrorRefreshTokenDisabled when the feature is off, ErrorRefreshTokenNotFound when the token does not exist, and ErrorRefreshTokenExpired when the token has passed its expiry.

func (*CredentialVerifier) GenerateToken 

func (v *CredentialVerifier) GenerateToken(clientId, subject, audience string, scopes []string, verifiablePresentation *common.Presentation) (int64, string, error)

func (*CredentialVerifier) GetAuthorizationType 

func (v *CredentialVerifier) GetAuthorizationType(serviceIdentifier string) string

func (*CredentialVerifier) GetDefaultScope 

func (v *CredentialVerifier) GetDefaultScope(serviceIdentifier string) (scope string, err error)

func (*CredentialVerifier) GetHost 

func (v *CredentialVerifier) GetHost() string

func (*CredentialVerifier) GetJWKS 

func (v *CredentialVerifier) GetJWKS() jwk.Set

* * Return the JWKS used by the verifier to allow jwt verification *

func (*CredentialVerifier) GetOpenIDConfiguration 

func (v *CredentialVerifier) GetOpenIDConfiguration(serviceIdentifier string) (metadata common.OpenIDProviderMetadata, err error)

func (*CredentialVerifier) GetPathPrefix 

func (v *CredentialVerifier) GetPathPrefix() string

func (*CredentialVerifier) GetRequestObject 

func (v *CredentialVerifier) GetRequestObject(state string) (jwt string, err error)

func (*CredentialVerifier) GetToken 

func (v *CredentialVerifier) GetToken(authorizationCode string, redirectUri string, validated bool) (jwtString string, expiration int64, refreshToken string, err error)

GetToken returns an already generated jwt from the cache to properly authorized requests. Every token will only be returned once. When the refresh token feature is enabled, a refresh token is generated and returned alongside the access token; otherwise refreshToken is empty.

func (*CredentialVerifier) IsRefreshTokenEnabled 

func (v *CredentialVerifier) IsRefreshTokenEnabled() bool

IsRefreshTokenEnabled reports whether the refresh token feature is active.

func (*CredentialVerifier) RefreshTokenExpiresIn 

func (v *CredentialVerifier) RefreshTokenExpiresIn() int64

RefreshTokenExpiresIn returns the configured refresh token lifetime in seconds.

func (*CredentialVerifier) ReturnLoginQR 

func (v *CredentialVerifier) ReturnLoginQR(host string, protocol string, callback string, sessionId string, clientId string, nonce string, requestMode string) (qr string, err error)

* * Initializes the cross-device login flow and returns all neccessary information as a qr-code *

func (*CredentialVerifier) ReturnLoginQRV2 

func (v *CredentialVerifier) ReturnLoginQRV2(host string, protocol string, redircetUri string, sessionId string, clientId string, scope string, nonce string, requestMode string) (qrInfo QRLoginInfo, err error)

* * Initializes the cross-device login flow and returns all neccessary information as a qr-code *

func (*CredentialVerifier) StartSameDeviceFlow 

func (v *CredentialVerifier) StartSameDeviceFlow(host string, protocol string, state string, redirectPath string, clientId string, nonce string, requestMode string, scope string, requestProtocol string) (authenticationRequest string, err error)

* * Starts a same-device siop-flow and returns the required redirection information *

func (*CredentialVerifier) StartSiopFlow 

func (v *CredentialVerifier) StartSiopFlow(host string, protocol string, callback string, state string, clientId string, nonce string, requestMode string) (connectionString string, err error)

* * Starts a siop-flow and returns the required connection information *

type CredentialsConfig 

type CredentialsConfig interface {
	// GetScope returns the list of scopes to be requested via the scope parameter.
	GetScope(serviceIdentifier string) (scopes []string, err error)
	// GetDefaultScope returns the configured default scope.
	GetDefaultScope(serviceIdentifier string) (scope string, err error)
	// GetAuthorizationType returns the authorization type to be provided in the redirect.
	GetAuthorizationType(serviceIdentifier string) (path string, err error)
	// GetAuthorizationPath returns the authorization path to be provided in the redirect.
	GetAuthorizationPath(serviceIdentifier string) (path string)
	// GetPresentationDefinition returns the presentationDefinition be requested via the scope parameter.
	GetPresentationDefinition(serviceIdentifier string, scope string) (presentationDefinition *config.PresentationDefinition, err error)
	// GetDcqlQuery returns the DCQL query to be requested via the scope parameter.
	GetDcqlQuery(serviceIdentifier string, scope string) (dcql *config.DCQL, err error)
	// GetTrustedParticipantLists returns (EBSI TrustedIssuersRegistry compliant) endpoints for the
	// given service/credential combination, to check it's issued by a trusted participant.
	GetTrustedParticipantLists(serviceIdentifier string, scope string, credentialType string) (trustedIssuersRegistryUrl []config.TrustedParticipantsList, err error)
	// GetTrustedIssuersLists returns (EBSI TrustedIssuersRegistry compliant) endpoints for the
	// given service/credential combination, to check that credentials are issued by trusted issuers
	// and that the issuer has permission to issue such claims.
	GetTrustedIssuersLists(serviceIdentifier string, scope string, credentialType string) (trustedIssuersRegistryUrl []config.TrustedIssuersList, err error)
	// RequiredCredentialTypes returns the credential types that are required for the given service and scope.
	RequiredCredentialTypes(serviceIdentifier string, scope string) (credentialTypes []string, err error)
	// GetHolderVerification returns holder verification configuration.
	GetHolderVerification(serviceIdentifier string, scope string, credentialType string) (isEnabled bool, holderClaim string, err error)
	// GetComplianceRequired returns whether compliance is required for the credential.
	GetComplianceRequired(serviceIdentifier string, scope string, credentialType string) (isRequired bool, err error)
	// GetJwtInclusion returns JWT inclusion configuration for the credential.
	GetJwtInclusion(serviceIdentifier string, scope string, credentialType string) (jwtInclusion config.JwtInclusion, err error)
	// GetFlatClaims returns whether flatClaims should be used.
	GetFlatClaims(serviceIdentifier string, scope string) (flatClaims bool, err error)
	// GetCredentialStatusConfig returns the per-credential revocation-list
	// configuration for the given service, scope and credential type.
	// Returns a zero-value config (Enabled == false) when nothing is configured
	// or when the credential type is unknown.
	GetCredentialStatusConfig(serviceIdentifier string, scope string, credentialType string) (credentialStatus config.CredentialStatus, err error)
}

CredentialsConfig provides information about credentialTypes associated with services and their trust anchors. Implementations read from a global cache that is populated by a background refresh mechanism (HTTP client, database, or static config).

func InitCredentialsConfig 

func InitCredentialsConfig(repoConfig *config.ConfigRepo, repo database.ServiceRepository) (CredentialsConfig, error)

InitCredentialsConfig creates the appropriate CredentialsConfig implementation based on the provided configuration. When repo is non-nil, a DbBackedCredentialsConfig is used (database mode) that reads directly from the database. When repo is nil but ConfigEndpoint is set, the existing HTTP-based ServiceBackedCredentialsConfig is used. When neither is available, static-only mode is used (services from ConfigRepo.Services with no expiration).

func InitDbBackedCredentialsConfig 

func InitDbBackedCredentialsConfig(repoConfig *config.ConfigRepo, repo database.ServiceRepository) (CredentialsConfig, error)

InitDbBackedCredentialsConfig creates a CredentialsConfig that reads service configurations directly from the database via the given ServiceRepository. Static services from repoConfig.Services are kept as a fallback for services that are not (yet) stored in the database.

func InitServiceBackedCredentialsConfig 

func InitServiceBackedCredentialsConfig(repoConfig *config.ConfigRepo) (credentialsConfig CredentialsConfig, err error)

InitServiceBackedCredentialsConfig creates a CredentialsConfig that fetches service configurations from an external HTTP CCS endpoint. If no endpoint is configured, only static configuration from ConfigRepo.Services is used.

type DbBackedCredentialsConfig 

type DbBackedCredentialsConfig struct {
	// contains filtered or unexported fields
}

DbBackedCredentialsConfig is a CredentialsConfig implementation that reads service configurations directly from the database on every call. Static services from the initial configuration act as a fallback when a service is not found in the database.

func (DbBackedCredentialsConfig) GetAuthorizationPath 

func (dbc DbBackedCredentialsConfig) GetAuthorizationPath(serviceIdentifier string) string

GetAuthorizationPath returns the authorization endpoint path for the given service.

func (DbBackedCredentialsConfig) GetAuthorizationType 

func (dbc DbBackedCredentialsConfig) GetAuthorizationType(serviceIdentifier string) (string, error)

GetAuthorizationType returns the authorization type for the given service.

func (DbBackedCredentialsConfig) GetComplianceRequired 

func (dbc DbBackedCredentialsConfig) GetComplianceRequired(serviceIdentifier string, scope string, credentialType string) (bool, error)

GetComplianceRequired returns whether compliance is required for the given credential type.

func (DbBackedCredentialsConfig) GetCredentialStatusConfig 

func (dbc DbBackedCredentialsConfig) GetCredentialStatusConfig(serviceIdentifier string, scope string, credentialType string) (config.CredentialStatus, error)

GetCredentialStatusConfig returns the per-credential revocation-list configuration for the given service, scope and credential type.

func (DbBackedCredentialsConfig) GetDcqlQuery 

func (dbc DbBackedCredentialsConfig) GetDcqlQuery(serviceIdentifier string, scope string) (*config.DCQL, error)

GetDcqlQuery returns the DCQL query for the given service and scope.

func (DbBackedCredentialsConfig) GetDefaultScope 

func (dbc DbBackedCredentialsConfig) GetDefaultScope(serviceIdentifier string) (string, error)

GetDefaultScope returns the configured default OIDC scope for the given service.

func (DbBackedCredentialsConfig) GetFlatClaims 

func (dbc DbBackedCredentialsConfig) GetFlatClaims(serviceIdentifier string, scope string) (bool, error)

GetFlatClaims returns whether flat claims should be used for the given service and scope.

func (DbBackedCredentialsConfig) GetHolderVerification 

func (dbc DbBackedCredentialsConfig) GetHolderVerification(serviceIdentifier string, scope string, credentialType string) (bool, string, error)

GetHolderVerification returns holder verification settings for the given credential type.

func (DbBackedCredentialsConfig) GetJwtInclusion 

func (dbc DbBackedCredentialsConfig) GetJwtInclusion(serviceIdentifier string, scope string, credentialType string) (config.JwtInclusion, error)

GetJwtInclusion returns the JWT inclusion configuration for the given credential type.

func (DbBackedCredentialsConfig) GetPresentationDefinition 

func (dbc DbBackedCredentialsConfig) GetPresentationDefinition(serviceIdentifier string, scope string) (*config.PresentationDefinition, error)

GetPresentationDefinition returns the presentation definition for the given service and scope.

func (DbBackedCredentialsConfig) GetScope 

func (dbc DbBackedCredentialsConfig) GetScope(serviceIdentifier string) ([]string, error)

GetScope returns all configured scope names for the given service.

func (DbBackedCredentialsConfig) GetTrustedIssuersLists 

func (dbc DbBackedCredentialsConfig) GetTrustedIssuersLists(serviceIdentifier string, scope string, credentialType string) ([]config.TrustedIssuersList, error)

GetTrustedIssuersLists returns trusted issuers list endpoints for the given service, scope, and credential type.

func (DbBackedCredentialsConfig) GetTrustedParticipantLists 

func (dbc DbBackedCredentialsConfig) GetTrustedParticipantLists(serviceIdentifier string, scope string, credentialType string) ([]config.TrustedParticipantsList, error)

GetTrustedParticipantLists returns trusted participant list endpoints for the given service, scope, and credential type.

func (DbBackedCredentialsConfig) RequiredCredentialTypes 

func (dbc DbBackedCredentialsConfig) RequiredCredentialTypes(serviceIdentifier string, scope string) ([]string, error)

RequiredCredentialTypes returns the credential types required for the given service and scope.

type GaiaXRegistryValidationService 

type GaiaXRegistryValidationService struct {
	// contains filtered or unexported fields
}

func InitGaiaXRegistryValidationService 

func InitGaiaXRegistryValidationService(verifierConfig *configModel.Verifier) GaiaXRegistryValidationService

func (*GaiaXRegistryValidationService) ValidateVC 

func (v *GaiaXRegistryValidationService) ValidateVC(verifiableCredential *common.Credential, validationContext ValidationContext) (result bool, err error)

type HolderValidationContext 

type HolderValidationContext struct {
	// contains filtered or unexported fields
}

func (HolderValidationContext) GetClaim 

func (hvc HolderValidationContext) GetClaim() string

func (HolderValidationContext) GetHolder 

func (hvc HolderValidationContext) GetHolder() string

type HolderValidationService 

type HolderValidationService struct{}

func (*HolderValidationService) ValidateVC 

func (hvs *HolderValidationService) ValidateVC(verifiableCredential *common.Credential, validationContext ValidationContext) (result bool, err error)

type IETFStatusListClient 

type IETFStatusListClient interface {
	// FetchIETF fetches and returns the parsed IETF status list from the
	// given URI. Implementations may cache results internally.
	FetchIETF(uri string) (*common.IETFStatusList, error)

	// InvalidateIETF removes a cached status list entry so the next
	// FetchIETF call retrieves a fresh copy from the origin.
	InvalidateIETF(uri string)
}

IETFStatusListClient fetches IETF OAuth 2.0 Token Status List JWTs from the URI declared in a credential's `status.status_list.uri` field.

The response is a JWT with Content-Type `application/statuslist+jwt`, optionally gzip-compressed (Content-Encoding: gzip). The JWT payload contains `status_list.bits` and `status_list.lst` — the latter being a base64url-encoded, zlib-compressed bitstring.

type JWTProofChecker 

type JWTProofChecker struct {
	// contains filtered or unexported fields
}

JWTProofChecker verifies JWT signatures using DID-resolved keys. Supports standard DID methods via the did.Registry and optionally did:elsi via JAdES.

func GetProofChecker 

func GetProofChecker() *JWTProofChecker

GetProofChecker returns the shared JWT proof checker for VP signature verification.

func NewJWTProofChecker 

func NewJWTProofChecker(registry *did.Registry, jAdESValidator jades.JAdESValidator) *JWTProofChecker

func (*JWTProofChecker) VerifyJWT 

func (jpc *JWTProofChecker) VerifyJWT(token []byte) ([]byte, error)

VerifyJWT verifies the JWT signature using DID-resolved keys and returns the payload.

func (*JWTProofChecker) VerifyJWTAndReturnKey 

func (jpc *JWTProofChecker) VerifyJWTAndReturnKey(token []byte) ([]byte, jwk.Key, error)

VerifyJWTAndReturnKey verifies the JWT signature and returns both the payload and the resolved signer key. For did:elsi (JAdES-based), the key is nil since verification uses certificate chains instead of JWKs.

type KeyResolver 

type KeyResolver interface {
	ResolvePublicKeyFromDID(kid string) (key jwk.Key, err error)
	ExtractKIDFromJWT(tokenString string) (string, error)
}

type NonceGenerator 

type NonceGenerator interface {
	GenerateNonce() string
}

type PresentationParser 

type PresentationParser interface {
	ParsePresentation(tokenBytes []byte) (*common.Presentation, error)
}

parser interface

func GetPresentationParser 

func GetPresentationParser() PresentationParser

* * Global singelton access to the parser *

type QRLoginInfo 

type QRLoginInfo struct {
	QR                    string
	ExpireAt              time.Time
	TotalDuration         int
	AuthenticationRequest string
}

Verifier QR Information

type RequestObjectClient 

type RequestObjectClient struct {
	HttpClient  common.HttpClient
	KeyResolver KeyResolver
}

func NewRequestObjectClient 

func NewRequestObjectClient() (roc *RequestObjectClient)

func (*RequestObjectClient) GetClientRequestObject 

func (roc *RequestObjectClient) GetClientRequestObject(requestUri string) (clientRequestObject *ClientRequestObject, err error)

type Response 

type Response struct {
	// version of the flow
	FlowVersion int
	// the redirect target to be informed
	RedirectTarget string
	// code of the siop flow
	Code string
	// session id provided by the client
	SessionId string
	// nonce provided by the client
	Nonce string
}

Response structure for successful same-device authentications

type SdJwtParser 

type SdJwtParser interface {
	Parse(tokenString string) (map[string]interface{}, error)
	ParseWithSdJwt(tokenBytes []byte) (presentation *common.Presentation, err error)
	ClaimsToCredential(claims map[string]interface{}) (credential *common.Credential, err error)
}

func GetSdJwtParser 

func GetSdJwtParser() SdJwtParser

* * Global singelton access to the parser *

type ServiceBackedCredentialsConfig 

type ServiceBackedCredentialsConfig struct {
	// contains filtered or unexported fields
}

ServiceBackedCredentialsConfig is a CredentialsConfig implementation that fetches service configurations from an external HTTP-based CCS endpoint and caches them locally.

func (ServiceBackedCredentialsConfig) GetAuthorizationPath 

func (cc ServiceBackedCredentialsConfig) GetAuthorizationPath(serviceIdentifier string) (path string)

GetAuthorizationPath returns the authorization endpoint path for the given service.

func (ServiceBackedCredentialsConfig) GetAuthorizationType 

func (cc ServiceBackedCredentialsConfig) GetAuthorizationType(serviceIdentifier string) (path string, err error)

GetAuthorizationType returns the authorization type for the given service.

func (ServiceBackedCredentialsConfig) GetComplianceRequired 

func (cc ServiceBackedCredentialsConfig) GetComplianceRequired(serviceIdentifier string, scope string, credentialType string) (isRequired bool, err error)

GetComplianceRequired returns whether compliance is required for the given credential type.

func (ServiceBackedCredentialsConfig) GetCredentialStatusConfig 

func (cc ServiceBackedCredentialsConfig) GetCredentialStatusConfig(serviceIdentifier string, scope string, credentialType string) (credentialStatus config.CredentialStatus, err error)

GetCredentialStatusConfig returns the per-credential revocation-list configuration for the given service, scope and credential type.

When the service or credential type is unknown, or the credential entry has no `credentialStatus` block, a zero-value `config.CredentialStatus` is returned so that callers can treat "unknown" and "not configured" the same way. No error is returned in those cases — a missing block is a valid configuration meaning "feature off for this credential type".

func (ServiceBackedCredentialsConfig) GetDcqlQuery 

func (cc ServiceBackedCredentialsConfig) GetDcqlQuery(serviceIdentifier string, scope string) (dcql *config.DCQL, err error)

GetDcqlQuery returns the DCQL query for the given service and scope.

func (ServiceBackedCredentialsConfig) GetDefaultScope 

func (cc ServiceBackedCredentialsConfig) GetDefaultScope(serviceIdentifier string) (scope string, err error)

GetDefaultScope returns the configured default OIDC scope for the given service.

func (ServiceBackedCredentialsConfig) GetFlatClaims 

func (cc ServiceBackedCredentialsConfig) GetFlatClaims(serviceIdentifier string, scope string) (flatClaims bool, err error)

GetFlatClaims returns whether flat claims should be used for the given service and scope.

func (ServiceBackedCredentialsConfig) GetHolderVerification 

func (cc ServiceBackedCredentialsConfig) GetHolderVerification(serviceIdentifier string, scope string, credentialType string) (isEnabled bool, holderClaim string, err error)

GetHolderVerification returns holder verification settings for the given credential type.

func (ServiceBackedCredentialsConfig) GetJwtInclusion 

func (cc ServiceBackedCredentialsConfig) GetJwtInclusion(serviceIdentifier string, scope string, credentialType string) (jwtInclusion config.JwtInclusion, err error)

GetJwtInclusion returns the JWT inclusion configuration for the given credential type.

func (ServiceBackedCredentialsConfig) GetPresentationDefinition 

func (cc ServiceBackedCredentialsConfig) GetPresentationDefinition(serviceIdentifier string, scope string) (presentationDefinition *config.PresentationDefinition, err error)

GetPresentationDefinition returns the presentation definition for the given service and scope.

func (ServiceBackedCredentialsConfig) GetScope 

func (cc ServiceBackedCredentialsConfig) GetScope(serviceIdentifier string) (scopes []string, err error)

GetScope returns all configured scope names for the given service.

func (ServiceBackedCredentialsConfig) GetTrustedIssuersLists 

func (cc ServiceBackedCredentialsConfig) GetTrustedIssuersLists(serviceIdentifier string, scope string, credentialType string) (trustedIssuersRegistryUrl []config.TrustedIssuersList, err error)

GetTrustedIssuersLists returns trusted issuers list endpoints for the given service, scope, and credential type.

func (ServiceBackedCredentialsConfig) GetTrustedParticipantLists 

func (cc ServiceBackedCredentialsConfig) GetTrustedParticipantLists(serviceIdentifier string, scope string, credentialType string) (trustedIssuersRegistryUrl []config.TrustedParticipantsList, err error)

GetTrustedParticipantLists returns trusted participant list endpoints for the given service, scope, and credential type.

func (ServiceBackedCredentialsConfig) RequiredCredentialTypes 

func (cc ServiceBackedCredentialsConfig) RequiredCredentialTypes(serviceIdentifier string, scope string) (credentialTypes []string, err error)

RequiredCredentialTypes returns the credential types that are required for the given service and scope.

type StatusListCredentialClient 

type StatusListCredentialClient interface {
	// Fetch returns the status-list credential found at the given URL. It is
	// free to serve previously fetched responses from an internal cache.
	Fetch(url string) (*common.Credential, error)
}

StatusListCredentialClient fetches and returns W3C Bitstring / StatusList2021 credentials referenced from a VC's `credentialStatus` entry.

Implementations are expected to be safe for concurrent use so the verifier can share a single client across requests.

type StatusListJWTVerifier 

type StatusListJWTVerifier interface {
	// VerifyStatusListJWT verifies the JWT signature and returns the payload.
	VerifyStatusListJWT(jwtBytes []byte) (payload []byte, err error)
}

StatusListJWTVerifier verifies the signature of an IETF Token Status List JWT and returns the verified payload bytes. Implementations may extract the verification key from the JWT header (e.g. x5c certificate chain) or resolve it externally (e.g. via DID resolution).

type StatusListJWTVerifierImpl 

type StatusListJWTVerifierImpl struct {
	// contains filtered or unexported fields
}

StatusListJWTVerifierImpl verifies IETF Token Status List JWTs using two strategies, tried in order:

  1. If the JWT payload contains an `iss` claim that is a DID, the public key is resolved from the DID document via the configured DID registry.
  2. Otherwise, if the JWT header carries an `x5c` certificate chain, the public key is extracted from the leaf certificate.

This two-step approach covers both spec-compliant issuers (iss-based) and legacy/transitional deployments that only embed an x5c header.

func NewStatusListJWTVerifier 

func NewStatusListJWTVerifier(registry *did.Registry) *StatusListJWTVerifierImpl

NewStatusListJWTVerifier constructs a StatusListJWTVerifierImpl backed by the given DID registry. The registry must support the DID methods used by status list issuers (typically did:web and did:key).

func (*StatusListJWTVerifierImpl) VerifyStatusListJWT 

func (v *StatusListJWTVerifierImpl) VerifyStatusListJWT(jwtBytes []byte) ([]byte, error)

VerifyStatusListJWT parses the JWS and verifies the signature. It first attempts iss-based DID key resolution; when no iss claim is present it falls back to x5c certificate chain verification.

type TrustRegistriesValidationContext 

type TrustRegistriesValidationContext struct {
	// contains filtered or unexported fields
}

func (TrustRegistriesValidationContext) GetRequiredCredentialTypes 

func (trvc TrustRegistriesValidationContext) GetRequiredCredentialTypes() []string

func (TrustRegistriesValidationContext) GetTrustedIssuersLists 

func (trvc TrustRegistriesValidationContext) GetTrustedIssuersLists() map[string][]configModel.TrustedIssuersList

GetTrustedIssuersLists returns the per-credential-type trusted issuers list configuration.

func (TrustRegistriesValidationContext) GetTrustedParticipantLists 

func (trvc TrustRegistriesValidationContext) GetTrustedParticipantLists() map[string][]configModel.TrustedParticipantsList

type TrustedIssuerValidationService 

type TrustedIssuerValidationService struct {
	// contains filtered or unexported fields
}

* * The trusted participant verification service will validate the entry of a participant within the trusted list.

func (*TrustedIssuerValidationService) ValidateVC 

func (tpvs *TrustedIssuerValidationService) ValidateVC(verifiableCredential *common.Credential, validationContext ValidationContext) (result bool, err error)

type TrustedParticipantValidationService 

type TrustedParticipantValidationService struct {
	// contains filtered or unexported fields
}

* * The trusted participant validation service will validate the entry of a participant within the trusted list.

func (*TrustedParticipantValidationService) ValidateVC 

func (tpvs *TrustedParticipantValidationService) ValidateVC(verifiableCredential *common.Credential, validationContext ValidationContext) (result bool, err error)

type ValidationContext 

type ValidationContext interface{}

type ValidationService 

type ValidationService interface {
	// Validates the given VC. FIXME Currently a positiv result is returned even when no policy was checked
	ValidateVC(verifiableCredential *common.Credential, verificationContext ValidationContext) (result bool, err error)
}

type VdrKeyResolver 

type VdrKeyResolver struct {
	Vdr []did.VDR
}

func (*VdrKeyResolver) ExtractKIDFromJWT 

func (kr *VdrKeyResolver) ExtractKIDFromJWT(tokenString string) (string, error)

func (*VdrKeyResolver) ResolvePublicKeyFromDID 

func (kr *VdrKeyResolver) ResolvePublicKeyFromDID(kid string) (key jwk.Key, err error)

type Verifier 

type Verifier interface {
	ReturnLoginQR(host string, protocol string, callback string, sessionId string, clientId string, nonce string, requestMode string) (qr string, err error)
	ReturnLoginQRV2(host string, protocol string, callback string, sessionId string, clientId string, scope string, nonce string, requestMode string) (qrLoginInfo QRLoginInfo, err error)
	StartSiopFlow(host string, protocol string, callback string, state string, clientId string, nonce string, requestMode string) (connectionString string, err error)
	StartSameDeviceFlow(host string, protocol string, sessionId string, redirectPath string, clientId string, nonce string, requestMode string, scope string, requestProtocol string) (authenticationRequest string, err error)
	GetToken(authorizationCode string, redirectUri string, validated bool) (jwtString string, expiration int64, refreshToken string, err error)
	GetJWKS() jwk.Set
	AuthenticationResponse(state string, verifiablePresentation *common.Presentation) (sameDevice Response, err error)
	GenerateToken(clientId, subject, audience string, scope []string, verifiablePresentation *common.Presentation) (int64, string, error)
	GetOpenIDConfiguration(serviceIdentifier string) (metadata common.OpenIDProviderMetadata, err error)
	GetRequestObject(state string) (jwt string, err error)
	GetHost() string
	GetPathPrefix() string
	GetAuthorizationType(clientId string) string
	GetDefaultScope(serviceIdentifier string) (string, error)
	// ExchangeRefreshToken atomically consumes a refresh token and returns a
	// new signed access token JWT, its expiration (seconds), and a rotated
	// refresh token. Returns ErrorRefreshTokenDisabled when the feature is off.
	ExchangeRefreshToken(refreshToken string) (jwtString string, expiration int64, newRefreshToken string, err error)
	// IsRefreshTokenEnabled reports whether the refresh token feature is active.
	IsRefreshTokenEnabled() bool
	// RefreshTokenExpiresIn returns the configured refresh token lifetime in seconds.
	RefreshTokenExpiresIn() int64
	// CreateRefreshToken generates a new opaque refresh token, stores the
	// full signed JWT in the database, and returns the token string.
	CreateRefreshToken(clientId string, signedJWT string) (string, error)
}

verifier interface

func GetVerifier 

func GetVerifier() Verifier

* * Global singelton access to the verifier *

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.