validators

type DCQLResponseConstraintsValidator ¶

type DCQLResponseConstraintsValidator struct{}

func (DCQLResponseConstraintsValidator) ID() string

func (DCQLResponseConstraintsValidator) Validate(_ context.Context, input Input) Result

type EvidenceMinimumItemsValidator ¶

type EvidenceMinimumItemsValidator struct{}

func (EvidenceMinimumItemsValidator) ID() string

func (EvidenceMinimumItemsValidator) Validate(_ context.Context, input Input) Result

type EvidenceNonEmptyValidator ¶

type EvidenceNonEmptyValidator struct{}

func (EvidenceNonEmptyValidator) ID() string

func (EvidenceNonEmptyValidator) Validate(_ context.Context, input Input) Result

type EvidencePresentValidator ¶

type EvidencePresentValidator struct{}

func (EvidencePresentValidator) ID() string

func (EvidencePresentValidator) Validate(_ context.Context, input Input) Result

type EvidenceScreenshotNamedValidator ¶

type EvidenceScreenshotNamedValidator struct{}

EvidenceScreenshotNamedValidator proves that a flow stored a screenshot under a given name, which is how a source requirement that a particular screen was shown is evidenced: the flow takes that screenshot only while the screen is up, and the stored file name carries the name.

The evidence is the mobile step's `maestro_screenshot_urls`, so the check is on the file names of those URLs. The name is normalised with the same Snakecase PocketBase applies when it stores the file, so `no-match-notice` matches `..._no_match_notice_<random>.png`.

func (EvidenceScreenshotNamedValidator) ID() string

func (EvidenceScreenshotNamedValidator) Validate(_ context.Context, input Input) Result

type FCAFNotApplicableValidator ¶

type FCAFNotApplicableValidator struct{}

FCAFNotApplicableValidator records that a source test's Wallet expectation cannot apply to the SUT, so the test reports not applicable instead of a pass or a failure. The engine folds pass + not_applicable into not_applicable, while any fail/error/blocked dominates.

Two grounds are sanctioned (.agents/HITL.md, 2026-10-14 and 2026-10-21):

• the source's own relevancy is EUDI_forbidden, whatever its expected result; such a test carries this assertion alone and no Wallet interaction (scenario fcaf-wallet-solution-relying-party-eudi-forbidden);
• the SUT's own capabilities refute the source's precondition, so the test is not about this Wallet (WS_RP_MS_ProtocolMessages__011/018, WS_RP_MS_Metadata__134).

A precondition the harness cannot build is a different case: that is fcaf.skipped, and its reason must name the unbuilt precondition, never the Wallet's behaviour.

func (FCAFNotApplicableValidator) ID() string

func (FCAFNotApplicableValidator) Validate(_ context.Context, input Input) Result

type FCAFSkippedValidator ¶

type FCAFSkippedValidator struct{}

FCAFSkippedValidator records that the setup a test requires cannot be built with the available verifier, issuer or infrastructure, so the test reports skipped with the missing prerequisite instead of asserting on unrelated evidence.

func (FCAFSkippedValidator) ID() string

func (FCAFSkippedValidator) Validate(_ context.Context, input Input) Result

type HTTPHeaderCountValidator ¶

type HTTPHeaderCountValidator struct{}

HTTPHeaderCountValidator requires a header field to occur a given number of times in the Wallet's requests, counted by Capture from the raw header list (header_counts): joined header values cannot show that a field was sent once.

func (HTTPHeaderCountValidator) ID() string

func (HTTPHeaderCountValidator) Validate(_ context.Context, input Input) Result

type HTTPResponseMediaTypeValidator ¶

type HTTPResponseMediaTypeValidator struct{}

HTTPResponseMediaTypeValidator verifies the media type captured from an http-request activity result.

func (HTTPResponseMediaTypeValidator) ID() string

func (HTTPResponseMediaTypeValidator) Validate(_ context.Context, input Input) Result

type Input ¶

type Input struct {
	Value   any
	Bundle  evidence.Bundle
	Params  map[string]any
	Runtime map[string]any
	Suite   dsl.Suite
}

type JOSEJWEEncryptedResponseValidator ¶

type JOSEJWEEncryptedResponseValidator struct{}

func (JOSEJWEEncryptedResponseValidator) ID() string

func (JOSEJWEEncryptedResponseValidator) Validate(_ context.Context, input Input) Result

type JOSEJWEProtectedHeaderValidator ¶

type JOSEJWEProtectedHeaderValidator struct{}

JOSEJWEProtectedHeaderValidator verifies a field in a compact JWE protected header. Nested fields use dot notation, for example epk.crv.

func (JOSEJWEProtectedHeaderValidator) ID() string

func (JOSEJWEProtectedHeaderValidator) Validate(_ context.Context, input Input) Result

type JOSEJWSInvalidSignatureValidator ¶

type JOSEJWSInvalidSignatureValidator struct{}

func (JOSEJWSInvalidSignatureValidator) ID() string

func (JOSEJWSInvalidSignatureValidator) Validate(_ context.Context, input Input) Result

type JOSEJWSSignedRequestValidator ¶

type JOSEJWSSignedRequestValidator struct{}

func (JOSEJWSSignedRequestValidator) ID() string

func (JOSEJWSSignedRequestValidator) Validate(_ context.Context, input Input) Result

type JOSEMemberValidator ¶

type JOSEMemberValidator struct{}

JOSEMemberValidator checks the members of a JWT's JOSE header or payload.

func (JOSEMemberValidator) ID() string

func (JOSEMemberValidator) Validate(_ context.Context, input Input) Result

type JOSESignatureAlgorithmValidator ¶

type JOSESignatureAlgorithmValidator struct{}

JOSESignatureAlgorithmValidator requires the alg of a JWT's protected header to be an accepted signature algorithm.

func (JOSESignatureAlgorithmValidator) ID() string

func (JOSESignatureAlgorithmValidator) Validate(_ context.Context, input Input) Result

type JOSESignatureValidator ¶

type JOSESignatureValidator struct{}

JOSESignatureValidator verifies the signature of a compact JWS with the public key the source names.

func (JOSESignatureValidator) ID() string

func (JOSESignatureValidator) Validate(_ context.Context, input Input) Result

type JSONFieldEqualsValidator ¶

type JSONFieldEqualsValidator struct{}

func (JSONFieldEqualsValidator) ID() string

func (JSONFieldEqualsValidator) Validate(_ context.Context, input Input) Result

type JSONFieldPresenceValidator ¶

type JSONFieldPresenceValidator struct{}

func (JSONFieldPresenceValidator) ID() string

func (JSONFieldPresenceValidator) Validate(_ context.Context, input Input) Result

type JSONFieldRequiredValidator ¶

type JSONFieldRequiredValidator struct{}

func (JSONFieldRequiredValidator) ID() string

func (JSONFieldRequiredValidator) Validate(_ context.Context, input Input) Result

type JSONFieldStringPrefixValidator ¶

type JSONFieldStringPrefixValidator struct{}

func (JSONFieldStringPrefixValidator) ID() string

func (JSONFieldStringPrefixValidator) Validate(_ context.Context, input Input) Result

type JSONFieldTypeValidator ¶

type JSONFieldTypeValidator struct{}

JSONFieldTypeValidator requires an object member to hold a value of one JSON type.

func (JSONFieldTypeValidator) ID() string

func (JSONFieldTypeValidator) Validate(_ context.Context, input Input) Result

type JSONObjectExactlyOneMemberValidator ¶

type JSONObjectExactlyOneMemberValidator struct{}

JSONObjectExactlyOneMemberValidator requires an object member to be an object carrying exactly one of the listed members.

func (JSONObjectExactlyOneMemberValidator) ID() string

func (JSONObjectExactlyOneMemberValidator) Validate(_ context.Context, input Input) Result

type JSONValueShapeValidator ¶

type JSONValueShapeValidator struct{}

JSONValueShapeValidator checks the JSON type of selected values, the length of an array and the type of its items. Without any constraint it requires the selection to exist, which is how a parameter's presence is evidenced.

func (JSONValueShapeValidator) ID() string

func (JSONValueShapeValidator) Validate(_ context.Context, input Input) Result

type JWTHeaderFieldEqualsValidator ¶

type JWTHeaderFieldEqualsValidator struct{}

func (JWTHeaderFieldEqualsValidator) ID() string

func (JWTHeaderFieldEqualsValidator) Validate(_ context.Context, input Input) Result

type JWTHeaderFieldPresenceValidator ¶

type JWTHeaderFieldPresenceValidator struct{}

func (JWTHeaderFieldPresenceValidator) ID() string

func (JWTHeaderFieldPresenceValidator) Validate(_ context.Context, input Input) Result

type JWTPayloadFieldEqualsValidator ¶

type JWTPayloadFieldEqualsValidator struct{}

func (JWTPayloadFieldEqualsValidator) ID() string

func (JWTPayloadFieldEqualsValidator) Validate(_ context.Context, input Input) Result

type JWTPayloadFieldPresenceValidator ¶

type JWTPayloadFieldPresenceValidator struct{}

func (JWTPayloadFieldPresenceValidator) ID() string

func (JWTPayloadFieldPresenceValidator) Validate(_ context.Context, input Input) Result

type JWTPayloadFieldsDifferValidator ¶

type JWTPayloadFieldsDifferValidator struct{}

func (JWTPayloadFieldsDifferValidator) ID() string

func (JWTPayloadFieldsDifferValidator) Validate(_ context.Context, input Input) Result

type JWTPayloadObjectKeysAllowedValidator ¶

type JWTPayloadObjectKeysAllowedValidator struct{}

func (JWTPayloadObjectKeysAllowedValidator) ID() string

func (JWTPayloadObjectKeysAllowedValidator) Validate(_ context.Context, input Input) Result

type MDocDigestAlgorithmValidator ¶

type MDocDigestAlgorithmValidator struct{}

func (MDocDigestAlgorithmValidator) ID() string

func (MDocDigestAlgorithmValidator) Validate(_ context.Context, input Input) Result

type MDocDomesticNamespaceValidator ¶

type MDocDomesticNamespaceValidator struct{}

func (MDocDomesticNamespaceValidator) ID() string

func (MDocDomesticNamespaceValidator) Validate(_ context.Context, input Input) Result

type MDocElementCBORTypeValidator ¶

type MDocElementCBORTypeValidator struct{}

func (MDocElementCBORTypeValidator) ID() string

func (MDocElementCBORTypeValidator) Validate(_ context.Context, input Input) Result

type MDocElementCountryCodeArrayValidator ¶

type MDocElementCountryCodeArrayValidator struct{}

func (MDocElementCountryCodeArrayValidator) ID() string

func (MDocElementCountryCodeArrayValidator) Validate(_ context.Context, input Input) Result

type MDocElementCountryCodeValidator ¶

type MDocElementCountryCodeValidator struct{}

func (MDocElementCountryCodeValidator) ID() string

func (MDocElementCountryCodeValidator) Validate(_ context.Context, input Input) Result

type MDocElementCountrySubdivisionValidator ¶

type MDocElementCountrySubdivisionValidator struct{}

func (MDocElementCountrySubdivisionValidator) ID() string

func (MDocElementCountrySubdivisionValidator) Validate(_ context.Context, input Input) Result

type MDocElementDateEncodingValidator ¶

type MDocElementDateEncodingValidator struct{}

func (MDocElementDateEncodingValidator) ID() string

func (MDocElementDateEncodingValidator) Validate(_ context.Context, input Input) Result

type MDocElementDateFormatValidator ¶

type MDocElementDateFormatValidator struct{}

func (MDocElementDateFormatValidator) ID() string

func (MDocElementDateFormatValidator) Validate(_ context.Context, input Input) Result

type MDocElementEqualsValidator ¶

type MDocElementEqualsValidator struct{}

MDocElementEqualsValidator verifies that one mdoc element is a CBOR text string equal to an expected value. DCQL value matching compares the CBOR value through its JSON-compatible representation (RFC 8949 §6.1), so the expected value is the string the query constrained.

func (MDocElementEqualsValidator) ID() string

func (MDocElementEqualsValidator) Validate(_ context.Context, input Input) Result

type MDocElementInternationalPhoneValidator ¶

type MDocElementInternationalPhoneValidator struct{}

func (MDocElementInternationalPhoneValidator) ID() string

func (MDocElementInternationalPhoneValidator) Validate(_ context.Context, input Input) Result

type MDocElementJPEGValidator ¶

type MDocElementJPEGValidator struct{}

func (MDocElementJPEGValidator) ID() string

func (MDocElementJPEGValidator) Validate(_ context.Context, input Input) Result

type MDocElementMapMemberCountryCodeValidator ¶

type MDocElementMapMemberCountryCodeValidator struct{}

func (MDocElementMapMemberCountryCodeValidator) ID() string

func (MDocElementMapMemberCountryCodeValidator) Validate(_ context.Context, input Input) Result

type MDocElementMapMemberUTF8MaxLengthValidator ¶

type MDocElementMapMemberUTF8MaxLengthValidator struct{}

func (MDocElementMapMemberUTF8MaxLengthValidator) ID() string

func (MDocElementMapMemberUTF8MaxLengthValidator) Validate(_ context.Context, input Input) Result

type MDocElementMapShapeValidator ¶

type MDocElementMapShapeValidator struct{}

func (MDocElementMapShapeValidator) ID() string

func (MDocElementMapShapeValidator) Validate(_ context.Context, input Input) Result

type MDocElementMapTextValuesValidator ¶

type MDocElementMapTextValuesValidator struct{}

func (MDocElementMapTextValuesValidator) ID() string

func (MDocElementMapTextValuesValidator) Validate(_ context.Context, input Input) Result

type MDocElementRFC5322EmailValidator ¶

type MDocElementRFC5322EmailValidator struct{}

func (MDocElementRFC5322EmailValidator) ID() string

func (MDocElementRFC5322EmailValidator) Validate(_ context.Context, input Input) Result

type MDocElementStringArrayValidator ¶

type MDocElementStringArrayValidator struct{}

func (MDocElementStringArrayValidator) ID() string

func (MDocElementStringArrayValidator) Validate(_ context.Context, input Input) Result

type MDocElementUTF8StringValidator ¶

type MDocElementUTF8StringValidator struct{}

func (MDocElementUTF8StringValidator) ID() string

func (MDocElementUTF8StringValidator) Validate(_ context.Context, input Input) Result

type MDocElementUnsignedIntegerAllowedValidator ¶

type MDocElementUnsignedIntegerAllowedValidator struct{}

func (MDocElementUnsignedIntegerAllowedValidator) ID() string

func (MDocElementUnsignedIntegerAllowedValidator) Validate(_ context.Context, input Input) Result

type MDocElementValidDateValidator ¶

type MDocElementValidDateValidator struct{}

func (MDocElementValidDateValidator) ID() string

func (MDocElementValidDateValidator) Validate(_ context.Context, input Input) Result

type MDocExactNamespaceElementsValidator ¶

type MDocExactNamespaceElementsValidator struct{}

MDocExactNamespaceElementsValidator verifies that a presentation contains exactly the requested elements in one namespace.

func (MDocExactNamespaceElementsValidator) ID() string

func (MDocExactNamespaceElementsValidator) Validate(_ context.Context, input Input) Result

type MDocMSOStatusCBORTypeValidator ¶

type MDocMSOStatusCBORTypeValidator struct{}

MDocMSOStatusCBORTypeValidator verifies the CBOR major type of an element inside the Mobile Security Object `status` value.

func (MDocMSOStatusCBORTypeValidator) ID() string

func (MDocMSOStatusCBORTypeValidator) Validate(_ context.Context, input Input) Result

type MDocMSOStatusListStructureValidator ¶

type MDocMSOStatusListStructureValidator struct{}

MDocMSOStatusListStructureValidator verifies the StatusListInfo map inside the Mobile Security Object `status`: the pair count encoded in its CBOR header, its text keys, and the CBOR type of each value. A map with non-text keys already fails to decode as evidence, so every counted pair is a member.

func (MDocMSOStatusListStructureValidator) ID() string

func (MDocMSOStatusListStructureValidator) Validate(_ context.Context, input Input) Result

type MDocMSOStatusMemberPresentValidator ¶

type MDocMSOStatusMemberPresentValidator struct{}

MDocMSOStatusMemberPresentValidator verifies that the Mobile Security Object of the presented mdoc carries the addressed status element.

func (MDocMSOStatusMemberPresentValidator) ID() string

func (MDocMSOStatusMemberPresentValidator) Validate(_ context.Context, input Input) Result

type MDocMSOStatusURIValidator ¶

type MDocMSOStatusURIValidator struct{}

MDocMSOStatusURIValidator verifies that an element inside the Mobile Security Object `status` value is a CBOR text string holding an RFC 3986 URI.

func (MDocMSOStatusURIValidator) ID() string

func (MDocMSOStatusURIValidator) Validate(_ context.Context, input Input) Result

type MDocNamespaceElementPresentValidator ¶

type MDocNamespaceElementPresentValidator struct{}

func (MDocNamespaceElementPresentValidator) ID() string

func (MDocNamespaceElementPresentValidator) Validate(_ context.Context, input Input) Result

type OID4VCICredentialConfigurationScopeRequestedValidator ¶

type OID4VCICredentialConfigurationScopeRequestedValidator struct{}

OID4VCICredentialConfigurationScopeRequestedValidator requires the Credential Request's credential_configuration_id to be a key of credential_configurations_supported whose scope the Wallet requested in its (pushed) Authorization Request.

func (OID4VCICredentialConfigurationScopeRequestedValidator) ID() string

func (OID4VCICredentialConfigurationScopeRequestedValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VCICredentialRequestBodyValidator ¶

type OID4VCICredentialRequestBodyValidator struct{}

OID4VCICredentialRequestBodyValidator checks the Credential Request body as received: an unencrypted request must be application/json and pass every Shared_JSON case on its exact bytes. An encrypted request (application/jwt to an issuer advertising credential_request_encryption) is outside the source, which leaves the encrypted case open, so it is not applicable.

func (OID4VCICredentialRequestBodyValidator) ID() string

func (OID4VCICredentialRequestBodyValidator) Validate(_ context.Context, input Input) Result

type OID4VCIFixturesStoredValidator ¶

type OID4VCIFixturesStoredValidator struct{}

OID4VCIFixturesStoredValidator proves that the Wallet holds a credential for each named claim-set fixture without presenting it: presenting would spend it, because the reference Wallet uses each instance once.

Each evidence entry pairs the issuer session that issued a fixture with the screenshots of the wallet step that accepted the offer. The issuer session proves the Wallet fetched the credential; the named screenshot, which the issuance flow takes only after the Wallet confirms the document was added, proves the Wallet stored it rather than discarding it after the fetch.

func (OID4VCIFixturesStoredValidator) ID() string

func (OID4VCIFixturesStoredValidator) Validate(ctx context.Context, input Input) Result

type OID4VCIIssuedCredentialPresentedValidator ¶

type OID4VCIIssuedCredentialPresentedValidator struct{}

OID4VCIIssuedCredentialPresentedValidator proves that a Wallet stored the credential it received in a valid Credential Response and can present it.

func (OID4VCIIssuedCredentialPresentedValidator) ID() string

func (OID4VCIIssuedCredentialPresentedValidator) Validate(_ context.Context, input Input) Result

type OID4VCIIssuerResponseValidator ¶

type OID4VCIIssuerResponseValidator struct{}

OID4VCIIssuerResponseValidator confirms that the issuer delivered the response a test scenario sets up, for instance a PAR response without request_uri. It checks the test harness, not the Wallet: when the response does not match, the Wallet's reaction is no evidence of the test, so the result is blocked.

func (OID4VCIIssuerResponseValidator) ID() string

func (OID4VCIIssuerResponseValidator) Validate(_ context.Context, input Input) Result

type OID4VCINoRequestAfterValidator ¶

type OID4VCINoRequestAfterValidator struct{}

OID4VCINoRequestAfterValidator requires the Wallet to make no further request after an anchor request, such as the Credential Request an issuer denied. The anchor is the first matching request, so a retry of it is itself a further request. Requests the session cannot hold, like an Authorization Request without request_uri, are looked up among the unattributed requests of the session window.

func (OID4VCINoRequestAfterValidator) ID() string

func (OID4VCINoRequestAfterValidator) Validate(_ context.Context, input Input) Result

type OID4VCINonceFromNonceEndpointValidator ¶

type OID4VCINonceFromNonceEndpointValidator struct{}

OID4VCINonceFromNonceEndpointValidator requires the nonce of the Wallet's proofs of one type to be a c_nonce the Nonce Endpoint returned before the Credential Request. Capture attributes a nonce response to the session when a Credential Request proof repeats its c_nonce.

func (OID4VCINonceFromNonceEndpointValidator) ID() string

func (OID4VCINonceFromNonceEndpointValidator) Validate(_ context.Context, input Input) Result

type OID4VCIOfferEngagementValidator ¶

type OID4VCIOfferEngagementValidator struct{}

OID4VCIOfferEngagementValidator evaluates what a Wallet did once the End-user followed a Credential Offer link from the issuer's engagement page (GET /ui/sessions/{id}/engage). Its input is an exchange with session_creation (the delivered deeplink), capture_session, session_requests and the engagement step's screenshots.

The engagement flow screenshots `wallet-invoked` once the Wallet's screen replaced the page, or `wallet-not-invoked` when the page is still shown, i.e. the platform did not hand the link's scheme to the Wallet. The source decides what a Wallet that was not invoked means (when_not_invoked): the test is not applicable to a Wallet without an optional scheme, a failure for a required one, and blocked when the invocation is only a precondition.

Before the Wallet is judged, the delivered offer must be the one the test sets up: the deeplink scheme and the members present in or absent from raw.credential_offer_delivered. Otherwise the result is blocked.

func (OID4VCIOfferEngagementValidator) ID() string

func (OID4VCIOfferEngagementValidator) Validate(_ context.Context, input Input) Result

type OID4VCIPARScopeSupportedValidator ¶

type OID4VCIPARScopeSupportedValidator struct{}

OID4VCIPARScopeSupportedValidator requires every space-separated value of the PAR's scope to be the scope of a credential configuration the issuer metadata advertises.

func (OID4VCIPARScopeSupportedValidator) ID() string

func (OID4VCIPARScopeSupportedValidator) Validate(_ context.Context, input Input) Result

type OID4VCIRequestValuesEqualValidator ¶

type OID4VCIRequestValuesEqualValidator struct{}

OID4VCIRequestValuesEqualValidator requires a value of each later request to equal a value of the latest earlier request, such as the request_uri of an Authorization Request and the one the PAR endpoint returned before it.

func (OID4VCIRequestValuesEqualValidator) ID() string

func (OID4VCIRequestValuesEqualValidator) Validate(_ context.Context, input Input) Result

type OID4VCIRevocationPrecedesRequestValidator ¶

type OID4VCIRevocationPrecedesRequestValidator struct{}

OID4VCIRevocationPrecedesRequestValidator proves the precondition of a revoked-credential test: the Status List service revoked every reference of the issuance, and the Wallet received the Verifier's request long enough after the revocation that any Status List Token it fetched before it had expired.

A Wallet may rely on a Status List Token until its exp (Token Status List, Section 13.7), so a request that arrives earlier says nothing about whether the Wallet checks revocation. That case is blocked, not a Wallet failure.

Input: { revocation: <POST /sessions/{id}/status response>, presentation_session: <Capture verifier session record> }.

func (OID4VCIRevocationPrecedesRequestValidator) ID() string

func (OID4VCIRevocationPrecedesRequestValidator) Validate(_ context.Context, input Input) Result

type OID4VCIWalletRequestValidator ¶

type OID4VCIWalletRequestValidator struct{}

OID4VCIWalletRequestValidator checks the Wallet's HTTP requests of one kind, located by path suffix, against the endpoint the Wallet resolved from metadata and against the request parameters the source requires.

func (OID4VCIWalletRequestValidator) ID() string

func (OID4VCIWalletRequestValidator) Validate(_ context.Context, input Input) Result

type OID4VPClientIDMatchValidator ¶

type OID4VPClientIDMatchValidator struct{}

OID4VPClientIDMatchValidator verifies that client_id in the outer Authorization Request URI exactly matches the signed Request Object claim.

func (OID4VPClientIDMatchValidator) ID() string

func (OID4VPClientIDMatchValidator) Validate(_ context.Context, input Input) Result

type OID4VPClientMetadataHashAlgorithmsValidator ¶

type OID4VPClientMetadataHashAlgorithmsValidator struct{}

OID4VPClientMetadataHashAlgorithmsValidator reads the client_metadata signed into the delivered Request Object and fails when it names a hash algorithm outside the allowed list.

func (OID4VPClientMetadataHashAlgorithmsValidator) ID() string

func (OID4VPClientMetadataHashAlgorithmsValidator) Validate(_ context.Context, input Input) Result

type OID4VPDCAPIInvocationValidator ¶

type OID4VPDCAPIInvocationValidator struct{}

OID4VPDCAPIInvocationValidator reads the browser-side record of a Digital Credentials API invocation.

A DC API presentation is mediated by the User Agent, so the verifier learns nothing from the wire when the Wallet refuses: no Authorization Response is ever posted. The capture page therefore reports the outcome separately, and that report is the only protocol-grade evidence that the Wallet was invoked at all. Distinguishing api_unavailable from rejected matters: the first says the browser never offered the API, which is an environment failure rather than a Wallet verdict.

func (OID4VPDCAPIInvocationValidator) ID() string

func (OID4VPDCAPIInvocationValidator) Validate(_ context.Context, input Input) Result

type OID4VPDCQLArraySelectorFilterValidator ¶

type OID4VPDCQLArraySelectorFilterValidator struct{}

OID4VPDCQLArraySelectorFilterValidator verifies that a DCQL array selector drops the selected elements that cannot satisfy the trailing path component, while the satisfiable elements stay in the presented selection.

func (OID4VPDCQLArraySelectorFilterValidator) ID() string

func (OID4VPDCQLArraySelectorFilterValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPDCQLCredentialsNonArrayValidator ¶

type OID4VPDCQLCredentialsNonArrayValidator struct{}

func (OID4VPDCQLCredentialsNonArrayValidator) ID() string

func (OID4VPDCQLCredentialsNonArrayValidator) Validate(_ context.Context, input Input) Result

type OID4VPDCQLEmptyClaimPathValidator ¶

type OID4VPDCQLEmptyClaimPathValidator struct{}

OID4VPDCQLEmptyClaimPathValidator verifies a DCQL claim whose path is empty.

func (OID4VPDCQLEmptyClaimPathValidator) ID() string

func (OID4VPDCQLEmptyClaimPathValidator) Validate(_ context.Context, input Input) Result

type OID4VPDCQLMetaEmptyValidator ¶

type OID4VPDCQLMetaEmptyValidator struct{}

OID4VPDCQLMetaEmptyValidator verifies a DCQL credential with an empty meta object.

func (OID4VPDCQLMetaEmptyValidator) ID() string

func (OID4VPDCQLMetaEmptyValidator) Validate(_ context.Context, input Input) Result

type OID4VPDCQLMetaFormatMismatchValidator ¶

type OID4VPDCQLMetaFormatMismatchValidator struct{}

OID4VPDCQLMetaFormatMismatchValidator verifies DCQL metadata from another credential format.

func (OID4VPDCQLMetaFormatMismatchValidator) ID() string

func (OID4VPDCQLMetaFormatMismatchValidator) Validate(_ context.Context, input Input) Result

type OID4VPDCQLMetaOmittedValidator ¶

type OID4VPDCQLMetaOmittedValidator struct{}

OID4VPDCQLMetaOmittedValidator verifies a DCQL credential that omits meta.

func (OID4VPDCQLMetaOmittedValidator) ID() string

func (OID4VPDCQLMetaOmittedValidator) Validate(_ context.Context, input Input) Result

type OID4VPDCQLMultipleNonBooleanValidator ¶

type OID4VPDCQLMultipleNonBooleanValidator struct{}

OID4VPDCQLMultipleNonBooleanValidator verifies a malformed DCQL multiple property.

func (OID4VPDCQLMultipleNonBooleanValidator) ID() string

func (OID4VPDCQLMultipleNonBooleanValidator) Validate(_ context.Context, input Input) Result

type OID4VPDCQLObjectPropertyFilterValidator ¶

type OID4VPDCQLObjectPropertyFilterValidator struct{}

OID4VPDCQLObjectPropertyFilterValidator verifies that a DCQL object-property path discloses only the requested member of the selected object.

func (OID4VPDCQLObjectPropertyFilterValidator) ID() string

func (OID4VPDCQLObjectPropertyFilterValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPDCQLRequestedClaimPathsValidator ¶

type OID4VPDCQLRequestedClaimPathsValidator struct{}

OID4VPDCQLRequestedClaimPathsValidator verifies that the Authorization Request captured on the session requested exactly the expected claims paths. Rejection cases need this: without it, a request for one unavailable claim and a request mixing an available claim with an unavailable one produce the same evidence, so one test's assertions cannot distinguish the other's precondition.

func (OID4VPDCQLRequestedClaimPathsValidator) ID() string

func (OID4VPDCQLRequestedClaimPathsValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPDCQLTrustedAuthoritiesEmptyValidator ¶

type OID4VPDCQLTrustedAuthoritiesEmptyValidator struct{}

OID4VPDCQLTrustedAuthoritiesEmptyValidator verifies an empty trusted_authorities array.

func (OID4VPDCQLTrustedAuthoritiesEmptyValidator) ID() string

func (OID4VPDCQLTrustedAuthoritiesEmptyValidator) Validate(_ context.Context, input Input) Result

type OID4VPDCQLTrustedAuthoritiesInvalidObjectValidator ¶

type OID4VPDCQLTrustedAuthoritiesInvalidObjectValidator struct{}

func (OID4VPDCQLTrustedAuthoritiesInvalidObjectValidator) ID() string

func (OID4VPDCQLTrustedAuthoritiesInvalidObjectValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPDCQLTrustedAuthoritiesMissingTypeValidator ¶

type OID4VPDCQLTrustedAuthoritiesMissingTypeValidator struct{}

OID4VPDCQLTrustedAuthoritiesMissingTypeValidator verifies a trusted authority whose required type property is absent.

func (OID4VPDCQLTrustedAuthoritiesMissingTypeValidator) ID() string

func (OID4VPDCQLTrustedAuthoritiesMissingTypeValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPDCQLTrustedAuthoritiesNonArrayValidator ¶

type OID4VPDCQLTrustedAuthoritiesNonArrayValidator struct{}

func (OID4VPDCQLTrustedAuthoritiesNonArrayValidator) ID() string

func (OID4VPDCQLTrustedAuthoritiesNonArrayValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPDCQLTrustedAuthoritiesUnsupportedTypeValidator ¶

type OID4VPDCQLTrustedAuthoritiesUnsupportedTypeValidator struct{}

OID4VPDCQLTrustedAuthoritiesUnsupportedTypeValidator verifies a trusted authority type that is not defined by OID4VP.

func (OID4VPDCQLTrustedAuthoritiesUnsupportedTypeValidator) ID() string

func (OID4VPDCQLTrustedAuthoritiesUnsupportedTypeValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPDCQLValueConstraintsSatisfiedValidator ¶

type OID4VPDCQLValueConstraintsSatisfiedValidator struct{}

OID4VPDCQLValueConstraintsSatisfiedValidator proves that a Wallet applied the value restrictions of a DCQL query rather than merely answering it. Counting vp_token entries cannot decide this: several credentials of one type answer the same credential query, and only the disclosed claim values say which one came back. Every returned presentation must therefore disclose each restricted claim with a value drawn from that claim's values list, which fails as soon as one near-miss credential is released.

func (OID4VPDCQLValueConstraintsSatisfiedValidator) ID() string

func (OID4VPDCQLValueConstraintsSatisfiedValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPDIDSignedRequestValidator ¶

type OID4VPDIDSignedRequestValidator struct{}

OID4VPDIDSignedRequestValidator verifies a Request Object with the public key selected by its kid from the published DID document.

func (OID4VPDIDSignedRequestValidator) ID() string

func (OID4VPDIDSignedRequestValidator) Validate(_ context.Context, input Input) Result

type OID4VPDIDSigningKeyUnlistedValidator ¶

type OID4VPDIDSigningKeyUnlistedValidator struct{}

OID4VPDIDSigningKeyUnlistedValidator proves that a decentralized_identifier Request Object is signed by a key that none of the verification methods in the resolved DID document verifies.

func (OID4VPDIDSigningKeyUnlistedValidator) ID() string

func (OID4VPDIDSigningKeyUnlistedValidator) Validate(_ context.Context, input Input) Result

type OID4VPDistinctRequestEncryptionKeysValidator ¶

type OID4VPDistinctRequestEncryptionKeysValidator struct{}

OID4VPDistinctRequestEncryptionKeysValidator verifies that several Authorization Requests each published a different verifier encryption key. It makes a per-request key-agreement assertion meaningful: without distinct keys, a Wallet that reused one key for every response would still match each request's metadata.

func (OID4VPDistinctRequestEncryptionKeysValidator) ID() string

func (OID4VPDistinctRequestEncryptionKeysValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPEncryptedRequestObjectProcessedValidator ¶

type OID4VPEncryptedRequestObjectProcessedValidator struct{}

OID4VPEncryptedRequestObjectProcessedValidator applies OpenID4VP 1.0 Section 5.10 to a Wallet that requires an encrypted Request Object: the Wallet advertises public encryption keys and the key-management and content-encryption algorithms it accepts in its POSTed wallet_metadata, the Request Object is delivered as a compact JWE using those algorithms, and the interaction proceeds to a presentation.

The session is ground truth for the negotiation because the encrypted JWE in raw.authorization_request_jwe alone does not show which algorithms the Wallet advertised: the captured vp_request_object_encrypted event records the alg, enc, kid, and the metadata member each value came from. A Wallet that publishes no jwks does not require the encrypted Request Object at all, which is reported not applicable rather than as a pass so an unexercised feature cannot inflate the conformance score.

func (OID4VPEncryptedRequestObjectProcessedValidator) ID() string

func (OID4VPEncryptedRequestObjectProcessedValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPErrorResponseRequiredValidator ¶

type OID4VPErrorResponseRequiredValidator struct{}

OID4VPErrorResponseRequiredValidator verifies that the Wallet answered a request it cannot satisfy with exactly one OAuth2/OID4VP error code and no presentation, so credential selection and user authorization never started.

When a definition names a format in not_applicable_when_wallet_supports_format, a Wallet whose own evidence says it supports that format is outside the source's applicability: the result is not_applicable, not a code mismatch.

func (OID4VPErrorResponseRequiredValidator) ID() string

func (OID4VPErrorResponseRequiredValidator) Validate(_ context.Context, input Input) Result

type OID4VPMDocDeviceResponsePerQueryValidator ¶

type OID4VPMDocDeviceResponsePerQueryValidator struct{}

OID4VPMDocDeviceResponsePerQueryValidator proves that a Wallet answering several ISO mdoc credential queries returned one separate DeviceResponse per query, each holding the credential that query selected. Every query must restrict at least one claim value, so the disclosed values show which stored mdoc answered it; counting DeviceResponses alone cannot tell three distinct credentials from one credential returned three times.

func (OID4VPMDocDeviceResponsePerQueryValidator) ID() string

func (OID4VPMDocDeviceResponsePerQueryValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPMalformedStatusCredentialAbsentValidator ¶

type OID4VPMalformedStatusCredentialAbsentValidator struct{}

OID4VPMalformedStatusCredentialAbsentValidator proves that a Wallet did not keep a Referenced Token whose status reference is malformed.

Rejection cannot be observed directly, so it is probed: the query pins the document_number of the claim-set fixture the malformed token was issued on and asks for every match. A Wallet that rejected the token returns nothing. The shape check matters because one fixture may legitimately be issued more than once on the same device — the Wallet then holds a valid credential with the same document_number, and only the status claim distinguishes it from the one that had to be refused.

`vct` selects an SD-JWT VC query, whose status is the JOSE `status` claim; `doctype` with `namespace` selects an ISO mdoc query, whose status is the `status` element of the Mobile Security Object.

func (OID4VPMalformedStatusCredentialAbsentValidator) ID() string

func (OID4VPMalformedStatusCredentialAbsentValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPNoPresentationValidator ¶

type OID4VPNoPresentationValidator struct{}

OID4VPNoPresentationValidator fails when a Verifier session shows that the Wallet answered an Authorization Request with a presentation. FCAF negative tests accept a rejection either as no Authorization Response at all or as an error response without a vp_token; any other response fails.

func (OID4VPNoPresentationValidator) ID() string

func (OID4VPNoPresentationValidator) Validate(_ context.Context, input Input) Result

type OID4VPPresentationResponseHTTPValidator ¶

type OID4VPPresentationResponseHTTPValidator struct{}

OID4VPPresentationResponseHTTPValidator verifies the raw direct-post HTTP request captured on one presentation session.

func (OID4VPPresentationResponseHTTPValidator) ID() string

func (OID4VPPresentationResponseHTTPValidator) Validate(_ context.Context, input Input) Result

type OID4VPPresentedDigestAlgorithmsValidator ¶

type OID4VPPresentedDigestAlgorithmsValidator struct{}

OID4VPPresentedDigestAlgorithmsValidator requires every presentation in a captured session to be digested with an allowed hash algorithm.

func (OID4VPPresentedDigestAlgorithmsValidator) ID() string

func (OID4VPPresentedDigestAlgorithmsValidator) Validate(_ context.Context, input Input) Result

type OID4VPRedirectURIVisitedValidator ¶

type OID4VPRedirectURIVisitedValidator struct{}

OID4VPRedirectURIVisitedValidator proves that the Wallet's user agent opened the redirect URI the Verifier supplied after the Authorization Response. The capture service records a visit only when the request carries the response_code it generated for that session, so a recorded visit identifies the exact URI that was opened. The recorded envelope holds the request method and redacted headers only: it cannot show whether the Wallet appended further parameters to the URI.

func (OID4VPRedirectURIVisitedValidator) ID() string

func (OID4VPRedirectURIVisitedValidator) Validate(_ context.Context, input Input) Result

type OID4VPRequestAudienceValidator ¶

type OID4VPRequestAudienceValidator struct{}

OID4VPRequestAudienceValidator evaluates the Wallet against the aud claim of the Request Object it was served (OpenID4VP Section 5.8). A Wallet using dynamic discovery POSTs wallet_metadata carrying issuer, and aud must equal it; otherwise the Wallet relies on static discovery, and aud must be https://self-issued.me/v2. The test applies only to the discovery mode named in params; the delivered aud must match (outcome accepted) or differ from (outcome rejected) the value that mode requires, and the Wallet must then present or answer with an error and no presentation. Its input is the captured presentation session.

func (OID4VPRequestAudienceValidator) ID() string

func (OID4VPRequestAudienceValidator) Validate(ctx context.Context, input Input) Result

type OID4VPRequestCertificateChainValidator ¶

type OID4VPRequestCertificateChainValidator struct{}

OID4VPRequestCertificateChainValidator proves which defect the delivered Request Object's x5c chain actually carries.

The capture verifier signs these requests with the replaced chain's own leaf key and recomputes the Client Identifier from it, so the signature verifies and the hash matches: the chain is the only thing wrong. A test that asserted only "the Wallet rejected it" could not tell these three cases apart, nor distinguish them from a corrupted signature.

func (OID4VPRequestCertificateChainValidator) ID() string

func (OID4VPRequestCertificateChainValidator) Validate(_ context.Context, input Input) Result

type OID4VPRequestEncryptionJWKValidator ¶

type OID4VPRequestEncryptionJWKValidator struct{}

OID4VPRequestEncryptionJWKValidator verifies the verifier encryption JWK that an Authorization Request published in client_metadata. It proves the precondition of a response-encryption negative test, for example a key that omits the alg parameter OpenID for Verifiable Presentations requires, or a key whose alg cannot be the JWE alg the Wallet would use.

func (OID4VPRequestEncryptionJWKValidator) ID() string

func (OID4VPRequestEncryptionJWKValidator) Validate(_ context.Context, input Input) Result

type OID4VPRequestJWKValueAbsentValidator ¶

type OID4VPRequestJWKValueAbsentValidator struct{}

OID4VPRequestJWKValueAbsentValidator verifies that no JWK published in an Authorization Request client_metadata uses a prohibited field value.

func (OID4VPRequestJWKValueAbsentValidator) ID() string

func (OID4VPRequestJWKValueAbsentValidator) Validate(_ context.Context, input Input) Result

type OID4VPRequestURINotRetrievedValidator ¶

type OID4VPRequestURINotRetrievedValidator struct{}

OID4VPRequestURINotRetrievedValidator verifies that the Wallet did not retrieve the request object after rejecting an invalid request_uri_method.

func (OID4VPRequestURINotRetrievedValidator) ID() string

func (OID4VPRequestURINotRetrievedValidator) Validate(_ context.Context, input Input) Result

type OID4VPRequestURIRetrievalValidator ¶

type OID4VPRequestURIRetrievalValidator struct{}

OID4VPRequestURIRetrievalValidator verifies the captured request_uri retrieval method, HTTPS endpoint, and optional request headers, form body, and request target. Capture Wallet attaches this record only after its session-specific /request endpoint has handled the request.

func (OID4VPRequestURIRetrievalValidator) ID() string

func (OID4VPRequestURIRetrievalValidator) Validate(_ context.Context, input Input) Result

type OID4VPResponseEncUnsupportedErrorRequiredValidator ¶

type OID4VPResponseEncUnsupportedErrorRequiredValidator struct{}

OID4VPResponseEncUnsupportedErrorRequiredValidator decides a test whose profile is a Wallet supporting a single response content-encryption algorithm that the Verifier does not offer. The POSTed wallet_metadata states which enc values the Wallet supports: any value beyond the single one puts the Wallet outside the profile. Otherwise the Wallet must answer with the required error and no presentation.

func (OID4VPResponseEncUnsupportedErrorRequiredValidator) ID() string

func (OID4VPResponseEncUnsupportedErrorRequiredValidator) Validate(
	ctx context.Context,
	input Input,
) Result

type OID4VPResponseEncryptionValidator ¶

type OID4VPResponseEncryptionValidator struct{}

OID4VPResponseEncryptionValidator verifies response encryption properties from the original compact JWE captured in the direct-post form.

func (OID4VPResponseEncryptionValidator) ID() string

func (OID4VPResponseEncryptionValidator) Validate(_ context.Context, input Input) Result

type OID4VPResponseEndpointCallbackValidator ¶

type OID4VPResponseEndpointCallbackValidator struct{}

OID4VPResponseEndpointCallbackValidator verifies the HTTP response the verifier returns to the Wallet after a direct-post submission, captured in the session's raw.presentation_response_verifier_http record.

func (OID4VPResponseEndpointCallbackValidator) ID() string

func (OID4VPResponseEndpointCallbackValidator) Validate(_ context.Context, input Input) Result

type OID4VPResponseParametersTopLevelValidator ¶

type OID4VPResponseParametersTopLevelValidator struct{}

OID4VPResponseParametersTopLevelValidator verifies that the decrypted Authorization Response JWT carries the response contents as top-level JSON members, as required by OpenID4VP 1.0 Section 8.3. A Wallet that wraps the response in a sub-object fails either because a required member is missing from the root or because a response parameter is reachable one level down.

func (OID4VPResponseParametersTopLevelValidator) ID() string

func (OID4VPResponseParametersTopLevelValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPResponseURIClientIDMismatchValidator ¶

type OID4VPResponseURIClientIDMismatchValidator struct{}

OID4VPResponseURIClientIDMismatchValidator proves the precondition of the strict Response URI matching rule in OpenID4VP 1.0 Section 5.9: for the x509_san_dns Client Identifier Prefix the FQDN of the Response URI must equal the Client Identifier without its prefix. It inspects the Request Object that was actually delivered to the Wallet and requires the delivered response_uri host to differ from that Client Identifier, so the Wallet is known to have received a request it must refuse.

func (OID4VPResponseURIClientIDMismatchValidator) ID() string

func (OID4VPResponseURIClientIDMismatchValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPSessionEventCountValidator ¶

type OID4VPSessionEventCountValidator struct{}

OID4VPSessionEventCountValidator verifies how many times one capture event type was recorded on a presentation session. It is used to prove that the Wallet stopped communicating, for example that it delivered exactly one Authorization Response and then terminated the interaction.

func (OID4VPSessionEventCountValidator) ID() string

func (OID4VPSessionEventCountValidator) Validate(_ context.Context, input Input) Result

type OID4VPStateEchoValidator ¶

type OID4VPStateEchoValidator struct{}

OID4VPStateEchoValidator verifies that the Wallet returned the state parameter of the Authorization Request unchanged in the Authorization Response, as OpenID4VP 1.0 Section 5.2 requires. Its input carries the Request Object served to the Wallet as `request_object` and the decrypted Authorization Response as `response`.

func (OID4VPStateEchoValidator) ID() string

func (OID4VPStateEchoValidator) Validate(_ context.Context, input Input) Result

type OID4VPTransactionDataCredentialIDsMismatchValidator ¶

type OID4VPTransactionDataCredentialIDsMismatchValidator struct{}

OID4VPTransactionDataCredentialIDsMismatchValidator verifies that at least one string transaction data credential ID does not occur in the DCQL query.

func (OID4VPTransactionDataCredentialIDsMismatchValidator) ID() string

func (OID4VPTransactionDataCredentialIDsMismatchValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPTransactionDataCredentialIDsNonArrayValidator ¶

type OID4VPTransactionDataCredentialIDsNonArrayValidator struct{}

OID4VPTransactionDataCredentialIDsNonArrayValidator verifies malformed credential_ids.

func (OID4VPTransactionDataCredentialIDsNonArrayValidator) ID() string

func (OID4VPTransactionDataCredentialIDsNonArrayValidator) Validate(
	_ context.Context,
	input Input,
) Result

type OID4VPTransactionDataCredentialIDsValidator ¶

type OID4VPTransactionDataCredentialIDsValidator struct{}

OID4VPTransactionDataCredentialIDsValidator verifies that every transaction data credential ID is a DCQL Credential Query ID.

func (OID4VPTransactionDataCredentialIDsValidator) ID() string

func (OID4VPTransactionDataCredentialIDsValidator) Validate(_ context.Context, input Input) Result

type OID4VPTransactionDataTypeNonStringValidator ¶

type OID4VPTransactionDataTypeNonStringValidator struct{}

OID4VPTransactionDataTypeNonStringValidator verifies a malformed type field.

func (OID4VPTransactionDataTypeNonStringValidator) ID() string

func (OID4VPTransactionDataTypeNonStringValidator) Validate(_ context.Context, input Input) Result

type OID4VPUnencryptedRequestObjectRejectedValidator ¶

type OID4VPUnencryptedRequestObjectRejectedValidator struct{}

OID4VPUnencryptedRequestObjectRejectedValidator applies only to a Wallet whose POSTed wallet_metadata publishes jwks, which OpenID4VP Section 5.10.1 uses to require an encrypted Request Object. Such a Wallet must answer the unencrypted Request Object it received with invalid_request and no presentation. Its input is the captured presentation session.

The session must have served a plain Request Object: Capture records the served JWE in raw.authorization_request_jwe and keeps the signed Request Object in raw.authorization_request_jwt even when the delivery was encrypted, so a session whose Wallet requires encryption needs request_behavior.request_object_encryption: none before the JWS proves what the Wallet received.

func (OID4VPUnencryptedRequestObjectRejectedValidator) ID() string

func (OID4VPUnencryptedRequestObjectRejectedValidator) Validate(
	ctx context.Context,
	input Input,
) Result

type OID4VPUnsupportedResponseTypeValidator ¶

type OID4VPUnsupportedResponseTypeValidator struct{}

OID4VPUnsupportedResponseTypeValidator verifies rejection or discontinuation after a Wallet receives a response type that HAIP does not permit.

func (OID4VPUnsupportedResponseTypeValidator) ID() string

func (OID4VPUnsupportedResponseTypeValidator) Validate(_ context.Context, input Input) Result

type OID4VPVerifierAttestationRequestValidator ¶

type OID4VPVerifierAttestationRequestValidator struct{}

OID4VPVerifierAttestationRequestValidator proves the bindings a delivered Request Object declares through the verifier_attestation: Client Identifier Prefix: the attestation carried in its jwt JOSE header, the attestation sub and iss, the Request Object signature under the attestation's cnf.jwk, the attestation signature under the published issuer JWKS, and the optional redirect_uris claim. FCAF tests change one binding at a time, so a verdict names the observed bindings instead of only accepting or rejecting the whole request.

func (OID4VPVerifierAttestationRequestValidator) ID() string

func (OID4VPVerifierAttestationRequestValidator) Validate(_ context.Context, input Input) Result

type OID4VPVerifierInfoAllCredentialsValidator ¶

type OID4VPVerifierInfoAllCredentialsValidator struct{}

OID4VPVerifierInfoAllCredentialsValidator verifies that every verifier_info attestation applies to all requested DCQL credentials by omitting credential_ids.

func (OID4VPVerifierInfoAllCredentialsValidator) ID() string

func (OID4VPVerifierInfoAllCredentialsValidator) Validate(_ context.Context, input Input) Result

type OID4VPVerifierMetadataExclusiveValidator ¶

type OID4VPVerifierMetadataExclusiveValidator struct{}

OID4VPVerifierMetadataExclusiveValidator verifies that verifier metadata is non-empty, contains supported presentation formats, and appears only inside the client_metadata Authorization Request parameter.

func (OID4VPVerifierMetadataExclusiveValidator) ID() string

func (OID4VPVerifierMetadataExclusiveValidator) Validate(_ context.Context, input Input) Result

type OID4VPWalletErrorConcealsReasonValidator ¶

type OID4VPWalletErrorConcealsReasonValidator struct{}

OID4VPWalletErrorConcealsReasonValidator requires the Wallet to answer with an error and no presentation, without disclosing why: none of params.terms may appear in the error, error_description or error_uri it sent.

FCAF WS_RP_SM_IssuerIntegrity__012 asks for an error "without revealing reason (revocation of MSO)". Disclosure can only be checked against named terms, so this is an approximation: it catches a Wallet that says the credential is revoked, not one that paraphrases it.

func (OID4VPWalletErrorConcealsReasonValidator) ID() string

func (OID4VPWalletErrorConcealsReasonValidator) Validate(_ context.Context, input Input) Result

type OID4VPWalletMetadataHashAlgorithmsValidator ¶

type OID4VPWalletMetadataHashAlgorithmsValidator struct{}

OID4VPWalletMetadataHashAlgorithmsValidator applies HAIP Section 8: an entity using hash algorithms beyond SHA-256 SHOULD state them in its metadata. The session shows both halves: the Wallet's POSTed wallet_metadata and the digest algorithm of what it presented. Presenting a non-SHA-256 credential is what proves the Wallet supports another hash algorithm; without it the source's profile applicability does not hold.

func (OID4VPWalletMetadataHashAlgorithmsValidator) ID() string

func (OID4VPWalletMetadataHashAlgorithmsValidator) Validate(_ context.Context, input Input) Result

type OID4VPWalletMetadataValidator ¶

type OID4VPWalletMetadataValidator struct{}

OID4VPWalletMetadataValidator checks the wallet_metadata the Wallet POSTed to the Request URI (OpenID4VP Section 5.10.1). Its input is the captured request_uri payload.

func (OID4VPWalletMetadataValidator) ID() string

func (OID4VPWalletMetadataValidator) Validate(_ context.Context, input Input) Result

type OID4VPWalletNonceMatchValidator ¶

type OID4VPWalletNonceMatchValidator struct{}

OID4VPWalletNonceMatchValidator verifies that the wallet_nonce supplied in the request_uri POST exactly matches the signed Request Object claim.

func (OID4VPWalletNonceMatchValidator) ID() string

func (OID4VPWalletNonceMatchValidator) Validate(_ context.Context, input Input) Result

type OID4VPWalletNonceMismatchValidator ¶

type OID4VPWalletNonceMismatchValidator struct{}

OID4VPWalletNonceMismatchValidator verifies that the Request Object returned from a POST request_uri flow has the expected non-matching nonce state.

func (OID4VPWalletNonceMismatchValidator) ID() string

func (OID4VPWalletNonceMismatchValidator) Validate(_ context.Context, input Input) Result

type OID4VPX509ClientIDLeafMismatchValidator ¶

type OID4VPX509ClientIDLeafMismatchValidator struct{}

OID4VPX509ClientIDLeafMismatchValidator proves that an X.509 Client Identifier does not bind to the leaf certificate delivered in x5c (OpenID4VP Section 5.9.3): for x509_hash the value is not the leaf hash, and for x509_san_dns the DNS name is not a dNSName SAN of the leaf.

func (OID4VPX509ClientIDLeafMismatchValidator) ID() string

func (OID4VPX509ClientIDLeafMismatchValidator) Validate(_ context.Context, input Input) Result

type OID4VPX509HashClientIDValidator ¶

type OID4VPX509HashClientIDValidator struct{}

OID4VPX509HashClientIDValidator verifies the leaf certificate hash binding.

func (OID4VPX509HashClientIDValidator) ID() string

func (OID4VPX509HashClientIDValidator) Validate(_ context.Context, input Input) Result

type PIDMDocMandatoryElementsValidator ¶

type PIDMDocMandatoryElementsValidator struct{}

func (PIDMDocMandatoryElementsValidator) ID() string

func (PIDMDocMandatoryElementsValidator) Validate(_ context.Context, input Input) Result

type PIDMDocTypeValidator ¶

type PIDMDocTypeValidator struct{}

func (PIDMDocTypeValidator) ID() string

func (PIDMDocTypeValidator) Validate(_ context.Context, input Input) Result

type PIDSDJWTMandatoryClaimsValidator ¶

type PIDSDJWTMandatoryClaimsValidator struct{}

func (PIDSDJWTMandatoryClaimsValidator) ID() string

func (PIDSDJWTMandatoryClaimsValidator) Validate(_ context.Context, input Input) Result

type PIDSDJWTVCTValidator ¶

type PIDSDJWTVCTValidator struct{}

func (PIDSDJWTVCTValidator) ID() string

func (PIDSDJWTVCTValidator) Validate(_ context.Context, input Input) Result

type Registry ¶

type Registry struct {
	// contains filtered or unexported fields
}

func DefaultRegistry() (*Registry, error)

func NewRegistry(validators ...Validator) (*Registry, error)

func (r *Registry) Get(id string) (Validator, bool)

func (r *Registry) Register(validator Validator) error

type Result ¶

type Result struct {
	Status  Status         `json:"status"`
	Message string         `json:"message,omitempty"`
	Details map[string]any `json:"details,omitempty"`
}

type SDJWTCNFConformsValidator ¶

type SDJWTCNFConformsValidator struct{}

func (SDJWTCNFConformsValidator) ID() string

func (SDJWTCNFConformsValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimCountryCodeArrayValidator ¶

type SDJWTClaimCountryCodeArrayValidator struct{}

func (SDJWTClaimCountryCodeArrayValidator) ID() string

func (SDJWTClaimCountryCodeArrayValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimCountryCodeValidator ¶

type SDJWTClaimCountryCodeValidator struct{}

func (SDJWTClaimCountryCodeValidator) ID() string

func (SDJWTClaimCountryCodeValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimCountrySubdivisionValidator ¶

type SDJWTClaimCountrySubdivisionValidator struct{}

func (SDJWTClaimCountrySubdivisionValidator) ID() string

func (SDJWTClaimCountrySubdivisionValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimDateFormatValidator ¶

type SDJWTClaimDateFormatValidator struct{}

func (SDJWTClaimDateFormatValidator) ID() string

func (SDJWTClaimDateFormatValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimIntegerAllowedValidator ¶

type SDJWTClaimIntegerAllowedValidator struct{}

func (SDJWTClaimIntegerAllowedValidator) ID() string

func (SDJWTClaimIntegerAllowedValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimInternationalPhoneValidator ¶

type SDJWTClaimInternationalPhoneValidator struct{}

func (SDJWTClaimInternationalPhoneValidator) ID() string

func (SDJWTClaimInternationalPhoneValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimJPEGDataURLValidator ¶

type SDJWTClaimJPEGDataURLValidator struct{}

func (SDJWTClaimJPEGDataURLValidator) ID() string

func (SDJWTClaimJPEGDataURLValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimNestedStringMaxLengthValidator ¶

type SDJWTClaimNestedStringMaxLengthValidator struct{}

func (SDJWTClaimNestedStringMaxLengthValidator) ID() string

func (SDJWTClaimNestedStringMaxLengthValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimNonEmptyUTF8StringValidator ¶

type SDJWTClaimNonEmptyUTF8StringValidator struct{}

func (SDJWTClaimNonEmptyUTF8StringValidator) ID() string

func (SDJWTClaimNonEmptyUTF8StringValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimNonNegativeIntegerValidator ¶

type SDJWTClaimNonNegativeIntegerValidator struct{}

SDJWTClaimNonNegativeIntegerValidator verifies that a resolved SD-JWT claim carries an integral number that is not negative, the shape the status-list `idx` member uses.

func (SDJWTClaimNonNegativeIntegerValidator) ID() string

func (SDJWTClaimNonNegativeIntegerValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimObjectKeysValidator ¶

type SDJWTClaimObjectKeysValidator struct{}

func (SDJWTClaimObjectKeysValidator) ID() string

func (SDJWTClaimObjectKeysValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimObjectStringValuesValidator ¶

type SDJWTClaimObjectStringValuesValidator struct{}

func (SDJWTClaimObjectStringValuesValidator) ID() string

func (SDJWTClaimObjectStringValuesValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimObjectValidator ¶

type SDJWTClaimObjectValidator struct{}

func (SDJWTClaimObjectValidator) ID() string

func (SDJWTClaimObjectValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimPresenceValidator ¶

type SDJWTClaimPresenceValidator struct{}

SDJWTClaimPresenceValidator asserts either presence or absence of a claim, so a test whose requirement is that a claim was never issued can state that directly instead of relying on a neighbouring positive assertion.

func (SDJWTClaimPresenceValidator) ID() string

func (SDJWTClaimPresenceValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimPresentValidator ¶

type SDJWTClaimPresentValidator struct{}

func (SDJWTClaimPresentValidator) ID() string

func (SDJWTClaimPresentValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimRFC5322EmailValidator ¶

type SDJWTClaimRFC5322EmailValidator struct{}

func (SDJWTClaimRFC5322EmailValidator) ID() string

func (SDJWTClaimRFC5322EmailValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimStringArrayValidator ¶

type SDJWTClaimStringArrayValidator struct{}

func (SDJWTClaimStringArrayValidator) ID() string

func (SDJWTClaimStringArrayValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimStringPrefixValidator ¶

type SDJWTClaimStringPrefixValidator struct{}

func (SDJWTClaimStringPrefixValidator) ID() string

func (SDJWTClaimStringPrefixValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimTypeValidator ¶

type SDJWTClaimTypeValidator struct{}

func (SDJWTClaimTypeValidator) ID() string

func (SDJWTClaimTypeValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimURIValidator ¶

type SDJWTClaimURIValidator struct{}

SDJWTClaimURIValidator verifies that a resolved SD-JWT claim carries an absolute RFC 3986 URI, the shape the status-list `uri` member uses.

func (SDJWTClaimURIValidator) ID() string

func (SDJWTClaimURIValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimUTF8StringValidator ¶

type SDJWTClaimUTF8StringValidator struct{}

func (SDJWTClaimUTF8StringValidator) ID() string

func (SDJWTClaimUTF8StringValidator) Validate(_ context.Context, input Input) Result

type SDJWTClaimValidDateValidator ¶

type SDJWTClaimValidDateValidator struct{}

func (SDJWTClaimValidDateValidator) ID() string

func (SDJWTClaimValidDateValidator) Validate(_ context.Context, input Input) Result

type SDJWTCompactSerializationValidator ¶

type SDJWTCompactSerializationValidator struct{}

SDJWTCompactSerializationValidator verifies RFC 9901 tilde-delimited presentation framing with or without a final Key Binding JWT.

func (SDJWTCompactSerializationValidator) ID() string

func (SDJWTCompactSerializationValidator) Validate(_ context.Context, input Input) Result

type SDJWTDisclosureDigestsSHA256Validator ¶

type SDJWTDisclosureDigestsSHA256Validator struct{}

SDJWTDisclosureDigestsSHA256Validator verifies that disclosed SD-JWT claims use the SHA-256 digest algorithm. Parsing an SD-JWT presentation recomputes every disclosure digest and verifies its reference in the issuer payload.

func (SDJWTDisclosureDigestsSHA256Validator) ID() string

func (SDJWTDisclosureDigestsSHA256Validator) Validate(_ context.Context, input Input) Result

type SDJWTDomesticNamespaceValidator ¶

type SDJWTDomesticNamespaceValidator struct{}

func (SDJWTDomesticNamespaceValidator) ID() string

func (SDJWTDomesticNamespaceValidator) Validate(_ context.Context, input Input) Result

type SDJWTIssuerTrustAnchorExcludedValidator ¶

type SDJWTIssuerTrustAnchorExcludedValidator struct{}

SDJWTIssuerTrustAnchorExcludedValidator verifies that the presented SD-JWT VC carries the issuer signing certificate and its trust chain in `x5c` while the trust anchor stays outside that chain.

The observable form of an excluded anchor is that no certificate in `x5c` is self-signed and every link is signed by its successor, so the top-most certificate is signed by a key the chain does not carry. A trust anchor that a trust list designates below a root cannot be distinguished from a regular intermediate by inspecting the presentation alone.

func (SDJWTIssuerTrustAnchorExcludedValidator) ID() string

func (SDJWTIssuerTrustAnchorExcludedValidator) Validate(
	_ context.Context,
	input Input,
) Result

type SDJWTIssuerX509HeaderValidator ¶

type SDJWTIssuerX509HeaderValidator struct{}

func (SDJWTIssuerX509HeaderValidator) ID() string

func (SDJWTIssuerX509HeaderValidator) Validate(_ context.Context, input Input) Result

type SDJWTKBJWTAlgorithmAllowedValidator ¶

type SDJWTKBJWTAlgorithmAllowedValidator struct{}

SDJWTKBJWTAlgorithmAllowedValidator checks that every KB-JWT of the presentation evidence uses a JOSE signature algorithm from the accepted list the assertion supplies.

func (SDJWTKBJWTAlgorithmAllowedValidator) ID() string

func (SDJWTKBJWTAlgorithmAllowedValidator) Validate(_ context.Context, input Input) Result

type SDJWTKBJWTClaimStringPrefixValidator ¶

type SDJWTKBJWTClaimStringPrefixValidator struct{}

SDJWTKBJWTClaimStringPrefixValidator reads a claim of the Key Binding JWT rather than of the credential.

The KB-JWT audience is where a presentation records who it was produced for, and over the Digital Credentials API that is the browser origin prefixed by `origin:` instead of a Client Identifier. The credential claims say nothing about it, so the existing sdjwt.claim_* family cannot reach this value: the parser keeps the Key Binding payload beside the claims, not inside them.

func (SDJWTKBJWTClaimStringPrefixValidator) ID() string

func (SDJWTKBJWTClaimStringPrefixValidator) Validate(_ context.Context, input Input) Result

type SDJWTKBJWTPresentValidator ¶

type SDJWTKBJWTPresentValidator struct{}

func (SDJWTKBJWTPresentValidator) ID() string

func (SDJWTKBJWTPresentValidator) Validate(_ context.Context, input Input) Result

type SDJWTKeyBindingMatchesCNFValidator ¶

type SDJWTKeyBindingMatchesCNFValidator struct{}

func (SDJWTKeyBindingMatchesCNFValidator) ID() string

func (SDJWTKeyBindingMatchesCNFValidator) Validate(_ context.Context, input Input) Result

type SDJWTPresentationDigestAlgorithmValidator ¶

type SDJWTPresentationDigestAlgorithmValidator struct{}

SDJWTPresentationDigestAlgorithmValidator decides a source test whose requirement is conditional on the Wallet's supported hash functions: the Wallet must not present a credential digested with an algorithm it does not support. A Wallet that presents it has demonstrated support, which puts it outside the source's profile applicability instead of in breach of it, so that case is reported as not applicable rather than as a failure. With require_error, a Wallet inside the applicability must also have answered with an error and no presentation.

func (SDJWTPresentationDigestAlgorithmValidator) ID() string

func (SDJWTPresentationDigestAlgorithmValidator) Validate(_ context.Context, input Input) Result

type SharedJSONValidator ¶

type SharedJSONValidator struct{}

SharedJSONValidator runs the Shared_JSON test cases on received bytes.

func (SharedJSONValidator) ID() string

func (SharedJSONValidator) Validate(_ context.Context, input Input) Result

type SharedJWTJWEValidator ¶

type SharedJWTJWEValidator struct{}

SharedJWTJWEValidator runs the Shared_JWT_JWE test cases on a compact JWE.

func (SharedJWTJWEValidator) ID() string

func (SharedJWTJWEValidator) Validate(_ context.Context, input Input) Result

type SharedJWTJWSValidator ¶

type SharedJWTJWSValidator struct{}

SharedJWTJWSValidator runs the Shared_JWT_JWS test cases on a compact JWS.

func (SharedJWTJWSValidator) ID() string

func (SharedJWTJWSValidator) Validate(_ context.Context, input Input) Result

type Status ¶

type Status string

const (
	StatusPass          Status = "pass"
	StatusFail          Status = "fail"
	StatusBlocked       Status = "blocked"
	StatusSkipped       Status = "skipped"
	StatusNotApplicable Status = "not_applicable"
	StatusInconclusive  Status = "inconclusive"
	StatusError         Status = "error"
)

type URISyntaxValidator ¶

type URISyntaxValidator struct{}

URISyntaxValidator requires selected strings to be syntactically correct RFC 3986 URIs: a scheme, only permitted characters, valid percent-encoding, and at most one fragment delimiter.

func (URISyntaxValidator) ID() string

func (URISyntaxValidator) Validate(_ context.Context, input Input) Result

type Validator ¶

type Validator interface {
	ID() string
	Validate(ctx context.Context, input Input) Result
}