Table of Contents

Class MockWalletResponses

Namespace
Tessio.Verifier.AspNetCore.Testing
Assembly
Tessio.Verifier.AspNetCore.dll

Builds the wallet response for a session the way MOCK mode does, but callable by a consumer.

public sealed class MockWalletResponses : IDisposable
Inheritance
MockWalletResponses
Implements
Inherited Members

Remarks

MOCK mode only fires from the built-in /start endpoint. A host that self-drives the protocol (serving its own request_uri and response_uri) cannot reuse it, so it has no way to exercise its own callback in an automated test. This helper closes that gap: it mints a real, signed SD-JWT VC presentation bound to the session and wraps it exactly as a wallet would POST it. Additive to contracts-v0; nothing existing changes.

Trust: the presentation is signed by an ephemeral mock issuer. Register IssuerCertificate for IssuerId on the trust list under test, or verification will correctly reject it as untrusted.

Fields

EuAgeVerificationDocType

docType of the EU age-verification attestation, the mdoc-only credential purpose-built for age checks. It carries age_over_N booleans and no identity attributes.

public const string EuAgeVerificationDocType = "eu.europa.ec.av.1"

Field Value

string

Properties

IssuerCertificate

The mock issuer's self-signed certificate, to register as the trust anchor under test.

public X509Certificate2 IssuerCertificate { get; }

Property Value

X509Certificate2

IssuerId

The mock issuer identifier. Its host matches the certificate SAN.

public static string IssuerId { get; }

Property Value

string

MdocIacaCertificate

The mdoc IACA root, to register as the trust anchor when verifying an mdoc response.

public X509Certificate2 MdocIacaCertificate { get; }

Property Value

X509Certificate2

MdocIssuerId

The mdoc issuer identifier, which is the Document Signer certificate's subject rather than a URL. This is the value to put on the trust list; the docType is not an issuer.

public string MdocIssuerId { get; }

Property Value

string

Methods

CreateEncryptedSdJwtResponse(VerificationSession, IEnumerable<string>?, string?, string?, IReadOnlyDictionary<string, object>?)

The SD-JWT counterpart wrapped as an ENCRYPTED direct_post.jwt response: the form carries a single response JWE, ECDH-ES direct + A256GCM, encrypted to the key the session advertised.

public WalletResponseData CreateEncryptedSdJwtResponse(VerificationSession session, IEnumerable<string>? claims = null, string? vct = null, string? audience = null, IReadOnlyDictionary<string, object>? claimValues = null)

Parameters

session VerificationSession
claims IEnumerable<string>
vct string
audience string
claimValues IReadOnlyDictionary<string, object>

Returns

WalletResponseData

Remarks

This exists because CreateSdJwtResponse(VerificationSession, IEnumerable<string>?, string?, string?, IReadOnlyDictionary<string, object>?) is cleartext, so a host that only used it never exercised the decryption path a real HAIP wallet forces. The verifier resolves its per-request key by the kid echoed here, so this is the shape that proves keys are resolved per request rather than from one shared key.

CreateMdocResponse(VerificationSession, IEnumerable<string>?, string?, string?, byte[]?, IReadOnlyDictionary<string, object>?)

Issues an ISO 18013-5 mdoc DeviceResponse bound to the session, wrapped in the cleartext direct_post form a wallet POSTs to the response_uri.

public WalletResponseData CreateMdocResponse(VerificationSession session, IEnumerable<string>? claimNames = null, string? docType = null, string? mdocNamespace = null, byte[]? encryptionKeyThumbprint = null, IReadOnlyDictionary<string, object>? claimValues = null)

Parameters

session VerificationSession

The pending session to answer. Supplies client_id, nonce, response_uri and state.

claimNames IEnumerable<string>

Elements to disclose. Defaults to age_over_18.

docType string

mdoc docType. Defaults to the EU age-verification attestation.

mdocNamespace string

Namespace holding the elements. Defaults to docType.

encryptionKeyThumbprint byte[]

Set only for an encrypted direct_post.jwt response, whose transcript binds the key thumbprint.

claimValues IReadOnlyDictionary<string, object>

Values to disclose, by claim name, overriding the sample persona (which answers every age question with true).

Returns

WalletResponseData

Remarks

The mdoc counterpart of CreateSdJwtResponse(VerificationSession, IEnumerable<string>?, string?, string?, IReadOnlyDictionary<string, object>?). It matters separately because the two formats fail in different places: an mdoc device signature covers the session transcript (client_id, nonce, response_uri), so a host that only ever exercises SD-JWT has never tested the binding a real mdoc wallet actually performs. The EU age-verification attestation is mdoc-only, which makes this the shape an age check has to handle.

Trust: register MdocIacaCertificate as the trust anchor under test, not IssuerCertificate. The mdoc chain is issued by a separate ephemeral IACA root.

CreateSdJwtResponse(VerificationSession, IEnumerable<string>?, string?, string?, IReadOnlyDictionary<string, object>?)

Issues an SD-JWT VC presentation bound to the session's nonce, audience and transaction data, wrapped in the cleartext direct_post form a wallet POSTs to the response_uri.

public WalletResponseData CreateSdJwtResponse(VerificationSession session, IEnumerable<string>? claims = null, string? vct = null, string? audience = null, IReadOnlyDictionary<string, object>? claimValues = null)

Parameters

session VerificationSession

The pending session to answer. Its request supplies nonce, audience and state.

claims IEnumerable<string>

Claims to disclose. Defaults to age_over_18.

vct string

Credential type. Defaults to the demo VCT.

audience string

KB-JWT audience. Defaults to the session's client_id, which is what the verifier checks.

claimValues IReadOnlyDictionary<string, object>

Values to disclose, by claim name, overriding the sample persona. See the remarks on CreateMdocResponse(VerificationSession, IEnumerable<string>?, string?, string?, byte[]?, IReadOnlyDictionary<string, object>?) for why a test needs to choose these.

Returns

WalletResponseData

A response ready to hand to a callback endpoint or IWalletResponseVerifier.

Dispose()

Releases the ephemeral issuer keys and certificates.

public void Dispose()