Class VerifierOptions
- Namespace
- Tessio.Verifier.AspNetCore
- Assembly
- Tessio.Verifier.AspNetCore.dll
Configuration for the Tessio verifier, supplied via AddTessioVerifier(IServiceCollection, Action<VerifierOptions>).
public sealed class VerifierOptions- Inheritance
-
VerifierOptions
- Inherited Members
Fields
UndisclosedErrorMessage
What an anonymous caller reads in place of a failure message.
public const string UndisclosedErrorMessage = "The failure message is not disclosed on this surface. Read the code, or the stored result."Field Value
Remarks
Code is append-only observable behaviour and is what a caller acts on, so the code still travels. The message is prose written by whoever produced the failure, and the reader of this surface is whoever holds a session id. A sentence rather than a token, because an integrator meeting it needs to know the message exists elsewhere rather than that the failure had no explanation.
UndisclosedTrustListSource
What an anonymous caller sees in place of a trust list identifier that is not on PublicTrustListSources.
public const string UndisclosedTrustListSource = "undisclosed"Field Value
Remarks
A fixed token rather than null, because the two say different things: null means no list was consulted, and this means one was and is not named on this surface.
Properties
ClientId
Verifier identifier (OpenID4VP client_id). Per OpenID4VP 1.0 this may carry a
client-identifier-scheme prefix (e.g. x509_san_dns:verifier.example.com) in production.
public string ClientId { get; set; }Property Value
CompleteOnlyOnValidResponse
When true, only a response that passes verification completes a session. A response that fails verification is answered 400, recorded as LastFailure, and the session stays pending for another response until it expires. A wallet's Authorization Error Response, in the clear or sealed, is recorded the same way but answered 200, as OpenID4VP 1.0 section 8.2 requires. Defaults to false.
public bool CompleteOnlyOnValidResponse { get; set; }Property Value
Remarks
OpenID4VP 1.0 §8.6 requires a failing VP Token to be rejected and says nothing about the session, so both settings conform. They differ in what a failed attempt costs: with this off, a failing response completes the session and a holder whose wallet failed starts again with a new one. With it on, the holder can retry within the same session.
It changes what a failure looks like to your code. A failure no longer arrives as a
completed session with Result.IsValid false. The session stays pending, carries
LastFailure and FailedAttempts,
and ends as completed-and-valid or expired. The status resource carries both, and the SSE stream
sends an attempt_failed event when FailedAttempts rises.
Failures close together can share one event, so read the count rather than counting events. Off by
default because the frozen VerificationSessionStatus contract models a failed
verification as completed, and turning this on changes that meaning for the deployment that does it.
The registered ISessionStore must implement IAttemptRecordingSessionStore. The built-in store does. Without it the wallet callback throws when it is first built, which in mock mode is at startup and in live mode is the first callback.
CredentialFormat
Credential format to request and verify: dc+sd-jwt (default) or mso_mdoc
(ISO mobile documents, e.g. the mDL).
public string CredentialFormat { get; set; }Property Value
DemoCompletionDelay
In Demo, how long to wait before auto-completing a session with a synthesized result. Default: 2 seconds. Set to Zero to complete immediately.
public TimeSpan DemoCompletionDelay { get; set; }Property Value
ExpectedDocType
Expected mdoc document type when CredentialFormat is mso_mdoc.
Defaults to the mobile driving licence (org.iso.18013.5.1.mDL).
public string ExpectedDocType { get; set; }Property Value
ExpectedVct
Optional expected credential type (SD-JWT VC vct) to constrain the DCQL query. When unset a
demo default is used.
public string? ExpectedVct { get; set; }Property Value
MdocNamespace
Namespace for requested mdoc claims (DCQL paths are [namespace, element]).
Defaults to the mDL namespace.
public string MdocNamespace { get; set; }Property Value
Mode
Operating mode. Defaults to Demo so a fresh install runs end-to-end without a wallet.
public VerifierMode Mode { get; set; }Property Value
PublicTrustListSources
Trust list identifiers that may be disclosed to an ANONYMOUS caller. Empty by default, which discloses none.
public ISet<string> PublicTrustListSources { get; }Property Value
Remarks
Why an allowlist and not a redaction rule. The session status endpoint and its SSE stream
are reachable by whoever holds a session id, and a session id is self-served by
GET {prefix}/start, so treat that surface as anonymous. It carries
TrustListSource, which a resolver may set to anything: the built-in
TrustListLoader passes the path or URL it was handed straight through, so the
value can be a server filesystem path, and a directory of anchor files can name the parties a
deployment tests against.
A redaction rule would ask "does this look sensitive", which is a judgement that fails open on the first string nobody anticipated. This inverts it: a source is emitted only if it appears here, and anything else becomes UndisclosedTrustListSource. That fails closed by construction.
Nothing a caller needs is lost. "A trust list was consulted and your issuer was not on it" is the useful part, and the token still says it. Put a genuinely public list here, such as a Commission-published trusted list URL, where naming it helps an integrator and discloses nothing. The full value is untouched on any surface you authorise and scope yourself.
RequestedClaims
Claims to request via selective disclosure (the DCQL query is generated from these). Ask only for
what you need. When empty, the verifier requests age_over_18 so the demo always shows something.
public IList<string> RequestedClaims { get; set; }Property Value
ResponseMode
OpenID4VP response delivery mode written into the generated request. Defaults to DirectPostJwt (the HAIP default).
public ResponseMode ResponseMode { get; set; }Property Value
RoutePrefix
URL path prefix under which MapTessioVerifier(IEndpointRouteBuilder, string?)
mounts its endpoints. Default: /verify.
public string RoutePrefix { get; set; }Property Value
SessionLifetime
How long a created session (and its request) remains valid. Default: 5 minutes.
public TimeSpan SessionLifetime { get; set; }Property Value
TransactionData
Transaction data to bind into the presentation (OpenID4VP transaction_data): each entry is a
JSON object string with at least a type member; credential_ids defaults to the
query's credential id. The wallet acknowledges each entry with a hash in the KB-JWT, which is
verified. SD-JWT VC flows only.
public IList<string> TransactionData { get; set; }