Class VerificationResult

Namespace

Tessio.Verifier.Core

Assembly

Tessio.Verifier.Core.dll

Outcome of credential verification. Carries the disclosed claims, issuer info, and any failure reasons.

public sealed record VerificationResult : IEquatable<VerificationResult>

Inheritance

object

VerificationResult

Implements

IEquatable<VerificationResult>

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

FROZEN contract (contracts-v0). Forward-compatible: new optional inputs may be added as init-only properties, which is how CredentialType, CredentialQueryId and VerifiedPresentations arrived. No existing member changes.

Properties

CredentialQueryId

The id of the DCQL Credential Query the verified presentation answered, when the verifier knows the request: which alternative the wallet chose, for a query offering several. Null when it was not established.

public string? CredentialQueryId { get; init; }

Property Value

string

Remarks

SPEC: OpenID4VP 1.0 section 6.4.3: "it is typically expected that the Wallet presents the End-User with a choice of which Credential(s) to present if multiple of the sets of Credentials in options can satisfy the request", so which one answered is known only from the response. Set by WalletResponseVerifier in the ASP.NET Core package, from CredentialQueryId. A credential verifier on its own does not set it, because it sees one presentation and not the request.

A response answering several Credential Queries yields one result. When the response verifies, it is the presentation that verified whose Credential Query comes first in the query's credentials array, so the order the wallet put its keys in does not change it, and this names that Credential Query. VerifiedPresentations carries every presentation that verified. When what verified does not answer the query, the result is the first presentation that failed and this names its Credential Query. When the refusal concerns the request or the response as a whole rather than one presentation (a key naming no Credential Query, an unverifiable request, transaction data no verified presentation acknowledges), this is null.

Init-only and optional, so every existing construction of this record still compiles and behaves as it did.

CredentialType

The credential type that was actually presented: the vct for SD-JWT VC, the docType for mdoc. Null when verification failed before the type could be read.

public string? CredentialType { get; init; }

Property Value

string

Remarks

What was PRESENTED, not what was requested. The caller already knows what it asked for. Once a request names several types, which one arrived is a fact only the verifier holds, and without this the only way to learn it is to read a mismatch message, which exists only when the type was wrong. A caller recording what a holder presented, or choosing which claim path to read an answer from, needs it on the passing path too.

Null means "not established", never "the credential declared none". A signature that fails before the payload is parsed leaves nothing to report, and an empty string there would be the stronger and false claim.

Init-only and optional, so every existing construction of this record still compiles and behaves as it did. Additive in the sense the frozen contract permits: no existing member changes.

DisclosedClaims

The claims the holder elected to disclose, keyed by claim name. Empty when IsValid is false. Values are dynamic JSON values represented as object (string, number, bool, list, dict, or null).

public required IReadOnlyDictionary<string, object> DisclosedClaims { get; init; }

Property Value

IReadOnlyDictionary<string, object>

Errors

Verification failures; empty when IsValid is true.

public required IReadOnlyList<VerificationError> Errors { get; init; }

Property Value

IReadOnlyList<VerificationError>

IsValid

True when signature, disclosures, key binding, and trust checks all pass.

public required bool IsValid { get; init; }

Property Value

bool

Issuer

Information about the credential issuer and how its key was resolved.

public required IssuerInfo Issuer { get; init; }

Property Value

IssuerInfo

VerifiedPresentations

For a passing result over a DCQL query whose Credential Query ids the verifier could read: the result of every presentation that verified, in the order of the query's credentials array, each with its own CredentialQueryId, claims and issuer. Null otherwise, including on every failing result.

public IReadOnlyList<VerificationResult>? VerifiedPresentations { get; init; }

Property Value

IReadOnlyList<VerificationResult>

Remarks

The top-level members describe the first of these. A credential set option may need two credentials together (OpenID4VP 1.0 section 6.2), and the second one's claims are reachable only here. A presentation that failed and was discarded (section 8.6) is not listed.

The entries' own VerifiedPresentations are null, so the list is one level deep.

Init-only and optional, so every existing construction of this record still compiles and behaves as it did.

Methods

Invalid(IReadOnlyList<VerificationError>, IssuerInfo?)

A failing result carrying every accumulated error and, optionally, the resolved issuer. Falls back to Unknown when no issuer was reached.

public static VerificationResult Invalid(IReadOnlyList<VerificationError> errors, IssuerInfo? issuer = null)

Parameters

errors IReadOnlyList<VerificationError>

issuer IssuerInfo

Returns

VerificationResult

Remarks

Every message is made one line here, because messages quote what the presenter sent and a caller may log them as they stand: each character that could break the line becomes U+FFFD. Every failing result this library builds goes through here, and a test holds the source to that, so no failure path can return a message that skipped it. The one other place that sets a result's errors, the session view, replaces every message with one fixed sentence.

A caller passing its own messages here gets them made one line too.

Invalid(VerificationError, IssuerInfo?)

A failing result carrying one error and, optionally, the issuer that was resolved.

public static VerificationResult Invalid(VerificationError error, IssuerInfo? issuer = null)

Parameters

error VerificationError

issuer IssuerInfo

Returns

VerificationResult

Valid(IReadOnlyDictionary<string, object>, IssuerInfo)

A passing result carrying the disclosed claims and resolved issuer. Convenience for tests and self-driving hosts that synthesize results rather than fully initializing every required member.

public static VerificationResult Valid(IReadOnlyDictionary<string, object> disclosedClaims, IssuerInfo issuer)

Parameters

disclosedClaims IReadOnlyDictionary<string, object>

issuer IssuerInfo

Returns

VerificationResult