Class WalletResponseParserOptions
- Namespace
- Tessio.Verifier.OpenId4Vp
- Assembly
- Tessio.Verifier.OpenId4Vp.dll
Configuration for WalletResponseParser.
public sealed class WalletResponseParserOptions- Inheritance
-
WalletResponseParserOptions
- Inherited Members
Properties
DcqlQueryJson
The DCQL query of the request the response answers, as the JSON sent in dcql_query. When set, each
presentation is read in the format of the Credential Query its vp_token key names, and a response that
does not answer the query is refused. Null by default, which reads every presentation in
PresentationFormat as before.
public string? DcqlQueryJson { get; set; }Property Value
Remarks
Set it for a query offering several credentials, such as a PID as an mdoc or as an SD-JWT VC built by AnyOf(params DcqlCredentialQuery[]): one format for the whole response cannot read either answer correctly. PresentationFormat still applies when the query's only Credential Query names no format; a query asking for several credentials must name one on each.
A response is refused, as a WalletResponseException, when a vp_token key names no
Credential Query, when a Credential Query that does not allow multiple gets more than one presentation
(OpenID4VP 1.0 section 8.1), or when the Credential Queries answered are not a combination the query requested
(section 6.4.2): every one of them when the query has no credential_sets, otherwise an option of every
required set, and nothing outside the options answered. A bare presentation, not keyed by id, is read as the
answer to the only Credential Query of a query that has one, and refused for a query that has several.
A value that is not a DCQL query with a non-empty credentials array, each entry carrying a well-formed id
of its own (and a format, when there are several or there are credential sets), and well-formed
credential_sets when present, is the caller's configuration, not the wallet's answer. The parser's
constructor refuses it with ArgumentException. Changed on the options afterwards, it makes every
parse throw InvalidOperationException before any of the response is read.
PresentationFormat
Credential format assigned to string presentations extracted from vp_token.
Defaults to dc+sd-jwt, the SD-JWT VC format identifier.
public string PresentationFormat { get; set; }Property Value
ReadErrorResponses
Whether ParseDetailedAsync(WalletResponseData, CancellationToken) returns an Authorization Error Response, in
the clear or sealed in a direct_post.jwt response, with Error
set and no credentials, instead of throwing. Off by default.
public bool ReadErrorResponses { get; set; }Property Value
Remarks
Off by default because a caller written before this option existed expects an exception for a form with
no presentation. Handed an empty credential list instead, a check over "every credential" would pass on
nothing. Turn it on only where Error is read before the credentials.
The built-in callback and WalletResponseVerifier in the ASP.NET Core package do.
ResponseDecryptionKey
Private key used to decrypt direct_post.jwt (JWE) responses. The matching public key is
advertised to wallets via client_metadata.jwks. Required to parse encrypted responses;
plain direct_post responses need no key.
public SecurityKey? ResponseDecryptionKey { get; set; }Property Value
ResponseDecryptionKeyResolver
Resolves the decryption key from the JWE's kid header. Takes precedence over
ResponseDecryptionKey when set.
public Func<string?, SecurityKey?>? ResponseDecryptionKeyResolver { get; set; }Property Value
Remarks
Needed because response-encryption keys are ephemeral per authorization request (HAIP 1.0
§5) and for direct_post.jwt the session correlation handle (state)
is inside the encrypted payload, so the key cannot be picked by session. The kid the
wallet echoes from our client_metadata.jwks is the way back to the right key.