OID4VP: Remove deprecated elements

Author: nodh

CHANGELOG.md

@@ -19,6 +19,7 @@ Release 5.10.0 (Unreleased):
    - Use correct syntax for `vp_token` in responses to DCQL queries, i.e., with an array
    - Drop session transcript implementation from ISO/IEC 18013-7:2024 Annex B, which was pre-OpenID4VP 1.0
    - Remove deprecated format identifier `vc+sd-jwt` (now `dc+sd-jwt`)
+   - Remove deprecated client identifier prefix scheme `x509_san_uri`
 
 Release 5.9.0
  - Refactor `RqesWalletService` to be stateless

openid-data-classes/src/commonMain/kotlin/at/asitplus/openid/AuthenticationRequestParameters.kt

@@ -52,14 +52,6 @@ data class AuthenticationRequestParameters(
     @SerialName("client_id")
     val clientId: String? = null,
 
-    /**
-     * OID4VP: OPTIONAL. A string identifying the scheme of the value in the `client_id` Authorization Request parameter
-     * (Client Identifier scheme). Kept here only for compatibility with POTENTIAL.
-     */
-    @Deprecated("Removed from OpenID4VP Draft 22", level = DeprecationLevel.ERROR)
-    @SerialName("client_id_scheme")
-    val clientIdScheme: OpenIdConstants.ClientIdScheme? = null,
-
     /**
      * OIDC: REQUIRED. Redirection URI to which the response will be sent. This URI MUST exactly match one of the
      * Redirection URI values for the Client pre-registered at the OpenID Provider, with the matching performed as
@@ -128,10 +120,6 @@ data class AuthenticationRequestParameters(
     @SerialName("client_metadata")
     val clientMetadata: RelyingPartyMetadata? = null,
 
-    @Deprecated("Removed from OpenID4VP Draft 21")
-    @SerialName("client_metadata_uri")
-    val clientMetadataUri: String? = null,
-
     /**
      * OIDC: OPTIONAL. ID Token previously issued by the Authorization Server being passed as a hint about the
      * End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is
@@ -395,15 +383,13 @@ data class AuthenticationRequestParameters(
 ) : RequestParameters() {
 
     /**
-     * Reads the [OpenIdConstants.ClientIdScheme] of this request either directly from [clientIdScheme],
-     * or by extracting the prefix from [clientId] (as specified in OpenID4VP draft 22 onwards).
+     * Reads the [OpenIdConstants.ClientIdScheme] by extracting the prefix from [clientId]
      */
     val clientIdSchemeExtracted: OpenIdConstants.ClientIdScheme?
         get() = clientId?.let { OpenIdConstants.ClientIdScheme.decodeFromClientId(it) }
 
     /**
-     * Reads the [clientId] and removes the prefix of the [clientIdSchemeExtracted],
-     * as specified in OpenID4VP draft 22 onwards.
+     * Reads the [clientId] and removes the prefix of the [clientIdSchemeExtracted].
      * OpenID4VP states that the *full* [clientId] must be used for presentations and anything else.
      */
     val clientIdWithoutPrefix: String?
@@ -413,13 +399,12 @@ data class AuthenticationRequestParameters(
 
     /**
      * Reads the [redirectUrl], or the [clientIdWithoutPrefix] if [clientIdSchemeExtracted] is
-     * [OpenIdConstants.ClientIdScheme.RedirectUri], as specified in OpenID4VP draft 22 onwards.
+     * [OpenIdConstants.ClientIdScheme.RedirectUri].
      */
     val redirectUrlExtracted: String?
         get() = redirectUrl
             ?: (clientIdSchemeExtracted as? OpenIdConstants.ClientIdScheme.RedirectUri)?.let { clientIdWithoutPrefix }
 
-    @Suppress("DEPRECATION")
     override fun equals(other: Any?): Boolean {
         if (this === other) return true
         if (other == null || this::class != other::class) return false
@@ -473,7 +458,6 @@ data class AuthenticationRequestParameters(
         return true
     }
 
-    @Suppress("DEPRECATION")
     override fun hashCode(): Int {
         var result = responseType?.hashCode() ?: 0
         result = 31 * result + (clientId?.hashCode() ?: 0)

openid-data-classes/src/commonMain/kotlin/at/asitplus/openid/OpenIdConstants.kt

@@ -150,17 +150,14 @@ object OpenIdConstants {
             private const val STRING_PRE_REGISTERED = "pre-registered"
             private const val STRING_REDIRECT_URI = "redirect_uri"
             private const val STRING_X509_SAN_DNS = "x509_san_dns"
-            private const val STRING_X509_SAN_URI = "x509_san_uri"
             private const val STRING_X509_HASH = "x509_hash"
             private const val STRING_ENTITY_ID = "entity_id"
             private const val STRING_DID = "did"
             private const val STRING_VERIFIER_ATTESTATION = "verifier_attestation"
 
-            @Suppress("DEPRECATION")
             fun decodeFromClientId(clientId: String) = when (clientId.substringBefore(":")) {
                 STRING_REDIRECT_URI -> RedirectUri
                 STRING_X509_SAN_DNS -> X509SanDns
-                STRING_X509_SAN_URI -> X509SanUri
                 STRING_X509_HASH -> X509Hash
                 STRING_ENTITY_ID -> EntityId
                 STRING_DID -> Did
@@ -201,20 +198,6 @@ object OpenIdConstants {
          */
         object X509SanDns : ClientIdScheme(STRING_X509_SAN_DNS)
 
-        /**
-         * When the Client Identifier Scheme is `x509_san_uri`, the Client Identifier MUST be a URI and match a
-         * `uniformResourceIdentifier` Subject Alternative Name (SAN) RFC5280 entry in the leaf certificate passed with
-         * the request. The request MUST be signed with the private key corresponding to the public key in the leaf
-         * X.509 certificate of the certificate chain added to the request in the `x5c` JOSE header RFC7515 of the
-         * signed request object. The Wallet MUST validate the signature and the trust chain of the X.509 certificate.
-         * All Verifier metadata other than the public key MUST be obtained from the `client_metadata` parameter. If
-         * the Wallet can establish trust in the Client Identifier authenticated through the certificate, e.g. because
-         * the Client Identifier is contained in a list of trusted Client Identifiers, it may allow the client to
-         * freely choose the `redirect_uri` value. If not, the `redirect_uri` value MUST match the Client Identifier.
-         */
-        @Deprecated("Removed in OpenID4VP Draft 25")
-        object X509SanUri : ClientIdScheme(STRING_X509_SAN_URI)
-
         /**
          * When the Client Identifier Prefix is `x509_hash`, the original Client Identifier (the part without the
          * `x509_hash:` prefix) MUST be a hash and match the hash of the leaf certificate passed with the request.
@@ -272,12 +255,10 @@ object OpenIdConstants {
         object Serializer : KSerializer<ClientIdScheme> {
             override val descriptor = PrimitiveSerialDescriptor("ClientIdScheme", PrimitiveKind.STRING)
 
-            @Suppress("DEPRECATION")
             override fun deserialize(decoder: Decoder): ClientIdScheme = when (val string = decoder.decodeString()) {
                 STRING_PRE_REGISTERED -> PreRegistered
                 STRING_REDIRECT_URI -> RedirectUri
                 STRING_X509_SAN_DNS -> X509SanDns
-                STRING_X509_SAN_URI -> X509SanUri
                 STRING_X509_HASH -> X509Hash
                 STRING_ENTITY_ID -> EntityId
                 STRING_DID -> Did

openid-data-classes/src/commonMain/kotlin/at/asitplus/openid/dcql/DCQLCredentialSetQuery.kt

@@ -7,36 +7,24 @@ import kotlinx.serialization.Serializable
 /**
  *  6.2. Credential Set Query
  *
- * A Credential Set Query is an object representing a request for one or more credentials to
- * satisfy a particular use case with the Verifier.
+ * A Credential Set Query is an object representing a request for one or more Credentials to satisfy a particular use
+ * case with the Verifier.
  */
 @Serializable
 data class DCQLCredentialSetQuery(
     /**
-     * OID4VP draft 23: options: REQUIRED: A non-empty array, where each value in the array is a
-     * list of Credential Query identifiers representing one set of Credentials that satisfies the
-     * use case. The value of each element in the options array is an array of identifiers which
-     * reference elements in credentials.
+     * REQUIRED. A non-empty array, where each value in the array is a list of Credential Query identifiers
+     * representing one set of Credentials that satisfies the use case. The value of each element in the `options` array
+     * is a non-empty array of identifiers which reference elements in `credentials`.
      */
     @SerialName("options")
     val options: NonEmptyList<List<DCQLCredentialQueryIdentifier>>,
 
     /**
-     * OID4VP draft 23: required: OPTIONAL. A boolean which indicates whether this set of
-     * Credentials is required to satisfy the particular use case at the Verifier. If omitted,
-     * the default value is true.
+     * OPTIONAL. A boolean which indicates whether this set of Credentials is required to satisfy the particular use
+     * case at the Verifier. If omitted, the default value is `true`.
      */
     @SerialName("required")
     val required: Boolean = true,
 
-    /**
-     * OID4VP draft 23: purpose: OPTIONAL. A string, number or object specifying the purpose of the
-     * query. This specification does not define a specific structure or specific values for this
-     * property. The purpose is intended to be used by the Verifier to communicate the reason for
-     * the query to the Wallet. The Wallet MAY use this information to show the user the reason
-     * for the request.
-     */
-    @Deprecated("Removed in OpenID4VP Draft 26")
-    @SerialName("purpose")
-    val purpose: DCQLCredentialSetQueryPurpose? = null,
-)
+    )

openid-data-classes/src/commonTest/kotlin/at/asitplus/openid/dcql/DCQLQueryTest.kt

@@ -538,15 +538,13 @@ val DCQLQueryTest by testSuite {
                   ],
                   "credential_sets": [
                     {
-                      "purpose": "Identification",
                       "options": [
                         [ "pid" ],
                         [ "other_pid" ],
                         [ "pid_reduced_cred_1", "pid_reduced_cred_2" ]
                       ]
                     },
                     {
-                      "purpose": "Show your rewards card",
                       "required": false,
                       "options": [
                         [ "nice_to_have" ]
@@ -752,14 +750,12 @@ val DCQLQueryTest by testSuite {
                   ],
                   "credential_sets": [
                     {
-                      "purpose": "Identification",
                       "options": [
                         [ "mdl-id" ],
                         [ "photo_card-id" ]
                       ]
                     },
                     {
-                      "purpose": "Proof of address",
                       "required": false,
                       "options": [
                         [ "mdl-address" ],

vck-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/openid/AuthorizationRequestValidator.kt

@@ -84,11 +84,8 @@ internal class AuthorizationRequestValidator(
         }
     }
 
-    @Suppress("DEPRECATION")
     private fun ClientIdScheme?.isAnyX509() =
-        (this == ClientIdScheme.X509SanDns)
-                || (this == ClientIdScheme.X509SanUri)
-                || (this == ClientIdScheme.X509Hash)
+        (this == ClientIdScheme.X509SanDns) || (this == ClientIdScheme.X509Hash)
 
     @Throws(OAuth2Exception::class)
     private fun AuthenticationRequestParameters.verifyClientMetadata() {
@@ -127,7 +124,6 @@ internal class AuthorizationRequestValidator(
         val leaf = jwsSigned.header.certificateChain!!.leaf
         when (clientIdScheme) {
             ClientIdScheme.X509SanDns -> verifyX509SanDns(leaf, responseModeIsDirectPost, responseModeIsDcApi)
-            ClientIdScheme.X509SanUri -> verifyX509SanUri(leaf)
             ClientIdScheme.X509Hash -> verifyX509SanHash(leaf)
             // checked before calling this method
             else -> throw InvalidRequest("Unexpected clientIdScheme $clientIdScheme")

vck/src/commonTest/kotlin/at/asitplus/wallet/openid/dcql/DCQLQueryProcedureAdapterTest.kt

@@ -53,7 +53,6 @@ val DCQLQueryProcedureAdapterTest by testSuite {
               {
                 "credential_sets": [
                   {
-                    "purpose": "To obtain e-prescription, we need to verify your identity.",
                     "options": [
                       [
                         "pid_sd_jwt"