Require the holder's identifier to be a URI

Author: nodh

CHANGELOG.md

@@ -9,7 +9,7 @@ Release 5.9.0 (unreleased):
    - Introduce interface `PublishedKeyMaterial` to indicate clients can lookup that key with the `identifier` used as a `keyId` in a key set
    - Other key material gets randomly assigned identifiers to not rely on DIDs
    - For JVM add `PublishedKeyStoreMaterial` to load keys from Java key stores with a fixed identifier
-   - In class `HolderAgent` require the `identifier` to be set in the constructor, as this needs to be an URI for SD-JWT and JWT VC
+   - In class `HolderAgent` require the `identifier` to be a URI, set in the constructor, as required for SD-JWT and JWT VC
    - Key material will be referenced by its `keyId` and key set URL or by its certificate or plain public key in JWS proofs
 
 Release 5.8.0:

openid-data-classes/src/commonMain/kotlin/at/asitplus/wallet/lib/data/rfc3986/UniformResourceIdentifier.kt

@@ -21,3 +21,5 @@ import kotlin.jvm.JvmInline
         get() = url.toString()
 }
 
+fun String.toUri() = UniformResourceIdentifier(this)
+

vck-openid-ktor/src/commonTest/kotlin/at/asitplus/wallet/lib/ktor/openid/OpenId4VciClientTest.kt

@@ -29,6 +29,7 @@ import at.asitplus.wallet.lib.agent.ValidatorSdJwt
 import at.asitplus.wallet.lib.agent.Verifier.VerifyCredentialResult
 import at.asitplus.wallet.lib.data.ConstantIndex
 import at.asitplus.wallet.lib.data.ConstantIndex.CredentialRepresentation.*
+import at.asitplus.wallet.lib.data.rfc3986.toUri
 import at.asitplus.wallet.lib.data.vckJsonSerializer
 import at.asitplus.wallet.lib.jws.JwsHeaderCertOrJwk
 import at.asitplus.wallet.lib.jws.JwsHeaderNone
@@ -56,12 +57,8 @@ import io.kotest.matchers.types.shouldBeInstanceOf
 import io.ktor.client.*
 import io.ktor.client.engine.mock.*
 import io.ktor.client.request.*
-import io.ktor.http.ContentType
-import io.ktor.http.HttpHeaders
-import io.ktor.http.HttpStatusCode
-import io.ktor.http.fullPath
-import io.ktor.http.headersOf
-import io.ktor.util.toMap
+import io.ktor.http.*
+import io.ktor.util.*
 import kotlinx.serialization.json.jsonPrimitive
 import kotlin.random.Random
 import kotlin.time.Clock
@@ -242,7 +239,7 @@ class OpenId4VciClientTest : FunSpec() {
         )
         val issuer = IssuerAgent(
             keyMaterial = EphemeralKeyWithSelfSignedCert(),
-            identifier = "https://issuer.example.com/"
+            identifier = "https://issuer.example.com/".toUri()
         )
         credentialIssuer = CredentialIssuer(
             authorizationService = authorizationService,

vck-openid-ktor/src/commonTest/kotlin/at/asitplus/wallet/lib/ktor/openid/OpenId4VpWalletTest.kt

@@ -28,6 +28,7 @@ import at.asitplus.wallet.lib.data.ConstantIndex.CredentialRepresentation.SD_JWT
 import at.asitplus.wallet.lib.data.CredentialPresentation.DCQLPresentation
 import at.asitplus.wallet.lib.data.CredentialPresentationRequest.DCQLRequest
 import at.asitplus.wallet.lib.data.SelectiveDisclosureItem
+import at.asitplus.wallet.lib.data.rfc3986.toUri
 import at.asitplus.wallet.lib.oidvci.OAuth2Exception
 import at.asitplus.wallet.lib.openid.*
 import at.asitplus.wallet.lib.openid.AuthnResponseResult.SuccessIso
@@ -305,7 +306,7 @@ class OpenId4VpWalletTest : FunSpec() {
     ) = storeCredential(
         IssuerAgent(
             keyMaterial = EphemeralKeyWithSelfSignedCert(),
-            identifier = "https://issuer.example.com/"
+            identifier = "https://issuer.example.com/".toUri()
         ).issueCredential(
             representation.toCredentialToBeIssued(scheme, attributes)
         ).getOrThrow().toStoreCredentialInput()

vck-openid/src/commonTest/kotlin/at/asitplus/wallet/lib/oidvci/OidvciAttestationTest.kt

@@ -12,6 +12,7 @@ import at.asitplus.wallet.lib.data.AtomicAttribute2023
 import at.asitplus.wallet.lib.data.ConstantIndex
 import at.asitplus.wallet.lib.data.ConstantIndex.CredentialRepresentation
 import at.asitplus.wallet.lib.data.VerifiableCredentialJws
+import at.asitplus.wallet.lib.data.rfc3986.toUri
 import at.asitplus.wallet.lib.data.vckJsonSerializer
 import at.asitplus.wallet.lib.jws.JwsHeaderCertOrJwk
 import at.asitplus.wallet.lib.jws.SignJwt
@@ -64,7 +65,7 @@ class OidvciAttestationTest : FunSpec({
         )
         issuer = CredentialIssuer(
             authorizationService = authorizationService,
-            issuer = IssuerAgent(identifier = "https://issuer.example.com"),
+            issuer = IssuerAgent(identifier = "https://issuer.example.com".toUri()),
             credentialSchemes = setOf(ConstantIndex.AtomicAttribute2023, MobileDrivingLicenceScheme),
             proofValidator = ProofValidator(
                 verifyAttestationProof = { true },
@@ -106,7 +107,7 @@ class OidvciAttestationTest : FunSpec({
     test("use key attestation for proof, issuer does not verify it") {
         issuer = CredentialIssuer(
             authorizationService = authorizationService,
-            issuer = IssuerAgent(identifier = "https://issuer.example.com"),
+            issuer = IssuerAgent(identifier = "https://issuer.example.com".toUri()),
             credentialSchemes = setOf(ConstantIndex.AtomicAttribute2023, MobileDrivingLicenceScheme),
             proofValidator = ProofValidator(
                 verifyAttestationProof = { false }, // do not accept key attestation

vck-openid/src/commonTest/kotlin/at/asitplus/wallet/lib/oidvci/OidvciCodeFlowTest.kt

@@ -17,6 +17,7 @@ import at.asitplus.wallet.lib.data.ConstantIndex.AtomicAttribute2023
 import at.asitplus.wallet.lib.data.ConstantIndex.CredentialRepresentation.*
 import at.asitplus.wallet.lib.data.VerifiableCredentialJws
 import at.asitplus.wallet.lib.data.VerifiableCredentialSdJwt
+import at.asitplus.wallet.lib.data.rfc3986.toUri
 import at.asitplus.wallet.lib.data.vckJsonSerializer
 import at.asitplus.wallet.lib.oauth2.AuthorizationServiceStrategy
 import at.asitplus.wallet.lib.oauth2.ClientAuthRequest
@@ -59,7 +60,7 @@ class OidvciCodeFlowTest : FreeSpec({
         )
         issuer = CredentialIssuer(
             authorizationService = authorizationService,
-            issuer = IssuerAgent(identifier = "https://issuer.example.com"),
+            issuer = IssuerAgent(identifier = "https://issuer.example.com".toUri()),
             credentialSchemes = setOf(AtomicAttribute2023, MobileDrivingLicenceScheme),
         )
         client = WalletService()
@@ -230,7 +231,7 @@ class OidvciCodeFlowTest : FreeSpec({
         )
         issuer = CredentialIssuer(
             authorizationService = authorizationService,
-            issuer = IssuerAgent(identifier = "https://issuer.example.com"),
+            issuer = IssuerAgent(identifier = "https://issuer.example.com".toUri()),
             credentialSchemes = setOf(AtomicAttribute2023),
         )
         val requestOptions = RequestOptions(AtomicAttribute2023, PLAIN_JWT)

vck-openid/src/commonTest/kotlin/at/asitplus/wallet/lib/oidvci/OidvciEncryptionTest.kt

@@ -12,6 +12,7 @@ import at.asitplus.wallet.lib.agent.IssuerAgent
 import at.asitplus.wallet.lib.data.AtomicAttribute2023
 import at.asitplus.wallet.lib.data.ConstantIndex
 import at.asitplus.wallet.lib.data.VerifiableCredentialJws
+import at.asitplus.wallet.lib.data.rfc3986.toUri
 import at.asitplus.wallet.lib.data.vckJsonSerializer
 import at.asitplus.wallet.lib.jws.DecryptJwe
 import at.asitplus.wallet.lib.jws.DecryptJweFun
@@ -62,7 +63,7 @@ class OidvciEncryptionTest : FunSpec({
         )
         issuer = CredentialIssuer(
             authorizationService = authorizationService,
-            issuer = IssuerAgent(identifier = "https://issuer.example.com"),
+            issuer = IssuerAgent(identifier = "https://issuer.example.com".toUri()),
             credentialSchemes = setOf(ConstantIndex.AtomicAttribute2023),
             requireEncryption = true, // this is important, to require encryption
         )
@@ -78,7 +79,7 @@ class OidvciEncryptionTest : FunSpec({
     test("issuer fails to encrypt") {
         issuer = CredentialIssuer(
             authorizationService = authorizationService,
-            issuer = IssuerAgent(identifier = "https://issuer.example.com"),
+            issuer = IssuerAgent(identifier = "https://issuer.example.com".toUri()),
             credentialSchemes = setOf(ConstantIndex.AtomicAttribute2023),
             requireEncryption = true, // this is important, to require encryption
             encryptCredentialRequest = object : EncryptJweFun {

vck-openid/src/commonTest/kotlin/at/asitplus/wallet/lib/oidvci/OidvciOfferCodeTest.kt

@@ -6,6 +6,7 @@ import at.asitplus.openid.CredentialOffer
 import at.asitplus.openid.TokenResponseParameters
 import at.asitplus.wallet.lib.agent.IssuerAgent
 import at.asitplus.wallet.lib.data.ConstantIndex.AtomicAttribute2023
+import at.asitplus.wallet.lib.data.rfc3986.toUri
 import at.asitplus.wallet.lib.oauth2.OAuth2Client
 import at.asitplus.wallet.lib.oauth2.SimpleAuthorizationService
 import at.asitplus.wallet.lib.openid.AuthenticationResponseResult
@@ -32,7 +33,7 @@ class OidvciOfferCodeTest : FreeSpec({
         )
         issuer = CredentialIssuer(
             authorizationService = authorizationService,
-            issuer = IssuerAgent(identifier = "https://issuer.example.com"),
+            issuer = IssuerAgent(identifier = "https://issuer.example.com".toUri()),
             credentialSchemes = setOf(AtomicAttribute2023, MobileDrivingLicenceScheme),
         )
         client = WalletService()

vck-openid/src/commonTest/kotlin/at/asitplus/wallet/lib/oidvci/OidvciPreAuthTest.kt

@@ -10,6 +10,7 @@ import at.asitplus.wallet.lib.agent.IssuerAgent
 import at.asitplus.wallet.lib.data.ConstantIndex.AtomicAttribute2023
 import at.asitplus.wallet.lib.data.ConstantIndex.CredentialRepresentation.PLAIN_JWT
 import at.asitplus.wallet.lib.data.VerifiableCredentialJws
+import at.asitplus.wallet.lib.data.rfc3986.toUri
 import at.asitplus.wallet.lib.data.vckJsonSerializer
 import at.asitplus.wallet.lib.oauth2.OAuth2Client
 import at.asitplus.wallet.lib.oauth2.SimpleAuthorizationService
@@ -37,7 +38,7 @@ class OidvciPreAuthTest : FreeSpec({
         )
         issuer = CredentialIssuer(
             authorizationService = authorizationService,
-            issuer = IssuerAgent(identifier = "https://issuer.example.com"),
+            issuer = IssuerAgent(identifier = "https://issuer.example.com".toUri()),
             credentialSchemes = setOf(AtomicAttribute2023, MobileDrivingLicenceScheme),
         )
         client = WalletService()

vck-openid/src/commonTest/kotlin/at/asitplus/wallet/lib/openid/CredentialJsonInteropTest.kt

@@ -8,6 +8,7 @@ import at.asitplus.wallet.lib.data.ConstantIndex.CredentialRepresentation.ISO_MD
 import at.asitplus.wallet.lib.data.ConstantIndex.CredentialRepresentation.PLAIN_JWT
 import at.asitplus.wallet.lib.data.ConstantIndex.CredentialRepresentation.SD_JWT
 import at.asitplus.wallet.lib.data.CredentialToJsonConverter
+import at.asitplus.wallet.lib.data.rfc3986.toUri
 import at.asitplus.wallet.lib.openid.DummyCredentialDataProvider
 import com.benasher44.uuid.uuid4
 import io.kotest.assertions.throwables.shouldThrow
@@ -30,7 +31,7 @@ class CredentialJsonInteropTest : FreeSpec({
         holderAgent = HolderAgent(holderKeyMaterial, subjectCredentialStore)
         issuerAgent = IssuerAgent(
             keyMaterial = EphemeralKeyWithSelfSignedCert(),
-            identifier = "https://issuer.example.com/"
+            identifier = "https://issuer.example.com/".toUri()
         )
     }