|
| 1 | +@file:OptIn(kotlinx.serialization.ExperimentalSerializationApi::class) |
| 2 | + |
| 3 | +package id.walt.wallet2.server.models |
| 4 | + |
| 5 | +import id.walt.verifier.openid.models.authorization.AuthorizationRequest |
| 6 | +import id.walt.verifier.openid.models.authorization.ClientMetadata |
| 7 | +import id.walt.wallet2.handlers.StatelessPreviewPresentationResult |
| 8 | +import id.waltid.openid4vp.wallet.response.ResponseEncryption |
| 9 | +import kotlinx.serialization.Serializable |
| 10 | +import kotlinx.serialization.json.JsonElement |
| 11 | +import kotlinx.serialization.json.JsonObject |
| 12 | + |
| 13 | +/** |
| 14 | + * UI-facing result of resolving and validating an OpenID4VP request for consent review. |
| 15 | + * |
| 16 | + * Stateless: no preview handle is retained server-side. The caller holds [authorizationRequest] |
| 17 | + * and completes the flow with `credentials/present/build-vp-token` + `send-response`, or rejects |
| 18 | + * via `credentials/present/reject` with the original `requestUrl`. |
| 19 | + * |
| 20 | + * When [valid] is false, the detected [error] can be returned to the verifier via reject. |
| 21 | + */ |
| 22 | +@Serializable |
| 23 | +data class PresentationPreviewResponse( |
| 24 | + val authorizationRequest: AuthorizationRequest, |
| 25 | + val valid: Boolean, |
| 26 | + val clientId: String? = null, |
| 27 | + val verifier: PreviewVerifierMetadata? = null, |
| 28 | + val responseUri: String? = null, |
| 29 | + val state: String? = null, |
| 30 | + val nonce: String? = null, |
| 31 | + val responseEncryption: PreviewResponseEncryption? = null, |
| 32 | + val transactionData: List<PreviewTransactionDataItem> = emptyList(), |
| 33 | + val credentialOptions: List<PreviewCredentialOption> = emptyList(), |
| 34 | + val credentialRequirements: List<PreviewCredentialRequirement> = emptyList(), |
| 35 | + val error: PreviewError? = null, |
| 36 | +) |
| 37 | + |
| 38 | +/** Localized verifier display metadata; supplied by the verifier and not on its own evidence of trust. */ |
| 39 | +@Serializable |
| 40 | +data class PreviewVerifierMetadata( |
| 41 | + val name: String? = null, |
| 42 | + val locale: String? = null, |
| 43 | + val logoUri: String? = null, |
| 44 | + val clientUri: String? = null, |
| 45 | + val policyUri: String? = null, |
| 46 | + val termsOfServiceUri: String? = null, |
| 47 | +) |
| 48 | + |
| 49 | +/** Response-encryption state selected for an OpenID4VP presentation request. */ |
| 50 | +@Serializable |
| 51 | +data class PreviewResponseEncryption( |
| 52 | + val required: Boolean, |
| 53 | + val keyManagementAlgorithm: String? = null, |
| 54 | + val contentEncryptionAlgorithm: String? = null, |
| 55 | + val verifierKeyId: String? = null, |
| 56 | + val verifierKeyThumbprint: String? = null, |
| 57 | +) |
| 58 | + |
| 59 | +/** A decoded transaction_data item attached to a presentation request. */ |
| 60 | +@Serializable |
| 61 | +data class PreviewTransactionDataItem( |
| 62 | + val type: String, |
| 63 | + val credentialQueryIds: List<String> = emptyList(), |
| 64 | + val rawJson: JsonObject, |
| 65 | + val details: JsonObject, |
| 66 | +) |
| 67 | + |
| 68 | +/** A wallet credential that satisfies one DCQL credential query in the presentation request. */ |
| 69 | +@Serializable |
| 70 | +data class PreviewCredentialOption( |
| 71 | + val queryId: String, |
| 72 | + val credentialId: String, |
| 73 | + val multiple: Boolean = false, |
| 74 | + val format: String, |
| 75 | + val issuer: String? = null, |
| 76 | + val subject: String? = null, |
| 77 | + val label: String? = null, |
| 78 | + val credentialData: JsonObject, |
| 79 | + val disclosures: List<PreviewCredentialDisclosure> = emptyList(), |
| 80 | +) |
| 81 | + |
| 82 | +/** A claim value that may be shared for a matched credential, with selective-disclosure flags. */ |
| 83 | +@Serializable |
| 84 | +data class PreviewCredentialDisclosure( |
| 85 | + val path: String, |
| 86 | + val name: String? = null, |
| 87 | + val value: JsonElement, |
| 88 | + val selectivelyDisclosable: Boolean, |
| 89 | + val required: Boolean, |
| 90 | + val selectable: Boolean, |
| 91 | +) |
| 92 | + |
| 93 | +/** A required DCQL credential-query combination; at least one option must be satisfied. */ |
| 94 | +@Serializable |
| 95 | +data class PreviewCredentialRequirement( |
| 96 | + val options: List<List<String>>, |
| 97 | +) |
| 98 | + |
| 99 | +/** Standard OpenID4VP error detected by the wallet while validating a request. */ |
| 100 | +@Serializable |
| 101 | +data class PreviewError( |
| 102 | + val code: String, |
| 103 | + val message: String? = null, |
| 104 | +) |
| 105 | + |
| 106 | +/** |
| 107 | + * Projects a [StatelessPreviewPresentationResult] into the serializable [PresentationPreviewResponse]. |
| 108 | + * |
| 109 | + * @param preferredLocales BCP 47 language tags used to pick localized verifier display values. |
| 110 | + */ |
| 111 | +fun StatelessPreviewPresentationResult.toPreviewResponse( |
| 112 | + preferredLocales: List<String> = emptyList(), |
| 113 | +): PresentationPreviewResponse = when (this) { |
| 114 | + is StatelessPreviewPresentationResult.Invalid -> PresentationPreviewResponse( |
| 115 | + authorizationRequest = authorizationRequest, |
| 116 | + valid = false, |
| 117 | + clientId = authorizationRequest.clientId, |
| 118 | + verifier = authorizationRequest.clientMetadata?.toPreviewVerifierMetadata(preferredLocales), |
| 119 | + responseUri = authorizationRequest.responseUri, |
| 120 | + state = authorizationRequest.state, |
| 121 | + nonce = authorizationRequest.nonce, |
| 122 | + error = PreviewError(code = error.code.code, message = error.message), |
| 123 | + ) |
| 124 | + |
| 125 | + is StatelessPreviewPresentationResult.Ready -> PresentationPreviewResponse( |
| 126 | + authorizationRequest = authorizationRequest, |
| 127 | + valid = true, |
| 128 | + clientId = authorizationRequest.clientId, |
| 129 | + verifier = authorizationRequest.clientMetadata?.toPreviewVerifierMetadata(preferredLocales), |
| 130 | + responseUri = authorizationRequest.responseUri, |
| 131 | + state = authorizationRequest.state, |
| 132 | + nonce = authorizationRequest.nonce, |
| 133 | + responseEncryption = responseEncryption.toPreviewResponseEncryption(), |
| 134 | + transactionData = transactionData.map { item -> |
| 135 | + PreviewTransactionDataItem( |
| 136 | + type = item.type, |
| 137 | + credentialQueryIds = item.credentialQueryIds, |
| 138 | + rawJson = item.rawJson, |
| 139 | + details = item.details, |
| 140 | + ) |
| 141 | + }, |
| 142 | + credentialOptions = credentialOptions.map { option -> |
| 143 | + PreviewCredentialOption( |
| 144 | + queryId = option.queryId, |
| 145 | + credentialId = option.credentialId, |
| 146 | + multiple = option.multiple, |
| 147 | + format = option.format, |
| 148 | + issuer = option.issuer, |
| 149 | + subject = option.subject, |
| 150 | + label = option.label, |
| 151 | + credentialData = option.credentialData, |
| 152 | + disclosures = option.disclosures.map { disclosure -> |
| 153 | + PreviewCredentialDisclosure( |
| 154 | + path = disclosure.path, |
| 155 | + name = disclosure.name, |
| 156 | + value = disclosure.value, |
| 157 | + selectivelyDisclosable = disclosure.selectivelyDisclosable, |
| 158 | + required = disclosure.required, |
| 159 | + selectable = disclosure.selectable, |
| 160 | + ) |
| 161 | + }, |
| 162 | + ) |
| 163 | + }, |
| 164 | + credentialRequirements = credentialRequirements.map { |
| 165 | + PreviewCredentialRequirement(options = it.options) |
| 166 | + }, |
| 167 | + ) |
| 168 | +} |
| 169 | + |
| 170 | +private fun ClientMetadata.toPreviewVerifierMetadata( |
| 171 | + preferredLocales: List<String>, |
| 172 | +): PreviewVerifierMetadata { |
| 173 | + val name = selectLocalizedValue(clientName, clientNameI18n, preferredLocales) |
| 174 | + val logo = selectLocalizedValue(logoUri, logoUriI18n, preferredLocales) |
| 175 | + return PreviewVerifierMetadata( |
| 176 | + name = name.value, |
| 177 | + locale = if (name.value != null) name.locale else logo.locale, |
| 178 | + logoUri = logo.value, |
| 179 | + clientUri = selectLocalizedValue(clientUri, clientUriI18n, preferredLocales).value, |
| 180 | + policyUri = selectLocalizedValue(policyUri, policyUriI18n, preferredLocales).value, |
| 181 | + termsOfServiceUri = selectLocalizedValue(tosUri, tosUriI18n, preferredLocales).value, |
| 182 | + ) |
| 183 | +} |
| 184 | + |
| 185 | +private fun ResponseEncryption.Metadata?.toPreviewResponseEncryption(): PreviewResponseEncryption = |
| 186 | + this?.let { |
| 187 | + PreviewResponseEncryption( |
| 188 | + required = true, |
| 189 | + keyManagementAlgorithm = keyManagementAlgorithm, |
| 190 | + contentEncryptionAlgorithm = contentEncryptionAlgorithm, |
| 191 | + verifierKeyId = verifierKeyId, |
| 192 | + verifierKeyThumbprint = verifierKeyThumbprint, |
| 193 | + ) |
| 194 | + } ?: PreviewResponseEncryption(required = false) |
| 195 | + |
| 196 | +// --------------------------------------------------------------------------- |
| 197 | +// Localized value selection (base value + language-tagged map) |
| 198 | +// --------------------------------------------------------------------------- |
| 199 | + |
| 200 | +private data class LocalizedValue(val locale: String?, val value: String?) |
| 201 | + |
| 202 | +private fun selectLocalizedValue( |
| 203 | + base: String?, |
| 204 | + localized: Map<String, String>, |
| 205 | + preferredLocales: List<String>, |
| 206 | +): LocalizedValue = buildList { |
| 207 | + base?.takeIf { it.isNotBlank() }?.let { add(LocalizedValue(locale = null, value = it)) } |
| 208 | + localized.forEach { (locale, value) -> |
| 209 | + value.takeIf { it.isNotBlank() }?.let { add(LocalizedValue(locale = locale, value = it)) } |
| 210 | + } |
| 211 | +}.selectPreferredByLocale(preferredLocales) { it.locale } ?: LocalizedValue(locale = null, value = null) |
0 commit comments