feat(openid4vp): add transaction_data support across wallet, verifier2, and shared libraries#1656
Open
szijpeter wants to merge 64 commits intowalt-id:mainfrom
Open
feat(openid4vp): add transaction_data support across wallet, verifier2, and shared libraries#1656szijpeter wants to merge 64 commits intowalt-id:mainfrom
szijpeter wants to merge 64 commits intowalt-id:mainfrom
Conversation
fix(wallet-api): remove core-wallet classpath collision
… deep-link bootstrap
Both demo and dev wallet presentation-init pages currently do encodeURI(decodeURI(fixRequest(...))) before base64url-wrapping the request.
This is unsafe for already URL-encoded OpenID4VP query payloads (dcql_query/request object parameters): decode+re-encode can alter percent-encoded content and change request semantics, which can surface as failed credential matching for otherwise valid requests.
In this flow the input already comes from window.location.search (encoded query string), and we immediately pass the normalized request through encodeRequest() (base64url). Additional URI normalization is redundant and introduces risk.
Change made (consistently in both apps):
- replace encodeURI(decodeURI(fixRequest('openid://' + window.location.search)))
- with fixRequest('openid://' + window.location.search)
Files:
- waltid-demo-wallet src/pages/api/siop/initiatePresentation.vue
- waltid-dev-wallet src/pages/api/siop/initiatePresentation.vue
Scope intentionally minimal: no wallet-api/protocol behavior changes, only safer request forwarding from web wallet entrypoint.
This reverts commit da4adcb.
…o dc+sd-jwt query The verifier2 transaction demo credential query for dc+sd-jwt previously filtered only by vct_values=[<issuer>/identity_credential]. In OSS local flows, issuer-api commonly issues draft13 IdentityCredential VCTs (<issuer>/draft13/IdentityCredential). With the strict single-value filter, wallets can hold a valid sd-jwt credential yet still show 'no matching credentials' during transaction verification. Update buildCredentialQuery() to advertise both recognized VCT identifiers: - <issuer>/identity_credential - <issuer>/draft13/IdentityCredential This keeps matching strict enough to avoid unrelated credentials while restoring interoperability across the current issuer configurations used by the portal transaction flow. Scope intentionally minimal: no changes to wallet-api matching semantics or verifier2 policy logic; only the portal request filter metadata is adjusted.
* feat(portal): merge transaction demo into main verification flow * refactor(portal): align verifier2 success view with legacy layout * feat(portal): surface transaction-data policy results on success page * fix(portal): tighten transaction-data UX and preserve success-session credential snapshots * replace icons * stop polling after cancel * remove router * fix(portal): remove credential cache and tighten tx verification flow * fix(portal): guard tx input params and harden verifier2 polling
Contributor
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 50 minutes and 36 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (68)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds
transaction_datasupport for OpenID4VP flows by extending sharedopenid4vp-*libraries and wiring behavior through wallet + verifier2 + verifier portal flow.Why
This implements the remaining part of transaction-data support tracked in issue #1583, following the policy-based, format-specific direction discussed there.
What this PR changes
dc+sd-jwtandmso_mdocFormat scope
Implemented for the formats with concrete standards-backed transaction binding in this repo:
dc+sd-jwtmso_mdocKnown limitations
transaction_datavalidation currently requires credential queries to use a supported transaction-data profile in this implementation (dc+sd-jwt,mso_mdoc);jwt_vc_jsonis rejected by design in this path.SD-JWT + IETF SD-JWT VC(mapped todc+sd-jwt); mdoc transaction flow is not yet selectable from that pagemso_mdoc/ device-auth signature verification may fail in specific end-to-end paths.request_uri_method=postis not universally supported across all verifier integrations.Recordings
transaction_data_demo.mov
Scope boundary
transaction_dataimplementation and wiring.References
Note
Builds upon #1655