AttestoPhoenix.Verifier (AttestoPhoenix v2.13.0)

Host-facing OID4VP verifier API.

Presentation requests are persisted before their signed request object is published. Wallet responses are verified by the public direct-post controller, and hosts read the completed result once through presentation_result/2 (single-use: the read consumes the session).

Request objects continue to use the main AttestoPhoenix.Config.keystore/1; their protected alg is derived from that key by Attesto.JWS.sign_current. The separate verifier-encryption keystore is only an ECDH-ES recipient key and never changes request-object signing policy.

Summary

Types

create_attrs()

create_result()

Functions

create_presentation_request(config, attrs)

Create a verifier presentation session and its signed request object.

presentation_result(config, id)

Read and consume the verified result of a completed presentation session.

Types

create_attrs()

@type create_attrs() :: %{
  :dcql_query => map(),
  :expected_query_ids => [String.t()],
  :issuer_trust => Attesto.PresentationSession.issuer_trust(),
  optional(:response_mode) => String.t(),
  optional(:client_id_scheme) => String.t()
}

create_result()

@type create_result() :: %{
  id: String.t(),
  nonce: String.t(),
  client_id: String.t(),
  request_uri: String.t()
}

Functions

create_presentation_request(config, attrs)

@spec create_presentation_request(AttestoPhoenix.Config.t(), create_attrs()) ::
  {:ok, create_result()} | {:error, term()}

Create a verifier presentation session and its signed request object.

The returned id is the OID4VP state; the absolute request_uri serves the request object from the convention-derived verifier endpoint.

presentation_result(config, id)

@spec presentation_result(AttestoPhoenix.Config.t(), String.t()) ::
  {:ok, map()} | :error

Read and consume the verified result of a completed presentation session.

Single-use: the completed session is removed on read, so the response_code the browser carries to the completion page cannot be replayed to re-read the presented claims. Returns :error on a second read, or an unknown, pending, or expired session.