world-id-primitives 0.16.0

//! Module containing all the functionality to handle requests from Relying Parties (RPs) to Authenticators.
//!
//! Enables an RP to create a Proof request or a Session Proof request, and provides base functionality
//! for Authenticators to handle such requests.
mod constraints;
pub use constraints::{ConstraintExpr, ConstraintKind, ConstraintNode, MAX_CONSTRAINT_NODES};

use crate::{
    FieldElement, Nullifier, OprfPrefix, OprfPrefixedFieldElement as _, PrimitiveError, SessionId,
    SessionNullifier, SessionRef, ZeroKnowledgeProof, rp::RpId,
};
use serde::{Deserialize, Serialize, de::Error as _};
use std::collections::HashSet;
use taceo_oprf::types::OprfKeyId;
// The uuid crate is needed for wasm compatibility
use uuid as _;

/// Protocol schema version for proof requests and responses.
#[repr(u8)]
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum RequestVersion {
    /// Version 1
    V1 = 1,
}

impl serde::Serialize for RequestVersion {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: serde::Serializer,
    {
        let v = *self as u8;
        serializer.serialize_u8(v)
    }
}

impl<'de> serde::Deserialize<'de> for RequestVersion {
    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
    where
        D: serde::Deserializer<'de>,
    {
        let v = u8::deserialize(deserializer)?;
        match v {
            1 => Ok(Self::V1),
            _ => Err(serde::de::Error::custom("unsupported version")),
        }
    }
}

/// The high-level proof flow requested by an RP.
///
/// Reserved for a possible future one-byte protocol encoding. Currently, JSON uses
/// snake_case variant names and these discriminants are not serialized.
///
/// The discriminants mirror the OPRF domains used by each proof flow.
/// [`OprfPrefix::SessionOprfSeed`] (`0x01`) has no variant here because the session
/// `oprf_seed` is not a proof flow of its own.
#[repr(u8)]
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum ProofType {
    /// A uniqueness proof scoped by the RP-provided action.
    ///
    /// May carry `session_id: "create"` to mint a fresh session bound to the proof,
    /// or omit session involvement entirely — see [`ProofRequest::binds_session`].
    /// Binding to an already existing session is not supported.
    #[default]
    Uniqueness = OprfPrefix::Uniqueness as u8,
    /// Prove an RP-scoped session — either minting a fresh one
    /// (`session_id: "create"`) or an existing one (`session_id: "session_<hex>"`).
    Session = OprfPrefix::SessionAction as u8,
}

impl ProofType {
    /// Returns true for the default uniqueness proof flow.
    #[must_use]
    pub const fn is_uniqueness(&self) -> bool {
        matches!(self, Self::Uniqueness)
    }

    /// Returns true for proof flows that produce a session proof response item.
    #[must_use]
    pub const fn is_session(&self) -> bool {
        matches!(self, Self::Session)
    }
}

/// A proof request from a Relying Party (RP) for an Authenticator.
///
/// Unknown JSON fields are ignored during deserialization so that older
/// Authenticators keep accepting requests from RPs speaking a newer minor
/// revision of the protocol. The RP signature only covers the enumerated
/// fields (see [`ProofRequest::digest_hash`]), so tolerated fields are
/// never part of any signed or hashed message.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct ProofRequest {
    /// Unique identifier for this request.
    pub id: String,
    /// Version of the request.
    pub version: RequestVersion,
    /// Requested high-level proof flow.
    ///
    /// If omitted, the request is strictly treated as a [`ProofType::Uniqueness`] request.
    /// Session creation and session proving must opt in explicitly.
    #[serde(default)]
    pub proof_type: ProofType,
    /// Unix timestamp (seconds) when the request was created.
    pub created_at: u64,
    /// Unix timestamp (seconds) when the request expires.
    pub expires_at: u64,
    /// Registered RP identifier from the `RpRegistry`.
    pub rp_id: RpId,
    /// `OprfKeyId` of the RP.
    pub oprf_key_id: OprfKeyId,
    /// Session identifier that links proofs for the same user/RP pair across requests.
    ///
    /// Three states: absent/`null` (no session), `"create"` (mint a fresh session),
    /// or an existing `"session_"`-prefixed id. [`ProofType::Uniqueness`] accepts
    /// absent or `"create"` (see [`Self::binds_session`]); [`ProofType::Session`]
    /// requires `"create"` or an existing id.
    /// The proof will only be valid if the session ID is meant for this context and
    /// this particular World ID holder.
    #[serde(default)]
    pub session_id: SessionRef,
    /// An RP-defined context that scopes what the user is proving uniqueness on.
    ///
    /// This parameter expects a field element. When dealing with strings or bytes,
    /// hash with a byte-friendly hash function like keccak256 or SHA256 and reduce to the field.
    pub action: Option<FieldElement>,
    /// The RP's ECDSA signature over the request.
    #[serde(with = "crate::serde_utils::hex_signature")]
    pub signature: alloy::signers::Signature,
    /// Unique nonce for this request provided by the RP.
    pub nonce: FieldElement,
    /// Specific credential requests. This defines which credentials to ask for.
    #[serde(rename = "proof_requests")]
    pub requests: Vec<RequestItem>,
    /// Constraint expression (all/any/enumerate) optional.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub constraints: Option<ConstraintExpr<'static>>,
}

/// Per-credential request payload.
///
/// Unknown JSON fields are ignored during deserialization; see
/// [`ProofRequest`] for the forward-compatibility rationale.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct RequestItem {
    /// An RP-defined identifier for this request item used to match against constraints and responses.
    ///
    /// Example: `orb`, `document`.
    pub identifier: String,

    /// Unique identifier for the credential schema and issuer pair.
    ///
    /// Registered in the `CredentialSchemaIssuerRegistry`.
    pub issuer_schema_id: u64,

    /// Arbitrary data provided by the RP that gets cryptographically bound into the proof.
    ///
    /// When present, the Authenticator hashes this via `signal_hash` and commits it into the
    /// proof circuit so the RP can tie the proof to a particular context.
    ///
    /// The reason why the signal is expected as raw bytes and hashed by the Authenticator instead
    /// of directly as a field element is so that in the future it can be displayed to the user in
    /// a human-readable way.
    ///
    /// Raw bytes provides maximum flexibility because for on-chain use cases any arbitrary set of
    /// inputs can be ABI-encoded to be verified on-chain.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[serde(with = "crate::serde_utils::hex_bytes_opt")]
    pub signal: Option<Vec<u8>>,

    /// Minimum `genesis_issued_at` timestamp that the used Credential must meet.
    ///
    /// If present, the proof will include a constraint that the credential's genesis issued at timestamp
    /// is greater than or equal to this value. Can be set to 0 to skip.
    /// This is useful for migration from previous protocol versions.
    pub genesis_issued_at_min: Option<u64>,

    /// The minimum expiration required for the Credential used in the proof.
    ///
    /// If the constraint is not required, it should use the current time as the minimum expiration.
    /// The Authenticator will normally expose the effective input used in the proof.
    ///
    /// This is particularly useful to specify a minimum duration for a Credential proportional to the action
    /// being performed. For example, when claiming a benefit that is once every 6 months, the minimum duration
    /// can be set to 180 days to prevent double claiming in that period in case the Credential is set to expire earlier.
    ///
    /// It is an RP's responsibility to understand the issuer's policies regarding expiration to ensure the request
    /// can be fulfilled.
    ///
    /// If not provided, this will default to the [`ProofRequest::created_at`] attribute.
    pub expires_at_min: Option<u64>,
}

impl RequestItem {
    /// Create a new request item with the given identifier, issuer schema ID and optional signal.
    #[must_use]
    pub const fn new(
        identifier: String,
        issuer_schema_id: u64,
        signal: Option<Vec<u8>>,
        genesis_issued_at_min: Option<u64>,
        expires_at_min: Option<u64>,
    ) -> Self {
        Self {
            identifier,
            issuer_schema_id,
            signal,
            genesis_issued_at_min,
            expires_at_min,
        }
    }

    /// Get the signal hash for the request item.
    #[must_use]
    pub fn signal_hash(&self) -> FieldElement {
        if let Some(signal) = &self.signal {
            FieldElement::from_arbitrary_raw_bytes(signal)
        } else {
            FieldElement::ZERO
        }
    }

    /// Get the effective minimum expiration timestamp for this request item.
    ///
    /// If `expires_at_min` is `Some`, returns that value.
    /// Otherwise, returns the `request_created_at` value (which should be the `ProofRequest::created_at` timestamp).
    #[must_use]
    pub const fn effective_expires_at_min(&self, request_created_at: u64) -> u64 {
        match self.expires_at_min {
            Some(value) => value,
            None => request_created_at,
        }
    }
}

/// Overall response from the Authenticator to the RP
///
/// Unknown JSON fields are ignored during deserialization so that older
/// RPs keep accepting responses from Authenticators speaking a newer minor
/// revision of the protocol (e.g. one that discloses additional
/// credential data on response items).
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ProofResponse {
    /// The response id references request id
    pub id: String,
    /// Version corresponding to request version
    pub version: RequestVersion,
    /// RP session identifier that links multiple proofs for the same
    /// user/RP pair across requests.
    ///
    /// For an initial request which creates a session, this contains
    /// the newly generated `SessionId`. For subsequent Session Proofs, this
    /// echoes back the `SessionId` from the request for convenience.
    ///
    /// For Uniqueness Proofs this is present when the request asked to create a
    /// bound session ([`ProofRequest::binds_session`]) and carries the newly
    /// minted `SessionId`.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub session_id: Option<SessionId>,
    /// Error message if the entire proof request failed.
    /// When present, the responses array will be empty.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub error: Option<String>,
    /// Per-credential results (empty if error is present)
    pub responses: Vec<ResponseItem>,
}

/// Per-credential response item returned by the Authenticator.
///
/// Each entry corresponds to one requested credential with its proof material.
/// If any credential cannot be satisfied, the entire proof response will have
/// an error at the `ProofResponse` level with an empty `responses` array.
///
/// # Nullifier Types
///
/// - **Uniqueness proofs**: Use `nullifier` field (a single `FieldElement`).
///   The contract's `verify()` function takes this as a separate `uint256 nullifier` param.
///
/// - **Session proofs**: Use `session_nullifier` field (contains both nullifier and action).
///   The contract's `verifySession()` function expects `uint256[2] sessionNullifier`.
///
/// Exactly one of `nullifier` or `session_nullifier` should be present.
///
/// Unknown JSON fields are ignored during deserialization; see
/// [`ProofResponse`] for the forward-compatibility rationale.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ResponseItem {
    /// An RP-defined identifier for this request item used to match against constraints and responses.
    ///
    /// Example: `orb`, `document`.
    pub identifier: String,

    /// Unique identifier for the credential schema and issuer pair.
    pub issuer_schema_id: u64,

    /// Encoded World ID Proof. See [`ZeroKnowledgeProof`] for more details.
    pub proof: ZeroKnowledgeProof,

    /// A [`Nullifier`] for Uniqueness proofs.
    ///
    /// Present for Uniqueness proofs, absent for Session proofs.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub nullifier: Option<Nullifier>,

    /// A [`SessionNullifier`] for Session proofs.
    ///
    /// Present for Session proofs, absent for Uniqueness proofs.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub session_nullifier: Option<SessionNullifier>,

    /// The minimum expiration required for the Credential used in the proof.
    ///
    /// This precise value must be used when verifying the proof on-chain.
    pub expires_at_min: u64,
}

impl ProofResponse {
    /// Determine if constraints are satisfied given a constraint expression.
    /// Returns false if the response has an error.
    #[must_use]
    pub fn constraints_satisfied(&self, constraints: &ConstraintExpr<'_>) -> bool {
        // If there's an error, constraints cannot be satisfied
        if self.error.is_some() {
            return false;
        }

        let provided: HashSet<&str> = self
            .responses
            .iter()
            .map(|item| item.identifier.as_str())
            .collect();

        constraints.evaluate(&|t| provided.contains(t))
    }
}

impl ResponseItem {
    /// Create a new response item for a Uniqueness proof.
    #[must_use]
    pub const fn new_uniqueness(
        identifier: String,
        issuer_schema_id: u64,
        proof: ZeroKnowledgeProof,
        nullifier: Nullifier,
        expires_at_min: u64,
    ) -> Self {
        Self {
            identifier,
            issuer_schema_id,
            proof,
            nullifier: Some(nullifier),
            session_nullifier: None,
            expires_at_min,
        }
    }

    /// Create a new response item for a Session proof.
    #[must_use]
    pub const fn new_session(
        identifier: String,
        issuer_schema_id: u64,
        proof: ZeroKnowledgeProof,
        session_nullifier: SessionNullifier,
        expires_at_min: u64,
    ) -> Self {
        Self {
            identifier,
            issuer_schema_id,
            proof,
            nullifier: None,
            session_nullifier: Some(session_nullifier),
            expires_at_min,
        }
    }

    /// Returns true if this is a Session proof response.
    #[must_use]
    pub const fn is_session(&self) -> bool {
        self.session_nullifier.is_some()
    }

    /// Returns true if this is a Uniqueness proof response.
    #[must_use]
    pub const fn is_uniqueness(&self) -> bool {
        self.nullifier.is_some()
    }
}

impl ProofRequest {
    /// Determine which requested credentials to prove given available credentials.
    ///
    /// Returns `None` if constraints (or lack thereof) cannot be satisfied with the available set.
    ///
    /// # Panics
    /// Panics if constraints are present but invalid according to the type invariants
    /// (this should not occur as constraints are provided by trusted request issuer).
    #[must_use]
    pub fn credentials_to_prove(&self, available: &HashSet<u64>) -> Option<Vec<&RequestItem>> {
        // Pre-compute which identifiers have an available issuer_schema_id
        let available_identifiers: HashSet<&str> = self
            .requests
            .iter()
            .filter(|r| available.contains(&r.issuer_schema_id))
            .map(|r| r.identifier.as_str())
            .collect();

        let is_selectable = |identifier: &str| available_identifiers.contains(identifier);

        // If no explicit constraints: require all requested be available
        if self.constraints.is_none() {
            return if self
                .requests
                .iter()
                .all(|r| available.contains(&r.issuer_schema_id))
            {
                Some(self.requests.iter().collect())
            } else {
                None
            };
        }

        // Compute selected identifiers using the constraint expression
        let selected_identifiers = select_expr(self.constraints.as_ref().unwrap(), &is_selectable)?;
        let selected_set: HashSet<&str> = selected_identifiers.into_iter().collect();

        // Return proof_requests in original order filtered by selected identifiers
        let result: Vec<&RequestItem> = self
            .requests
            .iter()
            .filter(|r| selected_set.contains(r.identifier.as_str()))
            .collect();
        Some(result)
    }

    /// Find a request item by issuer schema ID if available
    #[must_use]
    pub fn find_request_by_issuer_schema_id(&self, issuer_schema_id: u64) -> Option<&RequestItem> {
        self.requests
            .iter()
            .find(|r| r.issuer_schema_id == issuer_schema_id)
    }

    /// Returns true if the request is expired relative to now (unix timestamp in seconds)
    #[must_use]
    pub const fn is_expired(&self, now: u64) -> bool {
        now > self.expires_at
    }

    /// Compute the digest hash of this request that should be signed by the RP, which right now
    /// includes the `nonce` and the timestamp of the request.
    ///
    /// # Returns
    /// A 32-byte hash that represents this request and should be signed by the RP.
    ///
    /// # Errors
    /// Returns a `PrimitiveError` if `FieldElement` serialization fails (which should never occur in practice).
    ///
    /// The digest is computed as: `SHA256(version || nonce || created_at || expires_at || action)`.
    /// This mirrors the RP signature message format from `rp::compute_rp_signature_msg`.
    /// Note: the timestamp is encoded as big-endian to mirror the RP-side signing
    /// performed in test fixtures and the OPRF stub.
    pub fn digest_hash(&self) -> Result<[u8; 32], PrimitiveError> {
        use crate::rp::compute_rp_signature_msg;
        use sha2::{Digest, Sha256};

        let msg = compute_rp_signature_msg(
            *self.nonce,
            self.created_at,
            self.expires_at,
            self.action.map(|v| *v),
        );
        let mut hasher = Sha256::new();
        hasher.update(&msg);
        Ok(hasher.finalize().into())
    }

    /// Validates that the request fields match the explicit proof type.
    ///
    /// If `proof_type` was omitted during deserialization, it defaults to
    /// [`ProofType::Uniqueness`]. Session flows must opt in explicitly.
    ///
    /// A uniqueness `action` must also carry [`OprfPrefix::Uniqueness`], so that an
    /// action from another domain is rejected here rather than by the OPRF nodes after
    /// a round trip.
    ///
    /// # Errors
    /// Returns [`PrimitiveError::InvalidInput`] when the request has an invalid
    /// combination of `proof_type`, `session_id`, and `action`.
    pub fn validate_proof_type(&self) -> Result<(), PrimitiveError> {
        match (self.proof_type, self.session_id, self.action) {
            (ProofType::Uniqueness, _, None) => Err(PrimitiveError::InvalidInput {
                attribute: "action".to_string(),
                reason: "must be present for uniqueness proofs".to_string(),
            }),
            (ProofType::Uniqueness, SessionRef::Existing(_), _) => {
                Err(PrimitiveError::InvalidInput {
                    attribute: "session_id".to_string(),
                    reason: "must be omitted or \"create\" for uniqueness proofs".to_string(),
                })
            }
            (ProofType::Session, SessionRef::None, _) => Err(PrimitiveError::InvalidInput {
                attribute: "session_id".to_string(),
                reason: "must be \"create\" or an existing session id for session proofs"
                    .to_string(),
            }),
            (ProofType::Session, SessionRef::Create | SessionRef::Existing(_), Some(_)) => {
                Err(PrimitiveError::InvalidInput {
                    attribute: "action".to_string(),
                    reason: "must be omitted for session proofs".to_string(),
                })
            }
            _ => Ok(()),
        }?;

        // Only uniqueness flows can reach this point with an action; session flows
        // carrying one were rejected above.
        if let Some(action) = self.action
            && !action.has_prefix(OprfPrefix::Uniqueness)
        {
            return Err(PrimitiveError::InvalidInput {
                attribute: "action".to_string(),
                reason: format!("MSB must be 0x{:02x}", OprfPrefix::Uniqueness as u8),
            });
        }

        Ok(())
    }

    /// Returns true if this request produces a Session proof.
    #[must_use]
    pub const fn is_session_proof(&self) -> bool {
        self.proof_type.is_session()
    }

    /// Returns true if this request asks for a Uniqueness Proof committed to a freshly
    /// minted session.
    ///
    /// A committed proof carries [`SessionId::commitment`] as its `id_commitment` public
    /// signal, proving in-circuit that session and nullifier belong to the same World ID.
    /// RPs MUST verify the proof against that commitment — with a zero commitment the
    /// proof is valid but unbound.
    #[must_use]
    pub const fn binds_session(&self) -> bool {
        self.proof_type.is_uniqueness() && self.session_id.is_create()
    }

    /// Validates the structural integrity of the constraint expression.
    ///
    /// Checks that the constraint tree (when present) does not exceed the maximum
    /// nesting depth of 2 or the maximum node count. This is the same check
    /// performed inside [`validate_response`]; exposing it separately allows
    /// callers to pre-flight a request before attempting proof generation.
    ///
    /// # Errors
    /// Returns [`ValidationError::ConstraintTooDeep`] or [`ValidationError::ConstraintTooLarge`]
    /// if the expression exceeds protocol limits.
    ///
    /// [`validate_response`]: Self::validate_response
    pub fn validate_constraints(&self) -> Result<(), ValidationError> {
        if let Some(expr) = &self.constraints {
            if !expr.validate_max_depth(2) {
                return Err(ValidationError::ConstraintTooDeep);
            }
            if !expr.validate_max_nodes(MAX_CONSTRAINT_NODES) {
                return Err(ValidationError::ConstraintTooLarge);
            }
        }
        Ok(())
    }

    /// Validate that a response satisfies this request: id match and constraints semantics.
    ///
    /// # Errors
    /// Returns a `ValidationError` if the response does not correspond to this request or
    /// does not satisfy the declared constraints.
    pub fn validate_response(&self, response: &ProofResponse) -> Result<(), ValidationError> {
        self.validate_proof_type()
            .map_err(|err| ValidationError::InvalidProofRequest(err.to_string()))?;

        // Validate id and version match
        if self.id != response.id {
            return Err(ValidationError::RequestIdMismatch);
        }
        if self.version != response.version {
            return Err(ValidationError::VersionMismatch);
        }

        // If response has an error, it failed to satisfy constraints
        if let Some(error) = &response.error {
            return Err(ValidationError::ProofGenerationFailed(error.clone()));
        }

        match (self.proof_type, self.session_id) {
            (ProofType::Uniqueness, SessionRef::None) => {
                if response.session_id.is_some() {
                    return Err(ValidationError::UnexpectedSessionId);
                }
            }
            (ProofType::Uniqueness, SessionRef::Create) => {
                if response.session_id.is_none() {
                    return Err(ValidationError::MissingSessionId);
                }
            }
            (ProofType::Uniqueness, SessionRef::Existing(_)) => {
                return Err(ValidationError::InvalidProofRequest(
                    "uniqueness proof with an existing session_id".to_string(),
                ));
            }
            (ProofType::Session, SessionRef::Create) => {
                // No request-side id to compare — the freshly minted id must be present.
                if response.session_id.is_none() {
                    return Err(ValidationError::MissingSessionId);
                }
            }
            (ProofType::Session, SessionRef::Existing(session_id)) => {
                if response.session_id != Some(session_id) {
                    return Err(ValidationError::SessionIdMismatch);
                }
            }
            // Rejected by validate_proof_type() above; kept explicit to stay exhaustive.
            (ProofType::Session, SessionRef::None) => {
                return Err(ValidationError::InvalidProofRequest(
                    "session proof without session_id".to_string(),
                ));
            }
        }

        // Validate response items correspond to request items and are unique.
        let mut provided: HashSet<&str> = HashSet::new();
        for response_item in &response.responses {
            if !provided.insert(response_item.identifier.as_str()) {
                return Err(ValidationError::DuplicateCredential(
                    response_item.identifier.clone(),
                ));
            }

            let request_item = self
                .requests
                .iter()
                .find(|r| r.identifier == response_item.identifier)
                .ok_or_else(|| {
                    ValidationError::UnexpectedCredential(response_item.identifier.clone())
                })?;

            if self.is_session_proof() {
                // Session proof: must have session_nullifier
                if response_item.session_nullifier.is_none() {
                    return Err(ValidationError::MissingSessionNullifier(
                        response_item.identifier.clone(),
                    ));
                }
            } else {
                // Uniqueness proof: must have nullifier
                if response_item.nullifier.is_none() {
                    return Err(ValidationError::MissingNullifier(
                        response_item.identifier.clone(),
                    ));
                }
            }

            let expected_expires_at_min = request_item.effective_expires_at_min(self.created_at);
            if response_item.expires_at_min != expected_expires_at_min {
                return Err(ValidationError::ExpiresAtMinMismatch(
                    response_item.identifier.clone(),
                    expected_expires_at_min,
                    response_item.expires_at_min,
                ));
            }
        }

        match &self.constraints {
            // None => all requested credentials (via identifier) are required
            None => {
                for req in &self.requests {
                    if !provided.contains(req.identifier.as_str()) {
                        return Err(ValidationError::MissingCredential(req.identifier.clone()));
                    }
                }
                Ok(())
            }
            Some(expr) => {
                self.validate_constraints()?;
                if expr.evaluate(&|t| provided.contains(t)) {
                    Ok(())
                } else {
                    Err(ValidationError::ConstraintNotSatisfied)
                }
            }
        }
    }

    /// Parse from JSON
    ///
    /// # Errors
    /// Returns an error if the JSON is invalid or contains duplicate issuer schema ids.
    pub fn from_json(json: &str) -> Result<Self, serde_json::Error> {
        let v: Self = serde_json::from_str(json)?;
        v.validate_proof_type().map_err(serde_json::Error::custom)?;
        // Enforce unique issuer schema ids within a single request
        let mut seen: HashSet<String> = HashSet::new();
        for r in &v.requests {
            let t = r.issuer_schema_id.to_string();
            if !seen.insert(t.clone()) {
                return Err(serde_json::Error::custom(format!(
                    "duplicate issuer schema id: {t}"
                )));
            }
        }
        Ok(v)
    }

    /// Serialize to JSON
    ///
    /// # Errors
    /// Returns an error if serialization unexpectedly fails.
    pub fn to_json(&self) -> Result<String, serde_json::Error> {
        serde_json::to_string(self)
    }

    /// Serialize to pretty JSON
    ///
    /// # Errors
    /// Returns an error if serialization unexpectedly fails.
    pub fn to_json_pretty(&self) -> Result<String, serde_json::Error> {
        serde_json::to_string_pretty(self)
    }
}

impl ProofResponse {
    /// Parse from JSON
    ///
    /// # Errors
    /// Returns an error if the JSON does not match the expected response shape.
    pub fn from_json(json: &str) -> Result<Self, serde_json::Error> {
        serde_json::from_str(json)
    }

    /// Serialize to pretty JSON
    ///
    /// # Errors
    /// Returns an error if serialization fails.
    pub fn to_json_pretty(&self) -> Result<String, serde_json::Error> {
        serde_json::to_string_pretty(self)
    }

    /// Return the list of successful `issuer_schema_id`s in the response.
    /// Returns an empty vec if the response has an error.
    #[must_use]
    pub fn successful_credentials(&self) -> Vec<u64> {
        if self.error.is_some() {
            return vec![];
        }
        self.responses.iter().map(|r| r.issuer_schema_id).collect()
    }
}

/// Validation errors when checking a response against a request
#[derive(Debug, thiserror::Error, PartialEq, Eq)]
pub enum ValidationError {
    /// The request's proof type does not match its fields.
    #[error("Invalid proof request: {0}")]
    InvalidProofRequest(String),
    /// The response `id` does not match the request `id`
    #[error("Request ID mismatch")]
    RequestIdMismatch,
    /// The response `version` does not match the request `version`
    #[error("Version mismatch")]
    VersionMismatch,
    /// The proof generation failed (response contains an error)
    #[error("Proof generation failed: {0}")]
    ProofGenerationFailed(String),
    /// A required credential was not provided
    #[error("Missing required credential: {0}")]
    MissingCredential(String),
    /// A credential was returned that was not requested.
    #[error("Unexpected credential in response: {0}")]
    UnexpectedCredential(String),
    /// A credential identifier was returned more than once.
    #[error("Duplicate credential in response: {0}")]
    DuplicateCredential(String),
    /// The provided credentials do not satisfy the request constraints
    #[error("Constraints not satisfied")]
    ConstraintNotSatisfied,
    /// The constraints expression exceeds the supported nesting depth
    #[error("Constraints nesting exceeds maximum allowed depth")]
    ConstraintTooDeep,
    /// The constraints expression exceeds the maximum allowed size/complexity
    #[error("Constraints exceed maximum allowed size")]
    ConstraintTooLarge,
    /// The `expires_at_min` value in the response does not match the expected value from the request
    #[error("Invalid expires_at_min for credential '{0}': expected {1}, got {2}")]
    ExpiresAtMinMismatch(String, u64, u64),
    /// Session ID doesn't match between request and response
    #[error("Session ID doesn't match between request and response")]
    SessionIdMismatch,
    /// Session ID missing from a session-create response.
    #[error("Session ID missing from session response")]
    MissingSessionId,
    /// Session ID present in a uniqueness response.
    #[error("Session ID present in uniqueness response")]
    UnexpectedSessionId,
    /// Session nullifier missing for credential in session proof
    #[error("Session nullifier missing for credential: {0}")]
    MissingSessionNullifier(String),
    /// Nullifier missing for credential in uniqueness proof
    #[error("Nullifier missing for credential: {0}")]
    MissingNullifier(String),
}

// Helper selection functions for constraint evaluation
fn select_node<'a, F>(node: &'a ConstraintNode<'a>, pred: &F) -> Option<Vec<&'a str>>
where
    F: Fn(&str) -> bool,
{
    match node {
        ConstraintNode::Type(t) => pred(t.as_ref()).then(|| vec![t.as_ref()]),
        ConstraintNode::Expr(e) => select_expr(e, pred),
    }
}

fn select_expr<'a, F>(expr: &'a ConstraintExpr<'a>, pred: &F) -> Option<Vec<&'a str>>
where
    F: Fn(&str) -> bool,
{
    match expr {
        ConstraintExpr::All { all } => {
            let mut seen: std::collections::HashSet<&'a str> = std::collections::HashSet::new();
            let mut out: Vec<&'a str> = Vec::new();
            for n in all {
                let sub = select_node(n, pred)?;
                for s in sub {
                    if seen.insert(s) {
                        out.push(s);
                    }
                }
            }
            Some(out)
        }
        ConstraintExpr::Any { any } => any.iter().find_map(|n| select_node(n, pred)),
        ConstraintExpr::Enumerate { enumerate } => {
            // HashSet deduplicates identifiers, while Vec preserves first-seen output order.
            let mut seen: std::collections::HashSet<&'a str> = std::collections::HashSet::new();
            let mut selected: Vec<&'a str> = Vec::new();

            // Enumerate semantics: collect every satisfiable child; skip unsatisfied children.
            for child in enumerate {
                let Some(child_selection) = select_node(child, pred) else {
                    continue;
                };

                for identifier in child_selection {
                    if seen.insert(identifier) {
                        selected.push(identifier);
                    }
                }
            }

            if selected.is_empty() {
                None
            } else {
                Some(selected)
            }
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::SessionNullifier;
    use alloy::{
        signers::{SignerSync, local::PrivateKeySigner},
        uint,
    };
    use k256::ecdsa::SigningKey;

    // Test helpers
    fn test_signature() -> alloy::signers::Signature {
        let signer =
            PrivateKeySigner::from_signing_key(SigningKey::from_bytes(&[1u8; 32].into()).unwrap());
        signer.sign_message_sync(b"test").expect("can sign")
    }

    fn test_nonce() -> FieldElement {
        FieldElement::from(1u64)
    }

    fn test_field_element(n: u64) -> FieldElement {
        FieldElement::from(n)
    }

    /// Creates a field element carrying the given domain prefix in its MSB
    fn test_action_with_prefix(prefix: OprfPrefix, n: u64) -> FieldElement {
        use ruint::aliases::U256;
        let v = U256::from(n) | (U256::from(prefix as u8) << 248);
        FieldElement::try_from(v).expect("test value fits in field")
    }

    /// Creates an action with the required `0x02` session prefix
    fn test_action(n: u64) -> FieldElement {
        test_action_with_prefix(OprfPrefix::SessionAction, n)
    }

    /// Creates a session id with a non-zero commitment and a `0x01`-prefixed oprf seed
    fn test_session_id(n: u64) -> SessionId {
        use ruint::{aliases::U256, uint};
        let seed = U256::from(n)
            | uint!(0x0100000000000000000000000000000000000000000000000000000000000000_U256);
        SessionId::new(
            test_field_element(n),
            FieldElement::try_from(seed).expect("test value fits in field"),
        )
        .expect("valid session id")
    }

    #[test]
    fn constraints_all_any_nested() {
        // Build a response that has test_req_1 and test_req_2 provided
        let response = ProofResponse {
            id: "req_123".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![
                ResponseItem::new_uniqueness(
                    "test_req_1".into(),
                    1,
                    ZeroKnowledgeProof::default(),
                    test_field_element(1001).into(),
                    1_735_689_600,
                ),
                ResponseItem::new_uniqueness(
                    "test_req_2".into(),
                    2,
                    ZeroKnowledgeProof::default(),
                    test_field_element(1002).into(),
                    1_735_689_600,
                ),
            ],
        };

        // all: [test_req_1, any: [test_req_2, test_req_4]]
        let expr = ConstraintExpr::All {
            all: vec![
                ConstraintNode::Type("test_req_1".into()),
                ConstraintNode::Expr(ConstraintExpr::Any {
                    any: vec![
                        ConstraintNode::Type("test_req_2".into()),
                        ConstraintNode::Type("test_req_4".into()),
                    ],
                }),
            ],
        };

        assert!(response.constraints_satisfied(&expr));

        // all: [test_req_1, test_req_3] should fail because test_req_3 is not in response
        let fail_expr = ConstraintExpr::All {
            all: vec![
                ConstraintNode::Type("test_req_1".into()),
                ConstraintNode::Type("test_req_3".into()),
            ],
        };
        assert!(!response.constraints_satisfied(&fail_expr));
    }

    #[test]
    fn constraints_enumerate_partial_and_empty() {
        // Build a response that has orb and passport provided
        let response = ProofResponse {
            id: "req_123".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![
                ResponseItem::new_uniqueness(
                    "orb".into(),
                    1,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1001)),
                    1_735_689_600,
                ),
                ResponseItem::new_uniqueness(
                    "passport".into(),
                    2,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1002)),
                    1_735_689_600,
                ),
            ],
        };

        // enumerate: [passport, national_id] should pass due to passport
        let expr = ConstraintExpr::Enumerate {
            enumerate: vec![
                ConstraintNode::Type("passport".into()),
                ConstraintNode::Type("national_id".into()),
            ],
        };
        assert!(response.constraints_satisfied(&expr));

        // enumerate: [national_id, document] should fail due to no matches
        let fail_expr = ConstraintExpr::Enumerate {
            enumerate: vec![
                ConstraintNode::Type("national_id".into()),
                ConstraintNode::Type("document".into()),
            ],
        };
        assert!(!response.constraints_satisfied(&fail_expr));
    }

    #[test]
    fn test_digest_hash() {
        let request = ProofRequest {
            id: "test_request".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(FieldElement::ZERO),
            created_at: 1_700_000_000,
            expires_at: 1_700_100_000,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: Some("test_signal".into()),
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: None,
        };

        let digest1 = request.digest_hash().unwrap();
        // Verify it returns a 32-byte hash
        assert_eq!(digest1.len(), 32);

        // Verify deterministic: same request produces same hash
        let digest2 = request.digest_hash().unwrap();
        assert_eq!(digest1, digest2);

        // Verify different request nonces produce different hashes
        let request2 = ProofRequest {
            nonce: test_field_element(3),
            ..request
        };
        let digest3 = request2.digest_hash().unwrap();
        assert_ne!(digest1, digest3);
    }

    #[test]
    fn proof_request_signature_serializes_as_hex_string() {
        let request = ProofRequest {
            id: "test".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(FieldElement::ZERO),
            created_at: 1_700_000_000,
            expires_at: 1_700_100_000,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: None,
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: None,
        };

        let json = request.to_json().unwrap();
        let value: serde_json::Value = serde_json::from_str(&json).unwrap();
        assert_eq!(value["proof_type"], "uniqueness");
        assert_eq!(
            value["action"],
            serde_json::to_value(FieldElement::ZERO).unwrap()
        );
        assert!(value.get("kind").is_none());
        let sig = value["signature"]
            .as_str()
            .expect("signature should be a string");
        assert!(sig.starts_with("0x"));
        assert_eq!(sig.len(), 132);

        let roundtripped = ProofRequest::from_json(&json).unwrap();
        assert_eq!(roundtripped.signature, request.signature);
    }

    #[test]
    fn request_validate_response_none_constraints_means_all() {
        let request = ProofRequest {
            id: "req_1".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(FieldElement::ZERO),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_600, // 2025-01-01
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![
                RequestItem {
                    identifier: "orb".into(),
                    issuer_schema_id: 1,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "document".into(),
                    issuer_schema_id: 2,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
            ],
            constraints: None,
        };

        let ok = ProofResponse {
            id: "req_1".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![
                ResponseItem::new_uniqueness(
                    "orb".into(),
                    1,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1001)),
                    1_735_689_600,
                ),
                ResponseItem::new_uniqueness(
                    "document".into(),
                    2,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1002)),
                    1_735_689_600,
                ),
            ],
        };
        assert!(request.validate_response(&ok).is_ok());

        let missing = ProofResponse {
            id: "req_1".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![ResponseItem::new_uniqueness(
                "orb".into(),
                1,
                ZeroKnowledgeProof::default(),
                Nullifier::from(test_field_element(1001)),
                1_735_689_600,
            )],
        };
        let err = request.validate_response(&missing).unwrap_err();
        assert!(matches!(err, ValidationError::MissingCredential(_)));

        let unexpected = ProofResponse {
            id: "req_1".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![
                ResponseItem::new_uniqueness(
                    "orb".into(),
                    1,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1001)),
                    1_735_689_600,
                ),
                ResponseItem::new_uniqueness(
                    "document".into(),
                    2,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1002)),
                    1_735_689_600,
                ),
                ResponseItem::new_uniqueness(
                    "passport".into(),
                    3,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1003)),
                    1_735_689_600,
                ),
            ],
        };
        let err = request.validate_response(&unexpected).unwrap_err();
        assert!(matches!(
            err,
            ValidationError::UnexpectedCredential(ref id) if id == "passport"
        ));

        let duplicate = ProofResponse {
            id: "req_1".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![
                ResponseItem::new_uniqueness(
                    "orb".into(),
                    1,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1001)),
                    1_735_689_600,
                ),
                ResponseItem::new_uniqueness(
                    "orb".into(),
                    1,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1001)),
                    1_735_689_600,
                ),
            ],
        };
        let err = request.validate_response(&duplicate).unwrap_err();
        assert!(matches!(
            err,
            ValidationError::DuplicateCredential(ref id) if id == "orb"
        ));
    }

    #[test]
    fn constraint_depth_enforced() {
        // Root all -> nested any -> nested all (depth 3) should be rejected
        let deep = ConstraintExpr::All {
            all: vec![ConstraintNode::Expr(ConstraintExpr::Any {
                any: vec![ConstraintNode::Expr(ConstraintExpr::All {
                    all: vec![ConstraintNode::Type("orb".into())],
                })],
            })],
        };

        let request = ProofRequest {
            id: "req_2".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(1)),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_600,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: None,
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: Some(deep),
        };

        let response = ProofResponse {
            id: "req_2".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![ResponseItem::new_uniqueness(
                "orb".into(),
                1,
                ZeroKnowledgeProof::default(),
                Nullifier::from(test_field_element(1001)),
                1_735_689_600,
            )],
        };

        let err = request.validate_response(&response).unwrap_err();
        assert!(matches!(err, ValidationError::ConstraintTooDeep));
    }

    #[test]
    #[allow(clippy::too_many_lines)]
    fn constraint_node_limit_boundary_passes() {
        // Root All with: 1 Type + Any(4) + Any(4)
        // Node count = root(1) + type(1) + any(1+4) + any(1+4) = 12

        let expr = ConstraintExpr::All {
            all: vec![
                ConstraintNode::Type("test_req_10".into()),
                ConstraintNode::Expr(ConstraintExpr::Any {
                    any: vec![
                        ConstraintNode::Type("test_req_11".into()),
                        ConstraintNode::Type("test_req_12".into()),
                        ConstraintNode::Type("test_req_13".into()),
                        ConstraintNode::Type("test_req_14".into()),
                    ],
                }),
                ConstraintNode::Expr(ConstraintExpr::Any {
                    any: vec![
                        ConstraintNode::Type("test_req_15".into()),
                        ConstraintNode::Type("test_req_16".into()),
                        ConstraintNode::Type("test_req_17".into()),
                        ConstraintNode::Type("test_req_18".into()),
                    ],
                }),
            ],
        };

        let request = ProofRequest {
            id: "req_nodes_ok".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(5)),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_600,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![
                RequestItem {
                    identifier: "test_req_10".into(),
                    issuer_schema_id: 10,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_11".into(),
                    issuer_schema_id: 11,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_12".into(),
                    issuer_schema_id: 12,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_13".into(),
                    issuer_schema_id: 13,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_14".into(),
                    issuer_schema_id: 14,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_15".into(),
                    issuer_schema_id: 15,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_16".into(),
                    issuer_schema_id: 16,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_17".into(),
                    issuer_schema_id: 17,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_18".into(),
                    issuer_schema_id: 18,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
            ],
            constraints: Some(expr),
        };

        // Provide just enough to satisfy both any-groups and the single type
        let response = ProofResponse {
            id: "req_nodes_ok".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![
                ResponseItem::new_uniqueness(
                    "test_req_10".into(),
                    10,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1010)),
                    1_735_689_600,
                ),
                ResponseItem::new_uniqueness(
                    "test_req_11".into(),
                    11,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1011)),
                    1_735_689_600,
                ),
                ResponseItem::new_uniqueness(
                    "test_req_15".into(),
                    15,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1015)),
                    1_735_689_600,
                ),
            ],
        };

        // Should not exceed size and should validate OK
        assert!(request.validate_response(&response).is_ok());
    }

    #[test]
    #[allow(clippy::too_many_lines)]
    fn constraint_node_limit_exceeded_fails() {
        // Root All with: 1 Type + Any(4) + Any(5)
        // Node count = root(1) + type(1) + any(1+4) + any(1+5) = 13 (> 12)
        let expr = ConstraintExpr::All {
            all: vec![
                ConstraintNode::Type("t0".into()),
                ConstraintNode::Expr(ConstraintExpr::Any {
                    any: vec![
                        ConstraintNode::Type("t1".into()),
                        ConstraintNode::Type("t2".into()),
                        ConstraintNode::Type("t3".into()),
                        ConstraintNode::Type("t4".into()),
                    ],
                }),
                ConstraintNode::Expr(ConstraintExpr::Any {
                    any: vec![
                        ConstraintNode::Type("t5".into()),
                        ConstraintNode::Type("t6".into()),
                        ConstraintNode::Type("t7".into()),
                        ConstraintNode::Type("t8".into()),
                        ConstraintNode::Type("t9".into()),
                    ],
                }),
            ],
        };

        let request = ProofRequest {
            id: "req_nodes_too_many".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(1)),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_600,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![
                RequestItem {
                    identifier: "test_req_20".into(),
                    issuer_schema_id: 20,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_21".into(),
                    issuer_schema_id: 21,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_22".into(),
                    issuer_schema_id: 22,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_23".into(),
                    issuer_schema_id: 23,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_24".into(),
                    issuer_schema_id: 24,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_25".into(),
                    issuer_schema_id: 25,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_26".into(),
                    issuer_schema_id: 26,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_27".into(),
                    issuer_schema_id: 27,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_28".into(),
                    issuer_schema_id: 28,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_29".into(),
                    issuer_schema_id: 29,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
            ],
            constraints: Some(expr),
        };

        // Response content is irrelevant; validation should fail before evaluation due to size
        let response = ProofResponse {
            id: "req_nodes_too_many".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![ResponseItem::new_uniqueness(
                "test_req_20".into(),
                20,
                ZeroKnowledgeProof::default(),
                Nullifier::from(test_field_element(1020)),
                1_735_689_600,
            )],
        };

        let err = request.validate_response(&response).unwrap_err();
        assert!(matches!(err, ValidationError::ConstraintTooLarge));
    }

    #[test]
    fn request_single_credential_parse_and_validate() {
        let req = ProofRequest {
            id: "req_18c0f7f03e7d".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Session,
            session_id: SessionRef::Existing(SessionId::default()),
            action: None,
            created_at: 1_725_381_192,
            expires_at: 1_725_381_492,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "test_req_1".into(),
                issuer_schema_id: 1,
                signal: Some("abcd-efgh-ijkl".into()),
                genesis_issued_at_min: Some(1_725_381_192),
                expires_at_min: None,
            }],
            constraints: None,
        };

        assert_eq!(req.id, "req_18c0f7f03e7d");
        assert_eq!(req.requests.len(), 1);

        // Build matching successful response (session proof requires session_id and session_nullifier)
        let resp = ProofResponse {
            id: req.id.clone(),
            version: RequestVersion::V1,
            session_id: Some(SessionId::default()),
            error: None,
            responses: vec![ResponseItem::new_session(
                "test_req_1".into(),
                1,
                ZeroKnowledgeProof::default(),
                SessionNullifier::new(test_field_element(1001), test_action(1)).unwrap(),
                1_725_381_192,
            )],
        };
        assert!(req.validate_response(&resp).is_ok());
    }

    #[test]
    fn request_multiple_credentials_all_constraint_and_missing() {
        let req = ProofRequest {
            id: "req_18c0f7f03e7d".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(1)),
            created_at: 1_725_381_192,
            expires_at: 1_725_381_492,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![
                RequestItem {
                    identifier: "test_req_1".into(),
                    issuer_schema_id: 1,
                    signal: Some("abcd-efgh-ijkl".into()),
                    genesis_issued_at_min: Some(1_725_381_192),
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_2".into(),
                    issuer_schema_id: 2,
                    signal: Some("abcd-efgh-ijkl".into()),
                    genesis_issued_at_min: Some(1_725_381_192),
                    expires_at_min: None,
                },
            ],
            constraints: Some(ConstraintExpr::All {
                all: vec![
                    ConstraintNode::Type("test_req_1".into()),
                    ConstraintNode::Type("test_req_2".into()),
                ],
            }),
        };

        // Build response that fails constraints (test_req_1 is missing)
        let resp = ProofResponse {
            id: req.id.clone(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![ResponseItem::new_uniqueness(
                "test_req_2".into(),
                2,
                ZeroKnowledgeProof::default(),
                Nullifier::from(test_field_element(1001)),
                1_725_381_192,
            )],
        };

        let err = req.validate_response(&resp).unwrap_err();
        assert!(matches!(err, ValidationError::ConstraintNotSatisfied));
    }

    #[test]
    fn request_more_complex_constraints_nested_success() {
        let req = ProofRequest {
            id: "req_18c0f7f03e7d".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(1)),
            created_at: 1_725_381_192,
            expires_at: 1_725_381_492,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![
                RequestItem {
                    identifier: "test_req_1".into(),
                    issuer_schema_id: 1,
                    signal: Some("abcd-efgh-ijkl".into()),
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_2".into(),
                    issuer_schema_id: 2,
                    signal: Some("mnop-qrst-uvwx".into()),
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_3".into(),
                    issuer_schema_id: 3,
                    signal: Some("abcd-efgh-ijkl".into()),
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
            ],
            constraints: Some(ConstraintExpr::All {
                all: vec![
                    ConstraintNode::Type("test_req_3".into()),
                    ConstraintNode::Expr(ConstraintExpr::Any {
                        any: vec![
                            ConstraintNode::Type("test_req_1".into()),
                            ConstraintNode::Type("test_req_2".into()),
                        ],
                    }),
                ],
            }),
        };

        // Satisfy nested any with 0x1 + 0x3
        let resp = ProofResponse {
            id: req.id.clone(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![
                ResponseItem::new_uniqueness(
                    "test_req_3".into(),
                    3,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1001)),
                    1_725_381_192,
                ),
                ResponseItem::new_uniqueness(
                    "test_req_1".into(),
                    1,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1002)),
                    1_725_381_192,
                ),
            ],
        };

        assert!(req.validate_response(&resp).is_ok());
    }

    #[test]
    fn request_validate_response_with_enumerate() {
        let req = ProofRequest {
            id: "req_enum".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(1)),
            created_at: 1_725_381_192,
            expires_at: 1_725_381_492,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![
                RequestItem {
                    identifier: "passport".into(),
                    issuer_schema_id: 2,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "national_id".into(),
                    issuer_schema_id: 3,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
            ],
            constraints: Some(ConstraintExpr::Enumerate {
                enumerate: vec![
                    ConstraintNode::Type("passport".into()),
                    ConstraintNode::Type("national_id".into()),
                ],
            }),
        };

        // Satisfies enumerate with passport
        let ok_resp = ProofResponse {
            id: req.id.clone(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![ResponseItem::new_uniqueness(
                "passport".into(),
                2,
                ZeroKnowledgeProof::default(),
                Nullifier::from(test_field_element(2002)),
                1_725_381_192,
            )],
        };
        assert!(req.validate_response(&ok_resp).is_ok());

        // Fails enumerate because none of the enumerate candidates are present
        let fail_resp = ProofResponse {
            id: req.id.clone(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![],
        };
        let err = req.validate_response(&fail_resp).unwrap_err();
        assert!(matches!(err, ValidationError::ConstraintNotSatisfied));
    }

    #[test]
    fn request_json_parse() {
        // Happy path with signal present
        let with_signal = r#"{
  "id": "req_abc123",
  "version": 1,
  "created_at": 1725381192,
  "expires_at": 1725381492,
  "rp_id": "rp_0000000000000001",
  "oprf_key_id": "0x1",
  "session_id": null,
  "action": "0x000000000000000000000000000000000000000000000000000000000000002a",
  "signature": "0xa1fd06f0d8ceb541f6096fe2e865063eac1ff085c9d2bac2eedcc9ed03804bfc18d956b38c5ac3a8f7e71fde43deff3bda254d369c699f3c7a3f8e6b8477a5f51c",
  "nonce": "0x0000000000000000000000000000000000000000000000000000000000000001",
  "proof_requests": [
    {
      "identifier": "orb",
      "issuer_schema_id": 1,
      "signal": "0xdeadbeef",
      "genesis_issued_at_min": 1725381192,
      "expires_at_min": 1725381492
    }
  ]
}"#;

        let req = ProofRequest::from_json(with_signal).expect("parse with signal");
        assert_eq!(req.id, "req_abc123");
        assert_eq!(req.requests.len(), 1);
        assert_eq!(req.requests[0].signal, Some(b"\xde\xad\xbe\xef".to_vec()));
        assert_eq!(req.requests[0].genesis_issued_at_min, Some(1_725_381_192));
        assert_eq!(req.requests[0].expires_at_min, Some(1_725_381_492));

        let without_signal = r#"{
  "id": "req_abc123",
  "version": 1,
  "created_at": 1725381192,
  "expires_at": 1725381492,
  "rp_id": "rp_0000000000000001",
  "oprf_key_id": "0x1",
  "session_id": null,
  "action": "0x000000000000000000000000000000000000000000000000000000000000002a",
  "signature": "0xa1fd06f0d8ceb541f6096fe2e865063eac1ff085c9d2bac2eedcc9ed03804bfc18d956b38c5ac3a8f7e71fde43deff3bda254d369c699f3c7a3f8e6b8477a5f51c",
  "nonce": "0x0000000000000000000000000000000000000000000000000000000000000001",
  "proof_requests": [
    {
      "identifier": "orb",
      "issuer_schema_id": 1
    }
  ]
}"#;

        let req = ProofRequest::from_json(without_signal).expect("parse without signal");
        assert!(req.requests[0].signal.is_none());
        assert_eq!(req.requests[0].signal_hash(), FieldElement::ZERO);
    }

    #[test]
    fn request_json_tolerates_unknown_fields() {
        // A request from an RP speaking a newer minor protocol revision must
        // still parse: unknown fields are ignored at every nesting level.
        let json = r#"{
  "id": "req_abc123",
  "version": 1,
  "created_at": 1725381192,
  "expires_at": 1725381492,
  "rp_id": "rp_0000000000000001",
  "oprf_key_id": "0x1",
  "session_id": null,
  "action": "0x000000000000000000000000000000000000000000000000000000000000002a",
  "signature": "0xa1fd06f0d8ceb541f6096fe2e865063eac1ff085c9d2bac2eedcc9ed03804bfc18d956b38c5ac3a8f7e71fde43deff3bda254d369c699f3c7a3f8e6b8477a5f51c",
  "nonce": "0x0000000000000000000000000000000000000000000000000000000000000001",
  "from_the_future": true,
  "proof_requests": [
    {
      "identifier": "orb",
      "issuer_schema_id": 1,
      "also_from_the_future": {"nested": [1, 2, 3]}
    }
  ]
}"#;

        let req = ProofRequest::from_json(json).expect("unknown fields must be tolerated");
        assert_eq!(req.id, "req_abc123");
        assert_eq!(req.requests.len(), 1);
        assert_eq!(req.requests[0].identifier, "orb");
    }

    #[test]
    fn response_json_tolerates_unknown_fields() {
        // A response from an Authenticator speaking a newer minor protocol
        // revision must still parse: unknown fields are ignored at every
        // nesting level.
        let json = r#"{
  "id": "req_18c0f7f03e7d",
  "version": 1,
  "from_the_future": "yes",
  "responses": [
    {
      "identifier": "orb",
      "issuer_schema_id": 100,
      "proof": "00000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000",
      "nullifier": "nil_00000000000000000000000000000000000000000000000000000000000003e9",
      "expires_at_min": 1725381192,
      "claims": ["0x01", "0x02"]
    }
  ]
}"#;

        let resp = ProofResponse::from_json(json).expect("unknown fields must be tolerated");
        assert_eq!(resp.successful_credentials(), vec![100]);
        assert!(resp.responses[0].is_uniqueness());
    }

    #[test]
    fn response_json_parse() {
        // Success OK - Uniqueness nullifier (simple FieldElement)
        let ok_json = r#"{
  "id": "req_18c0f7f03e7d",
  "version": 1,
  "responses": [
    {
      "identifier": "orb",
      "issuer_schema_id": 100,
      "proof": "00000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000",
      "nullifier": "nil_00000000000000000000000000000000000000000000000000000000000003e9",
      "expires_at_min": 1725381192
    }
  ]
}"#;

        let ok = ProofResponse::from_json(ok_json).unwrap();
        assert_eq!(ok.successful_credentials(), vec![100]);
        assert!(ok.responses[0].is_uniqueness());

        // Canonical session nullifier representation (prefixed hex bytes).
        let canonical_session_nullifier = serde_json::to_string(
            &SessionNullifier::new(test_field_element(1001), test_action(42)).unwrap(),
        )
        .unwrap();
        let sess_json_canonical = format!(
            r#"{{
  "id": "req_18c0f7f03e7d",
  "version": 1,
  "session_id": "session_00000000000000000000000000000000000000000000000000000000000003ea0100000000000000000000000000000000000000000000000000000000000001",
  "responses": [
    {{
      "identifier": "orb",
      "issuer_schema_id": 100,
      "proof": "00000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000",
      "session_nullifier": {canonical_session_nullifier},
      "expires_at_min": 1725381192
    }}
  ]
}}"#
        );
        let sess_canonical = ProofResponse::from_json(&sess_json_canonical).unwrap();
        assert_eq!(sess_canonical.successful_credentials(), vec![100]);
        assert!(sess_canonical.responses[0].is_session());
        assert_eq!(
            sess_canonical.session_id.unwrap().oprf_seed.to_u256(),
            uint!(0x0100000000000000000000000000000000000000000000000000000000000001_U256)
        );
    }
    /// Test duplicate detection by creating a serialized `ProofRequest` with duplicates
    /// and then trying to parse it with `from_json` which should detect the duplicates
    #[test]
    fn request_rejects_duplicate_issuer_schema_ids_on_parse() {
        let req = ProofRequest {
            id: "req_dup".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(5)),
            created_at: 1_725_381_192,
            expires_at: 1_725_381_492,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![
                RequestItem {
                    identifier: "test_req_1".into(),
                    issuer_schema_id: 1,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "test_req_2".into(),
                    issuer_schema_id: 1, // Duplicate!
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
            ],
            constraints: None,
        };

        // Serialize then deserialize to trigger the duplicate check in from_json
        let json = req.to_json().unwrap();
        let err = ProofRequest::from_json(&json).unwrap_err();
        let msg = err.to_string();
        assert!(
            msg.contains("duplicate issuer schema id"),
            "Expected error message to contain 'duplicate issuer schema id', got: {msg}"
        );
    }

    #[test]
    fn response_with_error_has_empty_responses_and_fails_validation() {
        let request = ProofRequest {
            id: "req_error".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(FieldElement::ZERO),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_600,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: None,
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: None,
        };

        // Response with error should have empty responses array
        let error_response = ProofResponse {
            id: "req_error".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: Some("credential_not_available".into()),
            responses: vec![], // Empty when error is present
        };

        // Validation should fail with ProofGenerationFailed
        let err = request.validate_response(&error_response).unwrap_err();
        assert!(matches!(err, ValidationError::ProofGenerationFailed(_)));
        if let ValidationError::ProofGenerationFailed(msg) = err {
            assert_eq!(msg, "credential_not_available");
        }

        // successful_credentials should return empty vec when error is present
        assert_eq!(error_response.successful_credentials(), Vec::<u64>::new());

        // constraints_satisfied should return false when error is present
        let expr = ConstraintExpr::All {
            all: vec![ConstraintNode::Type("orb".into())],
        };
        assert!(!error_response.constraints_satisfied(&expr));
    }

    #[test]
    fn response_error_json_parse() {
        // Error response JSON
        let error_json = r#"{
  "id": "req_error",
  "version": 1,
  "error": "credential_not_available",
  "responses": []
}"#;

        let error_resp = ProofResponse::from_json(error_json).unwrap();
        assert_eq!(error_resp.error, Some("credential_not_available".into()));
        assert_eq!(error_resp.responses.len(), 0);
        assert_eq!(error_resp.successful_credentials(), Vec::<u64>::new());
    }

    #[test]
    fn credentials_to_prove_none_constraints_requires_all_and_drops_if_missing() {
        let req = ProofRequest {
            id: "req".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(5)),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_600, // 2025-01-01 00:00:00 UTC
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![
                RequestItem {
                    identifier: "orb".into(),
                    issuer_schema_id: 100,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "passport".into(),
                    issuer_schema_id: 101,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
            ],
            constraints: None,
        };

        let available_ok: HashSet<u64> = [100, 101].into_iter().collect();
        let sel_ok = req.credentials_to_prove(&available_ok).unwrap();
        assert_eq!(sel_ok.len(), 2);
        assert_eq!(sel_ok[0].issuer_schema_id, 100);
        assert_eq!(sel_ok[1].issuer_schema_id, 101);

        let available_missing: HashSet<u64> = std::iter::once(100).collect();
        assert!(req.credentials_to_prove(&available_missing).is_none());
    }

    #[test]
    fn credentials_to_prove_with_constraints_all_and_any() {
        // proof_requests: orb, passport, national-id
        let orb_id = 100;
        let passport_id = 101;
        let national_id = 102;

        let req = ProofRequest {
            id: "req".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(1)),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_600, // 2025-01-01 00:00:00 UTC
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![
                RequestItem {
                    identifier: "orb".into(),
                    issuer_schema_id: orb_id,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "passport".into(),
                    issuer_schema_id: passport_id,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "national_id".into(),
                    issuer_schema_id: national_id,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
            ],
            constraints: Some(ConstraintExpr::All {
                all: vec![
                    ConstraintNode::Type("orb".into()),
                    ConstraintNode::Expr(ConstraintExpr::Any {
                        any: vec![
                            ConstraintNode::Type("passport".into()),
                            ConstraintNode::Type("national_id".into()),
                        ],
                    }),
                ],
            }),
        };

        // Available has orb + passport → should pick [orb, passport]
        let available1: HashSet<u64> = [orb_id, passport_id].into_iter().collect();
        let sel1 = req.credentials_to_prove(&available1).unwrap();
        assert_eq!(sel1.len(), 2);
        assert_eq!(sel1[0].issuer_schema_id, orb_id);
        assert_eq!(sel1[1].issuer_schema_id, passport_id);

        // Available has orb + national-id → should pick [orb, national-id]
        let available2: HashSet<u64> = [orb_id, national_id].into_iter().collect();
        let sel2 = req.credentials_to_prove(&available2).unwrap();
        assert_eq!(sel2.len(), 2);
        assert_eq!(sel2[0].issuer_schema_id, orb_id);
        assert_eq!(sel2[1].issuer_schema_id, national_id);

        // Missing orb → cannot satisfy "all" → None
        let available3: HashSet<u64> = std::iter::once(passport_id).collect();
        assert!(req.credentials_to_prove(&available3).is_none());
    }

    #[test]
    fn credentials_to_prove_with_constraints_enumerate() {
        let orb_id = 100;
        let passport_id = 101;
        let national_id = 102;

        let req = ProofRequest {
            id: "req".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(1)),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_600,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![
                RequestItem {
                    identifier: "orb".into(),
                    issuer_schema_id: orb_id,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "passport".into(),
                    issuer_schema_id: passport_id,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "national_id".into(),
                    issuer_schema_id: national_id,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
            ],
            constraints: Some(ConstraintExpr::Enumerate {
                enumerate: vec![
                    ConstraintNode::Type("passport".into()),
                    ConstraintNode::Type("national_id".into()),
                ],
            }),
        };

        // One of enumerate candidates available -> one selected
        let available1: HashSet<u64> = [orb_id, passport_id].into_iter().collect();
        let sel1 = req.credentials_to_prove(&available1).unwrap();
        assert_eq!(sel1.len(), 1);
        assert_eq!(sel1[0].issuer_schema_id, passport_id);

        // Both enumerate candidates available -> both selected in request order
        let available2: HashSet<u64> = [orb_id, passport_id, national_id].into_iter().collect();
        let sel2 = req.credentials_to_prove(&available2).unwrap();
        assert_eq!(sel2.len(), 2);
        assert_eq!(sel2[0].issuer_schema_id, passport_id);
        assert_eq!(sel2[1].issuer_schema_id, national_id);

        // None of enumerate candidates available -> cannot satisfy
        let available3: HashSet<u64> = std::iter::once(orb_id).collect();
        assert!(req.credentials_to_prove(&available3).is_none());
    }

    #[test]
    fn credentials_to_prove_with_constraints_all_and_enumerate() {
        let orb_id = 100;
        let passport_id = 101;
        let national_id = 102;

        let req = ProofRequest {
            id: "req".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(1)),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_600,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![
                RequestItem {
                    identifier: "orb".into(),
                    issuer_schema_id: orb_id,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "passport".into(),
                    issuer_schema_id: passport_id,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
                RequestItem {
                    identifier: "national_id".into(),
                    issuer_schema_id: national_id,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None,
                },
            ],
            constraints: Some(ConstraintExpr::All {
                all: vec![
                    ConstraintNode::Type("orb".into()),
                    ConstraintNode::Expr(ConstraintExpr::Enumerate {
                        enumerate: vec![
                            ConstraintNode::Type("passport".into()),
                            ConstraintNode::Type("national_id".into()),
                        ],
                    }),
                ],
            }),
        };

        // orb + passport -> select both
        let available1: HashSet<u64> = [orb_id, passport_id].into_iter().collect();
        let sel1 = req.credentials_to_prove(&available1).unwrap();
        assert_eq!(sel1.len(), 2);
        assert_eq!(sel1[0].issuer_schema_id, orb_id);
        assert_eq!(sel1[1].issuer_schema_id, passport_id);

        // orb + passport + national_id -> select all three
        let available2: HashSet<u64> = [orb_id, passport_id, national_id].into_iter().collect();
        let sel2 = req.credentials_to_prove(&available2).unwrap();
        assert_eq!(sel2.len(), 3);
        assert_eq!(sel2[0].issuer_schema_id, orb_id);
        assert_eq!(sel2[1].issuer_schema_id, passport_id);
        assert_eq!(sel2[2].issuer_schema_id, national_id);

        // orb alone -> enumerate branch unsatisfied
        let available3: HashSet<u64> = std::iter::once(orb_id).collect();
        assert!(req.credentials_to_prove(&available3).is_none());
    }

    #[test]
    fn request_item_effective_expires_at_min_defaults_to_created_at() {
        let request_created_at = 1_735_689_600; // 2025-01-01 00:00:00 UTC
        let custom_expires_at = 1_735_862_400; // 2025-01-03 00:00:00 UTC

        // When expires_at_min is None, should use request_created_at
        let item_with_none = RequestItem {
            identifier: "test".into(),
            issuer_schema_id: 100,
            signal: None,
            genesis_issued_at_min: None,
            expires_at_min: None,
        };
        assert_eq!(
            item_with_none.effective_expires_at_min(request_created_at),
            request_created_at,
            "When expires_at_min is None, should default to request created_at"
        );

        // When expires_at_min is Some, should use that value
        let item_with_custom = RequestItem {
            identifier: "test".into(),
            issuer_schema_id: 100,
            signal: None,
            genesis_issued_at_min: None,
            expires_at_min: Some(custom_expires_at),
        };
        assert_eq!(
            item_with_custom.effective_expires_at_min(request_created_at),
            custom_expires_at,
            "When expires_at_min is Some, should use that explicit value"
        );
    }

    #[test]
    fn validate_response_checks_expires_at_min_matches() {
        let request_created_at = 1_735_689_600; // 2025-01-01 00:00:00 UTC
        let custom_expires_at = 1_735_862_400; // 2025-01-03 00:00:00 UTC

        // Request with one item that has no explicit expires_at_min (defaults to created_at)
        // and one with an explicit expires_at_min
        let request = ProofRequest {
            id: "req_expires_test".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(1)),
            created_at: request_created_at,
            expires_at: request_created_at + 300,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![
                RequestItem {
                    identifier: "orb".into(),
                    issuer_schema_id: 100,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: None, // Should default to request_created_at
                },
                RequestItem {
                    identifier: "document".into(),
                    issuer_schema_id: 101,
                    signal: None,
                    genesis_issued_at_min: None,
                    expires_at_min: Some(custom_expires_at), // Explicit value
                },
            ],
            constraints: None,
        };

        // Valid response with matching expires_at_min values
        let valid_response = ProofResponse {
            id: "req_expires_test".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![
                ResponseItem::new_uniqueness(
                    "orb".into(),
                    100,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1001)),
                    request_created_at, // Matches default
                ),
                ResponseItem::new_uniqueness(
                    "document".into(),
                    101,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1002)),
                    custom_expires_at, // Matches explicit value
                ),
            ],
        };
        assert!(request.validate_response(&valid_response).is_ok());

        // Invalid response with mismatched expires_at_min for first item
        let invalid_response_1 = ProofResponse {
            id: "req_expires_test".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![
                ResponseItem::new_uniqueness(
                    "orb".into(),
                    100,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1001)),
                    custom_expires_at, // Wrong! Should be request_created_at
                ),
                ResponseItem::new_uniqueness(
                    "document".into(),
                    101,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1002)),
                    custom_expires_at,
                ),
            ],
        };
        let err1 = request.validate_response(&invalid_response_1).unwrap_err();
        assert!(matches!(
            err1,
            ValidationError::ExpiresAtMinMismatch(_, _, _)
        ));
        if let ValidationError::ExpiresAtMinMismatch(identifier, expected, got) = err1 {
            assert_eq!(identifier, "orb");
            assert_eq!(expected, request_created_at);
            assert_eq!(got, custom_expires_at);
        }

        // Invalid response with mismatched expires_at_min for second item
        let invalid_response_2 = ProofResponse {
            id: "req_expires_test".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![
                ResponseItem::new_uniqueness(
                    "orb".into(),
                    100,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1001)),
                    request_created_at,
                ),
                ResponseItem::new_uniqueness(
                    "document".into(),
                    101,
                    ZeroKnowledgeProof::default(),
                    Nullifier::from(test_field_element(1002)),
                    request_created_at, // Wrong! Should be custom_expires_at
                ),
            ],
        };
        let err2 = request.validate_response(&invalid_response_2).unwrap_err();
        assert!(matches!(
            err2,
            ValidationError::ExpiresAtMinMismatch(_, _, _)
        ));
        if let ValidationError::ExpiresAtMinMismatch(identifier, expected, got) = err2 {
            assert_eq!(identifier, "document");
            assert_eq!(expected, custom_expires_at);
            assert_eq!(got, request_created_at);
        }
    }

    #[test]
    fn test_validate_proof_type_is_strict() {
        let uniqueness_with_create = ProofRequest {
            id: "req_bound_uniqueness".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::Create,
            action: Some(FieldElement::ZERO),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_900,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: None,
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: None,
        };

        // uniqueness + "create" mints and binds a session
        assert!(uniqueness_with_create.validate_proof_type().is_ok());
        assert!(uniqueness_with_create.binds_session());
        assert!(!uniqueness_with_create.is_session_proof());

        let uniqueness_without_action = ProofRequest {
            action: None,
            ..uniqueness_with_create.clone()
        };
        assert!(matches!(
            uniqueness_without_action.validate_proof_type(),
            Err(PrimitiveError::InvalidInput { attribute, .. }) if attribute == "action"
        ));

        let plain_uniqueness = ProofRequest {
            session_id: SessionRef::None,
            ..uniqueness_with_create.clone()
        };
        assert!(plain_uniqueness.validate_proof_type().is_ok());
        assert!(!plain_uniqueness.binds_session());

        // a uniqueness action must live in the uniqueness domain, not a session one
        for prefix in [OprfPrefix::SessionOprfSeed, OprfPrefix::SessionAction] {
            let session_prefixed_action = ProofRequest {
                action: Some(test_action_with_prefix(prefix, 42)),
                ..uniqueness_with_create.clone()
            };
            assert!(matches!(
                session_prefixed_action.validate_proof_type(),
                Err(PrimitiveError::InvalidInput { attribute, .. }) if attribute == "action"
            ));
        }

        // uniqueness cannot bind an already existing session
        let uniqueness_with_existing = ProofRequest {
            session_id: SessionRef::Existing(test_session_id(1)),
            ..uniqueness_with_create.clone()
        };
        assert!(matches!(
            uniqueness_with_existing.validate_proof_type(),
            Err(PrimitiveError::InvalidInput { attribute, .. }) if attribute == "session_id"
        ));
        assert!(!uniqueness_with_existing.binds_session());

        let session_without_session = ProofRequest {
            proof_type: ProofType::Session,
            session_id: SessionRef::None,
            action: None,
            ..uniqueness_with_create.clone()
        };
        assert!(matches!(
            session_without_session.validate_proof_type(),
            Err(PrimitiveError::InvalidInput { attribute, .. }) if attribute == "session_id"
        ));

        // session proofs accept both "create" and an existing session id
        let session_create = ProofRequest {
            proof_type: ProofType::Session,
            session_id: SessionRef::Create,
            action: None,
            ..uniqueness_with_create.clone()
        };
        assert!(session_create.validate_proof_type().is_ok());
        assert!(session_create.is_session_proof());
        assert!(!session_create.binds_session());

        let session_existing = ProofRequest {
            proof_type: ProofType::Session,
            session_id: SessionRef::Existing(test_session_id(1)),
            action: None,
            ..uniqueness_with_create.clone()
        };
        assert!(session_existing.validate_proof_type().is_ok());

        // action is forbidden for both session sub-states
        for session_id in [SessionRef::Create, SessionRef::Existing(test_session_id(1))] {
            let session_with_action = ProofRequest {
                proof_type: ProofType::Session,
                session_id,
                action: Some(FieldElement::ZERO),
                ..uniqueness_with_create.clone()
            };
            assert!(matches!(
                session_with_action.validate_proof_type(),
                Err(PrimitiveError::InvalidInput { attribute, .. }) if attribute == "action"
            ));
        }
    }

    #[test]
    fn test_bound_uniqueness_request_parses_with_default_proof_type() {
        let request = ProofRequest {
            id: "req_bound".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::Create,
            action: Some(FieldElement::ZERO),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_900,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: None,
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: None,
        };

        // `proof_type` is #[serde(default)]: session_id without proof_type binds
        let mut value: serde_json::Value =
            serde_json::from_str(&request.to_json().unwrap()).unwrap();
        value.as_object_mut().unwrap().remove("proof_type");
        let parsed = ProofRequest::from_json(&value.to_string()).unwrap();
        assert_eq!(parsed.proof_type, ProofType::Uniqueness);
        assert!(parsed.binds_session());
    }

    #[test]
    fn test_request_absent_session_id_defaults_to_none() {
        let request = ProofRequest {
            id: "req_plain".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(FieldElement::ZERO),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_900,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: None,
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: None,
        };

        // None serializes as null (unchanged wire shape) ...
        let json = request.to_json().unwrap();
        let mut value: serde_json::Value = serde_json::from_str(&json).unwrap();
        assert!(value["session_id"].is_null());

        // ... and an absent key also parses to None via #[serde(default)]
        value.as_object_mut().unwrap().remove("session_id");
        let parsed = ProofRequest::from_json(&value.to_string()).unwrap();
        assert_eq!(parsed.session_id, SessionRef::None);
        assert!(!parsed.binds_session());
    }

    #[test]
    fn test_validate_response_uniqueness_rejects_existing_session() {
        let session_id = test_session_id(7);
        let request = ProofRequest {
            id: "req_bound".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::Existing(session_id),
            action: Some(FieldElement::ZERO),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_900,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: None,
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: None,
        };

        let response = ProofResponse {
            id: request.id.clone(),
            version: RequestVersion::V1,
            session_id: Some(session_id),
            error: None,
            responses: vec![ResponseItem::new_uniqueness(
                "orb".into(),
                1,
                ZeroKnowledgeProof::default(),
                Nullifier::from(test_field_element(1001)),
                1_735_689_600,
            )],
        };
        // uniqueness proofs can only mint a session, never bind an existing one
        assert!(matches!(
            request.validate_response(&response),
            Err(ValidationError::InvalidProofRequest(_))
        ));

        // plain uniqueness requests still reject any session id in the response
        let plain_request = ProofRequest {
            session_id: SessionRef::None,
            ..request
        };
        assert!(matches!(
            plain_request.validate_response(&response),
            Err(ValidationError::UnexpectedSessionId)
        ));
    }

    #[test]
    fn proof_type_wire_encoding_is_stable() {
        assert_eq!(
            serde_json::to_string(&ProofType::Uniqueness).unwrap(),
            "\"uniqueness\""
        );
        assert_eq!(
            serde_json::to_string(&ProofType::Session).unwrap(),
            "\"session\""
        );
        assert_eq!(
            serde_json::from_str::<ProofType>("\"uniqueness\"").unwrap(),
            ProofType::Uniqueness
        );
        assert_eq!(
            serde_json::from_str::<ProofType>("\"session\"").unwrap(),
            ProofType::Session
        );
    }

    #[test]
    fn proof_type_byte_encoding_is_stable() {
        // Matches the action prefixes; 0x01 is skipped because it prefixes the session
        // `oprf_seed` rather than a proof flow.
        assert_eq!(ProofType::Uniqueness as u8, 0x00);
        assert_eq!(ProofType::Session as u8, 0x02);
    }

    #[test]
    fn test_validate_response_session_create_requires_minted_session_id() {
        let request = ProofRequest {
            id: "req_create_session".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Session,
            session_id: SessionRef::Create,
            action: None,
            created_at: 1_735_689_600,
            expires_at: 1_735_689_900,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: None,
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: None,
        };

        let missing_session = ProofResponse {
            id: request.id.clone(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![ResponseItem::new_session(
                "orb".into(),
                1,
                ZeroKnowledgeProof::default(),
                SessionNullifier::new(test_field_element(1001), test_action(42)).unwrap(),
                1_735_689_600,
            )],
        };
        assert!(matches!(
            request.validate_response(&missing_session),
            Err(ValidationError::MissingSessionId)
        ));

        let valid_response = ProofResponse {
            session_id: Some(SessionId::default()),
            ..missing_session
        };
        assert!(request.validate_response(&valid_response).is_ok());
    }

    #[test]
    fn test_validate_response_uniqueness_create_requires_minted_session_id() {
        let request = ProofRequest {
            id: "req_uniqueness_create".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::Create,
            action: Some(FieldElement::ZERO),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_900,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: None,
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: None,
        };

        let missing_session = ProofResponse {
            id: request.id.clone(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![ResponseItem::new_uniqueness(
                "orb".into(),
                1,
                ZeroKnowledgeProof::default(),
                Nullifier::new(test_field_element(1001)),
                1_735_689_600,
            )],
        };
        assert!(matches!(
            request.validate_response(&missing_session),
            Err(ValidationError::MissingSessionId)
        ));

        let valid_response = ProofResponse {
            session_id: Some(SessionId::default()),
            ..missing_session
        };
        assert!(request.validate_response(&valid_response).is_ok());
    }

    #[test]
    fn test_validate_response_requires_session_id_in_response() {
        // Request with session_id should require response to also have session_id
        let request = ProofRequest {
            id: "req_session".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Session,
            session_id: SessionRef::Existing(SessionId::default()),
            action: None,
            created_at: 1_735_689_600,
            expires_at: 1_735_689_900,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: None,
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: None,
        };

        // Response without session_id should fail validation
        let response_missing_session_id = ProofResponse {
            id: "req_session".into(),
            version: RequestVersion::V1,
            session_id: None, // Missing!
            error: None,
            responses: vec![ResponseItem::new_session(
                "orb".into(),
                1,
                ZeroKnowledgeProof::default(),
                SessionNullifier::new(test_field_element(1001), test_action(42)).unwrap(),
                1_735_689_600,
            )],
        };

        let err = request
            .validate_response(&response_missing_session_id)
            .unwrap_err();
        assert!(matches!(err, ValidationError::SessionIdMismatch));
    }

    #[test]
    fn test_validate_response_requires_session_nullifier_for_session_proof() {
        // Request with session_id requires session_nullifier in each response item
        let request = ProofRequest {
            id: "req_session".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Session,
            session_id: SessionRef::Existing(SessionId::default()),
            action: None,
            created_at: 1_735_689_600,
            expires_at: 1_735_689_900,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: None,
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: None,
        };

        // Response with uniqueness nullifier instead of session nullifier should fail
        let response_wrong_nullifier_type = ProofResponse {
            id: "req_session".into(),
            version: RequestVersion::V1,
            session_id: Some(SessionId::default()),
            error: None,
            responses: vec![ResponseItem::new_uniqueness(
                "orb".into(),
                1,
                ZeroKnowledgeProof::default(),
                Nullifier::from(test_field_element(1001)), // Using uniqueness nullifier instead of session!
                1_735_689_600,
            )],
        };

        let err = request
            .validate_response(&response_wrong_nullifier_type)
            .unwrap_err();
        assert!(matches!(
            err,
            ValidationError::MissingSessionNullifier(ref id) if id == "orb"
        ));
    }

    #[test]
    fn test_validate_response_requires_nullifier_for_uniqueness_proof() {
        // Request without session_id requires nullifier in each response item
        let request = ProofRequest {
            id: "req_uniqueness".into(),
            version: RequestVersion::V1,
            proof_type: ProofType::Uniqueness,
            session_id: SessionRef::None,
            action: Some(test_field_element(42)),
            created_at: 1_735_689_600,
            expires_at: 1_735_689_900,
            rp_id: RpId::new(1),
            oprf_key_id: OprfKeyId::new(uint!(1_U160)),
            signature: test_signature(),
            nonce: test_nonce(),
            requests: vec![RequestItem {
                identifier: "orb".into(),
                issuer_schema_id: 1,
                signal: None,
                genesis_issued_at_min: None,
                expires_at_min: None,
            }],
            constraints: None,
        };

        // Response with session nullifier instead of uniqueness nullifier should fail
        let response_wrong_nullifier_type = ProofResponse {
            id: "req_uniqueness".into(),
            version: RequestVersion::V1,
            session_id: None,
            error: None,
            responses: vec![ResponseItem::new_session(
                "orb".into(),
                1,
                ZeroKnowledgeProof::default(),
                SessionNullifier::new(test_field_element(1001), test_action(42)).unwrap(), // Using session nullifier instead of uniqueness!
                1_735_689_600,
            )],
        };

        let err = request
            .validate_response(&response_wrong_nullifier_type)
            .unwrap_err();
        assert!(matches!(
            err,
            ValidationError::MissingNullifier(ref id) if id == "orb"
        ));
    }
}