Module credential 

W3C Verifiable Credentials for DPP access control.

This module implements VC issuance and verification following the W3C Verifiable Credentials Data Model v2.0 specification, adapted to the EU Digital Product Passport audience model.

Audiences

Reg. (EU) 2023/1542 Art. 77(2) names three audiences, and the credential establishes which one a caller belongs to:

• Public: no credential required.
• LegitimateInterest: a VC proving the holder’s role (repairer, remanufacturer, second-life operator, recycler).
• Authority: an institutional DID (notified body, market surveillance authority, customs, the Commission).

These do not form a ranking. An Authority sees conformity test reports that a LegitimateInterest holder does not, and a LegitimateInterest holder sees individual-item data that an Authority does not. See Audience::may_see.

Credential lifecycle

1. An authority issues a DppAccessCredential to an operator.
2. The credential is signed as a JWS using the issuer’s Ed25519 key.
3. When requesting professional/confidential data, the holder presents the VC.
4. The verifier checks the JWS, expiration, revocation status, and scope.

Structs

AllowAllIssuers

Trust registry that accepts any issuer DID — use in tests or single-operator bootstrap only. In production, supply a StaticTrustedIssuers loaded from operator configuration.

CredentialBuilder

Builder for constructing DPP access credentials.

CredentialStatus

Credential status descriptor for revocation checking.

DppAccessCredential

A W3C Verifiable Credential for DPP access.

DppCredentialSubject

The claims inside a DPP access credential.

StaticTrustedIssuers

Configuration-driven allow-list implementation of TrustedIssuerRegistry.

Enums

Audience

Re-export the canonical access vocabulary from dpp-domain. Who is asking for passport data.

CredentialRole

The access role granted by a Verifiable Credential.

RevocationOutcome

Outcome of resolving a credential’s revocation status against a status list.

VerificationResult

Result of verifying a DPP access credential.

Traits

TrustedIssuerRegistry

Registry of issuer DIDs authorised to issue credentials for each audience.

Functions

check_revocation

Resolve a credential’s revocation status against an already-fetched status list. Fetching the status-list credential over the network is an infrastructure concern handled by the platform (crypto Gap 5) — this is the pure decision given the list.

verify_credential_claims

Verify structural validity and expiration of a credential (no signature check).

verify_credential_claims_with_trust

Verify structural validity, scope, and issuer trust of a credential (no signature check — that is the JWS verifier’s responsibility).

verify_credential_with_revocation

Full credential verification including revocation, with a fail-closed policy (crypto Gap 5).

verify_credential_with_revocation_and_trust

Full credential verification including revocation and issuer trust, with a fail-closed policy.