dpp_vc/credential/mod.rs
1//! W3C Verifiable Credentials for DPP access control.
2//!
3//! This module implements VC issuance and verification following the
4//! W3C Verifiable Credentials Data Model v2.0 specification, adapted
5//! to the EU Digital Product Passport audience model.
6//!
7//! ## Audiences
8//!
9//! Reg. (EU) 2023/1542 Art. 77(2) names three audiences, and the credential
10//! establishes which one a caller belongs to:
11//! - **Public**: no credential required.
12//! - **LegitimateInterest**: a VC proving the holder's role (repairer,
13//! remanufacturer, second-life operator, recycler).
14//! - **Authority**: an institutional DID (notified body, market surveillance
15//! authority, customs, the Commission).
16//!
17//! These do not form a ranking. An `Authority` sees conformity test reports
18//! that a `LegitimateInterest` holder does not, and a `LegitimateInterest`
19//! holder sees individual-item data that an `Authority` does not. See
20//! [`Audience::may_see`](dpp_domain::Audience::may_see).
21//!
22//! ## Credential lifecycle
23//!
24//! 1. An authority issues a `DppAccessCredential` to an operator.
25//! 2. The credential is signed as a JWS using the issuer's Ed25519 key.
26//! 3. When requesting professional/confidential data, the holder presents the VC.
27//! 4. The verifier checks the JWS, expiration, revocation status, and scope.
28
29mod builder;
30mod revocation;
31#[cfg(test)]
32mod tests;
33mod trust;
34mod types;
35mod verify;
36
37pub use builder::CredentialBuilder;
38pub use revocation::{RevocationOutcome, check_revocation};
39pub use trust::{AllowAllIssuers, StaticTrustedIssuers, TrustedIssuerRegistry};
40pub use types::{
41 Audience, CredentialRole, CredentialStatus, DppAccessCredential, DppCredentialSubject,
42};
43pub use verify::{
44 VerificationResult, verify_credential_claims, verify_credential_claims_with_trust,
45 verify_credential_with_revocation, verify_credential_with_revocation_and_trust,
46};