pub struct DTGCommon {Show 13 fields
pub context: Vec<String>,
pub type_: Vec<String>,
pub id: Option<String>,
pub issuer: String,
pub issuer_scope: IssuerScope,
pub valid_from: DateTime<Utc>,
pub valid_until: Option<DateTime<Utc>>,
pub task_context: Option<String>,
pub task_digest_multibase: Option<String>,
pub credential_subject: CredentialSubject,
pub credential_status: Option<Value>,
pub proof: Option<DataIntegrityProof>,
pub extra: Map<String, Value>,
}Expand description
All DTG Credentials follow a common structure.
Fields§
§context: Vec<String>JSON-LD links to contexts.
MUST list W3C_VC_V2_CONTEXT first (or, for a v1.1 credential, W3C_VC_V1_CONTEXT) and DTG_CONTEXT_V1 second, followed by any contexts a proof type, a predicate profile or a community vocabulary requires. A later context MUST NOT redefine a term the DTG context protects.
type_: Vec<String>Credential type identifiers.
MUST include VerifiableCredential, DTGCredential and exactly one concrete
subtype. A community-issued VMC MAY add PersonhoodCredential as a non-authoritative
hint; nothing else is accepted.
id: Option<String>OPTIONAL identifier for this specific credential, per the W3C VC Data Model.
When present it MUST be a single URL. A urn:uuid: URN is the usual choice for a
credential with no dereferenceable home.
This is the handle a holder or verifier stores the credential under, so it is what
makes re-delivery of the same credential idempotent and re-issuance of a different one
recognisable as a renewal rather than a duplicate. A counterparty that keys credentials
by id cannot accept one that has none — so issue with an id unless you know nobody
on the other side needs it.
§Set it before signing
A Data Integrity proof covers the credential minus its proof, which includes this
property. Set it while building — DTGCredential::with_id — never after
DTGCredential::sign, which would leave a document whose proof no longer verifies.
issuer: StringDID of the entity issuing this credential
issuer_scope: IssuerScopeThe correlation scope the issuer declares for the identifier in issuer.
REQUIRED: a credential without it, or with any value but pairwise, directed or
public, is refused at parse. See IssuerScope.
valid_from: DateTime<Utc>ISO 8601 format of when this credentials become valid from
valid_until: Option<DateTime<Utc>>ISO 8601 format of when these credentials are valid to
task_context: Option<String>Names the trust task exchange this credential cites: the id of the document that
initiated the innermost exchange attesting what the credential states (Trust Tasks
§4.9.1). For witness/session that document’s threadId is its own id, so the
earlier description of this member as the exchange’s threadId gives the same
value there; it does not in general, since a threadId need not be unique.
Carry DTGCommon::task_digest_multibase with it, which binds the credential to
the document this only names.
REQUIRED on a VSC whose predicate profile requires it (WITNESSED_V1, VETTED_V1,
PRESENTED_V1), OPTIONAL otherwise. A DTG credential without a taskContext MUST be
interpretable standing alone, independent of any exchange.
NOTE: A verifier MUST NOT interpret a taskContext-bearing credential as proof that
the associated trust task completed unless the matching trust task outcome evidence is
also present and verified.
task_digest_multibase: Option<String>The task digest of the Trust Task document DTGCommon::task_context names.
taskContext locates the exchange a credential cites; this binds the credential to
it. An id is only a name, and anyone can write a different document that reuses
it, so a verifier pairing a credential with the cited document by id alone accepts
a counterfeit.
Computed as Trust Tasks §4.9.3 Binding a Citation to the Document It Names defines
a task digest: the document with its top-level proof removed (a proof inside
payload stays), canonicalized with JCS (RFC 8785), hashed, multihash-tagged and
multibase-encoded. An issuer uses sha2-256 and base58btc, as for every other
digest-valued member of DTG Core Credentials. task_digest_multibase_json computes
it; DTGCredential::with_task_citation sets it together with taskContext.
REQUIRED wherever taskContext is REQUIRED, and SHOULD accompany it where it is
OPTIONAL. A VSC under a profile requiring it is refused at parse without one.
DTGCredential::cites_task reports a credential without one as citing nothing rather
than falling back to comparing ids.
credential_subject: CredentialSubjectThe assertion between the entities involved
credential_status: Option<Value>A W3C VC status mechanism through which a verifier determines whether this credential has been revoked.
Held as an opaque Value: the mechanism is chosen by the governing VTC or VTN,
and this library neither selects one nor resolves it. BitstringStatusListEntry is
the common choice.
CONDITIONAL on a VDC — REQUIRED where the appointment outlives the freshness window the governing party defines for delegations, and permitted to be absent otherwise, with short validity and re-issuance preferred wherever the delegator is reachable. A status check is a live lookup that reveals the verification event to whoever hosts the status list.
§Modelled so that digests survive a round trip
Every VMC issued against a status list carries this, and before it was modelled a
parse-then-re-serialise dropped it silently — producing a digest its issuer would
not recognise. See DTGCommon::extra, which closes the same gap for members this
library does not name at all.
proof: Option<DataIntegrityProof>Cryptographic proof of credential authenticity
extra: Map<String, Value>Top-level members this library does not model, preserved verbatim.
A DTG credential may legitimately carry properties beyond the ones named here —
credentialSchema, termsOfUse, evidence, an extension a governing party
defines. Without somewhere to keep them, a parse-then-re-serialise round trip drops
them, and the digest computed over the result matches nothing the issuer signed.
Capturing them makes DTGCredential::digest_multibase agree with
digest_multibase_json over the wire form for any credential whose extra members
are top-level. It is not a complete answer — the credentialSubject types still
reject members they do not model — so where you hold the bytes a counterparty sent,
hashing those remains the safe habit.
Implementations§
Source§impl DTGCommon
impl DTGCommon
Sourcepub fn signed(&self) -> bool
pub fn signed(&self) -> bool
Has this credential been signed? Returns true if a proof exists NOTE: This does NOT validate the proof itself
Sourcepub fn id(&self) -> Option<&str>
pub fn id(&self) -> Option<&str>
This credential’s own identifier, if it has one. See DTGCommon::id.
Sourcepub fn issuer_scope(&self) -> IssuerScope
pub fn issuer_scope(&self) -> IssuerScope
The correlation scope the issuer declares for its own identifier.
Sourcepub fn statement(&self) -> Option<&CredentialSubjectStatement>
pub fn statement(&self) -> Option<&CredentialSubjectStatement>
The statement — predicate, object and any profile members — when this
credential is a VSC.
None for every other credential type, for the same reason DTGCommon::authority
is fallible.
Sourcepub fn statement_mut(&mut self) -> Option<&mut CredentialSubjectStatement>
pub fn statement_mut(&mut self) -> Option<&mut CredentialSubjectStatement>
Mutable access to the statement, when this credential is a VSC.
Present for the same reason as DTGCommon::authority_mut: a verifier must be testable against statements this library’s own constructors would refuse to build.
The authority grant, when this credential is a VAC.
None for every other credential type — the accessor is deliberately fallible
rather than panicking, so a caller handed a credential of unknown type can ask
without first matching on type_.
Mutable access to the authority grant, when this credential is a VAC.
Present so that a caller can construct chains this library’s own DTGCredential::attenuate would refuse — which is exactly what a verifier must be tested against, since nothing stops another implementation emitting such JSON.
Sourcepub fn delegation(&self) -> Option<&DelegationGrant>
pub fn delegation(&self) -> Option<&DelegationGrant>
The delegation object, when this credential is a VDC.
None for every other credential type, for the same reason DTGCommon::authority
is fallible: a caller handed a credential of unknown type can ask without first
matching on type_.
Sourcepub fn delegation_mut(&mut self) -> Option<&mut DelegationGrant>
pub fn delegation_mut(&mut self) -> Option<&mut DelegationGrant>
Mutable access to the delegation object, when this credential is a VDC.
Present for the same reason as DTGCommon::authority_mut: a verifier must be testable against chains this library’s own constructors would refuse to build, since nothing stops another implementation emitting such JSON.
Sourcepub fn valid_from(&self) -> DateTime<Utc>
pub fn valid_from(&self) -> DateTime<Utc>
The credential is valid from this timestamp
Sourcepub fn valid_until(&self) -> Option<DateTime<Utc>>
pub fn valid_until(&self) -> Option<DateTime<Utc>>
The credential is valid until this timestamp, if set
Sourcepub fn task_context(&self) -> Option<&str>
pub fn task_context(&self) -> Option<&str>
The id naming the trust task exchange this credential cites, if set. See
DTGCommon::task_context.
Sourcepub fn task_digest_multibase(&self) -> Option<&str>
pub fn task_digest_multibase(&self) -> Option<&str>
The task digest of the document taskContext names, if set. See
DTGCommon::task_digest_multibase.