Struct JwtPresentationValidator 

pub struct JwtPresentationValidator<R, V = DefaultVerifier> { /* private fields */ }

Available on crate feature vc only.

Validates presentation JWTs and the credential JWTs they carry, see the module documentation for the checks.

Built over a JwtCredentialValidator, which validates the credentials with the same key resolver, verifier and status check.

Each profile has its own method, as for credentials: validate for the VCDM 1.1 JWT profile (typ JWT, the vp claim, credentials as JWTs) and validate_v2 for VCDM 2.0 secured with VC-JOSE-COSE (typ vp+jwt, the payload is the presentation, credentials enveloped). Neither accepts the other’s typ. A verifier that takes both picks by typ, and since typ is optional in both profiles, picks a token without one by its payload: VCDM 1.1 puts the presentation in a vp claim, VCDM 2.0 never has one.

use identity_kit::jose::DefaultVerifier;
use identity_kit::methods::DidKey;
use identity_kit::resolver::Resolver;
use identity_kit::vc::validation::{JwtPresentationValidator, PresentationValidationOptions};
use identity_kit::vc::{Jwt, JwtClaims, PresentationV2};

/// Whether `jwt` is a VCDM 2.0 presentation rather than a VCDM 1.1 one.
fn is_v2(jwt: &Jwt) -> Result<bool, Box<dyn std::error::Error>> {
    let jws = jwt.decode()?;
    Ok(match jws.header().typ.as_deref() {
        Some(typ) => typ == PresentationV2::JWT_TYP,
        None => {
            let claims: JwtClaims = serde_json::from_slice(jws.payload())?;
            !claims.additional.contains_key("vp")
        }
    })
}

async fn holder_of(
    validator: &JwtPresentationValidator<Resolver>,
    jwt: &Jwt,
    options: &PresentationValidationOptions,
) -> Result<Option<String>, Box<dyn std::error::Error>> {
    let holder = if is_v2(jwt)? {
        validator.validate_v2(jwt, options).await?.holder().cloned()
    } else {
        validator.validate(jwt, options).await?.holder().cloned()
    };
    Ok(holder.map(|holder| holder.to_string()))
}

let resolver = Resolver::builder().with(DidKey::default()).build();
let _validator = JwtPresentationValidator::new(resolver, DefaultVerifier);

Implementations

impl<R: KeyResolver, V: JwsVerifier> JwtPresentationValidator<R, V>

pub fn new(resolver: R, verifier: V) -> Self

A validator resolving keys with resolver and verifying signatures with verifier, without a status check.

pub fn from_credential_validator( credentials: JwtCredentialValidator<R, V>, ) -> Self

A validator over credentials, sharing its resolver, verifier and status check.

pub fn with_status_check(self, check: impl StatusCheck + 'static) -> Self

This validator checking credentialStatus with check.

pub fn credential_validator(&self) -> &JwtCredentialValidator<R, V>

The credential validator.

pub async fn validate( &self, jwt: &Jwt, options: &PresentationValidationOptions, ) -> Result<DecodedPresentation, PresentationValidationError>

Validates a presentation JWT and every credential it carries.

Errors

A PresentationValidationError naming what failed: the presentation (in which case no credential was validated), or the credentials that failed, all of them under FailFast::AllErrors.

pub async fn validate_v2( &self, jwt: &Jwt, options: &PresentationValidationOptions, ) -> Result<DecodedPresentationV2, PresentationValidationError>

Validates a VCDM 2.0 presentation JWT secured with VC-JOSE-COSE and every credential it envelopes.

The checks are those of validate, with the profile’s own shape: typ, when present, is vp+jwt (or one of options.additional_typ); the payload is the presentation, with iss and jti agreeing with holder and id and no vp claim; the holder, from holder or else iss, is required and owns the signing key (KeyReference::binds_to). Each credential is unwrapped from its EnvelopedVerifiableCredential and validated under options.credentials: an application/vc+jwt one with JwtCredentialValidator::validate_v2; with the sd-jwt feature, an application/vc+sd-jwt one as SdJwtCredentialValidator::validate_v2 of sd_jwt_vc does, with its credentialStatus entries and its status claim checked by this validator’s StatusCheck and the key binding of options.key_binding required when set (none by default: the presentation JWT already proves holder control). An envelope of another media type (a COSE credential) fails for that credential alone.

Errors

As validate.

Trait Implementations

impl<R: Debug, V: Debug> Debug for JwtPresentationValidator<R, V>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.