Skip to main content

Module linked_vp

identity_kit

Module linked_vp 

Source
Available on crate feature linked-vp only.
Expand description

DIF Linked Verifiable Presentation: verifiable presentations a DID controller publishes for anyone to discover, through a LinkedVerifiablePresentation service in its DID document.

The service entry is the normative part of the specification: type is SERVICE_TYPE and serviceEndpoint one URL or a non-empty array of them. service builds one, services reads them out of a document. Each URL serves one presentation; this crate handles the JSON Web Token form (a VCDM 1.1 presentation in the vp claim, its credentials as JWTs) and reports the JSON-LD form as unsupported.

  • LinkedPresentationBuilder signs a presentation for publishing: iss, sub and holder the DID, no aud and no nonce, which a presentation published for anyone cannot carry.
  • LinkedVpValidator validates one presentation for the DID whose document lists it: holder and iss are that DID, the holder signed with a key of the DID under authentication, exp holds when present, and every credential validates with its subject the holder (the specification’s SHOULD, configurable).
  • LinkedVpClient fetches what a document’s services point to through an HttpClient and validates each presentation, reporting per URL: every linked presentation stands on its own.

Anyone can fetch a linked presentation and replay it, and it says nothing about who controls the DID now. A verifier must not grant access on a linked presentation alone, but ask the holder for an interactive proof of control, as the specification’s security considerations require. Hashlinks (hl= in a URL) are passed through and not verified.

§typ

The specification does not constrain typ. Its example presentation carries the literal 'vp+ld+jwt', stray quotes included, and its credential 'vc+ld+jwt'; the validator accepts these (PRESENTATION_TYP, CREDENTIAL_TYP) next to JWT and no typ. The builder writes JWT.

§Examples

The specification’s example document lists two presentations, one over HTTPS and one on IPFS:

use identity_kit::did::DidDocument;
use identity_kit::linked_vp::services;
use serde_json::json;

let document: DidDocument = serde_json::from_value(json!({
  "@context": ["https://www.w3.org/ns/did/v1", "https://identity.foundation/linked-vp/contexts/v1"],
  "id": "did:example:123",
  "service": [
    {
      "id": "did:example:123#foo",
      "type": "LinkedVerifiablePresentation",
      "serviceEndpoint": ["https://bar.example.com/verifiable-presentation.jsonld"]
    },
    {
      "id": "did:example:123#baz",
      "type": "LinkedVerifiablePresentation",
      "serviceEndpoint": "ipfs://bafybeihkoviema7g3gxyt6la7vd5ho32ictqbilu3wnlo3rs7ewhnp7lly/verifiable-presentation.jwt"
    }
  ]
}))?;
let urls: Vec<String> = services(&document)
    .map(|service| service.map(|service| service.urls[0].to_string()))
    .collect::<Result<_, _>>()?;
assert_eq!(urls, [
    "https://bar.example.com/verifiable-presentation.jsonld",
    "ipfs://bafybeihkoviema7g3gxyt6la7vd5ho32ictqbilu3wnlo3rs7ewhnp7lly/verifiable-presentation.jwt",
]);

Structs§

LinkedPresentationBuilder
Builds a linked presentation in the JSON Web Token form: a VCDM 1.1 presentation of credential JWTs held by holder, with iss, sub and holder the holder, jti the presentation’s id, iat and nbf the issuance time, exp when an expiration is set, and neither aud nor nonce.
LinkedPresentationReport
What became of one URL of a LinkedVerifiablePresentation service.
LinkedVpClient
Fetches the presentations a DID document links with an HttpClient and validates them with a LinkedVpValidator.
LinkedVpService
A LinkedVerifiablePresentation service of a DID document, with its URLs.
LinkedVpValidationOptions
Options of LinkedVpValidator. The audience and nonce are fixed: a linked presentation has neither.
LinkedVpValidator
Validates linked presentations: JwtPresentationValidator with the options fixed to the specification, plus the holder and the signer being the DID that links the presentation.

Enums§

LinkedVpError
Why a linked presentation could not be found, fetched or validated.

Constants§

CONTEXT
The JSON-LD context defining SERVICE_TYPE, for the @context of a DID document that lists linked presentations.
CREDENTIAL_TYP
The header typ values a credential in a linked presentation may carry besides JWT: vc+ld+jwt, and the literal 'vc+ld+jwt' of the specification’s example.
PRESENTATION_TYP
The header typ values a linked presentation may carry besides JWT: vp+ld+jwt, and the literal 'vp+ld+jwt' with the single quotes of the specification’s example.
SERVICE_TYPE
The service type, LinkedVerifiablePresentation.

Functions§

decode
Decodes a linked presentation and its credentials without verifying or validating anything, accepting PRESENTATION_TYP and CREDENTIAL_TYP.
service
A LinkedVerifiablePresentation service of id pointing to urls.
services
The LinkedVerifiablePresentation services of document, in document order. A service of that type whose endpoint is a map, or names something other than a URL, is an LinkedVpError::InvalidService rather than silently skipped.