Module vc 

Available on crate feature vc only.

Verifiable credentials and presentations secured as JWTs.

The module implements two profiles over the same JOSE layer:

• VCDM 1.1 JWT profile (§6.3.1 of the Verifiable Credentials Data Model 1.1): Credential and Presentation map to and from a JwtClaims set whose vc or vp claim holds the data model object and whose registered claims (iss, sub, jti, nbf, exp, aud) carry the issuer, subject, id, validity period and audience.
• VCDM 2.0 with VC-JOSE-COSE: CredentialV2 and PresentationV2 are themselves the JWT payload (typ: vc+jwt or vp+jwt), and a secured credential travels inside a presentation as an EnvelopedVc holding a data:application/vc+jwt,… URL.

Both are plain data with open extension properties; @context is carried, never processed. ClaimPath points at a claim in any JSON credential: the claim path of SD-JWT VC §5.6.1 and the claims path pointer of OID4VP §7, which DCQL applies to every JSON-based format. JwtClaims lives in jose and is re-exported here; this module adds its conversions between NumericDate values and chrono times. Jwt is a compact JWS as a string, signed with any Signer through Jwt::sign. The validation module verifies and validates the JWTs: signature through a KeyResolver and a JwsVerifier, binding of the signing key to the issuer or holder, validity period, audience, nonce and status.

Timestamps are chrono::DateTime<Utc> values, serialized as RFC 3339 in UTC (2010-01-01T19:23:24Z), the dateTimeStamp form the data model requires.

Examples

The JWT claims of VCDM 1.1 Example 31, decoded to a credential and back.

use identity_kit::vc::{Credential, JwtClaims};
use serde_json::json;

let claims: JwtClaims = serde_json::from_value(json!({
  "sub": "did:example:ebfeb1f712ebc6f1c276e12ec21",
  "jti": "http://example.edu/credentials/3732",
  "iss": "https://example.com/keys/foo.jwk",
  "nbf": 1541493724,
  "exp": 1573029723,
  "nonce": "660!6345FSer",
  "vc": {
    "@context": [
      "https://www.w3.org/2018/credentials/v1",
      "https://www.w3.org/2018/credentials/examples/v1"
    ],
    "type": ["VerifiableCredential", "UniversityDegreeCredential"],
    "credentialSubject": {
      "degree": { "type": "BachelorDegree", "name": "Bachelor of Science and Arts" }
    }
  }
}))?;

let credential = Credential::from_jwt_claims(&claims)?;
assert_eq!(credential.id.as_ref().map(|id| id.as_str()), Some("http://example.edu/credentials/3732"));
assert_eq!(credential.issuer.id().as_str(), "https://example.com/keys/foo.jwk");
assert_eq!(credential.issuance_date.to_rfc3339(), "2018-11-06T08:42:04+00:00");
assert_eq!(
    credential.subject().and_then(|s| s.id.as_ref()).map(|id| id.as_str()),
    Some("did:example:ebfeb1f712ebc6f1c276e12ec21")
);

// The mapping is reversible; the custom `nonce` claim is the caller's to add back.
let encoded = credential.to_jwt_claims()?.with_claim("nonce", "660!6345FSer");
assert_eq!(encoded, claims);

Re-exports

pub use crate::jose::JwtClaims;

Modules

validation

Validation of credential and presentation JWTs: signature, binding to the issuer or holder, validity period, audience, nonce and status.

Structs

ClaimPath

A path into a JSON payload: a non-empty list of property names, array indexes and null (every element).

ClaimPathError

A ClaimPath component met a value it cannot select from.

Credential

A verifiable credential of the Verifiable Credentials Data Model 1.1, as data.

CredentialV2

A verifiable credential of the Verifiable Credentials Data Model 2.0, as data.

EnvelopedVc

An EnvelopedVerifiableCredential (VCDM 2.0 §4.12.1): a secured credential carried in a data: URL, the form a credential takes inside a PresentationV2.

EnvelopedVp

An EnvelopedVerifiablePresentation (VCDM 2.0 §4.12.2): a secured presentation carried in a data: URL.

Jwt

A JSON Web Token (RFC 7519) in compact serialization, kept as the string it is.

Presentation

A verifiable presentation of the Verifiable Credentials Data Model 1.1 whose credentials are JWTs, as data.

PresentationV2

A verifiable presentation of the Verifiable Credentials Data Model 2.0 whose credentials are EnvelopedVc objects, as data.

Subject

A credentialSubject: the optional id of the subject and the claims about it.

TypedObject

An object with a type and usually an id: a credentialStatus, credentialSchema, refreshService, termsOfUse or evidence entry, whose meaning the type defines.

Enums

CredentialError

Why a credential or presentation is not well-formed, or cannot be mapped to or from the claims of a JWT.

Party

The issuer of a credential or the holder of a presentation: a URI, or an object whose id is that URI and that carries further properties, a name say.

PathComponent

One step of a ClaimPath.

Constants

CONTEXT_V1

The base context of the Verifiable Credentials Data Model 1.1.

CONTEXT_V2

The base context of the Verifiable Credentials Data Model 2.0.