Struct JwtCredentialValidator 

pub struct JwtCredentialValidator<R, V = DefaultVerifier> { /* private fields */ }

Available on crate feature vc only.

Validates credential JWTs, see the module documentation for the checks.

Examples

A did:key issuer signs a credential about a subject, and the verifier validates it with a resolver that knows did:key.

use chrono::{TimeZone as _, Utc};
use identity_kit::did::Uri;
use identity_kit::jose::{DefaultVerifier, Jwk, JwsAlgorithm, JwsHeader, SignError, Signer};
use identity_kit::methods::DidKey;
use identity_kit::resolver::Resolver;
use identity_kit::vc::validation::{CredentialValidationOptions, JwtCredentialValidator, TimeOptions};
use identity_kit::vc::{Credential, Jwt, Subject};

// The Ed25519 key of RFC 8037 Appendix A.1 behind a `Signer`.
struct Issuer(ed25519_dalek::SigningKey);

#[async_trait::async_trait]
impl Signer for Issuer {
    fn alg(&self) -> JwsAlgorithm { JwsAlgorithm::EdDSA }
    fn kid(&self) -> Option<&str> { None }
    async fn sign(&self, input: &[u8]) -> Result<Vec<u8>, SignError> {
        use ed25519_dalek::Signer as _;
        Ok(self.0.sign(input).to_bytes().to_vec())
    }
}

let secret: [u8; 32] = identity_kit::jose::Jwk::from_ed25519_public(&[0; 32]).map(|_| [
    0x9d, 0x61, 0xb1, 0x9d, 0xef, 0xfd, 0x5a, 0x60, 0xba, 0x84, 0x4a, 0xf4, 0x92, 0xec, 0x2c, 0xc4,
    0x44, 0x49, 0xc5, 0x69, 0x7b, 0x32, 0x69, 0x19, 0x70, 0x3b, 0xac, 0x03, 0x1c, 0xae, 0x7f, 0x60,
])?;
let signing_key = ed25519_dalek::SigningKey::from_bytes(&secret);
let jwk = Jwk::from_ed25519_public(signing_key.verifying_key().as_bytes())?;
let issuer = DidKey::did(&jwk)?;
let kid = issuer.join(&format!("#{}", issuer.method_specific_id()))?;

let credential = Credential::new(
    &issuer,
    Utc.with_ymd_and_hms(2010, 1, 1, 0, 0, 0).unwrap(),
    Subject::new(Uri::parse("did:example:ebfeb1f712ebc6f1c276e12ec21")?),
);
let header = JwsHeader::new(JwsAlgorithm::EdDSA).with_typ("JWT").with_kid(kid.as_str());
let jwt = Jwt::sign(&header, &credential.to_jwt_claims()?, &Issuer(signing_key)).await?;

let resolver = Resolver::builder().with(DidKey::default()).build();
let validator = JwtCredentialValidator::new(resolver, DefaultVerifier);
let options = CredentialValidationOptions::new()
    .with_time(TimeOptions::at(Utc.with_ymd_and_hms(2024, 1, 1, 0, 0, 0).unwrap()));
let decoded = validator.validate(&jwt, &options).await?;
assert_eq!(decoded.credential, credential);

Implementations

impl<R: KeyResolver, V: JwsVerifier> JwtCredentialValidator<R, V>

pub fn new(resolver: R, verifier: V) -> Self

A validator resolving keys with resolver and verifying signatures with verifier, without a status check.

pub fn with_status_check(self, check: impl StatusCheck + 'static) -> Self

This validator checking credentialStatus and the status claim with check.

pub fn resolver(&self) -> &R

The key resolver.

pub fn verifier(&self) -> &V

The signature verifier.

pub fn has_status_check(&self) -> bool

Whether a status check is configured.

pub async fn validate( &self, jwt: &Jwt, options: &CredentialValidationOptions, ) -> Result<DecodedCredential, ValidationError>

Validates a VCDM 1.1 credential JWT.

Errors

The first ValidationError found, in the order the module documentation lists the checks.

pub async fn validate_v2( &self, jwt: &Jwt, options: &CredentialValidationOptions, ) -> Result<DecodedCredentialV2, ValidationError>

Validates a VCDM 2.0 credential JWT, whose typ is vc+jwt when present.

Errors

As validate.

Trait Implementations

impl<R: Debug, V: Debug> Debug for JwtCredentialValidator<R, V>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.