web4_core/

sd_jwt_vc.rs

// Copyright (c) 2026 MetaLINXX Inc.
// SPDX-License-Identifier: AGPL-3.0-or-later
//
// This software is covered by US Patents 11,477,027 and 12,278,913,
// and pending application 19/178,619. See PATENTS.md for details.

//! SD-JWT-VC issuance — Web4 attestations as selectively-disclosable
//! Verifiable Credentials (EUDI / IETF interop, Phase 1).
//!
//! Implements the issuance half of IETF SD-JWT (`draft-ietf-oauth-
//! selective-disclosure-jwt`) + SD-JWT-VC (`draft-ietf-oauth-sd-jwt-vc`):
//! a JWT whose selected claims are replaced by salted digests (`_sd`), with the
//! cleartext carried in detached *disclosures*. The holder presents only the
//! disclosures it chooses; the issuer signature still verifies.
//!
//! The issuer is an LCT (identified by a `did:web4` / `did:web`), signing with
//! its Ed25519 key (`EdDSA` JWS). This is the bridge from a Web4 attestation
//! into a wallet-consumable credential — lossy by design (the rich witness
//! structure collapses to signed claims; see `docs/strategy/
//! eudi-resolvability-plan.md`).
//!
//! Generic and public-eligible: no novel mechanism, just the standard format.
//!
//! Compact serialization: `<JWS>~<disclosure>~<disclosure>~` (trailing `~`;
//! a holder Key-Binding JWT is appended after the last `~` at presentation).

use crate::crypto::{KeyPair, PublicKey, SignatureBytes};
use base64::engine::general_purpose::URL_SAFE_NO_PAD;
use base64::Engine;
use rand::RngCore;
use serde_json::{json, Map, Value};
use sha2::{Digest, Sha256};

fn b64(bytes: &[u8]) -> String {
    URL_SAFE_NO_PAD.encode(bytes)
}
fn unb64(s: &str) -> Result<Vec<u8>, String> {
    URL_SAFE_NO_PAD.decode(s).map_err(|e| e.to_string())
}

/// A salted disclosure for one object claim: `[salt, name, value]`.
#[derive(Clone, Debug)]
pub struct Disclosure {
    pub salt: String,
    pub name: String,
    pub value: Value,
}

impl Disclosure {
    pub fn new(name: impl Into<String>, value: Value) -> Self {
        let mut salt_bytes = [0u8; 16];
        rand::thread_rng().fill_bytes(&mut salt_bytes);
        Self { salt: b64(&salt_bytes), name: name.into(), value }
    }

    /// Deterministic salt — for tests and reproducible issuance.
    pub fn with_salt(salt: impl Into<String>, name: impl Into<String>, value: Value) -> Self {
        Self { salt: salt.into(), name: name.into(), value }
    }

    /// The base64url(JSON `[salt, name, value]`) disclosure string.
    pub fn encoded(&self) -> String {
        let arr = json!([self.salt, self.name, self.value]);
        b64(serde_json::to_string(&arr).expect("disclosure serializes").as_bytes())
    }

    /// The `_sd` digest: base64url(SHA-256(ASCII(encoded))).
    pub fn digest(&self) -> String {
        let enc = self.encoded();
        b64(&Sha256::digest(enc.as_bytes()))
    }
}

/// Builder for an SD-JWT-VC.
pub struct SdJwtVc {
    vct: String,
    issuer: String,
    typ: String,
    iat: i64,
    /// Optional holder key binding (`cnf`) — the holder's Ed25519 public key.
    cnf_holder_pubkey: Option<[u8; 32]>,
    plain: Map<String, Value>,
    disclosures: Vec<Disclosure>,
}

impl SdJwtVc {
    /// `vct` = credential type (e.g. "Web4Presence"); `issuer` = the issuer DID.
    pub fn new(vct: impl Into<String>, issuer: impl Into<String>) -> Self {
        Self {
            vct: vct.into(),
            issuer: issuer.into(),
            // The IETF SD-JWT-VC draft is renaming `vc+sd-jwt` → `dc+sd-jwt`
            // ("Digital Credential"). `vc+sd-jwt` is the most widely deployed
            // value; override with `.typ()` for newer verifiers.
            typ: "vc+sd-jwt".to_string(),
            iat: chrono::Utc::now().timestamp(),
            cnf_holder_pubkey: None,
            plain: Map::new(),
            disclosures: Vec::new(),
        }
    }

    pub fn typ(mut self, typ: impl Into<String>) -> Self {
        self.typ = typ.into();
        self
    }
    /// Override issued-at (unix seconds) — for reproducible issuance/tests.
    pub fn iat(mut self, iat: i64) -> Self {
        self.iat = iat;
        self
    }
    /// Bind the credential to a holder key (`cnf`). The holder must later sign a
    /// Key-Binding JWT with the matching private key to present (see `present`).
    /// Emitted as a standard JWK (`OKP`/`Ed25519`).
    pub fn holder_binding(mut self, holder_pubkey: &PublicKey) -> Self {
        self.cnf_holder_pubkey = Some(holder_pubkey.to_bytes());
        self
    }

    /// An always-disclosed claim (appears in cleartext in the JWT payload).
    pub fn claim(mut self, name: impl Into<String>, value: Value) -> Self {
        self.plain.insert(name.into(), value);
        self
    }

    /// A selectively-disclosable claim (replaced by a digest; cleartext in a
    /// detached disclosure the holder may withhold).
    pub fn sd_claim(mut self, name: impl Into<String>, value: Value) -> Self {
        self.disclosures.push(Disclosure::new(name, value));
        self
    }

    /// SD claim with a fixed salt — reproducible issuance/tests.
    pub fn sd_claim_salted(
        mut self,
        salt: impl Into<String>,
        name: impl Into<String>,
        value: Value,
    ) -> Self {
        self.disclosures.push(Disclosure::with_salt(salt, name, value));
        self
    }

    /// Build the unsigned signing input (header + payload) and the disclosures,
    /// for issuance through an *external* signer (HSM, remote vault, the Web4
    /// hub's `RemoteSigner`) that never exposes a raw [`KeyPair`]. The signer
    /// EdDSA-signs [`UnsignedSdJwtVc::signing_bytes`]; the resulting signature
    /// is assembled via [`UnsignedSdJwtVc::into_compact`]. `issue` is the
    /// in-process convenience over this. `kid` is the issuer verification
    /// method id (e.g. `<did>#key-0`).
    pub fn prepare(&self, kid: &str) -> UnsignedSdJwtVc {
        // Digests, sorted so order doesn't leak insertion sequence.
        let mut digests: Vec<String> = self.disclosures.iter().map(|d| d.digest()).collect();
        digests.sort();

        let mut payload = self.plain.clone();
        payload.insert("iss".into(), json!(self.issuer));
        payload.insert("vct".into(), json!(self.vct));
        payload.insert("iat".into(), json!(self.iat));
        payload.insert("_sd_alg".into(), json!("sha-256"));
        payload.insert("_sd".into(), json!(digests));
        if let Some(pk) = &self.cnf_holder_pubkey {
            payload.insert("cnf".into(), json!({
                "jwk": { "kty": "OKP", "crv": "Ed25519", "x": b64(pk) }
            }));
        }

        let header = json!({ "alg": "EdDSA", "typ": self.typ, "kid": kid });
        let header_b64 = b64(serde_json::to_string(&header).unwrap().as_bytes());
        let payload_b64 = b64(serde_json::to_string(&Value::Object(payload)).unwrap().as_bytes());
        UnsignedSdJwtVc {
            signing_input: format!("{header_b64}.{payload_b64}"),
            encoded_disclosures: self.disclosures.iter().map(|d| d.encoded()).collect(),
        }
    }

    /// Issue: build + sign the JWS and emit the compact SD-JWT-VC.
    /// `kid` is the issuer verification method id (e.g. `<did>#key-0`).
    pub fn issue(&self, issuer_key: &KeyPair, kid: &str) -> String {
        let unsigned = self.prepare(kid);
        let sig = issuer_key.sign(unsigned.signing_bytes());
        unsigned.into_compact(&sig.bytes)
    }
}

/// An SD-JWT-VC prepared but not yet signed. Lets an issuer sign through an
/// external signer (HSM / remote vault / hub `RemoteSigner`) without exposing
/// a private key. Produced by [`SdJwtVc::prepare`].
pub struct UnsignedSdJwtVc {
    /// The exact bytes to EdDSA-sign: `base64url(header).base64url(payload)`.
    signing_input: String,
    /// Disclosures (already base64url-encoded) appended after the JWS.
    encoded_disclosures: Vec<String>,
}

impl UnsignedSdJwtVc {
    /// The bytes the external signer must EdDSA-sign.
    pub fn signing_bytes(&self) -> &[u8] {
        self.signing_input.as_bytes()
    }

    /// Assemble the compact SD-JWT-VC from the 64-byte Ed25519 signature the
    /// external signer returned over [`signing_bytes`](Self::signing_bytes).
    pub fn into_compact(self, signature: &[u8; 64]) -> String {
        // JWS ~ disclosures ~ (trailing tilde; KB-JWT slot left empty)
        let mut out = format!("{}.{}", self.signing_input, b64(signature));
        for d in &self.encoded_disclosures {
            out.push('~');
            out.push_str(d);
        }
        out.push('~');
        out
    }
}

/// The result of verifying an SD-JWT-VC: the issuer-signed claims, with the
/// presented disclosures merged back in.
#[derive(Clone, Debug)]
pub struct VerifiedCredential {
    pub vct: String,
    pub issuer: String,
    pub claims: Map<String, Value>,
}

/// Verify the issuer signature and reconstruct the disclosed claims.
///
/// - Verifies the EdDSA JWS against `issuer_pubkey`.
/// - For each presented disclosure: recomputes its digest, requires it to be in
///   the JWT's `_sd`, and merges `name → value` into the result.
/// - Always-disclosed claims pass through. Withheld disclosures simply don't
///   appear (selective disclosure). A disclosure whose digest isn't in `_sd`
///   is rejected (tamper).
pub fn verify_issuer(compact: &str, issuer_pubkey: &PublicKey) -> Result<VerifiedCredential, String> {
    let mut parts = compact.split('~');
    let jws = parts.next().ok_or("empty credential")?;
    // remaining parts are disclosures; a trailing '~' yields a final empty part
    // and the (unused here) KB-JWT slot.
    let disclosures: Vec<&str> = parts.filter(|p| !p.is_empty()).collect();

    // 1. JWS signature
    let jp: Vec<&str> = jws.split('.').collect();
    if jp.len() != 3 {
        return Err("malformed JWS".into());
    }
    let signing_input = format!("{}.{}", jp[0], jp[1]);
    let sig_raw = unb64(jp[2])?;
    let sig_arr: [u8; 64] = sig_raw.as_slice().try_into().map_err(|_| "bad sig length")?;
    issuer_pubkey
        .verify(signing_input.as_bytes(), &SignatureBytes::from_bytes(sig_arr))
        .map_err(|_| "issuer signature invalid".to_string())?;

    // 2. payload
    let payload: Value = serde_json::from_slice(&unb64(jp[1])?).map_err(|e| e.to_string())?;
    let obj = payload.as_object().ok_or("payload not an object")?;
    let sd: Vec<String> = obj
        .get("_sd")
        .and_then(|v| v.as_array())
        .map(|a| a.iter().filter_map(|x| x.as_str().map(String::from)).collect())
        .unwrap_or_default();

    // 3. reconstruct claims: start from cleartext (minus protocol fields)
    let mut claims = Map::new();
    for (k, v) in obj {
        if !matches!(k.as_str(), "_sd" | "_sd_alg") {
            claims.insert(k.clone(), v.clone());
        }
    }

    // 4. merge presented disclosures whose digest is in `_sd`
    for enc in disclosures {
        let digest = b64(&Sha256::digest(enc.as_bytes()));
        if !sd.contains(&digest) {
            return Err(format!("disclosure digest not in _sd (tamper?): {enc}"));
        }
        let raw = unb64(enc)?;
        let arr: Value = serde_json::from_slice(&raw).map_err(|e| e.to_string())?;
        let a = arr.as_array().ok_or("disclosure not an array")?;
        if a.len() != 3 {
            return Err("object disclosure must be [salt, name, value]".into());
        }
        let name = a[1].as_str().ok_or("disclosure name not a string")?;
        claims.insert(name.to_string(), a[2].clone());
    }

    Ok(VerifiedCredential {
        vct: obj.get("vct").and_then(|v| v.as_str()).unwrap_or_default().to_string(),
        issuer: obj.get("iss").and_then(|v| v.as_str()).unwrap_or_default().to_string(),
        claims,
    })
}

// ─────────────────────── presentation (holder Key-Binding) ───────────────────────

/// Present an issued SD-JWT-VC to a verifier: optionally narrow to a subset of
/// disclosures, then append a holder-signed Key-Binding JWT bound to the
/// verifier's `nonce` + `aud`. The credential MUST have been issued with a
/// `cnf` holder binding (`holder_binding`).
///
/// `disclose` selects which claim names to reveal; `None` reveals all. The
/// KB-JWT's `sd_hash` binds to *exactly* the presented disclosures, so a
/// verifier knows which claims this presentation covers.
pub fn present(
    issued_compact: &str,
    holder_key: &KeyPair,
    nonce: &str,
    aud: &str,
    now: i64,
    disclose: Option<&[&str]>,
) -> Result<String, String> {
    let mut it = issued_compact.split('~');
    let jws = it.next().ok_or("empty credential")?;
    let all: Vec<&str> = it.filter(|p| !p.is_empty()).collect();

    // Select disclosures to reveal.
    let kept: Vec<&str> = match disclose {
        None => all,
        Some(names) => all
            .into_iter()
            .filter(|enc| {
                unb64(enc)
                    .ok()
                    .and_then(|r| serde_json::from_slice::<Value>(&r).ok())
                    .and_then(|a| a.as_array().and_then(|a| a.get(1).and_then(|n| n.as_str()).map(String::from)))
                    .map(|name| names.contains(&name.as_str()))
                    .unwrap_or(false)
            })
            .collect(),
    };

    // The presentation prefix: JWS ~ kept-disclosures ~ (trailing tilde).
    let mut prefix = jws.to_string();
    for d in &kept {
        prefix.push('~');
        prefix.push_str(d);
    }
    prefix.push('~');

    // sd_hash binds the KB-JWT to this exact presentation.
    let sd_hash = b64(&Sha256::digest(prefix.as_bytes()));
    let kb_header = json!({ "alg": "EdDSA", "typ": "kb+jwt" });
    let kb_payload = json!({ "iat": now, "aud": aud, "nonce": nonce, "sd_hash": sd_hash });
    let kh = b64(serde_json::to_string(&kb_header).unwrap().as_bytes());
    let kp_b64 = b64(serde_json::to_string(&kb_payload).unwrap().as_bytes());
    let kb_signing = format!("{kh}.{kp_b64}");
    let kb_sig = holder_key.sign(kb_signing.as_bytes());
    let kb_jwt = format!("{kb_signing}.{}", b64(&kb_sig.bytes));

    Ok(format!("{prefix}{kb_jwt}"))
}

/// Verify a *presented* SD-JWT-VC: issuer signature + disclosure digests + the
/// holder Key-Binding JWT (signed by the `cnf` key, bound to `expected_nonce` /
/// `expected_aud`, fresh, and matching `sd_hash`). Returns the disclosed claims.
pub fn verify_presentation(
    compact: &str,
    issuer_pubkey: &PublicKey,
    expected_nonce: &str,
    expected_aud: &str,
    max_age_secs: i64,
    now: i64,
) -> Result<VerifiedCredential, String> {
    // The KB-JWT is the final '~'-segment (a 3-part JWT). Split it off; the
    // prefix is everything up to and including the last '~'.
    let last_tilde = compact.rfind('~').ok_or("no key-binding JWT (missing '~')")?;
    let prefix = &compact[..=last_tilde];
    let kb_jwt = &compact[last_tilde + 1..];
    if kb_jwt.is_empty() {
        return Err("presentation is missing the Key-Binding JWT".into());
    }

    // 1. issuer side (sig + disclosures) over the prefix.
    let cred = verify_issuer(prefix, issuer_pubkey)?;

    // 2. holder key from cnf.jwk in the issuer-signed payload.
    let payload_b64 = compact.split('~').next().unwrap().split('.').nth(1).ok_or("malformed JWS")?;
    let payload: Value = serde_json::from_slice(&unb64(payload_b64)?).map_err(|e| e.to_string())?;
    let x = payload
        .get("cnf").and_then(|c| c.get("jwk")).and_then(|j| j.get("x")).and_then(|x| x.as_str())
        .ok_or("credential has no cnf holder key — not presentable with key binding")?;
    let holder_raw = unb64(x)?;
    let holder_arr: [u8; 32] = holder_raw.as_slice().try_into().map_err(|_| "bad holder key length")?;
    let holder_pk = PublicKey::from_bytes(&holder_arr).map_err(|e| e.to_string())?;

    // 3. KB-JWT signature + claims.
    let kp: Vec<&str> = kb_jwt.split('.').collect();
    if kp.len() != 3 {
        return Err("malformed Key-Binding JWT".into());
    }
    let kb_signing = format!("{}.{}", kp[0], kp[1]);
    let kb_sig_raw = unb64(kp[2])?;
    let kb_sig_arr: [u8; 64] = kb_sig_raw.as_slice().try_into().map_err(|_| "bad KB sig length")?;
    holder_pk
        .verify(kb_signing.as_bytes(), &SignatureBytes::from_bytes(kb_sig_arr))
        .map_err(|_| "Key-Binding JWT signature invalid (holder key mismatch)".to_string())?;

    let kb: Value = serde_json::from_slice(&unb64(kp[1])?).map_err(|e| e.to_string())?;
    if kb.get("nonce").and_then(|v| v.as_str()) != Some(expected_nonce) {
        return Err("KB-JWT nonce mismatch (replay?)".into());
    }
    if kb.get("aud").and_then(|v| v.as_str()) != Some(expected_aud) {
        return Err("KB-JWT audience mismatch (credential meant for another verifier)".into());
    }
    let iat = kb.get("iat").and_then(|v| v.as_i64()).ok_or("KB-JWT missing iat")?;
    if now.saturating_sub(iat) > max_age_secs {
        return Err("KB-JWT expired".into());
    }
    let expected_sd_hash = b64(&Sha256::digest(prefix.as_bytes()));
    if kb.get("sd_hash").and_then(|v| v.as_str()) != Some(expected_sd_hash.as_str()) {
        return Err("KB-JWT sd_hash does not match the presented disclosures".into());
    }

    Ok(cred)
}

// ─────────────── Web4 credential helpers (the pattern, not the policy) ───────────────

/// Build a `Web4Presence` SD-JWT-VC: an assurance attestation about a subject,
/// with the assurance level selectively-disclosable. Inputs are primitives
/// (no hestia/witness types) so web4-core stays dependency-clean.
pub fn web4_presence_credential(
    issuer_did: &str,
    subject_did: &str,
    assurance_level: &str,
) -> SdJwtVc {
    SdJwtVc::new("Web4Presence", issuer_did)
        .claim("sub", json!(subject_did))
        .sd_claim("assurance_level", json!(assurance_level))
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn external_signer_path_matches_issue() {
        // prepare()+into_compact() (external-signer path) must produce a
        // byte-identical credential to issue() (in-process path).
        let issuer = KeyPair::generate();
        let kid = "did:web4:hub.example:abc#key-0";
        let builder = SdJwtVc::new("Web4Membership", "did:web4:hub.example:abc")
            .iat(1_700_000_000)
            .claim("sub", json!("did:web4:hub.example:member"))
            .sd_claim_salted("s1", "role", json!("citizen"));

        let in_process = builder.issue(&issuer, kid);

        // External path: hub holds no KeyPair; signs the prepared bytes.
        let unsigned = builder.prepare(kid);
        let sig = issuer.sign(unsigned.signing_bytes());
        let external = unsigned.into_compact(&sig.bytes);

        assert_eq!(in_process, external);
        // And it verifies under the issuer key.
        verify_issuer(&external, &issuer.verifying_key()).expect("external-signed must verify");
    }

    #[test]
    fn test_issue_and_verify_roundtrip() {
        let issuer = KeyPair::generate();
        let pk = issuer.verifying_key();

        let compact = SdJwtVc::new("Web4Presence", "did:web4:hub.example.com:abc")
            .iat(1_700_000_000)
            .claim("sub", json!("did:web4:hub.example.com:def"))
            .sd_claim_salted("salt1", "assurance_level", json!("multi_device"))
            .sd_claim_salted("salt2", "github", json!("https://github.com/dp-web4"))
            .issue(&issuer, "did:web4:hub.example.com:abc#key-0");

        let v = verify_issuer(&compact, &pk).expect("must verify");
        assert_eq!(v.vct, "Web4Presence");
        assert_eq!(v.issuer, "did:web4:hub.example.com:abc");
        // cleartext claim present
        assert_eq!(v.claims.get("sub").unwrap(), &json!("did:web4:hub.example.com:def"));
        // both SD claims reconstructed
        assert_eq!(v.claims.get("assurance_level").unwrap(), &json!("multi_device"));
        assert_eq!(v.claims.get("github").unwrap(), &json!("https://github.com/dp-web4"));
    }

    #[test]
    fn test_selective_disclosure() {
        let issuer = KeyPair::generate();
        let pk = issuer.verifying_key();
        let compact = SdJwtVc::new("Web4Presence", "did:iss")
            .sd_claim_salted("s1", "assurance_level", json!("hardware_backed"))
            .sd_claim_salted("s2", "email", json!("dp@metalinxx.io"))
            .issue(&issuer, "did:iss#key-0");

        // Holder presents ONLY the assurance disclosure, withholds email.
        let jws_and_first = {
            let mut it = compact.split('~');
            let jws = it.next().unwrap();
            // find the assurance disclosure (the one decoding to "assurance_level")
            let discs: Vec<&str> = it.filter(|p| !p.is_empty()).collect();
            let keep = discs.iter().find(|d| {
                let raw = unb64(d).unwrap();
                let a: Value = serde_json::from_slice(&raw).unwrap();
                a[1] == json!("assurance_level")
            }).unwrap();
            format!("{jws}~{keep}~")
        };

        let v = verify_issuer(&jws_and_first, &pk).expect("partial presentation verifies");
        assert_eq!(v.claims.get("assurance_level").unwrap(), &json!("hardware_backed"));
        assert!(!v.claims.contains_key("email")); // withheld
    }

    #[test]
    fn test_wrong_issuer_key_rejected() {
        let issuer = KeyPair::generate();
        let imposter = KeyPair::generate();
        let compact = SdJwtVc::new("Web4Presence", "did:iss")
            .sd_claim_salted("s1", "x", json!(1))
            .issue(&issuer, "did:iss#key-0");
        assert!(verify_issuer(&compact, &imposter.verifying_key()).is_err());
    }

    #[test]
    fn test_tampered_disclosure_rejected() {
        let issuer = KeyPair::generate();
        let pk = issuer.verifying_key();
        let compact = SdJwtVc::new("Web4Presence", "did:iss")
            .sd_claim_salted("s1", "assurance_level", json!("single_device"))
            .issue(&issuer, "did:iss#key-0");

        // Forge a disclosure claiming hardware_backed and splice it in.
        let forged = Disclosure::with_salt("s1", "assurance_level", json!("hardware_backed")).encoded();
        let jws = compact.split('~').next().unwrap();
        let tampered = format!("{jws}~{forged}~");
        // its digest won't be in _sd → rejected
        assert!(verify_issuer(&tampered, &pk).is_err());
    }

    #[test]
    fn test_holder_binding_jwk_in_payload() {
        let issuer = KeyPair::generate();
        let holder = KeyPair::generate();
        let compact = SdJwtVc::new("Web4Presence", "did:iss")
            .holder_binding(&holder.verifying_key())
            .claim("sub", json!("did:holder"))
            .issue(&issuer, "did:iss#key-0");
        let payload_b64 = compact.split('~').next().unwrap().split('.').nth(1).unwrap();
        let payload: Value = serde_json::from_slice(&unb64(payload_b64).unwrap()).unwrap();
        assert_eq!(payload["cnf"]["jwk"]["kty"], json!("OKP"));
        assert_eq!(payload["cnf"]["jwk"]["crv"], json!("Ed25519"));
        assert!(payload["cnf"]["jwk"]["x"].is_string());
    }

    #[test]
    fn test_present_and_verify_presentation() {
        let issuer = KeyPair::generate();
        let holder = KeyPair::generate();
        let issued = SdJwtVc::new("Web4Presence", "did:iss")
            .holder_binding(&holder.verifying_key())
            .claim("sub", json!("did:holder"))
            .sd_claim_salted("s1", "assurance_level", json!("multi_device"))
            .sd_claim_salted("s2", "email", json!("dp@metalinxx.io"))
            .issue(&issuer, "did:iss#key-0");

        // Holder presents to verifier "did:verifier" with nonce, revealing only
        // assurance_level.
        let vp = present(&issued, &holder, "nonce-xyz", "did:verifier", 1_700_000_000,
            Some(&["assurance_level"])).unwrap();

        let v = verify_presentation(&vp, &issuer.verifying_key(),
            "nonce-xyz", "did:verifier", 300, 1_700_000_100).unwrap();
        assert_eq!(v.claims.get("assurance_level").unwrap(), &json!("multi_device"));
        assert!(!v.claims.contains_key("email")); // withheld at presentation
        assert!(v.claims.contains_key("sub"));     // always-disclosed
    }

    #[test]
    fn test_presentation_nonce_mismatch_rejected() {
        let issuer = KeyPair::generate();
        let holder = KeyPair::generate();
        let issued = SdJwtVc::new("Web4Presence", "did:iss")
            .holder_binding(&holder.verifying_key())
            .sd_claim_salted("s1", "x", json!(1))
            .issue(&issuer, "did:iss#key-0");
        let vp = present(&issued, &holder, "good-nonce", "did:v", 1000, None).unwrap();
        // verifier expects a different nonce → reject (replay defense)
        assert!(verify_presentation(&vp, &issuer.verifying_key(), "bad-nonce", "did:v", 300, 1000).is_err());
        // wrong audience → reject
        assert!(verify_presentation(&vp, &issuer.verifying_key(), "good-nonce", "other-v", 300, 1000).is_err());
    }

    #[test]
    fn test_presentation_wrong_holder_key_rejected() {
        let issuer = KeyPair::generate();
        let holder = KeyPair::generate();
        let imposter = KeyPair::generate();
        let issued = SdJwtVc::new("Web4Presence", "did:iss")
            .holder_binding(&holder.verifying_key())
            .sd_claim_salted("s1", "x", json!(1))
            .issue(&issuer, "did:iss#key-0");
        // imposter (not the cnf key) tries to present → KB-JWT sig won't match cnf
        let vp = present(&issued, &imposter, "n", "did:v", 1000, None).unwrap();
        assert!(verify_presentation(&vp, &issuer.verifying_key(), "n", "did:v", 300, 1000).is_err());
    }

    #[test]
    fn test_web4_presence_helper() {
        let issuer = KeyPair::generate();
        let pk = issuer.verifying_key();
        let compact = web4_presence_credential("did:iss", "did:sub", "multi_device")
            .issue(&issuer, "did:iss#key-0");
        let v = verify_issuer(&compact, &pk).unwrap();
        assert_eq!(v.vct, "Web4Presence");
        assert_eq!(v.claims.get("sub").unwrap(), &json!("did:sub"));
        assert_eq!(v.claims.get("assurance_level").unwrap(), &json!("multi_device"));
    }
}