Repository navigation
Conversation
…fiers Reports are created under a strict policy, so that they show every problem; a lenient policy only requires the integrity of an artifact, e.g. to store a credential the user decided to keep. Verifiers of VC-K return a sealed AuthnResponseResult, and reject presentations of untrusted issuers by default, so the test verifiers use the lenient policy for credentials issued by ephemeral keys.
Map a ValidationReport to a serializable model with findings the user can understand, e.g. an untrusted signer, an expired certificate, a revoked status, or unregistered requests, and show it as a banner with the most important problems and a tree of every check. Which unsatisfied checks the user may continue past is decided by name, following the naming conventions of VC-K: trust, the validity period of the artifact, its status, and the registration of a relying party (linkage, requestAuthorization). Every other check blocks, including checks VC-K adds later.
Registration certificate providers are not published as a List of Trusted Entities, so their root certificates come from a bundled PEM file and from a PEM bundle at a URL configurable in the settings, persisted like trust lists.
Configure the validators of VC-K in the session: credentials are trusted per type through their List of Trusted Entities, relying parties and credential issuers through the WRPAC providers and the WRPRC anchors. HolderAgent takes the CredentialValidator, as its former validators no longer take effect, and issued credentials are stored if their integrity is intact, as before.
A report failing its integrity names the first check the user may not continue past, depth-first, with its cause, as rejection names the first unsatisfied check, which may be one the user may continue past, e.g. the trust in an issuer, and so hide the check that actually rejects the artifact. Describe every problem of a report for logs.
VC-K reports the WRPRCs a relying party transports, and the registration information of a credential issuer, in a check named registration, which the user may continue past like linkage and requestAuthorization. A missing WRPRC is shown as missing registration information.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the groundwork to use a-sit-plus/vck#716 in Valera. Written by Claude under close supervision.