Repository navigation
feat: add an ehic scope releasing EHIC credential claims - #20
Merged
Merged
Conversation
EHIC could not be issued at all: vc's apigw maps the ehic scope to its
assertion data source (OIDC-backed), and requests the credential type as the
OIDC scope - Scopes: []string{session.CredentialType} in its OIDC RP
callback - but "ehic" was not in scopes_supported and no user carried EHIC
data.
Claims are emitted under the names the EHIC credential type
(urn:eudi:ehic:1) declares, because apigw uses the OIDC claims verbatim as
the credential's document data (DocumentData: claims). Anything named
differently simply isn't present to disclose later, and a verifier's DCQL
query for it won't match.
EHIC data is a nested struct on User rather than more flat fields: the EHIC
type nests issuing_authority and authentic_source as id+name objects, while
the "profile" scope releases issuing_authority as a plain string. The same
claim name means different shapes in the two credential types, so they can't
share one field.
"ehic" is added to the backwards-compat guard as well. Without that, an
ehic-only request - exactly what apigw sends - would match none of
profile/email/organisation, fall through to "return all claims", and
overwrite the EHIC objects with the profile string form.
Tested: the ehic scope releases the nested objects and no profile claims,
and a user without ehic data yields no EHIC claims rather than empty ones.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
EHIC cannot be issued at all in the SIROS stack.
vc's apigw maps theehicscope to its assertion (OIDC-backed) data source, and requests the credential type as the OIDC scope —Scopes: []string{session.CredentialType}in its OIDC RP callback. Butehicwasn't inscopes_supported, and no user carried EHIC data.Change
Adds an
ehicscope releasing the EHIC claim set, plus EHIC data for the three sample natural persons.Claims are emitted under the names the EHIC credential type (
urn:eudi:ehic:1) declares, because apigw uses the OIDC claims verbatim as the credential's document data (DocumentData: claims). Anything named differently simply isn't present to disclose later, and a verifier's DCQL query for it won't match.Two details worth flagging for review:
EHIC data is a nested struct on
User, not more flat fields. The EHIC type nestsissuing_authorityandauthentic_sourceasid+nameobjects, whereas theprofilescope releasesissuing_authorityas a plain string. The same claim name means different shapes in the two credential types, so they can't share one field.ehicis added to the backwards-compat guard. Without that, anehic-only request — exactly what apigw sends — would match none ofprofile/email/organisation, fall through to "return all claims", and overwrite the EHIC objects with the profile string form. That failure mode is covered by a test.Test plan
TestClaimsForScopesEHIC— the scope releases the nestedid+nameobjects and no profile claimsTestClaimsForScopesEHICOmittedWhenNil— a user without EHIC data yields no EHIC claims rather than empty onesgo build ./...andgo test ./...pass🤖 Generated with Claude Code