feat: jarm

[auer-martin]

Some left todos.

• Either
  • Allow passing in the encrypted response as string to the lib and decrypt inside the vp library
  • Decrypt outside
• Move MdocVerifiablePresentation to the SSI SDK. (Should not be a class)
  The version is currently not inferred correctly. This is probably due to a type issue with the MDOC presentation definition input.
• No Revocation Verification for Mdoc
• Nonce handling
• Authorization Response Encryption key extraction. (Maybe we should just allow passing in the jwk instead of extracting the encryption jwk from the metadata)
• Pex Integration

[sanderPostma]

This is going to clash with our mdoc support branch which is soon to be merged.
See https://github.com/Sphereon-Opensource/SSI-SDK/blob/f6f9cace14a1cee5340ecf0db1c0606d42159084/packages/ssi-types/src/types/vc.ts#L21

[TimoGlastra]

This is going to clash with our mdoc support branch which is soon to be merged.

I think it's best if we update to your mdoc support then as the todo comments also mentions "Move MdocVerifiablePresentation to the SSI SDK. (Should not be a class)". So if you added the needed types to the ssi-sdk we can cross that one off :)

[TimoGlastra]

Either

• Allow passing in the encrypted response as string to the lib and decrypt inside the vp library
• Decrypt outside

I think we should allow passing in the encrypted response. Same like we allow passing the signed request.

• Authorization Response Encryption key extraction. (Maybe we should just allow passing in the jwk instead of extracting the encryption jwk from the metadata)

I think for the Funke we need to extract it from jwks in the client_metadata. So maybe we can allow to pass a key, but if it's not provided we try to extract it from the metadata? I think for most normal cases it'll then work out of the box, as long as you provide a decryption callback.

Pex Integration

@sanderPostma I saw you also had some MDOC integration work in the PEX library. Is the idea that PEX will support MDOC natively, and that it can also process e.g. a submission including both mdoc and sd-jwt presentations?

[auer-martin]

I will start moving the external depdency. Are you okay with the general abstractions?

[nklomp]

See remark about kid in the callback interface. Rest looks okay to proceed

[TimoGlastra]

It seems this test is failing @auer-martin

succeed in a full flow with the client using OpenID4VCI version 11 and jwt_vc_json

[nklomp]

Some small remarks. The client_id aud validation seems to be incorrect

[TimoGlastra]

Is this ready to merge now @nklomp?

[nklomp]

Yes, needed to do a round of testing