Merge pull request #389 from beyonkuhre/feat/mso_mdoc_transaction_data

Implement transaction data for mso_mdoc credentials

Author: phisakel

Package.resolved

@@ -17,7 +17,7 @@ let package = Package(
 		.package(url: "https://github.com/eu-digital-identity-wallet/eudi-lib-ios-wallet-storage.git", exact: "0.22.0"),
 		.package(url: "https://github.com/eu-digital-identity-wallet/eudi-lib-sdjwt-swift.git", exact: "0.14.6"),
 		.package(url: "https://github.com/eu-digital-identity-wallet/eudi-lib-ios-openid4vci-swift.git", exact: "0.40.2"),
-		.package(url: "https://github.com/eu-digital-identity-wallet/eudi-lib-ios-siop-openid4vp-swift.git", exact: "0.35.0"),
+		.package(url: "https://github.com/eu-digital-identity-wallet/eudi-lib-ios-openid4vp-swift.git", exact: "0.35.0"),
 		.package(url: "https://github.com/eu-digital-identity-wallet/eudi-lib-ios-statium-swift.git", exact: "0.4.0"),
     	.package(url: "https://github.com/apple/swift-docc-plugin", from: "1.5.0"),
 	],
@@ -29,7 +29,7 @@ let package = Package(
 			dependencies: [
 				.product(name: "MdocDataTransfer18013", package: "eudi-lib-ios-iso18013-data-transfer"),
 				.product(name: "WalletStorage", package: "eudi-lib-ios-wallet-storage"),
-				.product(name: "OpenID4VP", package: "eudi-lib-ios-siop-openid4vp-swift"),
+				.product(name: "OpenID4VP", package: "eudi-lib-ios-openid4vp-swift"),
 				.product(name: "OpenID4VCI", package: "eudi-lib-ios-openid4vci-swift"),
 				.product(name: "eudi-lib-sdjwt-swift", package: "eudi-lib-sdjwt-swift"),
 				.product(name: "StatiumSwift", package: "eudi-lib-ios-statium-swift"),

Package.swift

@@ -586,7 +586,7 @@ On view appearance the attestations are presented with the receiveRequest method
 	 _ = await presentationSession.receiveRequest()
 }
 ```
-After the request is received the ``presentationSession.disclosedDocumentSets`` contains an array of credential selection options. Each element is a `[DocElements]` representing one valid combination of credentials that satisfies the query. The selected state of the items can be modified via UI binding. Finally, the response is sent with the following code: 
+After the request is received the ``presentationSession.disclosedDocumentSets`` contains an array of credential selection options. Each element is a `[DocElements]` representing one valid combination of credentials that satisfies the query. The selected state of the items can be modified via UI binding. Finally, the response is sent with the following code. The optional `deviceNameSpacesToSend` parameter can be used to include device-signed namespaces in the response:
 
 ```swift
 // Use the first credential selection option (or let the user choose)

README.md

@@ -79,6 +79,8 @@ After the request is received, ``PresentationSession/disclosedDocumentSets`` con
 
 When partial-claim presentation is enabled, each option includes only the claims that are both requested and available. The selected state of the items can be modified via UI binding.
 
+The `deviceNameSpacesToSend` parameter allows including device-signed namespaces in the response. Pass a ``RequestDeviceNameSpaces`` value when device namespaces are needed, or omit it to send only issuer-signed data.
+
 ```swift
 // Example: use the first credential selection option
 let selectedOption = presentationSession.disclosedDocumentSets.first ?? []

Sources/EudiWalletKit/EudiWalletKit.docc/PresentationService.md

@@ -20,6 +20,7 @@ import struct OpenID4VP.PreregisteredClient
 import class OpenID4VP.JWSAlgorithm
 import enum OpenID4VP.WebKeySource
 import enum OpenID4VP.ResponseEncryptionConfiguration
+import struct OpenID4VP.SupportedTransactionDataType
 import enum OpenID4VP.ResponseMode
 
 /// Client identifier scheme for verifier authentication
@@ -99,21 +100,27 @@ public struct OpenId4VpConfiguration: Sendable {
 	/// from the Verifier's request. The response URI is always taken from the request.
 	/// When `nil`, the library uses the mode from the request (default behavior).
 	public let preferredResponseMode: PreferredResponseMode?
+	/// Configuration for supported transaction data types
+	///
+	/// When provided all request with transaction data will be validated against the list
+	public let supportedTransactionDataTypes: [SupportedTransactionDataType]
 
 	public static let defaultClientIdSchemes: [ClientIdScheme] = [.x509SanDns, .x509Hash, .redirectUri]
 
 	public init() {
 		self.clientIdSchemes = Self.defaultClientIdSchemes
 		self.responseEncryptionConfiguration = nil
 		self.allowPresentingPartialClaims = false
+		self.supportedTransactionDataTypes = []
 		self.preferredResponseMode = nil
 	}
 
-	public init(clientIdSchemes: [ClientIdScheme]? = nil, responseEncryptionConfiguration: ResponseEncryptionConfiguration? = nil, allowPresentingPartialClaims: Bool = false, preferredResponseMode: PreferredResponseMode? = nil) {
+	public init(clientIdSchemes: [ClientIdScheme]? = nil, responseEncryptionConfiguration: ResponseEncryptionConfiguration? = nil, allowPresentingPartialClaims: Bool = false, preferredResponseMode: PreferredResponseMode? = nil, supportedTransactionDataTypes: [SupportedTransactionDataType] = []) {
 		self.clientIdSchemes = clientIdSchemes ?? Self.defaultClientIdSchemes
 		self.responseEncryptionConfiguration = responseEncryptionConfiguration
 		self.allowPresentingPartialClaims = allowPresentingPartialClaims
 		self.preferredResponseMode = preferredResponseMode
+		self.supportedTransactionDataTypes = supportedTransactionDataTypes
 	}
 }
 

Sources/EudiWalletKit/Models/OpenId4VpConfiguration.swift

@@ -35,7 +35,7 @@ public final class BlePresentationService: @unchecked Sendable, PresentationServ
 	var continuationPowerOn: CheckedContinuation<Void, Error>?
 	var continuationRequest: CheckedContinuation<UserRequestInfo, Error>?
 	var continuationDisconnect: CheckedContinuation<Void, Error>?
-	var handleSelected: ((Bool, RequestItems?) async -> Void)?
+	var handleSelected: ((Bool, RequestItems?, RequestDeviceNameSpaces?) async -> Void)?
 	var request: UserRequestInfo?
 	var readBuffer = Data()
 	public var transactionLog: TransactionLog
@@ -151,7 +151,7 @@ public final class BlePresentationService: @unchecked Sendable, PresentationServ
 					continuationRequest?.resume(returning: decoded.userRequestInfo)
 					continuationRequest = nil
 				} else {
-					await userSelected(false, nil)
+					await userSelected(false, nil, nil)
 					let notAvailableMessage = "The requested document is not available in your EUDI Wallet. Please contact the authorised issuer for further information."
 					let userInfo = [NSLocalizedDescriptionKey: notAvailableMessage]
 					didFinishedWithError(NSError(domain: "\(MdocGattServer.self)", code: 0, userInfo: userInfo))
@@ -189,7 +189,7 @@ public final class BlePresentationService: @unchecked Sendable, PresentationServ
 		}
 	}
 
-	public func userSelected(_ b: Bool, _ items: RequestItems?) async {
+	public func userSelected(_ b: Bool, _ items: RequestItems?, _ deviceNameSpaces: RequestDeviceNameSpaces? = nil) async {
 		status = .userSelected
 		let resError = await MdocHelpers.getSessionDataToSend(sessionEncryption: sessionEncryption, status: .error, docToSend: DeviceResponse(status: 0))
 		var bytesToSend = try! resError.get()
@@ -207,7 +207,18 @@ public final class BlePresentationService: @unchecked Sendable, PresentationServ
 				let docTypeReq = deviceRequest?.docRequests.first?.itemsRequest.docType ?? ""
 				let compactDocMetadata = docMetadata.compactMapValues { $0 }
 				let eReaderKey = sessionEncryption!.sessionKeys.publicKey
-				guard let (drToSend, _, _, resMetadata, resDocIds, resZkpDocIds) = try await MdocHelpers.getDeviceResponseToSend(deviceRequest: deviceRequest!, issuerSigned: docs, docMetadata: compactDocMetadata, selectedItems: items, sessionEncryption: sessionEncryption, eReaderKey: eReaderKey, privateKeyObjects: privateKeyObjects, dauthMethod: dauthMethod, unlockData: unlockData, zkSystemRepository: zkSystemRepository) else {
+				guard let (drToSend, _, _, resMetadata, resDocIds, resZkpDocIds) = try await MdocHelpers.getDeviceResponseToSend(
+					deviceRequest: deviceRequest!,
+					issuerSigned: docs,
+					docMetadata: compactDocMetadata,
+					selectedItems: items,
+					sessionEncryption: sessionEncryption,
+					eReaderKey: eReaderKey,
+					privateKeyObjects: privateKeyObjects,
+					dauthMethod: dauthMethod,
+					unlockData: unlockData,
+					zkSystemRepository: zkSystemRepository,
+					deviceNameSpacesRequested: deviceNameSpaces) else {
 					errorToSend = MdocHelpers.getErrorNoDocuments(docTypeReq)
 					return
 				}
@@ -258,8 +269,10 @@ public final class BlePresentationService: @unchecked Sendable, PresentationServ
 	/// - Parameters:
 	///   - userAccepted: True if user accepted to send the response
 	///   - itemsToSend: The selected items to send organized in document types and namespaces
-	public func sendResponse(userAccepted: Bool, itemsToSend: RequestItems, onSuccess: (@Sendable (URL?) -> Void)?) async throws  {
-		await handleSelected?(userAccepted, itemsToSend)
+	///   - deviceNameSpacesToSend: Optional device-signed namespaces to include in the response
+	///   - onSuccess: Callback invoked on successful response with an optional redirect URL
+	public func sendResponse(userAccepted: Bool, itemsToSend: RequestItems, deviceNameSpacesToSend: RequestDeviceNameSpaces? = nil, onSuccess: (@Sendable (URL?) -> Void)?) async throws  {
+		await handleSelected?(userAccepted, itemsToSend, deviceNameSpacesToSend)
 		handleSelected = nil
 		TransactionLogUtils.setCborTransactionLogResponseInfo(self, transactionLog: &transactionLog)
 	}

Sources/EudiWalletKit/Services/BlePresentationService.swift

@@ -47,7 +47,7 @@ public final class FaultPresentationService: @unchecked Sendable, PresentationSe
 		throw error
 	}
 
-	public func sendResponse(userAccepted: Bool, itemsToSend: RequestItems,  onSuccess: ((URL?) -> Void)?) async throws{
+	public func sendResponse(userAccepted: Bool, itemsToSend: RequestItems, deviceNameSpacesToSend: RequestDeviceNameSpaces? = nil, onSuccess: ((URL?) -> Void)?) async throws{
 		throw error
 	}
 

Sources/EudiWalletKit/Services/FaultPresentationService.swift

@@ -28,6 +28,7 @@ import eudi_lib_sdjwt_swift
 import JOSESwift
 import Logging
 import X509
+import SwiftyJSON
 import struct OpenID4VP.ClaimPath
 import enum OpenID4VP.ClaimPathElement
 import struct WalletStorage.Document
@@ -66,6 +67,7 @@ public final class OpenId4VpService: @unchecked Sendable, PresentationService {
 	var zkSpecsRequested: [DocType: [ZkSystemSpec]]?
 	var networking: Networking
 	var unlockData: [String: Data]!
+	var verifierInfo: [VerifierInfo]?
 	public var transactionLog: TransactionLog
 	public var zkpDocumentIds: [WalletStorage.Document.ID]?
 	public var flow: FlowType
@@ -144,6 +146,8 @@ public final class OpenId4VpService: @unchecked Sendable, PresentationService {
 		vpNonce = vp.nonce; vpClientId = resolvedClientId
 		mdocGeneratedNonce = OpenId4VpUtils.generateMdocGeneratedNonce()	// Not longer required for SessionTranscript, use the verifier (client) nonce i.e vpNonce
 		sessionTranscript = SessionTranscript(handOver: OpenId4VpUtils.generateOpenId4VpHandover(clientId: resolvedClientId, responseUri: responseUri, nonce: vpNonce, jwkThumbprint: jwkThumbprint?.byteArray))
+		transactionData = vp.transactionData
+		verifierInfo = vp.verifierInfo
 
 		logger.info("Session Transcript: \(sessionTranscript.encode().toHexString()), for clientId: \(vp.client.id), responseUri: \(responseUri), nonce: \(vp.nonce), mdocGeneratedNonce: \(mdocGeneratedNonce!)")
 		// Only DCQL supported now
@@ -156,13 +160,29 @@ public final class OpenId4VpService: @unchecked Sendable, PresentationService {
 			let credentialSelectionSets = try OpenId4VpUtils.resolveDcql(
 				dcql, queryable: dcqlQueryable, allowPresentingPartialClaims: openID4VpConfig.allowPresentingPartialClaims)
 			let requestItemsArray = OpenId4VpUtils.getRequestItems(credentialSelectionSets, idsToDocTypes: transferInfo.idsToDocTypes, formatsRequested: formatsRequested)
-			self.transactionData = vp.transactionData
+			let transactionDataRequestedArray = transactionData != nil
+				? try OpenId4VpUtils.getTransactionDataRequested(
+					credentialSelectionSets,
+					transactionDataList: transactionData!)
+				: nil
+			let verifierInfoRequestedArray = verifierInfo != nil
+				? OpenId4VpUtils.getVerifierInfoRequested(credentialSelectionSets, verifierInfoList: verifierInfo!)
+				: nil
 			let certificateIssuerName = readerCertificateIssuer.map(MdocHelpers.getCN(from:))
 			let rar = ReaderAuthenticationResult(isValidated: readerAuthValidated, certificateIssuer: certificateIssuerName, validationMessage: readerCertificateValidationMessage, legalName: rrd.legalName, authBytes: nil, certificateChain: certificateChain)
 			var results = [UserRequestInfo]()
 			for (requestName, requestItems) in requestItemsArray {
+				let transactionDataRequested = transactionDataRequestedArray?.first(where: { $0.0 == requestName })
+				let verifierInfoRequested = verifierInfoRequestedArray?.first(where: { $0.0 == requestName })
 				//guard let requestItems, let formatsRequested else { throw PresentationSession.makeError(str: "Invalid request query") }
-				var result = UserRequestInfo(docDataFormats: formatsRequested, itemsRequested: requestItems, deviceRequestBytes: deviceRequestBytes, requestName: requestName)
+				var result = UserRequestInfo(
+					docDataFormats: formatsRequested,
+					itemsRequested: requestItems,
+					deviceRequestBytes: deviceRequestBytes,
+					transactionDataRequested: transactionDataRequested?.1,
+					verifierInfo: verifierInfoRequested?.1,
+					requestName: requestName
+				)
 				logger.info("Verifier requested items: \(requestItems.mapValues { $0.mapValues { ar in ar.map(\.elementIdentifier) } })")
 				result.readerAuthResults = ["": rar]
 				TransactionLogUtils.setCborTransactionLogRequestInfo(result, transactionLog: &transactionLog)
@@ -176,11 +196,23 @@ public final class OpenId4VpService: @unchecked Sendable, PresentationService {
 		docsCbor = transferInfo.documentObjects.filter { k,v in Self.filterFormat(transferInfo.dataFormats[k]!, fmt: .cbor)} .mapValues { try? IssuerSigned(data: $0.bytes) }.compactMapValues { $0 }
 	}
 
-	func generateCborVpToken(itemsToSend: RequestItems) async throws -> (VerifiablePresentation, Data, [Data?], [String]) {
+	func generateCborVpToken(itemsToSend: RequestItems, deviceNameSpacesToSend: RequestDeviceNameSpaces?) async throws -> (VerifiablePresentation, Data, [Data?], [String]) {
 		let docMetadata = transferInfo.docMetadata
 		let privateKeyObjects = transferInfo.privateKeyObjects
 		let zkSystemRepository = transferInfo.zkSystemRepository
-		let resp = try await MdocHelpers.getDeviceResponseToSend(deviceRequest: nil, issuerSigned: docsCbor, docMetadata: docMetadata, selectedItems: itemsToSend, eReaderKey: eReaderPub, privateKeyObjects: privateKeyObjects, sessionTranscript: sessionTranscript, dauthMethod: .deviceSignature, unlockData: unlockData, zkSpecsRequested: zkSpecsRequested, zkSystemRepository: zkSystemRepository)
+		let resp = try await MdocHelpers.getDeviceResponseToSend(
+			deviceRequest: nil,
+			issuerSigned: docsCbor,
+			docMetadata: docMetadata,
+			selectedItems: itemsToSend,
+			eReaderKey: eReaderPub,
+			privateKeyObjects: privateKeyObjects,
+			sessionTranscript: sessionTranscript,
+			dauthMethod: .deviceSignature,
+			unlockData: unlockData,
+			zkSpecsRequested: zkSpecsRequested,
+			zkSystemRepository: zkSystemRepository,
+			deviceNameSpacesRequested: deviceNameSpacesToSend)
 		guard let resp else { throw PresentationSession.makeError(str: "DOCUMENT_ERROR") }
 		let vpTokenData = Data(resp.deviceResponse.toCBOR(options: CBOROptions()).encode())
 		let vpTokenStr = vpTokenData.base64URLEncodedString()
@@ -209,7 +241,9 @@ public final class OpenId4VpService: @unchecked Sendable, PresentationService {
 	/// - Parameters:
 	///   - userAccepted: True if user accepted to send the response
 	///   - itemsToSend: The selected items to send organized in document types and namespaces
-	public func sendResponse(userAccepted: Bool, itemsToSend: RequestItems, onSuccess: ((URL?) -> Void)?) async throws {
+	///   - deviceNameSpacesToSend: Optional device-signed namespaces to include in the response
+	///   - onSuccess: Callback invoked on successful response with an optional redirect URL
+	public func sendResponse(userAccepted: Bool, itemsToSend: RequestItems, deviceNameSpacesToSend: RequestDeviceNameSpaces? = nil, onSuccess: ((URL?) -> Void)?) async throws {
 		guard dcql != nil, let resolved = resolvedRequestData else {
 			throw PresentationSession.makeError(str: "Unexpected error")
 		}
@@ -229,7 +263,7 @@ public final class OpenId4VpService: @unchecked Sendable, PresentationService {
 			if transferInfo.dataFormats[docId] == .cbor {
 				if docsCbor == nil { makeCborDocs() }
 				let itemsToSend1 = Dictionary(uniqueKeysWithValues: [(docId, nsItems)])
-				let vpToken = try await generateCborVpToken(itemsToSend: itemsToSend1)
+				let vpToken = try await generateCborVpToken(itemsToSend: itemsToSend1, deviceNameSpacesToSend: deviceNameSpacesToSend)
 				zkpDocumentIds!.append(contentsOf: vpToken.3)
 				inputToPresentations.append((inputDescrId, docId, vpToken.0))
 			} else if transferInfo.dataFormats[docId] == .sdjwt {
@@ -341,7 +375,18 @@ public final class OpenId4VpService: @unchecked Sendable, PresentationService {
 				case .preregistered(let clients): .preregistered(clients: Dictionary(uniqueKeysWithValues: clients.map { ($0.clientId, $0) }))
 			}
 		}
-		let res = OpenId4VPConfiguration(privateKey: privateKey, publicWebKeySet: keySet, supportedClientIdSchemes: supportedClientIdPrefixes, vpFormatsSupported: [], jarConfiguration: .encryptionOption, vpConfiguration: .default(), errorDispatchPolicy: .allClients, session: networking, responseEncryptionConfiguration: openID4VpConfig.responseEncryptionConfiguration ?? .default())
+		let res = OpenId4VPConfiguration(
+			privateKey: privateKey,
+			publicWebKeySet: keySet,
+			supportedClientIdSchemes: supportedClientIdPrefixes,
+			vpFormatsSupported: [],
+			jarConfiguration: .encryptionOption,
+			vpConfiguration: try! .init(
+				vpFormatsSupported: .default(),
+				supportedTransactionDataTypes: openID4VpConfig.supportedTransactionDataTypes),
+			errorDispatchPolicy: .allClients,
+			session: networking,
+			responseEncryptionConfiguration: openID4VpConfig.responseEncryptionConfiguration ?? .default())
 		return res
 	}