tba-profile-credential-sd-jwt-vc 0.4.0.dev2__tar.gz

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,16 @@
+Metadata-Version: 2.4
+Name: tba-profile-credential-sd-jwt-vc
+Version: 0.4.0.dev2
+Summary: 
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-concrete-claim-credential-status (==0.4.0.dev2)
+Requires-Dist: tba-concrete-claim-credential-type (==0.4.0.dev2)
+Requires-Dist: tba-concrete-sd-jwt (==0.4.0.dev2)
+Requires-Dist: tba-concrete-sd-jwt-vc-credential (==0.4.0.dev2)
+Requires-Dist: tba-contracts-identity (==0.4.0.dev2)

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,10 @@
+[project]
+name="tba-profile-credential-sd-jwt-vc"
+version="0.4.0.dev2"
+requires-python=">=3.10,<3.15"
+dependencies=["tba-contracts-identity==0.4.0.dev2","tba-concrete-claim-credential-type==0.4.0.dev2","tba-concrete-claim-credential-status==0.4.0.dev2","tba-concrete-sd-jwt==0.4.0.dev2","tba-concrete-sd-jwt-vc-credential==0.4.0.dev2"]
+[build-system]
+requires=["poetry-core>=1.0.0"]
+build-backend="poetry.core.masonry.api"
+[tool.poetry]
+packages=[{include="tba_profile_credential_sd_jwt_vc",from="src"}]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/__init__.py

@@ -0,0 +1,91 @@
+"""Versioned SD-JWT VC draft-profile ownership."""
+
+from tba_contracts_identity.protocol_processing import (
+    build_protocol_capability_report,
+)
+
+from .bindings import CAPABILITY_REQUIREMENTS
+from .artifact import parse_sd_jwt_vc
+from .claims import (
+    SD_JWT_VC_CLAIM_CLASSES,
+    SdJwtVcClaimSetPayload,
+    compose_sd_jwt_vc_claim_set,
+    parse_sd_jwt_vc_claims,
+)
+from .compatibility import (
+    COMPATIBILITY_PATHS,
+    SdJwtVcCompatibility,
+    compatibility,
+)
+from .errors import (
+    SdJwtVcKeyBindingError,
+    SdJwtVcProfileError,
+    UnsupportedSdJwtVcMediaTypeError,
+)
+from .features import FEATURES_BY_VERSION, supports
+from .migrations import migrate_claims
+from .metadata import SdJwtVcTypeMetadata, parse_type_metadata
+from .schemas import (
+    LEGACY_SD_JWT_VC_TYP,
+    SD_JWT_VC_CARRIER,
+    SdJwtVcCarrier,
+    select_carrier,
+)
+from .versions import CURRENT_VERSION, VERSION_HISTORY, SdJwtVcVersion, select_version
+from .status import SdJwtVcStatusReference, parse_status_reference
+from .validation import validate_sd_jwt_vc
+from tba_concrete_sd_jwt_vc_credential import SdJwtVcCredential
+
+DRAFT_REVISION = "draft-ietf-oauth-sd-jwt-vc-17"
+MEDIA_TYPE = SD_JWT_VC_CARRIER.media_type
+TYP = SD_JWT_VC_CARRIER.typ
+SdJwtVc = SdJwtVcCredential
+
+
+def capability_report() -> dict[str, object]:
+    return build_protocol_capability_report(
+        protocol="sd-jwt-vc",
+        revision=CURRENT_VERSION.identifier,
+        features=tuple(FEATURES_BY_VERSION[CURRENT_VERSION.identifier]),
+        evidence_links=("tests/unit/test_versioned_eat_sd_jwt_vc_profiles.py",),
+        extra_requirements=CAPABILITY_REQUIREMENTS,
+        include_default_artifact_requirements=False,
+    )
+
+
+__all__ = [
+    "CAPABILITY_REQUIREMENTS",
+    "COMPATIBILITY_PATHS",
+    "CURRENT_VERSION",
+    "DRAFT_REVISION",
+    "FEATURES_BY_VERSION",
+    "LEGACY_SD_JWT_VC_TYP",
+    "MEDIA_TYPE",
+    "SD_JWT_VC_CARRIER",
+    "SD_JWT_VC_CLAIM_CLASSES",
+    "SdJwtVcClaimSetPayload",
+    "SdJwtVcCredential",
+    "SdJwtVcStatusReference",
+    "SdJwtVcTypeMetadata",
+    "VERSION_HISTORY",
+    "SdJwtVcCarrier",
+    "SdJwtVc",
+    "SdJwtVcCompatibility",
+    "SdJwtVcKeyBindingError",
+    "SdJwtVcProfileError",
+    "SdJwtVcVersion",
+    "TYP",
+    "UnsupportedSdJwtVcMediaTypeError",
+    "capability_report",
+    "compatibility",
+    "compose_sd_jwt_vc_claim_set",
+    "migrate_claims",
+    "parse_sd_jwt_vc",
+    "parse_sd_jwt_vc_claims",
+    "parse_status_reference",
+    "parse_type_metadata",
+    "select_carrier",
+    "select_version",
+    "supports",
+    "validate_sd_jwt_vc",
+]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/artifact.py

@@ -0,0 +1,29 @@
+import base64
+import json
+from typing import Mapping
+
+from tba_concrete_sd_jwt import parse_sd_jwt_serialization
+from tba_concrete_sd_jwt_vc_credential import SdJwtVcCredential
+
+
+def _decode_object(segment: str) -> Mapping[str, object]:
+    try:
+        value = json.loads(
+            base64.urlsafe_b64decode(segment + "=" * (-len(segment) % 4))
+        )
+    except (ValueError, UnicodeDecodeError) as exc:
+        raise ValueError("invalid SD-JWT VC JSON segment") from exc
+    if not isinstance(value, dict):
+        raise ValueError("SD-JWT VC segment must be an object")
+    return value
+
+
+def parse_sd_jwt_vc(value: str) -> SdJwtVcCredential:
+    serialization = parse_sd_jwt_serialization(value)
+    header_segment, claims_segment, _ = serialization.issuer_jwt.split(".")
+    return SdJwtVcCredential(
+        serialization, _decode_object(header_segment), _decode_object(claims_segment)
+    )
+
+
+__all__ = ["parse_sd_jwt_vc"]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/bindings.py

@@ -0,0 +1,37 @@
+"""SD-JWT VC wire operations mapped to reportable capabilities."""
+
+from tba_contracts_identity.capabilities import ProtocolCapabilityRequirement
+
+from .versions import CURRENT_VERSION
+
+CAPABILITY_REQUIREMENTS = (
+    ProtocolCapabilityRequirement(
+        "sd-jwt-vc",
+        CURRENT_VERSION.identifier,
+        "sd-jwt-vc-decode",
+        "application/dc+sd-jwt",
+        "artifact.processing",
+        "decode",
+        "sd-jwt-vc-disclosures",
+    ),
+    ProtocolCapabilityRequirement(
+        "sd-jwt-vc",
+        CURRENT_VERSION.identifier,
+        "sd-jwt-vc-validation",
+        "issuer-signed JWT and disclosures",
+        "artifact.processing",
+        "validate",
+        "verified-sd-jwt-vc",
+    ),
+    ProtocolCapabilityRequirement(
+        "sd-jwt-vc",
+        CURRENT_VERSION.identifier,
+        "sd-jwt-vc-encode",
+        "application/dc+sd-jwt",
+        "artifact.processing",
+        "encode",
+        "sd-jwt-vc",
+    ),
+)
+
+__all__ = ["CAPABILITY_REQUIREMENTS"]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/claims.py

@@ -0,0 +1,66 @@
+"""SD-JWT VC claim-set composition."""
+
+from dataclasses import dataclass
+from typing import Mapping
+
+from tba_concrete_claim_credential_status import CredentialStatusClaim
+from tba_concrete_claim_credential_type import CredentialTypeClaim
+from tba_contracts_identity.claims import ClaimSet
+
+from .versions import CURRENT_VERSION
+
+SD_JWT_VC_CLAIM_CLASSES = (CredentialTypeClaim, CredentialStatusClaim)
+
+
+@dataclass(frozen=True, slots=True)
+class SdJwtVcClaimSetPayload:
+    credential_type: str
+    issuer: str | None = None
+    issued_at: int | None = None
+    not_before: int | None = None
+    expiration: int | None = None
+    confirmation: Mapping[str, object] | None = None
+    status: Mapping[str, object] | None = None
+    type_integrity: str | None = None
+
+
+def parse_sd_jwt_vc_claims(claims: Mapping[str, object]) -> SdJwtVcClaimSetPayload:
+    credential_type = claims.get("vct")
+    if not isinstance(credential_type, str) or not credential_type:
+        raise ValueError("SD-JWT VC requires a non-empty vct claim")
+    for name in ("iat", "nbf", "exp"):
+        value = claims.get(name)
+        if value is not None and (
+            not isinstance(value, int) or isinstance(value, bool)
+        ):
+            raise ValueError(f"{name} must be a NumericDate")
+    for name in ("cnf", "status"):
+        if name in claims and not isinstance(claims[name], Mapping):
+            raise ValueError(f"{name} must be an object")
+    integrity = claims.get("vct#integrity")
+    if integrity is not None and (not isinstance(integrity, str) or not integrity):
+        raise ValueError("vct#integrity must be an integrity metadata string")
+    return SdJwtVcClaimSetPayload(
+        credential_type,
+        claims.get("iss") if isinstance(claims.get("iss"), str) else None,
+        claims.get("iat"),
+        claims.get("nbf"),
+        claims.get("exp"),
+        claims.get("cnf"),
+        claims.get("status"),
+        integrity,
+    )
+
+
+def compose_sd_jwt_vc_claim_set(*claims: object) -> ClaimSet:
+    if not any(isinstance(claim, CredentialTypeClaim) for claim in claims):
+        raise ValueError("SD-JWT VC requires vct")
+    return ClaimSet(tuple(claims), "sd-jwt-vc", CURRENT_VERSION.identifier)
+
+
+__all__ = [
+    "SD_JWT_VC_CLAIM_CLASSES",
+    "SdJwtVcClaimSetPayload",
+    "compose_sd_jwt_vc_claim_set",
+    "parse_sd_jwt_vc_claims",
+]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/compatibility.py

@@ -0,0 +1,37 @@
+"""SD-JWT VC draft compatibility paths."""
+
+from dataclasses import dataclass
+
+from .versions import CURRENT_VERSION, VERSION_HISTORY
+
+
+@dataclass(frozen=True, slots=True)
+class SdJwtVcCompatibility:
+    source: str
+    target: str
+    compatible: bool
+    migration_required: bool
+
+
+COMPATIBILITY_PATHS = tuple(
+    SdJwtVcCompatibility(
+        version.identifier,
+        CURRENT_VERSION.identifier,
+        True,
+        version.identifier != CURRENT_VERSION.identifier,
+    )
+    for version in VERSION_HISTORY
+)
+
+
+def compatibility(
+    source: str,
+    target: str = CURRENT_VERSION.identifier,
+) -> SdJwtVcCompatibility:
+    for path in COMPATIBILITY_PATHS:
+        if path.source == source and path.target == target:
+            return path
+    return SdJwtVcCompatibility(source, target, False, False)
+
+
+__all__ = ["COMPATIBILITY_PATHS", "SdJwtVcCompatibility", "compatibility"]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/errors.py

@@ -0,0 +1,20 @@
+"""SD-JWT VC profile mapping errors."""
+
+
+class SdJwtVcProfileError(ValueError):
+    """Base error for a selected SD-JWT VC draft mapping."""
+
+
+class UnsupportedSdJwtVcMediaTypeError(SdJwtVcProfileError):
+    """Raised when the current `dc+sd-jwt` carrier is not selected."""
+
+
+class SdJwtVcKeyBindingError(SdJwtVcProfileError):
+    """Raised when required KB-JWT holder binding is absent or invalid."""
+
+
+__all__ = [
+    "SdJwtVcKeyBindingError",
+    "SdJwtVcProfileError",
+    "UnsupportedSdJwtVcMediaTypeError",
+]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/features.py

@@ -0,0 +1,24 @@
+FEATURES_BY_VERSION = {
+    "draft-10": frozenset({"vct", "status", "key-binding"}),
+    "draft-13": frozenset({"vct", "status", "key-binding", "type-metadata"}),
+    "draft-17": frozenset(
+        {
+            "vct",
+            "status",
+            "key-binding",
+            "type-metadata",
+            "vct-integrity",
+            "dc-media-type",
+        }
+    ),
+}
+
+
+def supports(feature: str, version: str = "draft-17") -> bool:
+    try:
+        return feature in FEATURES_BY_VERSION[version]
+    except KeyError as exc:
+        raise ValueError(f"unsupported SD-JWT VC version: {version}") from exc
+
+
+__all__ = ["FEATURES_BY_VERSION", "supports"]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/metadata.py

@@ -0,0 +1,35 @@
+from dataclasses import dataclass
+from typing import Mapping, Sequence
+
+
+@dataclass(frozen=True, slots=True)
+class SdJwtVcTypeMetadata:
+    credential_type: str
+    name: str | None = None
+    description: str | None = None
+    extends: str | None = None
+    claim_metadata: Sequence[Mapping[str, object]] = ()
+
+
+def parse_type_metadata(value: Mapping[str, object]) -> SdJwtVcTypeMetadata:
+    credential_type = value.get("vct")
+    if not isinstance(credential_type, str) or not credential_type:
+        raise ValueError("type metadata requires vct")
+    claims = value.get("claims", ())
+    if not isinstance(claims, list) or not all(
+        isinstance(item, Mapping) for item in claims
+    ):
+        raise ValueError("type metadata claims must be an array of objects")
+    extends = value.get("extends")
+    if extends is not None and not isinstance(extends, str):
+        raise ValueError("extends must be a string")
+    return SdJwtVcTypeMetadata(
+        credential_type,
+        value.get("name") if isinstance(value.get("name"), str) else None,
+        value.get("description") if isinstance(value.get("description"), str) else None,
+        extends,
+        tuple(dict(item) for item in claims),
+    )
+
+
+__all__ = ["SdJwtVcTypeMetadata", "parse_type_metadata"]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/migrations.py

@@ -0,0 +1,16 @@
+from typing import Any, Mapping
+
+
+def migrate_claims(
+    value: Mapping[str, Any], *, source: str, target: str = "draft-17"
+) -> dict[str, Any]:
+    if source == target:
+        return dict(value)
+    if source not in {"draft-10", "draft-13"} or target != "draft-17":
+        raise ValueError(f"unsupported SD-JWT VC migration: {source} -> {target}")
+    if not isinstance(value.get("vct"), str):
+        raise ValueError("SD-JWT VC migration requires vct")
+    return dict(value)
+
+
+__all__ = ["migrate_claims"]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/schemas.py

@@ -0,0 +1,31 @@
+"""Selected SD-JWT VC carrier descriptors."""
+
+from dataclasses import dataclass
+
+from .errors import UnsupportedSdJwtVcMediaTypeError
+
+
+@dataclass(frozen=True, slots=True)
+class SdJwtVcCarrier:
+    media_type: str
+    typ: str
+
+
+SD_JWT_VC_CARRIER = SdJwtVcCarrier("application/dc+sd-jwt", "dc+sd-jwt")
+LEGACY_SD_JWT_VC_TYP = "vc+sd-jwt"
+
+
+def select_carrier(media_type: str) -> SdJwtVcCarrier:
+    if media_type != SD_JWT_VC_CARRIER.media_type:
+        raise UnsupportedSdJwtVcMediaTypeError(
+            f"unsupported SD-JWT VC media type: {media_type}"
+        )
+    return SD_JWT_VC_CARRIER
+
+
+__all__ = [
+    "LEGACY_SD_JWT_VC_TYP",
+    "SD_JWT_VC_CARRIER",
+    "SdJwtVcCarrier",
+    "select_carrier",
+]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/status.py

@@ -0,0 +1,28 @@
+from dataclasses import dataclass
+from typing import Mapping
+
+
+@dataclass(frozen=True, slots=True)
+class SdJwtVcStatusReference:
+    mechanism: str
+    index: int | None = None
+    uri: str | None = None
+
+
+def parse_status_reference(value: Mapping[str, object]) -> SdJwtVcStatusReference:
+    if len(value) != 1:
+        raise ValueError("status must select exactly one status mechanism")
+    mechanism, details = next(iter(value.items()))
+    if not isinstance(details, Mapping):
+        raise ValueError("status mechanism details must be an object")
+    index, uri = details.get("idx"), details.get("uri")
+    if index is not None and (
+        not isinstance(index, int) or isinstance(index, bool) or index < 0
+    ):
+        raise ValueError("status index must be a non-negative integer")
+    if uri is not None and (not isinstance(uri, str) or not uri):
+        raise ValueError("status URI must be a non-empty string")
+    return SdJwtVcStatusReference(mechanism, index, uri)
+
+
+__all__ = ["SdJwtVcStatusReference", "parse_status_reference"]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/validation.py

@@ -0,0 +1,37 @@
+from tba_concrete_sd_jwt import decode_disclosure, disclosure_digest
+from tba_concrete_sd_jwt_vc_credential import SdJwtVcCredential
+
+from .claims import parse_sd_jwt_vc_claims
+from .schemas import LEGACY_SD_JWT_VC_TYP, SD_JWT_VC_CARRIER
+from .status import parse_status_reference
+
+
+def validate_sd_jwt_vc(
+    credential: SdJwtVcCredential, *, accept_legacy_typ: bool = False
+) -> None:
+    accepted_types = (
+        {SD_JWT_VC_CARRIER.typ, LEGACY_SD_JWT_VC_TYP}
+        if accept_legacy_typ
+        else {SD_JWT_VC_CARRIER.typ}
+    )
+    if credential.header.get("typ") not in accepted_types:
+        raise ValueError("invalid SD-JWT VC typ")
+    parsed = parse_sd_jwt_vc_claims(credential.claims)
+    if parsed.status is not None:
+        parse_status_reference(parsed.status)
+    algorithm = str(credential.claims.get("_sd_alg", "sha-256")).replace("-", "")
+    referenced = credential.claims.get("_sd", [])
+    if not isinstance(referenced, list) or not all(
+        isinstance(item, str) for item in referenced
+    ):
+        raise ValueError("_sd must be an array")
+    seen = set()
+    for encoded in credential.disclosures:
+        decode_disclosure(encoded)
+        digest = disclosure_digest(encoded, algorithm)
+        if digest not in referenced or digest in seen:
+            raise ValueError("unreferenced or duplicate SD-JWT VC disclosure")
+        seen.add(digest)
+
+
+__all__ = ["validate_sd_jwt_vc"]

tba_profile_credential_sd_jwt_vc-0.4.0.dev2/src/tba_profile_credential_sd_jwt_vc/versions.py

@@ -0,0 +1,26 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class SdJwtVcVersion:
+    identifier: str
+    status: str
+    published: str
+
+
+VERSION_HISTORY = (
+    SdJwtVcVersion("draft-10", "superseded-draft", "2024-09"),
+    SdJwtVcVersion("draft-13", "superseded-draft", "2025-02"),
+    SdJwtVcVersion("draft-17", "active-draft", "2025-07"),
+)
+CURRENT_VERSION = VERSION_HISTORY[-1]
+
+
+def select_version(identifier: str = "draft-17") -> SdJwtVcVersion:
+    for version in VERSION_HISTORY:
+        if version.identifier == identifier:
+            return version
+    raise ValueError(f"unsupported SD-JWT VC version: {identifier}")
+
+
+__all__ = ["CURRENT_VERSION", "VERSION_HISTORY", "SdJwtVcVersion", "select_version"]