tba-profile-haip 0.4.0.dev2__tar.gz

tba_profile_haip-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,15 @@
+Metadata-Version: 2.4
+Name: tba-profile-haip
+Version: 0.4.0.dev2
+Summary: 
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
+Requires-Dist: tba-protocol-oid4vci (==0.4.0.dev2)
+Requires-Dist: tba-protocol-oid4vp (==0.4.0.dev2)

tba_profile_haip-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,11 @@
+[project]
+name="tba-profile-haip"
+version="0.4.0.dev2"
+requires-python=">=3.10,<3.15"
+license="Apache-2.0"
+dependencies=["tba-protocol-oid4vci==0.4.0.dev2","tba-protocol-oid4vp==0.4.0.dev2","tba-contracts-identity==0.4.0.dev2"]
+[build-system]
+requires=["poetry-core>=1.0.0"]
+build-backend="poetry.core.masonry.api"
+[tool.poetry]
+packages=[{include="tba_profile_haip",from="src"}]

tba_profile_haip-0.4.0.dev2/src/tba_profile_haip/__init__.py

@@ -0,0 +1,51 @@
+"""Versioned High Assurance Interoperability Profile ownership."""
+
+from tba_contracts_identity.protocol_processing import (
+    build_protocol_capability_report,
+)
+
+from .bindings import CAPABILITY_REQUIREMENTS
+from .claims import HAIP_PROOF_CLAIM_CLASSES
+from .compatibility import COMPATIBILITY_PATHS, HaipCompatibility, compatibility
+from .errors import HaipComponentVersionError, HaipProfileError, HaipTrustBindingError
+from .features import FEATURES_BY_VERSION, supports
+from .migrations import migrate_configuration
+from .profile import HAIP_CREDENTIAL_FORMATS, HaipConfiguration, configure_haip
+from .schemas import HaipComponentVersions, HaipCredentialFormats
+from .versions import CURRENT_VERSION, VERSION_HISTORY, HaipVersion, select_version
+
+
+def capability_report() -> dict[str, object]:
+    return build_protocol_capability_report(
+        protocol="haip",
+        revision=CURRENT_VERSION.identifier,
+        features=tuple(FEATURES_BY_VERSION[CURRENT_VERSION.identifier]),
+        evidence_links=("tests/unit/test_versioned_haip_profile.py",),
+        extra_requirements=CAPABILITY_REQUIREMENTS,
+        include_default_artifact_requirements=False,
+    )
+
+
+__all__ = [
+    "CAPABILITY_REQUIREMENTS",
+    "COMPATIBILITY_PATHS",
+    "CURRENT_VERSION",
+    "FEATURES_BY_VERSION",
+    "HAIP_CREDENTIAL_FORMATS",
+    "HAIP_PROOF_CLAIM_CLASSES",
+    "VERSION_HISTORY",
+    "HaipCompatibility",
+    "HaipComponentVersionError",
+    "HaipComponentVersions",
+    "HaipConfiguration",
+    "HaipCredentialFormats",
+    "HaipProfileError",
+    "HaipTrustBindingError",
+    "HaipVersion",
+    "capability_report",
+    "compatibility",
+    "configure_haip",
+    "migrate_configuration",
+    "select_version",
+    "supports",
+]

tba_profile_haip-0.4.0.dev2/src/tba_profile_haip/bindings.py

@@ -0,0 +1,73 @@
+"""HAIP profile requirements mapped to composed capabilities."""
+
+from tba_contracts_identity.capabilities import ProtocolCapabilityRequirement
+
+from .versions import CURRENT_VERSION
+
+CAPABILITY_REQUIREMENTS = (
+    ProtocolCapabilityRequirement(
+        "haip",
+        CURRENT_VERSION.identifier,
+        "haip-credential-issuance",
+        "OID4VCI credential response",
+        "digital-credential.issuance",
+        "issue",
+        "haip-credential",
+    ),
+    ProtocolCapabilityRequirement(
+        "haip",
+        CURRENT_VERSION.identifier,
+        "haip-wallet-attestation",
+        "wallet attestation",
+        "digital-credential.issuance",
+        "verify_wallet_attestation",
+        "verified-wallet-attestation",
+    ),
+    ProtocolCapabilityRequirement(
+        "haip",
+        CURRENT_VERSION.identifier,
+        "haip-presentation",
+        "OID4VP authorization response",
+        "digital-credential.presentation",
+        "present",
+        "haip-presentation-result",
+    ),
+    ProtocolCapabilityRequirement(
+        "haip",
+        CURRENT_VERSION.identifier,
+        "haip-presentation-verification",
+        "SD-JWT VC or mdoc presentation",
+        "digital-credential.presentation",
+        "verify_presentation",
+        "verified-haip-presentation",
+    ),
+    ProtocolCapabilityRequirement(
+        "haip",
+        CURRENT_VERSION.identifier,
+        "haip-artifact-validation",
+        "SD-JWT VC, KB-JWT, mdoc, or attestation artifact",
+        "artifact.processing",
+        "validate",
+        "verified-haip-artifact",
+    ),
+    ProtocolCapabilityRequirement(
+        "haip",
+        CURRENT_VERSION.identifier,
+        "haip-key-verifier-attestation",
+        "key or verifier attestation",
+        "attestation.appraisal",
+        "verify_evidence",
+        "verified-attestation-evidence",
+    ),
+    ProtocolCapabilityRequirement(
+        "haip",
+        CURRENT_VERSION.identifier,
+        "haip-replay-protection",
+        "nonce and transaction binding",
+        "security.replay-protection",
+        "check_and_reserve",
+        "haip:presentation-binding",
+    ),
+)
+
+__all__ = ["CAPABILITY_REQUIREMENTS"]

tba_profile_haip-0.4.0.dev2/src/tba_profile_haip/claims.py

@@ -0,0 +1,10 @@
+"""Claim families composed by HAIP from OID4VCI and OID4VP."""
+
+from tba_protocol_oid4vci.claims import OID4VCI_PROOF_CLAIM_CLASSES
+from tba_protocol_oid4vp.claims import OID4VP_BINDING_CLAIM_CLASSES
+
+HAIP_PROOF_CLAIM_CLASSES = tuple(
+    dict.fromkeys(OID4VCI_PROOF_CLAIM_CLASSES + OID4VP_BINDING_CLAIM_CLASSES)
+)
+
+__all__ = ["HAIP_PROOF_CLAIM_CLASSES"]

tba_profile_haip-0.4.0.dev2/src/tba_profile_haip/compatibility.py

@@ -0,0 +1,45 @@
+"""HAIP revision compatibility paths."""
+
+from dataclasses import dataclass
+
+from .versions import CURRENT_VERSION, VERSION_HISTORY
+
+
+@dataclass(frozen=True, slots=True)
+class HaipCompatibility:
+    source: str
+    target: str
+    compatible: bool
+    migration_required: bool
+    lossless: bool
+
+
+COMPATIBILITY_PATHS = (
+    HaipCompatibility(
+        VERSION_HISTORY[0].identifier,
+        CURRENT_VERSION.identifier,
+        True,
+        True,
+        False,
+    ),
+    HaipCompatibility(
+        CURRENT_VERSION.identifier,
+        CURRENT_VERSION.identifier,
+        True,
+        False,
+        True,
+    ),
+)
+
+
+def compatibility(
+    source: str,
+    target: str = CURRENT_VERSION.identifier,
+) -> HaipCompatibility:
+    for path in COMPATIBILITY_PATHS:
+        if path.source == source and path.target == target:
+            return path
+    return HaipCompatibility(source, target, False, False, False)
+
+
+__all__ = ["COMPATIBILITY_PATHS", "HaipCompatibility", "compatibility"]

tba_profile_haip-0.4.0.dev2/src/tba_profile_haip/errors.py

@@ -0,0 +1,16 @@
+"""HAIP profile composition errors."""
+
+
+class HaipProfileError(ValueError):
+    """Base error for an HAIP configuration or binding failure."""
+
+
+class HaipComponentVersionError(HaipProfileError):
+    """Raised when component protocol revisions are not profile-compatible."""
+
+
+class HaipTrustBindingError(HaipProfileError):
+    """Raised when required wallet/key/verifier trust evidence is unavailable."""
+
+
+__all__ = ["HaipComponentVersionError", "HaipProfileError", "HaipTrustBindingError"]

tba_profile_haip-0.4.0.dev2/src/tba_profile_haip/features.py

@@ -0,0 +1,36 @@
+FEATURES_BY_VERSION = {
+    "draft-03": frozenset(
+        {
+            "oid4vci",
+            "oid4vp",
+            "sd-jwt-vc",
+            "iso-mdoc",
+            "wallet-attestation",
+            "key-attestation",
+        }
+    ),
+    "1.0": frozenset(
+        {
+            "oid4vci-1.0",
+            "oid4vp-1.0",
+            "sd-jwt-vc",
+            "iso-mdoc",
+            "dcql",
+            "wallet-attestation",
+            "key-attestation",
+            "holder-binding",
+            "verifier-attestation",
+            "encrypted-responses",
+        }
+    ),
+}
+
+
+def supports(feature: str, version: str = "1.0") -> bool:
+    try:
+        return feature in FEATURES_BY_VERSION[version]
+    except KeyError as exc:
+        raise ValueError(f"unsupported HAIP version: {version}") from exc
+
+
+__all__ = ["FEATURES_BY_VERSION", "supports"]

tba_profile_haip-0.4.0.dev2/src/tba_profile_haip/migrations.py

@@ -0,0 +1,21 @@
+from typing import Any, Mapping
+
+
+def migrate_configuration(
+    value: Mapping[str, Any], *, source: str, target: str = "1.0"
+) -> dict[str, Any]:
+    if source == target:
+        return dict(value)
+    if source != "draft-03" or target != "1.0":
+        raise ValueError(f"unsupported HAIP migration: {source} -> {target}")
+    migrated = dict(value)
+    if "presentation_definition" in migrated:
+        raise ValueError(
+            "HAIP draft Presentation Exchange constraints require an explicit DCQL migration"
+        )
+    migrated["oid4vci_version"] = "1.0"
+    migrated["oid4vp_version"] = "1.0"
+    return migrated
+
+
+__all__ = ["migrate_configuration"]

tba_profile_haip-0.4.0.dev2/src/tba_profile_haip/profile.py

@@ -0,0 +1,35 @@
+from dataclasses import dataclass
+
+from tba_protocol_oid4vci import select_version as select_oid4vci_version
+from tba_protocol_oid4vp import select_version as select_oid4vp_version
+
+HAIP_CREDENTIAL_FORMATS = frozenset({"dc+sd-jwt", "mso_mdoc"})
+
+
+@dataclass(frozen=True, slots=True)
+class HaipConfiguration:
+    credential_formats: frozenset[str]
+    oid4vci_version: str = "1.0"
+    oid4vp_version: str = "1.0"
+    wallet_attestation: bool = True
+    key_attestation: bool = True
+
+    def validate(self) -> None:
+        select_oid4vci_version(self.oid4vci_version)
+        select_oid4vp_version(self.oid4vp_version)
+        unsupported = self.credential_formats - HAIP_CREDENTIAL_FORMATS
+        if unsupported:
+            raise ValueError(
+                f"unsupported HAIP credential formats: {sorted(unsupported)}"
+            )
+        if not self.credential_formats:
+            raise ValueError("HAIP requires at least one credential format")
+
+
+def configure_haip(*, credential_formats: frozenset[str]) -> HaipConfiguration:
+    configuration = HaipConfiguration(credential_formats)
+    configuration.validate()
+    return configuration
+
+
+__all__ = ["HAIP_CREDENTIAL_FORMATS", "HaipConfiguration", "configure_haip"]

tba_profile_haip-0.4.0.dev2/src/tba_profile_haip/schemas.py

@@ -0,0 +1,23 @@
+"""Typed HAIP component/profile schema descriptors."""
+
+from dataclasses import dataclass
+
+from .profile import HAIP_CREDENTIAL_FORMATS, HaipConfiguration
+
+
+@dataclass(frozen=True, slots=True)
+class HaipComponentVersions:
+    oid4vci: str = "1.0"
+    oid4vp: str = "1.0"
+
+
+@dataclass(frozen=True, slots=True)
+class HaipCredentialFormats:
+    allowed: frozenset[str] = HAIP_CREDENTIAL_FORMATS
+
+
+__all__ = [
+    "HaipComponentVersions",
+    "HaipConfiguration",
+    "HaipCredentialFormats",
+]

tba_profile_haip-0.4.0.dev2/src/tba_profile_haip/versions.py

@@ -0,0 +1,25 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class HaipVersion:
+    identifier: str
+    status: str
+    published: str
+
+
+VERSION_HISTORY = (
+    HaipVersion("draft-03", "superseded-draft", "2025-03"),
+    HaipVersion("1.0", "final", "2025-12-24"),
+)
+CURRENT_VERSION = VERSION_HISTORY[-1]
+
+
+def select_version(identifier: str = "1.0") -> HaipVersion:
+    for version in VERSION_HISTORY:
+        if version.identifier == identifier:
+            return version
+    raise ValueError(f"unsupported HAIP version: {identifier}")
+
+
+__all__ = ["CURRENT_VERSION", "VERSION_HISTORY", "HaipVersion", "select_version"]