addRequestCredentials

Require verifiable credentials to access the asset.

New in DDO v5, and the core of credential-gated access. Each entry names a credential type and the format it must be presented in.

See the identity guide for the consumer side.

Usage

import { CredentialListTypes } from '@deltadao/nautilus'
 
assetBuilder.addRequestCredentials(CredentialListTypes.ALLOW, [ 
  { type: 'VerifiableId', format: 'jwt_vc_json' }, 
  { type: 'UniversityDegree', format: 'jwt_vc_json' } 
]) 

Each entry can carry its own policies, a policy name or { policy, args }, checked against that credential only. nautilus stores each one JSON-encoded ('signature' becomes '"signature"'), the form the policy server parses and the enterprise market writes; the policy server skips a per-credential policy that is not valid JSON.

This is where policies with arguments belong. The policy server keeps the arguments of per-credential policies, but drops those of asset- and service-level VC policies, so issuer trust goes here:

{
  type: 'gx:LegalPerson',
  format: 'jwt_vc_json',
  policies: [
    // Only credentials of this type from these issuers count. A credential of
    // another type skips this check: see the warning below.
    { policy: 'allowed-issuer', args: ['did:web:delta-dao.com'] }
  ]
}

args is passed to the walt.id verifier as given: allowed-issuer takes one issuer DID or a list of them.

Requested credentials are one part of a gate. Pair them with the VC and VP policies of the recommended set, including { policy: 'signature' } among the VP policies, which checks the presentation's own signature.

Returns

• Type: AssetBuilder

The asset builder instance, to chain further calls with.