CredentialProvider

The interface nautilus calls to answer a verifiable-presentation request. One method.

nautilus opens the policy-server session itself (PolicySessionResolver): it starts the verification, reads the session id and, after the presentation, checks that the verifier accepted it. A provider does only the step in between: answering the openid4vp request from a wallet. It is called only for a service whose SSIpolicy asks for credentials; a service gated by addresses only needs no provider.

class MyProvider implements CredentialProvider {
  async present(challenge: CredentialChallenge): Promise<void> { 
    challenge.asset
    challenge.serviceId
    challenge.consumerAddress
    challenge.node // the node that opened the session and will enforce it
    challenge.sessionId // the session the policy server opened
    challenge.redirectUri // the openid4vp request to answer
  }
}

Resolve once the verifier has the presentation. Throw only when you could not present at all (no matching credential, a rejected request): whether the verifier accepted it is checked by nautilus afterwards, and a presentation it did not accept is a PolicyDeniedError.

When present() throws, nautilus asks the verifier's record of the session which policies failed. If it names some, the caller gets a PolicyDeniedError with them and your error as its cause; otherwise your error as you threw it. To skip that read when your provider failed before the verifier saw anything, throw a CredentialPresentationError with a reason other than 'verifier-rejected' (e.g. 'no-matching-credential'). Keep the session id, the openid4vp request and the wallet's redirect URI out of your error's message and fields: the session id is a credential, and apps log errors.

Implementations