addRequestCredentials

Require verifiable credentials for this service specifically.

The service-level counterpart of AssetBuilder.addRequestCredentials. The policy server merges both when deciding whether a presentation is needed.

Usage

import { CredentialListTypes } from '@deltadao/nautilus'
 
serviceBuilder.addRequestCredentials(CredentialListTypes.ALLOW, [ 
  { type: 'VerifiableId', format: 'jwt_vc_json' } 
]) 

Each entry can carry its own policies, a policy name or { policy, args }, checked against that credential only. nautilus stores each one JSON-encoded ('signature' becomes '"signature"'), the form the policy server parses and the enterprise market writes; the policy server skips a per-credential policy that is not valid JSON.

This is where policies with arguments belong. The policy server keeps the arguments of per-credential policies, but drops those of asset- and service-level VC policies, so issuer trust goes here:

{
  type: 'gx:LegalPerson',
  format: 'jwt_vc_json',
  policies: [
    // Only credentials of this type from these issuers count. A credential of
    // another type skips this check: see the warning below.
    { policy: 'allowed-issuer', args: ['did:web:delta-dao.com'] }
  ]
}

args is passed to the walt.id verifier as given: allowed-issuer takes one issuer DID or a list of them.

Requested credentials are one part of a gate; the VC and VP policies of the recommended set are the other. This method takes no VC or VP policies today, so a service-level gate runs only with the policy server's own DEFAULT_VC_POLICIES and DEFAULT_VP_POLICIES. Its operator sets those; the deployed values are unknown, so { policy: 'signature' } on the presentation may not run at all. Per-service VC and VP policies are a planned SDK change.

Don't work around it with AssetBuilder.setVcPolicies or setVpPolicies on an asset whose other services need no credential. Those write an asset-level SSIpolicy without request_credentials, and the policy server then refuses every such service ("SSIpolicy was found, but failed to fetch request credentials"). When every service needs the credential, gate the asset with AssetBuilder.addRequestCredentials and the recommended set instead.

Returns

• Type: ServiceBuilder

The service builder instance, to chain further calls with.