Skip to content

Support OpenID4VP multi-signed request in Rust matcher #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
netheril96 merged 2 commits into from
Jul 24, 2026
Merged

Support OpenID4VP multi-signed request in Rust matcher #45

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fe11207
Support OpenID4VP multi-signed request in Rust matcher
QZHelen Jul 21, 2026
6a8e041
address reviewer feedback
QZHelen Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
78 changes: 76 additions & 2 deletions matcher-rs/src/openid4vp.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,51 @@
use crate::base64url::decode_base64url;
use crate::credman::CredmanApi;
use crate::json_value::JsonValue;
pub use crate::openid4vp_models::*;
use crate::reporter::report_match_result;
use nanoserde::DeJson;
use std::borrow::Cow;

fn extract_multisigned_payload<'a>(
pr: &'a ProtocolRequest,
) -> Result<String, Box<dyn std::error::Error>> {
let json_str: &str = if let Some(data) = &pr.data {
match data {
ProtocolRequestData::String(s) => s.as_str(),
ProtocolRequestData::Object(obj) => obj.request.as_str(),
}
} else if !pr.request.is_empty() {
pr.request.as_str()
} else {
return Err("Missing multisigned request data".into());
};

@netheril96 netheril96 Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This whole blocks let json_str = ... looks a lot like the ones in the beginning of parse_protocol_request_data. Shall we extract them out into a function?


let parsed: JsonValue = DeJson::deserialize_json(json_str)?;

let payload = match &parsed {

@netheril96 netheril96 Jul 21, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of match &parsed, write match parsed, then you don't need to clone the strings anymore.

JsonValue::Object(map) => {
if let Some(JsonValue::Object(req_map)) = map.get("request") {
if let Some(JsonValue::String(p)) = req_map.get("payload") {
p.clone()
} else {
return Err("Missing 'payload' in 'request' object".into());
}
} else if let Some(JsonValue::String(p)) = map.get("payload") {
p.clone()
} else {
return Err("Missing 'payload' field in multisigned request".into());
}
}
_ => return Err("Multisigned request must be a JSON object".into()),
};
Comment thread
QZHelen marked this conversation as resolved.

if payload.is_empty() {
return Err("Empty payload in multisigned request".into());
}

Ok(payload)
}

fn parse_protocol_request_data<'a>(
pr: &'a ProtocolRequest,
) -> Result<Cow<'a, OpenId4VpData>, Box<dyn std::error::Error>> {
Expand Down Expand Up @@ -36,7 +77,14 @@ fn parse_protocol_request_data<'a>(
return Ok(Cow::Owned(DeJson::deserialize_json(std::str::from_utf8(
&decoded,
)?)?));
}
} else if pr.protocol == "openid4vp-v1-multisigned" {
log::debug!("Handling multisigned OpenID4VP request");
let payload_str = extract_multisigned_payload(pr)?;
let decoded = decode_base64url(&payload_str)?;
return Ok(Cow::Owned(DeJson::deserialize_json(std::str::from_utf8(
&decoded,
)?)?));
}

log::debug!("Handling unsigned OpenID4VP request");
if let Some(data) = &pr.data {
Expand Down Expand Up @@ -110,7 +158,10 @@ pub fn openid4vp_main(credman: &mut impl CredmanApi) -> Result<(), Box<dyn std::
continue;
}
log::debug!("Processing request {}: protocol={}", i, pr.protocol);
if pr.protocol != "openid4vp-v1-unsigned" && pr.protocol != "openid4vp-v1-signed" {
if pr.protocol != "openid4vp-v1-unsigned"
&& pr.protocol != "openid4vp-v1-signed"
&& pr.protocol != "openid4vp-v1-multisigned"
{
log::warn!("Unsupported protocol: {}", pr.protocol);
continue;
}
Expand Down Expand Up @@ -173,6 +224,28 @@ mod tests {
assert!(err.to_string().contains("Missing unsigned request data"));
}

#[test]
fn test_parse_protocol_request_data_multisigned_valid() {
let json = r#"{
"protocol": "openid4vp-v1-multisigned",
"data": "{\"request\": {\"payload\": \"eyJkY3FsX3F1ZXJ5Ijp7ImNyZWRlbnRpYWxzIjpbXX19\"}}"
}"#;
let pr: ProtocolRequest = DeJson::deserialize_json(json).unwrap();
let data = parse_protocol_request_data(&pr).unwrap();
assert!(data.dcql_query.is_some());
}

#[test]
fn test_parse_protocol_request_data_multisigned_invalid_payload() {
let json = r#"{
"protocol": "openid4vp-v1-multisigned",
"data": "{\"request\": {}}"
}"#;
let pr: ProtocolRequest = DeJson::deserialize_json(json).unwrap();
let err = parse_protocol_request_data(&pr).unwrap_err();
assert!(err.to_string().contains("Missing 'payload'"));
}

use crate::test_utils::*;

macro_rules! define_test {
Expand Down Expand Up @@ -221,6 +294,7 @@ mod tests {
);
define_test!(tc30_parse_v1_unsigned, "TC30_ParseV1Unsigned");
define_test!(tc31_parse_v1_signed, "TC31_ParseV1Signed");
define_test!(tc42_parse_v1_multisigned, "TC42_ParseV1Multisigned");
define_test!(tc32_extract_payment_sca1, "TC32_ExtractPaymentSca1");
define_test!(tc33_extract_payment_details, "TC33_ExtractPaymentDetails");
define_test!(tc34_extract_payment_generic, "TC34_ExtractPaymentGeneric");
Expand Down
139 changes: 139 additions & 0 deletions matcher-rs/testdata/TC42_ParseV1Multisigned_expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,139 @@
{
"entrySets": {
"req:0;null": {
"entries": {
"0": {
"mdoc_cred_1": {
"additional_info": "",
"credId": "mdoc_cred_1",
"disclaimer": "",
"fields": [
[
"Family Name",
"Doe"
],
[
"Given Name",
"John"
],
[
"Age",
""
],
[
"Over 21",
"Yes"
]
],
"merchant_name": "",
"metadata_display_text": "",
"subtitle": "",
"title": "John's Driving License",
"transaction_amount": "",
"type": "Verification",
"warning": ""
},
"mdoc_cred_3": {
"additional_info": "",
"credId": "mdoc_cred_3",
"disclaimer": "",
"fields": [
[
"Family Name",
""
],
[
"Given Name",
""
],
[
"Age",
""
],
[
"Over 21",
""
]
],
"merchant_name": "",
"metadata_display_text": "",
"subtitle": "",
"title": "Alice's Driving License",
"transaction_amount": "",
"type": "Verification",
"warning": ""
},
"mdoc_cred_4": {
"additional_info": "",
"credId": "mdoc_cred_4",
"disclaimer": "",
"fields": [
[
"Family Name",
""
],
[
"Given Name",
""
],
[
"Age",
""
],
[
"Over 21",
""
]
],
"merchant_name": "",
"metadata_display_text": "",
"subtitle": "",
"title": "Jane's Driving License",
"transaction_amount": "",
"type": "Verification",
"warning": ""
},
"mdoc_cred_underage": {
"additional_info": "",
"credId": "mdoc_cred_underage",
"disclaimer": "",
"fields": [
[
"Age",
""
],
[
"Over 21",
"Yes"
]
],
"merchant_name": "",
"metadata_display_text": "",
"subtitle": "",
"title": "Underage License",
"transaction_amount": "",
"type": "Verification",
"warning": ""
}
}
},
"setId": "req:0;null",
"setLength": 1
}
},
"standaloneEntries": [
{
"additional_info": "",
"credId": "issuance_mdl_1",
"disclaimer": "",
"fields": [],
"merchant_name": "",
"metadata_display_text": "",
"subtitle": "From your local DMV",
"title": "Get a New mDL",
"transaction_amount": "",
"type": "InlineIssuance",
"warning": ""
}
]
}
10 changes: 10 additions & 0 deletions matcher-rs/testdata/TC42_ParseV1Multisigned_request.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"requests": [
{
"data": {
"request": "{\"payload\":\"eyJkY3FsX3F1ZXJ5Ijp7ImNyZWRlbnRpYWxzIjpbeyJmb3JtYXQiOiJtc29fbWRvYyIsImlkIjoibWRsIiwibWV0YSI6eyJkb2N0eXBlX3ZhbHVlIjoib3JnLmlzby4xODAxMy41LjEubURMIn19XX19\"}"
},
"protocol": "openid4vp-v1-multisigned"
}
]
}
Loading