Support more than two `path` entries for mdoc based DCQL queries
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 112
- Forks
- 38
- Avg merge
- 12d 19h
- Merged PRs (30d)
- 4
Description
The Mdoc DCQL query path MUST contain exactly two string elements: The namespace and the claim_name (which were originally two params named like this).
It can be useful for querying to allow more path elements to be provided. Mdoc only supports disclosing on the claim_name level, but the DCQL query can assist with users only sharing a credential that is applicable.
One notable example that is not possible currently with mdoc credentials: ensuring a string value is present in an array value. For example, i I want to check that your nationality includes NL. With SD-JWT-VC you can write:
{
"path": ["nationalities", null],
"values": ["NL"]
}
But with mDoc a similar syntax is not allowed (MUST be exactly two string components referencing namespace and claim name).
I think one of the arguments previously was that there's no definition how a path translates to an mdoc CBOR structure, however such a definitions has already been added to the OpenID4VCI spec for the metadata path: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-semantics-for-iso-mdoc-base.
When processing the DCQL query for matching which attributes will be disclosed it's still quite simple: you just ensure the first two params of each claim query are always string, and extract the namespace and claim name out of them, and disclosure those attributes in the device response.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository file or test is named in the issue. Start by locating DCQL mdoc path validation and matching, then read the OpenID4VCI metadata path semantics linked in the issue. Done means paths may contain additional elements while the first two remain string namespace and claim-name components and disclosure matching still works.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100