Enterprise Roadmap

{
  "protocol": "openid4vp",
  "request": {
    "client_id": "https://verifier.example.com",
    "client_id_scheme": "web-origin",
    "response_type": "vp_token",
    "response_mode": "dc_api",
    "nonce": "n-0S6_WzA2Mj",
    "presentation_definition": { ... }
  }
}

// Request creation
var dcRequest = new DcApiRequestBuilder()
    .WithClientId("https://verifier.example.com")
    .WithNonce(GenerateNonce())
    .WithPresentationDefinition(presentationDefinition)
    .WithResponseMode(DcApiResponseMode.DcApi)
    .Build();

// JavaScript payload for navigator.credentials.get()
string jsPayload = dcRequest.ToNavigatorCredentialsPayload();

// Response validation
var validator = new DcApiResponseValidator(options);
var result = await validator.ValidateAsync(
    dcResponse,
    expectedOrigin: "https://verifier.example.com",
    expectedNonce: nonce);

// Access verified claims
if (result.IsValid)
{
    var claims = result.VerifiedCredentials;
}

// Frontend JavaScript
const dcRequest = await fetch("/api/dc-request").then((r) => r.json());

const credential = await navigator.credentials.get({
  digital: {
    providers: [
      {
        protocol: "openid4vp",
        request: dcRequest,
      },
    ],
  },
});

// Submit to backend
const result = await fetch("/api/verify", {
  method: "POST",
  body: JSON.stringify(credential),
});

public interface IEuTrustListResolver
{
    /// <summary>
    /// Resolves and validates issuer trust from EU Trust Lists.
    /// </summary>
    Task<TrustValidationResult> ValidateIssuerAsync(
        X509Certificate2 issuerCert,
        string credentialType,
        CancellationToken cancellationToken = default);

    /// <summary>
    /// Gets the current List of Trusted Lists.
    /// </summary>
    Task<ListOfTrustedLists> GetLotlAsync(
        CancellationToken cancellationToken = default);

    /// <summary>
    /// Gets trusted service providers for a specific member state.
    /// </summary>
    Task<IReadOnlyList<TrustedServiceProvider>> GetTrustedProvidersAsync(
        string memberStateCode,
        CancellationToken cancellationToken = default);
}

public class ArfProfileValidator
{
    /// <summary>
    /// Validates a credential against EUDIW ARF requirements.
    /// </summary>
    public ArfValidationResult ValidateCredential(
        object credential, // SD-JWT VC or mdoc
        ArfCredentialType credentialType)
    {
        // Validate format compliance
        // Validate cryptographic algorithms (HAIP Level 2 minimum)
        // Validate issuer trust
        // Validate credential type-specific requirements
    }
}

public enum ArfCredentialType
{
    /// <summary>Person Identification Data</summary>
    PID,
    /// <summary>Mobile Driving License</summary>
    MDL,
    /// <summary>Qualified Electronic Attestation of Attributes</summary>
    QEAA,
    /// <summary>Electronic Attestation of Attributes</summary>
    EAA
}

public class PidCredentialHandler
{
    private const string PidDocType = "eu.europa.ec.eudi.pid.1";
    private const string PidNamespace = "eu.europa.ec.eudi.pid.1";

    /// <summary>
    /// Validates and extracts PID claims from an mdoc credential.
    /// </summary>
    public PidValidationResult ValidatePid(Document pidDocument)
    {
        // Validate DocType
        if (pidDocument.DocType != PidDocType)
            return PidValidationResult.InvalidDocType();

        // Extract mandatory claims
        var claims = ExtractPidClaims(pidDocument);

        // Validate mandatory fields present
        ValidateMandatoryFields(claims);

        return new PidValidationResult
        {
            IsValid = true,
            FamilyName = claims.FamilyName,
            GivenName = claims.GivenName,
            BirthDate = claims.BirthDate,
            IssuingCountry = claims.IssuingCountry,
            // ... other PID claims
        };
    }
}

/// <summary>
/// PID mandatory claims per ARF specification.
/// </summary>
public class PidClaims
{
    public string FamilyName { get; set; }
    public string GivenName { get; set; }
    public DateTime BirthDate { get; set; }
    public bool? AgeOver18 { get; set; }
    public bool? AgeOver21 { get; set; }
    public string IssuingCountry { get; set; }
    public string IssuingAuthority { get; set; }
    public DateTime IssuanceDate { get; set; }
    public DateTime ExpiryDate { get; set; }
    // Optional: resident_address, nationality, etc.
}

public class QeaaHandler
{
    /// <summary>
    /// Validates a Qualified Electronic Attestation of Attributes.
    /// </summary>
    public QeaaValidationResult ValidateQeaa(
        string sdJwtVc,
        IEuTrustListResolver trustResolver)
    {
        // Parse SD-JWT VC
        // Validate issuer is a Qualified Trust Service Provider (QTSP)
        // Validate signature with qualified certificate
        // Validate attestation claims
    }

    /// <summary>
    /// Checks if the issuer is a registered QTSP.
    /// </summary>
    public async Task<bool> IsQualifiedProviderAsync(
        string issuerUrl,
        IEuTrustListResolver trustResolver)
    {
        var providers = await trustResolver.GetTrustedProvidersAsync("*");
        return providers.Any(p =>
            p.ServiceType == TrustServiceType.QualifiedAttestation &&
            p.ServiceEndpoint == issuerUrl);
    }
}

public class RpRegistrationValidator
{
    /// <summary>
    /// Validates that a relying party is registered in the EU RP registry.
    /// </summary>
    public async Task<RpValidationResult> ValidateRpAsync(
        string rpClientId,
        string[] requestedCredentialTypes)
    {
        // Fetch RP registration from registry
        var registration = await _rpRegistry.GetRegistrationAsync(rpClientId);

        if (registration == null)
            return RpValidationResult.NotRegistered();

        // Validate RP is authorized for requested credential types
        var authorized = requestedCredentialTypes.All(ct =>
            registration.AuthorizedCredentialTypes.Contains(ct));

        if (!authorized)
            return RpValidationResult.NotAuthorizedForCredentialTypes();

        // Validate RP status (active, suspended, revoked)
        if (registration.Status != RpStatus.Active)
            return RpValidationResult.Inactive(registration.Status);

        return RpValidationResult.Valid(registration);
    }
}

public class EudiwVerificationService
{
    private readonly ArfProfileValidator _arfValidator;
    private readonly IEuTrustListResolver _trustResolver;
    private readonly RpRegistrationValidator _rpValidator;
    private readonly PidCredentialHandler _pidHandler;
    private readonly MdocVerifier _mdocVerifier;

    public async Task<EudiwVerificationResult> VerifyPresentationAsync(
        DeviceResponse presentation,
        string rpClientId,
        string expectedNonce)
    {
        // 1. Validate RP is registered
        var rpResult = await _rpValidator.ValidateRpAsync(
            rpClientId,
            presentation.Documents.Select(d => d.DocType).ToArray());

        if (!rpResult.IsValid)
            return EudiwVerificationResult.RpNotAuthorized(rpResult);

        // 2. Verify each credential
        var credentialResults = new List<CredentialVerificationResult>();

        foreach (var doc in presentation.Documents)
        {
            // 2a. Verify mdoc structure and signature
            var mdocResult = _mdocVerifier.Verify(doc, new MdocVerificationOptions
            {
                ValidateExpiry = true
            });

            if (!mdocResult.IsValid)
            {
                credentialResults.Add(CredentialVerificationResult.Failed(
                    doc.DocType, mdocResult.Error));
                continue;
            }

            // 2b. Validate ARF compliance
            var arfResult = _arfValidator.ValidateCredential(
                doc,
                MapDocTypeToArfType(doc.DocType));

            if (!arfResult.IsCompliant)
            {
                credentialResults.Add(CredentialVerificationResult.NonCompliant(
                    doc.DocType, arfResult.Violations));
                continue;
            }

            // 2c. Validate issuer trust
            var issuerCert = ExtractIssuerCertificate(doc);
            var trustResult = await _trustResolver.ValidateIssuerAsync(
                issuerCert,
                doc.DocType);

            if (!trustResult.IsTrusted)
            {
                credentialResults.Add(CredentialVerificationResult.UntrustedIssuer(
                    doc.DocType, trustResult.Reason));
                continue;
            }

            // 2d. Extract verified claims
            var claims = ExtractClaims(doc);
            credentialResults.Add(CredentialVerificationResult.Success(
                doc.DocType,
                claims,
                trustResult.IssuerInfo));
        }

        return new EudiwVerificationResult
        {
            Success = credentialResults.All(r => r.IsValid),
            RpValidation = rpResult,
            Credentials = credentialResults,
            Timestamp = DateTimeOffset.UtcNow
        };
    }
}