Support OpenID4VP multi-signed request in Rust matcher

matcher-rs/src/openid4vp.rs

@@ -1,30 +1,69 @@
 use crate::base64url::decode_base64url;
 use crate::credman::CredmanApi;
+use crate::json_value::JsonValue;
 pub use crate::openid4vp_models::*;
 use crate::reporter::report_match_result;
 use nanoserde::DeJson;
 use std::borrow::Cow;
 
+fn extract_request_str<'a>(
+    pr: &'a ProtocolRequest,
+) -> Result<&'a str, Box<dyn std::error::Error>> {
+    if let Some(data) = &pr.data {
+        match data {
+            ProtocolRequestData::String(s) => Ok(s.as_str()),
+            ProtocolRequestData::Object(obj) => {
+                if obj.request.is_empty() {
+                    return Err("Missing 'request' field in data object".into());
+                }
+                Ok(obj.request.as_str())
+            }
+        }
+    } else if !pr.request.is_empty() {
+        Ok(pr.request.as_str())
+    } else {
+        Err("Missing request data".into())
+    }
+}
+
+fn extract_multisigned_payload(
+    pr: &ProtocolRequest,
+) -> Result<String, Box<dyn std::error::Error>> {
+    let json_str = extract_request_str(pr)?;
+    let parsed: JsonValue = DeJson::deserialize_json(json_str)?;
+
+    let JsonValue::Object(mut map) = parsed else {
+        return Err("Multisigned request must be a JSON object".into());
+    };
+
+    let payload = if let Some(req_val) = map.shift_remove("request") {
+        let JsonValue::Object(mut req_map) = req_val else {
+            return Err("Missing 'payload' in 'request' object".into());
+        };
+        let Some(JsonValue::String(p)) = req_map.shift_remove("payload") else {
+            return Err("Missing 'payload' in 'request' object".into());
+        };
+        p
+    } else {
+        let Some(JsonValue::String(p)) = map.shift_remove("payload") else {
+            return Err("Missing 'payload' field in multisigned request".into());
+        };
+        p
+    };
+
+    if payload.is_empty() {
+        return Err("Empty payload in multisigned request".into());
+    }
+
+    Ok(payload)
+}
+
 fn parse_protocol_request_data<'a>(
     pr: &'a ProtocolRequest,
 ) -> Result<Cow<'a, OpenId4VpData>, Box<dyn std::error::Error>> {
     if pr.protocol == "openid4vp-v1-signed" {
         log::debug!("Handling signed OpenID4VP request");
-        let jws: &'a str = if let Some(data) = &pr.data {
-            match data {
-                ProtocolRequestData::String(s) => s,
-                ProtocolRequestData::Object(obj) => {
-                    if obj.request.is_empty() {
-                        return Err("Missing 'request' field in signed data object".into());
-                    }
-                    &obj.request
-                }
-            }
-        } else if !pr.request.is_empty() {
-            &pr.request
-        } else {
-            return Err("Missing signed request data".into());
-        };
+        let jws = extract_request_str(pr)?;
 
         let parts: Vec<&str> = jws.split('.').collect();
         if parts.len() < 2 {
@@ -36,7 +75,14 @@ fn parse_protocol_request_data<'a>(
         return Ok(Cow::Owned(DeJson::deserialize_json(std::str::from_utf8(
             &decoded,
         )?)?));
-    }
+    } else if pr.protocol == "openid4vp-v1-multisigned" {
+        log::debug!("Handling multisigned OpenID4VP request");
+        let payload_str = extract_multisigned_payload(pr)?;
+        let decoded = decode_base64url(&payload_str)?;
+        return Ok(Cow::Owned(DeJson::deserialize_json(std::str::from_utf8(
+            &decoded,
+        )?)?));
+    } 
 
     log::debug!("Handling unsigned OpenID4VP request");
     if let Some(data) = &pr.data {
@@ -110,7 +156,10 @@ pub fn openid4vp_main(credman: &mut impl CredmanApi) -> Result<(), Box<dyn std::
                 continue;
             }
             log::debug!("Processing request {}: protocol={}", i, pr.protocol);
-            if pr.protocol != "openid4vp-v1-unsigned" && pr.protocol != "openid4vp-v1-signed" {
+            if pr.protocol != "openid4vp-v1-unsigned"
+                && pr.protocol != "openid4vp-v1-signed"
+                && pr.protocol != "openid4vp-v1-multisigned"
+            {
                 log::warn!("Unsupported protocol: {}", pr.protocol);
                 continue;
             }
@@ -173,6 +222,28 @@ mod tests {
         assert!(err.to_string().contains("Missing unsigned request data"));
     }
 
+    #[test]
+    fn test_parse_protocol_request_data_multisigned_valid() {
+        let json = r#"{
+            "protocol": "openid4vp-v1-multisigned",
+            "data": "{\"request\": {\"payload\": \"eyJkY3FsX3F1ZXJ5Ijp7ImNyZWRlbnRpYWxzIjpbXX19\"}}"
+        }"#;
+        let pr: ProtocolRequest = DeJson::deserialize_json(json).unwrap();
+        let data = parse_protocol_request_data(&pr).unwrap();
+        assert!(data.dcql_query.is_some());
+    }
+
+    #[test]
+    fn test_parse_protocol_request_data_multisigned_invalid_payload() {
+        let json = r#"{
+            "protocol": "openid4vp-v1-multisigned",
+            "data": "{\"request\": {}}"
+        }"#;
+        let pr: ProtocolRequest = DeJson::deserialize_json(json).unwrap();
+        let err = parse_protocol_request_data(&pr).unwrap_err();
+        assert!(err.to_string().contains("Missing 'payload'"));
+    }
+
     use crate::test_utils::*;
 
     macro_rules! define_test {
@@ -221,6 +292,7 @@ mod tests {
     );
     define_test!(tc30_parse_v1_unsigned, "TC30_ParseV1Unsigned");
     define_test!(tc31_parse_v1_signed, "TC31_ParseV1Signed");
+    define_test!(tc42_parse_v1_multisigned, "TC42_ParseV1Multisigned");
     define_test!(tc32_extract_payment_sca1, "TC32_ExtractPaymentSca1");
     define_test!(tc33_extract_payment_details, "TC33_ExtractPaymentDetails");
     define_test!(tc34_extract_payment_generic, "TC34_ExtractPaymentGeneric");

matcher-rs/testdata/TC42_ParseV1Multisigned_expected.json

@@ -0,0 +1,139 @@
+{
+  "entrySets": {
+    "req:0;null": {
+      "entries": {
+        "0": {
+          "mdoc_cred_1": {
+            "additional_info": "",
+            "credId": "mdoc_cred_1",
+            "disclaimer": "",
+            "fields": [
+              [
+                "Family Name",
+                "Doe"
+              ],
+              [
+                "Given Name",
+                "John"
+              ],
+              [
+                "Age",
+                ""
+              ],
+              [
+                "Over 21",
+                "Yes"
+              ]
+            ],
+            "merchant_name": "",
+            "metadata_display_text": "",
+            "subtitle": "",
+            "title": "John's Driving License",
+            "transaction_amount": "",
+            "type": "Verification",
+            "warning": ""
+          },
+          "mdoc_cred_3": {
+            "additional_info": "",
+            "credId": "mdoc_cred_3",
+            "disclaimer": "",
+            "fields": [
+              [
+                "Family Name",
+                ""
+              ],
+              [
+                "Given Name",
+                ""
+              ],
+              [
+                "Age",
+                ""
+              ],
+              [
+                "Over 21",
+                ""
+              ]
+            ],
+            "merchant_name": "",
+            "metadata_display_text": "",
+            "subtitle": "",
+            "title": "Alice's Driving License",
+            "transaction_amount": "",
+            "type": "Verification",
+            "warning": ""
+          },
+          "mdoc_cred_4": {
+            "additional_info": "",
+            "credId": "mdoc_cred_4",
+            "disclaimer": "",
+            "fields": [
+              [
+                "Family Name",
+                ""
+              ],
+              [
+                "Given Name",
+                ""
+              ],
+              [
+                "Age",
+                ""
+              ],
+              [
+                "Over 21",
+                ""
+              ]
+            ],
+            "merchant_name": "",
+            "metadata_display_text": "",
+            "subtitle": "",
+            "title": "Jane's Driving License",
+            "transaction_amount": "",
+            "type": "Verification",
+            "warning": ""
+          },
+          "mdoc_cred_underage": {
+            "additional_info": "",
+            "credId": "mdoc_cred_underage",
+            "disclaimer": "",
+            "fields": [
+              [
+                "Age",
+                ""
+              ],
+              [
+                "Over 21",
+                "Yes"
+              ]
+            ],
+            "merchant_name": "",
+            "metadata_display_text": "",
+            "subtitle": "",
+            "title": "Underage License",
+            "transaction_amount": "",
+            "type": "Verification",
+            "warning": ""
+          }
+        }
+      },
+      "setId": "req:0;null",
+      "setLength": 1
+    }
+  },
+  "standaloneEntries": [
+    {
+      "additional_info": "",
+      "credId": "issuance_mdl_1",
+      "disclaimer": "",
+      "fields": [],
+      "merchant_name": "",
+      "metadata_display_text": "",
+      "subtitle": "From your local DMV",
+      "title": "Get a New mDL",
+      "transaction_amount": "",
+      "type": "InlineIssuance",
+      "warning": ""
+    }
+  ]
+}

matcher-rs/testdata/TC42_ParseV1Multisigned_request.json

@@ -0,0 +1,10 @@
+{
+  "requests": [
+    {
+      "data": {
+        "request": "{\"payload\":\"eyJkY3FsX3F1ZXJ5Ijp7ImNyZWRlbnRpYWxzIjpbeyJmb3JtYXQiOiJtc29fbWRvYyIsImlkIjoibWRsIiwibWV0YSI6eyJkb2N0eXBlX3ZhbHVlIjoib3JnLmlzby4xODAxMy41LjEubURMIn19XX19\"}"
+      },
+      "protocol": "openid4vp-v1-multisigned"
+    }
+  ]
+}