Changelog

2.3.0

Features

• Added an optional onPresentationRequest parameter to requestCredentials(). The hook is invoked once after the presentation session is created, and again each time the OpenID4VP authorization request URI is regenerated, for example when a cross-device QR code refreshes. Use it to perform operations against the current request. It is supported in same-device, cross-device, and Digital Credentials API sessions.

If the hook throws, or the promise it returns rejects on any invocation, the in-progress presentation is aborted. The session is aborted server-side, and for cross-device sessions the iframe is closed. requestCredentials() then resolves with a new OnPresentationRequestFailed error (RequestCredentialsErrorType.OnPresentationRequestFailed).

Fixes

• Fixed an issue where slow verifications were being reported as failures. The SDK now waits up to 15 seconds for a verification to complete before timing out, up from 3 seconds.

2.2.0

Features

• Added an optional state parameter to requestCredentials(). Pass an opaque correlation reference, such as an internal record ID, to link a verification session to a record in your own system without maintaining a separate sessionId mapping. MATTR VII carries the value through the session and returns it with the result in both same-device and cross-device flows, on both successful and failed results. See Correlating verification sessions with your system.

2.1.1

Updated internal dependencies to address known vulnerabilities and improve overall security stability.

2.1.0

This is a maintenance release. It includes code refactoring and improvements to support future capabilities.

2.0.2

Documentation

• Updated installation documentation with version-specific script link.

2.0.1

Fixes

• Export OpenIdvpConfiguration type for requestCredentials options

2.0.0

BREAKING CHANGES

• intialise method:

  • The intialise method was renamed to initialize
  • The InitialiseOptions type was renamed to InitializeOptions
  • The initialize method now requires providing an applicationId to identify a specific web application interacting with the MATTR VII verifier tenant.

• The values in the Mode enum were renamed to use PascalCase:

  • crossDevice was renamed to CrossDevice
  • sameDevice was renamed to SameDevice

• requestCredentials method:

  • The method no longer accepts a union of RequestCredentialsSameDeviceOptions, RequestCredentialsCrossDeviceDeviceOptions, and RequestCredentialsAutoDetectOptions. Instead, walletProviderId, mode, and redirectUri are grouped inside an optional openid4vpConfiguration attribute which can be used to differentiate between presentation modes:
    • for openid4vp in same device mode: provide mode as SameDevice and provide redirectUri
    • for openid4vp in cross device mode: provide mode as CrossDevice and omit redirectUri
    • for openid4vp in auto-detect mode: omit mode and provide redirectUri
  • For cross-device flow, the method no longer accept the crossDeviceCallback option which contains the onComplete and onFailure callback functions. Instead the function will await for the session to complete and return a Result. The Result will contain the presentation result on success, or an error with the failure reason.
  • For same-device flow, the method will automatically close the current browser window on success as the verification process continues on a separate redirect page. Please be mindful, this only works for windows that were opened by a script using the Window.open() method, or on top-level windows that have a single history entry. The returned value now contains a sessionCompletedInRedirect: true property to indicate if the flow has continue on the redirect page.

• Invalid credentials included in presentations will no longer result in a PresentationFailureResult, but instead a PresentationSuccessResult containing details of which credentials have failed verification and why. The verification response structure was updated to allow this:

  MobileCredentialVerificationReasonType now includes a number of extra possible values: TrustedIssuerCertificateExpired, TrustedIssuerCertificateNotYetValid, IssuerNotTrusted, MobileCredentialInvalid, MobileCredentialExpired, MobileCredentialNotYetValid, InvalidSignerCertificate, DeviceKeyInvalid, UnsupportedCurve, StatusRevoked, StatusSuspended, StatusUnknown and no longer includes expired, inactive, invalid, suspended, unknown

Features

• Added abortCredentialRequest method for aborting the currently active credentials request session. Any in-progress requestCredentials invocation will resolve immediately with an error result with the RequestCredentialsErrorType.Abort error type.

1.1.0

• The initialise method now takes an optional applicationId to identify a specific web application interacting with the MATTR VII verifier tenant.
• CrossDeviceCallbackOnCompleteResponse and HandleRedirectCallbackResponse will return sessionId on the top level
• MobileCredentialVerificationReasonType now includes values specific to mobile credential revocation status: StatusRevoked, StatusSuspended, StatusUnknown

1.0.1

Documentation

• Updated installation documentation with version specific script link.

1.0.0

Features

• Request Mobile Credentials for verification from a web application via a MATTR VII tenant with use of OpenID4VP as defined in ISO-18013-7.
• Support for both cross-device and same-device flows.