# OID4VP & OID4VCI Flows

## OID4VP Phase #1: Cross-Device - Direct Post Flow

### Participants:

`Cloud-Agent Controller` - any code in Kotlin, TypeScript, or Python that uses the HTTP client generated based on the Open API specification of the Cloud-Agent.
Usually, `Cloud-Agent Controller` is included as a module to the Edge Agent SDK. Still, it can also be used separately to provide a `managed` SSI solution for the mobile, web, and backend applications (Node.js). This `Controller` communicates with the `Cloud-Agent` using the REST API and usually leverages the Keycloak for authentication and authorization purposes.

`Cloud-Agent` is the backend service that performs the business logic and maintains the tenant's configuration.

`Cloud OIDC Issuer/Holder/Verifier` is one of the roles of the `Cloud Agent` in the OID4VCI and OID4VC flows.

`Edge OIDC Issuer/Holder/Verifier` is one of the roles of the `Edge Agent SDK` in the OID4VCI and OID4VP flows. The term' edge' highlights the focus on the `unmanaged` SSI solution.

**NOTE**: One of the OID4VCI and OID4VP flow challenges is that these flows are usually focused on web applications (redirect URLs are heavily used to compose the flows).
Another challenge is that the Holder might need an active endpoint to participate in the flow; If the Holder doesn't have the endpoint, the requests (CredentialOffer request or PresentationRequest) are delivered to the Holder using the OOB: URL encoded into the code.

For demo and testing purposes, we need to introduce a couple of web applications to demonstrate these flows:
- Issuer/Verifier web application for `managed` solution. It includes a web application, `Cloud-Agent Controller` and optional `Edge Agent SDK.`
- Issuer/Holder/Verifier web application for `unmanaged` solution. It includes a web application (web Wallet), `Cloud-Agent Controller` or OID4VCI/OID4VP library, and the `Edge Agent SDK TypeScript` as a required component
- Holder mobile application for `unmanaged` solution. It includes a mobile application (Mobile Wallet), `Edge Agent SDK Swift or Kotlin,` and either `Cloud-Agent Controller` or OID4VCI/OID4VP library.

**NOTE**: by thy library in the current context, we use one of the libraries of [eu-digital-identity-wallet](https://github.com/orgs/eu-digital-identity-wallet/repositories?q=openid)

In the `Cross-Device - Direct Post Flow`, the following participants are defined:
- `HolderUser` - the user that plays the role of the Holder and has either `Mobile Wallet` or `Web Wallet` applications.
- `VerifierUser` - the user who plays the role of the Verifier and has a `Web Application` that represents the Verifier in a `managed` SSI solution.
- `WebWallet` - the web application that is used by the `HolderUser`
- `MobileWallet` - the mobile application that is used by the `HolderUser`
- `VerifierWebApplication` - the web application used by the `VerifierUser`.
- `CloudAgent` - the backend application used by the `VerifierUser`
- `Keycloak` - the backend application used for authentication and authorization.

**NOTE**: for a simple demo purposes (without redirect) a `VerifierWebApplication` can be replaced by `Cloud-Agent Controller`. In these cases, having REST API is enough.

**NOTE**: The OID4VP spec declares a feature where the Wallet exposes the Metadata about the supported [Static Configuration Values of the Wallets](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-11.1)

## Cross-Device - Direct Post Flow
This is the simplest scenario in the OID4VP flows.
The `HolderUser` must use a `MobileWallet` application to present the VP using `un-managed` solution, and the `VerifierUser` can use either `VerificationWebApplication` or plain `Cloud-Agent Controller` and `managed` solution.

Prerequisites:
- The Verifier User has
- an account in the Identus Platform
- a published Prism DID
- Verifier User knows the [Wallet Metadata](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-8.2) as a predefined static configuration defined in the [Section 11.1.2](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-11.1.2)
- Verifier User knows about the credential schema of the Holder's VC
- The Holder User has
- unpublished or published Prism DID
- VC in JWT format

sequenceDiagram
    actor VerifierUser as Verifier User
    participant Controller as Cloud-Agent Controller
    participant CloudAgent as CloudAgent (OIDC Verifier)
    participant MobileWallet as Mobile Wallet (EdgeAgent SDK TS)
    actor HolderUser as Holder User


    Note over VerifierUser, CloudAgent: Verifier User initiates presentation request
    VerifierUser->>VerifierUser: Defines the `presentation_definition` that matches the Holder's VC
    VerifierUser->>Controller: Create Presentation Request with the `presentation_definition`
    Controller->>CloudAgent: Create Presentation Request and strore it in the session object
    CloudAgent->>VerifierUser: Provide Presentation Request (URL/QR code)
    Note over VerifierUser, HolderUser: Cross-device interaction via URL/QR code
    VerifierUser->>HolderUser: Share Presentation Request (URL/QR code)
    HolderUser->>+MobileWallet: Scan and Parse Presentation Request (URL/QR code)
    MobileWallet->>CloudAgent: Request Verifiable Credential presentation
    CloudAgent-->>MobileWallet: Return the Presentation Request object
    MobileWallet->>MobileWallet: Compose the Presentation Response object
    MobileWallet->>+CloudAgent: Submit Verifiable Credential (Direct Post)
    CloudAgent->>CloudAgent: Verify Verifiable Credential Response

## Same Device -