Sphereon-Opensource / OID4VC

OpenID for Verifiable Credentials - modules for issuers, holders and RPs
Apache License 2.0
62 stars 19 forks source link

Missing support for latest draft 13 #109

Closed cre8 closed 2 months ago

cre8 commented 3 months ago

@TimoGlastra @nklomp To be aligned with the latest version of the spec, it would help to know what is the current supported version (I assume it is 11 based on the open issues)

I remember that this SDK tries to support all drafts, when is it planned to drop it? I would love to help so other systems can interact with software based on this package

cre8 commented 3 months ago

Suggestion: we are removing support for all versions below 13 and publish it under a new major version. This will bot break current systems when they updating according to semv versioning.

nklomp commented 3 months ago

Yeah, we will do that over the next few months. We do have to support DIIP, Mosip and Entra, so we cannot go there directly, as our solutions need to support these versions simultaniously. But the nice thing is that the reference implementation, DIIP v3 in Aug and other parties are moving to similar versions of the specs. So before that we will start on new major versions where we drop the older versions

nklomp commented 3 months ago

One thing we want to do is move towards a strategy pattern for version support and do more validations with something like joi. V13 support will land shortly BTW. Like in this week ;) We haven't created a first stable version yet, but if you want to take a stab at dropping pre v13 in a v1-next branch using the above pointers, we are of course more than happy to work together with you on that.

Because that provides everyone with a nice upgrade path. We then have current 0.x.x versions that support multiple versions, including V13 that most parties now seem to settle on. Then we would get a 1.x.x version that does keep some of the discovery mechanisms, but only supports V13

cre8 commented 3 months ago

I like the discovery approach. But when OID4VCI is leaving the draft phase I think it's okay to create a version that only includes the final version. The removal of "deprecated" versions will increase security and auditability of the library.

nklomp commented 3 months ago

Yeah for sure. Also moving towards a strategy pattern, means we can simply have the version code in complete separate folders and packages. Then it is just deleting them as we go. But as soon as a stable version emerges, we for sure would move to drop all of the draft versions. I just want to keep the infra for version discovery so we can also have new final or draft versions of the specs over time one we hit a stable version. But then we don't repeat the current approach of having so much logic constantly having to take into account the different versions etc. Simple detect it and then go into complete seperate code paths from that point on,

nklomp commented 2 months ago

Okay, this took longer than we hoped, but current version has ID 1 / Draft 13 support. We will start on a new 1.x.x. branch shortly where we will do some refactoring and drop everything below draft 13