Skip to content

Conversation

@coplat
Copy link
Contributor

@coplat coplat commented Jan 12, 2026

Description of change

This PR initializes the nonce endpoint as described in OID4CI's draft 15 specification. . This is vital as a means to prevent replay attacks during credential requests. Nonces are generated when a post request is made to the /oid4vci/nonce endpoint, returning a unique and fresh c_nonce.

This c_nonce must then be included in the proof of a CredentialRequest made to the issuer. If that nonce has already been redeemed or does not exist, the credential request is denied.

If it is valid, the c_nonce is then marked as redeemed and can no longer be reused.

This PR initializes the nonce endpoint which generates the nonce, and validates the nonce when a credential request is made within the API layer. Further, the nonce commands, events, errors and corresponding aggregate are also initialized within this PR.

Links to any relevant issues

How the change has been tested

Existing tests have been updated to include nonces. Nonce endpoint has been added to the postman collection for c_nonce generation.

Definition of Done checklist

Add an x to the boxes that are relevant to your changes.

  • I have followed the contribution guidelines for this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • I have successfully tested this change in a docker environment

@coplat coplat self-assigned this Jan 12, 2026
@coplat coplat marked this pull request as ready for review January 12, 2026 15:35
@coplat coplat added the Blocked Something blocks the integration of this code. label Jan 14, 2026
@coplat coplat removed the Blocked Something blocks the integration of this code. label Jan 29, 2026
@codecov-commenter
Copy link

Codecov Report

❌ Patch coverage is 77.27273% with 30 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
agent_event_publisher_http/src/lib.rs 41.17% 10 Missing ⚠️
agent_issuance/src/nonce/event.rs 0.00% 6 Missing ⚠️
...tp/src/v0/issuance/credential_issuer/credential.rs 85.29% 5 Missing ⚠️
agent_issuance/src/nonce/aggregate.rs 85.18% 4 Missing ⚠️
agent_event_publisher_nats/src/lib.rs 0.00% 3 Missing ⚠️
agent_issuance/src/state.rs 50.00% 1 Missing ⚠️
agent_store/src/lib.rs 94.11% 1 Missing ⚠️
Files with missing lines Coverage Δ
agent_api_http/src/lib.rs 0.00% <ø> (ø)
.../src/v0/issuance/credential_issuer/notification.rs 98.92% <100.00%> (ø)
agent_api_http/src/v0/issuance/mod.rs 100.00% <100.00%> (ø)
agent_api_http/src/v0/issuance/nonce/mod.rs 100.00% <100.00%> (ø)
agent_issuance/src/lib.rs 100.00% <ø> (ø)
agent_issuance/src/nonce/views/mod.rs 100.00% <100.00%> (ø)
agent_issuance/src/server_config/aggregate.rs 49.53% <100.00%> (-0.70%) ⬇️
agent_shared/src/config/mod.rs 91.93% <ø> (ø)
agent_issuance/src/state.rs 54.76% <50.00%> (-0.06%) ⬇️
agent_store/src/lib.rs 72.84% <94.11%> (+0.82%) ⬆️
... and 5 more

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@coplat coplat added the BREAKING CHANGE A change to the API that requires a major release. label Jan 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

BREAKING CHANGE A change to the API that requires a major release.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants