DCQL-Java

A Java implementation of the Digital Credentials Query Language(DCQL).

Maven

The library is available at maven central:

 <dependency>
<groupId>io.github.wistefan</groupId>
<artifactId>dcql-java</artifactId>
</dependency>

Example usage

In order to evaluate DCQL-Queries, a list of VerifiableCredentials has to be provided. The library itself uses a minimum of dependencies, therefor parsing of credentials and queries needs to be done by the caller. A possible option is Jackson. In order to properly deserialize a query, the ObjectMapper needs to be configured as following:

ObjectMapperobjectMapper = newObjectMapper();
// future and backwards compatible, just ignore unsupported partsobjectMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
// properties should be translated following snake-case, e.g. `claimSet` becomes `claim_set`and vice versaobjectMapper.setPropertyNamingStrategy(PropertyNamingStrategies.SNAKE_CASE);
SimpleModuledeserializerModule = newSimpleModule();
// help deserialization of the enums. See test/java/io/github/wistefan/dcql/helper for their implementationsdeserializerModule.addDeserializer(CredentialFormat.class, newCredentialFormatDeserializer());
deserializerModule.addDeserializer(TrustedAuthorityType.class, newTrustedAuthorityTypeDeserializer());
objectMapper.registerModule(deserializerModule);

Since credentials are usually not standard json-format, additional helper might be required. In case of sd-jwt and jwt credentials, a library like Nimbus JOSE+JWT can be used. See examples for loading SD and JWT credentials in the ParseCredentialTest

After loading the credentials and providing query, evaluation is straight-forward:

// this configuration would support all CredentialFormats currently included in DCQL.DCQLEvaluatordcqlEvaluator = newDCQLEvaluator(List.of(
newJwtCredentialEvaluator(),
newDcSdJwtCredentialEvaluator(),
newVcSdJwtCredentialEvaluator(),
newMDocCredentialEvaluator(),
newLdpCredentialEvaluator()));
QueryResultqueryResult = dcqlEvaluator.evaluateDCQLQuery(dcqlQuery, credentialsList);

The QueryResult provides a quick success indicator and the filtered list of credentials to be used. In case of SD-JWT Credentials, only the requested elements are disclosed.

Limitations

As of now, DCQL-Java only supports querying for trusted authorities of type Authority Key Identifier("aki"). In order to do so, a bouncycastle implementation needs to be provided:

 <dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk18on</artifactId>
<version>${version.org.bouncycastle}</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk18on</artifactId>
<version>${version.org.bouncycastle}</version>
</dependency>

License

DCQL-Java is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.