Control disclosure of attributes

[javereec]

When generating a device response, a presentation definition object is used (from DIF PEX). In constraints, it is possible to indicate if an attribute is optional. The current implementation seems to not allow for controls to leave this decision up to the user to decide wether to include these optional params. If available, it discloses them.

Wouldn't it be better to allow more control over which attributes to include when generating the response?

[siacomuzzi]

Hi Jan,

This library does not handle the interaction with the end-user. So, as a workaround, if the user decides not to share an optional field, you should create the device response by specifying a new presentation definition object without that field.

In future versions, we should replace the usingPresentationDefinition() method with a new method where the developer only specifies the list of fields authorized by the user.

[javereec]

Okay, that's a good suggestion for a workaround. Thanks for the idea.

As for the future version, I think it would be a good idea to have a different way of doing this. One more reason is that there is now something that is called DCQL in the OpenID4VP spec that is likely to become the main query language, although PE can still be used.

[nvoutsin]

Since DCQL is now included in OID4VP, and the OID4VC HAIP mandates DCQL while excluding the use of PE, it would be useful the library to support DCQL via an additional method