fix: ClaimsExtractor DCQL response type to map[string][]string#6
Merged
s-jairl merged 1 commit intoMay 11, 2026
Merged
Conversation
OID4VP §6.3 DCQL vp_token values are arrays of presentations, not single strings. The extractClaimsFromDCQLResponse function used map[string]string which caused json.Unmarshal to fail with: cannot unmarshal array into Go value of type string Change dcqlResponse to map[string][]string and iterate over all tokens per credential query ID. Add empty-array guard and tests. Fixes the claims extraction path used by OIDC and OpenID4VP direct-post handlers that pass raw DCQL JSON to ExtractClaimsFromVPToken.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR #5 correctly changed
VPResponse.VPTokenfrommap[string]stringtomap[string][]string, but theClaimsExtractor.extractClaimsFromDCQLResponsewas not updated to match. When a spec-compliant wallet sends DCQL array values,json.Unmarshalfails with:Changes
dcqlResponsefrommap[string]stringtomap[string][]stringAffected code paths
The OIDC handler (
handler_oidc.go) and OpenID4VP direct-post handler (handler_openid4vp.go) both pass raw DCQL JSON toextractAndMapClaims→ExtractClaimsFromVPToken→extractClaimsFromDCQLResponse, hitting this bug.The verifier handler (
handlers_verification.go) is not affected because it unwrapsvpTokens[0]before calling the claims extractor.