add claim extraction to package

Signed-off-by: F-Node-Karlsruhe <christian.fries@eecc.de>

Author: F-Node-Karlsruhe

.cursor/notes/index.md

@@ -32,7 +32,7 @@ See [module-layout.md](module-layout.md) for embedding patterns, pluggable depen
 - **Wallet URL building** with inline or `request_uri` transport
 - **Direct post handling** with optional `response_code` (`DirectPostResult`)
 - **Pluggable** repository and verifier; `Oid4Vp.builder()` for tests and host wiring
-- **DCQL query models**, GS1 template, `PresentationParser`, sealed `Oid4VpError`
+- **DCQL query models**, GS1 template, `PresentationParser`, `PresentationClaims` extraction via `PresentationRequestDefinition`, sealed `Oid4VpError`
 
 ## Development & Release
 

.cursor/notes/module-layout.md

@@ -18,6 +18,7 @@
 - `GenerateRequestOptions.builderSupplier` + `beforeSave` — set app fields before `save()`
 - `PollStatusResolver` — override poll UX; default handles `response_code`, `completed`, verification errors
 - `Oid4VpError` sealed hierarchy — map errors without parsing HTTP status from messages
+- `PresentationRequestDefinition.extractPresentationClaims` + `Oid4Vp.extractPresentationClaims` — template-driven claim extraction from stored `vp_token`
 
 ## Spring Boot (optional)
 

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- `PresentationRequestDefinition.extractPresentationClaims(JsonNode)` for template-specific claim extraction from verified `vp_token` responses
+- `Oid4Vp.extractPresentationClaims(...)` helpers to parse stored tokens and validate primary claim values
+- `EmptyPresentationClaims` error (HTTP 401) when extracted `PresentationClaims.values()` is empty
+
 ## [0.4.3] - 2026-06-15
 
 - merge ttl into one property

README.md

@@ -85,25 +85,25 @@ PresentationRequestDefinition myDefinition = new PresentationRequestDefinition()
 PresentationRequest request = oid4Vp.generatePresentationRequest(myDefinition);
 ```
 
-After verification, add your own logic to read claims from the `vp_token` (see `PresentationParser` or the GS1 template below).
-
-#### Built-in template: GS1 License Presentation
-
-The library also ships a ready-made definition for GS1 Company Prefix and Prefix License credentials:
+After verification, extract claims via the same definition used to generate the request:
 
 ```java
 import de.eecc.oid4vc.oid4vp.PresentationClaims;
 import de.eecc.oid4vc.oid4vp.request.PresentationRequest;
 import de.eecc.oid4vc.oid4vp.request.template.gs1.Gs1LicenseRequest;
 
 PresentationRequest request = oid4Vp.generatePresentationRequest(Gs1LicenseRequest.INSTANCE);
-String walletUrl = oid4Vp.toOpenId4VpUrl(request);
-
-// After direct_post verification:
-PresentationClaims claims = Gs1LicenseRequest.extractPresentationClaims(vpTokenNode);
+// ... after direct_post verification ...
+PresentationClaims claims = oid4Vp.extractPresentationClaims(Gs1LicenseRequest.INSTANCE, request);
 List<String> gcps = claims.values();
 ```
 
+Lower-level access: `definition.extractPresentationClaims(vpTokenNode)` or `PresentationParser` for format-specific parsing.
+
+#### Built-in template: GS1 License Presentation
+
+The library ships a ready-made definition for GS1 Company Prefix and Prefix License credentials (`Gs1LicenseRequest.INSTANCE`).
+
 Application-specific attributes (for example `purpose` or an organisation id) belong on a
 subclass of `PresentationRequest` and are never serialized to the wallet.
 

oid4vp-java/oid4vp-core/src/main/java/de/eecc/oid4vc/oid4vp/api/Oid4Vp.java

@@ -4,12 +4,14 @@
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import de.eecc.oid4vc.oid4vp.Constants;
+import de.eecc.oid4vc.oid4vp.PresentationClaims;
 import de.eecc.oid4vc.oid4vp.request.PresentationRequest;
 import de.eecc.oid4vc.oid4vp.request.PresentationRequestDefinition;
 import de.eecc.oid4vc.oid4vp.request.PublicPresentationRequest;
 import de.eecc.oid4vc.oid4vp.VerificationStatus;
 import de.eecc.oid4vc.oid4vp.VpTokenResponse;
 import de.eecc.oid4vc.oid4vp.exception.AlreadyConsumed;
+import de.eecc.oid4vc.oid4vp.exception.EmptyPresentationClaims;
 import de.eecc.oid4vc.oid4vp.exception.ExpiredState;
 import de.eecc.oid4vc.oid4vp.exception.InternalError;
 import de.eecc.oid4vc.oid4vp.exception.InvalidVpToken;
@@ -342,6 +344,46 @@ public java.util.List<Object> buildVerifierRequestBody(JsonNode presentationNode
         return verifier.buildVerifierRequestBody(presentationNode);
     }
 
+    /**
+     * Extracts presentation claims from the {@code vp_token} stored on a verified request.
+     *
+     * @throws Oid4VpException with {@link InvalidVpToken} when the stored token is missing or invalid JSON
+     * @throws Oid4VpException with {@link EmptyPresentationClaims} when {@link PresentationClaims#values()} is empty
+     */
+    public PresentationClaims extractPresentationClaims(
+            PresentationRequestDefinition definition, PresentationRequest request) {
+        String vpToken = request.getVpToken();
+        if (vpToken == null || vpToken.isBlank()) {
+            throw new Oid4VpException(new InvalidVpToken("No vp_token on presentation request"));
+        }
+        return extractPresentationClaims(definition, vpToken);
+    }
+
+    /**
+     * Extracts presentation claims from a verified {@code vp_token} JSON string.
+     *
+     * @throws Oid4VpException with {@link InvalidVpToken} when JSON parsing fails
+     * @throws Oid4VpException with {@link EmptyPresentationClaims} when {@link PresentationClaims#values()} is empty
+     */
+    public PresentationClaims extractPresentationClaims(
+            PresentationRequestDefinition definition, String vpToken) {
+        return extractPresentationClaims(definition, parseVpToken(vpToken));
+    }
+
+    /**
+     * Extracts presentation claims from a parsed {@code vp_token}.
+     *
+     * @throws Oid4VpException with {@link EmptyPresentationClaims} when {@link PresentationClaims#values()} is empty
+     */
+    public PresentationClaims extractPresentationClaims(
+            PresentationRequestDefinition definition, JsonNode vpTokenNode) {
+        PresentationClaims claims = definition.extractPresentationClaims(vpTokenNode);
+        if (claims.values().isEmpty()) {
+            throw new Oid4VpException(new EmptyPresentationClaims());
+        }
+        return claims;
+    }
+
     private JsonNode parseVpToken(String vpToken) {
         try {
             return objectMapper.readTree(vpToken);

oid4vp-java/oid4vp-core/src/main/java/de/eecc/oid4vc/oid4vp/exception/EmptyPresentationClaims.java

@@ -0,0 +1,14 @@
+package de.eecc.oid4vc.oid4vp.exception;
+
+public record EmptyPresentationClaims() implements Oid4VpError {
+
+    @Override
+    public String message() {
+        return "Verified presentation does not contain the requested primary claim values";
+    }
+
+    @Override
+    public int suggestedHttpStatus() {
+        return 401;
+    }
+}

oid4vp-java/oid4vp-core/src/main/java/de/eecc/oid4vc/oid4vp/exception/Oid4VpError.java

@@ -9,6 +9,7 @@ public sealed interface Oid4VpError permits
         AlreadyConsumed,
         InvalidVpToken,
         VerificationFailed,
+        EmptyPresentationClaims,
         InternalError {
 
     String message();

oid4vp-java/oid4vp-core/src/main/java/de/eecc/oid4vc/oid4vp/request/PresentationRequestDefinition.java

@@ -1,7 +1,9 @@
 package de.eecc.oid4vc.oid4vp.request;
 
+import com.fasterxml.jackson.databind.JsonNode;
 import de.eecc.oid4vc.oid4vp.ClientMetadata;
 import de.eecc.oid4vc.oid4vp.DcqlQuery;
+import de.eecc.oid4vc.oid4vp.PresentationClaims;
 
 /**
  * Credential-specific parts of an OID4VP authorization request.
@@ -14,4 +16,9 @@ public interface PresentationRequestDefinition {
     default ClientMetadata clientMetadata() {
         return ClientMetadata.presentationDefault();
     }
+
+    /**
+     * Extracts claims from a verified {@code vp_token} according to this definition's DCQL query.
+     */
+    PresentationClaims extractPresentationClaims(JsonNode vpTokenNode);
 }

oid4vp-java/oid4vp-core/src/main/java/de/eecc/oid4vc/oid4vp/request/template/gs1/Gs1LicenseRequest.java

@@ -139,7 +139,8 @@ public DcqlQuery.Query dcqlQuery() {
      * Extracts GCP and organisation metadata from a verified {@code vp_token}.
      * Organisation fields use the first GCP credential encountered.
      */
-    public static PresentationClaims extractPresentationClaims(JsonNode vpTokenNode) {
+    @Override
+    public PresentationClaims extractPresentationClaims(JsonNode vpTokenNode) {
         List<String> extractedGcps = new ArrayList<>();
         String firstOrganizationName = null;
         String firstPartyGln = null;

oid4vp-java/oid4vp-core/src/test/java/de/eecc/oid4vc/oid4vp/api/Oid4VpExtractPresentationClaimsTest.java

@@ -0,0 +1,86 @@
+package de.eecc.oid4vc.oid4vp.api;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import de.eecc.oid4vc.oid4vp.PresentationClaims;
+import de.eecc.oid4vc.oid4vp.exception.EmptyPresentationClaims;
+import de.eecc.oid4vc.oid4vp.exception.InvalidVpToken;
+import de.eecc.oid4vc.oid4vp.exception.Oid4VpException;
+import de.eecc.oid4vc.oid4vp.request.PresentationRequest;
+import de.eecc.oid4vc.oid4vp.request.template.gs1.Gs1LicenseRequest;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+class Oid4VpExtractPresentationClaimsTest {
+
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    private Oid4Vp oid4Vp;
+
+    @BeforeEach
+    void setUp() {
+        oid4Vp = Oid4Vp.builder()
+                .options(Oid4VpOptions.builder()
+                        .responseUri("https://example.com/api/auth/oid4vp/response")
+                        .build())
+                .objectMapper(MAPPER)
+                .build();
+    }
+
+    @Test
+    void extractPresentationClaims_fromStoredRequest() throws Exception {
+        PresentationRequest request = oid4Vp.generatePresentationRequest(Gs1LicenseRequest.INSTANCE);
+        request.setVpToken("""
+                {
+                  "gs1_license": [{
+                    "verifiableCredential": [{
+                      "type": ["VerifiableCredential", "GS1CompanyPrefixLicenseCredential"],
+                      "credentialSubject": {
+                        "licenseValue": "0614141",
+                        "organization": {
+                          "gs1:organizationName": "ACME",
+                          "gs1:partyGLN": "9501234567890"
+                        }
+                      }
+                    }]
+                  }]
+                }
+                """);
+
+        PresentationClaims claims = oid4Vp.extractPresentationClaims(Gs1LicenseRequest.INSTANCE, request);
+
+        assertThat(claims.values()).containsExactly("0614141");
+        assertThat(claims.name()).isEqualTo("ACME");
+        assertThat(claims.identifier()).isEqualTo("9501234567890");
+    }
+
+    @Test
+    void extractPresentationClaims_emptyValues_throwsEmptyPresentationClaims() {
+        assertThatThrownBy(() -> oid4Vp.extractPresentationClaims(
+                        Gs1LicenseRequest.INSTANCE, "{\"gs1_license\": [{\"verifiableCredential\": []}]}"))
+                .isInstanceOf(Oid4VpException.class)
+                .satisfies(ex -> {
+                    Oid4VpException oid4VpException = (Oid4VpException) ex;
+                    assertThat(oid4VpException.error()).isInstanceOf(EmptyPresentationClaims.class);
+                    assertThat(oid4VpException.error().suggestedHttpStatus()).isEqualTo(401);
+                });
+    }
+
+    @Test
+    void extractPresentationClaims_missingVpToken_throwsInvalidVpToken() {
+        PresentationRequest request = oid4Vp.generatePresentationRequest(Gs1LicenseRequest.INSTANCE);
+
+        assertThatThrownBy(() -> oid4Vp.extractPresentationClaims(Gs1LicenseRequest.INSTANCE, request))
+                .isInstanceOf(Oid4VpException.class)
+                .satisfies(ex -> assertThat(((Oid4VpException) ex).error()).isInstanceOf(InvalidVpToken.class));
+    }
+
+    @Test
+    void extractPresentationClaims_invalidJson_throwsInvalidVpToken() {
+        assertThatThrownBy(() -> oid4Vp.extractPresentationClaims(Gs1LicenseRequest.INSTANCE, "not-json"))
+                .isInstanceOf(Oid4VpException.class)
+                .satisfies(ex -> assertThat(((Oid4VpException) ex).error()).isInstanceOf(InvalidVpToken.class));
+    }
+}