Skip to content

fix: treat an absent identifier as empty in CredentialSubjectProbe - #63

Open
wantaekchoi wants to merge 1 commit into
1EdTech:mainfrom
wantaekchoi:fix/credential-subject-missing-identifier
Open

fix: treat an absent identifier as empty in CredentialSubjectProbe#63
wantaekchoi wants to merge 1 commit into
1EdTech:mainfrom
wantaekchoi:fix/credential-subject-missing-identifier

Conversation

@wantaekchoi

@wantaekchoi wantaekchoi commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

A credentialSubject with neither id nor identifier currently validates as VALID. OB 3.0 §B.1.3 says "Either id or at least one identifier MUST be supplied", and the JSON Schema does not encode that constraint, so CredentialSubjectProbe is the only place it is enforced.

Cause

#46 swapped the inline array check for JsonNodeUtil.asNodeList, which returns null when the field is absent:

List<JsonNode> identifiers = JsonNodeUtil.asNodeList(root.get("identifier"));
if (identifiers == null || identifiers.size() > 0) return false;

A missing identifier takes the null branch and reports the subject as populated — the opposite of what the method's own comment says it checks ("Check that we have either .id or .identifier populated"). The check only fires today when identifier is written out as a literal [].

#46 was about accepting a non-array identifier, and asNodeList still does that. Only the null case moves, back to what it did before #46.

Change: identifiers == null ||identifiers != null &&

id identifier before after
present any pass pass
absent array with entries pass pass
absent single non-array node pass pass
absent absent pass error
absent [] error error

EndorsementInspector builds this probe through the one-argument constructor, which defaults identifierRequired to true, so endorsements see the same change. BitstringStatusListCredentialInspector passes false and is unaffected, and OB 2.0 does not use this probe.

Testing

Added simple-err-credential-subject-no-id-no-identifier.json, copied from the existing identifier-type fixture with identifier removed. There was no fixture for the absent case, which is why the suite did not catch this.

Before the fix, testSimpleJsonCredentialSubjectWithoutIdOrIdentifier fails with did not find probe id CredentialSubjectProbe; after it, the probe reports no id in credentialSubject. mvn -pl inspector-vc -am test passes, 98 tests.

asNodeList returns null when the field is missing, so the null branch
was reporting the subject as populated and no error was raised. A
credentialSubject carrying neither id nor identifier validated clean,
which OB 3.0 B.1.3 requires to fail.

Adds the fixture the suite was missing for that case.
@wantaekchoi
wantaekchoi requested a review from xaviaracil as a code owner August 4, 2026 02:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant