@startuml Credential Issuance Low-Level Flow
autonumber

participant "User" as u

box "User's smartphone" #LightBlue
participant "Browser" as ua
participant "Wallet Instance" as w
end box

participant "Credential Issuer" as i



rnote over w,i #LIGHTGREEN
Check Credential Issuer is part of the Federation and obtain its metadata
endrnote


w -> w : create PKCE code verifier and WA-PoP

w -> i : PAR Request (\n  client_id,\n  request) \n  with OAuth-Client-Attestation and OAuth-Client-Attestation-PoP in the Header
rnote over i #LIGHTGREEN
Check Wallet Provider is part of the Federation 
Check signature of the Wallet App Attestation and its validity 
endrnote


i --> w : PAR Response (request_uri, expires_in)


w --> ua: Authorization Request (client_id, request_uri)
ua --> i: Authorization Request (client_id, request_uri)

alt Credential == PID
rnote over i,u #WHITE
user authentication with CieID LoA High (L3) and consent (optionally collecting user's contacts)
endrnote
else Credential == (Q)EAA)
rnote over i,u #WHITE
user authentication with PID and consent (optionally collecting user's contacts)
endrnote
end

i --> ua : Authorization Response (code, state, iss)
ua --> w : Authorization Response (code, state, iss)

w -> w : generate DPoP key

w -> w : generate DPoP proof and WA-PoP for Credential Issuer token endpoint


w -> i : Token Request with DPoP proof (\n  grant_type,\n  code,\n  code_verifier,\n  redirect_uri) \n with OAuth-Client-Attestation and OAuth-Client-Attestation-PoP in the Header

i -> w : Token Response (access_token, refresh_token, token_type, expires_in)

w -> i : Nonce Request HTTP POST /nonce

i -> w : Nonce Response (c_nonce)


w  -> w : create DPoP proof for Credential Issuer credential endpoint

alt Single Credential Issuance

  w -> w : create proof of possession (c_nonce) using the DPoP key
  w -> i : Credential Request with DPoP access_token and DPoP proof (credential_identifier or credential_configuration_id, proof)

else Batch Credential Issuance

  w -> w : generate N fresh credential keys (N==batch_size)
  w -> w : generate N proof of possession (c_nonce) using the N fresh keys 
  w -> i : Batch Credential Request with DPoP access_token and DPoP proof (credential_identifier or credential_configuration_id, proofs (proof1, proof2,...,proofN)) 

end


alt Credential is available 

rnote over i #LIGHTGREEN
The number of Credentials is equal to the number 
of key proofs provided by the Wallet Instance
endrnote

i -> w : Credential Response (credentials, notification_id)

w -> w : Credentials validity and status check

w -> u : ask for User consent
u -> w : consent to store credentials

w -> w : store credentials

w -> i : Notification Request HTTP POST /notification (notification_id, event) \n with DPoP Access Token

rnote over i #LIGHTBLUE
Register all the credential-related 
information for verification/revocation  
endrnote

i -> w : Notification Response HTTP 204 No Content

else Credential is NOT available
i -> w : Credential Response (lead_time, transaction_id)
rnote over u,i
The Wallet Instance, after an amount of time specified by lead_time and when triggered by the User, starts the flow again
endrnote
end
@enduml