@startuml
'https://plantuml.com/sequence-diagram

skinparam classFontColor 007BFF
skinparam classFontSize 12
skinparam classFontName Aapex
skinparam backgroundColor white
skinparam minClassWidth 155
skinparam nodesep 34
skinparam ranksep 70

skinparam sequence {
ArrowColor 007BFF
ActorBorderColor 007BFF
LifeLineBorderColor 007BFF
LifeLineBackgroundColor 007BFF

ParticipantBorderColor 007BFF
ParticipantBackgroundColor 007BFF
ParticipantFontName Impact
ParticipantFontSize 17
ParticipantFontColor #A9DCDF

'ActorBackgroundColor aqua
ActorFontColor 007BFF
ActorFontSize 17
ActorFontName Aapex
}

skinparam class {
BorderColor 007BFF
ArrowColor 007BFF
BackgroundColor white
}

skinparam interface {
BorderColor 007BFF
ArrowColor 007BFF
}

skinparam note {
BorderColor 007BFF
BackgroundColor 7ACFF5
}


autonumber
'https://ec.europa.eu/cefdigital/wiki/display/BLOCKCHAININT/2.+VC+exchange+over+API
header OIDC credential issuance flow
title
OIDC credential issuance flow (BETA)
end title
autonumber
participant "SSIKit User\n(via CLI or SDK)" as SU
participant "SSIKit" as SK
participant "Issuing Party \n(Issuer Backend)" as IP
participant "Issuer web portal\n(Browser)" as IWP

SU->SU: Lookup/determine issuer OIDC URL
SU->SK: Get issuer info\n(ssikit oidc ci info [...])
SK->IP: Get OIDC discovery document
IP-->SK: OIDC discovery document
SK->SK: Parse credential manifests
SK-->SU: List issuable credentials, VP requirements,...
SU->SU: Choose credentials to issue

opt VP Requirements
SU->SK: Get nonce for verifiable presentation\n(ssikit oidc ci nonce [...])
SK->IP: Get nonce for VP
IP-->SK: Nonce
SK-->SU: Nonce
SU->SK: Create required verifiable presentation\n(ssikit vc present [...])
SK->SK: create and sign required VP
SK-->SU: verifiable presentation
end

SU->SK: Push authorization request\n(ssikit oidc ci auth [...])
SK->IP: Push OIDC authorization request\nwith redirect_uri and opt. VPs
IP-->SK: authorization request URI
SK->SU: Issuer portal authorization URL
SU->IWP: Open/Redirect to issuer portal in browser\nuser interaction: authorize, select credentials, confirm,...
IWP->IP:
IP->IP: Generate authorization code
IP-->SU: Redirect to redirect_uri with authorization code\n(copy redirected uri for CLI)

SU->SK: Get access_token\n(ssikit oidc ci token [...] -r <pasted URL>)
SK->IP: Resolve access_token using auth. code
IP-->SK: access_token
SK-->SU: access_token
loop for each credential type
SU->SK: Get credential from issuer\n(ssikit oidc ci credential [...])
SK->IP: Fetch credential using access_token
IP-->SK: credential
SK->SK: store credential (optional)
SK-->SU: Issued credential
end

@enduml
