feat(be): add ICRC-3 attribute sharing API with nonce support by aterga · Pull Request #3726 · dfinity/internet-identity

aterga · 2026-04-01T17:09:55Z

Summary

Add two new ICRC-3 attribute sharing API endpoints: prepare_icrc3_attributes (update) and get_icrc3_attributes (query)
Unlike the existing per-attribute prepare_attributes/get_attributes flow, the ICRC-3 variant produces a single canister signature over a Candid-encoded ICRC-3 Value map containing all requested attribute key-value pairs
Caller specifies attributes via AttributeSpec with optional value matching, scope control, and a relying-party nonce:
- value: opt blob — if set, validates against stored credential; if unset, uses stored value directly
- omit_scope: bool — if true, certified key is just the attribute name (e.g., "email"); if false, full scoped key (e.g., "openid:https://...:email")
- nonce: blob — 32-byte value from the relying party, included as "implicit:nonce" in the signed ICRC-3 message map to prevent replay attacks
Domain separator is "ic-request-auth-info" (used for canister signature computation)
get_icrc3_attributes returns a typed NoSuchSignature error instead of trapping when the signature is not found
New types: Icrc3Value, AttributeSpec, PrepareIcrc3AttributeRequest/Response/Error, GetIcrc3AttributeRequest/Response/Error
All changes are purely additive — the existing prepare_attributes/get_attributes implementation is not modified

Test plan

Unit tests for ValidatedPrepareIcrc3AttributeRequest validation (attribute count, nonce length, key parsing, scope requirement)
Unit tests for ValidatedGetIcrc3AttributeRequest validation
Unit tests for Anchor::prepare_icrc3_attributes error paths (value mismatch, unknown issuer, scopeless attribute)
Unit tests for icrc3_attribute_message encoding (determinism, decodability, scoped vs unscoped keys)
Integration test: full prepare → get → signature verification flow with mixed omit_scope and nonce value assertion
Integration test: typed NoSuchSignature error for unknown message
cargo check passes for all affected crates

…ions Add two new ICRC-3 attribute sharing endpoints that produce a single canister signature over a Candid-encoded ICRC-3 Value map of all attributes, instead of per-attribute signatures. - prepare_icrc3_attributes: validates caller-provided attribute values against stored OpenID credentials, Candid-encodes them as an ICRC-3 Map, and signs the encoded bytes - get_icrc3_attributes: retrieves the single signature for the message blob returned by prepare Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

This PR introduces a new ICRC-3-flavored attribute sharing flow to Internet Identity, adding endpoints that sign a single Candid-encoded ICRC-3 Value map containing all requested attribute key/value pairs, rather than per-attribute signatures.

Changes:

Added prepare_icrc3_attributes (update) and get_icrc3_attributes (query) canister APIs, including new request/response/error types.
Implemented ICRC-3 message construction (Candid-encoded map) and canister-signature issuance/lookup for the message blob.
Added test plumbing: PocketIC API helpers, signature verification helper, and a new integration test covering the prepare → get → verify flow.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`src/internet_identity/src/main.rs`	Exposes the new `prepare_icrc3_attributes` / `get_icrc3_attributes` canister methods and wires validation/auth/account lookup.
`src/internet_identity/src/attributes.rs`	Implements ICRC-3 message building, validation against stored OpenID credential claims, and signature issuance/lookup.
`src/internet_identity/internet_identity.did`	Adds Candid types and service methods for the new ICRC-3 attribute sharing API.
`src/internet_identity_interface/src/internet_identity/types/attributes.rs`	Adds public interface types + validation logic for ICRC-3 prepare/get requests.
`src/internet_identity_interface/src/internet_identity/types/icrc3.rs`	Introduces the `Icrc3Value` enum used to build the signed message.
`src/internet_identity_interface/src/internet_identity/types.rs`	Exports the new `icrc3` module.
`src/canister_tests/src/api/internet_identity.rs`	Adds PocketIC API wrappers to call the new endpoints.
`src/canister_tests/src/framework.rs`	Adds a helper to verify ICRC-3 attribute signatures in tests.
`src/internet_identity/tests/integration/attributes.rs`	Adds an integration test for the new ICRC-3 attribute sharing flow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Import `candid::Encode` macro explicitly - Remove unreachable wildcard pattern in scope match Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Introduce `AttributeSpec` type for `prepare_icrc3_attributes` with: - `key`: full attribute key with scope - `value: opt blob`: optional value matching against stored credentials - `omit_scope: bool`: strip scope prefix from certified key for privacy When `value` is None, the stored value is used without validation. When `omit_scope` is true, the certified key is just the attribute name (e.g., "email" instead of "openid:https://...:email"). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…tests - Return typed NoSuchSignature error from get_icrc3_attributes instead of trapping - Fix ICRC3_MESSAGE_MAX_BYTES to include key sizes and Candid overhead - Add unit tests for ValidatedPrepareIcrc3AttributeRequest and ValidatedGetIcrc3AttributeRequest - Add 9 integration tests covering value set/unset, omit_scope true/false corner cases Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Drop should_certify_icrc3_attributes_without_value_check and should_certify_icrc3_attributes_with_omit_scope since the mixed_omit_scope test already covers composability of omit_scope true/false. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The should_reject_icrc3_attributes_with_correct_and_wrong_value test already covers the wrong-value case while also testing partial mismatch. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Tests that don't rely on certification (value mismatch, unknown issuer, scopeless attribute, message encoding) are now unit tests on the core logic directly, keeping only certification-dependent tests as PocketIc integration tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The nonce is a 32-byte value generated by the relying party to prevent replay attacks and enable attribute expiration per flow. It is included in the signed ICRC-3 message as `implicit:nonce`. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The nonce field is now included in the certified pairs, so the ICRC-3 message map has 3 entries (email, name, implicit:nonce) instead of 2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…validation Extend should_certify_icrc3_attributes_mixed_omit_scope to use a specific nonce, verify the canister signature, and assert that the nonce value in the certified message map matches the provided bytes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…e bound - Detect duplicate certified attribute keys in prepare_icrc3_attributes: if two specs resolve to the same key (e.g., two issuers with omit_scope=true both become "email"), return an error instead of silently overwriting. - Fix ICRC3_ATTRIBUTE_KEY_MAX_BYTES to account for the full scoped key format ("openid:" + issuer + ":" + attribute_name) rather than just the issuer length, ensuring ICRC3_MESSAGE_MAX_BYTES is a sound bound. - Add unit test for duplicate key detection. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

## Summary - Add `list_available_attributes` query endpoint that lists attribute key/value pairs stored on an identity's OpenID credentials - Supports optional filtering via `attributes: opt vec text`: - `None` → returns all available attributes across all credentials - Scoped keys (e.g., `"openid:https://accounts.google.com:email"`) → exact match - Unscoped keys (e.g., `"email"`) → wildcard match across all scopes - Response always uses fully-scoped keys (e.g., `"openid:https://accounts.google.com:email"`) - Authenticated the same way as `prepare_icrc3_attributes` (via `check_authorization`) - No origin/account_number needed since no signing is performed ## Test plan - [x] Unit tests for `ValidatedListAvailableAttributesRequest` validation (valid/invalid inputs) - [x] Unit tests for `Anchor::list_available_attributes` (all attributes, scoped filter, unscoped wildcard, missing attributes, no credentials, wrong issuer) - [x] Integration test `should_list_all_available_attributes` — full flow with real credential storage - [x] All 203 binary unit tests pass - [x] All 30 interface unit tests pass < [Previous PR](#3726) | [Next PR](#3730) > --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>

aterga and others added 2 commits April 1, 2026 19:04

🤖 cargo-fmt auto-update

737d587

aterga requested a review from a team as a code owner April 1, 2026 17:09

Copilot AI review requested due to automatic review settings April 1, 2026 17:09

Copilot started reviewing on behalf of aterga April 1, 2026 17:10 View session

Copilot AI reviewed Apr 1, 2026

View reviewed changes

Comment thread src/internet_identity/src/attributes.rs Outdated

Comment thread src/internet_identity_interface/src/internet_identity/types/attributes.rs Outdated

Comment thread src/internet_identity_interface/src/internet_identity/types/attributes.rs

fix: resolve clippy errors in ICRC-3 attributes

6a376a6

- Import `candid::Encode` macro explicitly - Remove unreachable wildcard pattern in scope match Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

aterga commented Apr 2, 2026

View reviewed changes

Comment thread src/internet_identity/internet_identity.did Outdated

aterga and others added 7 commits April 2, 2026 12:28

🤖 cargo-fmt auto-update

d5581b3

Remove redundant should_reject_icrc3_attributes_with_wrong_value test

779ffd6

The should_reject_icrc3_attributes_with_correct_and_wrong_value test already covers the wrong-value case while also testing partial mismatch. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

🤖 cargo-fmt auto-update

8ef83ed

aterga requested a review from sea-snake April 2, 2026 11:09

aterga changed the title ~~feat: add prepare_icrc3_attributes and get_icrc3_attributes API~~ feat(be): add prepare_icrc3_attributes and get_icrc3_attributes API Apr 2, 2026

aterga commented Apr 2, 2026

View reviewed changes

Comment thread src/internet_identity/src/attributes.rs

aterga commented Apr 2, 2026

View reviewed changes

Comment thread src/internet_identity/src/attributes.rs Outdated

aterga commented Apr 2, 2026

View reviewed changes

Comment thread src/internet_identity/internet_identity.did

aterga mentioned this pull request Apr 2, 2026

feat(be): add list_available_attributes query API #3728

Merged

5 tasks

aterga and others added 3 commits April 2, 2026 15:39

Rename ICRC-3 domain separator to ic-request-auth-info

45770c4

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fix: update integration test to account for nonce in ICRC-3 message map

df125fe

The nonce field is now included in the certified pairs, so the ICRC-3 message map has 3 entries (email, name, implicit:nonce) instead of 2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

aterga requested a review from Copilot April 2, 2026 13:58

sea-snake approved these changes Apr 2, 2026

View reviewed changes

Copilot started reviewing on behalf of aterga April 2, 2026 13:58 View session

Copilot AI reviewed Apr 2, 2026

View reviewed changes

Comment thread src/internet_identity/src/attributes.rs Outdated

Comment thread src/internet_identity_interface/src/internet_identity/types/attributes.rs Outdated

Comment thread src/internet_identity/tests/integration/attributes.rs

aterga and others added 2 commits April 2, 2026 16:08

🤖 cargo-fmt auto-update

7fd1976

aterga changed the title ~~feat(be): add prepare_icrc3_attributes and get_icrc3_attributes API~~ feat(be): add prepare_icrc3_attributes and get_icrc3_attributes API Apr 2, 2026

aterga changed the title ~~feat(be): add prepare_icrc3_attributes and get_icrc3_attributes API~~ feat(be): add ICRC-3 attribute sharing API with nonce support Apr 2, 2026

aterga and others added 2 commits April 2, 2026 16:30

fix: use entry API for duplicate key detection to satisfy clippy

ffc2abb

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

aterga added this pull request to the merge queue Apr 2, 2026

Merged via the queue into main with commit 815f7bd Apr 2, 2026
52 checks passed

aterga deleted the claude/gracious-moser branch April 2, 2026 15:06

aterga mentioned this pull request Apr 2, 2026

feat(be): add implicit:origin and implicit:issued_at_timestamp_ns to ICRC-3 message #3730

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(be): add ICRC-3 attribute sharing API with nonce support#3726

feat(be): add ICRC-3 attribute sharing API with nonce support#3726
aterga merged 17 commits intomainfrom
claude/gracious-moser

aterga commented Apr 1, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

aterga commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aterga commented Apr 1, 2026 •

edited

Loading