[Txauth] Changes to XYZ

[Justin Richer <[e-mail]>]

Following last week’s great conversations at IIW, I’ve made a handful of changes to XYZ:

 - Clients can now signal more than one kind of interaction is possible. Syntactically this means we’re sending keys with booleans instead of a “type” key with a string value. Practically this means that the AS now can choose from among a set of options that the client can do and determine what makes the most sense, probably allowing multiple options that it supports.
 - Among the new interaction options are “didcomm" and “didcomm_query”, which give us a way to bridge to another kind of front channel that doesn’t use the web browser. In this case, DID-based agents. I can envision lots of other options, from webauthn challenge/response to direct app communications.
 - Key presentation and key format are now separate from each other. This doesn’t really have much impact on the syntax as it turns out, just the assumptions of what the underlying model is. A “key handle” will still represent a pair of key and presentation method.
 - I renamed the “client” section to “display” because that’s more what it was — user-facing elements. It’s my hope that this will be less of a place to hang everything off of, like the client ended up being in OAuth2.
 - I shuffled around a few things to show how the continuation request can happen, and hopefully show how it’s different from a base transaction request. The question still remains of how to specify a continuation request with additional features (more resources, more client info, etc), and that’s going to require careful wording in the client definition.
 - The “data” element of the resource request is now “datatype”, from feedback on RAR.
 - I added a “capabilities” array to both the client’s request and server’s response, which will list a set of extensions that are supported. It’s a way to do general purpose discovery through this same interface, and it fits the transaction model well (“this is what I can do, tell me what you can do”).

I’ve updated the website https://oauth.xyz/ with these changes, but I haven’t had a chance to update the spec draft text or the implementations yet.

I’d love to start getting feedback on these ideas as we’re moving towards the BoF in Singapore!

— Justin