# IssuerDiaSubjectMatch — credential issuer DID is a DIA subject.

@prefix sh:     <http://www.w3.org/ns/shacl#> .
@prefix rdfs:   <http://www.w3.org/2000/01/rdf-schema#> .
@prefix owl:    <http://www.w3.org/2002/07/owl#> .
@prefix xsd:    <http://www.w3.org/2001/XMLSchema#> .
@prefix cred:   <https://www.w3.org/2018/credentials#> .
@prefix unece:  <https://test.uncefact.org/vocabulary/> .
@prefix gv:     <https://vocabulary.uncefact.org/untp/shapes/> .

gv:IssuerDiaSubjectMatch
    a owl:Ontology, sh:NodeShape ;
    owl:versionInfo "0.8.0" ;
    rdfs:label "Issuer DID matches DIA subject"@en ;
    rdfs:comment "The issuer DID of a UNTP credential must equal the credentialSubject of a Digital Identity Anchor in the graph. Otherwise the issuer is an unanchored DID — technically verifiable, but not bound to a registered identity."@en ;
    rdfs:seeAlso <https://untp.unece.org/docs/specification/DigitalIdentityAnchor> ;
    sh:declare
        [ sh:prefix "cred" ; sh:namespace "https://www.w3.org/2018/credentials#"^^xsd:anyURI ] ,
        [ sh:prefix "unece" ; sh:namespace "https://test.uncefact.org/vocabulary/"^^xsd:anyURI ] ;
    sh:targetSubjectsOf cred:issuer ;
    sh:sparql [
        a sh:SPARQLConstraint ;
        sh:message "This credential's issuer DID is not the subject of any Digital Identity Anchor in the graph."@en ;
        sh:prefixes gv:IssuerDiaSubjectMatch ;
        sh:select """
            PREFIX cred:  <https://www.w3.org/2018/credentials#>
            PREFIX unece: <https://test.uncefact.org/vocabulary/>
            SELECT $this ?issuer
            WHERE {
              $this cred:issuer ?issuer .
              FILTER NOT EXISTS { ?issuer a unece:RegisteredIdentity }
            }
        """ ;
    ] .