@bedrock/vc-delivery 5.0.1 → 5.2.0

package/lib/oid4/oid4vp.js

@@ -0,0 +1,330 @@
+/*!
+ * Copyright (c) 2022-2024 Digital Bazaar, Inc. All rights reserved.
+ */
+import * as bedrock from '@bedrock/core';
+import * as exchanges from '../exchanges.js';
+import {evaluateTemplate, unenvelopePresentation} from '../helpers.js';
+import {
+  presentationSubmission as presentationSubmissionSchema,
+  verifiablePresentation as verifiablePresentationSchema
+} from '../../schemas/bedrock-vc-workflow.js';
+import {compile} from '@bedrock/validation';
+import {klona} from 'klona';
+import {oid4vp} from '@digitalbazaar/oid4-client';
+import {verify} from '../verify.js';
+
+const {util: {BedrockError}} = bedrock;
+
+const VC_CONTEXT_2 = 'https://www.w3.org/ns/credentials/v2';
+
+const VALIDATORS = {
+  presentation: null,
+  presentationSubmission: null
+};
+
+bedrock.events.on('bedrock.init', () => {
+  // create validators for x-www-form-urlencoded parsed data
+  VALIDATORS.presentation = compile({schema: verifiablePresentationSchema()});
+  VALIDATORS.presentationSubmission = compile({
+    schema: presentationSubmissionSchema
+  });
+});
+
+export async function getAuthorizationRequest({req}) {
+  const {config: workflow} = req.serviceObject;
+  const exchangeRecord = await req.getExchange();
+  let {exchange} = exchangeRecord;
+  let step;
+
+  while(true) {
+    // exchange step required for OID4VP
+    const currentStep = exchange.step;
+    if(!currentStep) {
+      _throwUnsupportedProtocol();
+    }
+
+    step = workflow.steps[exchange.step];
+    if(step.stepTemplate) {
+      // generate step from the template; assume the template type is
+      // `jsonata` per the JSON schema
+      step = await evaluateTemplate(
+        {workflow, exchange, typedTemplate: step.stepTemplate});
+      if(Object.keys(step).length === 0) {
+        throw new BedrockError('Could not create authorization request.', {
+          name: 'DataError',
+          details: {httpStatusCode: 500, public: true}
+        });
+      }
+    }
+
+    // step must have `openId` to perform OID4VP
+    if(!step.openId) {
+      _throwUnsupportedProtocol();
+    }
+
+    let updateExchange = false;
+
+    if(exchange.state === 'pending') {
+      exchange.state = 'active';
+      updateExchange = true;
+    }
+
+    // get authorization request
+    let authorizationRequest = step.openId.authorizationRequest;
+    if(!authorizationRequest) {
+      // create authorization request...
+      // get variable name for authorization request
+      const authzReqName = step.openId.createAuthorizationRequest;
+      if(authzReqName === undefined) {
+        _throwUnsupportedProtocol();
+      }
+
+      // create or get cached authorization request
+      authorizationRequest = exchange.variables?.[authzReqName];
+      if(!authorizationRequest) {
+        const {verifiablePresentationRequest} = step;
+        authorizationRequest = oid4vp.fromVpr({verifiablePresentationRequest});
+
+        // add / override params from step `openId` information
+        const {
+          client_id, client_id_scheme,
+          client_metadata, client_metadata_uri,
+          nonce, response_uri
+        } = step.openId || {};
+        if(client_id) {
+          authorizationRequest.client_id = client_id;
+        } else {
+          authorizationRequest.client_id =
+            `${workflow.id}/exchanges/${exchange.id}` +
+            '/openid/client/authorization/response';
+        }
+        if(client_id_scheme) {
+          authorizationRequest.client_id_scheme = client_id_scheme;
+        } else if(authorizationRequest.client_id_scheme === undefined) {
+          authorizationRequest.client_id_scheme = 'redirect_uri';
+        }
+        if(client_metadata) {
+          authorizationRequest.client_metadata = klona(client_metadata);
+        } else if(client_metadata_uri) {
+          authorizationRequest.client_metadata_uri = client_metadata_uri;
+        } else {
+          // auto-generate client_metadata
+          authorizationRequest.client_metadata = _createClientMetaData();
+        }
+        if(nonce) {
+          authorizationRequest.nonce = nonce;
+        } else if(authorizationRequest.nonce === undefined) {
+          // if no nonce has been set for the authorization request, use the
+          // exchange ID
+          authorizationRequest.nonce = exchange.id;
+        }
+        if(response_uri) {
+          authorizationRequest.response_uri = response_uri;
+        } else if(authorizationRequest.response_mode === 'direct_post' &&
+          authorizationRequest.client_id_scheme === 'redirect_uri') {
+          // `authorizationRequest` uses `direct_post` so force client ID to
+          // be the exchange response URL per "Note" here:
+          // eslint-disable-next-line max-len
+          // https://openid.github.io/OpenID4VP/openid-4-verifiable-presentations-wg-draft.html#section-6.2
+          authorizationRequest.response_uri = authorizationRequest.client_id;
+        }
+
+        // store generated authorization request
+        updateExchange = true;
+        if(!exchange.variables) {
+          exchange.variables = {};
+        }
+        exchange.variables[authzReqName] = authorizationRequest;
+      }
+    }
+
+    if(updateExchange) {
+      exchange.sequence++;
+      try {
+        await exchanges.update({workflowId: workflow.id, exchange});
+      } catch(e) {
+        if(e.name !== 'InvalidStateError') {
+          // unrecoverable error
+          throw e;
+        }
+        // get exchange and loop to try again on `InvalidStateError`
+        const record = await exchanges.get(
+          {workflowId: workflow.id, id: exchange.id});
+        ({exchange} = record);
+        continue;
+      }
+    }
+
+    return {authorizationRequest, exchange, step};
+  }
+}
+
+export async function processAuthorizationResponse({req}) {
+  const {
+    presentation, envelope, presentationSubmission
+  } = await _parseAuthorizationResponse({req});
+
+  const {config: workflow} = req.serviceObject;
+  const exchangeRecord = await req.getExchange();
+  let {exchange} = exchangeRecord;
+
+  // get authorization request and updated exchange associated with exchange
+  const arRequest = await getAuthorizationRequest({req});
+  const {authorizationRequest, step} = arRequest;
+  ({exchange} = arRequest);
+
+  // FIXME: check the VP against the presentation submission if requested
+  // FIXME: check the VP against "trustedIssuer" in VPR, if provided
+  const {presentationSchema} = step;
+  if(presentationSchema) {
+    // if the VP is enveloped, validate the contents of the envelope
+    const toValidate = envelope ? envelope.contents : presentation;
+
+    // validate the received VP / envelope contents
+    const {jsonSchema: schema} = presentationSchema;
+    const validate = compile({schema});
+    const {valid, error} = validate(toValidate);
+    if(!valid) {
+      throw error;
+    }
+  }
+
+  // verify the received VP
+  const {verifiablePresentationRequest} = await oid4vp.toVpr(
+    {authorizationRequest});
+  const {allowUnprotectedPresentation = false} = step;
+  const verifyResult = await verify({
+    workflow,
+    verifiablePresentationRequest,
+    presentation,
+    allowUnprotectedPresentation,
+    expectedChallenge: authorizationRequest.nonce
+  });
+  const {verificationMethod} = verifyResult;
+
+  // store VP results in variables associated with current step
+  const currentStep = exchange.step;
+  if(!exchange.variables.results) {
+    exchange.variables.results = {};
+  }
+  const results = {
+    // common use case of DID Authentication; provide `did` for ease
+    // of use in template
+    did: verificationMethod?.controller || null,
+    verificationMethod,
+    verifiablePresentation: presentation,
+    openId: {
+      authorizationRequest,
+      presentationSubmission
+    }
+  };
+  if(envelope) {
+    // normalize VP from inside envelope to `verifiablePresentation`
+    results.envelopedPresentation = presentation;
+    results.verifiablePresentation = verifyResult
+      .presentationResult.presentation;
+  }
+  exchange.variables.results[currentStep] = results;
+  exchange.sequence++;
+
+  // if there is something to issue, update exchange, do not complete it
+  const {credentialTemplates = []} = workflow;
+  if(credentialTemplates?.length > 0 &&
+    (exchange.state === 'pending' || exchange.state === 'active')) {
+    // ensure exchange state is set to `active` (will be rejected as a
+    // conflict if the state in database at update time isn't `pending` or
+    // `active`)
+    exchange.state = 'active';
+    await exchanges.update({workflowId: workflow.id, exchange});
+  } else {
+    // mark exchange complete
+    await exchanges.complete({workflowId: workflow.id, exchange});
+  }
+
+  const result = {};
+
+  // include `redirect_uri` if specified in step
+  const redirect_uri = step.openId?.redirect_uri;
+  if(redirect_uri) {
+    result.redirect_uri = redirect_uri;
+  }
+
+  return result;
+}
+
+function _createClientMetaData() {
+  // return default supported `vp_formats`
+  return {
+    vp_formats: {
+      jwt_vp: {
+        alg: ['EdDSA', 'Ed25519', 'ES256', 'ES384']
+      },
+      ldp_vp: {
+        proof_type: [
+          'ecdsa-rdfc-2019',
+          'eddsa-rdfc-2022',
+          'Ed25519Signature2020'
+        ]
+      }
+    }
+  };
+}
+
+async function _parseAuthorizationResponse({req}) {
+  // get JSON `vp_token` and `presentation_submission`
+  const {vp_token, presentation_submission} = req.body;
+
+  // JSON parse and validate `vp_token` and `presentation_submission`
+  let presentation = _jsonParse(vp_token, 'vp_token');
+  const presentationSubmission = _jsonParse(
+    presentation_submission, 'presentation_submission');
+  _validate(VALIDATORS.presentationSubmission, presentationSubmission);
+  let envelope;
+  if(typeof presentation === 'string') {
+    // handle enveloped presentation
+    const {
+      envelope: raw, presentation: contents, format
+    } = await unenvelopePresentation({
+      envelopedPresentation: presentation,
+      // FIXME: check presentationSubmission for VP format
+      format: 'jwt_vc_json-ld'
+    });
+    _validate(VALIDATORS.presentation, contents);
+    presentation = {
+      '@context': VC_CONTEXT_2,
+      id: `data:${format},${raw}`,
+      type: 'EnvelopedVerifiablePresentation'
+    };
+    envelope = {raw, contents, format};
+  } else {
+    _validate(VALIDATORS.presentation, presentation);
+  }
+
+  return {presentation, envelope, presentationSubmission};
+}
+
+function _jsonParse(x, name) {
+  try {
+    return JSON.parse(x);
+  } catch(cause) {
+    throw new BedrockError(`Could not parse "${name}".`, {
+      name: 'DataError',
+      details: {httpStatusCode: 400, public: true},
+      cause
+    });
+  }
+}
+
+function _throwUnsupportedProtocol() {
+  throw new BedrockError('OID4VP is not supported by this exchange.', {
+    name: 'NotSupportedError',
+    details: {httpStatusCode: 400, public: true}
+  });
+}
+
+function _validate(validator, data) {
+  const result = validator(data);
+  if(!result.valid) {
+    throw result.error;
+  }
+}

package/lib/vcapi.js

@@ -4,7 +4,10 @@
 import * as bedrock from '@bedrock/core';
 import * as exchanges from './exchanges.js';
 import {createChallenge as _createChallenge, verify} from './verify.js';
-import {evaluateTemplate, unenvelopePresentation} from './helpers.js';
+import {
+  evaluateTemplate, generateRandom, unenvelopePresentation
+} from './helpers.js';
+import {exportJWK, generateKeyPair, importJWK} from 'jose';
 import {compile} from '@bedrock/validation';
 import {issue} from './issue.js';
 import {klona} from 'klona';
@@ -13,6 +16,79 @@ import {logger} from './logger.js';
 const {util: {BedrockError}} = bedrock;
 
 const MAXIMUM_STEPS = 100;
+const FIFTEEN_MINUTES = 60 * 15;
+
+export async function createExchange({workflow, exchange}) {
+  const {
+    ttl = FIFTEEN_MINUTES, openId, variables = {},
+    // allow steps to be skipped by creator as needed
+    step = workflow.initialStep
+  } = exchange;
+
+  // validate exchange step, if given
+  if(step && !(step in workflow.steps)) {
+    throw new BedrockError(`Undefined step "${step}".`, {
+      name: 'DataError',
+      details: {httpStatusCode: 400, public: true}
+    });
+  }
+
+  if(openId) {
+    // either issuer instances or a single issuer zcap be given if
+    // any expected credential requests are given
+    const {expectedCredentialRequests} = openId;
+    if(expectedCredentialRequests &&
+      !(workflow.issuerInstances || workflow.zcaps.issue)) {
+      throw new BedrockError(
+        'Credential requests are not supported by this workflow.', {
+          name: 'DataError',
+          details: {httpStatusCode: 400, public: true}
+        });
+    }
+
+    // perform key generation if requested
+    if(openId.oauth2?.generateKeyPair) {
+      const {oauth2} = openId;
+      const {algorithm} = oauth2.generateKeyPair;
+      const kp = await generateKeyPair(algorithm, {extractable: true});
+      const [privateKeyJwk, publicKeyJwk] = await Promise.all([
+        exportJWK(kp.privateKey),
+        exportJWK(kp.publicKey),
+      ]);
+      oauth2.keyPair = {privateKeyJwk, publicKeyJwk};
+      delete oauth2.generateKeyPair;
+    } else {
+      // ensure key pair can be imported
+      try {
+        const {oauth2: {keyPair}} = openId;
+        await Promise.all([
+          importJWK(keyPair.privateKeyJwk),
+          importJWK(keyPair.publicKeyJwk)
+        ]);
+      } catch(e) {
+        throw new BedrockError(
+          'Could not import OpenID OAuth2 key pair.', {
+            name: 'DataError',
+            details: {httpStatusCode: 400, public: true},
+            cause: e
+          });
+      }
+    }
+  }
+
+  // insert exchange
+  const {id: workflowId} = workflow;
+  exchange = {
+    id: await generateRandom(),
+    ttl,
+    variables,
+    openId,
+    step
+  };
+  await exchanges.insert({workflowId, exchange});
+  // FIXME: run parallel process to pre-warm cache with new exchange record
+  return exchange;
+}
 
 export async function processExchange({req, res, workflow, exchange}) {
   // get any `verifiablePresentation` from the body...

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/vc-delivery",
-  "version": "5.0.1",
+  "version": "5.2.0",
   "type": "module",
   "description": "Bedrock Verifiable Credential Delivery",
   "main": "./lib/index.js",