@bedrock/vc-delivery 5.3.2 → 5.3.4

package/lib/helpers.js

@@ -110,6 +110,44 @@ export function decodeLocalId({localId} = {}) {
   }));
 }
 
+export function deepEqual(obj1, obj2) {
+  const isObject1 = obj1 && typeof obj1 === 'object';
+  const isObject2 = obj2 && typeof obj2 === 'object';
+  if(isObject1 !== isObject2) {
+    return false;
+  }
+  if(!isObject1) {
+    return obj1 === obj2;
+  }
+  const isArray1 = Array.isArray(obj1);
+  const isArray2 = Array.isArray(obj2);
+  if(isArray1 !== isArray2) {
+    return false;
+  }
+  if(isArray1) {
+    if(obj1.length !== obj2.length) {
+      return false;
+    }
+    for(const [i, e] of obj1.entries()) {
+      if(!deepEqual(e, obj2[i])) {
+        return false;
+      }
+    }
+    return true;
+  }
+  const keys1 = Object.keys(obj1);
+  const keys2 = Object.keys(obj2);
+  if(keys1.length !== keys2.length) {
+    return false;
+  }
+  for(const k of keys1) {
+    if(!deepEqual(obj1[k], obj2[k])) {
+      return false;
+    }
+  }
+  return true;
+}
+
 export function stripStacktrace(error) {
   // serialize error and allow-list specific properties
   const serialized = serializeError(error);

package/lib/oid4/oid4vci.js

@@ -4,7 +4,7 @@
 import * as bedrock from '@bedrock/core';
 import * as exchanges from '../exchanges.js';
 import {
-  evaluateTemplate, getWorkflowIssuerInstances
+  deepEqual, evaluateTemplate, getWorkflowIssuerInstances
 } from '../helpers.js';
 import {importJWK, SignJWT} from 'jose';
 import {checkAccessToken} from '@bedrock/oauth2-verifier';
@@ -372,9 +372,9 @@ function _getSupportedFormats({workflow}) {
 function _matchCredentialRequest(expected, cr) {
   const {credential_definition: {'@context': c1, type: t1}} = expected;
   const {credential_definition: {'@context': c2, type: t2}} = cr;
-  // contexts must match exact order but types can have different order
+  // contexts must match exactly but types can have different order
   return (c1.length === c2.length && t1.length === t2.length &&
-    c1.every((c, i) => c === c2[i]) && t1.every(t => t2.some(x => t === x)));
+    deepEqual(c1, c2) && t1.every(t => t2.some(x => t === x)));
 }
 
 function _normalizeCredentialDefinitionTypes({credentialRequests}) {

package/lib/verify.js

@@ -181,9 +181,9 @@ export async function verifyDidProofJwt({workflow, exchange, jwt} = {}) {
     if(typeof match === 'string') {
       match = didDoc?.verificationMethod?.find?.(e => e.id === vm.id);
     }
-    if(!(match && Array.isArray(match.controller) ?
+    if(!(match && (Array.isArray(match.controller) ?
       match.controller.includes(vm.controller) :
-      match.controller === vm.controller)) {
+      match.controller === vm.controller))) {
       throw new BedrockError(
         `Verification method controller "${issuer}" did not authorize ` +
         `verification method "${vm.id}" for the purpose of "authentication".`, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/vc-delivery",
-  "version": "5.3.2",
+  "version": "5.3.4",
   "type": "module",
   "description": "Bedrock Verifiable Credential Delivery",
   "main": "./lib/index.js",