@bedrock/vc-delivery 7.16.1 → 7.17.1

package/lib/ExchangeProcessor.js

@@ -258,7 +258,7 @@ export class ExchangeProcessor {
 
     // 5. Set the verification results in
     // `exchange.variables.results[exchange.step]`.
-    const {verificationMethod} = verifyResult;
+    const {verificationMethod, publicKeyJwk} = verifyResult;
     exchange.variables.results[exchange.step] = {
       ...exchange.variables.results[exchange.step],
       // common use case of DID Authentication; provide `did` for ease
@@ -266,6 +266,7 @@ export class ExchangeProcessor {
       // receives `did` not verification method nor VP
       did: verificationMethod?.controller || null,
       verificationMethod,
+      publicKeyJwk,
       verifiablePresentation,
       verifyPresentationResults: buildVerifyPresentationResults({verifyResult})
     };

package/lib/issue.js

@@ -129,6 +129,7 @@ export function getIssueRequestsParams({workflow, exchange, step}) {
       }
     }
     const params = {
+      issuerInstanceId: r.issuerInstanceId,
       oid4vci: r.oid4vci,
       typedTemplate,
       variables: {
@@ -162,25 +163,36 @@ async function _evalIssueRequests({
   }));
 }
 
-function _getIssueZcap({issuerInstances, zcaps, issueRequest, mediaType}) {
+function _getIssueZcap({
+  issuerInstances, zcaps, issueRequestParams, mediaType
+}) {
   const {
     issuerInstanceId,
     oid4vci: {credentialConfigurationId} = {}
-  } = issueRequest;
-  const {zcapReferenceIds: {issue: issueRefId}} = issuerInstances.find(
-    ({id, oid4vci, supportedMediaTypes}) => {
-      // find by `issuerInstanceId` if given
-      if(id && id === issuerInstanceId) {
-        return true;
-      }
-      // find by `credentialConfigurationId` if given
-      if(credentialConfigurationId && oid4vci) {
-        return oid4vci.supportedConfigurationIds.includes(
-          credentialConfigurationId);
-      }
-      // find by `mediaType` instead
-      return supportedMediaTypes.includes(mediaType);
-    });
+  } = issueRequestParams;
+  const instance = issuerInstances.find(instance => {
+    const {id, oid4vci, supportedMediaTypes} = instance;
+    // find by `issuerInstanceId` if given
+    if(id && id === issuerInstanceId) {
+      return true;
+    }
+    // find by `credentialConfigurationId` if given
+    if(credentialConfigurationId && oid4vci) {
+      return oid4vci.supportedCredentialConfigurations
+        [credentialConfigurationId] !== undefined;
+    }
+    // find by `mediaType` instead
+    return supportedMediaTypes.includes(mediaType);
+  });
+  if(!instance) {
+    throw new BedrockError(
+      'Workflow step "issueRequest" configuration error; ' +
+      'no matching issuer instance found.', {
+        name: 'DataError',
+        details: {httpStatusCode: 500, public: true}
+      });
+  }
+  const {zcapReferenceIds: {issue: issueRefId}} = instance;
   return zcaps[issueRefId];
 }
 
@@ -199,7 +211,7 @@ async function _issue({workflow, exchange, issueRequests, mediaType} = {}) {
 
     // get the zcap to use for the issue request
     const capability = _getIssueZcap({
-      issuerInstances, zcaps, issueRequest, mediaType
+      issuerInstances, zcaps, issueRequestParams: params, mediaType
     });
 
     // specify URL to `/credentials/issue` to handle case that capability

package/lib/oid4/oid4vci.js

@@ -451,7 +451,7 @@ export async function processCredentialRequests({req, res, isBatchRequest}) {
         }
 
         // verify every DID proof and get resulting DIDs
-        const results = await Promise.all(
+        const credentialRequestProofResults = await Promise.all(
           credentialRequests.map(async credentialRequest => {
             return verifyCredentialRequestProof({
               credentialRequest, workflow, exchange
@@ -459,17 +459,18 @@ export async function processCredentialRequests({req, res, isBatchRequest}) {
           }));
         // require `did` to be the same for every proof
         // FIXME: determine if this needs to be more flexible
-        const did = results[0];
-        if(results.some(d => did !== d)) {
+        const did = credentialRequestProofResults[0].did;
+        if(credentialRequestProofResults.some(({did: d}) => did !== d)) {
           // FIXME: improve error
           throw new Error('every DID must be the same');
         }
-        // store did results in variables associated with current step
+        // store results in variables associated with current step
         exchange.variables.results[exchange.step] = {
           ...exchange.variables.results[exchange.step],
           // common use case of DID Authentication; provide `did` for ease
           // of use in templates
-          did
+          did,
+          credentialRequestProofResults
         };
       }
     },

package/lib/oid4/oid4vciDraft13.js

@@ -25,12 +25,14 @@ export function createSupportedCredentialConfigurations({
 
   // for every expected credential request and supported format, generate a
   // supported credential configuration
-  for(const credentialRequest of expectedCredentialRequests) {
-    const configurations = _createCredentialConfigurations({
-      credentialRequest, supportedFormats, step
-    });
-    for(const {id, configuration} of configurations) {
-      supported.set(id, configuration);
+  if(expectedCredentialRequests) {
+    for(const credentialRequest of expectedCredentialRequests) {
+      const configurations = _createCredentialConfigurations({
+        credentialRequest, supportedFormats, step
+      });
+      for(const {id, configuration} of configurations) {
+        supported.set(id, configuration);
+      }
     }
   }
 

package/lib/verify.js

@@ -142,7 +142,10 @@ export async function verify({
   return {
     verified,
     challengeUses,
+    // return original VM result and w/both common key formats
     verificationMethod,
+    multikey: await _toMultikey({vm: verificationMethod}),
+    publicKeyJwk: await _toJwk(verificationMethod),
     credentialResults,
     presentationResult
   };
@@ -157,16 +160,36 @@ export async function verifyCredentialRequestProof({
 
   let _did;
   const dids = [];
+  const verifyResults = {};
   if(diVp) {
-    const {did} = await verifyDidProofDiVp({workflow, exchange, diVp});
-    dids.push(did);
-    _did = did;
+    const result = await verifyDidProofDiVp({workflow, exchange, diVp});
+    verifyResults.di_vp = verifyResults.di_vp ?? [];
+    verifyResults.di_vp.push({
+      did: result.did,
+      // return original VM result and w/both common key formats
+      verificationMethod: result.verifyResult.verificationMethod,
+      multikey: await _toMultikey({vm: result.verifyResult.verificationMethod}),
+      publicKeyJwk: await _toJwk(result.verifyResult.verificationMethod)
+    });
+    dids.push(result.did);
+    _did = result.did;
   }
   if(jwt) {
-    const {did} = await verifyDidProofJwt({workflow, exchange, jwt});
-    dids.push(did);
+    const result = await verifyDidProofJwt({workflow, exchange, jwt});
+    verifyResults.jwt = verifyResults.jwt ?? [];
+    const multikey = await _toMultikey({
+      jwk: result.verifyResult.jwk, controller: result.did
+    });
+    verifyResults.jwt.push({
+      did: result.did,
+      // return original VM result and w/both common key formats
+      verificationMethod: multikey,
+      multikey,
+      publicKeyJwk: result.verifyResult.jwk
+    });
+    dids.push(result.did);
     if(_did === undefined) {
-      _did = did;
+      _did = result.did;
     }
   }
 
@@ -175,7 +198,7 @@ export async function verifyCredentialRequestProof({
     throw new Error('every DID must be the same');
   }
 
-  return _did;
+  return {did: _did, credentialRequest, verifyResults};
 }
 
 export async function verifyDidProofDiVp({workflow, exchange, diVp} = {}) {
@@ -191,6 +214,7 @@ export async function verifyDidProofDiVp({workflow, exchange, diVp} = {}) {
     expectedChallenge: exchange.id,
     expectedDomain: exchangeId
   });
+  // FIXME: ensure cryptosuite used matches a supported `di_vp` proof type
   const did = verifyResult.verificationMethod.controller;
   return {verified: true, did, verifyResult};
 }
@@ -208,6 +232,7 @@ export async function verifyDidProofJwt({workflow, exchange, jwt} = {}) {
 
   let issuer;
   // `resolveKey` is passed `protectedHeader`
+  let jwk;
   const resolveKey = async ({alg, kid}) => {
     const isEcdsa = ECDSA_ALGS.includes(alg);
     const isEddsa = !isEcdsa && EDDSA_ALGS.includes(alg);
@@ -258,7 +283,6 @@ export async function verifyDidProofJwt({workflow, exchange, jwt} = {}) {
           }
         });
     }
-    let jwk;
     if(isEcdsa) {
       const keyPair = await EcdsaMultikey.from(vm);
       jwk = await EcdsaMultikey.toJwk({keyPair});
@@ -272,6 +296,7 @@ export async function verifyDidProofJwt({workflow, exchange, jwt} = {}) {
   };
 
   // FIXME: indicate supported signatures
+  // FIXME: ensure algorithm used matches a supported `jwt` algs
   // const allowedAlgorithms = [];
 
   // use `jose` lib (for now) to verify JWT and return `payload`;
@@ -285,7 +310,7 @@ export async function verifyDidProofJwt({workflow, exchange, jwt} = {}) {
       audience,
       clockTolerance: maxClockSkew
     });
-    verifyResult = {payload, protectedHeader};
+    verifyResult = {payload, protectedHeader, jwk};
   } catch(e) {
     const details = {
       httpStatusCode: 403,
@@ -332,3 +357,69 @@ export async function verifyDidProofJwt({workflow, exchange, jwt} = {}) {
 
   return {verified: true, did: issuer, verifyResult};
 }
+
+function _getJwkAlgFromMultibase(mb) {
+  if(mb.startsWith('zDna')) {
+    return 'ES256';
+  }
+  if(mb.startsWith('z82L')) {
+    return 'ES384';
+  }
+  if(mb.startsWith('z6Mk')) {
+    return 'EdDSA';
+  }
+}
+
+// tries to convert to JWK and returns undefined if it cannot
+async function _toJwk(vm) {
+  if(vm?.type === 'JsonWebKey') {
+    return vm.publicKeyJwk;
+  }
+  if(!vm?.publicKeyMultibase) {
+    return;
+  }
+  let jwk;
+  const alg = _getJwkAlgFromMultibase(vm.publicKeyMultibase);
+  if(alg === 'EdDSA') {
+    const keyPair = await Ed25519Multikey.from(vm);
+    jwk = await Ed25519Multikey.toJwk({keyPair});
+    jwk.alg = 'EdDSA';
+  } else if(alg?.startsWith('ES')) {
+    const keyPair = await EcdsaMultikey.from(vm);
+    jwk = await EcdsaMultikey.toJwk({keyPair});
+    jwk.alg = alg;
+  }
+  return jwk;
+}
+
+// tries to convert to multikey and returns undefined if it cannot
+async function _toMultikey({vm, jwk, controller}) {
+  if(vm?.type === 'JsonWebKey') {
+    jwk = vm.publicKeyJwk;
+  }
+
+  let keyPair;
+  if(jwk) {
+    if(jwk.crv === 'Ed25519' || jwk.alg === 'EdDSA') {
+      keyPair = await Ed25519Multikey.fromJwk({jwk, controller});
+    }
+    if(jwk.crv?.startsWith('P-') || jwk.alg?.startsWith('ES')) {
+      keyPair = await EcdsaMultikey.fromJwk({jwk, controller});
+    }
+  } else if(vm?.publicKeyMultibase) {
+    if(vm.type === 'Multikey') {
+      // return VM as-is
+      return vm;
+    }
+    const alg = _getJwkAlgFromMultibase(vm.publicKeyMultibase);
+    if(alg === 'EdDSA') {
+      keyPair = await Ed25519Multikey.from(vm);
+    } else if(alg.startsWith('ES')) {
+      keyPair = await EcdsaMultikey.from(vm);
+    }
+  }
+
+  if(keyPair) {
+    return keyPair.export();
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/vc-delivery",
-  "version": "7.16.1",
+  "version": "7.17.1",
   "type": "module",
   "description": "Bedrock Verifiable Credential Delivery",
   "main": "./lib/index.js",

package/schemas/bedrock-vc-workflow.js

@@ -232,6 +232,57 @@ function credentialConfiguration() {
   };
 }
 
+function mdocCredentialConfiguration() {
+  return {
+    title: 'OID4VCI Credential Configuration for mdocs',
+    type: 'object',
+    required: [
+      'cryptographic_binding_methods_supported',
+      'credential_signing_alg_values_supported',
+      'doctype',
+      'format',
+      'proof_types_supported'
+    ],
+    additionalProperties: false,
+    properties: {
+      cryptographic_binding_methods_supported: {
+        type: 'array',
+        minItems: 1,
+        maxItems: 1,
+        items: {
+          type: 'string',
+          enum: ['cose_key']
+        }
+      },
+      credential_signing_alg_values_supported: {
+        // schema could be improved to ensure array is const: [-7, -9]; but
+        // other values might be acceptable in the future
+        type: 'array',
+        minItems: 2,
+        maxItems: 2,
+        items: {
+          type: 'number',
+          enum: [-7, -9]
+        }
+      },
+      doctype: {
+        const: 'org.iso.18013.5.1.mDL'
+      },
+      format: {
+        type: 'string',
+        enum: ['mso_mdoc']
+      },
+      proof_types_supported: {
+        type: 'object',
+        properties: {
+          di_vp: supportedProofTypeConfiguration,
+          jwt: supportedProofTypeConfiguration
+        }
+      }
+    }
+  };
+}
+
 const openIdExchangeOptions = {
   title: 'OpenID Exchange options',
   type: 'object',
@@ -367,7 +418,9 @@ const issuerInstance = {
           type: 'object',
           additionalProperties: false,
           patternProperties: {
-            '^.*$': credentialConfiguration()
+            '^.*$': {
+              oneOf: [credentialConfiguration(), mdocCredentialConfiguration()]
+            }
           }
         }
       }