@bedrock/vc-delivery 7.18.2 → 7.19.0

package/lib/helpers.js

@@ -175,6 +175,27 @@ export async function generateRandom() {
   });
 }
 
+export function getAlgFromJwk({jwk} = {}) {
+  if(jwk.alg) {
+    return jwk.alg;
+  }
+  if(jwk.kty === 'EC' && jwk.crv) {
+    if(jwk.crv.startsWith('P-')) {
+      return `ES${jwk.crv.slice(2)}`;
+    }
+    if(jwk.crv === 'secp256k1') {
+      return 'ES256K';
+    }
+  }
+  if(jwk.kty === 'OKP' && jwk.crv?.startsWith('Ed')) {
+    return 'EdDSA';
+  }
+  if(jwk.kty === 'RSA') {
+    return 'PS256';
+  }
+  return 'invalid';
+}
+
 export function getWorkflowIssuerInstances({workflow} = {}) {
   let {issuerInstances} = workflow;
   if(!issuerInstances && workflow.zcaps.issue) {

package/lib/oid4/authorizationRequest.js

@@ -3,7 +3,7 @@
  */
 import * as bedrock from '@bedrock/core';
 import {AsymmetricKey, KmsClient} from '@digitalbazaar/webkms-client';
-import {exportJWK, generateKeyPair} from 'jose';
+import {exportJWK, generateKeyPair, importJWK} from 'jose';
 import {oid4vp, signJWT} from '@digitalbazaar/oid4-client';
 import {getClientBaseUrl} from './clientProfiles.js';
 import {getZcapClient} from '../helpers.js';
@@ -237,42 +237,65 @@ async function _createJwt({workflow, clientProfile, authorizationRequest}) {
     // create zcap client
     const {zcapClient, zcaps} = await getZcapClient({workflow});
 
-    // get any `x5c` and the zcap to use to sign the authz request via
-    // the client profile
+    // get any `x5c` and either `privateKeyJwk` or the zcap to use to sign the
+    // authz request via the client profile
     const {
-      authorizationRequestSigningParameters: {x5c} = {},
+      authorizationRequestSigningParameters: {privateKeyJwk, x5c} = {},
       zcapReferenceIds: {signAuthorizationRequest: refId} = {}
     } = clientProfile;
-    if(refId === undefined) {
+    if(privateKeyJwk === undefined && refId === undefined) {
       throw new BedrockError(
-        'The OID4VP client profile does not specify which capability in the ' +
-        'workflow configuration to use to sign authorization requests.', {
-          name: 'DataError',
-          details: {httpStatusCode: 500, public: true}
-        });
-    }
-    const capability = zcaps[refId];
-    if(capability === undefined) {
-      throw new BedrockError(
-        'The capability specified by the OID4VP client profile for signing ' +
-        'authorization requests was not found in the workflow configuration.', {
+        'The OID4VP client profile does not specify the private key or ' +
+        'capability in the  workflow configuration to use to sign ' +
+        'authorization requests.', {
           name: 'DataError',
           details: {httpStatusCode: 500, public: true}
         });
     }
 
-    // create a WebKMS `signer` interface
-    const {invocationSigner} = zcapClient;
-    const kmsClient = new KmsClient({httpsAgent});
-    const signer = await AsymmetricKey.fromCapability({
-      capability, invocationSigner, kmsClient
-    });
-    const keyDescription = await signer.getKeyDescription();
-    const kid = keyDescription.id;
+    // code assumed ES256 (ECDSA P-256 + SHA-256) support only
+    const alg = 'ES256';
+    let kid;
+    let signer;
+    if(privateKeyJwk) {
+      kid = privateKeyJwk.kid;
+
+      // import `privateKeyJwk`
+      const privateKey = await importJWK(privateKeyJwk, alg);
+
+      // create signer API
+      const algorithm = {name: 'ECDSA', hash: {name: 'SHA-256'}};
+      signer = {
+        async sign({data}) {
+          return new Uint8Array(
+            await crypto.subtle.sign(algorithm, privateKey, data));
+        }
+      };
+    } else {
+      const capability = zcaps[refId];
+      if(capability === undefined) {
+        throw new BedrockError(
+          'The capability specified by the OID4VP client profile for signing ' +
+          'authorization requests was not found in the workflow ' +
+          'configuration.', {
+            name: 'DataError',
+            details: {httpStatusCode: 500, public: true}
+          });
+      }
+
+      // create a WebKMS `signer` interface
+      const {invocationSigner} = zcapClient;
+      const kmsClient = new KmsClient({httpsAgent});
+      signer = await AsymmetricKey.fromCapability({
+        capability, invocationSigner, kmsClient
+      });
+      const keyDescription = await signer.getKeyDescription();
+      kid = keyDescription.id;
+    }
 
     // create the JWT payload and header to be signed
     const payload = {...authorizationRequest};
-    const protectedHeader = {typ: OID4VP_JWT_TYP, alg: 'ES256', kid, x5c};
+    const protectedHeader = {typ: OID4VP_JWT_TYP, alg, kid, x5c};
 
     // create the JWT
     return signJWT({payload, protectedHeader, signer});

package/lib/oid4/oid4vci.js

@@ -4,7 +4,9 @@
 import * as bedrock from '@bedrock/core';
 import * as draft13 from './oid4vciDraft13.js';
 import {issue as defaultIssue, getIssueRequestsParams} from '../issue.js';
-import {getWorkflowIssuerInstances, setVariable} from '../helpers.js';
+import {
+  getAlgFromJwk, getWorkflowIssuerInstances, setVariable
+} from '../helpers.js';
 import {importJWK, SignJWT} from 'jose';
 import {timingSafeEqual, randomUUID as uuid} from 'node:crypto';
 import {
@@ -648,7 +650,7 @@ function _createSupportedCredentialRequests({
 async function _createOAuth2AccessToken({
   privateKeyJwk, audience, action, target, exp, iss, nbf, typ = 'at+jwt'
 }) {
-  const alg = _getAlgFromPrivateKey({privateKeyJwk});
+  const alg = getAlgFromJwk({jwk: privateKeyJwk});
   const scope = `${action}:${target}`;
   const builder = new SignJWT({scope})
     .setProtectedHeader({alg, typ})
@@ -671,27 +673,6 @@ async function _createOAuth2AccessToken({
   return {accessToken, ttl};
 }
 
-function _getAlgFromPrivateKey({privateKeyJwk}) {
-  if(privateKeyJwk.alg) {
-    return privateKeyJwk.alg;
-  }
-  if(privateKeyJwk.kty === 'EC' && privateKeyJwk.crv) {
-    if(privateKeyJwk.crv.startsWith('P-')) {
-      return `ES${privateKeyJwk.crv.slice(2)}`;
-    }
-    if(privateKeyJwk.crv === 'secp256k1') {
-      return 'ES256K';
-    }
-  }
-  if(privateKeyJwk.kty === 'OKP' && privateKeyJwk.crv?.startsWith('Ed')) {
-    return 'EdDSA';
-  }
-  if(privateKeyJwk.kty === 'RSA') {
-    return 'PS256';
-  }
-  return 'invalid';
-}
-
 function _getSupportedCredentialConfigurations({workflow, exchange, step}) {
   // get all OID4VCI credential configuration IDs from issue requests in step
   const issueRequestsParams = getIssueRequestsParams({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/vc-delivery",
-  "version": "7.18.2",
+  "version": "7.19.0",
   "type": "module",
   "description": "Bedrock Verifiable Credential Delivery",
   "main": "./lib/index.js",

package/schemas/bedrock-vc-workflow.js

@@ -547,8 +547,22 @@ const oid4vpClientProfile = {
       required: ['x5c'],
       additionalProperties: false,
       properties: {
-        // FIXME: consider adding `privateKeyJwk` as an alternative to using
-        // a zcap for a WebKMS key
+        privateKeyJwk: {
+          type: 'object',
+          required: ['kid', 'kty', 'crv', 'x', 'y', 'd'],
+          properties: {
+            // only ES256 supported at this time
+            alg: {enum: ['ES256']},
+            kid: {type: 'string'},
+            kty: {enum: ['EC']},
+            crv: {enum: ['P-256']},
+            x: {type: 'string'},
+            y: {type: 'string'},
+            d: {type: 'string'},
+            use: {const: 'sig'},
+            key_ops: {const: ['sign']}
+          }
+        },
         x5c: {
           type: 'array',
           minItems: 1,