@bedrock/vc-verifier 22.2.1 → 23.0.0

package/lib/di.js

@@ -2,7 +2,7 @@
  * Copyright (c) 2018-2025 Digital Bazaar, Inc. All rights reserved.
  */
 import * as vc from '@digitalbazaar/vc';
-import {checkStatus as _checkStatus} from './status.js';
+import {createCheckStatus} from './status.js';
 import {createDocumentLoader} from './documentLoader.js';
 import {createSuites} from './suites.js';
 
@@ -14,7 +14,7 @@ export async function verifyCredential({
 
   // only check credential status when option is set
   const checkStatus = checks.includes('credentialStatus') ?
-    _checkStatus : () => ({verified: true});
+    createCheckStatus({config}) : () => ({verified: true});
 
   const result = await vc.verifyCredential({
     credential,
@@ -59,7 +59,7 @@ export async function verifyPresentation({
     documentLoader: await createDocumentLoader({config}),
     suite: createSuites(),
     unsignedPresentation: !checks.includes('proof'),
-    checkStatus: _checkStatus,
+    checkStatus: createCheckStatus({config}),
     includeCredentials: true
   };
   return vc.verify(verifyOptions);

package/lib/documentLoader.js

@@ -46,10 +46,12 @@ bedrock.events.on('bedrock.init', () => {
  *
  * @param {object} options - The options to use.
  * @param {object} options.config - The verifier instance config.
+ * @param {Set} [options.remoteUrlAllowList] - Remote URLs that are
+ *   specifically allowed to be loaded (used for status list checks).
  *
  * @returns {Promise<Function>} The document loader.
  */
-export async function createDocumentLoader({config} = {}) {
+export async function createDocumentLoader({config, remoteUrlAllowList} = {}) {
   const contextDocumentLoader = await createContextDocumentLoader(
     {config, serviceType});
 
@@ -84,10 +86,12 @@ export async function createDocumentLoader({config} = {}) {
       // try to resolve URL through context doc loader
       return await contextDocumentLoader(url);
     } catch(e) {
-      // use web loader if configured and instance config allows it and
-      // the url starts with `http`, and the core config allows it
+      // use web loader if configured and instance config allows it (or it is
+      // allowed by an allow list) and the url starts with `http` (and the core
+      // config allows it, i.e., `webLoader` exists)
       const allowRemoteContexts = !config.verifyOptions?.documentLoader ||
-        config.verifyOptions.documentLoader.allowRemoteContexts;
+        config.verifyOptions.documentLoader.allowRemoteContexts ||
+        remoteUrlAllowList?.has(url);
       if(allowRemoteContexts &&
         url.startsWith('http') && e.name === 'NotFoundError' && webLoader) {
         return webLoader(url);

package/lib/index.js

@@ -21,7 +21,6 @@ bedrock.events.on('bedrock.init', async () => {
   const updateConfigBody = structuredClone(schemas.updateConfigBody);
   const schemasToUpdate = [createConfigBody, updateConfigBody];
   for(const schema of schemasToUpdate) {
-    // verify options
     schema.properties.verifyOptions = verifyOptions;
   }
 
@@ -36,6 +35,7 @@ bedrock.events.on('bedrock.init', async () => {
     validation: {
       createConfigBody,
       updateConfigBody,
+      validateConfigFn,
       // require these zcaps (by reference ID)
       zcapReferenceIds: [{
         referenceId: 'edv',
@@ -66,3 +66,20 @@ bedrock.events.on('bedrock.init', async () => {
     await initializeServiceAgent({serviceType});
   });
 });
+
+async function validateConfigFn({config} = {}) {
+  try {
+    // set default `verifyOptions` if not given
+    const {verifyOptions} = config;
+    if(verifyOptions === undefined) {
+      config.verifyOptions = {
+        documentLoader: {
+          allowRemoteContexts: false
+        }
+      };
+    }
+  } catch(error) {
+    return {valid: false, error};
+  }
+  return {valid: true};
+}

package/lib/status.js

@@ -14,6 +14,7 @@ import {
   statusTypeMatches as statusList2020StatusTypeMatches
 } from '@digitalbazaar/vc-status-list';
 import assert from 'assert-plus';
+import {createDocumentLoader} from './documentLoader.js';
 
 const handlerMap = new Map();
 handlerMap.set('BitstringStatusListEntry', {
@@ -29,26 +30,41 @@ handlerMap.set('StatusList2021Entry', {
   statusTypeMatches: statusList2020StatusTypeMatches
 });
 
-export async function checkStatus(options = {}) {
-  assert.object(options, 'options');
-  assert.object(options.credential, 'options.credential');
+export function createCheckStatus({config} = {}) {
+  return async function checkStatus(options = {}) {
+    assert.object(options, 'options');
+    assert.object(options.credential, 'options.credential');
 
-  try {
-    const {credential} = options;
-    const {credentialStatus} = credential;
-    if(!credentialStatus) {
-      // no status to check
-      return {verified: true};
-    }
+    try {
+      const {credential} = options;
+      const {credentialStatus} = credential;
+      if(!credentialStatus) {
+        // no status to check
+        return {verified: true};
+      }
 
-    const handlers = handlerMap.get(credentialStatus.type);
-    if(!(handlers && handlers.statusTypeMatches({credential}))) {
-      throw new Error(
-        `Unsupported credentialStatus type "${credentialStatus.type}".`);
-    }
+      const handlers = handlerMap.get(credentialStatus.type);
+      if(!(handlers && handlers.statusTypeMatches({credential}))) {
+        throw new Error(
+          `Unsupported credentialStatus type "${credentialStatus.type}".`);
+      }
 
-    return await handlers.checkStatus(options);
-  } catch(error) {
-    return {verified: false, error};
-  }
+      // document loader needs to only allow web loading of status
+      // list VCs, nothing else
+      const documentLoader = await createDocumentLoader({
+        config,
+        remoteUrlAllowList: new Set([
+          credentialStatus.statusListCredential ??
+          credentialStatus.revocationListCredential
+        ])
+      });
+      options = {
+        ...options,
+        documentLoader
+      };
+      return await handlers.checkStatus(options);
+    } catch(error) {
+      return {verified: false, error};
+    }
+  };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/vc-verifier",
-  "version": "22.2.1",
+  "version": "23.0.0",
   "type": "module",
   "description": "Bedrock VC Verifier",
   "main": "./lib/index.js",
@@ -26,7 +26,7 @@
   "homepage": "https://github.com/digitalbazaar/bedrock-vc-verifier",
   "dependencies": {
     "@digitalbazaar/bbs-2023-cryptosuite": "^2.0.1",
-    "@digitalbazaar/cborld": "^7.2.0",
+    "@digitalbazaar/cborld": "^8.0.0",
     "@digitalbazaar/data-integrity": "^2.5.0",
     "@digitalbazaar/ecdsa-2019-cryptosuite": "^2.0.0",
     "@digitalbazaar/ecdsa-jcs-2019-cryptosuite": "^1.0.0",
@@ -45,7 +45,7 @@
     "@digitalbazaar/vc-bitstring-status-list": "^2.0.1",
     "@digitalbazaar/vc-revocation-list": "^7.0.0",
     "@digitalbazaar/vc-status-list": "^8.0.1",
-    "@digitalbazaar/vpqr": "^5.1.0",
+    "@digitalbazaar/vpqr": "^6.0.0",
     "assert-plus": "^1.0.0",
     "bnid": "^3.0.0",
     "body-parser": "^1.20.3",