@bedrock/vc-verifier 22.3.0 → 23.1.0

package/lib/di.js

@@ -2,7 +2,7 @@
  * Copyright (c) 2018-2025 Digital Bazaar, Inc. All rights reserved.
  */
 import * as vc from '@digitalbazaar/vc';
-import {checkStatus as _checkStatus} from './status.js';
+import {createCheckStatus} from './status.js';
 import {createDocumentLoader} from './documentLoader.js';
 import {createSuites} from './suites.js';
 
@@ -14,7 +14,7 @@ export async function verifyCredential({
 
   // only check credential status when option is set
   const checkStatus = checks.includes('credentialStatus') ?
-    _checkStatus : () => ({verified: true});
+    createCheckStatus({config}) : () => ({verified: true});
 
   const result = await vc.verifyCredential({
     credential,
@@ -59,7 +59,7 @@ export async function verifyPresentation({
     documentLoader: await createDocumentLoader({config}),
     suite: createSuites(),
     unsignedPresentation: !checks.includes('proof'),
-    checkStatus: _checkStatus,
+    checkStatus: createCheckStatus({config}),
     includeCredentials: true
   };
   return vc.verify(verifyOptions);

package/lib/documentLoader.js

@@ -46,10 +46,12 @@ bedrock.events.on('bedrock.init', () => {
  *
  * @param {object} options - The options to use.
  * @param {object} options.config - The verifier instance config.
+ * @param {Set} [options.remoteUrlAllowList] - Remote URLs that are
+ *   specifically allowed to be loaded (used for status list checks).
  *
  * @returns {Promise<Function>} The document loader.
  */
-export async function createDocumentLoader({config} = {}) {
+export async function createDocumentLoader({config, remoteUrlAllowList} = {}) {
   const contextDocumentLoader = await createContextDocumentLoader(
     {config, serviceType});
 
@@ -84,10 +86,12 @@ export async function createDocumentLoader({config} = {}) {
       // try to resolve URL through context doc loader
       return await contextDocumentLoader(url);
     } catch(e) {
-      // use web loader if configured and instance config allows it and
-      // the url starts with `http`, and the core config allows it
+      // use web loader if configured and instance config allows it (or it is
+      // allowed by an allow list) and the url starts with `http` (and the core
+      // config allows it, i.e., `webLoader` exists)
       const allowRemoteContexts = !config.verifyOptions?.documentLoader ||
-        config.verifyOptions.documentLoader.allowRemoteContexts;
+        config.verifyOptions.documentLoader.allowRemoteContexts ||
+        remoteUrlAllowList?.has(url);
       if(allowRemoteContexts &&
         url.startsWith('http') && e.name === 'NotFoundError' && webLoader) {
         return webLoader(url);

package/lib/envelopes.js

@@ -33,7 +33,7 @@ export async function verifyEnvelopedCredential({
 }
 
 export async function verifyEnvelopedPresentation({
-  envelopedPresentation, challenge, domain
+  config, envelopedPresentation, challenge, domain, checks
 } = {}) {
   let format;
   try {
@@ -46,6 +46,10 @@ export async function verifyEnvelopedPresentation({
       result = await vcjwt.verifyEnvelopedPresentation({
         jwt: contents, challenge, domain
       });
+    } else if(format.typeAndSubType === 'application/vcb') {
+      result = await vcb.verifyEnvelopedPresentation({
+        config, contents, format, challenge, checks
+      });
     } else {
       _throwUnknownFormat(format);
     }

package/lib/index.js

@@ -21,7 +21,6 @@ bedrock.events.on('bedrock.init', async () => {
   const updateConfigBody = structuredClone(schemas.updateConfigBody);
   const schemasToUpdate = [createConfigBody, updateConfigBody];
   for(const schema of schemasToUpdate) {
-    // verify options
     schema.properties.verifyOptions = verifyOptions;
   }
 
@@ -36,6 +35,7 @@ bedrock.events.on('bedrock.init', async () => {
     validation: {
       createConfigBody,
       updateConfigBody,
+      validateConfigFn,
       // require these zcaps (by reference ID)
       zcapReferenceIds: [{
         referenceId: 'edv',
@@ -66,3 +66,20 @@ bedrock.events.on('bedrock.init', async () => {
     await initializeServiceAgent({serviceType});
   });
 });
+
+async function validateConfigFn({config} = {}) {
+  try {
+    // set default `verifyOptions` if not given
+    const {verifyOptions} = config;
+    if(verifyOptions === undefined) {
+      config.verifyOptions = {
+        documentLoader: {
+          allowRemoteContexts: false
+        }
+      };
+    }
+  } catch(error) {
+    return {valid: false, error};
+  }
+  return {valid: true};
+}

package/lib/status.js

@@ -14,6 +14,7 @@ import {
   statusTypeMatches as statusList2020StatusTypeMatches
 } from '@digitalbazaar/vc-status-list';
 import assert from 'assert-plus';
+import {createDocumentLoader} from './documentLoader.js';
 
 const handlerMap = new Map();
 handlerMap.set('BitstringStatusListEntry', {
@@ -29,26 +30,41 @@ handlerMap.set('StatusList2021Entry', {
   statusTypeMatches: statusList2020StatusTypeMatches
 });
 
-export async function checkStatus(options = {}) {
-  assert.object(options, 'options');
-  assert.object(options.credential, 'options.credential');
+export function createCheckStatus({config} = {}) {
+  return async function checkStatus(options = {}) {
+    assert.object(options, 'options');
+    assert.object(options.credential, 'options.credential');
 
-  try {
-    const {credential} = options;
-    const {credentialStatus} = credential;
-    if(!credentialStatus) {
-      // no status to check
-      return {verified: true};
-    }
+    try {
+      const {credential} = options;
+      const {credentialStatus} = credential;
+      if(!credentialStatus) {
+        // no status to check
+        return {verified: true};
+      }
 
-    const handlers = handlerMap.get(credentialStatus.type);
-    if(!(handlers && handlers.statusTypeMatches({credential}))) {
-      throw new Error(
-        `Unsupported credentialStatus type "${credentialStatus.type}".`);
-    }
+      const handlers = handlerMap.get(credentialStatus.type);
+      if(!(handlers && handlers.statusTypeMatches({credential}))) {
+        throw new Error(
+          `Unsupported credentialStatus type "${credentialStatus.type}".`);
+      }
 
-    return await handlers.checkStatus(options);
-  } catch(error) {
-    return {verified: false, error};
-  }
+      // document loader needs to only allow web loading of status
+      // list VCs, nothing else
+      const documentLoader = await createDocumentLoader({
+        config,
+        remoteUrlAllowList: new Set([
+          credentialStatus.statusListCredential ??
+          credentialStatus.revocationListCredential
+        ])
+      });
+      options = {
+        ...options,
+        documentLoader
+      };
+      return await handlers.checkStatus(options);
+    } catch(error) {
+      return {verified: false, error};
+    }
+  };
 }

package/lib/vcb.js

@@ -29,6 +29,41 @@ const SUPPORTED_BARCODE_FORMATS = new Set([
 
 const TEXT_DECODER = new TextDecoder();
 
+export async function verifyEnvelopedPresentation({
+  config, contents, format, challenge, checks
+} = {}) {
+  // handle base64 encoding
+  let {parameters} = format;
+  if(parameters.has('base64')) {
+    contents = new Uint8Array(Buffer.from(contents, 'base64'));
+    parameters = new Map(parameters);
+    parameters.delete('base64');
+  }
+  // only parameter understood is `barcode-format` with values of:
+  // 'qr_code' (default)
+  const barcodeFormat = parameters.size === 1 ?
+    parameters.get('barcode-format') : (parameters.size === 0 && 'qr_code');
+  if(barcodeFormat !== 'qr_code') {
+    _throwUnknownFormat(format);
+  }
+  // create loaders for JSON-LD contexts and CBOR-LD type tables
+  const documentLoader = await createDocumentLoader({config});
+  const typeTableLoader = await createCborldTypeTableLoader({
+    config, serviceType: 'vc-verifier'
+  });
+  // parse credential and any verification options from contents...
+  const {jsonldDocument: presentation, options} = await _parseQrCodeEnvelope({
+    contents, documentLoader, typeTableLoader, expectedHeader: 'VP1-'
+  });
+  // checks for VCB VPs only applies if there is actually a proof to check
+  checks = presentation.proof ? checks : [];
+  // verify VP
+  const result = await di.verifyPresentation({
+    config, presentation, options, challenge, checks
+  });
+  return {...result, presentation};
+}
+
 export async function verifyEnvelopedCredential({
   config, contents, format, checks
 } = {}) {
@@ -58,8 +93,8 @@ export async function verifyEnvelopedCredential({
   let credential;
   let options;
   if(barcodeFormat === 'qr_code') {
-    ({credential, options} = await _parseQrCodeEnvelope({
-      contents, documentLoader, typeTableLoader
+    ({jsonldDocument: credential, options} = await _parseQrCodeEnvelope({
+      contents, documentLoader, typeTableLoader, expectedHeader: 'VC1-'
     }));
   }
   if(barcodeFormat === 'pdf417') {
@@ -76,19 +111,19 @@ export async function verifyEnvelopedCredential({
 }
 
 async function _parseQrCodeEnvelope({
-  contents, documentLoader, typeTableLoader
+  contents, documentLoader, typeTableLoader, expectedHeader
 }) {
   // `fromQrCode` requires text, so convert to text as needed
   if(contents instanceof Uint8Array) {
     contents = TEXT_DECODER.decode(contents);
   }
-  const {jsonldDocument: credential} = await util.fromQrCode({
+  const {jsonldDocument} = await util.fromQrCode({
     text: contents,
     documentLoader,
     typeTableLoader,
-    expectedHeader: 'VC1-'
+    expectedHeader
   });
-  return {credential};
+  return {jsonldDocument};
 }
 
 async function _parsePdf417Envelope({

package/lib/verify.js

@@ -74,7 +74,7 @@ export async function verifyPresentation({
   }
 
   const presentationResult = await verifyEnvelopedPresentation({
-    envelopedPresentation: presentation, challenge, domain
+    config, envelopedPresentation: presentation, challenge, domain, checks
   });
   // verify each `verifiableCredential` in the resulting VP
   let verified = presentationResult.verified;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/vc-verifier",
-  "version": "22.3.0",
+  "version": "23.1.0",
   "type": "module",
   "description": "Bedrock VC Verifier",
   "main": "./lib/index.js",