@bedrock/vc-verifier 23.5.0 → 23.6.0

package/lib/iso18013-7.js

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2025-2026 Digital Bazaar, Inc. All rights reserved.
+ */
+import {oid4vp} from '@digitalbazaar/oid4-client';
+
+// returns session transcript bytes
+export async function getEncodedSessionTranscript({
+  options, domain, challenge
+} = {}) {
+  const {mdl} = options;
+
+  if(!mdl?.sessionTranscript) {
+    // no `mdl` session transcript given
+    return undefined;
+  }
+
+  const {sessionTranscript} = mdl;
+
+  // if `mdl.sessionTranscript` is a base64url string, decode and return it
+  if(typeof sessionTranscript === 'string') {
+    return Buffer.from(sessionTranscript, 'base64url');
+  }
+
+  // backwards compatibility case: `sessionTranscript` is an object with
+  // Annex B parameters; convert it
+  if(sessionTranscript && typeof sessionTranscript === 'object') {
+    const handover = {
+      type: 'AnnexBHandover',
+      responseUri: domain,
+      ...sessionTranscript
+    };
+
+    // `mdocGeneratedNonce` and `verifierGeneratedNonce` are
+    // base64url strings that must be converted to UTF-8 strings; the others
+    // are passthrough strings
+    for(const prop of ['mdocGeneratedNonce', 'verifierGeneratedNonce']) {
+      if(handover[prop]) {
+        handover[prop] = Buffer
+          .from(handover[prop], 'base64url')
+          .toString('utf8');
+      }
+    }
+
+    // add `challenge` as `verifierGeneratedNonce` if not specified
+    if(!handover.verifierGeneratedNonce) {
+      handover.verifierGeneratedNonce = challenge;
+    }
+
+    return oid4vp.mdl.encodeSessionTranscript({handover});
+  }
+
+  // no acceptable session transcript
+  return undefined;
+}

package/lib/mdl.js

@@ -1,12 +1,13 @@
 /*
- * Copyright (c) 2025 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2025-2026 Digital Bazaar, Inc. All rights reserved.
  */
 import * as bedrock from '@bedrock/core';
 import {addDocumentRoutes, documentStores} from '@bedrock/service-agent';
 import {
   createMdlCaStoreBody, updateMdlCaStoreBody
 } from '../schemas/bedrock-vc-verifier.js';
-import {DataItem, Verifier} from '@auth0/mdl';
+import {getEncodedSessionTranscript} from './iso18013-7.js';
+import {Verifier} from '@auth0/mdl';
 
 const {util: {BedrockError}} = bedrock;
 
@@ -51,14 +52,23 @@ export async function verifyEnvelopedPresentation({
   // decoded `contents` is the mDL device response
   const deviceResponse = Buffer.from(contents, 'base64url');
 
-  // session transcription must be provided modulo:
+  // session transcription must be provided as base64url string or as an
+  // object in `options.mdl.sessionTranscript` with Annex B parameters modulo:
   // `domain` which is used as the `responseUri`
   // `challenge` which is used as the `verifierGeneratedNonce`
-  const sessionTranscript = {
-    ..._getSessionTranscriptFromOptions({options}),
-    responseUri: domain,
-    verifierGeneratedNonce: challenge
-  };
+  const encodedSessionTranscript = await getEncodedSessionTranscript({
+    options, domain, challenge
+  });
+  if(!encodedSessionTranscript) {
+    throw new BedrockError(
+      'No usable mdoc session transcript provided in verification options.', {
+        name: 'DataError',
+        details: {
+          httpStatusCode: 400,
+          public: true
+        },
+      });
+  }
 
   // fetch CA store(s)
   const {documentStore} = await documentStores.get({config, serviceType});
@@ -71,18 +81,32 @@ export async function verifyEnvelopedPresentation({
     doc.content.trustedCertificates.forEach(caStore.add, caStore);
   }
 
-  return verifyPresentation({
-    deviceResponse, sessionTranscript, trustedCertificates: [...caStore]
+  return _verifyDeviceResponse({
+    deviceResponse, encodedSessionTranscript, trustedCertificates: [...caStore]
   });
 }
 
-export async function verifyPresentation({
-  deviceResponse, sessionTranscript, trustedCertificates
+async function _getCAStoreDocument({documentStore, url}) {
+  const doc = await documentStore.get({id: url});
+  if(doc.meta.type !== MDL_CA_STORE_TYPE) {
+    // wrong meta type; treat as not found error
+    throw new BedrockError(`Document "${url}" not found.`, {
+      name: 'NotFoundError',
+      details: {
+        url,
+        httpStatusCode: 404,
+        public: true
+      }
+    });
+  }
+  return doc;
+}
+
+async function _verifyDeviceResponse({
+  deviceResponse, encodedSessionTranscript, trustedCertificates
 } = {}) {
   try {
     const verifier = new Verifier(trustedCertificates);
-    const encodedSessionTranscript = _encodeSessionTranscript(
-      sessionTranscript);
 
     // uncomment to debug
     /*
@@ -133,61 +157,3 @@ export async function verifyPresentation({
     return {verified: false, error};
   }
 }
-
-// returns a full or partial session transcript
-function _getSessionTranscriptFromOptions({options}) {
-  if(!options.mdl?.sessionTranscript) {
-    // no `mdl` session transcription options given
-    return {};
-  }
-
-  // `mdocGeneratedNonce` and `verifierGeneratedNonce` are base64url-encoded
-  // values; the others are passthrough strings
-  const sessionTranscript = {...options.mdl.sessionTranscript};
-  if(sessionTranscript.mdocGeneratedNonce) {
-    sessionTranscript.mdocGeneratedNonce = Buffer
-      .from(sessionTranscript.mdocGeneratedNonce, 'base64url')
-      // note: ISO 18013-7 requires `verifierGeneratedNonce` to be a string
-      .toString('utf8');
-  }
-  if(sessionTranscript.verifierGeneratedNonce) {
-    sessionTranscript.verifierGeneratedNonce = Buffer
-      .from(sessionTranscript.verifierGeneratedNonce, 'base64url')
-      // note: ISO 18013-7 requires `verifierGeneratedNonce` to be a string
-      .toString('utf8');
-  }
-  return sessionTranscript;
-}
-
-function _encodeSessionTranscript(sessionTranscript) {
-  const {
-    mdocGeneratedNonce,
-    clientId,
-    responseUri,
-    verifierGeneratedNonce
-  } = sessionTranscript;
-  const encoded = DataItem.fromData([
-    // deviceEngagementBytes
-    null,
-    // eReaderKeyBytes
-    null,
-    [mdocGeneratedNonce, clientId, responseUri, verifierGeneratedNonce],
-  ]);
-  return DataItem.fromData(encoded).buffer;
-}
-
-async function _getCAStoreDocument({documentStore, url}) {
-  const doc = await documentStore.get({id: url});
-  if(doc.meta.type !== MDL_CA_STORE_TYPE) {
-    // wrong meta type; treat as not found error
-    throw new BedrockError(`Document "${url}" not found.`, {
-      name: 'NotFoundError',
-      details: {
-        url,
-        httpStatusCode: 404,
-        public: true
-      }
-    });
-  }
-  return doc;
-}

package/lib/status.js

@@ -62,6 +62,14 @@ export function createCheckStatus({config} = {}) {
       const credentialStatuses = Array.isArray(credentialStatus) ?
         credentialStatus : [credentialStatus];
 
+      // handle case that terse status has no published revocation or
+      // suspension lists, so credential status is empty, i.e., no status
+      // to check; a future revision might return the expanded BSL entries
+      // with a default `false` status value for each status purpose
+      if(credentialStatuses.length === 0) {
+        return {verified: true};
+      }
+
       // combination of different status types not supported at this time
       const expectedType = credentialStatuses?.[0]?.type;
       if(credentialStatuses.some(({type}) => type !== expectedType)) {
@@ -240,7 +248,7 @@ async function _fetchStatusListIfExists({expanded, cache}) {
     cache.set(statusListCredential, document);
     return true;
   } catch(e) {
-    if(e.message === 'NotFoundError') {
+    if(e.name === 'NotFoundError') {
       // ok for a terse bitstring list to not exist
       return false;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/vc-verifier",
-  "version": "23.5.0",
+  "version": "23.6.0",
   "type": "module",
   "description": "Bedrock VC Verifier",
   "main": "./lib/index.js",
@@ -41,6 +41,7 @@
     "@digitalbazaar/eddsa-2022-cryptosuite": "^1.0.0",
     "@digitalbazaar/eddsa-jcs-2022-cryptosuite": "^1.0.0",
     "@digitalbazaar/eddsa-rdfc-2022-cryptosuite": "^1.2.0",
+    "@digitalbazaar/oid4-client": "^5.8.0",
     "@digitalbazaar/pdf417-dl-canonicalizer": "^1.2.1",
     "@digitalbazaar/vc": "^7.2.0",
     "@digitalbazaar/vc-bitstring-status-list": "^2.0.1",
@@ -63,7 +64,7 @@
     "@bedrock/did-io": "^10.4.0",
     "@bedrock/express": "^8.3.1",
     "@bedrock/https-agent": "^4.1.0",
-    "@bedrock/jsonld-document-loader": "^5.2.0",
+    "@bedrock/jsonld-document-loader": "^5.2.1",
     "@bedrock/mongodb": "^11.0.0",
     "@bedrock/multikey-context": "^3.0.0",
     "@bedrock/security-context": "^9.0.0",