@docknetwork/wallet-sdk-core 1.7.7-alpha.0 → 1.9.0

package/src/verification-controller.ts

@@ -3,6 +3,7 @@ import {pexService} from '@docknetwork/wallet-sdk-wasm/src/services/pex';
 import {credentialServiceRPC} from '@docknetwork/wallet-sdk-wasm/src/services/credential';
 import {
   createCredentialProvider,
+  CredentialStatus,
   ICredentialProvider,
 } from './credential-provider';
 import {IWallet} from './types';
@@ -21,17 +22,55 @@ export enum VerificationStatus {
   SelectingCredentials = 'SelectingCredentials',
 }
 
-function isRangeProofTemplate(templateJSON) {
-  return templateJSON.proving_key;
-}
-
 type CredentialId = string;
 type CredentialSelection = {
   credential: any;
+  /**
+   * Optional list of credential attributes to reveal in the presentation.
+   * When omitted, the credential-sdk automatically determines which attributes
+   * to reveal based on the PEX (Presentation Exchange) template requirements.
+   * This allows generating a default presentation without manual attribute selection.
+   */
   attributesToReveal?: string[];
 };
 type CredentialSelectionMap = Map<CredentialId, CredentialSelection>;
 
+export interface IVerificationController {
+  emitter: EventEmitter;
+  selectedCredentials: CredentialSelectionMap;
+  getStatus: () => VerificationStatus;
+  getStatusData: () => any;
+  submitPresentation: (presentation: any) => Promise<any>;
+  getSelectedDID: () => string | null;
+  setSelectedDID: (did: string) => void;
+  start: (params: {template: string | any}) => Promise<void>;
+  isBBSPlusCredential: (credential: any) => Promise<boolean>;
+  loadCredentials: () => Promise<void>;
+  getFilteredCredentials: () => any[];
+  createPresentation: () => Promise<any>;
+  createDefaultPresentation: () => Promise<any>;
+  evaluatePresentation: (presentation: any) => {
+    isValid: boolean;
+    errors: any[];
+    warnings: any[];
+  };
+  getRequirementGroups: () => Array<{
+    descriptorKey: string;
+    descriptorName: string;
+    candidates: any[];
+  }>;
+  getSelectedCredentialsByDescriptor: () => any[];
+  getCredentialOptionsForDescriptor: (credentialId: string) => Promise<any>;
+  switchCredential: (
+    currentCredentialId: string,
+    replacementCredentialId: string,
+  ) => Promise<void>;
+  getRequestedAttributes: (credentialId: string) => any[];
+  getCredentialStatus: (credentialId: string) => Promise<any>;
+  canSwitchCredential: (credentialId: string) => Promise<boolean>;
+  getTemplateJSON: () => any;
+}
+
 export function createVerificationController({
   wallet,
   credentialProvider,
@@ -40,7 +79,7 @@ export function createVerificationController({
   wallet: IWallet;
   credentialProvider?: ICredentialProvider;
   didProvider?: IDIDProvider;
-}) {
+}): IVerificationController {
   const emitter = new EventEmitter();
   let templateJSON = null;
   let status = VerificationStatus.Started;
@@ -50,9 +89,9 @@ export function createVerificationController({
    */
   let statusData = null;
   let filteredCredentials = [];
+  let filteredMatches = [];
   let selectedCredentials: CredentialSelectionMap = new Map();
   let selectedDID = null;
-  let provingKey = null;
 
   if (!credentialProvider) {
     credentialProvider = createCredentialProvider({wallet});
@@ -62,23 +101,6 @@ export function createVerificationController({
     didProvider = createDIDProvider({wallet});
   }
 
-  async function fetchProvingKey(templateJSON: any) {
-    if (templateJSON.proving_key) {
-      setState(VerificationStatus.FetchingProvingKey);
-      try {
-        provingKey = await axios
-          .get(templateJSON.proving_key)
-          .then(res => res.data);
-      } catch (err) {
-        setState(VerificationStatus.Error, {
-          message: 'failed_to_fetch_proving_key',
-        });
-
-        throw err;
-      }
-    }
-  }
-
   async function start({template}: {template: string | any}) {
     setState(VerificationStatus.LoadingTemplate);
 
@@ -96,7 +118,6 @@ export function createVerificationController({
     selectedDID = dids[0].didDocument.id;
     templateJSON = await getJSON(template);
 
-    await fetchProvingKey(templateJSON);
     await loadCredentials();
 
     setState(VerificationStatus.SelectingCredentials);
@@ -127,6 +148,7 @@ export function createVerificationController({
       });
 
       filteredCredentials = result.verifiableCredential;
+      filteredMatches = result.matches || [];
     } catch (err) {
       console.error(
         `Unable to filter credentials using the template: \n ${JSON.stringify(
@@ -154,70 +176,354 @@ export function createVerificationController({
     return credentialServiceRPC.isKvacCredential({credential});
   }
 
-  async function createPresentation() {
-    assert(!!selectedDID, 'No DID selected');
-    assert(!!selectedCredentials.size, 'No credentials selected');
+  async function deriveNonBbsCredentials(sdJwtSelections, regularSelections) {
+    const credentials = [];
 
-    if (isRangeProofTemplate(templateJSON)) {
-      // TODO: Implement proving key usage for range-proofs
-      assert(!!provingKey, 'No proving key found');
+    for (const sel of sdJwtSelections) {
+      const derived = await credentialServiceRPC.createSDJWTPresentation({
+        attributesToReveal: sel.attributesToReveal,
+        credential: sel.credential._sd_jwt.encoded,
+      });
+      credentials.push(derived);
     }
 
-    const credentials = [];
+    for (const sel of regularSelections) {
+      credentials.push(sel.credential);
+    }
 
-    for (const credentialSelection of selectedCredentials.values()) {
-      const isBBS = await isBBSPlusCredential(credentialSelection.credential);
-      const isKVAC = await isKvacCredential(credentialSelection.credential);
+    return credentials;
+  }
 
-      if (credentialSelection.credential._sd_jwt) {
-        const derivedCredential =
-          await credentialServiceRPC.createSDJWTPresentation({
-            attributesToReveal: credentialSelection.attributesToReveal,
-            credential: credentialSelection.credential._sd_jwt.encoded,
-          });
-
-        credentials.push(derivedCredential);
-      } else if (isBBS || isKVAC) {
-        // derive credential
-        const derivedCredentials =
-          await credentialServiceRPC.deriveVCFromPresentation({
-            proofRequest: templateJSON,
-            
-            credentials: [
-              {
-                credential: credentialSelection.credential,
-                witness: await credentialProvider.getMembershipWitness(credentialSelection.credential.id),
-                attributesToReveal: [
-                  ...(credentialSelection.attributesToReveal || []),
-                  'id',
-                ],
-              },
-            ],
-          });
+  function getKeyId(keyDoc) {
+    return keyDoc.controller.startsWith('did:key:')
+      ? keyDoc.id
+      : `${keyDoc.controller}#keys-1`;
+  }
+
+  async function assembleSignedPresentation(credentials, keyDoc) {
+    return credentialServiceRPC.createPresentation({
+      credentials,
+      challenge: templateJSON.nonce,
+      keyDoc,
+      id: getKeyId(keyDoc),
+      domain: 'dock.io',
+    });
+  }
 
-        console.log('Credential derived');
+  function getRequirementGroups() {
+    if (filteredMatches.length === 0) {
+      return [
+        {
+          descriptorKey: 'default',
+          descriptorName: 'default',
+          candidates: [...filteredCredentials],
+        },
+      ];
+    }
 
-        credentials.push(derivedCredentials[0]);
+    const groups: Array<{
+      descriptorKey: string;
+      descriptorName: string;
+      candidates: any[];
+    }> = [];
+    const groupKeyFn = match =>
+      match.from ? JSON.stringify(match.from) : match.name || match.id || '';
+    const seen = new Map<string, number>();
+
+    for (const match of filteredMatches) {
+      const key = groupKeyFn(match);
+      const candidateIndices: number[] = [];
+      for (const path of match.vc_path || []) {
+        const indexMatch = path.match(/\[(\d+)\]/);
+        if (indexMatch) {
+          candidateIndices.push(parseInt(indexMatch[1], 10));
+        }
+      }
+      const candidates = candidateIndices
+        .map(idx => filteredCredentials[idx])
+        .filter(Boolean);
+
+      if (match.from || !seen.has(key)) {
+        seen.set(key, groups.length);
+        groups.push({
+          descriptorKey: key,
+          descriptorName: match.name || match.id || key,
+          candidates,
+        });
       } else {
-        credentials.push(credentialSelection.credential);
+        const existing = groups[seen.get(key)];
+        for (const cred of candidates) {
+          if (!existing.candidates.some(c => c.id === cred.id)) {
+            existing.candidates.push(cred);
+          }
+        }
       }
     }
 
+    return groups;
+  }
+
+  async function filterValidCredentials(candidates: any[]) {
+    const results = await Promise.all(
+      candidates.map(async cred => {
+        const statusResult = await credentialProvider.getCredentialStatus(cred);
+        return {
+          credential: cred,
+          status: statusResult.status,
+        };
+      }),
+    );
+
+    return results
+      .filter(
+        r =>
+          r.status !== CredentialStatus.Revoked &&
+          r.status !== CredentialStatus.Invalid &&
+          r.status !== CredentialStatus.Expired,
+      )
+      .map(r => r.credential);
+  }
+
+  async function createDefaultPresentation() {
+    assert(filteredCredentials.length > 0, 'No filtered credentials available');
+
+    selectedCredentials.clear();
+
+    const groups = getRequirementGroups();
+    for (const group of groups) {
+      const validCandidates = await filterValidCredentials(group.candidates);
+      const chosen =
+        validCandidates.find(cred => !selectedCredentials.has(cred.id)) ||
+        validCandidates[0];
+      if (chosen) {
+        selectedCredentials.set(chosen.id, {credential: chosen});
+      }
+    }
+
+    assert(
+      selectedCredentials.size > 0,
+      'No credentials could be selected for the presentation',
+    );
+
+    return createPresentation();
+  }
+
+  function getSelectedCredentialsByDescriptor() {
+    const groups = getRequirementGroups();
+
+    return groups.map(group => {
+      const selected =
+        group.candidates.find(cred => selectedCredentials.has(cred.id)) || null;
+      const alternatives = group.candidates.filter(
+        cred => !selected || cred.id !== selected.id,
+      );
+
+      return {
+        descriptorId: group.descriptorKey,
+        descriptorName: group.descriptorName,
+        selected,
+        alternatives,
+      };
+    });
+  }
+
+  async function getCredentialOptionsForDescriptor(credentialId: string) {
+    const groups = getRequirementGroups();
+    const group = groups.find(g =>
+      g.candidates.some(c => c.id === credentialId),
+    );
+
+    assert(
+      group,
+      `Credential ${credentialId} not found in any descriptor group`,
+    );
+
+    const selected = group.candidates.find(c => c.id === credentialId);
+    const allAlternatives = group.candidates.filter(c => c.id !== credentialId);
+    const alternatives = await filterValidCredentials(allAlternatives);
+
+    return {
+      descriptorId: group.descriptorKey,
+      descriptorName: group.descriptorName,
+      selected,
+      alternatives,
+    };
+  }
+
+  async function switchCredential(
+    currentCredentialId: string,
+    replacementCredentialId: string,
+  ) {
+    assert(
+      selectedCredentials.has(currentCredentialId),
+      `Credential ${currentCredentialId} is not currently selected`,
+    );
+
+    const options = await getCredentialOptionsForDescriptor(currentCredentialId);
+    const replacement = options.alternatives.find(
+      c => c.id === replacementCredentialId,
+    );
+
+    assert(
+      replacement,
+      `Credential ${replacementCredentialId} is not a valid replacement for ${currentCredentialId}`,
+    );
+
+    selectedCredentials.delete(currentCredentialId);
+    selectedCredentials.set(replacementCredentialId, {credential: replacement});
+
+    return createPresentation();
+  }
+
+  function getAttributesToRevealFromTemplate(credential) {
+    const definition = getPresentationDefinition();
+    if (!definition?.input_descriptors) {
+      return ['id'];
+    }
+
+    const attributes = ['id'];
+    for (const descriptor of definition.input_descriptors) {
+      const fields = descriptor.constraints?.fields || [];
+      for (const field of fields) {
+        if (!field.path) {
+          continue;
+        }
+        const paths = Array.isArray(field.path) ? field.path : [field.path];
+        for (const p of paths) {
+          const attr = p.replace('$.', '');
+          if (
+            attr &&
+            !attributes.includes(attr) &&
+            !attr.startsWith('type') &&
+            !attr.startsWith('issuer') &&
+            !attr.startsWith('@context') &&
+            !attr.startsWith('proof') &&
+            !attr.startsWith('credentialSchema') &&
+            !attr.startsWith('issuanceDate')
+          ) {
+            // Only include if the credential actually has this attribute
+            const value = attr
+              .split('.')
+              .reduce((obj, key) => obj?.[key], credential);
+            if (value !== undefined) {
+              attributes.push(attr);
+            }
+            break;
+          }
+        }
+      }
+    }
+
+    return attributes;
+  }
+
+  function ensureDescriptorMap(presentation) {
+    if (presentation?.presentation_submission?.descriptor_map?.length > 0) {
+      return presentation;
+    }
+
+    const definition = getPresentationDefinition();
+    if (!definition?.input_descriptors) {
+      return presentation;
+    }
+
+    const descriptorMap = definition.input_descriptors.map(
+      (descriptor, idx) => ({
+        id: descriptor.id,
+        format: 'ldp_vp',
+        path: `$.verifiableCredential[${idx}]`,
+      }),
+    );
+
+    presentation.presentation_submission = {
+      ...presentation.presentation_submission,
+      definition_id: definition.id,
+      descriptor_map: descriptorMap,
+    };
+
+    return presentation;
+  }
+
+  async function createPresentation() {
+    assert(!!selectedDID, 'No DID selected');
+    assert(!!selectedCredentials.size, 'No credentials selected');
+
     const didKeyPairList = await didProvider.getDIDKeyPairs();
     const keyDoc = didKeyPairList.find(doc => doc.controller === selectedDID);
-
     assert(keyDoc, `No key pair found for the selected DID ${selectedDID}`);
 
-    const presentation = await credentialServiceRPC.createPresentation({
-      credentials,
-      challenge: templateJSON.nonce,
-      keyDoc,
-      id: keyDoc.controller.startsWith('did:key:')
-        ? keyDoc.id
-        : `${keyDoc.controller}#keys-1`,
-      domain: 'dock.io',
-    });
+    const sdJwtSelections = [];
+    const bbsKvacSelections = [];
+    const regularSelections = [];
+
+    for (const credentialSelection of selectedCredentials.values()) {
+      if (credentialSelection.credential._sd_jwt) {
+        sdJwtSelections.push(credentialSelection);
+      } else {
+        const isBBS = await isBBSPlusCredential(credentialSelection.credential);
+        const isKVAC = await isKvacCredential(credentialSelection.credential);
+        if (isBBS || isKVAC) {
+          bbsKvacSelections.push(credentialSelection);
+        } else {
+          regularSelections.push(credentialSelection);
+        }
+      }
+    }
+
+    if (bbsKvacSelections.length > 0) {
+      // When attributesToReveal is undefined, the credential-sdk will automatically
+      // determine which attributes to reveal based on the PEX template requirements.
+      // This enables generating a default presentation without manual attribute selection.
+      const credentialsWithWitness = await Promise.all(
+        bbsKvacSelections.map(async sel => {
+          return {
+            credential: sel.credential,
+            witness: await credentialProvider.getMembershipWitness(
+              sel.credential.id,
+            ),
+            attributesToReveal:
+              sel.attributesToReveal ||
+              getAttributesToRevealFromTemplate(sel.credential),
+          };
+        }),
+      );
 
+      // Derive each BBS+/KVAC credential separately, then assemble into a signed presentation.
+      // This approach uses deriveVCFromPresentation which properly handles range proof
+      // bound checks and produces presentations that the Truvera API can verify.
+      const derivedResults = await Promise.all(
+        credentialsWithWitness.map(c =>
+          credentialServiceRPC.deriveVCFromPresentation({
+            proofRequest: templateJSON,
+            credentials: [
+              {
+                credential: c.credential,
+                witness: c.witness,
+                attributesToReveal: c.attributesToReveal,
+              },
+            ],
+          }),
+        ),
+      );
+      const derivedCredentials = derivedResults.flat();
+
+      const nonBbsCredentials = await deriveNonBbsCredentials(
+        sdJwtSelections,
+        regularSelections,
+      );
+      const presentation = await assembleSignedPresentation(
+        [...derivedCredentials, ...nonBbsCredentials],
+        keyDoc,
+      );
+      return presentation;
+    }
+
+    // No BBS+/KVAC: handle SD-JWT and regular only
+    const credentials = await deriveNonBbsCredentials(
+      sdJwtSelections,
+      regularSelections,
+    );
+    const presentation = await assembleSignedPresentation(credentials, keyDoc);
     return presentation;
   }
 
@@ -245,13 +551,9 @@ export function createVerificationController({
    *
    * @param presentation
    */
-  function evaluatePresentation(presentation): {
-    isValid: boolean;
-    errors: any[];
-    warnings: any[];
-  } {
+  function evaluatePresentation(presentation) {
     const definition = getPresentationDefinition();
-    const result = credentialServiceRPC.evaluatePresentation({
+    const result = pexService.evaluatePresentation({
       presentation,
       presentationDefinition: definition,
     });
@@ -263,10 +565,152 @@ export function createVerificationController({
     };
   }
 
-  function submitPresentation(presentation) {
-    return axios
-      .post(templateJSON.response_url, presentation)
-      .then(res => res.data);
+  function getRequestedAttributes(credentialId: string) {
+    const definition = getPresentationDefinition();
+    if (!definition?.input_descriptors) {
+      return [];
+    }
+
+    const groups = getRequirementGroups();
+    const group = groups.find(g =>
+      g.candidates.some(c => c.id === credentialId),
+    );
+    if (!group) {
+      return [];
+    }
+
+    const credential = group.candidates.find(c => c.id === credentialId);
+    if (!credential) {
+      return [];
+    }
+
+    const descriptor = definition.input_descriptors.find(
+      d => (d.name || d.id) === group.descriptorName,
+    );
+    if (!descriptor?.constraints?.fields) {
+      return [];
+    }
+
+    const attributesToSkip = [
+      /^type/,
+      /^issuer/,
+      /^@context/,
+      /^proof/,
+      /^credentialSchema/,
+      /^issuanceDate/,
+      /^credentialStatus/,
+      /^cryptoVersion/,
+    ];
+
+    return descriptor.constraints.fields
+      .map(field => {
+        const paths = Array.isArray(field.path) ? field.path : [field.path];
+        let resolvedPath = null;
+        let value;
+
+        for (const p of paths) {
+          const cleanPath = p.replace('$.', '');
+          const pathParts = cleanPath.split('.');
+          let current = credential;
+          let found = true;
+          for (const part of pathParts) {
+            if (current && typeof current === 'object' && part in current) {
+              current = current[part];
+            } else {
+              found = false;
+              break;
+            }
+          }
+          if (found) {
+            resolvedPath = cleanPath;
+            value = current;
+            break;
+          }
+        }
+
+        if (!resolvedPath) {
+          return null;
+        }
+
+        if (attributesToSkip.some(regex => regex.test(resolvedPath))) {
+          return null;
+        }
+
+        const isRangeProof = !!(
+          field.filter &&
+          (field.filter.minimum !== undefined ||
+            field.filter.maximum !== undefined ||
+            field.filter.exclusiveMinimum !== undefined ||
+            field.filter.exclusiveMaximum !== undefined ||
+            field.filter.formatMinimum !== undefined ||
+            field.filter.formatMaximum !== undefined)
+        );
+
+        return {
+          name: resolvedPath,
+          value: isRangeProof ? null : value,
+          isRangeProof,
+          isOptional: field.optional === true,
+          ...(isRangeProof && {
+            min:
+              field.filter.minimum ??
+              field.filter.exclusiveMinimum ??
+              field.filter.formatMinimum,
+            max:
+              field.filter.maximum ??
+              field.filter.exclusiveMaximum ??
+              field.filter.formatMaximum,
+          }),
+        };
+      })
+      .filter(Boolean);
+  }
+
+  async function getCredentialStatus(credentialId: string) {
+    const groups = getRequirementGroups();
+    let credential = null;
+
+    for (const group of groups) {
+      credential = group.candidates.find(c => c.id === credentialId);
+      if (credential) {
+        break;
+      }
+    }
+
+    assert(
+      credential,
+      `Credential ${credentialId} not found in any descriptor group`,
+    );
+
+    return credentialProvider.isValid(credential);
+  }
+
+  async function canSwitchCredential(credentialId: string) {
+    try {
+      const options = await getCredentialOptionsForDescriptor(credentialId);
+      return options.alternatives.length > 0;
+    } catch {
+      return false;
+    }
+  }
+
+  async function submitPresentation(presentation, maxRetries = 3) {
+    for (let attempt = 0; attempt < maxRetries; attempt++) {
+      try {
+        const res = await axios.post(templateJSON.response_url, presentation);
+        return res.data;
+      } catch (err) {
+        const httpStatus = err?.response?.status;
+        const isRetryable =
+          !httpStatus || httpStatus === 429 || httpStatus >= 500;
+
+        if (!isRetryable || attempt === maxRetries - 1) {
+          throw err;
+        }
+        const delay = Math.min(1000 * 2 ** attempt, 8000);
+        await new Promise(resolve => setTimeout(resolve, delay));
+      }
+    }
   }
 
   return {
@@ -283,8 +727,16 @@ export function createVerificationController({
     isBBSPlusCredential,
     loadCredentials,
     getFilteredCredentials,
+    createDefaultPresentation,
     createPresentation,
     evaluatePresentation,
+    getRequirementGroups,
+    getSelectedCredentialsByDescriptor,
+    getCredentialOptionsForDescriptor,
+    switchCredential,
+    getRequestedAttributes,
+    getCredentialStatus,
+    canSwitchCredential,
     getTemplateJSON() {
       return templateJSON;
     },