@docknetwork/wallet-sdk-wasm 1.5.11 → 1.7.0

package/lib/services/credential/service.mjs

@@ -10,8 +10,9 @@ import { blockchainService } from '../blockchain/service.mjs';
 import { hasProvingKey, fetchProvingKey, applyEnforceBounds } from './bound-check.mjs';
 import assert from 'assert';
 import { getIsRevoked, getWitnessDetails } from './bbs-revocation.mjs';
-import { getPexRequiredAttributes } from './pex-helpers.mjs';
+import { getPexRequiredAttributes, shouldSkipAttribute } from './pex-helpers.mjs';
 import { didService } from '../dids/service.mjs';
+import { createSDJWTPresentation, isSDJWTCredential, verifySDJWT, credentialToW3C } from './sd-jwt.mjs';
 import '@cosmjs/proto-signing';
 import '@docknetwork/cheqd-blockchain-api';
 import '@docknetwork/cheqd-blockchain-modules';
@@ -26,6 +27,17 @@ import '@scure/bip39';
 import '@scure/bip39/wordlists/english';
 import '../util-crypto/configs.mjs';
 import '@docknetwork/credential-sdk/types';
+import '../blockchain/cached-did-resolver.mjs';
+import '../storage/index.mjs';
+import '../storage/service.mjs';
+import '../storage/service-rpc.mjs';
+import '../rpc-service-client.mjs';
+import '../../rpc-client.mjs';
+import 'json-rpc-2.0';
+import '../../core/crypto.mjs';
+import 'crypto';
+import '../../logger.mjs';
+import '../../rpc-util.mjs';
 import '@docknetwork/crypto-wasm-ts/lib/legosnark';
 import 'base64url';
 import '@astronautlabs/jsonpath';
@@ -40,23 +52,65 @@ import '@digitalbazaar/x25519-key-agreement-key-2019';
 import '@digitalbazaar/ed25519-verification-key-2018';
 import '@digitalbazaar/ed25519-verification-key-2020';
 import '../dids/keypair-utils.mjs';
+import '@sd-jwt/sd-jwt-vc';
+import '@sd-jwt/crypto-nodejs';
 
 // @ts-nocheck
+/**
+ * PEX (Presentation Exchange) instance for credential filtering
+ * @private
+ */
 const pex = new PEX();
+/**
+ * Checks if a credential uses BBS+ signature
+ * @param {Object} credential - The credential to check
+ * @returns {boolean} True if the credential uses BBS+ signature
+ * @example
+ * const isBBS = isBBSPlusCredential(credential);
+ * if (isBBS) {
+ *   console.log('This credential uses BBS+ signatures');
+ * }
+ */
 function isBBSPlusCredential(credential) {
     return ((typeof credential?.proof?.type === 'string' &&
         credential.proof.type.includes('BBS+SignatureDock')) ||
         (Array.isArray(credential['@context']) &&
             credential['@context'].find(context => typeof context === 'string' && context.indexOf('bbs') > -1)));
 }
+/**
+ * Checks if a credential uses KVAC (BBDT16) signature
+ * @param {Object} credential - The credential to check
+ * @returns {boolean} True if the credential uses KVAC signature
+ * @example
+ * const isKVAC = isKvacCredential(credential);
+ */
 function isKvacCredential(credential) {
     return (typeof credential?.proof?.type === 'string' &&
         credential.proof.type.toLowerCase().includes('bbdt16'));
 }
+/**
+ * Checks if a credential is anonymous (BBS+ or KVAC)
+ * @param {Object} credential - The credential to check
+ * @returns {boolean} True if the credential is anonymous
+ * @example
+ * if (isAnnonymousCredential(credential)) {
+ *   console.log('This credential supports selective disclosure');
+ * }
+ */
 function isAnnonymousCredential(credential) {
     return isBBSPlusCredential(credential) || isKvacCredential(credential);
 }
+/**
+ * Service class for managing verifiable credentials
+ * @class
+ * @description Provides methods for creating, signing, verifying, and presenting
+ * verifiable credentials with support for various signature types
+ */
 class CredentialService {
+    /**
+     * Creates a new CredentialService instance
+     * @constructor
+     */
     constructor() {
         this.name = serviceName;
     }
@@ -69,8 +123,25 @@ class CredentialService {
         CredentialService.prototype.deriveVCFromPresentation,
         CredentialService.prototype.isBBSPlusCredential,
         CredentialService.prototype.isKvacCredential,
+        CredentialService.prototype.isSDJWTCredential,
+        CredentialService.prototype.credentialToW3C,
+        CredentialService.prototype.createSDJWTPresentation,
         CredentialService.prototype.acquireOIDCredential,
     ];
+    createSDJWTPresentation(params) {
+        const { attributesToReveal, credential } = params;
+        return createSDJWTPresentation({ attributesToReveal, credential });
+    }
+    /**
+     * Generates a new verifiable credential template
+     * @param {Object} [params={}] - Generation parameters
+     * @param {Object} [params.subject] - The credential subject
+     * @returns {VerifiableCredential} A new verifiable credential instance
+     * @example
+     * const credential = credentialService.generateCredential({
+     *   subject: { id: 'did:example:123', name: 'Alice' }
+     * });
+     */
     generateCredential(params = {}) {
         validation.generateCredential(params);
         const { subject } = params;
@@ -88,6 +159,19 @@ class CredentialService {
         }
         return vc;
     }
+    /**
+     * Signs a verifiable credential
+     * @param {Object} params - Signing parameters
+     * @param {Object} params.vcJson - The credential JSON to sign
+     * @param {Object} params.keyDoc - The key document for signing
+     * @returns {Promise<VerifiableCredential>} The signed verifiable credential
+     * @throws {Error} If validation fails or signing fails
+     * @example
+     * const signedCredential = await credentialService.signCredential({
+     *   vcJson: credentialData,
+     *   keyDoc: issuerKeyDocument
+     * });
+     */
     async signCredential(params) {
         validation.signCredential(params);
         const { vcJson, keyDoc } = params;
@@ -100,13 +184,38 @@ class CredentialService {
         await verifiableCredential.sign(suite);
         return verifiableCredential;
     }
+    /**
+     * Creates a verifiable presentation from credentials
+     * @param {Object} params - Presentation parameters
+     * @param {Array<Object>} params.credentials - Array of verifiable credentials to include
+     * @param {Object} params.keyDoc - The key document for signing the presentation
+     * @param {string} [params.challenge] - Challenge string for the presentation proof
+     * @param {string} [params.id] - Presentation identifier
+     * @param {string} [params.domain] - Domain for the presentation proof
+     * @returns {Promise<Object>} The signed verifiable presentation
+     * @throws {Error} If validation fails
+     * @example
+     * const presentation = await credentialService.createPresentation({
+     *   credentials: [credential1, credential2],
+     *   keyDoc: holderKeyDocument,
+     *   challenge: 'abc123',
+     *   domain: 'example.com'
+     * });
+     */
     async createPresentation(params) {
         validation.createPresentation(params);
         const { credentials, keyDoc, challenge, id, domain } = params;
         const vp = new VerifiablePresentation(id);
         let shouldSkipSigning = false;
+        let jwtCredentials = [];
         for (const signedVC of credentials) {
-            vp.addCredential(signedVC);
+            if (typeof signedVC === 'string') {
+                jwtCredentials.push(signedVC);
+                shouldSkipSigning = true;
+            }
+            else {
+                vp.addCredential(signedVC);
+            }
             shouldSkipSigning = shouldSkipSigning || isAnnonymousCredential(signedVC);
         }
         if (!shouldSkipSigning) {
@@ -116,16 +225,54 @@ class CredentialService {
         keyPair.signer = keyPair.signer();
         const suite = await getSuiteFromKeyDoc(keyPair);
         if (shouldSkipSigning) {
-            return vp.toJSON();
+            const result = vp.toJSON();
+            result.verifiableCredential.push(...jwtCredentials);
+            return result;
         }
         return vp.sign(suite, challenge, domain, blockchainService.resolver);
     }
+    /**
+     * Verifies a verifiable presentation
+     * @param {Object} params - Verification parameters
+     * @param {Object} params.presentation - The presentation to verify
+     * @param {Object} [params.options] - Verification options
+     * @returns {Promise<Object>} Verification result with verified status and any errors
+     * @example
+     * const result = await credentialService.verifyPresentation({
+     *   presentation: presentationData
+     * });
+     * console.log('Verified:', result.verified);
+     */
     async verifyPresentation({ presentation, options }) {
         return verifyPresentation(presentation, options);
     }
+    /**
+     * Verifies a verifiable credential including revocation check
+     * @param {Object} params - Verification parameters
+     * @param {Object} params.credential - The credential to verify
+     * @param {Object} [params.membershipWitness] - Membership witness for revocation check
+     * @returns {Promise<Object>} Verification result
+     * @returns {boolean} returns.verified - Whether the credential is valid
+     * @returns {string} [returns.error] - Error message if verification failed
+     * @throws {Error} If validation fails
+     * @example
+     * const result = await credentialService.verifyCredential({
+     *   credential: credentialData,
+     *   membershipWitness: witnessData
+     * });
+     * if (!result.verified) {
+     *   console.error('Verification failed:', result.error);
+     * }
+     */
     async verifyCredential(params) {
         validation.verifyCredential(params);
-        const { credential, membershipWitness } = params;
+        let { credential, membershipWitness } = params;
+        if (credential._sd_jwt) {
+            credential = credential?._sd_jwt?.encoded;
+        }
+        if (typeof credential === 'string' && isSDJWTCredential(credential)) {
+            return verifySDJWT(credential);
+        }
         const result = await verifyCredential(credential, {
             resolver: blockchainService.resolver,
             revocationApi: { dock: blockchainService.dock },
@@ -146,24 +293,113 @@ class CredentialService {
         }
         return result;
     }
+    /**
+     * Filters credentials based on a presentation definition
+     * @param {Object} params - Filter parameters
+     * @param {Array<Object>} params.credentials - Array of credentials to filter
+     * @param {Object} params.presentationDefinition - PEX presentation definition
+     * @param {string} [params.holderDid] - DID of the credential holder
+     * @returns {Object} Filtered credentials matching the presentation definition
+     * @example
+     * const filtered = credentialService.filterCredentials({
+     *   credentials: allCredentials,
+     *   presentationDefinition: definition,
+     *   holderDid: 'did:example:holder'
+     * });
+     */
     filterCredentials(params) {
         const { credentials, presentationDefinition, holderDid } = params;
         const result = pex.selectFrom(presentationDefinition, credentials, holderDid);
         return result;
     }
+    /**
+     * Evaluates a presentation against a presentation definition
+     * @param {Object} params - Evaluation parameters
+     * @param {Object} params.presentation - The presentation to evaluate
+     * @param {Object} params.presentationDefinition - PEX presentation definition
+     * @returns {Object} Evaluation result with validation details
+     * @example
+     * const evaluation = credentialService.evaluatePresentation({
+     *   presentation: presentationData,
+     *   presentationDefinition: definition
+     * });
+     */
     evaluatePresentation(params) {
         const { presentation, presentationDefinition } = params;
         const result = pex.evaluatePresentation(presentationDefinition, presentation);
         return result;
     }
+    /**
+     * Checks if a credential uses BBS+ signature
+     * @param {Object} params - Check parameters
+     * @param {Object} params.credential - The credential to check
+     * @returns {boolean} True if the credential uses BBS+ signature
+     */
     isBBSPlusCredential(params) {
         const { credential } = params;
         return isBBSPlusCredential(credential);
     }
+    /**
+     * Checks if a credential uses KVAC signature
+     * @param {Object} params - Check parameters
+     * @param {Object} params.credential - The credential to check
+     * @returns {boolean} True if the credential uses KVAC signature
+     */
     isKvacCredential(params) {
         const { credential } = params;
         return isKvacCredential(credential);
     }
+    /**
+     * Checks if a credential is an SD-JWT (Selective Disclosure JWT) credential
+     * @param {Object} params - Check parameters
+     * @param {string} params.credential - The JWT string to check
+     * @returns {boolean} True if the credential is an SD-JWT credential
+     * @example
+     * const isSDJWT = credentialService.isSDJWTCredential({
+     *   credential: 'eyJ0eXAiOiJ2YytzZC1qd3Q...'
+     * });
+     */
+    isSDJWTCredential(params) {
+        const { credential } = params;
+        return isSDJWTCredential(credential);
+    }
+    /**
+     * Converts a credential to W3C Verifiable Credential format
+     * @description Handles both SD-JWT credentials (needs decoding) and regular W3C credentials (returns as-is)
+     * @param {Object} params - Conversion parameters
+     * @param {string|Object} params.credential - Either an SD-JWT string or a credential object
+     * @returns {Promise<Object>} W3C Verifiable Credential format
+     * @throws {Error} If credential cannot be converted to W3C format
+     * @example
+     * // Convert SD-JWT to W3C format
+     * const w3cCredential = await credentialService.credentialToW3C({
+     *   credential: 'eyJ0eXAiOiJ2YytzZC1qd3Q...'
+     * });
+     *
+     * // Returns W3C credential as-is
+     * const w3cCredential = await credentialService.credentialToW3C({
+     *   credential: { '@context': [...], type: [...], ... }
+     * });
+     */
+    async credentialToW3C(params) {
+        const { credential } = params;
+        return credentialToW3C(credential);
+    }
+    /**
+     * Acquires a credential through OpenID for Verifiable Credentials (OID4VC)
+     * @param {Object} params - Acquisition parameters
+     * @param {string} params.uri - The credential offer URI
+     * @param {string} [params.authorizationCode] - Authorization code if required
+     * @param {Object} params.holderKeyDocument - Key document for the credential holder
+     * @returns {Promise<Object>} Result containing the credential or authorization URL
+     * @returns {Object} [returns.credential] - The acquired credential
+     * @returns {string} [returns.authorizationURL] - Authorization URL if auth is required
+     * @example
+     * const result = await credentialService.acquireOIDCredential({
+     *   uri: 'openid-credential-offer://...',
+     *   holderKeyDocument: keyDoc
+     * });
+     */
     async acquireOIDCredential({ uri, authorizationCode, holderKeyDocument, }) {
         const searchParams = new URL(uri).searchParams;
         new URLSearchParams(searchParams);
@@ -173,6 +409,8 @@ class CredentialService {
             authorizationRequest: {
                 redirectUri: 'dock-wallet://credentials/callback',
                 clientId: 'dock.wallet',
+                // Hack: we need the scope property to avoid 'CredentialOffer format is wrong.' error
+                scope: []
             },
         });
         const format = 'ldp_vc';
@@ -223,6 +461,22 @@ class CredentialService {
             console.error(err);
         }
     }
+    /**
+     * Creates a BBS+ presentation with selective disclosure
+     * @param {Object} params - Presentation parameters
+     * @param {Array<Object>} params.credentials - Array of credentials with attributes to reveal
+     * @param {Object} params.credentials[].credential - The BBS+ credential
+     * @param {Array<string>} [params.credentials[].attributesToReveal] - Attributes to reveal
+     * @returns {Promise<Object>} The BBS+ presentation
+     * @throws {Error} If validation fails
+     * @example
+     * const presentation = await credentialService.createBBSPresentation({
+     *   credentials: [{
+     *     credential: bbsCredential,
+     *     attributesToReveal: ['name', 'age']
+     *   }]
+     * });
+     */
     async createBBSPresentation(params) {
         validation.createBBSPresentation(params);
         const { credentials } = params;
@@ -237,6 +491,13 @@ class CredentialService {
         }
         return bbsPlusPresentation.createPresentation();
     }
+    /**
+     * Gets the accumulator ID from a credential's status
+     * @param {Object} params - Parameters
+     * @param {Object} params.credential - The credential to get accumulator ID from
+     * @returns {string|null} The accumulator ID or null if not present
+     * @throws {Error} If credential is not provided
+     */
     getAccumulatorId({ credential }) {
         assert(!!credential, `credential is required`);
         if (!credential?.credentialStatus) {
@@ -244,6 +505,13 @@ class CredentialService {
         }
         return credential?.credentialStatus.id;
     }
+    /**
+     * Gets accumulator data from the blockchain for a credential
+     * @param {Object} params - Parameters
+     * @param {Object} params.credential - The credential to get accumulator data for
+     * @returns {Promise<Object|null>} The accumulator data or null if not found
+     * @throws {Error} If credential is not provided
+     */
     async getAccumulatorData({ credential }) {
         assert(!!credential, `credential is required`);
         const accumulatorId = await this.getAccumulatorId({ credential });
@@ -253,10 +521,15 @@ class CredentialService {
         return blockchainService.dock.accumulatorModule.getAccumulator(accumulatorId, false);
     }
     /**
-     * Fetch the latest accumulator witness updates for a given credential and membership witness
-     * The witness is generated by the issuer when the credential is created and is stored in the wallet when the credential is imported
-     *
-     * @param param0
+     * Updates the membership witness with the latest accumulator state
+     * @description The witness is generated by the issuer when the credential is created
+     * and is stored in the wallet when the credential is imported. This method updates
+     * it with the latest accumulator changes from the blockchain.
+     * @param {Object} params - Update parameters
+     * @param {Object} params.credential - The credential with revocation status
+     * @param {Object} params.membershipWitnessJSON - Current membership witness in JSON format
+     * @returns {Promise<Object>} Updated membership witness in JSON format
+     * @throws {Error} If updates cannot be fetched or applied
      */
     async updateMembershipWitness({ credential, membershipWitnessJSON }) {
         const revocationId = credential.credentialStatus.revocationId;
@@ -293,6 +566,25 @@ class CredentialService {
         witness.updateUsingPublicInfoPostBatchUpdate(member, additions, removals, queriedWitnessInfo);
         return witness.toJSON();
     }
+    /**
+     * Derives verifiable credentials from a presentation with selective disclosure
+     * @param {Object} params - Derivation parameters
+     * @param {Array<Object>} params.credentials - Array of credential objects
+     * @param {Object} params.credentials[].credential - The credential
+     * @param {Array<string>} params.credentials[].attributesToReveal - Attributes to reveal
+     * @param {Object} [params.credentials[].witness] - Membership witness for revocation
+     * @param {Object} [params.options={}] - Additional options for derivation
+     * @param {Object} [params.proofRequest] - Proof request with constraints
+     * @returns {Promise<Array>} Array of derived credentials
+     * @throws {Error} If validation fails
+     * @example
+     * const derivedCredentials = await credentialService.deriveVCFromPresentation({
+     *   credentials: [{
+     *     credential: bbsCredential,
+     *     attributesToReveal: ['name', 'dateOfBirth']
+     *   }]
+     * });
+     */
     async deriveVCFromPresentation(params) {
         validation.deriveVCFromPresentation(params);
         const { credentials, options = {}, proofRequest } = params;
@@ -323,7 +615,7 @@ class CredentialService {
             const attributesToSkip = descriptorBounds[idx]
                 ? descriptorBounds[idx].map(bound => bound.attributeName)
                 : [];
-            const filteredAttributes = attributesToReveal.filter(attribute => !attributesToSkip.includes(attribute));
+            const filteredAttributes = attributesToReveal.filter(attribute => !attributesToSkip.includes(attribute) && !shouldSkipAttribute(attribute));
             const _pexRequiredAttributes = pexRequiredAttributes[idx] || [];
             _pexRequiredAttributes.forEach(attr => {
                 if (!filteredAttributes.includes(attr)) {
@@ -346,10 +638,35 @@ class CredentialService {
         const credentialsFromPresentation = await presentation.deriveCredentials(options);
         return credentialsFromPresentation;
     }
+    /**
+     * Test method for range proofs
+     * @private
+     * @returns {Promise<void>}
+     */
     async testRangeProof() {
         console.log('test');
     }
 }
+/**
+ * Singleton instance of the credential service
+ * @type {CredentialService}
+ * @example
+ * import { credentialService } from '@docknetwork/wallet-sdk-wasm/services/credential';
+ *
+ * // Create and sign a credential
+ * const credential = credentialService.generateCredential({
+ *   subject: { id: 'did:example:123' }
+ * });
+ * const signed = await credentialService.signCredential({
+ *   vcJson: credential,
+ *   keyDoc: issuerKey
+ * });
+ *
+ * // Verify a credential
+ * const result = await credentialService.verifyCredential({
+ *   credential: signedCredential
+ * });
+ */
 const credentialService = new CredentialService();
 
 export { credentialService, isAnnonymousCredential, isBBSPlusCredential, isKvacCredential };