@docknetwork/wallet-sdk-wasm 1.5.14 → 1.7.0

package/lib/services/credential/sd-jwt.js

@@ -0,0 +1,214 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var sdJwtVc = require('@sd-jwt/sd-jwt-vc');
+var cryptoNodejs = require('@sd-jwt/crypto-nodejs');
+var base64url = require('base64url');
+
+function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
+
+var base64url__default = /*#__PURE__*/_interopDefaultLegacy(base64url);
+
+/**
+ * Checks if a JWT string is an SD-JWT credential
+ */
+function isSDJWTCredential(jwt) {
+    const jwtHeader = jwt.split('.')[0];
+    const decodedHeader = JSON.parse(base64url__default["default"].decode(jwtHeader));
+    return decodedHeader.typ === 'dc+sd-jwt' || decodedHeader.typ === 'vc+sd-jwt';
+}
+async function createSDJWTPresentation({ attributesToReveal, credential, }) {
+    const sdjwt = new sdJwtVc.SDJwtVcInstance({
+        signAlg: 'EdDSA',
+        hasher: cryptoNodejs.digest,
+        hashAlg: 'sha-256',
+        saltGenerator: cryptoNodejs.generateSalt,
+    });
+    // Holder defines the presentation frame to specify which claims should be presented
+    // The list of presented claims must be a subset of the disclosed claims
+    const presentationFrame = {};
+    attributesToReveal.forEach(attribute => {
+        presentationFrame[attribute.replace('credentialSubject.', '')] = true;
+    });
+    // Holder creates a presentation using the issued credential and the presentation frame
+    // returns an encoded SD JWT.
+    const presentation = await sdjwt.present(credential, presentationFrame);
+    return presentation;
+}
+/**
+ * Decodes an SD-JWT string into its structured format
+ * @param {string} sdJwtString - The SD-JWT string to decode
+ * @returns {Promise<Object>} Decoded SD-JWT structure with jwt and disclosures
+ */
+async function decodeSDJWT(sdJwtString) {
+    // Create SD-JWT instance with minimal configuration (no verification needed for decoding)
+    const sdjwt = new sdJwtVc.SDJwtVcInstance({
+        signAlg: 'EdDSA',
+        hasher: cryptoNodejs.digest,
+        hashAlg: 'sha-256',
+        saltGenerator: cryptoNodejs.generateSalt,
+    });
+    // Decode the SD-JWT
+    return await sdjwt.decode(sdJwtString);
+}
+/**
+ * Verifies an SD-JWT credential
+ * @param {string} jwt - The SD-JWT string to verify
+ * @returns {Promise<Object>} Verification result with verified status and optional error
+ * @returns {boolean} returns.verified - Whether the credential is valid
+ * @returns {string} [returns.error] - Error message if verification failed
+ */
+async function verifySDJWT(jwt) {
+    try {
+        // Decode the SD-JWT
+        const decoded = await decodeSDJWT(jwt);
+        // Extract payload for validation
+        const payload = decoded.jwt.payload;
+        // Check expiration date if present
+        if (payload.exp) {
+            const now = Math.floor(Date.now() / 1000);
+            const exp = Number(payload.exp);
+            if (now > exp) {
+                return {
+                    verified: false,
+                    error: 'SD-JWT credential has expired',
+                };
+            }
+        }
+        // Check not-before date if present
+        if (payload.nbf) {
+            const now = Math.floor(Date.now() / 1000);
+            const nbf = Number(payload.nbf);
+            if (now < nbf) {
+                return {
+                    verified: false,
+                    error: 'SD-JWT credential is not yet valid',
+                };
+            }
+        }
+        // If we successfully decoded and passed date checks, consider it verified
+        return {
+            verified: true,
+        };
+    }
+    catch (error) {
+        return {
+            verified: false,
+            error: error.message || 'Failed to verify SD-JWT credential',
+        };
+    }
+}
+/**
+ * Converts a decoded SD-JWT into W3C Verifiable Credential format
+ * @param {Object} decodedSDJWT - The decoded SD-JWT object from SDJwtVcInstance.decode()
+ * @param {string} [encodedSDJWT] - Optional raw encoded SD-JWT string
+ * @returns {Object} W3C Verifiable Credential format with SD-JWT metadata
+ */
+function sdJwtToW3C(decodedSDJWT, encodedSDJWT) {
+    const { jwt, disclosures } = decodedSDJWT;
+    // The jwt object already has header and payload parsed
+    jwt.header;
+    const payload = jwt.payload;
+    // Build credential subject from disclosed claims
+    const credentialSubject = {};
+    // Process disclosures to build the credential subject
+    if (disclosures && Array.isArray(disclosures)) {
+        disclosures.forEach(disclosure => {
+            if (disclosure && disclosure.key && disclosure.value !== undefined) {
+                credentialSubject[disclosure.key] = disclosure.value;
+            }
+        });
+    }
+    // Extract issuer from payload
+    const issuer = payload.iss || payload.issuer;
+    // Extract subject ID if present in disclosures
+    const subjectId = credentialSubject.id;
+    // Build final credential subject with id if available
+    const finalCredentialSubject = subjectId
+        ? { id: subjectId, ...credentialSubject }
+        : credentialSubject;
+    // Extract credential type from vct (verifiable credential type) field
+    // vct is the SD-JWT VC type claim
+    const credentialType = payload.vct || 'UnknownCredential';
+    // Build the W3C credential
+    const w3cCredential = {
+        '@context': ['https://www.w3.org/2018/credentials/v1'],
+        type: ['VerifiableCredential', credentialType],
+        issuer: issuer,
+        credentialSubject: finalCredentialSubject,
+    };
+    // Add issuance date if available
+    if (payload.iat) {
+        w3cCredential.issuanceDate = new Date(payload.iat * 1000).toISOString();
+    }
+    // Add expiration date if available
+    if (payload.exp) {
+        w3cCredential.expirationDate = new Date(payload.exp * 1000).toISOString();
+    }
+    // Add credential ID if available
+    if (payload.jti) {
+        w3cCredential.id = payload.jti;
+    }
+    // Store SD-JWT metadata for unwrapping during presentation flow
+    // This allows converting back to SD-JWT format when needed
+    w3cCredential._sd_jwt = {
+        // Raw encoded SD-JWT string
+        encoded: encodedSDJWT,
+    };
+    return w3cCredential;
+}
+/**
+ * Decodes an SD-JWT string and converts it to W3C credential format
+ * @param {string} sdJwtString - The SD-JWT string
+ * @returns {Promise<Object>} W3C Verifiable Credential format with SD-JWT metadata
+ */
+async function decodeSDJWTToW3C(sdJwtString) {
+    // Decode the SD-JWT using the reusable decode function
+    const decoded = await decodeSDJWT(sdJwtString);
+    // Convert to W3C format, passing both decoded data and raw string
+    return sdJwtToW3C(decoded, sdJwtString);
+}
+/**
+ * Converts a credential to W3C format
+ * Handles both SD-JWT credentials (needs decoding) and regular W3C credentials (returns as-is)
+ * @param {string|Object} credential - Either an SD-JWT string or a credential object
+ * @returns {Promise<Object>} W3C Verifiable Credential format
+ */
+async function credentialToW3C(credential) {
+    // If it's already an object with a type field, assume it's already W3C format
+    if (typeof credential === 'object' && credential.type) {
+        return credential;
+    }
+    // If it's a string, check if it's an SD-JWT
+    if (typeof credential === 'string') {
+        // First try to parse as JSON
+        try {
+            const parsed = JSON.parse(credential);
+            if (parsed.type) {
+                return parsed;
+            }
+        }
+        catch (e) {
+            // Not a JSON string, might be a JWT
+        }
+        // Check if it's an SD-JWT
+        try {
+            if (isSDJWTCredential(credential)) {
+                return await decodeSDJWTToW3C(credential);
+            }
+        }
+        catch (e) {
+            // Not a valid SD-JWT
+        }
+    }
+    throw new Error('Unable to convert credential to W3C format');
+}
+
+exports.createSDJWTPresentation = createSDJWTPresentation;
+exports.credentialToW3C = credentialToW3C;
+exports.decodeSDJWT = decodeSDJWT;
+exports.decodeSDJWTToW3C = decodeSDJWTToW3C;
+exports.isSDJWTCredential = isSDJWTCredential;
+exports.sdJwtToW3C = sdJwtToW3C;
+exports.verifySDJWT = verifySDJWT;

package/lib/services/credential/sd-jwt.mjs

@@ -0,0 +1,200 @@
+import { SDJwtVcInstance } from '@sd-jwt/sd-jwt-vc';
+import { digest, generateSalt } from '@sd-jwt/crypto-nodejs';
+import base64url from 'base64url';
+
+/**
+ * Checks if a JWT string is an SD-JWT credential
+ */
+function isSDJWTCredential(jwt) {
+    const jwtHeader = jwt.split('.')[0];
+    const decodedHeader = JSON.parse(base64url.decode(jwtHeader));
+    return decodedHeader.typ === 'dc+sd-jwt' || decodedHeader.typ === 'vc+sd-jwt';
+}
+async function createSDJWTPresentation({ attributesToReveal, credential, }) {
+    const sdjwt = new SDJwtVcInstance({
+        signAlg: 'EdDSA',
+        hasher: digest,
+        hashAlg: 'sha-256',
+        saltGenerator: generateSalt,
+    });
+    // Holder defines the presentation frame to specify which claims should be presented
+    // The list of presented claims must be a subset of the disclosed claims
+    const presentationFrame = {};
+    attributesToReveal.forEach(attribute => {
+        presentationFrame[attribute.replace('credentialSubject.', '')] = true;
+    });
+    // Holder creates a presentation using the issued credential and the presentation frame
+    // returns an encoded SD JWT.
+    const presentation = await sdjwt.present(credential, presentationFrame);
+    return presentation;
+}
+/**
+ * Decodes an SD-JWT string into its structured format
+ * @param {string} sdJwtString - The SD-JWT string to decode
+ * @returns {Promise<Object>} Decoded SD-JWT structure with jwt and disclosures
+ */
+async function decodeSDJWT(sdJwtString) {
+    // Create SD-JWT instance with minimal configuration (no verification needed for decoding)
+    const sdjwt = new SDJwtVcInstance({
+        signAlg: 'EdDSA',
+        hasher: digest,
+        hashAlg: 'sha-256',
+        saltGenerator: generateSalt,
+    });
+    // Decode the SD-JWT
+    return await sdjwt.decode(sdJwtString);
+}
+/**
+ * Verifies an SD-JWT credential
+ * @param {string} jwt - The SD-JWT string to verify
+ * @returns {Promise<Object>} Verification result with verified status and optional error
+ * @returns {boolean} returns.verified - Whether the credential is valid
+ * @returns {string} [returns.error] - Error message if verification failed
+ */
+async function verifySDJWT(jwt) {
+    try {
+        // Decode the SD-JWT
+        const decoded = await decodeSDJWT(jwt);
+        // Extract payload for validation
+        const payload = decoded.jwt.payload;
+        // Check expiration date if present
+        if (payload.exp) {
+            const now = Math.floor(Date.now() / 1000);
+            const exp = Number(payload.exp);
+            if (now > exp) {
+                return {
+                    verified: false,
+                    error: 'SD-JWT credential has expired',
+                };
+            }
+        }
+        // Check not-before date if present
+        if (payload.nbf) {
+            const now = Math.floor(Date.now() / 1000);
+            const nbf = Number(payload.nbf);
+            if (now < nbf) {
+                return {
+                    verified: false,
+                    error: 'SD-JWT credential is not yet valid',
+                };
+            }
+        }
+        // If we successfully decoded and passed date checks, consider it verified
+        return {
+            verified: true,
+        };
+    }
+    catch (error) {
+        return {
+            verified: false,
+            error: error.message || 'Failed to verify SD-JWT credential',
+        };
+    }
+}
+/**
+ * Converts a decoded SD-JWT into W3C Verifiable Credential format
+ * @param {Object} decodedSDJWT - The decoded SD-JWT object from SDJwtVcInstance.decode()
+ * @param {string} [encodedSDJWT] - Optional raw encoded SD-JWT string
+ * @returns {Object} W3C Verifiable Credential format with SD-JWT metadata
+ */
+function sdJwtToW3C(decodedSDJWT, encodedSDJWT) {
+    const { jwt, disclosures } = decodedSDJWT;
+    // The jwt object already has header and payload parsed
+    jwt.header;
+    const payload = jwt.payload;
+    // Build credential subject from disclosed claims
+    const credentialSubject = {};
+    // Process disclosures to build the credential subject
+    if (disclosures && Array.isArray(disclosures)) {
+        disclosures.forEach(disclosure => {
+            if (disclosure && disclosure.key && disclosure.value !== undefined) {
+                credentialSubject[disclosure.key] = disclosure.value;
+            }
+        });
+    }
+    // Extract issuer from payload
+    const issuer = payload.iss || payload.issuer;
+    // Extract subject ID if present in disclosures
+    const subjectId = credentialSubject.id;
+    // Build final credential subject with id if available
+    const finalCredentialSubject = subjectId
+        ? { id: subjectId, ...credentialSubject }
+        : credentialSubject;
+    // Extract credential type from vct (verifiable credential type) field
+    // vct is the SD-JWT VC type claim
+    const credentialType = payload.vct || 'UnknownCredential';
+    // Build the W3C credential
+    const w3cCredential = {
+        '@context': ['https://www.w3.org/2018/credentials/v1'],
+        type: ['VerifiableCredential', credentialType],
+        issuer: issuer,
+        credentialSubject: finalCredentialSubject,
+    };
+    // Add issuance date if available
+    if (payload.iat) {
+        w3cCredential.issuanceDate = new Date(payload.iat * 1000).toISOString();
+    }
+    // Add expiration date if available
+    if (payload.exp) {
+        w3cCredential.expirationDate = new Date(payload.exp * 1000).toISOString();
+    }
+    // Add credential ID if available
+    if (payload.jti) {
+        w3cCredential.id = payload.jti;
+    }
+    // Store SD-JWT metadata for unwrapping during presentation flow
+    // This allows converting back to SD-JWT format when needed
+    w3cCredential._sd_jwt = {
+        // Raw encoded SD-JWT string
+        encoded: encodedSDJWT,
+    };
+    return w3cCredential;
+}
+/**
+ * Decodes an SD-JWT string and converts it to W3C credential format
+ * @param {string} sdJwtString - The SD-JWT string
+ * @returns {Promise<Object>} W3C Verifiable Credential format with SD-JWT metadata
+ */
+async function decodeSDJWTToW3C(sdJwtString) {
+    // Decode the SD-JWT using the reusable decode function
+    const decoded = await decodeSDJWT(sdJwtString);
+    // Convert to W3C format, passing both decoded data and raw string
+    return sdJwtToW3C(decoded, sdJwtString);
+}
+/**
+ * Converts a credential to W3C format
+ * Handles both SD-JWT credentials (needs decoding) and regular W3C credentials (returns as-is)
+ * @param {string|Object} credential - Either an SD-JWT string or a credential object
+ * @returns {Promise<Object>} W3C Verifiable Credential format
+ */
+async function credentialToW3C(credential) {
+    // If it's already an object with a type field, assume it's already W3C format
+    if (typeof credential === 'object' && credential.type) {
+        return credential;
+    }
+    // If it's a string, check if it's an SD-JWT
+    if (typeof credential === 'string') {
+        // First try to parse as JSON
+        try {
+            const parsed = JSON.parse(credential);
+            if (parsed.type) {
+                return parsed;
+            }
+        }
+        catch (e) {
+            // Not a JSON string, might be a JWT
+        }
+        // Check if it's an SD-JWT
+        try {
+            if (isSDJWTCredential(credential)) {
+                return await decodeSDJWTToW3C(credential);
+            }
+        }
+        catch (e) {
+            // Not a valid SD-JWT
+        }
+    }
+    throw new Error('Unable to convert credential to W3C format');
+}
+
+export { createSDJWTPresentation, credentialToW3C, decodeSDJWT, decodeSDJWTToW3C, isSDJWTCredential, sdJwtToW3C, verifySDJWT };

package/lib/services/credential/service-rpc.js

@@ -41,6 +41,15 @@ class CredentialServiceRPC extends services_rpcServiceClient.RpcService {
   async isKvacCredential(params) {
     return this.call('isKvacCredential', params);
   }
+  async isSDJWTCredential(params) {
+    return this.call('isSDJWTCredential', params);
+  }
+  async credentialToW3C(params) {
+    return this.call('credentialToW3C', params);
+  }
+  async createSDJWTPresentation(params) {
+    return this.call('createSDJWTPresentation', params);
+  }
   async getAccumulatorId(params) {
     return this.call('getAccumulatorId', params);
   }

package/lib/services/credential/service-rpc.mjs

@@ -37,6 +37,15 @@ class CredentialServiceRPC extends RpcService {
   async isKvacCredential(params) {
     return this.call('isKvacCredential', params);
   }
+  async isSDJWTCredential(params) {
+    return this.call('isSDJWTCredential', params);
+  }
+  async credentialToW3C(params) {
+    return this.call('credentialToW3C', params);
+  }
+  async createSDJWTPresentation(params) {
+    return this.call('createSDJWTPresentation', params);
+  }
   async getAccumulatorId(params) {
     return this.call('getAccumulatorId', params);
   }