@docknetwork/wallet-sdk-wasm 1.5.14 → 1.7.6

package/src/services/credential/sd-jwt.ts

@@ -0,0 +1,231 @@
+import {SDJwtVcInstance} from '@sd-jwt/sd-jwt-vc';
+import {digest, generateSalt} from '@sd-jwt/crypto-nodejs';
+import base64url from 'base64url';
+
+/**
+ * Checks if a JWT string is an SD-JWT credential
+ */
+export function isSDJWTCredential(jwt) {
+  const jwtHeader = jwt.split('.')[0];
+  const decodedHeader = JSON.parse(base64url.decode(jwtHeader));
+  return decodedHeader.typ === 'dc+sd-jwt' || decodedHeader.typ === 'vc+sd-jwt';
+}
+
+export async function createSDJWTPresentation({
+  attributesToReveal,
+  credential,
+}: {
+  attributesToReveal: string[];
+  credential: string;
+}) {
+  const sdjwt = new SDJwtVcInstance({
+    signAlg: 'EdDSA',
+    hasher: digest,
+    hashAlg: 'sha-256',
+    saltGenerator: generateSalt,
+  });
+
+  // Holder defines the presentation frame to specify which claims should be presented
+  // The list of presented claims must be a subset of the disclosed claims
+  const presentationFrame: any = {};
+  attributesToReveal.forEach(attribute => {
+    presentationFrame[attribute.replace('credentialSubject.', '')] = true;
+  });
+
+  // Holder creates a presentation using the issued credential and the presentation frame
+  // returns an encoded SD JWT.
+  const presentation = await sdjwt.present(credential, presentationFrame);
+
+  return presentation;
+}
+/**
+ * Decodes an SD-JWT string into its structured format
+ * @param {string} sdJwtString - The SD-JWT string to decode
+ * @returns {Promise<Object>} Decoded SD-JWT structure with jwt and disclosures
+ */
+export async function decodeSDJWT(sdJwtString) {
+  // Create SD-JWT instance with minimal configuration (no verification needed for decoding)
+  const sdjwt = new SDJwtVcInstance({
+    signAlg: 'EdDSA',
+    hasher: digest,
+    hashAlg: 'sha-256',
+    saltGenerator: generateSalt,
+  });
+
+  // Decode the SD-JWT
+  return await sdjwt.decode(sdJwtString);
+}
+
+/**
+ * Verifies an SD-JWT credential
+ * @param {string} jwt - The SD-JWT string to verify
+ * @returns {Promise<Object>} Verification result with verified status and optional error
+ * @returns {boolean} returns.verified - Whether the credential is valid
+ * @returns {string} [returns.error] - Error message if verification failed
+ */
+export async function verifySDJWT(jwt) {
+  try {
+    // Decode the SD-JWT
+    const decoded = await decodeSDJWT(jwt);
+
+    // Extract payload for validation
+    const payload: any = decoded.jwt.payload;
+
+    // Check expiration date if present
+    if (payload.exp) {
+      const now = Math.floor(Date.now() / 1000);
+      const exp = Number(payload.exp);
+      if (now > exp) {
+        return {
+          verified: false,
+          error: 'SD-JWT credential has expired',
+        };
+      }
+    }
+
+    // Check not-before date if present
+    if (payload.nbf) {
+      const now = Math.floor(Date.now() / 1000);
+      const nbf = Number(payload.nbf);
+      if (now < nbf) {
+        return {
+          verified: false,
+          error: 'SD-JWT credential is not yet valid',
+        };
+      }
+    }
+
+    // If we successfully decoded and passed date checks, consider it verified
+    return {
+      verified: true,
+    };
+  } catch (error) {
+    return {
+      verified: false,
+      error: error.message || 'Failed to verify SD-JWT credential',
+    };
+  }
+}
+
+/**
+ * Converts a decoded SD-JWT into W3C Verifiable Credential format
+ * @param {Object} decodedSDJWT - The decoded SD-JWT object from SDJwtVcInstance.decode()
+ * @param {string} [encodedSDJWT] - Optional raw encoded SD-JWT string
+ * @returns {Object} W3C Verifiable Credential format with SD-JWT metadata
+ */
+export function sdJwtToW3C(decodedSDJWT, encodedSDJWT?) {
+  const {jwt, disclosures} = decodedSDJWT;
+
+  // The jwt object already has header and payload parsed
+  const header = jwt.header;
+  const payload = jwt.payload;
+
+  // Build credential subject from disclosed claims
+  const credentialSubject: any = {};
+
+  // Process disclosures to build the credential subject
+  if (disclosures && Array.isArray(disclosures)) {
+    disclosures.forEach(disclosure => {
+      if (disclosure && disclosure.key && disclosure.value !== undefined) {
+        credentialSubject[disclosure.key] = disclosure.value;
+      }
+    });
+  }
+
+  // Extract issuer from payload
+  const issuer = payload.iss || payload.issuer;
+
+  // Extract subject ID if present in disclosures
+  const subjectId = credentialSubject.id;
+
+  // Build final credential subject with id if available
+  const finalCredentialSubject = subjectId
+    ? {id: subjectId, ...credentialSubject}
+    : credentialSubject;
+
+  // Extract credential type from vct (verifiable credential type) field
+  // vct is the SD-JWT VC type claim
+  const credentialType = payload.vct || 'UnknownCredential';
+
+  // Build the W3C credential
+  const w3cCredential: any = {
+    '@context': ['https://www.w3.org/2018/credentials/v1'],
+    type: ['VerifiableCredential', credentialType],
+    issuer: issuer,
+    credentialSubject: finalCredentialSubject,
+  };
+
+  // Add issuance date if available
+  if (payload.iat) {
+    w3cCredential.issuanceDate = new Date(payload.iat * 1000).toISOString();
+  }
+
+  // Add expiration date if available
+  if (payload.exp) {
+    w3cCredential.expirationDate = new Date(payload.exp * 1000).toISOString();
+  }
+
+  // Add credential ID if available
+  if (payload.jti) {
+    w3cCredential.id = payload.jti;
+  }
+
+  // Store SD-JWT metadata for unwrapping during presentation flow
+  // This allows converting back to SD-JWT format when needed
+  w3cCredential._sd_jwt = {
+    // Raw encoded SD-JWT string
+    encoded: encodedSDJWT,
+  };
+
+  return w3cCredential;
+}
+
+/**
+ * Decodes an SD-JWT string and converts it to W3C credential format
+ * @param {string} sdJwtString - The SD-JWT string
+ * @returns {Promise<Object>} W3C Verifiable Credential format with SD-JWT metadata
+ */
+export async function decodeSDJWTToW3C(sdJwtString) {
+  // Decode the SD-JWT using the reusable decode function
+  const decoded = await decodeSDJWT(sdJwtString);
+
+  // Convert to W3C format, passing both decoded data and raw string
+  return sdJwtToW3C(decoded, sdJwtString);
+}
+
+/**
+ * Converts a credential to W3C format
+ * Handles both SD-JWT credentials (needs decoding) and regular W3C credentials (returns as-is)
+ * @param {string|Object} credential - Either an SD-JWT string or a credential object
+ * @returns {Promise<Object>} W3C Verifiable Credential format
+ */
+export async function credentialToW3C(credential) {
+  // If it's already an object with a type field, assume it's already W3C format
+  if (typeof credential === 'object' && credential.type) {
+    return credential;
+  }
+
+  // If it's a string, check if it's an SD-JWT
+  if (typeof credential === 'string') {
+    // First try to parse as JSON
+    try {
+      const parsed = JSON.parse(credential);
+      if (parsed.type) {
+        return parsed;
+      }
+    } catch (e) {
+      // Not a JSON string, might be a JWT
+    }
+
+    // Check if it's an SD-JWT
+    try {
+      if (isSDJWTCredential(credential)) {
+        return await decodeSDJWTToW3C(credential);
+      }
+    } catch (e) {
+      // Not a valid SD-JWT
+    }
+  }
+
+  throw new Error('Unable to convert credential to W3C format');
+}

package/src/services/credential/service-rpc.js

@@ -29,6 +29,15 @@ export class CredentialServiceRPC extends RpcService {
   async isKvacCredential(params) {
     return this.call('isKvacCredential', params);
   }
+  async isSDJWTCredential(params) {
+    return this.call('isSDJWTCredential', params);
+  }
+  async credentialToW3C(params) {
+    return this.call('credentialToW3C', params);
+  }
+  async createSDJWTPresentation(params) {
+    return this.call('createSDJWTPresentation', params);
+  }
   async getAccumulatorId(params) {
     return this.call('getAccumulatorId', params);
   }