@docknetwork/wallet-sdk-wasm 1.7.7-alpha.0 → 1.9.0

package/src/services/credential/index.test.js

@@ -1,7 +1,10 @@
 import {assertRpcService, getPromiseError} from '../test-utils';
-import {credentialService as service} from './service';
+import {
+  credentialService as service,
+  credentialUtils as serviceCredentialUtils,
+  pexUtils,
+} from './service';
 import {validation} from './config';
-import * as credentialUtils from '@docknetwork/credential-sdk/vc';
 import {CredentialServiceRPC} from './service-rpc';
 import {OpenID4VCIClientV1_0_13} from '@sphereon/oid4vci-client';
 import {didService} from '../dids/service';
@@ -13,17 +16,19 @@ describe('Credential Service', () => {
     const mockCreatePresentation = jest.fn();
     const mockDeriveCredentials = jest.fn(() => []);
 
-    jest.spyOn(credentialUtils, 'Presentation').mockImplementation(() => {
-      return {
-        addCredentialToPresent: mockAddCredentialToPresent,
-        addAttributeToReveal: mockAddAttributeToReveal,
-        createPresentation: mockCreatePresentation,
-        deriveCredentials: mockDeriveCredentials,
-        presBuilder: {
-          enforceBounds: jest.fn(),
-        },
-      };
-    });
+    jest
+      .spyOn(serviceCredentialUtils, 'Presentation')
+      .mockImplementation(() => {
+        return {
+          addCredentialToPresent: mockAddCredentialToPresent,
+          addAttributeToReveal: mockAddAttributeToReveal,
+          createPresentation: mockCreatePresentation,
+          deriveCredentials: mockDeriveCredentials,
+          presBuilder: {
+            enforceBounds: jest.fn(),
+          },
+        };
+      });
   });
   it('ServiceRpc', () => {
     assertRpcService(CredentialServiceRPC, service, validation);
@@ -34,7 +39,7 @@ describe('Credential Service', () => {
   });
   it('expect to verify credential', async () => {
     jest
-      .spyOn(credentialUtils, 'verifyCredential')
+      .spyOn(serviceCredentialUtils, 'verifyCredential')
       .mockImplementationOnce(async () => ({verified: true}));
     const credential = {
       '@context': [
@@ -86,7 +91,7 @@ describe('Credential Service', () => {
       },
     };
     await service.verifyCredential({credential});
-    expect(credentialUtils.verifyCredential).toBeCalled();
+    expect(serviceCredentialUtils.verifyCredential).toBeCalled();
   });
   it('should create a vc', async () => {
     const subject = {
@@ -311,7 +316,7 @@ describe('Credential Service', () => {
       credentials,
     });
 
-    const bbsPresentation = new credentialUtils.Presentation();
+    const bbsPresentation = new serviceCredentialUtils.Presentation();
     expect(bbsPresentation.addCredentialToPresent).toBeCalledWith(
       credential,
       expect.any(Object),
@@ -381,7 +386,7 @@ describe('Credential Service', () => {
       credentials,
     });
 
-    const bbsPresentation = new credentialUtils.Presentation();
+    const bbsPresentation = new serviceCredentialUtils.Presentation();
     expect(bbsPresentation.addCredentialToPresent).toBeCalledWith(
       credential,
       expect.any(Object),
@@ -566,4 +571,243 @@ describe('Credential Service', () => {
       });
     });
   });
+
+  describe('generatePresentationFromPex', () => {
+    let generateSpy;
+
+    const basePexRequest = {
+      id: 'test-request',
+      input_descriptors: [
+        {
+          id: 'Credential 1',
+          constraints: {fields: [{path: ['$.type[*]']}]},
+        },
+      ],
+    };
+
+    const baseCredential = {
+      id: 'https://example.com/credential/1',
+      type: ['VerifiableCredential'],
+      credentialSubject: {id: 'did:example:123', name: 'Test'},
+      proof: {type: 'Bls12381BBS+SignatureDock2022'},
+    };
+
+    beforeEach(() => {
+      generateSpy = jest.spyOn(pexUtils, 'generatePresentationFromPexRequest');
+    });
+
+    afterEach(() => {
+      generateSpy.mockRestore();
+    });
+
+    it('should reject empty credentials array', async () => {
+      const error = await getPromiseError(() =>
+        service.generatePresentationFromPex({
+          credentials: [],
+          pexRequest: basePexRequest,
+          challenge: 'test-challenge',
+        }),
+      );
+      expect(error.message).toBe('no credential found');
+    });
+
+    it('should reject non-array credentials', async () => {
+      const error = await getPromiseError(() =>
+        service.generatePresentationFromPex({
+          credentials: 'invalid',
+          pexRequest: basePexRequest,
+          challenge: 'test-challenge',
+        }),
+      );
+      expect(error.message).toBe('invalid credentials');
+    });
+
+    it('should reject missing pexRequest', async () => {
+      const error = await getPromiseError(() =>
+        service.generatePresentationFromPex({
+          credentials: [{credential: baseCredential}],
+          challenge: 'test-challenge',
+        }),
+      );
+      expect(error.message).toBe('pexRequest is required');
+    });
+
+    it('should reject missing challenge', async () => {
+      const error = await getPromiseError(() =>
+        service.generatePresentationFromPex({
+          credentials: [{credential: baseCredential}],
+          pexRequest: basePexRequest,
+        }),
+      );
+      expect(error.message).toBe('challenge is required');
+    });
+
+    it('should call generatePresentationFromPexRequest and return presentation', async () => {
+      const mockPresentation = {
+        type: ['VerifiablePresentation'],
+        verifiableCredential: [baseCredential],
+      };
+
+      generateSpy.mockResolvedValueOnce({
+        status: pexUtils.GeneratePresentationStatus.SUCCESS,
+        presentation: mockPresentation,
+      });
+
+      const result = await service.generatePresentationFromPex({
+        credentials: [
+          {
+            credential: baseCredential,
+            attributesToReveal: ['credentialSubject.name'],
+          },
+        ],
+        pexRequest: basePexRequest,
+        challenge: 'test-challenge',
+        domain: 'dock.io',
+        skipSigning: true,
+      });
+
+      expect(result).toEqual(mockPresentation);
+      expect(pexUtils.generatePresentationFromPexRequest).toHaveBeenCalledWith(
+        expect.objectContaining({
+          credentials: [baseCredential],
+          pexRequest: basePexRequest,
+          challenge: 'test-challenge',
+          domain: 'dock.io',
+          skipSigning: true,
+          selectiveDisclosure: {
+            credentials: [
+              {
+                attributes: ['credentialSubject.name', 'id'],
+                witness: undefined,
+              },
+            ],
+          },
+        }),
+      );
+    });
+
+    it('should throw when generation status is not SUCCESS', async () => {
+      generateSpy.mockResolvedValueOnce({
+        status: pexUtils.GeneratePresentationStatus.REQUIREMENTS_NOT_MET,
+        error: new Error(
+          'Credentials do not satisfy the presentation definition',
+        ),
+      });
+
+      const error = await getPromiseError(() =>
+        service.generatePresentationFromPex({
+          credentials: [{credential: baseCredential}],
+          pexRequest: basePexRequest,
+          challenge: 'test-challenge',
+          skipSigning: true,
+        }),
+      );
+
+      expect(error.message).toBe(
+        'Credentials do not satisfy the presentation definition',
+      );
+    });
+
+    it('should throw generic error when generation fails without error object', async () => {
+      generateSpy.mockResolvedValueOnce({
+        status: pexUtils.GeneratePresentationStatus.REQUIREMENTS_NOT_MET,
+      });
+
+      const error = await getPromiseError(() =>
+        service.generatePresentationFromPex({
+          credentials: [{credential: baseCredential}],
+          pexRequest: basePexRequest,
+          challenge: 'test-challenge',
+          skipSigning: true,
+        }),
+      );
+
+      expect(error.message).toBe(
+        'Presentation generation failed: requirements_not_met',
+      );
+    });
+
+    it('should pass credentials without witness as undefined', async () => {
+      generateSpy.mockResolvedValueOnce({
+        status: pexUtils.GeneratePresentationStatus.SUCCESS,
+        presentation: {type: ['VerifiablePresentation']},
+      });
+
+      await service.generatePresentationFromPex({
+        credentials: [{credential: baseCredential, attributesToReveal: []}],
+        pexRequest: basePexRequest,
+        challenge: 'test-challenge',
+        skipSigning: true,
+      });
+
+      const callArgs = generateSpy.mock.calls[0][0];
+      expect(
+        callArgs.selectiveDisclosure.credentials[0].witness,
+      ).toBeUndefined();
+    });
+
+    it('should not include loadProvingKey when no boundCheckSnarkKey', async () => {
+      generateSpy.mockResolvedValueOnce({
+        status: pexUtils.GeneratePresentationStatus.SUCCESS,
+        presentation: {type: ['VerifiablePresentation']},
+      });
+
+      await service.generatePresentationFromPex({
+        credentials: [{credential: baseCredential}],
+        pexRequest: basePexRequest,
+        challenge: 'test-challenge',
+        skipSigning: true,
+      });
+
+      const callArgs = generateSpy.mock.calls[0][0];
+      expect(callArgs.loadProvingKey).toBeUndefined();
+    });
+
+    it('should include loadProvingKey when boundCheckSnarkKey is provided', async () => {
+      generateSpy.mockResolvedValueOnce({
+        status: pexUtils.GeneratePresentationStatus.SUCCESS,
+        presentation: {type: ['VerifiablePresentation']},
+      });
+
+      await service.generatePresentationFromPex({
+        credentials: [{credential: baseCredential}],
+        pexRequest: basePexRequest,
+        challenge: 'test-challenge',
+        boundCheckSnarkKey: 'SGVsbG8gV29ybGQ=',
+        skipSigning: true,
+      });
+
+      const callArgs = generateSpy.mock.calls[0][0];
+      expect(typeof callArgs.loadProvingKey).toBe('function');
+    });
+
+    it('should always append id to attributesToReveal', async () => {
+      generateSpy.mockResolvedValueOnce({
+        status: pexUtils.GeneratePresentationStatus.SUCCESS,
+        presentation: {type: ['VerifiablePresentation']},
+      });
+
+      await service.generatePresentationFromPex({
+        credentials: [
+          {
+            credential: baseCredential,
+            attributesToReveal: ['credentialSubject.name'],
+          },
+          {credential: baseCredential},
+        ],
+        pexRequest: basePexRequest,
+        challenge: 'test-challenge',
+        skipSigning: true,
+      });
+
+      const callArgs = generateSpy.mock.calls[0][0];
+      expect(callArgs.selectiveDisclosure.credentials[0].attributes).toEqual([
+        'credentialSubject.name',
+        'id',
+      ]);
+      expect(callArgs.selectiveDisclosure.credentials[1].attributes).toEqual([
+        'id',
+      ]);
+    });
+  });
 });

package/src/services/credential/oid4vci.js

@@ -0,0 +1,44 @@
+export function resolveOfferedCredentialConfig(client) {
+  const supported = client.getCredentialsSupported();
+  const offerIds =
+    client.credentialOffer?.credential_offer?.credential_configuration_ids ??
+    client.credentialOffer?.credential_configuration_ids ??
+    [];
+
+  if (Array.isArray(supported)) {
+    const matchedLegacy = supported.find(
+      entry => entry?.id && offerIds.includes(entry.id),
+    );
+    return matchedLegacy ?? supported[0];
+  }
+
+  const matched = offerIds.map(id => supported[id]).find(Boolean);
+  return matched ?? Object.values(supported)[0];
+}
+
+const KNOWN_FORMATS = new Set([
+  'vc+sd-jwt',
+  'dc+sd-jwt',
+  'ldp_vc',
+  'jwt_vc_json',
+  'jwt_vc_json-ld',
+  'jwt_vc',
+]);
+
+export function resolveFormatAndType(config) {
+  const scopeSegments = config.scope?.split(':') ?? [];
+  const scopeTail = scopeSegments.slice(-1)[0];
+  const scopePrefix = scopeSegments.length > 1 ? scopeSegments[0] : undefined;
+  const definitionType = config.credential_definition?.type?.slice(-1)[0];
+
+  const format =
+    config.format ??
+    (scopePrefix && KNOWN_FORMATS.has(scopePrefix) ? scopePrefix : 'ldp_vc');
+
+  const credentialTypes =
+    format === 'vc+sd-jwt' || format === 'dc+sd-jwt'
+      ? config.vct
+      : definitionType ?? scopeTail;
+
+  return {format, credentialTypes};
+}

package/src/services/credential/oid4vci.test.js

@@ -0,0 +1,162 @@
+import {resolveOfferedCredentialConfig, resolveFormatAndType} from './oid4vci';
+
+function makeClient({supported, offerIds}) {
+  return {
+    getCredentialsSupported: () => supported,
+    credentialOffer: offerIds
+      ? {credential_offer: {credential_configuration_ids: offerIds}}
+      : undefined,
+  };
+}
+
+describe('OID4VCI offer resolution', () => {
+  describe('resolveOfferedCredentialConfig', () => {
+    it('returns the entry matching the offered configuration id', () => {
+      const supported = {
+        'ldp_vc:MyCredential': {format: 'vc+sd-jwt', vct: 'MyCredential'},
+        'ldp_vc:OtherCredential': {format: 'ldp_vc'},
+      };
+      const client = makeClient({
+        supported,
+        offerIds: ['ldp_vc:MyCredential'],
+      });
+
+      expect(resolveOfferedCredentialConfig(client)).toBe(
+        supported['ldp_vc:MyCredential'],
+      );
+    });
+
+    it('falls back to the first record entry when the offer id does not match', () => {
+      const supported = {
+        'ldp_vc:A': {format: 'ldp_vc'},
+        'ldp_vc:B': {format: 'vc+sd-jwt'},
+      };
+      const client = makeClient({supported, offerIds: ['nonexistent']});
+
+      expect(resolveOfferedCredentialConfig(client)).toBe(
+        supported['ldp_vc:A'],
+      );
+    });
+
+    it('handles array-shaped credentialsSupported by returning the first entry', () => {
+      const supported = [
+        {format: 'vc+sd-jwt', vct: 'MyCredential'},
+        {format: 'ldp_vc'},
+      ];
+      const client = makeClient({supported, offerIds: []});
+
+      expect(resolveOfferedCredentialConfig(client)).toBe(supported[0]);
+    });
+
+    it('matches an array-shaped entry by id when the offer provides one', () => {
+      const supported = [
+        {id: 'ldp_vc:A', format: 'ldp_vc'},
+        {id: 'sdjwt:B', format: 'vc+sd-jwt', vct: 'B'},
+      ];
+      const client = makeClient({supported, offerIds: ['sdjwt:B']});
+
+      expect(resolveOfferedCredentialConfig(client)).toBe(supported[1]);
+    });
+
+    it('falls back to the first array entry when no offered id matches', () => {
+      const supported = [
+        {id: 'ldp_vc:A', format: 'ldp_vc'},
+        {id: 'sdjwt:B', format: 'vc+sd-jwt'},
+      ];
+      const client = makeClient({supported, offerIds: ['nonexistent']});
+
+      expect(resolveOfferedCredentialConfig(client)).toBe(supported[0]);
+    });
+
+    it('reads offer ids from credentialOffer.credential_configuration_ids when not nested', () => {
+      const supported = {
+        'ldp_vc:Wanted': {format: 'vc+sd-jwt', vct: 'Wanted'},
+        'ldp_vc:Other': {format: 'ldp_vc'},
+      };
+      const client = {
+        getCredentialsSupported: () => supported,
+        credentialOffer: {credential_configuration_ids: ['ldp_vc:Wanted']},
+      };
+
+      expect(resolveOfferedCredentialConfig(client)).toBe(
+        supported['ldp_vc:Wanted'],
+      );
+    });
+  });
+
+  describe('resolveFormatAndType', () => {
+    it('returns vct as credentialTypes for vc+sd-jwt', () => {
+      const result = resolveFormatAndType({
+        format: 'vc+sd-jwt',
+        vct: 'MyCredential',
+        scope: 'ldp_vc:MyCredential',
+      });
+
+      expect(result).toEqual({
+        format: 'vc+sd-jwt',
+        credentialTypes: 'MyCredential',
+      });
+    });
+
+    it('returns the last credential_definition.type entry for ldp_vc', () => {
+      const result = resolveFormatAndType({
+        format: 'ldp_vc',
+        credential_definition: {
+          type: ['VerifiableCredential', 'UniversityDegreeCredential'],
+        },
+      });
+
+      expect(result).toEqual({
+        format: 'ldp_vc',
+        credentialTypes: 'UniversityDegreeCredential',
+      });
+    });
+
+    it('falls back to the scope suffix when credential_definition is missing', () => {
+      const result = resolveFormatAndType({
+        format: 'ldp_vc',
+        scope: 'ldp_vc:LegacyCredential',
+      });
+
+      expect(result).toEqual({
+        format: 'ldp_vc',
+        credentialTypes: 'LegacyCredential',
+      });
+    });
+
+    it('returns undefined credentialTypes when nothing identifies the type', () => {
+      const result = resolveFormatAndType({format: 'jwt_vc_json'});
+
+      expect(result).toEqual({
+        format: 'jwt_vc_json',
+        credentialTypes: undefined,
+      });
+    });
+
+    it('derives format from a known scope prefix when format is missing', () => {
+      const result = resolveFormatAndType({
+        scope: 'vc+sd-jwt:MyCredential',
+        vct: 'MyCredential',
+      });
+
+      expect(result).toEqual({
+        format: 'vc+sd-jwt',
+        credentialTypes: 'MyCredential',
+      });
+    });
+
+    it('defaults to ldp_vc when format and a recognizable scope prefix are missing', () => {
+      const result = resolveFormatAndType({
+        scope: 'MyCredential',
+        credential_definition: {
+          type: ['VerifiableCredential', 'MyCredential'],
+        },
+      });
+
+      expect(result).toEqual({
+        format: 'ldp_vc',
+        credentialTypes: 'MyCredential',
+      });
+    });
+  });
+});

package/src/services/credential/pex-helpers.js

@@ -7,8 +7,8 @@ export const MAX_DATE_PLACEHOLDER = 884541351600000;
 export const MIN_DATE_PLACEHOLDER = -17592186044415;
 export const MAX_INTEGER = Number.MAX_SAFE_INTEGER;
 export const MIN_INTEGER = Number.MIN_SAFE_INTEGER;
-export const MAX_NUMBER = Number.MAX_SAFE_INTEGER;
-export const MIN_NUMBER = Number.MIN_SAFE_INTEGER;
+export const MAX_NUMBER = 100 ** 5;
+export const MIN_NUMBER = -(100 ** 5);
 
 /*
   PEX Filter rules:
@@ -283,35 +283,81 @@ export const shouldSkipAttribute = attributeName =>
   attributesToSkip.some(regex => regex.test(attributeName));
 
 export function getPexRequiredAttributes(pexRequest, selectedCredentials = []) {
-  return pexRequest.input_descriptors
-    .map((inputDescriptor, index) => {
-      return inputDescriptor.constraints.fields
-        .filter(field => {
-          if (field.filter || field.optional) {
-            return false;
-          }
+  // Match each credential to its best-fitting descriptor by checking which
+  // descriptor's fields exist in the credential, rather than relying on
+  // positional index. This allows credentials to be provided in any order.
+  return selectedCredentials.map((credential, credIdx) => {
+    const matchedDescriptor = findMatchingDescriptor(
+      pexRequest.input_descriptors,
+      credential,
+    );
+    if (!matchedDescriptor) {
+      return [];
+    }
+    return matchedDescriptor.constraints.fields
+      .filter(field => {
+        if (field.filter || field.optional) {
+          return false;
+        }
 
-          try {
-            if (!selectedCredentials[index]) {
-              return false;
-            }
-
-            const paths = Array.isArray(field.path)
-              ? field.path.flatMap(singlePath =>
-                  JSONPath.paths(selectedCredentials[index], singlePath),
-                )
-              : JSONPath.paths(selectedCredentials[index], field.path);
-
-            return paths.length !== 0;
-          } catch (error) {
-            console.error(`Error in field ${field.path}: ${error.message}`);
-            return false;
+        try {
+          const paths = Array.isArray(field.path)
+            ? field.path.flatMap(singlePath =>
+                JSONPath.paths(credential, singlePath),
+              )
+            : JSONPath.paths(credential, field.path);
+
+          return paths.length !== 0;
+        } catch (error) {
+          console.error(`Error in field ${field.path}: ${error.message}`);
+          return false;
+        }
+      })
+      .map(field =>
+        getAttributeName({field, selectedCredentials, index: credIdx}),
+      )
+      .filter(attributeName => {
+        return !shouldSkipAttribute(attributeName);
+      });
+  });
+}
+
+export function findMatchingDescriptor(inputDescriptors, credential) {
+  let bestMatch = null;
+  let bestScore = -1;
+
+  for (const descriptor of inputDescriptors) {
+    const fields = descriptor.constraints?.fields || [];
+    if (fields.length === 0) {
+      continue;
+    }
+
+    let matched = 0;
+    for (const field of fields) {
+      try {
+        const fieldPaths = Array.isArray(field.path)
+          ? field.path
+          : [field.path];
+        for (const p of fieldPaths) {
+          const paths = JSONPath.paths(credential, p);
+          if (paths.length > 0) {
+            matched++;
+            break;
           }
-        })
-        .map(field => getAttributeName({field, selectedCredentials, index}))
-        .filter(attributeName => {
-          return !shouldSkipAttribute(attributeName);
-        });
-    })
-    .filter(requiredAttributes => requiredAttributes.length > 0);
+        }
+      } catch {
+        // ignore
+      }
+    }
+
+    // Use match ratio so descriptors where all fields match score higher
+    // than descriptors where only generic fields (e.g. issuer) match
+    const score = matched / fields.length;
+    if (score > bestScore) {
+      bestScore = score;
+      bestMatch = descriptor;
+    }
+  }
+
+  return bestMatch;
 }

package/src/services/credential/pex-helpers.test.js

@@ -1,4 +1,4 @@
-import {getPexRequiredAttributes, pexToBounds} from './pex-helpers';
+import {getPexRequiredAttributes, pexToBounds, MAX_NUMBER} from './pex-helpers';
 
 describe('pex helpers', () => {
   describe('getPexRequiredAttributes', () => {
@@ -253,7 +253,7 @@ describe('pex helpers', () => {
           },
         ],
       );
-      expect(result).toEqual([]);
+      expect(result).toEqual([[]]);
     });
   });
 
@@ -302,7 +302,7 @@ describe('pex helpers', () => {
           {
             attributeName: 'credentialSubject.age',
             min: 0,
-            max: Number.MAX_SAFE_INTEGER,
+            max: MAX_NUMBER,
             proofRequestMax: undefined,
             proofRequestMin: 0,
             format: undefined,
@@ -357,7 +357,7 @@ describe('pex helpers', () => {
           {
             attributeName: 'credentialSubject.age',
             min: 0,
-            max: Number.MAX_SAFE_INTEGER,
+            max: MAX_NUMBER,
             proofRequestMax: undefined,
             proofRequestMin: 0,
             format: undefined,