@idos-network/issuer 1.0.0-rc.1.0

package/src/assets/v1.json

@@ -0,0 +1,273 @@
+{
+  "@context": {
+    "@version": 1.1,
+    "@protected": true,
+
+    "id": "@id",
+    "type": "@type",
+
+    "VerifiableCredential": {
+      "@id": "https://www.w3.org/2018/credentials#VerifiableCredential",
+      "@context": {
+        "@version": 1.1,
+        "@protected": true,
+
+        "id": "@id",
+        "type": "@type",
+
+        "cred": "https://www.w3.org/2018/credentials#",
+        "sec": "https://w3id.org/security#",
+        "xsd": "http://www.w3.org/2001/XMLSchema#",
+
+        "credentialSchema": {
+          "@id": "cred:credentialSchema",
+          "@type": "@id",
+          "@context": {
+            "@version": 1.1,
+            "@protected": true,
+
+            "id": "@id",
+            "type": "@type",
+
+            "cred": "https://www.w3.org/2018/credentials#",
+
+            "JsonSchemaValidator2018": "cred:JsonSchemaValidator2018"
+          }
+        },
+        "credentialStatus": { "@id": "cred:credentialStatus", "@type": "@id" },
+        "credentialSubject": { "@id": "cred:credentialSubject", "@type": "@id" },
+        "evidence": { "@id": "cred:evidence", "@type": "@id" },
+        "expirationDate": { "@id": "cred:expirationDate", "@type": "xsd:dateTime" },
+        "holder": { "@id": "cred:holder", "@type": "@id" },
+        "issued": { "@id": "cred:issued", "@type": "xsd:dateTime" },
+        "issuer": { "@id": "cred:issuer", "@type": "@id" },
+        "issuanceDate": { "@id": "cred:issuanceDate", "@type": "xsd:dateTime" },
+        "proof": { "@id": "sec:proof", "@type": "@id", "@container": "@graph" },
+        "refreshService": {
+          "@id": "cred:refreshService",
+          "@type": "@id",
+          "@context": {
+            "@version": 1.1,
+            "@protected": true,
+
+            "id": "@id",
+            "type": "@type",
+
+            "cred": "https://www.w3.org/2018/credentials#",
+
+            "ManualRefreshService2018": "cred:ManualRefreshService2018"
+          }
+        },
+        "termsOfUse": { "@id": "cred:termsOfUse", "@type": "@id" },
+        "validFrom": { "@id": "cred:validFrom", "@type": "xsd:dateTime" },
+        "validUntil": { "@id": "cred:validUntil", "@type": "xsd:dateTime" }
+      }
+    },
+
+    "VerifiablePresentation": {
+      "@id": "https://www.w3.org/2018/credentials#VerifiablePresentation",
+      "@context": {
+        "@version": 1.1,
+        "@protected": true,
+
+        "id": "@id",
+        "type": "@type",
+
+        "cred": "https://www.w3.org/2018/credentials#",
+        "sec": "https://w3id.org/security#",
+
+        "holder": { "@id": "cred:holder", "@type": "@id" },
+        "proof": { "@id": "sec:proof", "@type": "@id", "@container": "@graph" },
+        "verifiableCredential": {
+          "@id": "cred:verifiableCredential",
+          "@type": "@id",
+          "@container": "@graph"
+        }
+      }
+    },
+
+    "EcdsaSecp256k1Signature2019": {
+      "@id": "https://w3id.org/security#EcdsaSecp256k1Signature2019",
+      "@context": {
+        "@version": 1.1,
+        "@protected": true,
+
+        "id": "@id",
+        "type": "@type",
+
+        "sec": "https://w3id.org/security#",
+        "xsd": "http://www.w3.org/2001/XMLSchema#",
+
+        "challenge": "sec:challenge",
+        "created": { "@id": "http://purl.org/dc/terms/created", "@type": "xsd:dateTime" },
+        "domain": "sec:domain",
+        "expires": { "@id": "sec:expiration", "@type": "xsd:dateTime" },
+        "jws": "sec:jws",
+        "nonce": "sec:nonce",
+        "proofPurpose": {
+          "@id": "sec:proofPurpose",
+          "@type": "@vocab",
+          "@context": {
+            "@version": 1.1,
+            "@protected": true,
+
+            "id": "@id",
+            "type": "@type",
+
+            "sec": "https://w3id.org/security#",
+
+            "assertionMethod": {
+              "@id": "sec:assertionMethod",
+              "@type": "@id",
+              "@container": "@set"
+            },
+            "authentication": {
+              "@id": "sec:authenticationMethod",
+              "@type": "@id",
+              "@container": "@set"
+            }
+          }
+        },
+        "proofValue": "sec:proofValue",
+        "verificationMethod": { "@id": "sec:verificationMethod", "@type": "@id" }
+      }
+    },
+
+    "EcdsaSecp256r1Signature2019": {
+      "@id": "https://w3id.org/security#EcdsaSecp256r1Signature2019",
+      "@context": {
+        "@version": 1.1,
+        "@protected": true,
+
+        "id": "@id",
+        "type": "@type",
+
+        "sec": "https://w3id.org/security#",
+        "xsd": "http://www.w3.org/2001/XMLSchema#",
+
+        "challenge": "sec:challenge",
+        "created": { "@id": "http://purl.org/dc/terms/created", "@type": "xsd:dateTime" },
+        "domain": "sec:domain",
+        "expires": { "@id": "sec:expiration", "@type": "xsd:dateTime" },
+        "jws": "sec:jws",
+        "nonce": "sec:nonce",
+        "proofPurpose": {
+          "@id": "sec:proofPurpose",
+          "@type": "@vocab",
+          "@context": {
+            "@version": 1.1,
+            "@protected": true,
+
+            "id": "@id",
+            "type": "@type",
+
+            "sec": "https://w3id.org/security#",
+
+            "assertionMethod": {
+              "@id": "sec:assertionMethod",
+              "@type": "@id",
+              "@container": "@set"
+            },
+            "authentication": {
+              "@id": "sec:authenticationMethod",
+              "@type": "@id",
+              "@container": "@set"
+            }
+          }
+        },
+        "proofValue": "sec:proofValue",
+        "verificationMethod": { "@id": "sec:verificationMethod", "@type": "@id" }
+      }
+    },
+
+    "Ed25519Signature2018": {
+      "@id": "https://w3id.org/security#Ed25519Signature2018",
+      "@context": {
+        "@version": 1.1,
+        "@protected": true,
+
+        "id": "@id",
+        "type": "@type",
+
+        "sec": "https://w3id.org/security#",
+        "xsd": "http://www.w3.org/2001/XMLSchema#",
+
+        "challenge": "sec:challenge",
+        "created": { "@id": "http://purl.org/dc/terms/created", "@type": "xsd:dateTime" },
+        "domain": "sec:domain",
+        "expires": { "@id": "sec:expiration", "@type": "xsd:dateTime" },
+        "jws": "sec:jws",
+        "nonce": "sec:nonce",
+        "proofPurpose": {
+          "@id": "sec:proofPurpose",
+          "@type": "@vocab",
+          "@context": {
+            "@version": 1.1,
+            "@protected": true,
+
+            "id": "@id",
+            "type": "@type",
+
+            "sec": "https://w3id.org/security#",
+
+            "assertionMethod": {
+              "@id": "sec:assertionMethod",
+              "@type": "@id",
+              "@container": "@set"
+            },
+            "authentication": {
+              "@id": "sec:authenticationMethod",
+              "@type": "@id",
+              "@container": "@set"
+            }
+          }
+        },
+        "proofValue": "sec:proofValue",
+        "verificationMethod": { "@id": "sec:verificationMethod", "@type": "@id" }
+      }
+    },
+
+    "RsaSignature2018": {
+      "@id": "https://w3id.org/security#RsaSignature2018",
+      "@context": {
+        "@version": 1.1,
+        "@protected": true,
+
+        "challenge": "sec:challenge",
+        "created": { "@id": "http://purl.org/dc/terms/created", "@type": "xsd:dateTime" },
+        "domain": "sec:domain",
+        "expires": { "@id": "sec:expiration", "@type": "xsd:dateTime" },
+        "jws": "sec:jws",
+        "nonce": "sec:nonce",
+        "proofPurpose": {
+          "@id": "sec:proofPurpose",
+          "@type": "@vocab",
+          "@context": {
+            "@version": 1.1,
+            "@protected": true,
+
+            "id": "@id",
+            "type": "@type",
+
+            "sec": "https://w3id.org/security#",
+
+            "assertionMethod": {
+              "@id": "sec:assertionMethod",
+              "@type": "@id",
+              "@container": "@set"
+            },
+            "authentication": {
+              "@id": "sec:authenticationMethod",
+              "@type": "@id",
+              "@container": "@set"
+            }
+          }
+        },
+        "proofValue": "sec:proofValue",
+        "verificationMethod": { "@id": "sec:verificationMethod", "@type": "@id" }
+      }
+    },
+
+    "proof": { "@id": "https://w3id.org/security#proof", "@type": "@id", "@container": "@graph" }
+  }
+}

package/src/index.ts

@@ -0,0 +1,155 @@
+import {
+  type EditCredentialAsIssuerParams,
+  createNodeKwilClient,
+  createServerKwilSigner,
+} from "@idos-network/core";
+import type {
+  idOSCredential,
+  idOSGrant,
+  idOSUser,
+  idOSUserAttribute,
+  idOSWallet,
+} from "@idos-network/core/types";
+import type { SignKeyPair } from "tweetnacl";
+import {
+  CredentialService,
+  type DelegatedWriteGrantBaseParams,
+  type DelegatedWriteGrantParams,
+} from "./services/credential.service";
+import {
+  type CredentialFields,
+  type CredentialSubject,
+  CredentialsBuilderService,
+  type CredentialsIssuerConfig,
+} from "./services/credentials-builder.service";
+import { type CreateAccessGrantFromDAGParams, GrantService } from "./services/grant.service";
+import {
+  type CreateProfileReqParams,
+  type CreateWalletReqParams,
+  type UpsertWalletReqParams,
+  UserService,
+} from "./services/user.service";
+
+type CreateIssuerParams = {
+  chainId?: string;
+  nodeUrl: string;
+  signingKeyPair: SignKeyPair;
+  encryptionSecretKey: Uint8Array;
+};
+
+export class idOSIssuer {
+  readonly #credentialService: CredentialService;
+  readonly #grantService: GrantService;
+  readonly #userService: UserService;
+  readonly #credentialsBuilderService: CredentialsBuilderService;
+
+  static async init(params: CreateIssuerParams): Promise<idOSIssuer> {
+    const kwilClient = await createNodeKwilClient({
+      nodeUrl: params.nodeUrl,
+      chainId: params.chainId,
+    });
+
+    const [signer] = createServerKwilSigner(params.signingKeyPair);
+    kwilClient.setSigner(signer);
+
+    const credentialService = new CredentialService(
+      kwilClient,
+      params.signingKeyPair,
+      params.encryptionSecretKey,
+    );
+
+    const grantService = new GrantService(kwilClient, params.encryptionSecretKey);
+    const userService = new UserService(kwilClient);
+    const credentialsBuilderService = new CredentialsBuilderService();
+
+    return new idOSIssuer(credentialService, grantService, userService, credentialsBuilderService);
+  }
+
+  private constructor(
+    credentialService: CredentialService,
+    grantService: GrantService,
+    userService: UserService,
+    credentialsBuilderService: CredentialsBuilderService,
+  ) {
+    this.#credentialService = credentialService;
+    this.#grantService = grantService;
+    this.#userService = userService;
+    this.#credentialsBuilderService = credentialsBuilderService;
+  }
+
+  // User Service facade methods
+  async hasProfile(userAddress: string): Promise<boolean> {
+    return this.#userService.hasProfile(userAddress);
+  }
+
+  async createUserProfile(params: CreateProfileReqParams): Promise<idOSUser> {
+    return this.#userService.createUserProfile(params);
+  }
+
+  async upsertWalletAsInserter(params: UpsertWalletReqParams): Promise<idOSWallet> {
+    return this.#userService.upsertWalletAsInserter(params);
+  }
+
+  async createUser(
+    user: CreateProfileReqParams,
+    wallet: CreateWalletReqParams,
+  ): Promise<[idOSUser, idOSWallet]> {
+    return this.#userService.createUser(user, wallet);
+  }
+
+  async createCredentialByDelegatedWriteGrant(
+    credentialParams: DelegatedWriteGrantBaseParams,
+    delegatedWriteGrant: DelegatedWriteGrantParams,
+    consumerEncryptionPublicKey?: Uint8Array,
+  ): Promise<{
+    originalCredential: Omit<idOSCredential, "user_id">;
+    copyCredential: Omit<idOSCredential, "user_id">;
+  }> {
+    return this.#credentialService.createCredentialByDelegatedWriteGrant(
+      credentialParams,
+      delegatedWriteGrant,
+      consumerEncryptionPublicKey,
+    );
+  }
+
+  async editCredentialAsIssuer(
+    publicNotesId: string,
+    publicNotes: string,
+  ): Promise<EditCredentialAsIssuerParams | null> {
+    return this.#credentialService.editCredentialAsIssuer(publicNotesId, publicNotes);
+  }
+
+  async getCredentialIdByContentHash(contentHash: string): Promise<string | null> {
+    return this.#credentialService.getCredentialIdByContentHash(contentHash);
+  }
+
+  async getSharedCredential(id: string): Promise<idOSCredential | null> {
+    return this.#credentialService.getSharedCredential(id);
+  }
+
+  async createAccessGrantFromDAG(
+    params: CreateAccessGrantFromDAGParams,
+  ): Promise<CreateAccessGrantFromDAGParams | null> {
+    return this.#grantService.createAccessGrantFromDAG(
+      params,
+      (contentHash: string) => this.getCredentialIdByContentHash(contentHash),
+      (id: string) => this.getSharedCredential(id),
+    );
+  }
+
+  async buildCredentials(
+    fields: CredentialFields,
+    subject: CredentialSubject,
+    issuer: CredentialsIssuerConfig,
+    // biome-ignore lint/suspicious/noExplicitAny: Using `any` to avoid type errors.
+  ): Promise<any> {
+    return this.#credentialsBuilderService.buildCredentials(fields, subject, issuer);
+  }
+
+  // biome-ignore lint/suspicious/noExplicitAny: Using `any` to avoid type errors.
+  buildDocumentLoader(): any {
+    return this.#credentialsBuilderService.buildDocumentLoader();
+  }
+}
+
+export type { idOSCredential, idOSGrant, idOSUser, idOSUserAttribute, idOSWallet };

package/src/services/credential.service.ts

@@ -0,0 +1,207 @@
+import {
+  type KwilActionClient,
+  base64Decode,
+  base64Encode,
+  encryptContent,
+  hexEncode,
+  hexEncodeSha256Hash,
+  utf8Encode,
+} from "@idos-network/core";
+import {
+  type CreateCredentialByDelegatedWriteGrantParams,
+  type EditCredentialAsIssuerParams,
+  createCredentialByDelegatedWriteGrant,
+  editCredentialAsIssuer,
+  getCredentialIdByContentHash,
+  getSharedCredential,
+} from "@idos-network/core/kwil-actions";
+import type { idOSCredential } from "@idos-network/core/types";
+import invariant from "tiny-invariant";
+import nacl from "tweetnacl";
+
+type InsertableIDOSCredential = Omit<idOSCredential, "id" | "original_id"> & {
+  id?: idOSCredential["id"];
+  content_hash?: string;
+  public_notes_signature: string;
+  broader_signature: string;
+};
+
+type BuildInsertableIDOSCredentialArgs = {
+  userId: string;
+  publicNotes: string;
+  plaintextContent: Uint8Array;
+  recipientEncryptionPublicKey: Uint8Array;
+};
+
+export type BaseCredentialParams = {
+  id?: string;
+  userId: string;
+  publicNotes: string;
+  plaintextContent: Uint8Array;
+  recipientEncryptionPublicKey: Uint8Array;
+};
+
+export type DelegatedWriteGrantBaseParams = Omit<BaseCredentialParams, "userId">;
+
+export type DelegatedWriteGrantParams = {
+  id: string;
+  ownerWalletIdentifier: string;
+  consumerWalletIdentifier: string;
+  issuerPublicKey: string;
+  accessGrantTimelock: string;
+  notUsableBefore: string;
+  notUsableAfter: string;
+  signature: string;
+};
+
+export class CredentialService {
+  readonly #kwilClient: KwilActionClient;
+  readonly #signingKeyPair: nacl.SignKeyPair;
+  readonly #encryptionSecretKey: Uint8Array;
+
+  constructor(
+    kwilClient: KwilActionClient,
+    signingKeyPair: nacl.SignKeyPair,
+    encryptionSecretKey: Uint8Array,
+  ) {
+    this.#kwilClient = kwilClient;
+    this.#signingKeyPair = signingKeyPair;
+    this.#encryptionSecretKey = encryptionSecretKey;
+  }
+
+  #buildInsertableIDOSCredential(args: BuildInsertableIDOSCredentialArgs): InsertableIDOSCredential;
+
+  #buildInsertableIDOSCredential(
+    args: Omit<BuildInsertableIDOSCredentialArgs, "userId">,
+  ): Omit<InsertableIDOSCredential, "user_id">;
+
+  #buildInsertableIDOSCredential({
+    userId,
+    publicNotes,
+    plaintextContent,
+    recipientEncryptionPublicKey,
+  }: Omit<BuildInsertableIDOSCredentialArgs, "userId"> & { userId?: string }):
+    | InsertableIDOSCredential
+    | Omit<InsertableIDOSCredential, "user_id"> {
+    const ephemeralKeyPair = nacl.box.keyPair();
+    const content = encryptContent(
+      plaintextContent,
+      recipientEncryptionPublicKey,
+      ephemeralKeyPair.secretKey,
+    );
+
+    const public_notes_signature = base64Encode(
+      nacl.sign.detached(utf8Encode(publicNotes), this.#signingKeyPair.secretKey),
+    );
+
+    return {
+      user_id: userId,
+      content: base64Encode(content),
+      public_notes: publicNotes,
+      public_notes_signature,
+
+      broader_signature: base64Encode(
+        nacl.sign.detached(
+          Uint8Array.from([...base64Decode(public_notes_signature), ...content]),
+          this.#signingKeyPair.secretKey,
+        ),
+      ),
+
+      issuer_auth_public_key: hexEncode(this.#signingKeyPair.publicKey, true),
+      encryptor_public_key: base64Encode(ephemeralKeyPair.publicKey),
+    };
+  }
+
+  #ensureEntityId<T extends { id?: string }>(entity: T): T & { id: string } {
+    if (!entity.id) {
+      (entity as T & { id: string }).id = crypto.randomUUID();
+    }
+    return entity as T & { id: string };
+  }
+
+  async createCredentialByDelegatedWriteGrant(
+    credentialParams: DelegatedWriteGrantBaseParams,
+    delegatedWriteGrant: DelegatedWriteGrantParams,
+    consumerEncryptionPublicKey?: Uint8Array,
+  ): Promise<{
+    originalCredential: Omit<idOSCredential, "user_id">;
+    copyCredential: Omit<idOSCredential, "user_id">;
+  }> {
+    let recipientPublicKey = consumerEncryptionPublicKey;
+    if (!recipientPublicKey) {
+      // If we're not explicitly given a consumer enc pub key, we're assuming that the issuer is creating a copy
+      // for themselves. So, we derive the recipient encryption public key from the issuer's encryption secret key.
+      recipientPublicKey = nacl.box.keyPair.fromSecretKey(this.#encryptionSecretKey).publicKey;
+    }
+
+    const originalCredential = this.#ensureEntityId(
+      this.#buildInsertableIDOSCredential(credentialParams),
+    );
+
+    const contentHash = hexEncodeSha256Hash(credentialParams.plaintextContent);
+
+    const copyCredential = this.#ensureEntityId(
+      this.#buildInsertableIDOSCredential({
+        publicNotes: "",
+        plaintextContent: credentialParams.plaintextContent,
+        recipientEncryptionPublicKey: recipientPublicKey,
+      }),
+    );
+
+    const payload: CreateCredentialByDelegatedWriteGrantParams = {
+      issuer_auth_public_key: originalCredential.issuer_auth_public_key,
+      original_encryptor_public_key: originalCredential.encryptor_public_key,
+      original_credential_id: originalCredential.id,
+      original_content: originalCredential.content,
+      original_public_notes: originalCredential.public_notes,
+      original_public_notes_signature: originalCredential.public_notes_signature,
+      original_broader_signature: originalCredential.broader_signature,
+      copy_encryptor_public_key: copyCredential.encryptor_public_key,
+      copy_credential_id: copyCredential.id,
+      copy_content: copyCredential.content,
+      copy_public_notes_signature: copyCredential.public_notes_signature,
+      copy_broader_signature: copyCredential.broader_signature,
+      content_hash: contentHash,
+      dwg_owner: delegatedWriteGrant.ownerWalletIdentifier,
+      dwg_grantee: delegatedWriteGrant.consumerWalletIdentifier,
+      dwg_issuer_public_key: delegatedWriteGrant.issuerPublicKey,
+      dwg_id: delegatedWriteGrant.id,
+      dwg_access_grant_timelock: delegatedWriteGrant.accessGrantTimelock,
+      dwg_not_before: delegatedWriteGrant.notUsableBefore,
+      dwg_not_after: delegatedWriteGrant.notUsableAfter,
+      dwg_signature: delegatedWriteGrant.signature,
+    };
+
+    await createCredentialByDelegatedWriteGrant(this.#kwilClient, payload);
+
+    return { originalCredential, copyCredential };
+  }
+
+  async editCredentialAsIssuer(
+    publicNotesId: string,
+    publicNotes: string,
+  ): Promise<EditCredentialAsIssuerParams | null> {
+    const payload = {
+      public_notes_id: publicNotesId,
+      public_notes: publicNotes,
+    };
+
+    const result = await editCredentialAsIssuer(this.#kwilClient, payload);
+
+    return result ?? null;
+  }
+
+  async getCredentialIdByContentHash(contentHash: string): Promise<string | null> {
+    const id = await getCredentialIdByContentHash(this.#kwilClient, contentHash);
+
+    invariant(id, "Required `idOSCredential` id not found");
+
+    return id;
+  }
+
+  async getSharedCredential(id: string): Promise<idOSCredential | null> {
+    const result = await getSharedCredential(this.#kwilClient, id);
+
+    return result ?? null;
+  }
+}