@idos-network/issuer 1.0.0-rc.1.0

package/src/services/credentials-builder.service.ts

@@ -0,0 +1,203 @@
+import { Ed25519Signature2020 } from "@digitalbazaar/ed25519-signature-2020";
+import { Ed25519VerificationKey2020 } from "@digitalbazaar/ed25519-verification-key-2020";
+import * as vc from "@digitalbazaar/vc";
+import * as base85 from "base85";
+import { JsonLdDocumentLoader } from "jsonld-document-loader";
+import ed25519Signature2020V1 from "../assets/ed25519-signature-2020-v1.json";
+import idosCredentialSubjectV1 from "../assets/idos-credential-subject-v1.json";
+import idosCredentialsV1 from "../assets/idos-credentials-v1.json";
+import v1 from "../assets/v1.json";
+
+export interface CredentialFields {
+  id: string;
+
+  /* Level of KYC verification performed (e.g., basic, intermediate, advanced). */
+  level: string;
+
+  /* @default Date.now() */
+  issued?: Date;
+
+  /* Date the credential was approved. */
+  approvedAt?: Date;
+
+  /* Date the credential was revoked. */
+  expirationDate?: Date;
+}
+
+export interface CredentialResidentialAddress {
+  /* Street address. */
+  street: string;
+
+  /* House number. */
+  houseNumber?: string;
+
+  /* Additional address information (e.g., apartment number). */
+  additionalAddressInfo?: string;
+
+  /* Locality (e.g., city, town). */
+  city: string;
+
+  /* Postal code. */
+  postalCode: string;
+
+  /* Country. */
+  country: string;
+}
+
+export interface CredentialSubject {
+  /* ID(unique credential)	Unique identifier for the credential itself. */
+  id: string;
+
+  /* Given name of the individual. */
+  firstName: string;
+
+  /* Surname of the individual. */
+  familyName: string;
+
+  /* Family name at birth (e.g., maiden name). */
+  maidenName?: string;
+
+  /* Unique identifier issued by a government authority (e.g., SSN, Tax ID). */
+  governmentId?: string;
+
+  /* Type of government identifier (e.g., Social Security Number, Tax ID, etc.). */
+  governmentIdType?: string;
+
+  /* Date of birth of the individual. */
+  dateOfBirth: Date;
+
+  /* City and state/province of birth. */
+  placeOfBirth: string;
+
+  /* Country that issued the identity document. */
+  idDocumentCountry: string;
+
+  /* ID Document Number	Unique number on the identity document. */
+  idDocumentNumber: string;
+
+  /* ID Document Type	Type of identity document(e.g., Passport, Driver's License, National ID). */
+  idDocumentType: string;
+
+  /* ID Document Date of Issue	Date the identity document was issued. */
+  idDocumentDateOfIssue: Date;
+
+  /* ID Document Date of Expiry	Expiration date of the identity document - if applicable. */
+  idDocumentDateOfExpiry?: Date;
+
+  /* ID Document Front File	File or URL representing the front of the identity document. */
+  idDocumentFrontFile: Buffer;
+
+  /* ID Document Back File	File or URL representing the back of the identity document - if applicable. */
+  idDocumentBackFile?: Buffer;
+
+  /* (ID Document) Selfie File	File or URL of a selfie with the identity document for verification purposes. */
+  selfieFile: Buffer;
+
+  /* Residential Address	Full residential address of the individual - if applicable. */
+  residentialAddress?: CredentialResidentialAddress;
+
+  /* Residential Address Proof Category	Type of document provided to verify the address(e.g., utility bill, bank statement). */
+  residentialAddressProofCategory?: string;
+
+  /* Residential Address Proof Date Of Issue	Date the address proof document was issued. */
+  residentialAddressProofDateOfIssue?: Date;
+
+  /* Residential Address Proof File	File or URL of the document provided as address proof. */
+  residentialAddressProofFile?: Buffer;
+}
+
+export interface CredentialsIssuerConfig {
+  /* Issuers id */
+  id: string;
+
+  /* Issuer of the credential (URL). */
+  controller: string;
+
+  /* Issuer's private key in multibase format. */
+  privateKeyMultibase: string;
+
+  /* Issuer's public key in multibase format. */
+  publicKeyMultibase: string;
+}
+
+const CONTEXT_V1 = "https://www.w3.org/2018/credentials/v1";
+const CONTEXT_IDOS_CREDENTIALS_V1 =
+  "https://raw.githubusercontent.com/idos-network/idos-sdk-js/1bc3503f5302a7e42777076445d5b05fec8db429/packages/issuer-sdk-js/assets/idos-credentials-v1.json";
+const CONTEXT_IDOS_CREDENTIALS_V1_SUBJECT =
+  "https://raw.githubusercontent.com/idos-network/idos-sdk-js/1bc3503f5302a7e42777076445d5b05fec8db429/packages/issuer-sdk-js/assets/idos-credential-subject-v1.json";
+const CONTEXT_ED25519_SIGNATURE_2020_V1 = "https://w3id.org/security/suites/ed25519-2020/v1";
+
+export class CredentialsBuilderService {
+  private fileToBase85(file: Buffer) {
+    return base85.encode(file, "ascii85");
+  }
+
+  private capitalizeFirstLetter(str: string) {
+    return str[0].toUpperCase() + str.slice(1);
+  }
+
+  private convertValues<
+    K extends CredentialFields | CredentialSubject | CredentialResidentialAddress,
+  >(fields: K, prefix?: string): Record<string, unknown> {
+    const acc: Record<string, unknown> = {};
+
+    for (const key in fields) {
+      if (Object.hasOwn(fields, key)) {
+        const value = fields[key];
+        const name = prefix ? `${prefix}${this.capitalizeFirstLetter(key)}` : key;
+        if (value instanceof Date) {
+          acc[name] = value.toISOString();
+        } else if (value instanceof Buffer) {
+          // Convert file to base85
+          acc[name] = this.fileToBase85(value);
+        } else {
+          acc[name] = value;
+        }
+      }
+    }
+
+    return acc;
+  }
+
+  // biome-ignore lint/suspicious/noExplicitAny: Using `any` to avoid type errors.
+  buildDocumentLoader(): any {
+    const loader = new JsonLdDocumentLoader();
+    loader.addStatic(CONTEXT_V1, v1);
+    loader.addStatic(CONTEXT_IDOS_CREDENTIALS_V1, idosCredentialsV1);
+    loader.addStatic(CONTEXT_IDOS_CREDENTIALS_V1_SUBJECT, idosCredentialSubjectV1);
+    loader.addStatic(CONTEXT_ED25519_SIGNATURE_2020_V1, ed25519Signature2020V1);
+
+    return loader.build();
+  }
+
+  async buildCredentials(
+    fields: CredentialFields,
+    subject: CredentialSubject,
+    issuer: CredentialsIssuerConfig,
+    // biome-ignore lint/suspicious/noExplicitAny: Using `any` to avoid type errors.
+  ): Promise<any> {
+    const { residentialAddress, ...subjectData } = subject;
+
+    // Create credentials container
+    const credential = {
+      "@context": [CONTEXT_V1, CONTEXT_IDOS_CREDENTIALS_V1, CONTEXT_ED25519_SIGNATURE_2020_V1],
+      type: ["VerifiableCredential"],
+      issuer: issuer.controller,
+      ...this.convertValues(fields),
+      credentialSubject: {
+        "@context": CONTEXT_IDOS_CREDENTIALS_V1_SUBJECT,
+        ...this.convertValues(subjectData),
+        ...(residentialAddress ? this.convertValues(residentialAddress, "residentialAddress") : {}),
+      },
+    };
+
+    const key = await Ed25519VerificationKey2020.from({
+      ...issuer,
+      type: "Ed25519VerificationKey2020",
+    });
+    const suite = new Ed25519Signature2020({ key });
+    const documentLoader = this.buildDocumentLoader();
+
+    return vc.issue({ credential, suite, documentLoader });
+  }
+}

package/src/services/credentials-builder.test.ts

@@ -0,0 +1,100 @@
+import { Ed25519Signature2020 } from "@digitalbazaar/ed25519-signature-2020";
+import { Ed25519VerificationKey2020 } from "@digitalbazaar/ed25519-verification-key-2020";
+import * as vc from "@digitalbazaar/vc";
+import { describe, expect, it } from "vitest";
+import { CredentialsBuilderService } from "./credentials-builder.service";
+
+describe("buildVerifiableCredentials", () => {
+  it("should create a verifiable vc", async () => {
+    const id = "z6MkszZtxCmA2Ce4vUV132PCuLQmwnaDD5mw2L23fGNnsiX3";
+    const issuer = "https://vc-issuers.cool.id/idos";
+
+    const builder = new CredentialsBuilderService();
+
+    const data = await builder.buildCredentials(
+      {
+        id: `${issuer}/credentials/${id}`,
+        level: "human",
+        issued: new Date("2022-01-01"),
+        approvedAt: new Date("2022-01-01"),
+        expirationDate: new Date("2030-01-01"),
+      },
+      {
+        id: `uuid:${id}`,
+        firstName: "John",
+        familyName: "Lennon",
+        governmentIdType: "SSN",
+        governmentId: "123-45-6789",
+        dateOfBirth: new Date("1980-01-01"),
+        placeOfBirth: "New York, NY",
+        idDocumentCountry: "US",
+        idDocumentNumber: "123456789",
+        idDocumentType: "Passport",
+        idDocumentDateOfIssue: new Date("2022-01-01"),
+        idDocumentDateOfExpiry: new Date("2025-01-01"),
+        idDocumentFrontFile: Buffer.from("Front of ID document"),
+        idDocumentBackFile: Buffer.from("Back of ID document"),
+        selfieFile: Buffer.from("Selfie"),
+        residentialAddress: {
+          street: "Main St",
+          houseNumber: "123",
+          additionalAddressInfo: "Apt 1",
+          city: "New York",
+          postalCode: "10001",
+          country: "US",
+        },
+        residentialAddressProofCategory: "Utility Bill",
+        residentialAddressProofDateOfIssue: new Date("2022-01-01"),
+        residentialAddressProofFile: Buffer.from("Proof of address"),
+      },
+      {
+        id: `${issuer}/keys/1`,
+        controller: `${issuer}/issuer/1`,
+        publicKeyMultibase: "z6MkrQDe6W8yspNAZyVXw9Rt9s8FuP61y9XRnRhA2kbQ1Jyj",
+        privateKeyMultibase:
+          "zrv4XwF1S61SJuUjQpaAPCoM7QJiw8J3EDFPQ4AGN5D3r3iaR8mcSeJZoYjSWe6PqgSfwtC3KPvAvHQ7QxGeNp9rZ2m",
+      },
+    );
+
+    // Check if residential address is properly prefixed
+    expect(data.credentialSubject.residentialAddressStreet).toBe("Main St");
+    expect(data.credentialSubject.residentialAddressHouseNumber).toBe("123");
+    expect(data.credentialSubject.residentialAddressAdditionalAddressInfo).toBe("Apt 1");
+    expect(data.credentialSubject.residentialAddressCity).toBe("New York");
+    expect(data.credentialSubject.residentialAddressPostalCode).toBe("10001");
+    expect(data.credentialSubject.residentialAddressCountry).toBe("US");
+
+    // Check if proof is properly constructed
+    expect(data.proof.proofPurpose).toBe("assertionMethod");
+    expect(data.proof.type).toBe("Ed25519Signature2020");
+    expect(data.proof.verificationMethod).toBe("https://vc-issuers.cool.id/idos/keys/1");
+
+    const publicKey = await Ed25519VerificationKey2020.from({
+      id: `${issuer}/keys/1`,
+      controller: `${issuer}/issuer/1`,
+      publicKeyMultibase: "z6MkrQDe6W8yspNAZyVXw9Rt9s8FuP61y9XRnRhA2kbQ1Jyj",
+      type: "Ed25519VerificationKey2020",
+    });
+
+    const vcVerifyingSuite = new Ed25519Signature2020({
+      key: publicKey,
+      verificationMethod: publicKey.id,
+    });
+
+    const controller = {
+      "@context": "https://w3id.org/security/v2",
+      id: publicKey.controller,
+      assertionMethod: [publicKey.id],
+      authentication: [publicKey.id],
+    };
+
+    // Verify the signature
+    const verifyCredentialResult = await vc.verifyCredential({
+      credential: data,
+      suite: vcVerifyingSuite,
+      controller,
+      documentLoader: builder.buildDocumentLoader(),
+    });
+    expect(verifyCredentialResult.verified).toBe(true);
+  });
+});

package/src/services/grant.service.ts

@@ -0,0 +1,59 @@
+import {
+  type KwilActionClient,
+  NoncedBox,
+  base64Encode,
+  hexEncodeSha256Hash,
+  type idOSCredential,
+  utf8Encode,
+} from "@idos-network/core";
+import { createAccessGrantByDag as _createAccessGrantByDag } from "@idos-network/core/kwil-actions";
+import invariant from "tiny-invariant";
+
+export type CreateAccessGrantFromDAGParams = {
+  dag_data_id: string;
+  dag_owner_wallet_identifier: string;
+  dag_grantee_wallet_identifier: string;
+  dag_signature: string;
+  dag_locked_until: number;
+  dag_content_hash: string;
+};
+
+export class GrantService {
+  readonly #kwilClient: KwilActionClient;
+  readonly #encryptionSecretKey: Uint8Array;
+
+  constructor(kwilClient: KwilActionClient, encryptionSecretKey: Uint8Array) {
+    this.#kwilClient = kwilClient;
+    this.#encryptionSecretKey = encryptionSecretKey;
+  }
+
+  async createAccessGrantFromDAG(
+    params: CreateAccessGrantFromDAGParams,
+    getCredentialIdByContentHash: (contentHash: string) => Promise<string | null>,
+    getSharedCredential: (id: string) => Promise<idOSCredential | null>,
+  ): Promise<CreateAccessGrantFromDAGParams | null> {
+    const credentialId = await getCredentialIdByContentHash(params.dag_content_hash);
+
+    invariant(credentialId, "Missing `idOSCredential` id");
+
+    const credential = await getSharedCredential(credentialId);
+
+    invariant(credential, "`idOSCredential` with id `{credentialId}` not found");
+
+    const plaintextContent = await NoncedBox.nonceFromBase64SecretKey(
+      base64Encode(this.#encryptionSecretKey),
+    ).decrypt(credential.content, credential.encryptor_public_key);
+
+    // Get the content hash from the plaintext content
+    const contentHash = hexEncodeSha256Hash(utf8Encode(plaintextContent));
+
+    // Check if the content hash matches the content hash in the credential
+    if (contentHash !== params.dag_content_hash) {
+      throw new Error("Hash mismatch between `DAG` and `idOSCredential` content");
+    }
+
+    const result = await _createAccessGrantByDag(this.#kwilClient, params);
+
+    return result ?? null;
+  }
+}

package/src/services/user.service.ts

@@ -0,0 +1,75 @@
+import type { KwilActionClient } from "@idos-network/core";
+import {
+  createUser as _createUser,
+  hasProfile as _hasProfile,
+  upsertWalletAsInserter as _upsertWalletAsInserter,
+} from "@idos-network/core/kwil-actions";
+import type { idOSUser, idOSWallet } from "@idos-network/core/types";
+
+export type CreateProfileReqParams = Omit<idOSUser, "id"> & {
+  id?: string;
+};
+
+export type UpsertWalletReqParams = Omit<idOSWallet, "id"> & {
+  id?: string;
+};
+
+export type CreateWalletReqParams = Omit<UpsertWalletReqParams, "user_id"> & {
+  id?: string;
+};
+
+export class UserService {
+  readonly #kwilClient: KwilActionClient;
+
+  constructor(kwilClient: KwilActionClient) {
+    this.#kwilClient = kwilClient;
+  }
+
+  #ensureEntityId<T extends { id?: string }>(entity: T): T & { id: string } {
+    if (!entity.id) {
+      (entity as T & { id: string }).id = crypto.randomUUID();
+    }
+    return entity as T & { id: string };
+  }
+
+  async hasProfile(userAddress: string): Promise<boolean> {
+    return _hasProfile(this.#kwilClient, userAddress);
+  }
+
+  async createUserProfile(params: CreateProfileReqParams): Promise<idOSUser> {
+    const payload = this.#ensureEntityId(params);
+    await _createUser(this.#kwilClient, payload);
+    return payload;
+  }
+
+  async upsertWalletAsInserter(params: UpsertWalletReqParams): Promise<idOSWallet> {
+    const payload = this.#ensureEntityId(params);
+    await _upsertWalletAsInserter(this.#kwilClient, payload);
+    return payload;
+  }
+
+  async createUser(
+    user: CreateProfileReqParams,
+    wallet: CreateWalletReqParams,
+  ): Promise<[idOSUser, idOSWallet]> {
+    const user_id = user.id ?? crypto.randomUUID();
+    const wallet_id = wallet.id ?? crypto.randomUUID();
+
+    const userReqParams = {
+      ...user,
+      id: user_id,
+    };
+
+    const userResponse = await this.createUserProfile(userReqParams);
+
+    const walletReqParams = {
+      ...wallet,
+      user_id,
+      id: wallet_id,
+    };
+
+    const walletResponse = await this.upsertWalletAsInserter(walletReqParams);
+
+    return [userResponse, walletResponse];
+  }
+}

package/src/types.d.ts

@@ -0,0 +1,4 @@
+declare module "@digitalbazaar/ed25519-signature-2020";
+declare module "@digitalbazaar/ed25519-verification-key-2020";
+declare module "@digitalbazaar/vc";
+declare module "jsonld-document-loader";