@learncard/network-brain-service 3.17.0 → 3.19.0

package/src/helpers/boost.helpers.ts

@@ -1,7 +1,5 @@
-import { environment } from '@environment';
-import isEqual from 'lodash/isEqual';
 import cloneDeep from 'lodash/cloneDeep';
-import { v4 as uuidv4 } from 'uuid';
+import { isEncrypted, isVC2Format } from '@learncard/helpers';
 import { TRPCError } from '@trpc/server';
 import {
     VC,
@@ -10,7 +8,6 @@ import {
     LCNNotificationTypeEnumValidator,
     ContactMethodQueryType,
 } from '@learncard/types';
-import { isEncrypted, isVC2Format } from '@learncard/helpers';
 import { ProfileType, SigningAuthorityForUserType } from 'types/profile';
 import {
     CredentialIssuer,
@@ -18,13 +15,9 @@ import {
     getIssuerOwnerProfile,
     getIssuerProfileId,
 } from '../types/issuer';
-import { trace, traceDb, traceCrypto, traceInternal } from '@tracing';
+import { trace, traceDb } from '@tracing';
+import { injectObv3AlignmentsIntoCredentialForBoost } from '@services/skills-provider/inject';
 import {
-    injectObv3AlignmentsIntoCredentialForBoost,
-    buildObv3AlignmentsForBoost,
-} from '@services/skills-provider/inject';
-import {
-    hasMustacheVariables,
     renderBoostTemplate,
     parseRenderedTemplate,
     shouldAutoAppendTemplateEvidence,
@@ -41,7 +34,6 @@ import {
     createListingSentCredentialRelationship,
 } from '@accesslayer/credential/relationships/create';
 import { acceptCredential, getCredentialUri } from './credential.helpers';
-import { getLearnCard } from './learnCard.helpers';
 import { issueCredentialWithSigningAuthority } from './signingAuthority.helpers';
 import { addNotificationToQueue } from './notifications.helpers';
 import { getNotificationMessage } from './notificationMessages';
@@ -50,6 +42,8 @@ import { BoostStatus, getBoostOwnerProfile } from 'types/boost';
 import { getDidWeb } from './did.helpers';
 import { DbTermsType } from 'types/consentflowcontract';
 import { appendBitstringStatusListEntries } from './status-list.helpers';
+import { getIssuedCredentialPayload } from './issuedCredentialStatus.helpers';
+import type { IssuedCredential } from '../types/credential';
 
 export const getBoostUri = (id: string, domain: string): string =>
     constructUri('boost', id, domain);
@@ -113,274 +107,6 @@ export const convertCredentialToBoostTemplateJSON = (
     return JSON.stringify(template);
 };
 
-export const verifyCredentialIsDerivedFromBoost = async (
-    boost: BoostInstance,
-    credential: VC,
-    domain: string
-): Promise<boolean> => {
-    if (!boost || !credential) {
-        console.error('Either boost or credential do not exist.', credential, credential);
-        return false;
-    }
-
-    const boostCredential = JSON.parse(boost?.dataValues?.boost);
-    const boostId = boost?.dataValues?.id;
-    const boostURI = getBoostUri(boostId, domain);
-
-    if (!boostCredential) {
-        console.error('No credential template attached to boost');
-        return false;
-    }
-
-    if (!isEqual(credential.boostId, boostURI)) {
-        console.error('Credential boostId !== boost id', credential.boostId, boostURI);
-        return false;
-    }
-
-    // If the boost template contains Mustache variables, we use a more lenient verification.
-    // We only verify that the credential type matches the template type, since other fields
-    // may have been dynamically substituted at issuance time.
-    const boostTemplateString = boost?.dataValues?.boost;
-    const isTemplatedBoost = hasMustacheVariables(boostTemplateString);
-
-    if (isTemplatedBoost) {
-        // For templated boosts, only verify the type matches
-        if (!isEqual(credential.type, boostCredential.type)) {
-            console.error(
-                'Credential type !== boost credential type (templated boost)',
-                credential.type,
-                boostCredential.type
-            );
-            return false;
-        }
-        // Templated boost passed basic verification
-        return true;
-    }
-
-    /// Simplify Comparison
-    // if (
-    //     !isEqual(credential.boostId, boostId) ||
-    //     !isEqual(credential.type, boostCredential.type) ||
-    //     !isEqual(
-    //         credential.credentialSubject?.achievement,
-    //         boostCredential.credentialSubject?.achievement
-    //     ) ||
-    //     !isEqual(credential.display, boostCredential.display) ||
-    //     isEqual(credential.image, boostCredential.image) ||
-    //     !isEqual(credential.attachments, boostCredential.attachments)
-    // ) {
-    //     return false;
-    // }
-
-    if (!isEqual(credential.type, boostCredential.type)) {
-        console.error(
-            'Credential type !== boost credential type',
-            credential.type,
-            boostCredential.type
-        );
-        return false;
-    }
-
-    // Mirror plugin behavior: inject OBv3 alignments into the expected template before comparison.
-    // Additionally, warn (but allow) if the credential would match the base template without alignments.
-    if (
-        credential.credentialSubject &&
-        'achievement' in credential.credentialSubject &&
-        typeof (credential as any).credentialSubject.achievement === 'object'
-    ) {
-        try {
-            // Build expected boost credential with OBv3 alignments injected (JSON-LD typed as in plugin)
-            const baseExpected = boostCredential as VC | UnsignedVC;
-            const expectedWithAlignments = cloneDeep(baseExpected);
-
-            const rawAlignments = await buildObv3AlignmentsForBoost(boost, domain);
-            const jsonLdAlignments = (rawAlignments || []).map(a => ({
-                ...a,
-                type: ['Alignment'],
-            }));
-
-            const addAlignments = (subject: any) => {
-                if (!subject) return;
-
-                if (jsonLdAlignments.length === 0) return;
-
-                if (subject.achievement) {
-                    const ach = subject.achievement;
-                    if (!Array.isArray(ach.alignment))
-                        ach.alignment = Array.isArray(ach.alignment) ? ach.alignment : [];
-                    ach.alignment = [...ach.alignment, ...jsonLdAlignments];
-                    return;
-                }
-                if (!Array.isArray(subject.alignment))
-                    subject.alignment = Array.isArray(subject.alignment) ? subject.alignment : [];
-                subject.alignment = [...subject.alignment, ...jsonLdAlignments];
-            };
-
-            if (Array.isArray((expectedWithAlignments as any).credentialSubject)) {
-                (expectedWithAlignments as any).credentialSubject.forEach(addAlignments);
-            } else {
-                addAlignments((expectedWithAlignments as any).credentialSubject);
-            }
-
-            const credAch = (credential as any).credentialSubject.achievement;
-            const expectedAch = (expectedWithAlignments as any).credentialSubject?.achievement;
-            const baseAch = (baseExpected as any).credentialSubject?.achievement;
-
-            const matchWithAlignments = isEqual(credAch, expectedAch);
-            const matchWithoutAlignments = isEqual(credAch, baseAch);
-
-            if (!matchWithAlignments) {
-                if (matchWithoutAlignments && jsonLdAlignments.length > 0) {
-                    // Special warning: Accept but inform client to include alignments next time
-                    console.warn(
-                        '[OBV3 ALIGNMENTS WARNING] Credential matches boost template without OBv3 alignments. Please update the client to include alignments before issuing.'
-                    );
-                } else {
-                    console.error(
-                        'Credential achievement !== expected boost credential achievement (after alignment injection)',
-                        credAch,
-                        expectedAch
-                    );
-                    return false;
-                }
-            }
-        } catch (_e) {
-            // Non-fatal: fallback to legacy comparison
-            if (
-                !isEqual(
-                    (credential as any).credentialSubject?.achievement,
-                    (boostCredential as any).credentialSubject?.achievement
-                )
-            ) {
-                console.error(
-                    'Credential achievement !== boost credential achievement (legacy path)',
-                    (credential as any).credentialSubject?.achievement,
-                    (boostCredential as any).credentialSubject?.achievement
-                );
-                return false;
-            }
-        }
-    }
-
-    if (!isEqual(credential.display, boostCredential.display)) {
-        console.error(
-            'Credential display !== boost credential display',
-            credential.display,
-            boostCredential.display
-        );
-        return false;
-    }
-
-    if (!isEqual(credential.image, boostCredential.image)) {
-        console.error(
-            'Credential image !== boost credential image',
-            credential.image,
-            boostCredential.image
-        );
-        return false;
-    }
-
-    if (!isEqual(credential.attachments, boostCredential.attachments)) {
-        console.error(
-            'Credential attachments !== boost credential attachments',
-            credential.attachments,
-            boostCredential.attachments
-        );
-        return false;
-    }
-    if (boost && credential) {
-        return true;
-    }
-    return false;
-};
-
-export const issueCertifiedBoost = async (
-    boost: BoostInstance,
-    credential: VC,
-    domain: string,
-    ownerProfileId: string
-): Promise<VC | JWE | false> => {
-    return trace('certification', 'issueCertifiedBoost', async () => {
-        const learnCard = await trace('init', 'getLearnCard', () => getLearnCard(undefined, true));
-
-        let lcnDID = `did:web:${domain}`;
-
-        try {
-            const didDoc = await trace('did', 'resolveDid', () =>
-                learnCard.invoke.resolveDid(lcnDID)
-            );
-
-            if (!didDoc) {
-                lcnDID = learnCard.id.did();
-            }
-        } catch (error) {
-            if (environment.NODE_ENV !== 'test') {
-                console.warn(
-                    'LCN DID Document is unable to resolve while issuing Certified Boost. Reverting to did:key. Is this a test environment?',
-                    lcnDID,
-                    error
-                );
-            }
-            lcnDID = learnCard.id.did();
-        }
-
-        try {
-            const isValid = await traceInternal('verifyCredentialIsDerivedFromBoost', () =>
-                verifyCredentialIsDerivedFromBoost(boost, credential, domain)
-            );
-
-            if (isValid) {
-                const unsignedCertifiedBoost = await traceInternal(
-                    'constructCertifiedBoostCredential',
-                    () => constructCertifiedBoostCredential(boost, credential, domain, lcnDID)
-                );
-
-                await traceInternal('appendBitstringStatusListEntries:certifiedBoost', () =>
-                    appendBitstringStatusListEntries(unsignedCertifiedBoost, ownerProfileId, domain)
-                );
-
-                // TODO: Encrypt Boost Credential
-                const certifiedBoost = await traceCrypto('issueCredential', () =>
-                    learnCard.invoke.issueCredential(unsignedCertifiedBoost)
-                );
-
-                return certifiedBoost;
-            } else {
-                console.warn(
-                    'Credential is not derived from boost',
-                    boost.dataValues.boost,
-                    credential
-                );
-            }
-        } catch (error) {
-            console.warn('Could not issue certified boost', error);
-        }
-
-        return false;
-    });
-};
-
-export const decryptCredential = async (credential: VC | JWE): Promise<VC | false> => {
-    if (!isEncrypted(credential)) {
-        return credential;
-    }
-
-    return traceCrypto('decryptCredential', async () => {
-        const learnCard = await getLearnCard();
-
-        try {
-            const decrypted = await learnCard.invoke.decryptDagJwe<VC>(credential as JWE, [
-                learnCard.id.keypair(),
-            ]);
-
-            return decrypted || false;
-        } catch (error) {
-            console.warn('Could not decrypt Boost Credential!', error);
-            return false;
-        }
-    });
-};
-
 export const sendBoost = async ({
     from,
     to,
@@ -389,7 +115,6 @@ export const sendBoost = async ({
     domain,
     skipNotification = false,
     autoAcceptCredential = false,
-    skipCertification = false,
     contractTerms,
     metadata,
     activityId,
@@ -399,11 +124,10 @@ export const sendBoost = async ({
     from: CredentialIssuer;
     to: ProfileType;
     boost: BoostInstance;
-    credential: VC | JWE;
+    credential: VC | JWE | IssuedCredential;
     domain: string;
     skipNotification?: boolean;
     autoAcceptCredential?: boolean;
-    skipCertification?: boolean;
     contractTerms?: DbTermsType;
     metadata?: Record<string, unknown>;
     activityId?: string;
@@ -414,137 +138,70 @@ export const sendBoost = async ({
         'boost',
         'sendBoost',
         async () => {
-            const decryptedCredential = skipCertification
-                ? false
-                : await decryptCredential(credential);
-            let boostUri: string | undefined;
             const sourceBoostUri = getBoostUri(boost.dataValues.id, domain);
             const fromProfile = getIssuerOwnerProfile(from);
 
-            // Skip certification if requested or if credential can't be decrypted or if it's not a boost credential
-            let _skipCertification =
-                skipCertification ||
-                !decryptedCredential ||
-                !decryptedCredential?.type?.includes('BoostCredential');
-
-            if (!_skipCertification && decryptedCredential) {
-                const certifiedBoost = await issueCertifiedBoost(
-                    boost,
-                    decryptedCredential,
-                    domain,
-                    fromProfile.profileId
-                );
+            const payload = getIssuedCredentialPayload(credential);
+            // Pre-signed credentials may predate their network Boost (send can create
+            // one from the signed payload). Preserve them without inventing a signed
+            // association; only an explicit conflicting claim is rejected.
+            if (
+                !isEncrypted(payload) &&
+                (payload as VC).boostId !== undefined &&
+                (payload as VC).boostId !== sourceBoostUri
+            ) {
+                throw new TRPCError({
+                    code: 'BAD_REQUEST',
+                    message: 'Credential boostId must match the Boost being sent.',
+                });
+            }
 
-                if (certifiedBoost) {
-                    const credentialInstance = await traceDb('storeCredential', () =>
-                        storeCredential(certifiedBoost)
-                    );
-                    const tasks = [
-                        createBoostInstanceOfRelationship(credentialInstance, boost),
-                        createSentCredentialRelationship(
-                            from,
-                            to,
-                            credentialInstance,
-                            metadata,
-                            activityId,
-                            integrationId
-                        ),
-                    ];
-
-                    if (listingId) {
-                        tasks.push(
-                            createListingSentCredentialRelationship(
-                                listingId,
-                                to,
-                                credentialInstance,
-                                metadata,
-                                activityId,
-                                integrationId
-                            )
-                        );
-                    }
-
-                    // If this credential is being issued via a contract, create that relationship
-                    if (contractTerms) {
-                        tasks.push(
-                            createCredentialIssuedViaContractRelationship(
-                                credentialInstance,
-                                contractTerms
-                            )
-                        );
-                    }
-
-                    await traceDb('createRelationships', () => Promise.all(tasks));
-
-                    if (autoAcceptCredential) {
-                        await acceptCredential(
-                            to,
-                            getCredentialUri(credentialInstance.id, domain),
-                            {
-                                skipNotification,
-                            }
-                        );
-                    }
-
-                    boostUri = getCredentialUri(credentialInstance.id, domain);
-
-                    if (environment.NODE_ENV !== 'test') {
-                        console.log('🚀 sendBoost:boost certified', boostUri);
-                    }
-                } else {
-                    throw new Error('Credential does not match boost template.');
-                }
-            } else {
-                // TODO: Should we warn them if they send a credential that can't be decrypted?
-                const credentialInstance = await traceDb('storeCredential', () =>
-                    storeCredential(credential)
-                );
+            // Preserve the issuer's payload without decrypting or counter-signing it.
+            const credentialInstance = await traceDb('storeCredential', () =>
+                storeCredential(credential)
+            );
 
-                const tasks = [
-                    createBoostInstanceOfRelationship(credentialInstance, boost),
-                    createSentCredentialRelationship(
-                        from,
+            const tasks = [
+                createBoostInstanceOfRelationship(credentialInstance, boost),
+                createSentCredentialRelationship(
+                    from,
+                    to,
+                    credentialInstance,
+                    metadata,
+                    activityId,
+                    integrationId
+                ),
+            ];
+
+            if (listingId) {
+                tasks.push(
+                    createListingSentCredentialRelationship(
+                        listingId,
                         to,
                         credentialInstance,
                         metadata,
                         activityId,
                         integrationId
-                    ),
-                ];
-
-                if (listingId) {
-                    tasks.push(
-                        createListingSentCredentialRelationship(
-                            listingId,
-                            to,
-                            credentialInstance,
-                            metadata,
-                            activityId,
-                            integrationId
-                        )
-                    );
-                }
+                    )
+                );
+            }
 
-                if (contractTerms) {
-                    tasks.push(
-                        createCredentialIssuedViaContractRelationship(
-                            credentialInstance,
-                            contractTerms
-                        )
-                    );
-                }
+            if (contractTerms) {
+                tasks.push(
+                    createCredentialIssuedViaContractRelationship(credentialInstance, contractTerms)
+                );
+            }
 
-                await traceDb('createRelationships', () => Promise.all(tasks));
+            await traceDb('createRelationships', () => Promise.all(tasks));
 
-                if (autoAcceptCredential) {
-                    await acceptCredential(to, getCredentialUri(credentialInstance.id, domain), {
-                        skipNotification,
-                    });
-                }
-
-                boostUri = getCredentialUri(credentialInstance.id, domain);
+            if (autoAcceptCredential) {
+                await acceptCredential(to, getCredentialUri(credentialInstance.id, domain), {
+                    skipNotification,
+                });
             }
 
+            const boostUri = getCredentialUri(credentialInstance.id, domain);
+
             if (typeof boostUri === 'string') {
                 if (!skipNotification) {
                     // LC-1644: fire-and-forget the BOOST_RECEIVED notification enqueue.
@@ -591,36 +248,6 @@ export const sendBoost = async ({
     );
 };
 
-export const constructCertifiedBoostCredential = async (
-    boost: BoostInstance,
-    credential: VC | JWE,
-    domain: string,
-    issuerDid: string
-): Promise<UnsignedVC> => {
-    const currentDate = new Date()?.toISOString();
-
-    const boostId = boost?.dataValues?.id;
-    const boostURI = getBoostUri(boostId, domain);
-
-    const isVC2 = isVC2Format(credential);
-
-    return {
-        '@context': [
-            isVC2
-                ? 'https://www.w3.org/ns/credentials/v2'
-                : 'https://www.w3.org/2018/credentials/v1',
-            'https://ctx.learncard.com/boosts/1.0.1.json',
-        ],
-        id: `urn:uuid:${uuidv4()}`,
-        type: ['VerifiableCredential', 'CertifiedBoostCredential'],
-        issuer: issuerDid,
-        ...(isVC2 ? { validFrom: currentDate } : { issuanceDate: currentDate }),
-        credentialSubject: { id: issuerDid },
-        boostId: boostURI,
-        boostCredential: credential,
-    };
-};
-
 export const issueClaimLinkBoost = async (
     boost: BoostInstance,
     domain: string,
@@ -638,14 +265,14 @@ export const issueClaimLinkBoost = async (
     if (Array.isArray(boostCredential.credentialSubject)) {
         boostCredential.credentialSubject = boostCredential.credentialSubject.map(subject => ({
             ...subject,
-            id: subject.did,
+            id: getDidWeb(domain, to.profileId),
         }));
     } else {
         boostCredential.credentialSubject.id = getDidWeb(domain, to.profileId);
     }
 
     // Embed the boostURI into the boost credential for verification purposes.
-    if (boostCredential?.type?.includes('BoostCredential')) {
+    if (boostCredential.type.includes('BoostCredential')) {
         boostCredential.boostId = boostURI;
     }
 
@@ -657,14 +284,8 @@ export const issueClaimLinkBoost = async (
         await appendBitstringStatusListEntries(boostCredential, fromProfile.profileId, domain),
         signingAuthorityForUser,
         domain,
-        false
+        true
     );
-    // TODO: encrypt vc?
-
-    // const lcnDid = await client.utilities.getDid.query();
-
-    // const credential = await _learnCard.invoke
-    //     .createDagJwe(vc, [userData.did, targetProfile.did, lcnDid]);
 
     return sendBoost({
         from,

package/src/helpers/contact-method.helpers.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, it, vi } from 'vitest';
+
+const environment = vi.hoisted(() => ({
+    CLIENT_APP_DOMAIN_NAME: undefined as string | undefined,
+    CLIENT_APP_PORT: undefined as number | undefined,
+    PORT: 4000,
+    IS_OFFLINE: true,
+}));
+vi.mock('@environment', () => ({ environment }));
+vi.mock('@cache', () => ({ default: {} }));
+
+import { generateClaimUrl } from './contact-method.helpers';
+
+describe('inbox claim links', () => {
+    it('opens the default frontend instead of the backend port', () => {
+        expect(generateClaimUrl('test-token')).toBe(
+            'http://localhost:3000/interactions/inbox-claim/test-token?iuv=1'
+        );
+    });
+
+    it('uses the configured frontend port locally', () => {
+        environment.CLIENT_APP_PORT = 3100;
+        try {
+            expect(generateClaimUrl('test-token')).toContain('http://localhost:3100/');
+        } finally {
+            environment.CLIENT_APP_PORT = undefined;
+        }
+    });
+
+    it('honors a configured app domain locally and keeps production HTTPS', () => {
+        environment.CLIENT_APP_DOMAIN_NAME = 'app.example.org';
+        try {
+            expect(generateClaimUrl('test-token')).toContain('http://app.example.org/');
+            environment.IS_OFFLINE = false;
+            expect(generateClaimUrl('test-token')).toBe(
+                'https://app.example.org/interactions/inbox-claim/test-token?iuv=1'
+            );
+        } finally {
+            environment.IS_OFFLINE = true;
+            environment.CLIENT_APP_DOMAIN_NAME = undefined;
+        }
+    });
+});

package/src/helpers/contact-method.helpers.ts

@@ -110,10 +110,9 @@ export const markInboxClaimTokenAsUsed = async (token: string): Promise<boolean>
 
 export const generateClaimUrl = (token: string): string => {
     const domainName = environment.CLIENT_APP_DOMAIN_NAME;
-    const domain =
-        !domainName || environment.IS_OFFLINE
-            ? `localhost:${environment.PORT || 3000}`
-            : domainName;
+    // Claim links open the frontend, not the brain-service HTTP port. Honor an
+    // explicitly configured app domain in local development as well.
+    const domain = domainName || `localhost:${environment.CLIENT_APP_PORT || 3000}`;
 
     const protocol = environment.IS_OFFLINE ? 'http' : 'https';