@learncard/network-plugin 2.14.0 → 2.14.1

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,EACH,sCAAsC,EACtC,sBAAsB,EACtB,iBAAiB,EAEpB,MAAM,SAAS,CAAC;AAUjB;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAyaD,cAAc,SAAS,CAAC;AAExB,MAAM,MAAM,sBAAsB,GAAG,MAAM,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAE5F;;GAEG;AACH,+CAA+C;AAC/C,MAAM,WAAW,6BAA8B,SAAQ,gBAAgB;IACnE,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,wBAAsB,yBAAyB,CAC3C,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,sCAAsC,CAAC,EACvE,GAAG,EAAE,MAAM,EACX,iBAAiB,CAAC,EAAE,6BAA6B,GAClD,OAAO,CAAC,sBAAsB,CAAC,CAAC;AACnC,wBAAsB,yBAAyB,CAC3C,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,sCAAsC,CAAC,EACtE,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,6BAA6B,GACxC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAk3EnC;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAC7B,WAAW,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,EAC/C,0BAA0B,MAAM,KACjC,OAAO,CAAC,iBAAiB,CA8G3B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQvD,OAAO,EACH,sCAAsC,EACtC,sBAAsB,EACtB,iBAAiB,EAEpB,MAAM,SAAS,CAAC;AAUjB;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAyaD,cAAc,SAAS,CAAC;AAExB,MAAM,MAAM,sBAAsB,GAAG,MAAM,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAE5F;;GAEG;AACH,+CAA+C;AAC/C,MAAM,WAAW,6BAA8B,SAAQ,gBAAgB;IACnE,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,wBAAsB,yBAAyB,CAC3C,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,sCAAsC,CAAC,EACvE,GAAG,EAAE,MAAM,EACX,iBAAiB,CAAC,EAAE,6BAA6B,GAClD,OAAO,CAAC,sBAAsB,CAAC,CAAC;AACnC,wBAAsB,yBAAyB,CAC3C,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,sCAAsC,CAAC,EACtE,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,6BAA6B,GACxC,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAk3EnC;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAC7B,WAAW,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,EAC/C,0BAA0B,MAAM,KACjC,OAAO,CAAC,iBAAiB,CAgJ3B,CAAC"}

package/dist/test/verify-boost-regression.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=verify-boost-regression.test.d.ts.map

package/dist/test/verify-boost-regression.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-boost-regression.test.d.ts","sourceRoot":"","sources":["../../src/test/verify-boost-regression.test.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/network-plugin",
-    "version": "2.14.0",
+    "version": "2.14.1",
     "description": "",
     "type": "module",
     "main": "./dist/index.cjs",
@@ -39,10 +39,10 @@
         "url": "https://github.com/learningeconomy/LearnCard/issues"
     },
     "devDependencies": {
-        "@learncard/didkey-plugin": "^1.1.34",
-        "@learncard/didkit-plugin": "^1.9.14",
-        "@learncard/types": "5.19.0",
-        "@learncard/vc-plugin": "^1.6.0",
+        "@learncard/didkey-plugin": "^1.1.35",
+        "@learncard/didkit-plugin": "^1.10.0",
+        "@learncard/types": "5.20.0",
+        "@learncard/vc-plugin": "^1.6.1",
         "@types/node": "^17.0.31",
         "aqu": "0.4.3",
         "esbuild": "^0.27.1",
@@ -52,9 +52,9 @@
     },
     "types": "./dist/index.d.ts",
     "dependencies": {
-        "@learncard/core": "9.4.34",
-        "@learncard/helpers": "1.5.0",
-        "@learncard/network-brain-client": "2.5.55",
+        "@learncard/core": "9.4.35",
+        "@learncard/helpers": "1.5.1",
+        "@learncard/network-brain-client": "2.5.56",
         "mustache": "^4.2.0"
     },
     "sideEffects": false

package/src/plugin.ts

@@ -2974,6 +2974,13 @@ export const getVerifyBoostPlugin = async (
         if (!issuerDID) return;
         return boostRegistry.find(o => o.did === issuerDID);
     };
+    const getTrustedBoostNetwork = (boostId: unknown): TrustedBoostRegistryEntry | undefined => {
+        if (typeof boostId !== 'string') return;
+        const match = /^lc:network:([^?#\s]+)\/(?:trpc:)?boost:([^/?#\s]+)$/.exec(boostId);
+        if (!match) return;
+        const networkDid = `did:web:${match[1]!.replace(/\//g, ':')}`;
+        return boostRegistry.find(entry => entry.did === networkDid);
+    };
     return {
         name: 'VerifyBoost',
         displayName: 'Verify Boost Extension',
@@ -2984,20 +2991,31 @@ export const getVerifyBoostPlugin = async (
                     credential,
                     options
                 );
+                const hasOuterVerificationErrors = Boolean(verificationCheck.errors?.length);
                 const boostCredential = credential?.boostCredential;
                 try {
-                    if (boostCredential) {
-                        const verifyBoostCredential =
-                            await learnCard.invoke.verifyCredential(boostCredential);
-                        const boostCredentialErrors = verifyBoostCredential.errors ?? [];
-                        if (verifyBoostCredential.status?.length) {
+                    // Legacy credentials contain a separately signed inner VC. New
+                    // credentials are the issuer-signed VC itself with boostId metadata.
+                    const boostId = boostCredential?.boostId ?? credential?.boostId;
+                    if (
+                        boostCredential ||
+                        credential?.boostId ||
+                        credential?.type?.includes('BoostCredential')
+                    ) {
+                        const verifyBoostCredential = boostCredential
+                            ? await learnCard.invoke.verifyCredential(boostCredential)
+                            : verificationCheck;
+                        const boostCredentialErrors = boostCredential
+                            ? (verifyBoostCredential.errors ?? [])
+                            : [];
+                        if (boostCredential && verifyBoostCredential.status?.length) {
                             verificationCheck.status = [
                                 ...(verificationCheck.status ?? []),
                                 ...verifyBoostCredential.status,
                             ];
                         }
 
-                        if (!boostCredential?.boostId && !credential?.boostId) {
+                        if (!boostId) {
                             verificationCheck.warnings.push(
                                 'Boost Authenticity could not be verified: Boost ID metadata is missing.'
                             );
@@ -3019,21 +3037,37 @@ export const getVerifyBoostPlugin = async (
                                 ...(verificationCheck.errors || []),
                                 'Boost Credential could not be verified.',
                             ];
-                        } else if (boostCredential?.boostId !== credential?.boostId) {
+                        } else if (hasOuterVerificationErrors) {
+                            verificationCheck.warnings.push(
+                                'Boost Authenticity could not be verified: Credential verification failed.'
+                            );
+                        } else if (!boostId) {
+                            // The missing metadata warning above explains why trust is unknown.
+                        } else if (
+                            boostCredential &&
+                            boostCredential.boostId !== credential.boostId
+                        ) {
                             verificationCheck.errors.push(
                                 'Boost Authenticity could not be verified: Boost ID metadata is mismatched.'
                             );
                         } else {
-                            const trustedBoostIssuer = getTrustedBoostVerifier(credential?.issuer);
+                            // A direct VC is signed by the issuing authority, not by the
+                            // network. Its signed boostId identifies the associated network.
+                            // Legacy wrappers still establish trust through the outer issuer.
+                            const trustedBoostIssuer = boostCredential
+                                ? getTrustedBoostVerifier(credential?.issuer)
+                                : getTrustedBoostNetwork(boostId);
                             if (trustedBoostIssuer) {
                                 verificationCheck.checks.push(
                                     `Boost is Authentic. Verified by ${trustedBoostIssuer.id}.`
                                 );
                             } else {
                                 verificationCheck.warnings.push(
-                                    `Boost Authenticity could not be verified. Issuer is outside of trust network: ${getIssuerDID(
-                                        credential?.issuer
-                                    )}`
+                                    boostCredential
+                                        ? `Boost Authenticity could not be verified. Issuer is outside of trust network: ${getIssuerDID(
+                                              credential?.issuer
+                                          )}`
+                                        : `Boost Authenticity could not be verified. Boost ID does not identify a trusted network: ${boostId}`
                                 );
                             }
                         }

package/src/test/verify-boost-regression.test.ts

@@ -0,0 +1,167 @@
+import { describe, expect, it, vi } from 'vitest';
+import type { VC } from '@learncard/types';
+
+import { getVerifyBoostPlugin } from '../plugin';
+
+const trustedIssuer = 'did:web:network.learncard.com';
+const boostId = 'lc:network:network.learncard.com/trpc:boost:test';
+const result = (errors: string[] = []) => ({ errors, warnings: [], checks: ['proof', 'status'] });
+
+describe('VerifyBoost wrapper transition', () => {
+    it.each([
+        ['lc:network:localhost%3A4000/trpc:boost:test', 'did:web:localhost%3A4000'],
+        ['lc:network:preview.example/brain/trpc:boost:test', 'did:web:preview.example:brain'],
+        ['lc:network:preview.example/trpc/trpc:boost:test', 'did:web:preview.example:trpc'],
+        ['lc:network:network.learncard.com/boost:test', trustedIssuer],
+    ])('resolves the registry network from %s', async (boostId, did) => {
+        const card = {
+            invoke: { verifyCredential: vi.fn().mockResolvedValue(result()) },
+        } as unknown as Parameters<typeof getVerifyBoostPlugin>[0];
+        const registryUrl = `data:application/json,${encodeURIComponent(
+            JSON.stringify([{ id: 'Test Network', did, url: 'https://registry.example' }])
+        )}`;
+        const plugin = await getVerifyBoostPlugin(card, registryUrl);
+        const verified = await plugin.methods.verifyCredential(card, {
+            issuer: 'did:key:z6MkSigningAuthority',
+            boostId,
+            type: ['BoostCredential'],
+        } as unknown as VC);
+        expect(verified.checks).toContain('Boost is Authentic. Verified by Test Network.');
+        expect(verified.errors).toEqual([]);
+        expect(verified.warnings).toEqual([]);
+    });
+
+    it('does not infer authenticity for a pre-signed Boost without a signed association', async () => {
+        const card = {
+            invoke: { verifyCredential: vi.fn().mockResolvedValue(result()) },
+        } as unknown as Parameters<typeof getVerifyBoostPlugin>[0];
+        const plugin = await getVerifyBoostPlugin(card);
+        const verified = await plugin.methods.verifyCredential(card, {
+            issuer: trustedIssuer,
+            type: ['BoostCredential'],
+        } as unknown as VC);
+        expect(verified.errors).toEqual([]);
+        expect(verified.checks).toContain('proof');
+        expect(verified.checks.some(check => check.includes('Boost is Authentic'))).toBe(false);
+        expect(verified.warnings).toEqual([
+            'Boost Authenticity could not be verified: Boost ID metadata is missing.',
+        ]);
+    });
+
+    it.each([
+        'did:key:z6MkSigningAuthority',
+        'did:web:network.learncard.com:users:issuer',
+        { id: 'did:web:network.learncard.com:users:issuer' },
+    ])('verifies a direct SA credential using its signed Boost network (%j)', async issuer => {
+        const verifyCredential = vi.fn().mockResolvedValue(result());
+        const card = { invoke: { verifyCredential } } as unknown as Parameters<
+            typeof getVerifyBoostPlugin
+        >[0];
+        const plugin = await getVerifyBoostPlugin(card);
+        const vc = { issuer, boostId, type: ['BoostCredential'] } as unknown as VC;
+        const verified = await plugin.methods.verifyCredential(card, vc);
+        expect(verifyCredential).toHaveBeenCalledTimes(1);
+        expect(verified.errors).toEqual([]);
+        expect(verified.checks).toContain('Boost is Authentic. Verified by LearnCard Network.');
+    });
+
+    it.each([
+        'lc:network:untrusted.example/boost:test',
+        'lc:network:network.learncard.com.evil.example/boost:test',
+        'lc:network:network.learncard.com@evil.example/boost:test',
+        'lc:network:network.learncard.com/credential:test',
+        'lc:network:network.learncard.com/boost:',
+        'lc:network:network.learncard.com/boost:test?network=trusted',
+        'not-a-boost-uri',
+    ])(
+        'does not mark a direct credential with an untrusted or invalid Boost URI authentic (%s)',
+        async boostId => {
+            const card = {
+                invoke: { verifyCredential: vi.fn().mockResolvedValue(result()) },
+            } as unknown as Parameters<typeof getVerifyBoostPlugin>[0];
+            const plugin = await getVerifyBoostPlugin(card);
+            const verified = await plugin.methods.verifyCredential(card, {
+                issuer: trustedIssuer,
+                boostId,
+                type: ['BoostCredential'],
+            } as unknown as VC);
+            expect(verified.checks.some(check => check.includes('Boost is Authentic'))).toBe(false);
+            expect(verified.warnings).toEqual([
+                `Boost Authenticity could not be verified. Boost ID does not identify a trusted network: ${boostId}`,
+            ]);
+        }
+    );
+
+    it.each(['Invalid signature', 'Credential revoked'])(
+        'explains why a direct credential with %s cannot establish Boost authenticity',
+        async error => {
+            const card = {
+                invoke: { verifyCredential: vi.fn().mockResolvedValue(result([error])) },
+            } as unknown as Parameters<typeof getVerifyBoostPlugin>[0];
+            const plugin = await getVerifyBoostPlugin(card);
+            const verified = await plugin.methods.verifyCredential(card, {
+                issuer: trustedIssuer,
+                boostId,
+                type: ['BoostCredential'],
+            } as unknown as VC);
+            expect(verified.errors).toEqual([error]);
+            expect(verified.warnings).toContain(
+                'Boost Authenticity could not be verified: Credential verification failed.'
+            );
+            expect(verified.checks.some(check => check.includes('Boost is Authentic'))).toBe(false);
+        }
+    );
+
+    it('preserves legacy inner verification failures even when both boost IDs are missing', async () => {
+        const verifyCredential = vi
+            .fn()
+            .mockResolvedValueOnce(result())
+            .mockResolvedValueOnce(result(['Credential revoked']));
+        const card = { invoke: { verifyCredential } } as unknown as Parameters<
+            typeof getVerifyBoostPlugin
+        >[0];
+        const plugin = await getVerifyBoostPlugin(card);
+        const verified = await plugin.methods.verifyCredential(card, {
+            issuer: trustedIssuer,
+            type: ['CertifiedBoostCredential'],
+            boostCredential: { issuer: 'did:example:issuer', type: ['BoostCredential'] },
+        } as unknown as VC);
+        expect(verifyCredential).toHaveBeenCalledTimes(2);
+        expect(verified.errors).toContain('Credential revoked');
+        expect(verified.checks).not.toContain('status');
+    });
+
+    it('continues to verify matching legacy wrappers', async () => {
+        const verifyCredential = vi.fn().mockImplementation(async () => result());
+        const card = { invoke: { verifyCredential } } as unknown as Parameters<
+            typeof getVerifyBoostPlugin
+        >[0];
+        const plugin = await getVerifyBoostPlugin(card);
+        const verified = await plugin.methods.verifyCredential(card, {
+            issuer: trustedIssuer,
+            boostId,
+            type: ['CertifiedBoostCredential'],
+            boostCredential: { issuer: 'did:example:issuer', boostId, type: ['BoostCredential'] },
+        } as unknown as VC);
+        expect(verifyCredential).toHaveBeenCalledTimes(2);
+        expect(verified.errors).toEqual([]);
+        expect(verified.checks).toContain('Boost is Authentic. Verified by LearnCard Network.');
+    });
+
+    it('identifies the issuer when a legacy wrapper is outside the trust network', async () => {
+        const card = {
+            invoke: { verifyCredential: vi.fn().mockImplementation(async () => result()) },
+        } as unknown as Parameters<typeof getVerifyBoostPlugin>[0];
+        const plugin = await getVerifyBoostPlugin(card);
+        const verified = await plugin.methods.verifyCredential(card, {
+            issuer: 'did:example:untrusted',
+            boostId,
+            type: ['CertifiedBoostCredential'],
+            boostCredential: { issuer: 'did:example:issuer', boostId, type: ['BoostCredential'] },
+        } as unknown as VC);
+        expect(verified.checks.some(check => check.includes('Boost is Authentic'))).toBe(false);
+        expect(verified.warnings).toEqual([
+            'Boost Authenticity could not be verified. Issuer is outside of trust network: did:example:untrusted',
+        ]);
+    });
+});