@learncard/vc-plugin 1.6.0 → 1.6.2

package/src/issueCredential.test.ts

@@ -3,6 +3,7 @@ vi.mock('multiformats/bases/base58', () => ({ base58btc: {} }));
 vi.mock('multiformats/bases/base64', () => ({ base64url: {} }));
 
 import { issueCredential } from './issueCredential';
+import { MANAGED_REFRESH_SERVICE_CONTEXT } from '@learncard/helpers';
 
 type Keypair = {
     kty: string;
@@ -17,6 +18,7 @@ type Credential = {
     issuer: string;
     validFrom: string;
     credentialSubject: { id: string };
+    refreshService?: unknown;
 };
 
 type ProofOptionsForTest = {
@@ -135,4 +137,125 @@ describe('issueCredential', () => {
         expect(options.cryptosuite).toBeUndefined();
         expect(options.proofFormat).toBe('jwt');
     });
+
+    test('passes an untouched credential through unchanged when no managed refresh service is present', async () => {
+        const { initLearnCard, issueCredentialMock, learnCard } = getLearnCard();
+
+        await issueCredential(initLearnCard as never)(learnCard as never, credential as never);
+
+        const payload = issueCredentialMock.mock.calls[0][0] as Credential;
+
+        expect(payload).toEqual(credential);
+        expect(payload['@context']).toEqual(credential['@context']);
+    });
+
+    test('injects the managed inline context when a managed refresh service is present', async () => {
+        const { initLearnCard, issueCredentialMock, learnCard } = getLearnCard();
+
+        const refreshableCredential = {
+            ...credential,
+            refreshService: {
+                id: 'https://network.learncard.test/api/credential-refreshes/refresh-1',
+                type: 'LearnCardCredentialRefresh2026',
+                authorization: { type: 'LearnCardDIDAuth' },
+            },
+        };
+
+        await issueCredential(initLearnCard as never)(
+            learnCard as never,
+            refreshableCredential as never
+        );
+
+        const payload = issueCredentialMock.mock.calls[0][0] as Credential;
+
+        expect(payload).not.toBe(refreshableCredential);
+        expect(payload['@context']).toEqual([
+            ...credential['@context'],
+            MANAGED_REFRESH_SERVICE_CONTEXT,
+        ]);
+        expect(payload.refreshService).toEqual(refreshableCredential.refreshService);
+
+        // Signing options are unaffected by context preparation
+        const options = issueCredentialMock.mock.calls[0][1] as ProofOptionsForTest;
+
+        expect(options.type).toBe('DataIntegrityProof');
+        expect(options.cryptosuite).toBe('eddsa-rdfc-2022');
+        expect(options.verificationMethod).toBe('did:example:issuer#key-1');
+    });
+
+    test('does not duplicate the inline context when an equivalent mapping already exists', async () => {
+        const { initLearnCard, issueCredentialMock, learnCard } = getLearnCard();
+
+        const refreshableCredential = {
+            ...credential,
+            '@context': [...credential['@context'], MANAGED_REFRESH_SERVICE_CONTEXT],
+            refreshService: {
+                id: 'https://network.learncard.test/api/credential-refreshes/refresh-1',
+                type: 'LearnCardCredentialRefresh2026',
+                authorization: { type: 'LearnCardDIDAuth' },
+            },
+        };
+
+        await issueCredential(initLearnCard as never)(
+            learnCard as never,
+            refreshableCredential as never
+        );
+
+        const payload = issueCredentialMock.mock.calls[0][0] as Credential;
+
+        expect(payload['@context']).toEqual(refreshableCredential['@context']);
+    });
+
+    test('rejects a credential with a conflicting managed term mapping', async () => {
+        const { initLearnCard, learnCard } = getLearnCard();
+
+        const conflictingCredential = {
+            ...credential,
+            '@context': [
+                ...credential['@context'],
+                {
+                    LearnCardCredentialRefresh2026:
+                        'https://evil.example/other#LearnCardCredentialRefresh2026',
+                },
+            ],
+            refreshService: {
+                id: 'https://network.learncard.test/api/credential-refreshes/refresh-1',
+                type: 'LearnCardCredentialRefresh2026',
+            },
+        };
+
+        await expect(
+            issueCredential(initLearnCard as never)(
+                learnCard as never,
+                conflictingCredential as never
+            )
+        ).rejects.toThrow(/LearnCardCredentialRefresh2026/);
+    });
+
+    test('preserves explicit signing options while preparing a refreshable credential', async () => {
+        const { initLearnCard, issueCredentialMock, learnCard } = getLearnCard();
+
+        const refreshableCredential = {
+            ...credential,
+            refreshService: {
+                id: 'https://network.learncard.test/api/credential-refreshes/refresh-1',
+                type: 'LearnCardCredentialRefresh2026',
+            },
+        };
+
+        await issueCredential(initLearnCard as never)(
+            learnCard as never,
+            refreshableCredential as never,
+            { type: 'Ed25519Signature2020' }
+        );
+
+        const options = issueCredentialMock.mock.calls[0][1] as ProofOptionsForTest;
+
+        expect(options.type).toBe('Ed25519Signature2020');
+        expect(options.cryptosuite).toBeUndefined();
+
+        const payload = issueCredentialMock.mock.calls[0][0] as Credential;
+
+        expect((payload['@context'] as unknown[]).at(-1)).toEqual(MANAGED_REFRESH_SERVICE_CONTEXT);
+    });
 });

package/src/issueCredential.ts

@@ -1,5 +1,6 @@
 import { UnsignedVC } from '@learncard/types';
 
+import { prepareManagedRefreshContext } from '@learncard/helpers';
 import { ProofOptions } from '@learncard/didkit-plugin';
 import { VCDependentLearnCard, VCImplicitLearnCard } from './types';
 import { getDefaultVerificationMethod } from './helpers';
@@ -14,9 +15,14 @@ export const issueCredential = (initLearnCard: VCDependentLearnCard) => {
 
         if (!kp) throw new Error('Cannot issue credential: Could not get subject keypair');
 
-        const contexts = Array.isArray(credential['@context'])
-            ? credential['@context']
-            : [credential['@context']];
+        // Credentials carrying a LearnCard-managed refresh service need the inline
+        // JSON-LD context fragment that defines its terms; sign the prepared payload.
+        // Untouched credentials (no managed service) pass through by reference.
+        const preparedCredential = prepareManagedRefreshContext(credential);
+
+        const contexts = Array.isArray(preparedCredential['@context'])
+            ? preparedCredential['@context']
+            : [preparedCredential['@context']];
 
         const hasV2Context = contexts.some(
             ctx =>
@@ -28,8 +34,8 @@ export const issueCredential = (initLearnCard: VCDependentLearnCard) => {
         const proofType =
             hasV2Context && signingOptions.type === 'Ed25519Signature2018'
                 ? 'Ed25519Signature2020'
-                : signingOptions.type ??
-                  (signingOptions.proofFormat === 'jwt' ? undefined : 'DataIntegrityProof');
+                : (signingOptions.type ??
+                  (signingOptions.proofFormat === 'jwt' ? undefined : 'DataIntegrityProof'));
 
         const options: ProofOptions = {
             proofPurpose: 'assertionMethod',
@@ -43,17 +49,19 @@ export const issueCredential = (initLearnCard: VCDependentLearnCard) => {
 
         if (!('verificationMethod' in options)) {
             const issuerDid =
-                typeof credential.issuer === 'string' ? credential.issuer : credential.issuer.id!;
+                typeof preparedCredential.issuer === 'string'
+                    ? preparedCredential.issuer
+                    : preparedCredential.issuer.id!;
 
             options.verificationMethod = await getDefaultVerificationMethod(learnCard, issuerDid);
         }
 
         learnCard.debug?.('Signing with these options', {
-            credential,
+            credential: preparedCredential,
             options,
             kp,
         });
 
-        return initLearnCard.invoke.issueCredential(credential, options, kp);
+        return initLearnCard.invoke.issueCredential(preparedCredential, options, kp);
     };
 };