@nuggetslife/vc 0.0.21 → 0.0.24

package/test_sd_jwt.mjs

@@ -0,0 +1,197 @@
+import test from 'node:test';
+import assert from 'node:assert';
+import {
+    JoseNamedCurve,
+    generateJwk,
+    sdJwtIssue,
+    sdJwtPresent,
+    sdJwtVerify,
+} from './index.js';
+
+function makeKeyPair(curve = JoseNamedCurve.P256) {
+    const jwk = generateJwk(curve);
+    const { d, ...pubJwk } = jwk;
+    return { privateJwk: jwk, publicJwk: pubJwk };
+}
+
+// =====================================================================
+// SD-JWT Round-Trip Tests
+// =====================================================================
+
+test('SD-JWT round-trip with ES256', () => {
+    const issuer = makeKeyPair(JoseNamedCurve.P256);
+
+    const claims = { sub: 'user123', name: 'Alice', email: 'alice@example.com', age: 30 };
+    const result = sdJwtIssue(claims, ['name', 'email'], issuer.privateJwk, 'ES256');
+
+    assert.ok(result.sdJwt, 'sd_jwt is present');
+    assert.ok(result.sdJwt.includes('~'), 'sd_jwt contains tilde separators');
+    assert.equal(result.disclosures.length, 2, 'two disclosures');
+
+    // Present all disclosures
+    const allEncoded = result.disclosures.map(d => d.encoded);
+    const presentation = sdJwtPresent(result.sdJwt, allEncoded);
+
+    assert.ok(presentation.presentation, 'presentation is present');
+
+    // Verify
+    const verified = sdJwtVerify(presentation.presentation, issuer.publicJwk);
+    assert.ok(verified.verified, 'verification succeeded');
+    assert.equal(verified.claims.sub, 'user123');
+    assert.equal(verified.claims.name, 'Alice');
+    assert.equal(verified.claims.email, 'alice@example.com');
+    assert.equal(verified.claims.age, 30);
+    assert.equal(verified.error, null);
+});
+
+test('SD-JWT round-trip with EdDSA (Ed25519)', () => {
+    const issuer = makeKeyPair(JoseNamedCurve.Ed25519);
+
+    const claims = { sub: 'user456', name: 'Bob' };
+    const result = sdJwtIssue(claims, ['name'], issuer.privateJwk, 'EdDSA');
+
+    assert.equal(result.disclosures.length, 1);
+
+    const allEncoded = result.disclosures.map(d => d.encoded);
+    const presentation = sdJwtPresent(result.sdJwt, allEncoded);
+    const verified = sdJwtVerify(presentation.presentation, issuer.publicJwk);
+
+    assert.ok(verified.verified);
+    assert.equal(verified.claims.name, 'Bob');
+});
+
+// =====================================================================
+// Selective Reveal
+// =====================================================================
+
+test('SD-JWT selective reveal: only name disclosed', () => {
+    const issuer = makeKeyPair();
+
+    const claims = { sub: 'user123', name: 'Alice', email: 'alice@example.com', age: 30 };
+    const result = sdJwtIssue(claims, ['name', 'email', 'age'], issuer.privateJwk, 'ES256');
+
+    // Only reveal name
+    const nameDisclosure = result.disclosures.find(d => d.claimName === 'name');
+    const presentation = sdJwtPresent(result.sdJwt, [nameDisclosure.encoded]);
+    const verified = sdJwtVerify(presentation.presentation, issuer.publicJwk);
+
+    assert.ok(verified.verified);
+    assert.equal(verified.claims.sub, 'user123', 'sub is always visible');
+    assert.equal(verified.claims.name, 'Alice', 'name is disclosed');
+    assert.equal(verified.claims.email, undefined, 'email is NOT disclosed');
+    assert.equal(verified.claims.age, undefined, 'age is NOT disclosed');
+});
+
+// =====================================================================
+// Wrong Key Rejection
+// =====================================================================
+
+test('SD-JWT verification fails with wrong issuer key', () => {
+    const issuer = makeKeyPair();
+    const wrongKey = makeKeyPair();
+
+    const claims = { sub: 'user', name: 'Test' };
+    const result = sdJwtIssue(claims, ['name'], issuer.privateJwk, 'ES256');
+
+    const allEncoded = result.disclosures.map(d => d.encoded);
+    const presentation = sdJwtPresent(result.sdJwt, allEncoded);
+
+    assert.throws(() => {
+        sdJwtVerify(presentation.presentation, wrongKey.publicJwk);
+    }, 'should throw with wrong key');
+});
+
+// =====================================================================
+// Nested Objects
+// =====================================================================
+
+test('SD-JWT with nested object disclosure', () => {
+    const issuer = makeKeyPair();
+
+    const claims = {
+        sub: 'user123',
+        address: {
+            street: '123 Main St',
+            city: 'Springfield',
+            state: 'IL',
+        },
+    };
+    const result = sdJwtIssue(
+        claims,
+        ['address.street', 'address.city'],
+        issuer.privateJwk,
+        'ES256',
+    );
+
+    assert.equal(result.disclosures.length, 2);
+
+    // Reveal only street
+    const streetDisclosure = result.disclosures.find(d => d.claimName === 'street');
+    const presentation = sdJwtPresent(result.sdJwt, [streetDisclosure.encoded]);
+    const verified = sdJwtVerify(presentation.presentation, issuer.publicJwk);
+
+    assert.ok(verified.verified);
+    assert.equal(verified.claims.address.street, '123 Main St');
+    assert.equal(verified.claims.address.state, 'IL', 'state always visible');
+    assert.equal(verified.claims.address.city, undefined, 'city not disclosed');
+});
+
+// =====================================================================
+// Key Binding
+// =====================================================================
+
+test('SD-JWT with Key Binding JWT', () => {
+    const issuer = makeKeyPair();
+    const holder = makeKeyPair();
+
+    const claims = { sub: 'user123', name: 'Alice' };
+    const result = sdJwtIssue(
+        claims,
+        ['name'],
+        issuer.privateJwk,
+        'ES256',
+        holder.publicJwk,
+    );
+
+    const allEncoded = result.disclosures.map(d => d.encoded);
+    const presentation = sdJwtPresent(
+        result.sdJwt,
+        allEncoded,
+        holder.privateJwk,
+        'ES256',
+        'https://verifier.example.com',
+        'nonce123',
+    );
+
+    const verified = sdJwtVerify(
+        presentation.presentation,
+        issuer.publicJwk,
+        holder.publicJwk,
+        'https://verifier.example.com',
+        'nonce123',
+    );
+
+    assert.ok(verified.verified);
+    assert.equal(verified.claims.name, 'Alice');
+    assert.equal(verified.error, null);
+});
+
+// =====================================================================
+// Decoys
+// =====================================================================
+
+test('SD-JWT with decoy digests', () => {
+    const issuer = makeKeyPair();
+
+    const claims = { sub: 'user123', name: 'Alice' };
+    const result = sdJwtIssue(claims, ['name'], issuer.privateJwk, 'ES256', null, 3);
+
+    assert.equal(result.disclosures.length, 1, 'only 1 real disclosure');
+
+    const allEncoded = result.disclosures.map(d => d.encoded);
+    const presentation = sdJwtPresent(result.sdJwt, allEncoded);
+    const verified = sdJwtVerify(presentation.presentation, issuer.publicJwk);
+
+    assert.ok(verified.verified);
+    assert.equal(verified.claims.name, 'Alice');
+});