@originator-profile/securing-mechanism 0.5.2 → 0.5.3

package/dist/index.cjs

@@ -0,0 +1,188 @@
+'use strict';
+
+var jose = require('jose');
+var cryptography = require('@originator-profile/cryptography');
+var errors = require('jose/errors');
+
+class VcVerifyFailed extends Error {
+  constructor(message, result) {
+    super(message);
+    this.result = result;
+  }
+  static get code() {
+    return "ERR_VC_VERIFY_FAILED";
+  }
+  code = VcVerifyFailed.code;
+}
+class VcDecodeFailed extends Error {
+  constructor(message, result) {
+    super(message);
+    this.result = result;
+  }
+  static get code() {
+    return "ERR_VC_DECODE_FAILED";
+  }
+  code = VcDecodeFailed.code;
+}
+class VcValidateFailed extends Error {
+  constructor(message, result) {
+    super(message);
+    this.result = result;
+  }
+  static get code() {
+    return "ERR_VC_VALIDATION_FAILED";
+  }
+  code = VcValidateFailed.code;
+}
+
+const constructFromSymbol = Symbol.for("constructDateFrom");
+
+function constructFrom(date, value) {
+  if (typeof date === "function") return date(value);
+  if (date && typeof date === "object" && constructFromSymbol in date)
+    return date[constructFromSymbol](value);
+  if (date instanceof Date) return new date.constructor(value);
+  return new Date(value);
+}
+
+function toDate(argument, context) {
+  return constructFrom(argument, argument);
+}
+
+function fromUnixTime(unixTime, options) {
+  return toDate(unixTime * 1e3);
+}
+
+function getUnixTime(date) {
+  return Math.trunc(+toDate(date) / 1e3);
+}
+
+function toUnverifiedJwtVc(payload, protectedHeader, jwt) {
+  const {
+    aud: _aud,
+    exp,
+    iat,
+    iss: _iss,
+    jti: _jti,
+    nbf: _nbf,
+    sub: _sub,
+    ...rest
+  } = payload;
+  const { alg, typ } = protectedHeader;
+  const doc = rest;
+  return {
+    doc,
+    issuedAt: iat ? fromUnixTime(iat) : void 0,
+    expiredAt: exp ? fromUnixTime(exp) : void 0,
+    mediaType: typ && `application/${typ}`,
+    algorithm: alg,
+    source: jwt
+  };
+}
+function toVerifiedJwtVc(payload, protectedHeader, jwt, key) {
+  const unverified = toUnverifiedJwtVc(payload, protectedHeader, jwt);
+  const verificationKey = {
+    ...key,
+    kid: protectedHeader.kid
+  };
+  return { ...unverified, verificationKey, validated: false };
+}
+
+function JwtVcDecoder() {
+  function decode(jwt) {
+    let payload;
+    let protectedHeader;
+    try {
+      payload = jose.decodeJwt(jwt);
+      protectedHeader = jose.decodeProtectedHeader(jwt);
+    } catch (e) {
+      const error = e;
+      return new VcDecodeFailed(
+        "JWT VC Decoding Failure",
+        {
+          source: jwt,
+          error
+        }
+      );
+    }
+    return toUnverifiedJwtVc(payload, protectedHeader, jwt);
+  }
+  return decode;
+}
+
+async function signJwtVc(vc, privateKey, options) {
+  const payload = vc;
+  const { alg = "ES256", issuedAt, expiredAt } = options;
+  const header = {
+    alg,
+    kid: privateKey.kid ?? await cryptography.createThumbprint(privateKey, alg),
+    typ: "vc+jwt",
+    cty: "vc"
+  };
+  const privateKeyImported = await jose.importJWK(privateKey, alg);
+  const jwt = await new jose.SignJWT(payload).setProtectedHeader(header).setIssuer(vc.issuer).setSubject(vc.credentialSubject.id).setIssuedAt(getUnixTime(issuedAt)).setExpirationTime(getUnixTime(expiredAt)).sign(privateKeyImported);
+  return jwt;
+}
+
+function JwtVcVerifier(keys, issuer, validator) {
+  async function verify(jwt) {
+    const verified = await jose.jwtVerify(jwt, keys, { issuer }).catch(
+      (e) => e
+    );
+    if (verified instanceof errors.JOSEError) {
+      return new VcVerifyFailed(
+        "JWT VC Verification Failure",
+        {
+          source: jwt,
+          error: verified
+        }
+      );
+    }
+    const { payload, protectedHeader, key } = verified;
+    const jwk = await jose.exportJWK(key);
+    const vc = toVerifiedJwtVc(payload, protectedHeader, jwt, jwk);
+    if (!validator) return vc;
+    const validated = validator(vc);
+    if (validated instanceof VcValidateFailed) return validated;
+    validated.validated = true;
+    return validated;
+  }
+  return verify;
+}
+
+class SchemaValidationError extends Error {
+  constructor(issues) {
+    super(issues.map((i) => `${i.path}: ${i.message}`).join("; "));
+    this.issues = issues;
+    this.name = "SchemaValidationError";
+  }
+}
+
+function VcValidator(schema) {
+  function validate(vc) {
+    const result = schema.safeParse(vc.doc);
+    if (!result.success) {
+      const issues = result.error.issues.map((i) => ({
+        path: i.path.join("."),
+        message: i.message
+      }));
+      return new VcValidateFailed(result.error.message, {
+        ...vc,
+        error: new SchemaValidationError(issues)
+      });
+    }
+    return vc;
+  }
+  return validate;
+}
+
+exports.JwtVcDecoder = JwtVcDecoder;
+exports.JwtVcVerifier = JwtVcVerifier;
+exports.SchemaValidationError = SchemaValidationError;
+exports.VcDecodeFailed = VcDecodeFailed;
+exports.VcValidateFailed = VcValidateFailed;
+exports.VcValidator = VcValidator;
+exports.VcVerifyFailed = VcVerifyFailed;
+exports.signJwtVc = signJwtVc;
+exports.toUnverifiedJwtVc = toUnverifiedJwtVc;
+exports.toVerifiedJwtVc = toVerifiedJwtVc;

package/dist/index.d.mts

@@ -0,0 +1,151 @@
+import { OpVc, Jwk } from '@originator-profile/model';
+import { JWTInvalid, JOSEError } from 'jose/errors';
+import { JWTPayload, ProtectedHeaderParameters } from 'jose';
+import { Keys } from '@originator-profile/cryptography';
+import { ZodType } from 'zod';
+
+/** 未復号 VC */
+type UndecodedVc = {
+    /** ソース */
+    source: unknown;
+};
+/** 未検証 VC */
+type UnverifiedVc<T extends OpVc = OpVc> = UndecodedVc & {
+    /** VC DM 2.0 文書 */
+    doc: T;
+    /** 発行日 */
+    issuedAt?: Date;
+    /** 有効期限 */
+    expiredAt?: Date;
+    /** メディアタイプ */
+    mediaType?: string;
+    /** 暗号アルゴリズム */
+    algorithm?: string;
+};
+/** 検証済み VC */
+type VerifiedVc<T extends OpVc = OpVc> = UnverifiedVc<T> & {
+    /** 検証鍵 */
+    verificationKey: Jwk;
+    /** 妥当性確認済みか否か */
+    validated: boolean;
+};
+type WithError<V extends object, E extends Error = Error> = V & {
+    error: E;
+};
+/** スキーマ検証エラーの issue */
+type SchemaIssue = {
+    path: string;
+    message: string;
+};
+/** スキーマ検証エラー */
+declare class SchemaValidationError extends Error {
+    issues: SchemaIssue[];
+    constructor(issues: SchemaIssue[]);
+}
+/** VC 復号失敗 */
+type VcDecodingFailure<V extends UndecodedVc = UndecodedVc, E extends Error = Error> = WithError<V, E>;
+/** VC 妥当性確認失敗 */
+type VcValidationFailure<V extends UnverifiedVc = UnverifiedVc> = WithError<V, SchemaValidationError>;
+/** VC 検証失敗 */
+type VcVerificationFailure<V extends UndecodedVc = UndecodedVc, E extends Error = Error> = WithError<V, E>;
+/** VC 復号結果 */
+type VcDecodingResult<Success extends UnverifiedVc, Failure extends VcDecodingFailure> = Success | VcDecodeFailed<Failure>;
+/** VC 妥当性確認結果 */
+type VcValidationResult<Success extends UnverifiedVc, Failure extends VcValidationFailure> = Success | VcValidateFailed<VcValidationFailure<Failure>>;
+/** VC 検証結果 */
+type VcVerificationResult<Success extends VerifiedVc, Failure extends VcVerificationFailure> = Success | VcVerifyFailed<VcVerificationFailure<Failure>>;
+
+/** VC 検証失敗 */
+declare class VcVerifyFailed<T extends VcVerificationFailure> extends Error {
+    result: T;
+    static get code(): string;
+    readonly code: string;
+    constructor(message: string, result: T);
+}
+/** VC 復号失敗 */
+declare class VcDecodeFailed<T extends VcDecodingFailure> extends Error {
+    result: T;
+    static get code(): string;
+    readonly code: string;
+    constructor(message: string, result: T);
+}
+/**
+ * VC 妥当性確認失敗
+ *
+ * VC の妥当性確認に失敗しました。次の原因で使用されます。
+ *
+ * - データモデルへの適合性確認に失敗した
+ *
+ * */
+declare class VcValidateFailed<T extends VcValidationFailure> extends Error {
+    result: T;
+    static get code(): string;
+    readonly code: string;
+    constructor(message: string, result: T);
+}
+
+/** 未復号 VC */
+type UndecodedJwtVc = {
+    /** JWT */
+    source: string;
+};
+/** 未検証 JWT VC */
+type UnverifiedJwtVc<T extends OpVc> = UndecodedJwtVc & UnverifiedVc<T>;
+/** 検証済み JWT VC */
+type VerifiedJwtVc<T extends OpVc> = UnverifiedJwtVc<T> & VerifiedVc<T>;
+/** JWT VC 復号失敗 */
+type JwtVcDecodingFailure = VcDecodingFailure<UndecodedJwtVc, JWTInvalid | TypeError>;
+/** JWT VC 検証失敗 */
+type JwtVcVerificationFailure = VcVerificationFailure<UndecodedJwtVc, JOSEError>;
+/** JWT VC 妥当性確認結果 */
+type JwtVcValidationResult<T extends OpVc> = VcValidationResult<VerifiedJwtVc<T>, VcValidationFailure<VerifiedJwtVc<T>>>;
+/** JWT VC 復号結果 */
+type JwtVcDecodingResult<T extends OpVc> = VcDecodingResult<UnverifiedJwtVc<T>, JwtVcDecodingFailure>;
+/** JWT VC 検証結果 */
+type JwtVcVerificationResult<T extends OpVc> = VcVerificationResult<VerifiedJwtVc<T>, JwtVcVerificationFailure> | JwtVcValidationResult<T>;
+
+/**
+ * データモデルの復号器の生成
+ * @return 復号器
+ */
+declare function JwtVcDecoder<T extends OpVc>(): (jwt: string) => JwtVcDecodingResult<T>;
+type JwtVcDecoder<T extends OpVc> = ReturnType<typeof JwtVcDecoder<T>>;
+
+declare function toUnverifiedJwtVc<T extends OpVc>(payload: JWTPayload, protectedHeader: ProtectedHeaderParameters, jwt: string): UnverifiedJwtVc<T>;
+declare function toVerifiedJwtVc<T extends OpVc>(payload: JWTPayload, protectedHeader: ProtectedHeaderParameters, jwt: string, key: Jwk): VerifiedJwtVc<T>;
+
+type SignableVc = {
+    issuer: string;
+    credentialSubject: {
+        id: string;
+    };
+};
+/**
+ * VC への署名
+ * @param vc VC オブジェクト
+ * @param privateKey プライベートキー
+ * @return JWT でエンコードされた VC
+ */
+declare function signJwtVc<T extends SignableVc>(vc: T, privateKey: Jwk, options: {
+    alg?: string;
+    issuedAt: Date;
+    expiredAt: Date;
+}): Promise<string>;
+
+/** データモデルへの適合性確認のためのバリデーター */
+declare function VcValidator<V extends UnverifiedVc>(schema: ZodType): (vc: V) => VcValidationResult<V, VcValidationFailure<V>>;
+/** データモデルへの適合性確認のためのバリデーター */
+type VcValidator<V extends UnverifiedVc> = ReturnType<typeof VcValidator<V>>;
+
+/**
+ * JWT VC の検証者の作成
+ * @param keys 公開鍵
+ * @param issuer 公開鍵の有効な発行者
+ * @param validator バリデーター
+ * @return 検証者
+ */
+declare function JwtVcVerifier<T extends OpVc>(keys: Keys, issuer: string | string[], validator?: VcValidator<VerifiedJwtVc<T>>): (jwt: string) => Promise<JwtVcVerificationResult<T>>;
+type JwtVcVerifier<T extends OpVc> = ReturnType<typeof JwtVcVerifier<T>>;
+
+export { JwtVcDecoder, JwtVcVerifier, SchemaValidationError, VcDecodeFailed, VcValidateFailed, VcValidator, VcVerifyFailed, signJwtVc, toUnverifiedJwtVc, toVerifiedJwtVc };
+export type { JwtVcDecodingFailure, JwtVcDecodingResult, JwtVcValidationResult, JwtVcVerificationFailure, JwtVcVerificationResult, SchemaIssue, UndecodedJwtVc, UndecodedVc, UnverifiedJwtVc, UnverifiedVc, VcDecodingFailure, VcDecodingResult, VcValidationFailure, VcValidationResult, VcVerificationFailure, VcVerificationResult, VerifiedJwtVc, VerifiedVc };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@originator-profile/securing-mechanism",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "license": "Apache-2.0",
   "homepage": "https://docs.originator-profile.org",
   "repository": {
@@ -13,8 +13,14 @@
   },
   "type": "module",
   "exports": {
-    "types": "./dist/index.d.ts",
-    "default": "./dist/index.js"
+    "require": {
+      "types": "./dist/index.d.cts",
+      "default": "./dist/index.cjs"
+    },
+    "import": {
+      "types": "./dist/index.d.mts",
+      "default": "./dist/index.mjs"
+    }
   },
   "files": [
     "dist",
@@ -25,20 +31,20 @@
   "dependencies": {
     "jose": "^6.2.2",
     "zod": "^4.3.6",
-    "@originator-profile/cryptography": "0.5.2",
-    "@originator-profile/model": "0.5.2"
+    "@originator-profile/model": "0.5.3",
+    "@originator-profile/cryptography": "0.5.3"
   },
   "devDependencies": {
-    "date-fns": "4.1.0",
-    "eslint": "10.2.0",
-    "pkgroll": "2.27.0",
-    "typescript": "6.0.2",
-    "vitest": "4.1.4",
-    "eslint-config-originator-profile": "0.5.2",
-    "@originator-profile/tsconfig": "0.5.2"
+    "date-fns": "^4.1.0",
+    "eslint": "^10.1.0",
+    "pkgroll": "^2.27.0",
+    "typescript": "^6.0.2",
+    "vitest": "^4.1.2",
+    "@originator-profile/tsconfig": "0.5.3",
+    "eslint-config-originator-profile": "0.5.3"
   },
   "scripts": {
-    "build": "pkgroll --clean-dist",
+    "build": "pkgroll --clean-dist --target=node20",
     "test": "vitest run",
     "lint": "eslint --fix .",
     "type-check": "tsc --noEmit"