@originator-profile/verify 0.6.0-beta.1 → 0.6.0-beta.2

package/README.md

@@ -1,3 +1,30 @@
 # Profile Verify
 
 署名を検証するためのパッケージです。
+
+<!-- prettier-ignore-start -->
+<!-- environments-start -->
+
+<!-- NOTE: Auto-generated by ../../scripts/update-readme-environments.ts from package.json, .github/workflows/test.yml, Dockerfile, and manifest.json. Edit the source, not this section. -->
+
+## Environment
+
+### Verified
+
+- OS: Ubuntu 24.04
+
+### Development
+
+- Node.js: `^22.18.0 || ^24.10.0 || ^26.2.0`
+- pnpm: `11.0.9`
+
+<!-- environments-stop -->
+<!-- prettier-ignore-end -->
+
+### Verified
+
+- Browser: Modern browsers with Web Crypto API (bundled in OP Inspector)
+
+### Incompatible
+
+- Environments without Web Crypto API: Requires Web Crypto API (SubtleCrypto).

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { ContentAttestation, Image, Target, ContentAttestationSet, OpVc, Jwk, ArticleCA, Certificate as Certificate$1, CoreProfile, WebMediaProfile, WebsiteProfile, JapaneseExistenceCertificate, ProfileAnnotation, JapaneseExistencePA, ProfileAnnotationIssuerRegistration, OriginatorProfileSet, Jwks, SiteProfile, AllowedOrigin } from '@originator-profile/model';
+import { ContentAttestation, Image, Target, ContentAttestationSet, OpVc, Jwk, ArticleCA, Certificate as Certificate$1, CoreProfile, WebMediaProfile, WebsiteProfile, JapaneseExistenceCertificate, ProfileAnnotation, JapaneseExistencePA, ProfileAnnotationIssuerRegistration, OriginatorProfileSet, ProfileAnnotationPolicy, CertificationSystem, Jwks, SiteProfile, AllowedOrigin } from '@originator-profile/model';
 import { JwtVcDecodingResult, UnverifiedJwtVc, JwtVcVerificationResult, VerifiedJwtVc, VcValidator } from '@originator-profile/securing-mechanism';
 import { Keys } from '@originator-profile/cryptography';
 import { DigestSriResult, ContentFetcher, ElementSelector } from '@originator-profile/sign';
@@ -394,6 +394,24 @@ type OpsVerificationResult = VerifiedOps | OpsInvalid | OpsVerifyFailed;
  */
 declare function decodeOps(ops: OriginatorProfileSet): OpsDecodingResult;
 
+/** 新形式 PA の `credentialSubject.annotation` と旧 Certificate 形式の `credentialSubject.certificationSystem` 存在するほうを返す */
+declare function getAnnotationPolicy(doc: Certificate): ProfileAnnotationPolicy | CertificationSystem;
+/** Profile Annotation Issuer 登録証 PA かどうか */
+declare function isProfileAnnotationIssuerRegistration(doc: Certificate): doc is ProfileAnnotationIssuerRegistration;
+/**
+ * Profile Annotation Issuer 登録証 PA に基づく発行者の認可を確認
+ *
+ * 各 Profile Annotation の発行者が、Core Profile Issuer から発行された登録証 PA によって、その PA が準拠する 認証制度（Profile Annotation Policy）の発行を認可されているかを検証
+ *
+ * (2027年まで) 後方互換性のため、認可を確認できない場合も検証は失敗させず console.warn に留める。
+ *
+ * @param verifiedOps 検証済み Originator Profile Set
+ * @param cpIssuer 基底となる Core Profile Issuer の OP ID
+ *
+ * @see https://docs.originator-profile.org/opb/pa-model/profile-annotation-issuer-registration/
+ */
+declare function verifyAnnotationIssuerRegistration(verifiedOps: VerifiedOps, cpIssuer: string | string[]): VerifiedOps;
+
 /**
  * Originator Profile Set の検証者の作成
  * @param ops Originator Profile Set
@@ -468,5 +486,5 @@ declare function SpVerifier(sp: SiteProfile, keys: Keys, issuer: string | string
  */
 declare function verifyAllowedOrigin(origin: URL["origin"], allowedOrigins: AllowedOrigin): boolean;
 
-export { CaInvalid, CaVerifier, CaVerifyFailed, CasVerifyFailed, CertificateExpired, CoreProfileNotFound, IntegrityFetchFailed, IntegrityVerificationFailed, OpInvalid, OpVerifyFailed, OpsInvalid, OpsVerifier, OpsVerifyFailed, SiteProfileInvalid, SiteProfileVerifyFailed, SpVerifier, TargetIntegrityAlgorithm, VerifyResultFactory, article, caId, caUrl, certificate, cp, decodeOps, getMappedKeys, getTupledKeys, normalizeCasItem, opId, patch, verifyAllowedOrigin, verifyCas, verifyDigestSri, verifyImageDigestSri, verifyIntegrity, wmp, wsp };
+export { CaInvalid, CaVerifier, CaVerifyFailed, CasVerifyFailed, CertificateExpired, CoreProfileNotFound, IntegrityFetchFailed, IntegrityVerificationFailed, OpInvalid, OpVerifyFailed, OpsInvalid, OpsVerifier, OpsVerifyFailed, SiteProfileInvalid, SiteProfileVerifyFailed, SpVerifier, TargetIntegrityAlgorithm, VerifyResultFactory, article, caId, caUrl, certificate, cp, decodeOps, getAnnotationPolicy, getMappedKeys, getTupledKeys, isProfileAnnotationIssuerRegistration, normalizeCasItem, opId, patch, verifyAllowedOrigin, verifyAnnotationIssuerRegistration, verifyCas, verifyDigestSri, verifyImageDigestSri, verifyIntegrity, wmp, wsp };
 export type { CaDecodingFailure, CaDecodingResult, CaVerificationFailure, CaVerificationResult, CasItem, CasVerificationFailure, CasVerificationResult, Certificate, DecodedCa, DecodedOp, DecodedOps, FetchIntegrityResult, IntegrityVerifyResult, MappedKeys, OpDecodingFailure, OpDecodingResult, OpVerificationFailure, OpVerificationResult, OpsDecodingFailure, OpsDecodingResult, OpsVerificationFailure, OpsVerificationResult, SpVerificationFailure, SpVerificationResult, TupledKeys, VerifiedCa, VerifiedCas, VerifiedOp, VerifiedOps, VerifiedSp, VerifyIntegrity };

package/dist/index.js

@@ -998,6 +998,68 @@ function decodeOps(ops) {
   return resultOps;
 }
 
+function getAnnotationPolicy(doc) {
+  return "annotation" in doc.credentialSubject ? doc.credentialSubject.annotation : doc.credentialSubject.certificationSystem;
+}
+const isProfileAnnotation = (doc) => doc.type.includes("ProfileAnnotation");
+function isProfileAnnotationIssuerRegistration(doc) {
+  return doc.credentialSubject.type === "ProfileAnnotationIssuerRegistration";
+}
+function buildProfileAnnotationPolicy(verifiedOps, cpIssuers) {
+  const policy = /* @__PURE__ */ new Map();
+  const annotations = verifiedOps.flatMap((op) => op.annotations ?? []);
+  for (const { doc } of annotations) {
+    if (!isProfileAnnotationIssuerRegistration(doc)) continue;
+    if (!cpIssuers.has(doc.issuer)) continue;
+    const { id: registrationIssuer, annotationScheme } = doc.credentialSubject;
+    const allowedPolicy = policy.get(registrationIssuer) ?? /* @__PURE__ */ new Set();
+    for (const scheme of annotationScheme) allowedPolicy.add(scheme);
+    policy.set(registrationIssuer, allowedPolicy);
+  }
+  return policy;
+}
+function reportUnauthorizedAnnotation({
+  annotation,
+  opIndex,
+  paIndex,
+  policy,
+  cpIssuers
+}) {
+  const { doc } = annotation;
+  const { issuer: profileAnnotationIssuer } = doc;
+  const location = `OP[${opIndex}].PA[${paIndex}]`;
+  if (!isProfileAnnotation(doc)) {
+    console.warn(`Certificate is deprecated (${location})`);
+    return;
+  }
+  if (isProfileAnnotationIssuerRegistration(doc) && cpIssuers.has(profileAnnotationIssuer)) {
+    return;
+  }
+  const policyId = getAnnotationPolicy(doc)?.id;
+  const isAllowed = policyId && policy.get(profileAnnotationIssuer)?.has(policyId);
+  if (!isAllowed) {
+    console.warn(
+      `Profile Annotation Issuer is not registered for this annotation scheme (${location} issuer: ${profileAnnotationIssuer}, scheme: ${policyId ?? "unknown"})`
+    );
+  }
+}
+function verifyAnnotationIssuerRegistration(verifiedOps, cpIssuer) {
+  const cpIssuers = new Set([cpIssuer].flat());
+  const policy = buildProfileAnnotationPolicy(verifiedOps, cpIssuers);
+  for (const [opIndex, op] of verifiedOps.entries()) {
+    for (const [paIndex, annotation] of op.annotations?.entries() ?? []) {
+      reportUnauthorizedAnnotation({
+        annotation,
+        opIndex,
+        paIndex,
+        policy,
+        cpIssuers
+      });
+    }
+  }
+  return verifiedOps;
+}
+
 function OpVerifier(paOrWmpIssuerKeys, vc, validator) {
   const issuer = vc.doc.issuer;
   const jwks = paOrWmpIssuerKeys[issuer];
@@ -1136,7 +1198,7 @@ function OpsVerifier(ops, keys, issuer, validator) {
       const msg = verifyFailedIndexes.length > 0 ? `Originator Profile Set verify failed (${verifyFailedIndexes.map((i) => `OP[${i}]`).join(", ")})` : "Originator Profile Set verify failed";
       return new OpsVerifyFailed(msg, resultOps);
     }
-    return resultOps;
+    return verifyAnnotationIssuerRegistration(resultOps, issuer);
   }
   return verify;
 }
@@ -1263,4 +1325,4 @@ function SpVerifier(sp, keys, issuer, origin, verifyOrigin = true, validator) {
   return verify;
 }
 
-export { CaInvalid, CaVerifier, CaVerifyFailed, CasVerifyFailed, CertificateExpired, CoreProfileNotFound, IntegrityFetchFailed, IntegrityVerificationFailed, OpInvalid, OpVerifyFailed, OpsInvalid, OpsVerifier, OpsVerifyFailed, SiteProfileInvalid, SiteProfileVerifyFailed, SpVerifier, TargetIntegrityAlgorithm, VerifyResultFactory, article, caId, caUrl, certificate, cp, decodeOps, getMappedKeys, getTupledKeys, normalizeCasItem, opId, patch, verifyAllowedOrigin, verifyCas, verifyDigestSri, verifyImageDigestSri, verifyIntegrity, wmp, wsp };
+export { CaInvalid, CaVerifier, CaVerifyFailed, CasVerifyFailed, CertificateExpired, CoreProfileNotFound, IntegrityFetchFailed, IntegrityVerificationFailed, OpInvalid, OpVerifyFailed, OpsInvalid, OpsVerifier, OpsVerifyFailed, SiteProfileInvalid, SiteProfileVerifyFailed, SpVerifier, TargetIntegrityAlgorithm, VerifyResultFactory, article, caId, caUrl, certificate, cp, decodeOps, getAnnotationPolicy, getMappedKeys, getTupledKeys, isProfileAnnotationIssuerRegistration, normalizeCasItem, opId, patch, verifyAllowedOrigin, verifyAnnotationIssuerRegistration, verifyCas, verifyDigestSri, verifyImageDigestSri, verifyIntegrity, wmp, wsp };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@originator-profile/verify",
-  "version": "0.6.0-beta.1",
+  "version": "0.6.0-beta.2",
   "license": "Apache-2.0",
   "homepage": "https://docs.originator-profile.org",
   "repository": {
@@ -27,11 +27,11 @@
     "jose": "^6.2.2",
     "jsonld": "^9.0.0",
     "zod": "^4.3.6",
-    "@originator-profile/core": "0.6.0-beta.1",
-    "@originator-profile/model": "0.6.0-beta.1",
-    "@originator-profile/cryptography": "0.6.0-beta.1",
-    "@originator-profile/securing-mechanism": "0.6.0-beta.1",
-    "@originator-profile/sign": "0.6.0-beta.1"
+    "@originator-profile/core": "0.6.0-beta.2",
+    "@originator-profile/cryptography": "0.6.0-beta.2",
+    "@originator-profile/model": "0.6.0-beta.2",
+    "@originator-profile/sign": "0.6.0-beta.2",
+    "@originator-profile/securing-mechanism": "0.6.0-beta.2"
   },
   "devDependencies": {
     "@playwright/test": "1.59.1",
@@ -47,8 +47,8 @@
     "vite": "8.0.8",
     "vitest": "4.1.4",
     "websri": "1.0.1",
-    "@originator-profile/tsconfig": "0.6.0-beta.1",
-    "eslint-config-originator-profile": "0.6.0-beta.1"
+    "@originator-profile/tsconfig": "0.6.0-beta.2",
+    "eslint-config-originator-profile": "0.6.0-beta.2"
   },
   "scripts": {
     "build": "pkgroll --clean-dist",