@originator-profile/verify 0.6.1 → 0.7.0-beta.2

package/README.md

@@ -1,5 +1,7 @@
 # Profile Verify
 
+[![npm version](https://img.shields.io/npm/v/@originator-profile/verify)](https://www.npmjs.com/package/@originator-profile/verify) [![jsDocs.io](https://img.shields.io/badge/jsDocs.io-reference-blue)](https://www.jsdocs.io/package/@originator-profile/verify)
+
 署名を検証するためのパッケージです。
 
 <!-- prettier-ignore-start -->

package/dist/index.d.ts

@@ -39,6 +39,15 @@ declare class CaVerifyFailed extends Error {
     constructor(message: string, result: CaVerificationFailure);
 }
 
+/**
+ * 検証中の警告メッセージを受け取るハンドラー
+ *
+ * 検証を失敗とはしない後方互換性のための警告 (非推奨 Certificate や
+ * digestSRI の欠落・不一致など) の通知に使用する。
+ * デフォルトは `console.warn`。
+ */
+type WarnHandler = (message: string) => void;
+
 /**
  * `digestSRI` の検証
  * @see {@link https://www.w3.org/TR/SRI/#the-integrity-attribute}
@@ -55,9 +64,14 @@ declare class CaVerifyFailed extends Error {
 declare function verifyDigestSri(content: DigestSriResult, fetcher?: typeof fetch): Promise<boolean>;
 /**
  * Image の digestSRI を検証する。
- * 後方互換性の観点で、2027年までは検証失敗時に console.warn のみで処理を中断しない。
+ * 後方互換性の観点で、2027年までは検証失敗時に warn のみで処理を中断しない。
  */
-declare function verifyImageDigestSri(value: Image | undefined, fetcher?: typeof fetch): Promise<void>;
+declare function verifyImageDigestSri(value: Image | undefined, options?: {
+    /** コンテンツの取得に用いる fetch 実装 */
+    fetcher?: typeof fetch;
+    /** 警告ハンドラー (デフォルト: `console.warn`) */
+    warn?: WarnHandler;
+}): Promise<void>;
 
 declare class IntegrityFetchFailed extends Error {
     static get code(): "ERR_INTEGRITY_FETCH_FAILED";
@@ -403,24 +417,30 @@ declare function isProfileAnnotationIssuerRegistration(doc: Certificate): doc is
  *
  * 各 Profile Annotation の発行者が、Core Profile Issuer から発行された登録証 PA によって、その PA が準拠する 認証制度（Profile Annotation Policy）の発行を認可されているかを検証
  *
- * (2027年まで) 後方互換性のため、認可を確認できない場合も検証は失敗させず console.warn に留める。
+ * (2027年まで) 後方互換性のため、認可を確認できない場合も検証は失敗させず warn に留める。
  *
  * @param verifiedOps 検証済み Originator Profile Set
  * @param cpIssuer 基底となる Core Profile Issuer の OP ID
+ * @param warn 警告ハンドラー (デフォルト: `console.warn`)
  *
  * @see https://docs.originator-profile.org/opb/pa-model/profile-annotation-issuer-registration/
  */
-declare function verifyAnnotationIssuerRegistration(verifiedOps: VerifiedOps, cpIssuer: string | string[]): VerifiedOps;
+declare function verifyAnnotationIssuerRegistration(verifiedOps: VerifiedOps, cpIssuer: string | string[], warn?: WarnHandler): VerifiedOps;
 
 /**
  * Originator Profile Set の検証者の作成
  * @param ops Originator Profile Set
  * @param keys Core Profile の発行者の検証鍵
  * @param issuer Core Profile の発行者
- * @param validator バリデーター
+ * @param options バリデーターと警告ハンドラー
  * @returns 検証者
  */
-declare function OpsVerifier(ops: OriginatorProfileSet, keys: Keys, issuer: string | string[], validator?: typeof VcValidator): () => Promise<OpsVerificationResult>;
+declare function OpsVerifier(ops: OriginatorProfileSet, keys: Keys, issuer: string | string[], options?: {
+    /** バリデーター */
+    validator?: typeof VcValidator;
+    /** 警告ハンドラー (デフォルト: `console.warn`) */
+    warn?: WarnHandler;
+}): () => Promise<OpsVerificationResult>;
 
 type OpId = string;
 /**
@@ -472,11 +492,17 @@ type SpVerificationResult = VerifiedSp | SiteProfileInvalid | SiteProfileVerifyF
  * @param keys Core Profile の発行者の検証鍵
  * @param issuer Core Profile の発行者
  * @param origin 提示するWebサイトを識別するための RFC 6454 オリジン
- * @param verifyOrigin WSPが提示されたWebサイトのorigin引数との一致性検証の可否 (デフォルト: 有効)
- * @param validator バリデーター
+ * @param options オリジン検証の可否・バリデーター・警告ハンドラー
  * @returns 検証者
  */
-declare function SpVerifier(sp: SiteProfile, keys: Keys, issuer: string | string[], origin: URL["origin"], verifyOrigin?: boolean, validator?: typeof VcValidator): () => Promise<SpVerificationResult>;
+declare function SpVerifier(sp: SiteProfile, keys: Keys, issuer: string | string[], origin: URL["origin"], options?: {
+    /** WSPが提示されたWebサイトのorigin引数との一致性検証の可否 (デフォルト: 有効) */
+    verifyOrigin?: boolean;
+    /** バリデーター */
+    validator?: typeof VcValidator;
+    /** 警告ハンドラー (デフォルト: `console.warn`) */
+    warn?: WarnHandler;
+}): () => Promise<SpVerificationResult>;
 
 /**
  * URLオリジンが対象のオリジンの中に含まれているのか検証する
@@ -487,4 +513,4 @@ declare function SpVerifier(sp: SiteProfile, keys: Keys, issuer: string | string
 declare function verifyAllowedOrigin(origin: URL["origin"], allowedOrigins: AllowedOrigin): boolean;
 
 export { CaInvalid, CaVerifier, CaVerifyFailed, CasVerifyFailed, CertificateExpired, CoreProfileNotFound, IntegrityFetchFailed, IntegrityVerificationFailed, OpInvalid, OpVerifyFailed, OpsInvalid, OpsVerifier, OpsVerifyFailed, SiteProfileInvalid, SiteProfileVerifyFailed, SpVerifier, TargetIntegrityAlgorithm, VerifyResultFactory, article, caId, caUrl, certificate, cp, decodeOps, getAnnotationPolicy, getMappedKeys, getTupledKeys, isProfileAnnotationIssuerRegistration, normalizeCasItem, opId, patch, verifyAllowedOrigin, verifyAnnotationIssuerRegistration, verifyCas, verifyDigestSri, verifyImageDigestSri, verifyIntegrity, wmp, wsp };
-export type { CaDecodingFailure, CaDecodingResult, CaVerificationFailure, CaVerificationResult, CasItem, CasVerificationFailure, CasVerificationResult, Certificate, DecodedCa, DecodedOp, DecodedOps, FetchIntegrityResult, IntegrityVerifyResult, MappedKeys, OpDecodingFailure, OpDecodingResult, OpVerificationFailure, OpVerificationResult, OpsDecodingFailure, OpsDecodingResult, OpsVerificationFailure, OpsVerificationResult, SpVerificationFailure, SpVerificationResult, TupledKeys, VerifiedCa, VerifiedCas, VerifiedOp, VerifiedOps, VerifiedSp, VerifyIntegrity };
+export type { CaDecodingFailure, CaDecodingResult, CaVerificationFailure, CaVerificationResult, CasItem, CasVerificationFailure, CasVerificationResult, Certificate, DecodedCa, DecodedOp, DecodedOps, FetchIntegrityResult, IntegrityVerifyResult, MappedKeys, OpDecodingFailure, OpDecodingResult, OpVerificationFailure, OpVerificationResult, OpsDecodingFailure, OpsDecodingResult, OpsVerificationFailure, OpsVerificationResult, SpVerificationFailure, SpVerificationResult, TupledKeys, VerifiedCa, VerifiedCas, VerifiedOp, VerifiedOps, VerifiedSp, VerifyIntegrity, WarnHandler };

package/dist/index.js

@@ -315,10 +315,11 @@ async function verifyDigestSri(content, fetcher = fetch) {
     return false;
   }
 }
-async function verifyImageDigestSri(value, fetcher = fetch) {
+async function verifyImageDigestSri(value, options = {}) {
+  const { fetcher = fetch, warn = console.warn } = options;
   if (!value) return;
   if (!value.digestSRI) {
-    console.warn(`digestSRI is missing. ${WARN_SUFFIX}`);
+    warn(`digestSRI is missing. ${WARN_SUFFIX}`);
     return;
   }
   const valid = await verifyDigestSri(
@@ -326,7 +327,7 @@ async function verifyImageDigestSri(value, fetcher = fetch) {
     fetcher
   );
   if (!valid) {
-    console.warn(`digestSRI verification failed. ${WARN_SUFFIX}`);
+    warn(`digestSRI verification failed. ${WARN_SUFFIX}`);
   }
 }
 
@@ -1023,13 +1024,14 @@ function reportUnauthorizedAnnotation({
   opIndex,
   paIndex,
   policy,
-  cpIssuers
+  cpIssuers,
+  warn
 }) {
   const { doc } = annotation;
   const { issuer: profileAnnotationIssuer } = doc;
   const location = `OP[${opIndex}].PA[${paIndex}]`;
   if (!isProfileAnnotation(doc)) {
-    console.warn(`Certificate is deprecated (${location})`);
+    warn(`Certificate is deprecated (${location})`);
     return;
   }
   if (isProfileAnnotationIssuerRegistration(doc) && cpIssuers.has(profileAnnotationIssuer)) {
@@ -1038,12 +1040,12 @@ function reportUnauthorizedAnnotation({
   const policyId = getAnnotationPolicy(doc)?.id;
   const isAllowed = policyId && policy.get(profileAnnotationIssuer)?.has(policyId);
   if (!isAllowed) {
-    console.warn(
+    warn(
       `Profile Annotation Issuer is not registered for this annotation scheme (${location} issuer: ${profileAnnotationIssuer}, scheme: ${policyId ?? "unknown"})`
     );
   }
 }
-function verifyAnnotationIssuerRegistration(verifiedOps, cpIssuer) {
+function verifyAnnotationIssuerRegistration(verifiedOps, cpIssuer, warn = console.warn) {
   const cpIssuers = new Set([cpIssuer].flat());
   const policy = buildProfileAnnotationPolicy(verifiedOps, cpIssuers);
   for (const [opIndex, op] of verifiedOps.entries()) {
@@ -1053,7 +1055,8 @@ function verifyAnnotationIssuerRegistration(verifiedOps, cpIssuer) {
         opIndex,
         paIndex,
         policy,
-        cpIssuers
+        cpIssuers,
+        warn
       });
     }
   }
@@ -1082,7 +1085,8 @@ function validateCertificateExpiry(verifiedVc) {
   }
   return verifiedVc;
 }
-async function verifyAnnotations(paIssuerKeys, annotations, validator) {
+async function verifyAnnotations(paIssuerKeys, annotations, options = {}) {
+  const { validator, warn } = options;
   if (!annotations) return;
   return await Promise.all(
     annotations.map(async (annotation) => {
@@ -1108,13 +1112,14 @@ async function verifyAnnotations(paIssuerKeys, annotations, validator) {
       if (valid instanceof CertificateExpired) {
         return valid;
       }
-      await verifyImageDigestSri(valid.doc.credentialSubject.image);
+      await verifyImageDigestSri(valid.doc.credentialSubject.image, { warn });
       return valid;
     })
   );
 }
 
-async function verifyMedia(wmpIssuerKeys, media, validator) {
+async function verifyMedia(wmpIssuerKeys, media, options = {}) {
+  const { validator, warn } = options;
   if (!media) return;
   return await Promise.all(
     media.map(async (m) => {
@@ -1127,7 +1132,7 @@ async function verifyMedia(wmpIssuerKeys, media, validator) {
       if (result instanceof Error) {
         return result;
       }
-      await verifyImageDigestSri(result.doc.credentialSubject.logo);
+      await verifyImageDigestSri(result.doc.credentialSubject.logo, { warn });
       return result;
     })
   );
@@ -1143,7 +1148,8 @@ function generateErrorDetails(items, opIndex, prefix, sources) {
   }).filter((d) => d !== null);
 }
 const isVerifiedOps = (ops) => ops.every((op) => !(op instanceof OpVerifyFailed));
-function OpsVerifier(ops, keys, issuer, validator) {
+function OpsVerifier(ops, keys, issuer, options = {}) {
+  const { validator, warn } = options;
   const decoded = decodeOps(ops);
   const verifyCp = JwtVcVerifier(
     keys,
@@ -1161,9 +1167,12 @@ function OpsVerifier(ops, keys, issuer, validator) {
         const annotations = await verifyAnnotations(
           paOrWmpIssuerKeys,
           op.annotations,
-          validator
+          { validator, warn }
         );
-        const media = await verifyMedia(paOrWmpIssuerKeys, op.media, validator);
+        const media = await verifyMedia(paOrWmpIssuerKeys, op.media, {
+          validator,
+          warn
+        });
         const resultOp = { core, annotations, media };
         if (core instanceof Error) {
           return new OpVerifyFailed(
@@ -1198,7 +1207,7 @@ function OpsVerifier(ops, keys, issuer, validator) {
       const msg = verifyFailedIndexes.length > 0 ? `Originator Profile Set verify failed (${verifyFailedIndexes.map((i) => `OP[${i}]`).join(", ")})` : "Originator Profile Set verify failed";
       return new OpsVerifyFailed(msg, resultOps);
     }
-    return verifyAnnotationIssuerRegistration(resultOps, issuer);
+    return verifyAnnotationIssuerRegistration(resultOps, issuer, warn);
   }
   return verify;
 }
@@ -1246,9 +1255,13 @@ const decodeWebsiteProfiles = (sp, opsVerified) => {
     wspSources
   };
 };
-function SpVerifier(sp, keys, issuer, origin, verifyOrigin = true, validator) {
+function SpVerifier(sp, keys, issuer, origin, options = {}) {
+  const { verifyOrigin = true, validator, warn } = options;
   async function verify() {
-    const verifyOps = OpsVerifier(sp.originators, keys, issuer, validator);
+    const verifyOps = OpsVerifier(sp.originators, keys, issuer, {
+      validator,
+      warn
+    });
     const opsVerified = await verifyOps();
     if (opsVerified instanceof OpsInvalid) {
       return new SiteProfileInvalid("Originator Profile Set invalid", {
@@ -1297,7 +1310,9 @@ function SpVerifier(sp, keys, issuer, origin, verifyOrigin = true, validator) {
             return new Error("Origin not allowed");
           }
         }
-        await verifyImageDigestSri(verified.doc.credentialSubject.image);
+        await verifyImageDigestSri(verified.doc.credentialSubject.image, {
+          warn
+        });
         return verified;
       })
     );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@originator-profile/verify",
-  "version": "0.6.1",
+  "version": "0.7.0-beta.2",
   "license": "Apache-2.0",
   "homepage": "https://docs.originator-profile.org",
   "repository": {
@@ -27,35 +27,34 @@
     "jose": "^6.2.2",
     "jsonld": "^9.0.0",
     "zod": "^4.3.6",
-    "@originator-profile/core": "0.6.1",
-    "@originator-profile/cryptography": "0.6.1",
-    "@originator-profile/securing-mechanism": "0.6.1",
-    "@originator-profile/model": "0.6.1",
-    "@originator-profile/sign": "0.6.1"
+    "@originator-profile/core": "0.7.0-beta.2",
+    "@originator-profile/securing-mechanism": "0.7.0-beta.2",
+    "@originator-profile/cryptography": "0.7.0-beta.2",
+    "@originator-profile/sign": "0.7.0-beta.2",
+    "@originator-profile/model": "0.7.0-beta.2"
   },
   "devDependencies": {
     "@playwright/test": "1.59.1",
     "date-fns": "4.1.0",
-    "eslint": "10.2.0",
     "happy-dom": "20.8.9",
     "just-diff-apply": "5.5.0",
     "just-typeof": "3.2.0",
+    "oxlint": "^1.73.0",
+    "oxlint-tsgolint": "^0.24.0",
     "pkgroll": "2.27.0",
     "playwright": "1.59.1",
     "typescript": "6.0.2",
     "urlpattern-polyfill": "10.1.0",
-    "vite": "8.0.8",
+    "vite": "8.0.16",
     "vitest": "4.1.4",
     "websri": "1.0.1",
-    "@originator-profile/tsconfig": "0.6.1",
-    "eslint-config-originator-profile": "0.6.1"
+    "@originator-profile/tsconfig": "0.7.0-beta.2"
   },
   "scripts": {
     "build": "pkgroll --clean-dist",
     "test": "vitest run",
     "e2e": "playwright test",
     "e2e:update": "playwright test --update-snapshots",
-    "lint": "eslint --fix .",
-    "type-check": "tsc --noEmit"
+    "lint": "oxlint --fix ."
   }
 }