@sd-jwt/core 0.1.0 → 0.1.1-next.0

package/src/sdjwt.ts

@@ -0,0 +1,354 @@
+import { createHashMapping, getSDAlgAndPayload, unpack } from './decode';
+import { createDecoy } from './decoy';
+import { Jwt } from './jwt';
+import { KBJwt } from './kbjwt';
+import { transformPresentationFrame } from './present';
+import {
+  type DisclosureFrame,
+  type Hasher,
+  type HasherAndAlg,
+  type kbHeader,
+  type kbPayload,
+  type PresentationFrame,
+  type SaltGenerator,
+  SD_DECOY,
+  SD_DIGEST,
+  SD_LIST_KEY,
+  SD_SEPARATOR,
+  type SDJWTCompact,
+} from './types';
+import { Disclosure, SDJWTException } from './utils';
+
+export type SDJwtData<
+  Header extends Record<string, unknown>,
+  Payload extends Record<string, unknown>,
+  KBHeader extends kbHeader = kbHeader,
+  KBPayload extends kbPayload = kbPayload,
+> = {
+  jwt?: Jwt<Header, Payload>;
+  disclosures?: Array<Disclosure>;
+  kbJwt?: KBJwt<KBHeader, KBPayload>;
+};
+
+export class SDJwt<
+  Header extends Record<string, unknown> = Record<string, unknown>,
+  Payload extends Record<string, unknown> = Record<string, unknown>,
+  KBHeader extends kbHeader = kbHeader,
+  KBPayload extends kbPayload = kbPayload,
+> {
+  public jwt?: Jwt<Header, Payload>;
+  public disclosures?: Array<Disclosure>;
+  public kbJwt?: KBJwt<KBHeader, KBPayload>;
+
+  constructor(data?: SDJwtData<Header, Payload, KBHeader, KBPayload>) {
+    this.jwt = data?.jwt;
+    this.disclosures = data?.disclosures;
+    this.kbJwt = data?.kbJwt;
+  }
+
+  public static async decodeSDJwt<
+    Header extends Record<string, unknown> = Record<string, unknown>,
+    Payload extends Record<string, unknown> = Record<string, unknown>,
+    KBHeader extends kbHeader = kbHeader,
+    KBPayload extends kbPayload = kbPayload,
+  >(
+    sdjwt: SDJWTCompact,
+    hasher: Hasher,
+  ): Promise<{
+    jwt: Jwt<Header, Payload>;
+    disclosures: Array<Disclosure>;
+    kbJwt?: KBJwt<KBHeader, KBPayload>;
+  }> {
+    const [encodedJwt, ...encodedDisclosures] = sdjwt.split(SD_SEPARATOR);
+    const jwt = Jwt.fromEncode<Header, Payload>(encodedJwt);
+
+    if (!jwt.payload) {
+      throw new Error('Payload is undefined on the JWT. Invalid state reached');
+    }
+
+    if (encodedDisclosures.length === 0) {
+      return {
+        jwt,
+        disclosures: [],
+      };
+    }
+
+    const encodedKeyBindingJwt = encodedDisclosures.pop();
+    const kbJwt = encodedKeyBindingJwt
+      ? KBJwt.fromKBEncode<KBHeader, KBPayload>(encodedKeyBindingJwt)
+      : undefined;
+
+    const { _sd_alg } = getSDAlgAndPayload(jwt.payload);
+
+    const disclosures = await Promise.all(
+      encodedDisclosures.map((ed) =>
+        Disclosure.fromEncode(ed, { alg: _sd_alg, hasher }),
+      ),
+    );
+
+    return {
+      jwt,
+      disclosures,
+      kbJwt,
+    };
+  }
+
+  public static async extractJwt<
+    Header extends Record<string, unknown> = Record<string, unknown>,
+    Payload extends Record<string, unknown> = Record<string, unknown>,
+  >(encodedSdJwt: SDJWTCompact): Promise<Jwt<Header, Payload>> {
+    const [encodedJwt, ..._encodedDisclosures] =
+      encodedSdJwt.split(SD_SEPARATOR);
+
+    return Jwt.fromEncode(encodedJwt);
+  }
+
+  public static async fromEncode<
+    Header extends Record<string, unknown> = Record<string, unknown>,
+    Payload extends Record<string, unknown> = Record<string, unknown>,
+    KBHeader extends kbHeader = kbHeader,
+    KBPayload extends kbPayload = kbPayload,
+  >(
+    encodedSdJwt: SDJWTCompact,
+    hasher: Hasher,
+  ): Promise<SDJwt<Header, Payload>> {
+    const { jwt, disclosures, kbJwt } = await SDJwt.decodeSDJwt<
+      Header,
+      Payload,
+      KBHeader,
+      KBPayload
+    >(encodedSdJwt, hasher);
+
+    return new SDJwt<Header, Payload, KBHeader, KBPayload>({
+      jwt,
+      disclosures,
+      kbJwt,
+    });
+  }
+
+  public async present<T extends Record<string, unknown>>(
+    presentFrame: PresentationFrame<T> | undefined,
+    hasher: Hasher,
+  ): Promise<SDJWTCompact> {
+    const disclosures = await this.getPresentDisclosures(presentFrame, hasher);
+    const presentSDJwt = new SDJwt({
+      jwt: this.jwt,
+      disclosures,
+      kbJwt: this.kbJwt,
+    });
+    return presentSDJwt.encodeSDJwt();
+  }
+
+  public async getPresentDisclosures<T extends Record<string, unknown>>(
+    presentFrame: PresentationFrame<T> | undefined,
+    hasher: Hasher,
+  ): Promise<Disclosure<unknown>[]> {
+    if (!this.jwt?.payload || !this.disclosures) {
+      throw new SDJWTException('Invalid sd-jwt: jwt or disclosures is missing');
+    }
+    const { _sd_alg: alg } = getSDAlgAndPayload(this.jwt.payload);
+    const hash = { alg, hasher };
+    const hashmap = await createHashMapping(this.disclosures, hash);
+    const { disclosureKeymap } = await unpack(
+      this.jwt.payload,
+      this.disclosures,
+      hasher,
+    );
+
+    const keys = presentFrame
+      ? transformPresentationFrame(presentFrame)
+      : await this.presentableKeys(hasher);
+    const disclosures = keys
+      .map((k) => hashmap[disclosureKeymap[k]])
+      .filter((d) => d !== undefined);
+    return disclosures;
+  }
+
+  public encodeSDJwt(): SDJWTCompact {
+    const data: string[] = [];
+
+    if (!this.jwt) {
+      throw new SDJWTException('Invalid sd-jwt: jwt is missing');
+    }
+
+    const encodedJwt = this.jwt.encodeJwt();
+    data.push(encodedJwt);
+
+    if (this.disclosures && this.disclosures.length > 0) {
+      const encodeddisclosures = this.disclosures
+        .map((dc) => dc.encode())
+        .join(SD_SEPARATOR);
+      data.push(encodeddisclosures);
+    }
+
+    data.push(this.kbJwt ? this.kbJwt.encodeJwt() : '');
+    return data.join(SD_SEPARATOR);
+  }
+
+  public async keys(hasher: Hasher): Promise<string[]> {
+    return listKeys(await this.getClaims(hasher)).sort();
+  }
+
+  public async presentableKeys(hasher: Hasher): Promise<string[]> {
+    if (!this.jwt?.payload || !this.disclosures) {
+      throw new SDJWTException('Invalid sd-jwt: jwt or disclosures is missing');
+    }
+    const { disclosureKeymap } = await unpack(
+      this.jwt?.payload,
+      this.disclosures,
+      hasher,
+    );
+    return Object.keys(disclosureKeymap).sort();
+  }
+
+  public async getClaims<T>(hasher: Hasher): Promise<T> {
+    if (!this.jwt?.payload || !this.disclosures) {
+      throw new SDJWTException('Invalid sd-jwt: jwt or disclosures is missing');
+    }
+    const { unpackedObj } = await unpack(
+      this.jwt.payload,
+      this.disclosures,
+      hasher,
+    );
+    return unpackedObj as T;
+  }
+}
+
+export const listKeys = (obj: Record<string, unknown>, prefix = '') => {
+  const keys: string[] = [];
+  for (const key in obj) {
+    if (obj[key] === undefined) continue;
+    const newKey = prefix ? `${prefix}.${key}` : key;
+    keys.push(newKey);
+
+    const value = obj[key];
+    if (value && typeof value === 'object') {
+      keys.push(...listKeys(value as Record<string, unknown>, newKey));
+    }
+  }
+  return keys;
+};
+
+export const pack = async <T extends Record<string, unknown>>(
+  claims: T,
+  disclosureFrame: DisclosureFrame<T> | undefined,
+  hash: HasherAndAlg,
+  saltGenerator: SaltGenerator,
+): Promise<{
+  packedClaims: Record<string, unknown> | Array<Record<string, unknown>>;
+  disclosures: Array<Disclosure>;
+}> => {
+  if (!disclosureFrame) {
+    return {
+      packedClaims: claims,
+      disclosures: [],
+    };
+  }
+
+  const sd = disclosureFrame[SD_DIGEST] ?? [];
+  const decoyCount = disclosureFrame[SD_DECOY] ?? 0;
+
+  if (Array.isArray(claims)) {
+    const packedClaims: Array<Record<typeof SD_LIST_KEY, string>> = [];
+    const disclosures: Array<Disclosure> = [];
+    const recursivePackedClaims: Record<number, unknown> = {};
+
+    for (const key in disclosureFrame) {
+      if (key !== SD_DIGEST) {
+        const idx = Number.parseInt(key, 10);
+        const packed = await pack(
+          claims[idx],
+          disclosureFrame[idx],
+          hash,
+          saltGenerator,
+        );
+        recursivePackedClaims[idx] = packed.packedClaims;
+        disclosures.push(...packed.disclosures);
+      }
+    }
+
+    for (let i = 0; i < claims.length; i++) {
+      const claim = recursivePackedClaims[i]
+        ? recursivePackedClaims[i]
+        : claims[i];
+      /** This part is set discloure for array items.
+       *  The example of disclosureFrame of an Array is
+       *
+       *  const claims = {
+       *    array: ['a', 'b', 'c']
+       *  }
+       *
+       *  diclosureFrame: DisclosureFrame<typeof claims> = {
+       *    array: {
+       *      _sd: [0, 2]
+       *    }
+       *  }
+       *
+       *  It means that we want to disclose the first and the third item of the array
+       *
+       *  So If the index `i` is in the disclosure list(sd), then we create a disclosure for the claim
+       */
+      // @ts-expect-error
+      if (sd.includes(i)) {
+        const salt = await saltGenerator(16);
+        const disclosure = new Disclosure([salt, claim]);
+        const digest = await disclosure.digest(hash);
+        packedClaims.push({ [SD_LIST_KEY]: digest });
+        disclosures.push(disclosure);
+      } else {
+        packedClaims.push(claim);
+      }
+    }
+    for (let j = 0; j < decoyCount; j++) {
+      const decoyDigest = await createDecoy(hash, saltGenerator);
+      packedClaims.push({ [SD_LIST_KEY]: decoyDigest });
+    }
+    return { packedClaims, disclosures };
+  }
+
+  const packedClaims: Record<string, unknown> = {};
+  const disclosures: Array<Disclosure> = [];
+  const recursivePackedClaims: Record<string, unknown> = {};
+
+  for (const key in disclosureFrame) {
+    if (key !== SD_DIGEST) {
+      const packed = await pack(
+        // @ts-expect-error
+        claims[key],
+        disclosureFrame[key],
+        hash,
+        saltGenerator,
+      );
+      recursivePackedClaims[key] = packed.packedClaims;
+      disclosures.push(...packed.disclosures);
+    }
+  }
+
+  const _sd: string[] = [];
+
+  for (const key in claims) {
+    const claim = recursivePackedClaims[key]
+      ? recursivePackedClaims[key]
+      : claims[key];
+    if (sd.includes(key)) {
+      const salt = await saltGenerator(16);
+      const disclosure = new Disclosure([salt, key, claim]);
+      const digest = await disclosure.digest(hash);
+
+      _sd.push(digest);
+      disclosures.push(disclosure);
+    } else {
+      packedClaims[key] = claim;
+    }
+  }
+
+  for (let j = 0; j < decoyCount; j++) {
+    const decoyDigest = await createDecoy(hash, saltGenerator);
+    _sd.push(decoyDigest);
+  }
+
+  if (_sd.length > 0) {
+    packedClaims[SD_DIGEST] = _sd.sort();
+  }
+  return { packedClaims, disclosures };
+};

package/src/test/decode/decode.spec.ts

@@ -0,0 +1,202 @@
+import { hasher as digest } from '@owf/crypto';
+import { describe, expect, test } from 'vitest';
+import {
+  createHashMapping,
+  decodeJwt,
+  decodeSdJwt,
+  decodeSdJwtSync,
+  getClaims,
+  getClaimsSync,
+  getSDAlgAndPayload,
+  splitSdJwt,
+  unpackObj,
+} from '../../decode';
+
+describe('decode tests', () => {
+  test('decode jwt', () => {
+    const jwt =
+      'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
+    const { header, payload, signature } = decodeJwt(jwt);
+    expect(signature).toBeDefined();
+    expect(header).toStrictEqual({ alg: 'HS256', typ: 'JWT' });
+    expect(payload).toStrictEqual({
+      sub: '1234567890',
+      name: 'John Doe',
+      iat: 1516239022,
+    });
+  });
+
+  test('decode jwt with invalid input', () => {
+    const jwt = 'invalid.invalid';
+    expect(() => decodeJwt(jwt)).toThrow('Invalid JWT as input');
+  });
+
+  test('split sdjwt', () => {
+    const sdjwt = 'h.p.s~d1~d2~';
+    const { jwt, disclosures, kbJwt } = splitSdJwt(sdjwt);
+    expect(jwt).toBe('h.p.s');
+    expect(disclosures).toStrictEqual(['d1', 'd2']);
+    expect(kbJwt).toBeUndefined();
+  });
+
+  test('split sdjwt without disclosures', () => {
+    const sdjwt = 'h.p.s';
+    const { jwt, disclosures, kbJwt } = splitSdJwt(sdjwt);
+    expect(jwt).toBe('h.p.s');
+    expect(disclosures).toStrictEqual([]);
+    expect(kbJwt).toBeUndefined();
+  });
+
+  test('split sdjwt with kbjwt', () => {
+    const sdjwt = 'h.p.s~d1~d2~kbh.kbp.kbs';
+    const { jwt, disclosures, kbJwt } = splitSdJwt(sdjwt);
+    expect(jwt).toBe('h.p.s');
+    expect(disclosures).toStrictEqual(['d1', 'd2']);
+    expect(kbJwt).toBe('kbh.kbp.kbs');
+  });
+
+  test('decode sdjwt', async () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJfc2QiOlsiaWQ1azZ1ZVplVTY4bExaMlU2YjJJbF9QR3ZKb1RDMlpkMkpwY0RwMzFIWSJdLCJfc2RfYWxnIjoic2hhLTI1NiJ9.GiLF_HhacrstqCJ223VvWOoJJWU8qk4dYQHklSMwxv36pPF_7ER53Wbty1qYRlQ6NeMUdBRRdj9JQLLCzz1gCQ~WyI2NTMxNDA2ZmVhZmU0YjBmIiwiZm9vIiwiYmFyIl0~';
+    const decodedSdJwt = await decodeSdJwt(sdjwt, digest);
+    expect(decodedSdJwt).toBeDefined();
+    expect(decodedSdJwt.kbJwt).toBeUndefined();
+    expect(decodedSdJwt.disclosures.length).toEqual(1);
+    expect(decodedSdJwt.jwt).toBeDefined();
+  });
+
+  test('decode jwt', async () => {
+    const jwt =
+      'eyJhbGciOiJIUzI1NiIsInR5cCI6InNkK2p3dCJ9.eyJsYXN0bmFtZSI6IkRvZSIsInNzbiI6IjEyMy00NS02Nzg5IiwiX3NkIjpbIk4yUXhZV1UxTlRnME1qQmpOR1JpWVRCaU1tRmtaamN5WXpSbFpXUmhaRGd5WkRCbE1qaGhZVGcwTnpJMU9XSXpZek5qWkdNNE1qZG1NVGN6TmpZd05RIiwiWlRSalkyUTVOemRoWkRVM05tWTFZV0UyTmpka01XVmpNRE16WXpOak5qQmtNak5pT0dZelpHSTBOelV4TURsak9EWTRNREEzWm1JeFpUY3daREZqTmciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.mX14Sw86xy8NFQta7tCfNmhVCqzfaJ_K3VEIhTjbLDY';
+    const decodedSdJwt = await decodeSdJwt(jwt, digest);
+    expect(decodedSdJwt).toBeDefined();
+    expect(decodedSdJwt.kbJwt).toBeUndefined();
+    expect(decodedSdJwt.disclosures.length).toEqual(0);
+    expect(decodedSdJwt.jwt).toBeDefined();
+  });
+
+  test('decode sdjwt sync', () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJfc2QiOlsiaWQ1azZ1ZVplVTY4bExaMlU2YjJJbF9QR3ZKb1RDMlpkMkpwY0RwMzFIWSJdLCJfc2RfYWxnIjoic2hhLTI1NiJ9.GiLF_HhacrstqCJ223VvWOoJJWU8qk4dYQHklSMwxv36pPF_7ER53Wbty1qYRlQ6NeMUdBRRdj9JQLLCzz1gCQ~WyI2NTMxNDA2ZmVhZmU0YjBmIiwiZm9vIiwiYmFyIl0~';
+    const decodedSdJwt = decodeSdJwtSync(sdjwt, digest);
+    expect(decodedSdJwt).toBeDefined();
+    expect(decodedSdJwt.kbJwt).toBeUndefined();
+    expect(decodedSdJwt.disclosures.length).toEqual(1);
+    expect(decodedSdJwt.jwt).toBeDefined();
+  });
+
+  test('decode jwt sync', () => {
+    const jwt =
+      'eyJhbGciOiJIUzI1NiIsInR5cCI6InNkK2p3dCJ9.eyJsYXN0bmFtZSI6IkRvZSIsInNzbiI6IjEyMy00NS02Nzg5IiwiX3NkIjpbIk4yUXhZV1UxTlRnME1qQmpOR1JpWVRCaU1tRmtaamN5WXpSbFpXUmhaRGd5WkRCbE1qaGhZVGcwTnpJMU9XSXpZek5qWkdNNE1qZG1NVGN6TmpZd05RIiwiWlRSalkyUTVOemRoWkRVM05tWTFZV0UyTmpka01XVmpNRE16WXpOak5qQmtNak5pT0dZelpHSTBOelV4TURsak9EWTRNREEzWm1JeFpUY3daREZqTmciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.mX14Sw86xy8NFQta7tCfNmhVCqzfaJ_K3VEIhTjbLDY';
+    const decodedSdJwt = decodeSdJwtSync(jwt, digest);
+    expect(decodedSdJwt).toBeDefined();
+    expect(decodedSdJwt.kbJwt).toBeUndefined();
+    expect(decodedSdJwt.disclosures.length).toEqual(0);
+    expect(decodedSdJwt.jwt).toBeDefined();
+  });
+
+  test('decode sdjwt sync (with KB)', () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZCtqd3QiLCJhbGciOiJFUzI1NiJ9.eyJpZCI6IjEyMzQiLCJfc2QiOlsiYkRUUnZtNS1Zbi1IRzdjcXBWUjVPVlJJWHNTYUJrNTdKZ2lPcV9qMVZJNCIsImV0M1VmUnlsd1ZyZlhkUEt6Zzc5aGNqRDFJdHpvUTlvQm9YUkd0TW9zRmsiLCJ6V2ZaTlMxOUF0YlJTVGJvN3NKUm4wQlpRdldSZGNob0M3VVphYkZyalk4Il0sIl9zZF9hbGciOiJzaGEtMjU2In0.n27NCtnuwytlBYtUNjgkesDP_7gN7bhaLhWNL4SWT6MaHsOjZ2ZMp987GgQRL6ZkLbJ7Cd3hlePHS84GBXPuvg~WyI1ZWI4Yzg2MjM0MDJjZjJlIiwiZmlyc3RuYW1lIiwiSm9obiJd~WyJjNWMzMWY2ZWYzNTg4MWJjIiwibGFzdG5hbWUiLCJEb2UiXQ~WyJmYTlkYTUzZWJjOTk3OThlIiwic3NuIiwiMTIzLTQ1LTY3ODkiXQ~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJpYXQiOjE3MTAwNjk3MjIsImF1ZCI6ImRpZDpleGFtcGxlOjEyMyIsIm5vbmNlIjoiazh2ZGYwbmQ2Iiwic2RfaGFzaCI6Il8tTmJWSzNmczl3VzNHaDNOUktSNEt1NmZDMUwzN0R2MFFfalBXd0ppRkUifQ.pqw2OB5IA5ya9Mxf60hE3nr2gsJEIoIlnuCa4qIisijHbwg3WzTDFmW2SuNvK_ORN0WU6RoGbJx5uYZh8k4EbA';
+    const decodedSdJwt = decodeSdJwtSync(sdjwt, digest);
+    expect(decodedSdJwt).toBeDefined();
+    expect(decodedSdJwt.kbJwt).toBeDefined();
+    expect(decodedSdJwt.disclosures.length).toEqual(3);
+    expect(decodedSdJwt.jwt).toBeDefined();
+  });
+
+  test('decode sdjwt (with KB)', async () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZCtqd3QiLCJhbGciOiJFUzI1NiJ9.eyJpZCI6IjEyMzQiLCJfc2QiOlsiYkRUUnZtNS1Zbi1IRzdjcXBWUjVPVlJJWHNTYUJrNTdKZ2lPcV9qMVZJNCIsImV0M1VmUnlsd1ZyZlhkUEt6Zzc5aGNqRDFJdHpvUTlvQm9YUkd0TW9zRmsiLCJ6V2ZaTlMxOUF0YlJTVGJvN3NKUm4wQlpRdldSZGNob0M3VVphYkZyalk4Il0sIl9zZF9hbGciOiJzaGEtMjU2In0.n27NCtnuwytlBYtUNjgkesDP_7gN7bhaLhWNL4SWT6MaHsOjZ2ZMp987GgQRL6ZkLbJ7Cd3hlePHS84GBXPuvg~WyI1ZWI4Yzg2MjM0MDJjZjJlIiwiZmlyc3RuYW1lIiwiSm9obiJd~WyJjNWMzMWY2ZWYzNTg4MWJjIiwibGFzdG5hbWUiLCJEb2UiXQ~WyJmYTlkYTUzZWJjOTk3OThlIiwic3NuIiwiMTIzLTQ1LTY3ODkiXQ~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJpYXQiOjE3MTAwNjk3MjIsImF1ZCI6ImRpZDpleGFtcGxlOjEyMyIsIm5vbmNlIjoiazh2ZGYwbmQ2Iiwic2RfaGFzaCI6Il8tTmJWSzNmczl3VzNHaDNOUktSNEt1NmZDMUwzN0R2MFFfalBXd0ppRkUifQ.pqw2OB5IA5ya9Mxf60hE3nr2gsJEIoIlnuCa4qIisijHbwg3WzTDFmW2SuNvK_ORN0WU6RoGbJx5uYZh8k4EbA';
+    const decodedSdJwt = await decodeSdJwt(sdjwt, digest);
+    expect(decodedSdJwt).toBeDefined();
+    expect(decodedSdJwt.kbJwt).toBeDefined();
+    expect(decodedSdJwt.disclosures.length).toEqual(3);
+    expect(decodedSdJwt.jwt).toBeDefined();
+  });
+
+  test('get claims', async () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJfc2QiOlsiaWQ1azZ1ZVplVTY4bExaMlU2YjJJbF9QR3ZKb1RDMlpkMkpwY0RwMzFIWSJdLCJfc2RfYWxnIjoic2hhLTI1NiJ9.GiLF_HhacrstqCJ223VvWOoJJWU8qk4dYQHklSMwxv36pPF_7ER53Wbty1qYRlQ6NeMUdBRRdj9JQLLCzz1gCQ~WyI2NTMxNDA2ZmVhZmU0YjBmIiwiZm9vIiwiYmFyIl0~';
+    const decodedSdJwt = await decodeSdJwt(sdjwt, digest);
+    const claims = await getClaims(
+      decodedSdJwt.jwt.payload,
+      decodedSdJwt.disclosures,
+      digest,
+    );
+    expect(claims).toStrictEqual({
+      foo: 'bar',
+    });
+  });
+
+  test('getClaims #2', async () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0Ijp7Il9zZCI6WyJqVEszMHNleDZhYV9kUk1KSWZDR056Q0FwbVB5MzRRNjNBa3QzS3hhSktzIl19LCJfc2QiOlsiME9nMi1ReG95eW1UOGNnVzZZUjVSSFpQLUJuR2tHUi1NM2otLV92RWlzSSIsIkcwZ3lHNnExVFMyUlQxMkZ3X2RRRDVVcjlZc1AwZlVWOXVtQWdGMC1jQ1EiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.ggEyE4SeDO2Hu3tol3VLmi7NQj56yKzKQDaafocgkLrUBdivghohtzrfcbrMN7CRufJ_Cnh0EL54kymXLGTdDQ~WyIwNGU0MjAzOWU4ZWFiOWRjIiwiYSIsIjEiXQ~WyIwOGE1Yjc5MjMyYjAzYzBhIiwiMSJd~WyJiNWE2YjUzZGQwYTFmMGIwIiwienp6IiwieHh4Il0~WyIxYzdmOTE4ZTE0MjA2NzZiIiwiZm9vIiwiYmFyIl0~WyJmZjYxYzQ5ZGU2NjFiYzMxIiwiYXJyIixbeyIuLi4iOiJTSG96VW5KNUpkd0ZtTjVCbXB5dXZCWGZfZWRjckVvcExPYThTVlBFUmg0In0sIjIiLHsiX3NkIjpbIkpuODNhZkp0OGx4NG1FMzZpRkZyS2U2R2VnN0dlVUQ4Z3UwdVo3NnRZcW8iXX1dXQ~';
+    const decodedSdJwt = await decodeSdJwt(sdjwt, digest);
+    const claims = await getClaims(
+      decodedSdJwt.jwt.payload,
+      decodedSdJwt.disclosures,
+      digest,
+    );
+    expect(claims).toStrictEqual({
+      foo: 'bar',
+      arr: ['1', '2', { a: '1' }],
+      test: {
+        zzz: 'xxx',
+      },
+    });
+  });
+
+  test('get claims sync', () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJfc2QiOlsiaWQ1azZ1ZVplVTY4bExaMlU2YjJJbF9QR3ZKb1RDMlpkMkpwY0RwMzFIWSJdLCJfc2RfYWxnIjoic2hhLTI1NiJ9.GiLF_HhacrstqCJ223VvWOoJJWU8qk4dYQHklSMwxv36pPF_7ER53Wbty1qYRlQ6NeMUdBRRdj9JQLLCzz1gCQ~WyI2NTMxNDA2ZmVhZmU0YjBmIiwiZm9vIiwiYmFyIl0~';
+    const decodedSdJwt = decodeSdJwtSync(sdjwt, digest);
+    const claims = getClaimsSync(
+      decodedSdJwt.jwt.payload,
+      decodedSdJwt.disclosures,
+      digest,
+    );
+    expect(claims).toStrictEqual({
+      foo: 'bar',
+    });
+  });
+
+  test('getClaims sync #2', () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0Ijp7Il9zZCI6WyJqVEszMHNleDZhYV9kUk1KSWZDR056Q0FwbVB5MzRRNjNBa3QzS3hhSktzIl19LCJfc2QiOlsiME9nMi1ReG95eW1UOGNnVzZZUjVSSFpQLUJuR2tHUi1NM2otLV92RWlzSSIsIkcwZ3lHNnExVFMyUlQxMkZ3X2RRRDVVcjlZc1AwZlVWOXVtQWdGMC1jQ1EiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.ggEyE4SeDO2Hu3tol3VLmi7NQj56yKzKQDaafocgkLrUBdivghohtzrfcbrMN7CRufJ_Cnh0EL54kymXLGTdDQ~WyIwNGU0MjAzOWU4ZWFiOWRjIiwiYSIsIjEiXQ~WyIwOGE1Yjc5MjMyYjAzYzBhIiwiMSJd~WyJiNWE2YjUzZGQwYTFmMGIwIiwienp6IiwieHh4Il0~WyIxYzdmOTE4ZTE0MjA2NzZiIiwiZm9vIiwiYmFyIl0~WyJmZjYxYzQ5ZGU2NjFiYzMxIiwiYXJyIixbeyIuLi4iOiJTSG96VW5KNUpkd0ZtTjVCbXB5dXZCWGZfZWRjckVvcExPYThTVlBFUmg0In0sIjIiLHsiX3NkIjpbIkpuODNhZkp0OGx4NG1FMzZpRkZyS2U2R2VnN0dlVUQ4Z3UwdVo3NnRZcW8iXX1dXQ~';
+    const decodedSdJwt = decodeSdJwtSync(sdjwt, digest);
+    const claims = getClaimsSync(
+      decodedSdJwt.jwt.payload,
+      decodedSdJwt.disclosures,
+      digest,
+    );
+    expect(claims).toStrictEqual({
+      foo: 'bar',
+      arr: ['1', '2', { a: '1' }],
+      test: {
+        zzz: 'xxx',
+      },
+    });
+  });
+
+  test('Test default sd hash algorithm', () => {
+    const { _sd_alg } = getSDAlgAndPayload({});
+    expect(_sd_alg).toBe('sha-256');
+  });
+
+  test('unpackObj clone', async () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0Ijp7Il9zZCI6WyJqVEszMHNleDZhYV9kUk1KSWZDR056Q0FwbVB5MzRRNjNBa3QzS3hhSktzIl19LCJfc2QiOlsiME9nMi1ReG95eW1UOGNnVzZZUjVSSFpQLUJuR2tHUi1NM2otLV92RWlzSSIsIkcwZ3lHNnExVFMyUlQxMkZ3X2RRRDVVcjlZc1AwZlVWOXVtQWdGMC1jQ1EiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.ggEyE4SeDO2Hu3tol3VLmi7NQj56yKzKQDaafocgkLrUBdivghohtzrfcbrMN7CRufJ_Cnh0EL54kymXLGTdDQ~WyIwNGU0MjAzOWU4ZWFiOWRjIiwiYSIsIjEiXQ~WyIwOGE1Yjc5MjMyYjAzYzBhIiwiMSJd~WyJiNWE2YjUzZGQwYTFmMGIwIiwienp6IiwieHh4Il0~WyIxYzdmOTE4ZTE0MjA2NzZiIiwiZm9vIiwiYmFyIl0~WyJmZjYxYzQ5ZGU2NjFiYzMxIiwiYXJyIixbeyIuLi4iOiJTSG96VW5KNUpkd0ZtTjVCbXB5dXZCWGZfZWRjckVvcExPYThTVlBFUmg0In0sIjIiLHsiX3NkIjpbIkpuODNhZkp0OGx4NG1FMzZpRkZyS2U2R2VnN0dlVUQ4Z3UwdVo3NnRZcW8iXX1dXQ~';
+    const decodedSdJwt = await decodeSdJwt(sdjwt, digest);
+    const jwtPayload = JSON.parse(JSON.stringify(decodedSdJwt.jwt.payload));
+
+    const { _sd_alg } = getSDAlgAndPayload(decodedSdJwt.jwt.payload);
+    const hash = { hasher: digest, alg: _sd_alg };
+    const map = await createHashMapping(decodedSdJwt.disclosures, hash);
+
+    const { unpackedObj } = unpackObj(decodedSdJwt.jwt.payload, map);
+
+    expect(unpackedObj).toBeDefined();
+    expect(jwtPayload).toStrictEqual(decodedSdJwt.jwt.payload);
+  });
+});

package/src/test/decoy.spec.ts

@@ -0,0 +1,30 @@
+import { hasher as digest, generateSalt } from '@owf/crypto';
+import { describe, expect, test } from 'vitest';
+import { createDecoy } from '../decoy';
+import { base64urlEncode } from '../utils';
+
+const hash = {
+  hasher: digest,
+  alg: 'SHA256',
+};
+
+describe('Decoy', () => {
+  test('decoy', async () => {
+    const decoyValue = await createDecoy(hash, generateSalt);
+    expect(decoyValue.length).toBe(43);
+  });
+
+  // ref https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/07/
+  //  *Claim email*:
+  //  *  SHA-256 Hash: JzYjH4svliH0R3PyEMfeZu6Jt69u5qehZo7F7EPYlSE
+  //  *  Disclosure: WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImVtYWlsIiwgImpvaG5kb2VAZXhhbXBsZS5jb20iXQ
+  //  *  Contents: ["6Ij7tM-a5iVPGboS5tmvVA", "email", "johndoe@example.com"]
+  test('apply hasher and saltGenerator', async () => {
+    const decoyValue = await createDecoy(hash, () =>
+      base64urlEncode(
+        '["6Ij7tM-a5iVPGboS5tmvVA", "email", "johndoe@example.com"]',
+      ),
+    );
+    expect(decoyValue).toBe('JzYjH4svliH0R3PyEMfeZu6Jt69u5qehZo7F7EPYlSE');
+  });
+});