@sd-jwt/core 0.1.0 → 0.1.1-next.0

package/test/array_recursive_sd_some_disclosed.json

@@ -0,0 +1,63 @@
+{
+  "claims": {
+    "array_with_recursive_sd": [
+      "boring",
+      {
+        "foo": "bar",
+        "baz": {
+          "qux": "quxx"
+        }
+      },
+      ["foo", "bar"]
+    ],
+    "test2": ["foo", "bar"]
+  },
+  "disclosureFrame": {
+    "array_with_recursive_sd": {
+      "1": {
+        "_sd": ["baz"]
+      },
+      "2": {
+        "_sd": [0, 1]
+      }
+    },
+    "test2": {
+      "_sd": [0, 1]
+    }
+  },
+  "presentationFrames": {
+    "array_with_recursive_sd": {
+      "1": {
+        "baz": true
+      },
+      "2": {
+        "1": true
+      }
+    },
+    "test2": {
+      "0": true,
+      "1": true
+    }
+  },
+  "presentedClaims": {
+    "array_with_recursive_sd": [
+      "boring",
+      {
+        "foo": "bar",
+        "baz": {
+          "qux": "quxx"
+        }
+      },
+      ["bar"]
+    ],
+    "test2": ["foo", "bar"]
+  },
+  "requiredClaimKeys": [
+    "array_with_recursive_sd.1",
+    "array_with_recursive_sd.2",
+    "array_with_recursive_sd.1.baz",
+    "array_with_recursive_sd.2.1",
+    "test2.0",
+    "test2.1"
+  ]
+}

package/test/complex.json

@@ -0,0 +1,43 @@
+{
+  "claims": {
+    "firstname": "John",
+    "lastname": "Doe",
+    "ssn": "123-45-6789",
+    "id": "1234",
+    "data": {
+      "firstname": "John",
+      "lastname": "Doe",
+      "ssn": "123-45-6789",
+      "list": [{ "r": "1" }, "b", "c"]
+    },
+    "data2": {
+      "hi": "bye"
+    }
+  },
+  "disclosureFrame": {
+    "_sd": ["firstname", "id", "data2"],
+    "data": {
+      "_sd": ["list"],
+      "_sd_decoy": 2,
+      "list": {
+        "_sd": [0, 2],
+        "_sd_decoy": 1,
+        "0": {
+          "_sd": ["r"]
+        }
+      }
+    },
+    "data2": {
+      "_sd": ["hi"]
+    }
+  },
+  "presentationFrames": { "firstname": true, "id": true },
+  "presentedClaims": {
+    "lastname": "Doe",
+    "ssn": "123-45-6789",
+    "data": { "firstname": "John", "lastname": "Doe", "ssn": "123-45-6789" },
+    "id": "1234",
+    "firstname": "John"
+  },
+  "requiredClaimKeys": ["firstname", "id", "data.ssn"]
+}

package/test/header_mod.json

@@ -0,0 +1,48 @@
+{
+  "claims": {
+    "sub": "john_deo_42",
+    "given_name": "John",
+    "family_name": "Deo",
+    "email": "johndeo@example.com",
+    "phone": "+1-202-555-0101",
+    "address": {
+      "street_address": "123 Main St",
+      "locality": "Anytown",
+      "region": "Anystate",
+      "country": "US"
+    },
+    "birthdate": "1940-01-01"
+  },
+  "disclosureFrame": {
+    "_sd": [
+      "sub",
+      "given_name",
+      "family_name",
+      "email",
+      "phone",
+      "address",
+      "birthdate"
+    ]
+  },
+  "presentationFrames": {
+    "given_name": true,
+    "family_name": true,
+    "address": true
+  },
+  "presentedClaims": {
+    "given_name": "John",
+    "family_name": "Deo",
+    "address": {
+      "street_address": "123 Main St",
+      "locality": "Anytown",
+      "region": "Anystate",
+      "country": "US"
+    }
+  },
+  "requiredClaimKeys": [
+    "given_name",
+    "family_name",
+    "address.street_address",
+    "address.country"
+  ]
+}

package/test/json_serialization.json

@@ -0,0 +1,48 @@
+{
+  "claims": {
+    "sub": "john_deo_42",
+    "given_name": "John",
+    "family_name": "Deo",
+    "email": "johndeo@example.com",
+    "phone": "+1-202-555-0101",
+    "address": {
+      "street_address": "123 Main St",
+      "locality": "Anytown",
+      "region": "Anystate",
+      "country": "US"
+    },
+    "birthdate": "1940-01-01"
+  },
+  "disclosureFrame": {
+    "_sd": [
+      "sub",
+      "given_name",
+      "family_name",
+      "email",
+      "phone",
+      "address",
+      "birthdate"
+    ]
+  },
+  "presentationFrames": {
+    "given_name": true,
+    "family_name": true,
+    "address": true
+  },
+  "presentedClaims": {
+    "given_name": "John",
+    "family_name": "Deo",
+    "address": {
+      "street_address": "123 Main St",
+      "locality": "Anytown",
+      "region": "Anystate",
+      "country": "US"
+    }
+  },
+  "requiredClaimKeys": [
+    "given_name",
+    "family_name",
+    "address.street_address",
+    "address.country"
+  ]
+}

package/test/key_binding.json

@@ -0,0 +1,48 @@
+{
+  "claims": {
+    "sub": "john_deo_42",
+    "given_name": "John",
+    "family_name": "Deo",
+    "email": "johndeo@example.com",
+    "phone": "+1-202-555-0101",
+    "address": {
+      "street_address": "123 Main St",
+      "locality": "Anytown",
+      "region": "Anystate",
+      "country": "US"
+    },
+    "birthdate": "1940-01-01"
+  },
+  "disclosureFrame": {
+    "_sd": [
+      "sub",
+      "given_name",
+      "family_name",
+      "email",
+      "phone",
+      "address",
+      "birthdate"
+    ]
+  },
+  "presentationFrames": {
+    "given_name": true,
+    "family_name": true,
+    "address": true
+  },
+  "presentedClaims": {
+    "given_name": "John",
+    "family_name": "Deo",
+    "address": {
+      "street_address": "123 Main St",
+      "locality": "Anytown",
+      "region": "Anystate",
+      "country": "US"
+    }
+  },
+  "requiredClaimKeys": [
+    "given_name",
+    "family_name",
+    "address.street_address",
+    "address.country"
+  ]
+}

package/test/no_sd.json

@@ -0,0 +1,36 @@
+{
+  "claims": {
+    "recursive": [
+      "boring",
+      {
+        "foo": "bar",
+        "baz": {
+          "qux": "quxx"
+        }
+      },
+      ["foo", "bar"]
+    ],
+    "test2": ["foo", "bar"]
+  },
+  "disclosureFrame": {},
+  "presentationFrames": {},
+  "presentedClaims": {
+    "recursive": [
+      "boring",
+      {
+        "foo": "bar",
+        "baz": {
+          "qux": "quxx"
+        }
+      },
+      ["foo", "bar"]
+    ],
+    "test2": ["foo", "bar"]
+  },
+  "requiredClaimKeys": [
+    "recursive.0",
+    "recursive.1.baz.qux",
+    "recursive.2.1",
+    "test2.1"
+  ]
+}

package/test/object_data_types.json

@@ -0,0 +1,62 @@
+{
+  "claims": {
+    "value_Data_types": {
+      "test_null": null,
+      "test_int": 42,
+      "test_float": 3.14,
+      "test_str": "foo",
+      "test_bool": true,
+      "test_arr": ["Test"],
+      "test_object": {
+        "foo": "bar"
+      }
+    }
+  },
+  "disclosureFrame": {
+    "value_Data_types": {
+      "_sd": [
+        "test_null",
+        "test_int",
+        "test_float",
+        "test_str",
+        "test_bool",
+        "test_arr",
+        "test_object"
+      ]
+    }
+  },
+  "presentationFrames": {
+    "value_Data_types": {
+      "test_null": true,
+      "test_int": true,
+      "test_float": true,
+      "test_str": true,
+      "test_bool": true,
+      "test_arr": true,
+      "test_object": true
+    }
+  },
+  "presentedClaims": {
+    "value_Data_types": {
+      "test_null": null,
+      "test_int": 42,
+      "test_float": 3.14,
+      "test_str": "foo",
+      "test_bool": true,
+      "test_arr": ["Test"],
+      "test_object": {
+        "foo": "bar"
+      }
+    }
+  },
+  "requiredClaimKeys": [
+    "value_Data_types.test_null",
+    "value_Data_types.test_int",
+    "value_Data_types.test_float",
+    "value_Data_types.test_str",
+    "value_Data_types.test_bool",
+    "value_Data_types.test_arr",
+    "value_Data_types.test_object",
+    "value_Data_types.test_object.foo"
+  ]
+}

package/test/recursions.json

@@ -0,0 +1,117 @@
+{
+  "claims": {
+    "foo": ["one", "two"],
+    "bar": {
+      "red": 1,
+      "green": 2
+    },
+    "qux": [["blue", "yellow"]],
+    "baz": [["orange", "purple"], ["black", "white"]],
+    "animals": {
+      "snake": {
+        "name": "python",
+        "age": 10
+      },
+      "bird": {
+        "name": "eagle",
+        "age": 20
+      }
+    }
+  },
+  "disclosureFrame": {
+    "foo": {
+      "_sd": [0, 1]
+    },
+    "bar": {
+      "_sd": ["red", "green"]
+    },
+    "qux": {
+      "_sd": [0],
+      "0": {
+        "_sd": [0, 1]
+      }
+    },
+    "baz": {
+      "_sd": [0, 1],
+      "0": {
+        "_sd": [0, 1]
+      },
+      "1": {
+        "_sd": [0, 1]
+      }
+    },
+    "animals": {
+      "_sd": ["snake", "bird"],
+      "snake": {
+        "_sd": ["name", "age"]
+      },
+      "bird": {
+        "_sd": ["name", "age"]
+      }
+    }
+  },
+  "presentationFrames": {
+    "foo": {
+      "1": true
+    },
+    "bar": {
+      "green": true
+    },
+    "qux": {
+      "0": {
+        "0": true,
+        "1": true
+      },
+      "1": {
+        "0": true,
+        "1": true
+      }
+    },
+    "baz": {
+      "0": {
+        "0": true,
+        "1": true
+      },
+      "1": {
+        "0": true,
+        "1": true
+      }
+    },
+    "animals": {
+      "snake": {
+        "age": true
+      },
+      "bird": {
+        "age": true
+      }
+    }
+  },
+  "presentedClaims": {
+    "foo": ["two"],
+    "bar": {
+      "green": 2
+    },
+    "qux": [["blue", "yellow"]],
+    "baz": [["orange", "purple"], ["black", "white"]],
+    "animals": {
+      "snake": {
+        "age": 10
+      },
+      "bird": {
+        "age": 20
+      }
+    }
+  },
+  "requiredClaimKeys": [
+    "foo.1",
+    "bar.green",
+    "qux.0.0",
+    "qux.0.1",
+    "baz.0.0",
+    "baz.0.1",
+    "baz.1.0",
+    "baz.1.1",
+    "animals.snake.age",
+    "animals.bird.age"
+  ]
+}

package/test/rfc9901-validation.spec.ts

@@ -0,0 +1,150 @@
+import { describe, expect, test } from 'vitest';
+import { unpackObj } from '../src/decode';
+import { Disclosure } from '../src/utils';
+
+/**
+ * Tests for RFC 9901 validation checks added to unpackObj / unpackObjInternal.
+ *
+ * Section 7.1 step 4: Duplicate digest rejection
+ * Section 7.1 step 5: Unreferenced disclosure rejection
+ * Section 7.1 step 3c.ii.3: Claim name collision rejection
+ */
+
+const makeDisclosure = (
+  digest: string,
+  key: string | undefined,
+  value: unknown,
+) =>
+  Disclosure.fromArray(key ? ['salt', key, value] : ['salt', value], {
+    digest,
+    encoded: `encoded-${digest}`,
+  });
+
+describe('RFC 9901 validation', () => {
+  // ──────────────────────────────────────────
+  // 7.1 step 4 — Duplicate digest in _sd array
+  // ──────────────────────────────────────────
+  test('rejects duplicate digest in _sd array', () => {
+    const digest = 'abc123';
+    const payload = { _sd: [digest, digest] };
+    const map: Record<string, Disclosure> = {
+      [digest]: makeDisclosure(digest, 'foo', 'bar'),
+    };
+    expect(() => unpackObj(payload, map)).toThrow(
+      'Duplicate digest found in SD-JWT payload',
+    );
+  });
+
+  // ──────────────────────────────────────────
+  // 7.1 step 4 — Duplicate digest across nested _sd
+  // ──────────────────────────────────────────
+  test('rejects duplicate digest across nested _sd arrays', () => {
+    const digest = 'dup1';
+    const payload = {
+      _sd: [digest],
+      nested: {
+        _sd: [digest],
+      },
+    };
+    const map: Record<string, Disclosure> = {
+      [digest]: makeDisclosure(digest, 'x', 'y'),
+    };
+    expect(() => unpackObj(payload, map)).toThrow(
+      'Duplicate digest found in SD-JWT payload',
+    );
+  });
+
+  // ──────────────────────────────────────────
+  // 7.1 step 4 — Duplicate digest in array items
+  // ──────────────────────────────────────────
+  test('rejects duplicate digest in array element disclosures', () => {
+    const digest = 'arrdup';
+    const payload = {
+      arr: [{ '...': digest }, { '...': digest }],
+    };
+    const map: Record<string, Disclosure> = {
+      [digest]: makeDisclosure(digest, undefined, 'val'),
+    };
+    expect(() => unpackObj(payload, map)).toThrow(
+      'Duplicate digest found in SD-JWT payload',
+    );
+  });
+
+  // ──────────────────────────────────────────
+  // 7.1 step 5 — Unreferenced disclosure
+  // ──────────────────────────────────────────
+  test('rejects unreferenced disclosure', () => {
+    const usedDigest = 'used1';
+    const unusedDigest = 'unused1';
+    const payload = { _sd: [usedDigest] };
+    const map: Record<string, Disclosure> = {
+      [usedDigest]: makeDisclosure(usedDigest, 'a', 1),
+      [unusedDigest]: makeDisclosure(unusedDigest, 'b', 2),
+    };
+    expect(() => unpackObj(payload, map)).toThrow(
+      'Unreferenced disclosure(s) detected in SD-JWT',
+    );
+  });
+
+  test('rejects when no digests exist in payload but disclosures provided', () => {
+    const payload = { plain: 'value' };
+    const map: Record<string, Disclosure> = {
+      orphan: makeDisclosure('orphan', 'k', 'v'),
+    };
+    expect(() => unpackObj(payload, map)).toThrow(
+      'Unreferenced disclosure(s) detected in SD-JWT',
+    );
+  });
+
+  // ──────────────────────────────────────────
+  // 7.1 step 3c.ii.3 — Claim name collision
+  // ──────────────────────────────────────────
+  test('rejects disclosed claim name that conflicts with plaintext key', () => {
+    const digest = 'col1';
+    // The payload has both a plaintext "name" and a disclosure that would add "name"
+    const payload = { name: 'Alice', _sd: [digest] };
+    const map: Record<string, Disclosure> = {
+      [digest]: makeDisclosure(digest, 'name', 'Mallory'),
+    };
+    expect(() => unpackObj(payload, map)).toThrow(
+      'Disclosed claim name "name" conflicts with existing payload key',
+    );
+  });
+
+  // ──────────────────────────────────────────
+  // Positive: valid SD-JWT unpacks without error
+  // ──────────────────────────────────────────
+  test('unpacks valid SD-JWT without errors', () => {
+    const d1 = 'digest1';
+    const d2 = 'digest2';
+    const payload = { _sd: [d1, d2], plain: 'hello' };
+    const map: Record<string, Disclosure> = {
+      [d1]: makeDisclosure(d1, 'foo', 'bar'),
+      [d2]: makeDisclosure(d2, 'baz', 42),
+    };
+    const { unpackedObj, disclosureKeymap } = unpackObj(payload, map);
+    expect(unpackedObj).toEqual({ plain: 'hello', foo: 'bar', baz: 42 });
+    expect(disclosureKeymap).toEqual({ foo: d1, baz: d2 });
+  });
+
+  test('unpacks valid SD-JWT with array disclosures', () => {
+    const d1 = 'arrdig1';
+    const d2 = 'arrdig2';
+    const payload = {
+      arr: [{ '...': d1 }, 'plainItem', { '...': d2 }],
+    };
+    const map: Record<string, Disclosure> = {
+      [d1]: makeDisclosure(d1, undefined, 'secret1'),
+      [d2]: makeDisclosure(d2, undefined, 'secret2'),
+    };
+    const { unpackedObj } = unpackObj(payload, map);
+    expect(unpackedObj).toEqual({ arr: ['secret1', 'plainItem', 'secret2'] });
+  });
+
+  test('allows empty disclosure map with no _sd in payload', () => {
+    const payload = { plain: 'value' };
+    const map: Record<string, Disclosure> = {};
+    const { unpackedObj } = unpackObj(payload, map);
+    expect(unpackedObj).toEqual({ plain: 'value' });
+  });
+});

package/tsconfig.json

@@ -0,0 +1,7 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "dist"
+  }
+}

package/vitest.config.mts

@@ -0,0 +1,4 @@
+// vite.config.ts
+import { allEnvs } from '../../vitest.shared';
+
+export default allEnvs;

package/build/base64url.d.ts

@@ -1,28 +0,0 @@
-/// <reference types="node" />
-import { Buffer } from 'buffer';
-export declare class Base64url {
-    /**
-     *
-     * Encode into base64url string
-     *
-     */
-    static encode(input: string | Uint8Array | Buffer): string;
-    /**
-     *
-     * Encode from JSON into a base64url string
-     *
-     */
-    static encodeFromJson(input: Record<string, unknown> | Array<unknown>): string;
-    /**
-     *
-     * Decode from base64url into JSON
-     *
-     */
-    static decodeToJson<T extends Record<string, unknown> | Array<unknown> = Record<string, unknown>>(input: string): T;
-    /**
-     *
-     * Decode from base64url into a byte array
-     *
-     */
-    static decode(input: string): Uint8Array;
-}