@sd-jwt/core 0.19.1-next.1 → 0.19.1-next.11

package/src/test/decode/decode.spec.ts

@@ -0,0 +1,202 @@
+import { hasher as digest } from '@owf/crypto';
+import { describe, expect, test } from 'vitest';
+import {
+  createHashMapping,
+  decodeJwt,
+  decodeSdJwt,
+  decodeSdJwtSync,
+  getClaims,
+  getClaimsSync,
+  getSDAlgAndPayload,
+  splitSdJwt,
+  unpackObj,
+} from '../../decode';
+
+describe('decode tests', () => {
+  test('decode jwt', () => {
+    const jwt =
+      'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
+    const { header, payload, signature } = decodeJwt(jwt);
+    expect(signature).toBeDefined();
+    expect(header).toStrictEqual({ alg: 'HS256', typ: 'JWT' });
+    expect(payload).toStrictEqual({
+      sub: '1234567890',
+      name: 'John Doe',
+      iat: 1516239022,
+    });
+  });
+
+  test('decode jwt with invalid input', () => {
+    const jwt = 'invalid.invalid';
+    expect(() => decodeJwt(jwt)).toThrow('Invalid JWT as input');
+  });
+
+  test('split sdjwt', () => {
+    const sdjwt = 'h.p.s~d1~d2~';
+    const { jwt, disclosures, kbJwt } = splitSdJwt(sdjwt);
+    expect(jwt).toBe('h.p.s');
+    expect(disclosures).toStrictEqual(['d1', 'd2']);
+    expect(kbJwt).toBeUndefined();
+  });
+
+  test('split sdjwt without disclosures', () => {
+    const sdjwt = 'h.p.s';
+    const { jwt, disclosures, kbJwt } = splitSdJwt(sdjwt);
+    expect(jwt).toBe('h.p.s');
+    expect(disclosures).toStrictEqual([]);
+    expect(kbJwt).toBeUndefined();
+  });
+
+  test('split sdjwt with kbjwt', () => {
+    const sdjwt = 'h.p.s~d1~d2~kbh.kbp.kbs';
+    const { jwt, disclosures, kbJwt } = splitSdJwt(sdjwt);
+    expect(jwt).toBe('h.p.s');
+    expect(disclosures).toStrictEqual(['d1', 'd2']);
+    expect(kbJwt).toBe('kbh.kbp.kbs');
+  });
+
+  test('decode sdjwt', async () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJfc2QiOlsiaWQ1azZ1ZVplVTY4bExaMlU2YjJJbF9QR3ZKb1RDMlpkMkpwY0RwMzFIWSJdLCJfc2RfYWxnIjoic2hhLTI1NiJ9.GiLF_HhacrstqCJ223VvWOoJJWU8qk4dYQHklSMwxv36pPF_7ER53Wbty1qYRlQ6NeMUdBRRdj9JQLLCzz1gCQ~WyI2NTMxNDA2ZmVhZmU0YjBmIiwiZm9vIiwiYmFyIl0~';
+    const decodedSdJwt = await decodeSdJwt(sdjwt, digest);
+    expect(decodedSdJwt).toBeDefined();
+    expect(decodedSdJwt.kbJwt).toBeUndefined();
+    expect(decodedSdJwt.disclosures.length).toEqual(1);
+    expect(decodedSdJwt.jwt).toBeDefined();
+  });
+
+  test('decode jwt', async () => {
+    const jwt =
+      'eyJhbGciOiJIUzI1NiIsInR5cCI6InNkK2p3dCJ9.eyJsYXN0bmFtZSI6IkRvZSIsInNzbiI6IjEyMy00NS02Nzg5IiwiX3NkIjpbIk4yUXhZV1UxTlRnME1qQmpOR1JpWVRCaU1tRmtaamN5WXpSbFpXUmhaRGd5WkRCbE1qaGhZVGcwTnpJMU9XSXpZek5qWkdNNE1qZG1NVGN6TmpZd05RIiwiWlRSalkyUTVOemRoWkRVM05tWTFZV0UyTmpka01XVmpNRE16WXpOak5qQmtNak5pT0dZelpHSTBOelV4TURsak9EWTRNREEzWm1JeFpUY3daREZqTmciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.mX14Sw86xy8NFQta7tCfNmhVCqzfaJ_K3VEIhTjbLDY';
+    const decodedSdJwt = await decodeSdJwt(jwt, digest);
+    expect(decodedSdJwt).toBeDefined();
+    expect(decodedSdJwt.kbJwt).toBeUndefined();
+    expect(decodedSdJwt.disclosures.length).toEqual(0);
+    expect(decodedSdJwt.jwt).toBeDefined();
+  });
+
+  test('decode sdjwt sync', () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJfc2QiOlsiaWQ1azZ1ZVplVTY4bExaMlU2YjJJbF9QR3ZKb1RDMlpkMkpwY0RwMzFIWSJdLCJfc2RfYWxnIjoic2hhLTI1NiJ9.GiLF_HhacrstqCJ223VvWOoJJWU8qk4dYQHklSMwxv36pPF_7ER53Wbty1qYRlQ6NeMUdBRRdj9JQLLCzz1gCQ~WyI2NTMxNDA2ZmVhZmU0YjBmIiwiZm9vIiwiYmFyIl0~';
+    const decodedSdJwt = decodeSdJwtSync(sdjwt, digest);
+    expect(decodedSdJwt).toBeDefined();
+    expect(decodedSdJwt.kbJwt).toBeUndefined();
+    expect(decodedSdJwt.disclosures.length).toEqual(1);
+    expect(decodedSdJwt.jwt).toBeDefined();
+  });
+
+  test('decode jwt sync', () => {
+    const jwt =
+      'eyJhbGciOiJIUzI1NiIsInR5cCI6InNkK2p3dCJ9.eyJsYXN0bmFtZSI6IkRvZSIsInNzbiI6IjEyMy00NS02Nzg5IiwiX3NkIjpbIk4yUXhZV1UxTlRnME1qQmpOR1JpWVRCaU1tRmtaamN5WXpSbFpXUmhaRGd5WkRCbE1qaGhZVGcwTnpJMU9XSXpZek5qWkdNNE1qZG1NVGN6TmpZd05RIiwiWlRSalkyUTVOemRoWkRVM05tWTFZV0UyTmpka01XVmpNRE16WXpOak5qQmtNak5pT0dZelpHSTBOelV4TURsak9EWTRNREEzWm1JeFpUY3daREZqTmciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.mX14Sw86xy8NFQta7tCfNmhVCqzfaJ_K3VEIhTjbLDY';
+    const decodedSdJwt = decodeSdJwtSync(jwt, digest);
+    expect(decodedSdJwt).toBeDefined();
+    expect(decodedSdJwt.kbJwt).toBeUndefined();
+    expect(decodedSdJwt.disclosures.length).toEqual(0);
+    expect(decodedSdJwt.jwt).toBeDefined();
+  });
+
+  test('decode sdjwt sync (with KB)', () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZCtqd3QiLCJhbGciOiJFUzI1NiJ9.eyJpZCI6IjEyMzQiLCJfc2QiOlsiYkRUUnZtNS1Zbi1IRzdjcXBWUjVPVlJJWHNTYUJrNTdKZ2lPcV9qMVZJNCIsImV0M1VmUnlsd1ZyZlhkUEt6Zzc5aGNqRDFJdHpvUTlvQm9YUkd0TW9zRmsiLCJ6V2ZaTlMxOUF0YlJTVGJvN3NKUm4wQlpRdldSZGNob0M3VVphYkZyalk4Il0sIl9zZF9hbGciOiJzaGEtMjU2In0.n27NCtnuwytlBYtUNjgkesDP_7gN7bhaLhWNL4SWT6MaHsOjZ2ZMp987GgQRL6ZkLbJ7Cd3hlePHS84GBXPuvg~WyI1ZWI4Yzg2MjM0MDJjZjJlIiwiZmlyc3RuYW1lIiwiSm9obiJd~WyJjNWMzMWY2ZWYzNTg4MWJjIiwibGFzdG5hbWUiLCJEb2UiXQ~WyJmYTlkYTUzZWJjOTk3OThlIiwic3NuIiwiMTIzLTQ1LTY3ODkiXQ~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJpYXQiOjE3MTAwNjk3MjIsImF1ZCI6ImRpZDpleGFtcGxlOjEyMyIsIm5vbmNlIjoiazh2ZGYwbmQ2Iiwic2RfaGFzaCI6Il8tTmJWSzNmczl3VzNHaDNOUktSNEt1NmZDMUwzN0R2MFFfalBXd0ppRkUifQ.pqw2OB5IA5ya9Mxf60hE3nr2gsJEIoIlnuCa4qIisijHbwg3WzTDFmW2SuNvK_ORN0WU6RoGbJx5uYZh8k4EbA';
+    const decodedSdJwt = decodeSdJwtSync(sdjwt, digest);
+    expect(decodedSdJwt).toBeDefined();
+    expect(decodedSdJwt.kbJwt).toBeDefined();
+    expect(decodedSdJwt.disclosures.length).toEqual(3);
+    expect(decodedSdJwt.jwt).toBeDefined();
+  });
+
+  test('decode sdjwt (with KB)', async () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZCtqd3QiLCJhbGciOiJFUzI1NiJ9.eyJpZCI6IjEyMzQiLCJfc2QiOlsiYkRUUnZtNS1Zbi1IRzdjcXBWUjVPVlJJWHNTYUJrNTdKZ2lPcV9qMVZJNCIsImV0M1VmUnlsd1ZyZlhkUEt6Zzc5aGNqRDFJdHpvUTlvQm9YUkd0TW9zRmsiLCJ6V2ZaTlMxOUF0YlJTVGJvN3NKUm4wQlpRdldSZGNob0M3VVphYkZyalk4Il0sIl9zZF9hbGciOiJzaGEtMjU2In0.n27NCtnuwytlBYtUNjgkesDP_7gN7bhaLhWNL4SWT6MaHsOjZ2ZMp987GgQRL6ZkLbJ7Cd3hlePHS84GBXPuvg~WyI1ZWI4Yzg2MjM0MDJjZjJlIiwiZmlyc3RuYW1lIiwiSm9obiJd~WyJjNWMzMWY2ZWYzNTg4MWJjIiwibGFzdG5hbWUiLCJEb2UiXQ~WyJmYTlkYTUzZWJjOTk3OThlIiwic3NuIiwiMTIzLTQ1LTY3ODkiXQ~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJpYXQiOjE3MTAwNjk3MjIsImF1ZCI6ImRpZDpleGFtcGxlOjEyMyIsIm5vbmNlIjoiazh2ZGYwbmQ2Iiwic2RfaGFzaCI6Il8tTmJWSzNmczl3VzNHaDNOUktSNEt1NmZDMUwzN0R2MFFfalBXd0ppRkUifQ.pqw2OB5IA5ya9Mxf60hE3nr2gsJEIoIlnuCa4qIisijHbwg3WzTDFmW2SuNvK_ORN0WU6RoGbJx5uYZh8k4EbA';
+    const decodedSdJwt = await decodeSdJwt(sdjwt, digest);
+    expect(decodedSdJwt).toBeDefined();
+    expect(decodedSdJwt.kbJwt).toBeDefined();
+    expect(decodedSdJwt.disclosures.length).toEqual(3);
+    expect(decodedSdJwt.jwt).toBeDefined();
+  });
+
+  test('get claims', async () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJfc2QiOlsiaWQ1azZ1ZVplVTY4bExaMlU2YjJJbF9QR3ZKb1RDMlpkMkpwY0RwMzFIWSJdLCJfc2RfYWxnIjoic2hhLTI1NiJ9.GiLF_HhacrstqCJ223VvWOoJJWU8qk4dYQHklSMwxv36pPF_7ER53Wbty1qYRlQ6NeMUdBRRdj9JQLLCzz1gCQ~WyI2NTMxNDA2ZmVhZmU0YjBmIiwiZm9vIiwiYmFyIl0~';
+    const decodedSdJwt = await decodeSdJwt(sdjwt, digest);
+    const claims = await getClaims(
+      decodedSdJwt.jwt.payload,
+      decodedSdJwt.disclosures,
+      digest,
+    );
+    expect(claims).toStrictEqual({
+      foo: 'bar',
+    });
+  });
+
+  test('getClaims #2', async () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0Ijp7Il9zZCI6WyJqVEszMHNleDZhYV9kUk1KSWZDR056Q0FwbVB5MzRRNjNBa3QzS3hhSktzIl19LCJfc2QiOlsiME9nMi1ReG95eW1UOGNnVzZZUjVSSFpQLUJuR2tHUi1NM2otLV92RWlzSSIsIkcwZ3lHNnExVFMyUlQxMkZ3X2RRRDVVcjlZc1AwZlVWOXVtQWdGMC1jQ1EiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.ggEyE4SeDO2Hu3tol3VLmi7NQj56yKzKQDaafocgkLrUBdivghohtzrfcbrMN7CRufJ_Cnh0EL54kymXLGTdDQ~WyIwNGU0MjAzOWU4ZWFiOWRjIiwiYSIsIjEiXQ~WyIwOGE1Yjc5MjMyYjAzYzBhIiwiMSJd~WyJiNWE2YjUzZGQwYTFmMGIwIiwienp6IiwieHh4Il0~WyIxYzdmOTE4ZTE0MjA2NzZiIiwiZm9vIiwiYmFyIl0~WyJmZjYxYzQ5ZGU2NjFiYzMxIiwiYXJyIixbeyIuLi4iOiJTSG96VW5KNUpkd0ZtTjVCbXB5dXZCWGZfZWRjckVvcExPYThTVlBFUmg0In0sIjIiLHsiX3NkIjpbIkpuODNhZkp0OGx4NG1FMzZpRkZyS2U2R2VnN0dlVUQ4Z3UwdVo3NnRZcW8iXX1dXQ~';
+    const decodedSdJwt = await decodeSdJwt(sdjwt, digest);
+    const claims = await getClaims(
+      decodedSdJwt.jwt.payload,
+      decodedSdJwt.disclosures,
+      digest,
+    );
+    expect(claims).toStrictEqual({
+      foo: 'bar',
+      arr: ['1', '2', { a: '1' }],
+      test: {
+        zzz: 'xxx',
+      },
+    });
+  });
+
+  test('get claims sync', () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJfc2QiOlsiaWQ1azZ1ZVplVTY4bExaMlU2YjJJbF9QR3ZKb1RDMlpkMkpwY0RwMzFIWSJdLCJfc2RfYWxnIjoic2hhLTI1NiJ9.GiLF_HhacrstqCJ223VvWOoJJWU8qk4dYQHklSMwxv36pPF_7ER53Wbty1qYRlQ6NeMUdBRRdj9JQLLCzz1gCQ~WyI2NTMxNDA2ZmVhZmU0YjBmIiwiZm9vIiwiYmFyIl0~';
+    const decodedSdJwt = decodeSdJwtSync(sdjwt, digest);
+    const claims = getClaimsSync(
+      decodedSdJwt.jwt.payload,
+      decodedSdJwt.disclosures,
+      digest,
+    );
+    expect(claims).toStrictEqual({
+      foo: 'bar',
+    });
+  });
+
+  test('getClaims sync #2', () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0Ijp7Il9zZCI6WyJqVEszMHNleDZhYV9kUk1KSWZDR056Q0FwbVB5MzRRNjNBa3QzS3hhSktzIl19LCJfc2QiOlsiME9nMi1ReG95eW1UOGNnVzZZUjVSSFpQLUJuR2tHUi1NM2otLV92RWlzSSIsIkcwZ3lHNnExVFMyUlQxMkZ3X2RRRDVVcjlZc1AwZlVWOXVtQWdGMC1jQ1EiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.ggEyE4SeDO2Hu3tol3VLmi7NQj56yKzKQDaafocgkLrUBdivghohtzrfcbrMN7CRufJ_Cnh0EL54kymXLGTdDQ~WyIwNGU0MjAzOWU4ZWFiOWRjIiwiYSIsIjEiXQ~WyIwOGE1Yjc5MjMyYjAzYzBhIiwiMSJd~WyJiNWE2YjUzZGQwYTFmMGIwIiwienp6IiwieHh4Il0~WyIxYzdmOTE4ZTE0MjA2NzZiIiwiZm9vIiwiYmFyIl0~WyJmZjYxYzQ5ZGU2NjFiYzMxIiwiYXJyIixbeyIuLi4iOiJTSG96VW5KNUpkd0ZtTjVCbXB5dXZCWGZfZWRjckVvcExPYThTVlBFUmg0In0sIjIiLHsiX3NkIjpbIkpuODNhZkp0OGx4NG1FMzZpRkZyS2U2R2VnN0dlVUQ4Z3UwdVo3NnRZcW8iXX1dXQ~';
+    const decodedSdJwt = decodeSdJwtSync(sdjwt, digest);
+    const claims = getClaimsSync(
+      decodedSdJwt.jwt.payload,
+      decodedSdJwt.disclosures,
+      digest,
+    );
+    expect(claims).toStrictEqual({
+      foo: 'bar',
+      arr: ['1', '2', { a: '1' }],
+      test: {
+        zzz: 'xxx',
+      },
+    });
+  });
+
+  test('Test default sd hash algorithm', () => {
+    const { _sd_alg } = getSDAlgAndPayload({});
+    expect(_sd_alg).toBe('sha-256');
+  });
+
+  test('unpackObj clone', async () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0Ijp7Il9zZCI6WyJqVEszMHNleDZhYV9kUk1KSWZDR056Q0FwbVB5MzRRNjNBa3QzS3hhSktzIl19LCJfc2QiOlsiME9nMi1ReG95eW1UOGNnVzZZUjVSSFpQLUJuR2tHUi1NM2otLV92RWlzSSIsIkcwZ3lHNnExVFMyUlQxMkZ3X2RRRDVVcjlZc1AwZlVWOXVtQWdGMC1jQ1EiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.ggEyE4SeDO2Hu3tol3VLmi7NQj56yKzKQDaafocgkLrUBdivghohtzrfcbrMN7CRufJ_Cnh0EL54kymXLGTdDQ~WyIwNGU0MjAzOWU4ZWFiOWRjIiwiYSIsIjEiXQ~WyIwOGE1Yjc5MjMyYjAzYzBhIiwiMSJd~WyJiNWE2YjUzZGQwYTFmMGIwIiwienp6IiwieHh4Il0~WyIxYzdmOTE4ZTE0MjA2NzZiIiwiZm9vIiwiYmFyIl0~WyJmZjYxYzQ5ZGU2NjFiYzMxIiwiYXJyIixbeyIuLi4iOiJTSG96VW5KNUpkd0ZtTjVCbXB5dXZCWGZfZWRjckVvcExPYThTVlBFUmg0In0sIjIiLHsiX3NkIjpbIkpuODNhZkp0OGx4NG1FMzZpRkZyS2U2R2VnN0dlVUQ4Z3UwdVo3NnRZcW8iXX1dXQ~';
+    const decodedSdJwt = await decodeSdJwt(sdjwt, digest);
+    const jwtPayload = JSON.parse(JSON.stringify(decodedSdJwt.jwt.payload));
+
+    const { _sd_alg } = getSDAlgAndPayload(decodedSdJwt.jwt.payload);
+    const hash = { hasher: digest, alg: _sd_alg };
+    const map = await createHashMapping(decodedSdJwt.disclosures, hash);
+
+    const { unpackedObj } = unpackObj(decodedSdJwt.jwt.payload, map);
+
+    expect(unpackedObj).toBeDefined();
+    expect(jwtPayload).toStrictEqual(decodedSdJwt.jwt.payload);
+  });
+});

package/src/test/decoy.spec.ts

@@ -1,7 +1,7 @@
-import { digest, generateSalt } from '@sd-jwt/crypto-nodejs';
-import { base64urlEncode } from '@sd-jwt/utils';
+import { hasher as digest, generateSalt } from '@owf/crypto';
 import { describe, expect, test } from 'vitest';
 import { createDecoy } from '../decoy';
+import { base64urlEncode } from '../utils';
 
 const hash = {
   hasher: digest,

package/src/test/generalJSON.spec.ts

@@ -1,7 +1,7 @@
 import Crypto from 'node:crypto';
-import type { Signer, Verifier } from '@sd-jwt/types';
 import { describe, expect, test } from 'vitest';
 import { GeneralJSON } from '..';
+import type { Signer, Verifier } from '../types';
 
 const createSignerVerifier = () => {
   const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');

package/src/test/index.spec.ts

@@ -1,9 +1,9 @@
 import Crypto, { type KeyLike } from 'node:crypto';
-import { digest, ES256, generateSalt } from '@sd-jwt/crypto-nodejs';
-import type { JwtPayload, KbVerifier, Signer, Verifier } from '@sd-jwt/types';
+import { hasher as digest, ES256, generateSalt } from '@owf/crypto';
 import { exportJWK, importJWK, type JWK } from 'jose';
 import { describe, expect, test } from 'vitest';
 import { SDJwtInstance, type SdJwtPayload } from '../index';
+import type { JwtPayload, KbVerifier, Signer, Verifier } from '../types';
 
 // Extract the major version as a number
 const nodeVersionMajor = Number.parseInt(
@@ -269,6 +269,140 @@ describe('index', () => {
     expect(results).toBeDefined();
   });
 
+  test('verify rejects an expired kbJwt during full verification', async () => {
+    const { signer, verifier } = createSignerVerifier();
+    const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');
+
+    const kbVerifier: KbVerifier = async (
+      data: string,
+      sig: string,
+      payload: JwtPayload,
+    ) => {
+      if (!payload.cnf) throw Error('key binding not supported');
+      return Crypto.verify(
+        null,
+        Buffer.from(data),
+        (await importJWK(payload.cnf.jwk as JWK, 'EdDSA')) as KeyLike,
+        Buffer.from(sig, 'base64url'),
+      );
+    };
+
+    const kbSigner = (data: string) => {
+      const sig = Crypto.sign(null, Buffer.from(data), privateKey);
+      return Buffer.from(sig).toString('base64url');
+    };
+
+    const sdjwt = new SDJwtInstance<SdJwtPayload>({
+      signer,
+      signAlg: 'EdDSA',
+      verifier,
+      hasher: digest,
+      saltGenerator: generateSalt,
+      kbSigner,
+      kbVerifier,
+      kbSignAlg: 'EdDSA',
+    });
+
+    const now = Math.floor(Date.now() / 1000);
+    const credential = await sdjwt.issue(
+      {
+        foo: 'bar',
+        iat: now,
+        cnf: { jwk: await exportJWK(publicKey) },
+      },
+      { _sd: ['foo'] },
+    );
+
+    const presentation = await sdjwt.present(
+      credential,
+      { foo: true },
+      {
+        kb: {
+          payload: {
+            aud: '1',
+            iat: now - 7200,
+            nonce: '342',
+            // kb+jwt expired one hour ago
+            exp: now - 3600,
+          } as never,
+        },
+      },
+    );
+
+    await expect(
+      sdjwt.verify(presentation, {
+        requiredClaimKeys: ['foo'],
+        keyBindingNonce: '342',
+      }),
+    ).rejects.toThrow('Verify Error: JWT is expired');
+  });
+
+  test('verify accepts a kbJwt with a future exp during full verification', async () => {
+    const { signer, verifier } = createSignerVerifier();
+    const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');
+
+    const kbVerifier: KbVerifier = async (
+      data: string,
+      sig: string,
+      payload: JwtPayload,
+    ) => {
+      if (!payload.cnf) throw Error('key binding not supported');
+      return Crypto.verify(
+        null,
+        Buffer.from(data),
+        (await importJWK(payload.cnf.jwk as JWK, 'EdDSA')) as KeyLike,
+        Buffer.from(sig, 'base64url'),
+      );
+    };
+
+    const kbSigner = (data: string) => {
+      const sig = Crypto.sign(null, Buffer.from(data), privateKey);
+      return Buffer.from(sig).toString('base64url');
+    };
+
+    const sdjwt = new SDJwtInstance<SdJwtPayload>({
+      signer,
+      signAlg: 'EdDSA',
+      verifier,
+      hasher: digest,
+      saltGenerator: generateSalt,
+      kbSigner,
+      kbVerifier,
+      kbSignAlg: 'EdDSA',
+    });
+
+    const now = Math.floor(Date.now() / 1000);
+    const credential = await sdjwt.issue(
+      {
+        foo: 'bar',
+        iat: now,
+        cnf: { jwk: await exportJWK(publicKey) },
+      },
+      { _sd: ['foo'] },
+    );
+
+    const presentation = await sdjwt.present(
+      credential,
+      { foo: true },
+      {
+        kb: {
+          payload: {
+            aud: '1',
+            iat: now,
+            nonce: '342',
+            exp: now + 3600,
+          } as never,
+        },
+      },
+    );
+
+    const results = await sdjwt.verify(presentation, {
+      requiredClaimKeys: ['foo'],
+      keyBindingNonce: '342',
+    });
+    expect(results.kb).toBeDefined();
+  });
+
   test('Hasher not found', async () => {
     const sdjwt = new SDJwtInstance<SdJwtPayload>({});
     try {
@@ -627,4 +761,156 @@ describe('index', () => {
       expect(decode).toBeDefined();
     },
   );
+
+  test('safeVerify - success case', async () => {
+    const { signer, verifier } = createSignerVerifier();
+    const sdjwt = new SDJwtInstance<SdJwtPayload>({
+      signer,
+      signAlg: 'EdDSA',
+      verifier,
+      hasher: digest,
+      saltGenerator: generateSalt,
+    });
+
+    const credential = await sdjwt.issue(
+      {
+        foo: 'bar',
+        iss: 'Issuer',
+        iat: Math.floor(Date.now() / 1000),
+      },
+      {
+        _sd: ['foo'],
+      },
+    );
+
+    const result = await sdjwt.safeVerify(credential);
+
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.payload).toBeDefined();
+      expect(result.data.payload.foo).toBe('bar');
+    }
+  });
+
+  test('safeVerify - collect multiple errors', async () => {
+    const sdjwt = new SDJwtInstance<SdJwtPayload>({});
+
+    const result = await sdjwt.safeVerify('invalid.jwt.token');
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      // Should have multiple errors: hasher not found, verifier not found
+      expect(result.errors.length).toBeGreaterThanOrEqual(2);
+      const errorCodes = result.errors.map((e) => e.code);
+      expect(errorCodes).toContain('HASHER_NOT_FOUND');
+      expect(errorCodes).toContain('VERIFIER_NOT_FOUND');
+    }
+  });
+
+  test('safeVerify - invalid signature error', async () => {
+    const { signer } = createSignerVerifier();
+    const { verifier: wrongVerifier } = createSignerVerifier(); // Different key pair
+
+    const issuer = new SDJwtInstance<SdJwtPayload>({
+      signer,
+      signAlg: 'EdDSA',
+      hasher: digest,
+      saltGenerator: generateSalt,
+    });
+
+    const verifierInstance = new SDJwtInstance<SdJwtPayload>({
+      verifier: wrongVerifier,
+      hasher: digest,
+    });
+
+    const credential = await issuer.issue(
+      {
+        foo: 'bar',
+        iss: 'Issuer',
+        iat: Math.floor(Date.now() / 1000),
+      },
+      {
+        _sd: ['foo'],
+      },
+    );
+
+    const result = await verifierInstance.safeVerify(credential);
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      // The error message from the verifier contains 'signature' which maps to INVALID_JWT_SIGNATURE
+      const hasSignatureError = result.errors.some(
+        (e) =>
+          e.code === 'INVALID_JWT_SIGNATURE' ||
+          e.message.toLowerCase().includes('signature'),
+      );
+      expect(hasSignatureError).toBe(true);
+    }
+  });
+
+  test('safeVerify - expired JWT error', async () => {
+    const { signer, verifier } = createSignerVerifier();
+    const sdjwt = new SDJwtInstance<SdJwtPayload>({
+      signer,
+      signAlg: 'EdDSA',
+      verifier,
+      hasher: digest,
+      saltGenerator: generateSalt,
+    });
+
+    const credential = await sdjwt.issue(
+      {
+        foo: 'bar',
+        iss: 'Issuer',
+        iat: Math.floor(Date.now() / 1000) - 3600, // 1 hour ago
+        exp: Math.floor(Date.now() / 1000) - 1800, // Expired 30 min ago
+      },
+      {
+        _sd: ['foo'],
+      },
+    );
+
+    const result = await sdjwt.safeVerify(credential);
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.errors.some((e) => e.code === 'JWT_EXPIRED')).toBe(true);
+    }
+  });
+
+  test('safeVerify - missing required claims error', async () => {
+    const { signer, verifier } = createSignerVerifier();
+    const sdjwt = new SDJwtInstance<SdJwtPayload>({
+      signer,
+      signAlg: 'EdDSA',
+      verifier,
+      hasher: digest,
+      saltGenerator: generateSalt,
+    });
+
+    const credential = await sdjwt.issue(
+      {
+        foo: 'bar',
+        iss: 'Issuer',
+        iat: Math.floor(Date.now() / 1000),
+      },
+      {
+        _sd: ['foo'],
+      },
+    );
+
+    // Present without disclosing 'foo'
+    const presentation = await sdjwt.present(credential, {});
+
+    const result = await sdjwt.safeVerify(presentation, {
+      requiredClaimKeys: ['foo', 'missing_claim'],
+    });
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(
+        result.errors.some((e) => e.code === 'MISSING_REQUIRED_CLAIMS'),
+      ).toBe(true);
+    }
+  });
 });

package/src/test/jwt.spec.ts

@@ -1,8 +1,8 @@
 import Crypto from 'node:crypto';
-import type { Signer, Verifier } from '@sd-jwt/types';
-import { SDJWTException } from '@sd-jwt/utils';
 import { describe, expect, test } from 'vitest';
 import { Jwt } from '../jwt';
+import type { Signer, Verifier } from '../types';
+import { base64urlEncode, SDJWTException } from '../utils';
 
 describe('JWT', () => {
   test('create', async () => {
@@ -16,17 +16,11 @@ describe('JWT', () => {
   });
 
   test('returns decoded JWT when correct JWT string is provided', () => {
-    // Two objects are created separately, the first: { alg: 'HS256', typ: 'JWT' } represents a JWT Header and the second: { sub: '1234567890', name: 'John Doe' } represents a JWT Payload.
-    // These objects are turned into strings with JSON.stringify. The resulting strings are encoded with base64 encoding using Buffer.from(string).toString('base64').
-    // These base64 encoded strings are concatenated with a period (.) between them, following the structure of a JWT, which is composed of three Base64-URL strings separated by dots (header.payload.signature).
-    // A 'signature' string is added at the end to represent a JWT signature.
-    // So, the jwt variable ends up being a string with the format of a base64Url encoded Header, a period, a base64Url encoded Payload, another period, and a 'signature' string.
-    // It's important to note that the 'signature' here is just a placeholder string and not an actual cryptographic signature generated from the header and payload data.
-    const jwt = `${Buffer.from(
+    const jwt = `${base64urlEncode(
       JSON.stringify({ alg: 'HS256', typ: 'JWT' }),
-    ).toString('base64')}.${Buffer.from(
+    )}.${base64urlEncode(
       JSON.stringify({ sub: '1234567890', name: 'John Doe' }),
-    ).toString('base64')}.signature`;
+    )}.signature`;
     const result = Jwt.decodeJWT(jwt);
     expect(result).toEqual({
       header: { alg: 'HS256', typ: 'JWT' },
@@ -41,9 +35,9 @@ describe('JWT', () => {
   });
 
   test('throws an error when JWT parts are missing', () => {
-    const jwt = `${Buffer.from(
+    const jwt = `${base64urlEncode(
       JSON.stringify({ alg: 'HS256', typ: 'JWT' }),
-    ).toString('base64')}`;
+    )}`;
     expect(() => Jwt.decodeJWT(jwt)).toThrow('Invalid JWT as input');
   });