@sd-jwt/sd-jwt-vc 0.12.1-next.2 → 0.12.1-next.3

package/dist/index.d.mts

@@ -254,6 +254,12 @@ declare class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
      * @returns
      */
     private fetchVct;
+    /**
+     * Fetches VCT Metadata from the header of the SD-JWT-VC. Returns the type metadata format. If the SD-JWT-VC does not contain a vct claim, an error is thrown.
+     * @param result
+     * @param
+     */
+    private fetchVctFromHeader;
     /**
      * Verifies the status of the SD-JWT-VC.
      * @param result

package/dist/index.d.ts

@@ -254,6 +254,12 @@ declare class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
      * @returns
      */
     private fetchVct;
+    /**
+     * Fetches VCT Metadata from the header of the SD-JWT-VC. Returns the type metadata format. If the SD-JWT-VC does not contain a vct claim, an error is thrown.
+     * @param result
+     * @param
+     */
+    private fetchVctFromHeader;
     /**
      * Verifies the status of the SD-JWT-VC.
      * @param result

package/dist/index.js

@@ -281,14 +281,43 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends import_core.SDJwtInstance {
    */
   fetchVct(result) {
     return __async(this, null, function* () {
-      var _a;
+      var _a, _b;
       if (!result.payload.vct) {
         throw new import_utils.SDJWTException("vct claim is required");
       }
-      const fetcher = (_a = this.userConfig.vctFetcher) != null ? _a : (uri, integrity) => this.fetch(uri, integrity);
+      if ((_a = result.header) == null ? void 0 : _a.vctm) {
+        return this.fetchVctFromHeader(result.payload.vct, result);
+      }
+      const fetcher = (_b = this.userConfig.vctFetcher) != null ? _b : (uri, integrity) => this.fetch(uri, integrity);
       return fetcher(result.payload.vct, result.payload["vct#Integrity"]);
     });
   }
+  /**
+   * Fetches VCT Metadata from the header of the SD-JWT-VC. Returns the type metadata format. If the SD-JWT-VC does not contain a vct claim, an error is thrown.
+   * @param result
+   * @param
+   */
+  fetchVctFromHeader(vct, result) {
+    return __async(this, null, function* () {
+      var _a;
+      const vctmHeader = (_a = result.header) == null ? void 0 : _a.vctm;
+      if (!vctmHeader || !Array.isArray(vctmHeader)) {
+        throw new Error("vctm claim in SD JWT header is invalid");
+      }
+      const typeMetadataFormat = vctmHeader.map((vctm) => {
+        if (!(typeof vctm === "string")) {
+          throw new Error("vctm claim in SD JWT header is invalid");
+        }
+        return JSON.parse((0, import_utils.base64urlDecode)(vctm));
+      }).find((typeMetadataFormat2) => {
+        return typeMetadataFormat2.vct === vct;
+      });
+      if (!typeMetadataFormat) {
+        throw new Error("could not find VCT Metadata in JWT header");
+      }
+      return typeMetadataFormat;
+    });
+  }
   /**
    * Verifies the status of the SD-JWT-VC.
    * @param result

package/dist/index.mjs

@@ -24,7 +24,7 @@ var __async = (__this, __arguments, generator) => {
 
 // src/sd-jwt-vc-instance.ts
 import { Jwt, SDJwt, SDJwtInstance } from "@sd-jwt/core";
-import { SDJWTException } from "@sd-jwt/utils";
+import { base64urlDecode, SDJWTException } from "@sd-jwt/utils";
 import {
   getListFromStatusListJWT
 } from "@sd-jwt/jwt-status-list";
@@ -249,14 +249,43 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends SDJwtInstance {
    */
   fetchVct(result) {
     return __async(this, null, function* () {
-      var _a;
+      var _a, _b;
       if (!result.payload.vct) {
         throw new SDJWTException("vct claim is required");
       }
-      const fetcher = (_a = this.userConfig.vctFetcher) != null ? _a : (uri, integrity) => this.fetch(uri, integrity);
+      if ((_a = result.header) == null ? void 0 : _a.vctm) {
+        return this.fetchVctFromHeader(result.payload.vct, result);
+      }
+      const fetcher = (_b = this.userConfig.vctFetcher) != null ? _b : (uri, integrity) => this.fetch(uri, integrity);
       return fetcher(result.payload.vct, result.payload["vct#Integrity"]);
     });
   }
+  /**
+   * Fetches VCT Metadata from the header of the SD-JWT-VC. Returns the type metadata format. If the SD-JWT-VC does not contain a vct claim, an error is thrown.
+   * @param result
+   * @param
+   */
+  fetchVctFromHeader(vct, result) {
+    return __async(this, null, function* () {
+      var _a;
+      const vctmHeader = (_a = result.header) == null ? void 0 : _a.vctm;
+      if (!vctmHeader || !Array.isArray(vctmHeader)) {
+        throw new Error("vctm claim in SD JWT header is invalid");
+      }
+      const typeMetadataFormat = vctmHeader.map((vctm) => {
+        if (!(typeof vctm === "string")) {
+          throw new Error("vctm claim in SD JWT header is invalid");
+        }
+        return JSON.parse(base64urlDecode(vctm));
+      }).find((typeMetadataFormat2) => {
+        return typeMetadataFormat2.vct === vct;
+      });
+      if (!typeMetadataFormat) {
+        throw new Error("could not find VCT Metadata in JWT header");
+      }
+      return typeMetadataFormat;
+    });
+  }
   /**
    * Verifies the status of the SD-JWT-VC.
    * @param result

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sd-jwt/sd-jwt-vc",
-  "version": "0.12.1-next.2+1eefb26",
+  "version": "0.12.1-next.3+f89ba44",
   "description": "sd-jwt draft 7 implementation in typescript",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -39,15 +39,15 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@sd-jwt/core": "0.12.1-next.2+1eefb26",
-    "@sd-jwt/jwt-status-list": "0.12.1-next.2+1eefb26",
-    "@sd-jwt/utils": "0.12.1-next.2+1eefb26",
+    "@sd-jwt/core": "0.12.1-next.3+f89ba44",
+    "@sd-jwt/jwt-status-list": "0.12.1-next.3+f89ba44",
+    "@sd-jwt/utils": "0.12.1-next.3+f89ba44",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1"
   },
   "devDependencies": {
-    "@sd-jwt/crypto-nodejs": "0.12.1-next.2+1eefb26",
-    "@sd-jwt/types": "0.12.1-next.2+1eefb26",
+    "@sd-jwt/crypto-nodejs": "0.12.1-next.3+f89ba44",
+    "@sd-jwt/types": "0.12.1-next.3+f89ba44",
     "jose": "^5.2.2",
     "msw": "^2.3.5"
   },
@@ -67,5 +67,5 @@
       "esm"
     ]
   },
-  "gitHead": "1eefb262c40ea23e999cdef6e75222e5b4df1e2c"
+  "gitHead": "f89ba445aeb57ce342ec76b58a0eb6d0c090a4e9"
 }

package/src/sd-jwt-vc-instance.ts

@@ -1,6 +1,6 @@
 import { Jwt, SDJwt, SDJwtInstance, type VerifierOptions } from '@sd-jwt/core';
 import type { DisclosureFrame, Hasher, Verifier } from '@sd-jwt/types';
-import { SDJWTException } from '@sd-jwt/utils';
+import { base64urlDecode, SDJWTException } from '@sd-jwt/utils';
 import type { SdJwtVcPayload } from './sd-jwt-vc-payload';
 import type {
   SDJWTVCConfig,
@@ -294,12 +294,50 @@ export class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
       throw new SDJWTException('vct claim is required');
     }
 
+    if (result.header?.vctm) {
+      return this.fetchVctFromHeader(result.payload.vct, result);
+    }
+
     const fetcher: VcTFetcher =
       this.userConfig.vctFetcher ??
       ((uri, integrity) => this.fetch(uri, integrity));
     return fetcher(result.payload.vct, result.payload['vct#Integrity']);
   }
 
+  /**
+   * Fetches VCT Metadata from the header of the SD-JWT-VC. Returns the type metadata format. If the SD-JWT-VC does not contain a vct claim, an error is thrown.
+   * @param result
+   * @param
+   */
+  private async fetchVctFromHeader(
+    vct: string,
+    result: VerificationResult,
+  ): Promise<TypeMetadataFormat> {
+    const vctmHeader = result.header?.vctm;
+
+    if (!vctmHeader || !Array.isArray(vctmHeader)) {
+      throw new Error('vctm claim in SD JWT header is invalid');
+    }
+
+    const typeMetadataFormat = (vctmHeader as unknown[])
+      .map((vctm) => {
+        if (!(typeof vctm === 'string')) {
+          throw new Error('vctm claim in SD JWT header is invalid');
+        }
+
+        return JSON.parse(base64urlDecode(vctm));
+      })
+      .find((typeMetadataFormat) => {
+        return typeMetadataFormat.vct === vct;
+      });
+
+    if (!typeMetadataFormat) {
+      throw new Error('could not find VCT Metadata in JWT header');
+    }
+
+    return typeMetadataFormat;
+  }
+
   /**
    * Verifies the status of the SD-JWT-VC.
    * @param result

package/src/test/vct.spec.ts

@@ -9,6 +9,16 @@ import { HttpResponse, http } from 'msw';
 import { afterEach } from 'node:test';
 import type { TypeMetadataFormat } from '../sd-jwt-vc-type-metadata-format';
 
+const exampleVctm = {
+  vct: 'http://example.com/example',
+  name: 'ExampleCredentialType',
+  description: 'An example credential type',
+  schema_uri: 'http://example.com/schema/example',
+  //this value could be generated on demand to make it easier when changing the values
+  'schema_uri#Integrity':
+    'sha256-48a61b283ded3b55e8d9a9b063327641dc4c53f76bd5daa96c23f232822167ae',
+};
+
 const restHandlers = [
   http.get('http://example.com/schema/example', () => {
     const res = {
@@ -42,15 +52,7 @@ const restHandlers = [
     return HttpResponse.json(res);
   }),
   http.get('http://example.com/example', () => {
-    const res: TypeMetadataFormat = {
-      vct: 'http://example.com/example',
-      name: 'ExampleCredentialType',
-      description: 'An example credential type',
-      schema_uri: 'http://example.com/schema/example',
-      //this value could be generated on demand to make it easier when changing the values
-      'schema_uri#Integrity':
-        'sha256-48a61b283ded3b55e8d9a9b063327641dc4c53f76bd5daa96c23f232822167ae',
-    };
+    const res: TypeMetadataFormat = exampleVctm;
     return HttpResponse.json(res);
   }),
   http.get('http://example.com/timeout', () => {
@@ -133,6 +135,26 @@ describe('App', () => {
     await sdjwt.verify(encodedSdjwt);
   });
 
+  test('VCT from JWT header Validation', async () => {
+    const expectedPayload: SdJwtVcPayload = {
+      iat,
+      iss,
+      vct,
+      'vct#Integrity': vctIntegrity,
+      ...claims,
+    };
+    const header = {
+      vctm: [Buffer.from(JSON.stringify(exampleVctm)).toString('base64url')],
+    };
+    const encodedSdjwt = await sdjwt.issue(
+      expectedPayload,
+      disclosureFrame as unknown as DisclosureFrame<SdJwtVcPayload>,
+      { header },
+    );
+
+    await sdjwt.verify(encodedSdjwt);
+  });
+
   test('VCT Validation with timeout', async () => {
     const vct = 'http://example.com/timeout';
     const expectedPayload: SdJwtVcPayload = {