@sd-jwt/sd-jwt-vc 0.14.2-next.0 → 0.15.0

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [0.15.0](https://github.com/openwallet-foundation-labs/sd-jwt-js/compare/v0.14.1...v0.15.0) (2025-08-20)
+
+
+### Features
+
+* Allows to pass a custom function for the status list JWT validation ([#306](https://github.com/openwallet-foundation-labs/sd-jwt-js/issues/306)) ([25e546e](https://github.com/openwallet-foundation-labs/sd-jwt-js/commit/25e546e1536178f8ee41b0e1b3836656fd6f48ab))
+
+
+
+
+
 ## [0.14.1](https://github.com/openwallet-foundation-labs/sd-jwt-js/compare/v0.14.0...v0.14.1) (2025-08-02)
 
 

package/README.md

@@ -87,6 +87,8 @@ Check out more details in our [documentation](https://github.com/openwallet-foun
 
 To add revocation capabilities, you can use the `@sd-jwt/jwt-status-list` library to create a JWT Status List and include it in the SD-JWT-VC.
 
+You can pass a dedicated `statusVerifier` function in the configuration to verify the signature of the payload of the JWT of the statuslist. If no function is provided, it will fallback to the verifier that is also used for the sd-jwt-vc.
+
 ### Type Metadata
 
 By setting the `loadTypeMetadataFormat` to `true` like this:

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { SDJWTConfig, kbPayload, kbHeader, DisclosureFrame } from '@sd-jwt/types';
+import { SDJWTConfig, Verifier, kbPayload, kbHeader, DisclosureFrame } from '@sd-jwt/types';
 import { SdJwtPayload, SDJwtInstance, VerifierOptions } from '@sd-jwt/core';
 
 /**
@@ -156,6 +156,7 @@ type SDJWTVCConfig = SDJWTConfig & {
     statusListFetcher?: StatusListFetcher;
     statusValidator?: StatusValidator;
     vctFetcher?: VcTFetcher;
+    statusVerifier?: Verifier;
     loadTypeMetadataFormat?: boolean;
     timeout?: number;
 };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { SDJWTConfig, kbPayload, kbHeader, DisclosureFrame } from '@sd-jwt/types';
+import { SDJWTConfig, Verifier, kbPayload, kbHeader, DisclosureFrame } from '@sd-jwt/types';
 import { SdJwtPayload, SDJwtInstance, VerifierOptions } from '@sd-jwt/core';
 
 /**
@@ -156,6 +156,7 @@ type SDJWTVCConfig = SDJWTConfig & {
     statusListFetcher?: StatusListFetcher;
     statusValidator?: StatusValidator;
     vctFetcher?: VcTFetcher;
+    statusVerifier?: Verifier;
     loadTypeMetadataFormat?: boolean;
     timeout?: number;
 };

package/dist/index.js

@@ -325,7 +325,7 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends import_core.SDJwtInstance {
    */
   verifyStatus(result, options) {
     return __async(this, null, function* () {
-      var _a, _b, _c, _d;
+      var _a, _b, _c, _d, _e;
       if (result.payload.status) {
         if (result.payload.status.status_list) {
           const fetcher = (_a = this.userConfig.statusListFetcher) != null ? _a : this.statusListFetcher.bind(this);
@@ -333,16 +333,19 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends import_core.SDJwtInstance {
             result.payload.status.status_list.uri
           );
           const slJWT = import_core.Jwt.fromEncode(statusListJWT);
-          yield slJWT.verify(this.userConfig.verifier, options);
-          const currentDate = (_b = options == null ? void 0 : options.currentDate) != null ? _b : Math.floor(Date.now() / 1e3);
-          if (((_c = slJWT.payload) == null ? void 0 : _c.exp) && slJWT.payload.exp < currentDate) {
+          yield slJWT.verify(
+            (_b = this.userConfig.statusVerifier) != null ? _b : this.userConfig.verifier,
+            options
+          );
+          const currentDate = (_c = options == null ? void 0 : options.currentDate) != null ? _c : Math.floor(Date.now() / 1e3);
+          if (((_d = slJWT.payload) == null ? void 0 : _d.exp) && slJWT.payload.exp < currentDate) {
             throw new import_utils.SDJWTException("Status list is expired");
           }
           const statusList = (0, import_jwt_status_list.getListFromStatusListJWT)(statusListJWT);
           const status = statusList.getStatus(
             result.payload.status.status_list.idx
           );
-          const statusValidator = (_d = this.userConfig.statusValidator) != null ? _d : this.statusValidator.bind(this);
+          const statusValidator = (_e = this.userConfig.statusValidator) != null ? _e : this.statusValidator.bind(this);
           yield statusValidator(status);
         }
       }

package/dist/index.mjs

@@ -293,7 +293,7 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends SDJwtInstance {
    */
   verifyStatus(result, options) {
     return __async(this, null, function* () {
-      var _a, _b, _c, _d;
+      var _a, _b, _c, _d, _e;
       if (result.payload.status) {
         if (result.payload.status.status_list) {
           const fetcher = (_a = this.userConfig.statusListFetcher) != null ? _a : this.statusListFetcher.bind(this);
@@ -301,16 +301,19 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends SDJwtInstance {
             result.payload.status.status_list.uri
           );
           const slJWT = Jwt.fromEncode(statusListJWT);
-          yield slJWT.verify(this.userConfig.verifier, options);
-          const currentDate = (_b = options == null ? void 0 : options.currentDate) != null ? _b : Math.floor(Date.now() / 1e3);
-          if (((_c = slJWT.payload) == null ? void 0 : _c.exp) && slJWT.payload.exp < currentDate) {
+          yield slJWT.verify(
+            (_b = this.userConfig.statusVerifier) != null ? _b : this.userConfig.verifier,
+            options
+          );
+          const currentDate = (_c = options == null ? void 0 : options.currentDate) != null ? _c : Math.floor(Date.now() / 1e3);
+          if (((_d = slJWT.payload) == null ? void 0 : _d.exp) && slJWT.payload.exp < currentDate) {
             throw new SDJWTException("Status list is expired");
           }
           const statusList = getListFromStatusListJWT(statusListJWT);
           const status = statusList.getStatus(
             result.payload.status.status_list.idx
           );
-          const statusValidator = (_d = this.userConfig.statusValidator) != null ? _d : this.statusValidator.bind(this);
+          const statusValidator = (_e = this.userConfig.statusValidator) != null ? _e : this.statusValidator.bind(this);
           yield statusValidator(status);
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sd-jwt/sd-jwt-vc",
-  "version": "0.14.2-next.0+1c55f0e",
+  "version": "0.15.0",
   "description": "sd-jwt draft 7 implementation in typescript",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -39,15 +39,15 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@sd-jwt/core": "0.14.2-next.0+1c55f0e",
-    "@sd-jwt/jwt-status-list": "0.14.2-next.0+1c55f0e",
-    "@sd-jwt/utils": "0.14.2-next.0+1c55f0e",
+    "@sd-jwt/core": "0.15.0",
+    "@sd-jwt/jwt-status-list": "0.15.0",
+    "@sd-jwt/utils": "0.15.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1"
   },
   "devDependencies": {
-    "@sd-jwt/crypto-nodejs": "0.14.2-next.0+1c55f0e",
-    "@sd-jwt/types": "0.14.2-next.0+1c55f0e",
+    "@sd-jwt/crypto-nodejs": "0.15.0",
+    "@sd-jwt/types": "0.15.0",
     "jose": "^5.2.2",
     "msw": "^2.3.5"
   },
@@ -67,5 +67,5 @@
       "esm"
     ]
   },
-  "gitHead": "1c55f0ecb7a308b4115565a1f5abc57efab6b80f"
+  "gitHead": "b8733bc33817900b2bfe946bd10e3ff8673bb5fc"
 }

package/src/sd-jwt-vc-config.ts

@@ -1,4 +1,4 @@
-import type { SDJWTConfig } from '@sd-jwt/types';
+import type { SDJWTConfig, Verifier } from '@sd-jwt/types';
 import type { VcTFetcher } from './sd-jwt-vc-vct';
 
 export type StatusListFetcher = (uri: string) => Promise<string>;
@@ -14,6 +14,8 @@ export type SDJWTVCConfig = SDJWTConfig & {
   statusValidator?: StatusValidator;
   // a function that fetches the type metadata format from the uri. If not provided, the library will assume that the response is a TypeMetadataFormat. Caching has to be implemented in this function. If the integrity value is passed, it to be validated according to https://www.w3.org/TR/SRI/
   vctFetcher?: VcTFetcher;
+  // a function that verifies the status of the JWT. If not provided, the library will assume that the status is valid if it is 0.
+  statusVerifier?: Verifier;
   // if set to true, it will load the metadata format based on the vct value. If not provided, it will default to false.
   loadTypeMetadataFormat?: boolean;
   // timeout value in milliseconds when to abort the fetch request. If not provided, it will default to 10000.

package/src/sd-jwt-vc-instance.ts

@@ -358,7 +358,11 @@ export class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
           StatusListJWTPayload
         >(statusListJWT);
         // check if the status list has a valid signature. The presence of the verifier is checked in the parent class.
-        await slJWT.verify(this.userConfig.verifier as Verifier, options);
+        await slJWT.verify(
+          this.userConfig.statusVerifier ??
+            (this.userConfig.verifier as Verifier),
+          options,
+        );
 
         const currentDate =
           options?.currentDate ?? Math.floor(Date.now() / 1000);

package/src/test/index.spec.ts

@@ -22,6 +22,10 @@ const iat = Math.floor(Date.now() / 1000);
 
 const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');
 
+//create a separate keypair for the status list
+const { privateKey: statusListPrivateKey, publicKey: statusListPublicKey } =
+  Crypto.generateKeyPairSync('ed25519');
+
 //TODO: to simulate a hosted status list, use the same appraoch as in vct.spec.ts
 
 const createSignerVerifier = () => {
@@ -54,7 +58,7 @@ const generateStatusList = async (): Promise<string> => {
   const values = createHeaderAndPayload(statusList, payload, header);
   return new SignJWT(values.payload)
     .setProtectedHeader(values.header)
-    .sign(privateKey);
+    .sign(statusListPrivateKey);
 };
 
 const statusListJWT = await generateStatusList();
@@ -105,6 +109,15 @@ describe('Revocation', () => {
     //   if (status === 0) return Promise.resolve();
     //   throw new Error('Status is not valid');
     // },
+    statusVerifier: async (data: string, sig: string) => {
+      //we could also look into the data to extract the public key from the x5c when provided
+      return Crypto.verify(
+        null,
+        Buffer.from(data),
+        statusListPublicKey,
+        Buffer.from(sig, 'base64url'),
+      );
+    },
   });
 
   test('Test with a non revcoked credential', async () => {