@sd-jwt/sd-jwt-vc 0.19.1-next.11 → 0.19.1-next.13

package/dist/index.d.mts

@@ -986,10 +986,10 @@ declare class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
     protected userConfig: SDJWTVCConfig;
     constructor(userConfig?: SDJWTVCConfig);
     /**
-     * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
+     * Validates if the disclosure frame attempts to selectively disclose protected SD-JWT-VC claims.
      * @param disclosureFrame
      */
-    protected validateReservedFields(disclosureFrame: DisclosureFrame<SdJwtVcPayload>): void;
+    protected validateDisclosureFrame(disclosureFrame?: DisclosureFrame<SdJwtVcPayload>): void;
     /**
      * Fetches the status list from the uri with a timeout of 10 seconds.
      * @param uri The URI to fetch from.

package/dist/index.d.ts

@@ -986,10 +986,10 @@ declare class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
     protected userConfig: SDJWTVCConfig;
     constructor(userConfig?: SDJWTVCConfig);
     /**
-     * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
+     * Validates if the disclosure frame attempts to selectively disclose protected SD-JWT-VC claims.
      * @param disclosureFrame
      */
-    protected validateReservedFields(disclosureFrame: DisclosureFrame<SdJwtVcPayload>): void;
+    protected validateDisclosureFrame(disclosureFrame?: DisclosureFrame<SdJwtVcPayload>): void;
     /**
      * Fetches the status list from the uri with a timeout of 10 seconds.
      * @param uri The URI to fetch from.

package/dist/index.js

@@ -280,10 +280,10 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends import_core.SDJwtInstance {
     }
   }
   /**
-   * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
+   * Validates if the disclosure frame attempts to selectively disclose protected SD-JWT-VC claims.
    * @param disclosureFrame
    */
-  validateReservedFields(disclosureFrame) {
+  validateDisclosureFrame(disclosureFrame) {
     if ((disclosureFrame == null ? void 0 : disclosureFrame._sd) && Array.isArray(disclosureFrame._sd) && disclosureFrame._sd.length > 0) {
       const reservedNames = ["iss", "nbf", "exp", "cnf", "vct", "status"];
       const reservedNamesInDisclosureFrame = disclosureFrame._sd.filter(
@@ -716,6 +716,9 @@ ${import_zod2.default.prettifyError(validated.error)}`
   verifyStatus(result, options) {
     return __async(this, null, function* () {
       var _a, _b, _c;
+      if (options == null ? void 0 : options.disableStatusVerification) {
+        return;
+      }
       if (result.payload.status) {
         if (result.payload.status.status_list) {
           const fetcher = (_a = this.userConfig.statusListFetcher) != null ? _a : this.statusListFetcher.bind(this);

package/dist/index.mjs

@@ -242,10 +242,10 @@ var SDJwtVcInstance = class _SDJwtVcInstance extends SDJwtInstance {
     }
   }
   /**
-   * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
+   * Validates if the disclosure frame attempts to selectively disclose protected SD-JWT-VC claims.
    * @param disclosureFrame
    */
-  validateReservedFields(disclosureFrame) {
+  validateDisclosureFrame(disclosureFrame) {
     if ((disclosureFrame == null ? void 0 : disclosureFrame._sd) && Array.isArray(disclosureFrame._sd) && disclosureFrame._sd.length > 0) {
       const reservedNames = ["iss", "nbf", "exp", "cnf", "vct", "status"];
       const reservedNamesInDisclosureFrame = disclosureFrame._sd.filter(
@@ -678,6 +678,9 @@ ${z2.prettifyError(validated.error)}`
   verifyStatus(result, options) {
     return __async(this, null, function* () {
       var _a, _b, _c;
+      if (options == null ? void 0 : options.disableStatusVerification) {
+        return;
+      }
       if (result.payload.status) {
         if (result.payload.status.status_list) {
           const fetcher = (_a = this.userConfig.statusListFetcher) != null ? _a : this.statusListFetcher.bind(this);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sd-jwt/sd-jwt-vc",
-  "version": "0.19.1-next.11+9e9bca1",
+  "version": "0.19.1-next.13+3d8a72a",
   "description": "sd-jwt draft 7 implementation in typescript",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -39,7 +39,7 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@owf/token-status-list": "^0.1.0-alpha-20260312123226",
-    "@sd-jwt/core": "0.19.1-next.11+9e9bca1",
+    "@sd-jwt/core": "0.19.1-next.13+3d8a72a",
     "zod": "^4.3.5"
   },
   "devDependencies": {
@@ -63,5 +63,5 @@
       "esm"
     ]
   },
-  "gitHead": "9e9bca10de3ad8574bfcbc875c85e37cee541505"
+  "gitHead": "3d8a72a0a279d67439db038c9c2b52621568b866"
 }

package/src/sd-jwt-vc-instance.ts

@@ -48,20 +48,18 @@ export class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
   }
 
   /**
-   * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
+   * Validates if the disclosure frame attempts to selectively disclose protected SD-JWT-VC claims.
    * @param disclosureFrame
    */
-  protected validateReservedFields(
-    disclosureFrame: DisclosureFrame<SdJwtVcPayload>,
+  protected validateDisclosureFrame(
+    disclosureFrame?: DisclosureFrame<SdJwtVcPayload>,
   ): void {
-    //validate disclosureFrame according to https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-08.html#section-3.2.2.2
     if (
       disclosureFrame?._sd &&
       Array.isArray(disclosureFrame._sd) &&
       disclosureFrame._sd.length > 0
     ) {
       const reservedNames = ['iss', 'nbf', 'exp', 'cnf', 'vct', 'status'];
-      // check if there is any reserved names in the disclosureFrame._sd array
       const reservedNamesInDisclosureFrame = disclosureFrame._sd.filter((key) =>
         reservedNames.includes(String(key)),
       );
@@ -625,6 +623,10 @@ export class SDJwtVcInstance extends SDJwtInstance<SdJwtVcPayload> {
     result: VerificationResult,
     options?: VerifierOptions,
   ): Promise<void> {
+    if (options?.disableStatusVerification) {
+      return;
+    }
+
     if (result.payload.status) {
       //checks if a status field is present in the payload based on https://www.ietf.org/archive/id/draft-ietf-oauth-status-list-02.html
       if (result.payload.status.status_list) {

package/src/test/index.spec.ts

@@ -120,7 +120,7 @@ describe('Revocation', () => {
     },
   });
 
-  test('Test with a non revcoked credential', async () => {
+  test('Test with a non revoked credential', async () => {
     const claims = {
       firstname: 'John',
       status: {
@@ -152,6 +152,24 @@ describe('Revocation', () => {
     await expect(result).rejects.toThrowError('Status is not valid');
   });
 
+  test('Test with a revoked credential but status verification disabled', async () => {
+    const claims = {
+      firstname: 'John',
+      status: {
+        status_list: {
+          uri: 'https://example.com/status-list',
+          idx: 1,
+        },
+      },
+    };
+    const expectedPayload: SdJwtVcPayload = { iat, iss, vct, ...claims };
+    const encodedSdjwt = await sdjwt.issue(expectedPayload);
+    const result = await sdjwt.verify(encodedSdjwt, {
+      disableStatusVerification: true,
+    });
+    expect(result).toBeDefined();
+  });
+
   test('test to fetch the statuslist', async () => {
     //TODO: not implemented yet since we need to either mock the fetcher or use a real fetcher
   });