@sphereon/ssi-sdk-ext.identifier-resolution 0.36.1-feature.integration.fides.68 → 0.36.1-feature.integration.fides.74

package/dist/index.cjs

@@ -4866,7 +4866,6 @@ async function getManagedDidIdentifier(opts, context) {
     identifier = opts.identifier;
   }
   const did = identifier.did;
-  const keys = identifier?.keys;
   const extendedKey = await (0, import_ssi_sdk_ext.getFirstKeyWithRelation)({
     ...opts,
     // Make sure we use offline mode if no pref was supplied. We are looking for managed DIDs after all. Could be it is not published yet
@@ -4875,7 +4874,6 @@ async function getManagedDidIdentifier(opts, context) {
     vmRelationship: opts.vmRelationship ?? "verificationMethod"
   }, context);
   const key = extendedKey;
-  const controllerKeyId = identifier.controllerKeyId;
   const jwk = (0, import_ssi_sdk_ext2.toJwk)(key.publicKeyHex, key.type, {
     key
   });
@@ -4888,6 +4886,42 @@ async function getManagedDidIdentifier(opts, context) {
     kid = `${did}${hash}${kid}`;
   }
   const issuer = opts.issuer ?? did;
+  let filteredKeys = identifier?.keys ?? [];
+  if (opts.kmsKeyRef) {
+    const keysByKmsKeyRef = filteredKeys.filter((k) => k.kid === opts.kmsKeyRef);
+    if (keysByKmsKeyRef.length > 0) {
+      filteredKeys = keysByKmsKeyRef;
+    }
+  }
+  if (filteredKeys.length === identifier?.keys?.length && opts.vmRelationship) {
+    const keysByVmRelationship = filteredKeys.filter((k) => {
+      const purposes = k.meta?.purposes;
+      if (!purposes || purposes.length === 0) {
+        return opts.vmRelationship === "verificationMethod";
+      }
+      return purposes.includes(opts.vmRelationship);
+    });
+    if (keysByVmRelationship.length > 0) {
+      filteredKeys = keysByVmRelationship;
+    }
+  }
+  if (filteredKeys.length === identifier?.keys?.length && typeof opts.identifier === "string" && opts.identifier.includes("#")) {
+    const fragment = opts.identifier.split("#")[1];
+    const keysByFragment = filteredKeys.filter((k) => {
+      const vmId = k.meta?.verificationMethod?.id;
+      return vmId === `${did}#${fragment}` || vmId === fragment || k.kid === fragment;
+    });
+    if (keysByFragment.length > 0) {
+      filteredKeys = keysByFragment;
+    }
+  }
+  const keys = filteredKeys;
+  const controllerKeyId = key.kid;
+  const filteredIdentifier = {
+    ...identifier,
+    keys: filteredKeys,
+    controllerKeyId
+  };
   return {
     method,
     key,
@@ -4899,7 +4933,7 @@ async function getManagedDidIdentifier(opts, context) {
     kid,
     keys,
     issuer,
-    identifier,
+    identifier: filteredIdentifier,
     clientId: opts.clientId,
     clientIdScheme: opts.clientIdScheme,
     opts