@sphereon/ssi-sdk-ext.identifier-resolution 0.36.1-next.11 → 0.36.1-next.115

package/dist/index.cjs

@@ -1088,9 +1088,9 @@ var require_plugin_schema = __commonJS({
               type: "object"
             },
             DidDocumentJwks: {
-              $ref: '#/components/schemas/Record<Exclude<DIDDocumentSection,("publicKey"|"service")>,def-interface-.ts-36152-36877-.ts-0-63876[]>'
+              $ref: '#/components/schemas/Record<Exclude<DIDDocumentSection,("publicKey"|"service")>,def-interface-.ts-36172-36897-.ts-0-63936[]>'
             },
-            'Record<Exclude<DIDDocumentSection,("publicKey"|"service")>,def-interface-.ts-36152-36877-.ts-0-63876[]>': {
+            'Record<Exclude<DIDDocumentSection,("publicKey"|"service")>,def-interface-.ts-36172-36897-.ts-0-63936[]>': {
               type: "object",
               properties: {
                 verificationMethod: {
@@ -4866,7 +4866,6 @@ async function getManagedDidIdentifier(opts, context) {
     identifier = opts.identifier;
   }
   const did = identifier.did;
-  const keys = identifier?.keys;
   const extendedKey = await (0, import_ssi_sdk_ext.getFirstKeyWithRelation)({
     ...opts,
     // Make sure we use offline mode if no pref was supplied. We are looking for managed DIDs after all. Could be it is not published yet
@@ -4875,19 +4874,57 @@ async function getManagedDidIdentifier(opts, context) {
     vmRelationship: opts.vmRelationship ?? "verificationMethod"
   }, context);
   const key = extendedKey;
-  const controllerKeyId = identifier.controllerKeyId;
   const jwk = (0, import_ssi_sdk_ext2.toJwk)(key.publicKeyHex, key.type, {
     key
   });
   const jwkThumbprint = key.meta?.jwkThumbprint ?? (0, import_ssi_sdk_ext2.calculateJwkThumbprint)({
     jwk
   });
-  let kid = opts.kid ?? extendedKey.meta?.verificationMethod?.id;
-  if (!kid.startsWith(did)) {
+  let kid = opts.kid ?? extendedKey.meta?.verificationMethod?.id ?? extendedKey.kid;
+  if (kid && !kid.startsWith(did)) {
     const hash = kid.startsWith("#") ? "" : "#";
     kid = `${did}${hash}${kid}`;
   }
   const issuer = opts.issuer ?? did;
+  let filteredKeys = identifier?.keys ?? [];
+  let isFiltered = false;
+  if (opts.kmsKeyRef) {
+    const keysByKmsKeyRef = filteredKeys.filter((k) => k.kid === opts.kmsKeyRef);
+    if (keysByKmsKeyRef.length > 0) {
+      filteredKeys = keysByKmsKeyRef;
+      isFiltered = true;
+    }
+  }
+  if (!isFiltered && opts.vmRelationship) {
+    const keysByVmRelationship = filteredKeys.filter((k) => {
+      const purposes = k.meta?.purposes;
+      if (!purposes || purposes.length === 0) {
+        return opts.vmRelationship === "verificationMethod";
+      }
+      return purposes.includes(opts.vmRelationship);
+    });
+    if (keysByVmRelationship.length > 0) {
+      filteredKeys = keysByVmRelationship;
+      isFiltered = true;
+    }
+  }
+  if (!isFiltered && typeof opts.identifier === "string" && opts.identifier.includes("#")) {
+    const fragment = opts.identifier.split("#")[1];
+    const keysByFragment = filteredKeys.filter((k) => {
+      const vmId = k.meta?.verificationMethod?.id;
+      return vmId === `${did}#${fragment}` || vmId === fragment || k.kid === fragment;
+    });
+    if (keysByFragment.length > 0) {
+      filteredKeys = keysByFragment;
+    }
+  }
+  const keys = filteredKeys;
+  const controllerKeyId = key.kid;
+  const filteredIdentifier = {
+    ...identifier,
+    keys: filteredKeys,
+    controllerKeyId
+  };
   return {
     method,
     key,
@@ -4899,7 +4936,7 @@ async function getManagedDidIdentifier(opts, context) {
     kid,
     keys,
     issuer,
-    identifier,
+    identifier: filteredIdentifier,
     clientId: opts.clientId,
     clientIdScheme: opts.clientIdScheme,
     opts
@@ -5019,10 +5056,10 @@ async function getManagedOID4VCIssuerIdentifier(opts, context) {
 }
 __name(getManagedOID4VCIssuerIdentifier, "getManagedOID4VCIssuerIdentifier");
 async function getManagedIdentifier(opts, context) {
-  let resolutionResult;
   if (isManagedIdentifierResult(opts)) {
-    opts;
+    return opts;
   }
+  let resolutionResult;
   if (isManagedIdentifierKidOpts(opts)) {
     resolutionResult = await getManagedKidIdentifier(opts, context);
   } else if (isManagedIdentifierDidOpts(opts)) {
@@ -5262,7 +5299,13 @@ async function resolveExternalDidIdentifier(opts, context) {
   }).resolve(did);
   const didDocument = didResolutionResult.didDocument ?? void 0;
   const didJwks = didDocument ? (0, import_ssi_sdk_ext4.didDocumentToJwks)(didDocument) : void 0;
-  const jwks = didJwks ? Array.from(new Set(Array.from(Object.values(didJwks).filter((jwks2) => (0, import_utils.isDefined)(jwks2) && jwks2.length > 0).flatMap((jwks2) => jwks2)).flatMap((jwk) => {
+  const jwks = didJwks ? Array.from(new Set(Array.from(Object.values(didJwks).filter((jwks2) => (0, import_utils.isDefined)(jwks2) && jwks2.length > 0).flatMap((jwks2) => jwks2)).filter((jwk) => {
+    if (!didParsed.fragment) {
+      return true;
+    }
+    const fullKid = `${didParsed.did}#${didParsed.fragment}`;
+    return jwk.kid === fullKid || jwk.kid === didParsed.fragment;
+  }).flatMap((jwk) => {
     return {
       jwk,
       jwkThumbprint: (0, import_ssi_sdk_ext5.calculateJwkThumbprint)({