@sphereon/ssi-sdk-ext.identifier-resolution 0.36.1-next.50 → 0.36.1-next.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphereon/ssi-sdk-ext.identifier-resolution",
-  "version": "0.36.1-next.50+49074a02",
+  "version": "0.36.1-next.70+6dc79789",
   "source": "./src/index.ts",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,12 +27,12 @@
     "generate-plugin-schema": "tsx ../../packages/dev/bin/sphereon.js dev generate-plugin-schema"
   },
   "dependencies": {
-    "@sphereon/ssi-sdk-ext.did-utils": "0.36.1-next.50+49074a02",
-    "@sphereon/ssi-sdk-ext.key-utils": "0.36.1-next.50+49074a02",
-    "@sphereon/ssi-sdk-ext.x509-utils": "0.36.1-next.50+49074a02",
-    "@sphereon/ssi-sdk.agent-config": "0.36.1-next.50+49074a02",
-    "@sphereon/ssi-sdk.oidf-client": "0.36.1-next.50+49074a02",
-    "@sphereon/ssi-types": "0.36.1-next.50+49074a02",
+    "@sphereon/ssi-sdk-ext.did-utils": "0.36.1-next.70+6dc79789",
+    "@sphereon/ssi-sdk-ext.key-utils": "0.36.1-next.70+6dc79789",
+    "@sphereon/ssi-sdk-ext.x509-utils": "0.36.1-next.70+6dc79789",
+    "@sphereon/ssi-sdk.agent-config": "0.36.1-next.70+6dc79789",
+    "@sphereon/ssi-sdk.oidf-client": "0.36.1-next.70+6dc79789",
+    "@sphereon/ssi-types": "0.36.1-next.70+6dc79789",
     "@veramo/core": "4.2.0",
     "@veramo/utils": "4.2.0",
     "debug": "^4.3.4",
@@ -40,11 +40,11 @@
     "uint8arrays": "3.1.1"
   },
   "devDependencies": {
-    "@sphereon/ssi-sdk-ext.did-provider-jwk": "0.36.1-next.50+49074a02",
-    "@sphereon/ssi-sdk-ext.did-resolver-jwk": "0.36.1-next.50+49074a02",
-    "@sphereon/ssi-sdk-ext.key-manager": "0.36.1-next.50+49074a02",
-    "@sphereon/ssi-sdk-ext.kms-local": "0.36.1-next.50+49074a02",
-    "@sphereon/ssi-sdk.dev": "0.36.1-next.50+49074a02",
+    "@sphereon/ssi-sdk-ext.did-provider-jwk": "0.36.1-next.70+6dc79789",
+    "@sphereon/ssi-sdk-ext.did-resolver-jwk": "0.36.1-next.70+6dc79789",
+    "@sphereon/ssi-sdk-ext.key-manager": "0.36.1-next.70+6dc79789",
+    "@sphereon/ssi-sdk-ext.kms-local": "0.36.1-next.70+6dc79789",
+    "@sphereon/ssi-sdk.dev": "0.36.1-next.70+6dc79789",
     "@veramo/data-store": "4.2.0",
     "@veramo/did-manager": "4.2.0",
     "@veramo/did-resolver": "4.2.0",
@@ -78,5 +78,5 @@
     "X.509 Certificates",
     "ARF"
   ],
-  "gitHead": "49074a0266b42bdd8012e0872d471f655a0b5736"
+  "gitHead": "6dc79789e21f41b193a6e604c132d24130748fa5"
 }

package/plugin.schema.json

@@ -1052,9 +1052,9 @@
           "type": "object"
         },
         "DidDocumentJwks": {
-          "$ref": "#/components/schemas/Record<Exclude<DIDDocumentSection,(\"publicKey\"|\"service\")>,def-interface-.ts-36152-36877-.ts-0-63876[]>"
+          "$ref": "#/components/schemas/Record<Exclude<DIDDocumentSection,(\"publicKey\"|\"service\")>,def-interface-.ts-36172-36897-.ts-0-63936[]>"
         },
-        "Record<Exclude<DIDDocumentSection,(\"publicKey\"|\"service\")>,def-interface-.ts-36152-36877-.ts-0-63876[]>": {
+        "Record<Exclude<DIDDocumentSection,(\"publicKey\"|\"service\")>,def-interface-.ts-36172-36897-.ts-0-63936[]>": {
           "type": "object",
           "properties": {
             "verificationMethod": {

package/src/functions/managedIdentifierFunctions.ts

@@ -4,38 +4,37 @@ import { pemOrDerToX509Certificate } from '@sphereon/ssi-sdk-ext.x509-utils'
 import { contextHasDidManager, contextHasKeyManager } from '@sphereon/ssi-sdk.agent-config'
 import type { ICoseKeyJson, JWK } from '@sphereon/ssi-types'
 import type { IAgentContext, IIdentifier, IKey, IKeyManager } from '@veramo/core'
-import { CryptoEngine, setEngine } from 'pkijs'
 import { webcrypto } from 'node:crypto'
+import { CryptoEngine, setEngine } from 'pkijs'
 import type {
   IIdentifierResolution,
   ManagedIdentifierCoseKeyOpts,
   ManagedIdentifierCoseKeyResult,
   ManagedIdentifierDidOpts,
   ManagedIdentifierDidResult,
-  ManagedIdentifierOID4VCIssuerOpts,
-  ManagedIdentifierOID4VCIssuerResult,
   ManagedIdentifierJwkOpts,
   ManagedIdentifierJwkResult,
   ManagedIdentifierKeyOpts,
   ManagedIdentifierKeyResult,
   ManagedIdentifierKidOpts,
   ManagedIdentifierKidResult,
+  ManagedIdentifierOID4VCIssuerOpts,
+  ManagedIdentifierOID4VCIssuerResult,
   ManagedIdentifierOptsOrResult,
   ManagedIdentifierResult,
   ManagedIdentifierX5cOpts,
   ManagedIdentifierX5cResult,
 } from '../types'
-
 import {
   isManagedIdentifierCoseKeyOpts,
   isManagedIdentifierDidOpts,
   isManagedIdentifierDidResult,
-  isManagedIdentifierOID4VCIssuerOpts,
   isManagedIdentifierJwkOpts,
   isManagedIdentifierJwkResult,
   isManagedIdentifierKeyOpts,
   isManagedIdentifierKeyResult,
   isManagedIdentifierKidOpts,
+  isManagedIdentifierOID4VCIssuerOpts,
   isManagedIdentifierX5cOpts,
 } from '../types'
 
@@ -183,7 +182,6 @@ export async function getManagedDidIdentifier(opts: ManagedIdentifierDidOpts, co
   }
 
   const did = identifier.did
-  const keys = identifier?.keys // fixme: We really want to return the vmRelationship keys here actually
   const extendedKey = await getFirstKeyWithRelation(
     {
       ...opts,
@@ -195,16 +193,71 @@ export async function getManagedDidIdentifier(opts: ManagedIdentifierDidOpts, co
     context,
   )
   const key = extendedKey
-  const controllerKeyId = identifier.controllerKeyId
   const jwk = toJwk(key.publicKeyHex, key.type, { key })
   const jwkThumbprint = key.meta?.jwkThumbprint ?? calculateJwkThumbprint({ jwk })
-  let kid = opts.kid ?? extendedKey.meta?.verificationMethod?.id
-  if (!kid.startsWith(did)) {
+  let kid = opts.kid ?? extendedKey.meta?.verificationMethod?.id ?? extendedKey.kid
+  if (kid && !kid.startsWith(did)) {
     // Make sure we create a fully qualified kid
     const hash = kid.startsWith('#') ? '' : '#'
     kid = `${did}${hash}${kid}`
   }
   const issuer = opts.issuer ?? did
+
+  // filter keys based on the criteria
+  let filteredKeys = identifier?.keys ?? []
+
+  // Use a flag to track if we have successfully applied a specific filter
+  let isFiltered = false
+
+  // first try to filter by kmsKeyRef if supplied
+  if (opts.kmsKeyRef) {
+    const keysByKmsKeyRef = filteredKeys.filter((k) => k.kid === opts.kmsKeyRef)
+    if (keysByKmsKeyRef.length > 0) {
+      filteredKeys = keysByKmsKeyRef
+      isFiltered = true
+    }
+  }
+
+  // no match or kmsKeyRef not supplied, try vmRelationship
+  if (!isFiltered && opts.vmRelationship) {
+    const keysByVmRelationship = filteredKeys.filter((k) => {
+      const purposes = k.meta?.purposes
+      if (!purposes || purposes.length === 0) {
+        return opts.vmRelationship === 'verificationMethod'
+      }
+      return purposes.includes(opts.vmRelationship!)
+    })
+    if (keysByVmRelationship.length > 0) {
+      filteredKeys = keysByVmRelationship
+      isFiltered = true
+    }
+  }
+
+  //no match, try to filter by fragment from opts.identifier (if it's a string with fragment)
+  if (!isFiltered && typeof opts.identifier === 'string' && opts.identifier.includes('#')) {
+    const fragment = opts.identifier.split('#')[1]
+    const keysByFragment = filteredKeys.filter((k) => {
+      const vmId = k.meta?.verificationMethod?.id
+      return vmId === `${did}#${fragment}` || vmId === fragment || k.kid === fragment
+    })
+    if (keysByFragment.length > 0) {
+      filteredKeys = keysByFragment
+    }
+  }
+
+  // Use the filtered keys (or original keys if no filtering occurred)
+  const keys = filteredKeys
+
+  // Update controllerKeyId to match the selected key
+  const controllerKeyId = key.kid
+
+  // update the identifier object with filtered keys and updated controllerKeyId
+  const filteredIdentifier: IIdentifier = {
+    ...identifier,
+    keys: filteredKeys,
+    controllerKeyId,
+  }
+
   return {
     method,
     key,
@@ -216,7 +269,7 @@ export async function getManagedDidIdentifier(opts: ManagedIdentifierDidOpts, co
     kid,
     keys,
     issuer,
-    identifier,
+    identifier: filteredIdentifier,
     clientId: opts.clientId,
     clientIdScheme: opts.clientIdScheme,
     opts,
@@ -341,10 +394,10 @@ export async function getManagedIdentifier(
   },
   context: IAgentContext<IKeyManager>,
 ): Promise<ManagedIdentifierResult> {
-  let resolutionResult: ManagedIdentifierResult
   if (isManagedIdentifierResult(opts)) {
-    opts
+    return opts
   }
+  let resolutionResult: ManagedIdentifierResult
   if (isManagedIdentifierKidOpts(opts)) {
     resolutionResult = await getManagedKidIdentifier(opts, context)
   } else if (isManagedIdentifierDidOpts(opts)) {