@sphereon/ssi-sdk-ext.jwt-service 0.24.1-next.106 → 0.24.1-next.109

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +77 -376
  2. package/package.json +10 -10
package/README.md CHANGED
@@ -6,410 +6,111 @@
6
6
  <br>
7
7
  </h1>
8
8
 
9
- A plugin that in a uniform way can resolve any supported external identifiers, as well as get managed identifiers. It
10
- performs validations as well as return the objects in a uniform way. Public keys will always be resolved and presented
11
- as JWKs.
9
+ A plugin that can generate and verify JWTs. It can create/sign JWS in Compact, JSON General and JSON Flattened form as
10
+ specified in [RFC 7515](https://datatracker.ietf.org/doc/html/rfc7515)
12
11
 
13
- Currently, it supports the following identifier methods and types:
12
+ Currently, it supports the following JWS forms:
14
13
 
15
- - DIDs (and the internal IIdentifier type)
16
- - JWKs (JWK object and public key in hex)
17
- - kid, KMS key references and jwk thumbprints
18
- - X.509 certificate chains
14
+ - JWS Compact Form
15
+ - JWS Json General
16
+ - JWS Json Flattened (1 signature)
19
17
 
20
- TODO:
18
+ The plugin is using
19
+ the [Universal Identifier Resolution](https://github.com/Sphereon-Opensource/SSI-SDK-crypto-extensions/tree/develop/packages/identifier-resolution)
20
+ module. Both for generating JWS JWTs as well as for verifying JWTs.
21
21
 
22
- - https .well-knowns (JWKSet)
23
- - OIDC Discovery
24
- - X.509 CN en SANs
25
- - OID4VCI Issuers
22
+ When signing a JWS it takes into account any x5c, kid or JWK value already present in the header, as well as the `iss`
23
+ value. When not present but a Managed Identifier is being provided, the signing service will take care of putting the
24
+ correct headers into the JWS.
26
25
 
27
- Since the plugin dynamically looks for the correct agent plugins based on the types being resolved, this plugin should
28
- be used for any and all identifier resolution.
26
+ # Creating/signing a JWS
29
27
 
30
- No matter whether the plugin is doing resolution of external identifiers or managed/internal identifiers, the results
31
- will always include certain objects, like the JWK key(s) associated, certificates etc. This ensures uniform handling in
32
- all places that rely on key/identifier management.
28
+ The `jwtCreateJswCompactSignature` accepts a protected JWT header. You can put any JWT header properties in there.
29
+ The `payload` can either be a base64url payload, a `JwtPayload` object or a Buffer/Uint8arry. The method will take care
30
+ of any relevant conversions
33
31
 
34
- ## Managed Identifiers
35
-
36
- Managed or internal identifiers, are identifiers that are being controlled by the agent. This means the agent either has
37
- access to the private key, or is using a hardware protected mechanism with access to the private key. All of the managed
38
- methods return both a JWK managed by the agent, an IKey instance, which is the internal key representations, as well as
39
- a kmsKeyRef allowing you to retrieve the key easily later.
40
-
41
- Read an identifier by IIdentifier object or DID (or did URL)
42
-
43
- ### DIDs and IIdentifiers
32
+ The `issuer` object allows you to provide a managed identifier
44
33
 
45
34
  ```typescript
46
- const identifier = await agent.didManagerCreate({ kms: 'local' })
47
- // Created an idenftier. For example did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiR2poUzgzeTJGaWhqYkYzOFBfc01VS2Y5MzVoVnZNRHNjazBEZ3h4bUMzNCIsInkiOiJTcFZPR3g1bGV2UWM1TV9ZM2VBTTJvdWhmRnF0VXNQelVfX0RBSVRYLWhJIn0"
35
+ const publicKeyHex = '037fcdce2770f6c45d4183cbee6fdb4b7b580733357be9ef13bacf6e3c7bd15445'
36
+ const kid = publicKeyHex
48
37
 
49
- let resolution = await agent.identifierManagedGet({ identifier })
50
- console.log(JSON.stringify(resolution, null, 2))
51
38
 
52
- // This is the same as above, but with the benefit of having fully typed response, instead of a union
53
- resolution = await agent.identifierManagedGetByDid({ identifier })
54
-
55
- resolution = await agent.identifierManagedGet({
56
- identifier:
57
- 'did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiR2poUzgzeTJGaWhqYkYzOFBfc01VS2Y5MzVoVnZNRHNjazBEZ3h4bUMzNCIsInkiOiJTcFZPR3g1bGV2UWM1TV9ZM2VBTTJvdWhmRnF0VXNQelVfX0RBSVRYLWhJIn0',
58
- })
59
- // This is the same as above, but with the benefit of having fully typed response, instead of a union
60
- resolution = await agent.identifierManagedGetByDid({
61
- identifier:
62
- 'did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiR2poUzgzeTJGaWhqYkYzOFBfc01VS2Y5MzVoVnZNRHNjazBEZ3h4bUMzNCIsInkiOiJTcFZPR3g1bGV2UWM1TV9ZM2VBTTJvdWhmRnF0VXNQelVfX0RBSVRYLWhJIn0',
39
+ const example = await agent.jwtCreateJwsCompactSignature({
40
+ // Example payloads from IETF spec
41
+ issuer: {identifier: kid, noIdentifierInHeader: true}, // do not update any header values with the provided identifier. Just use the identifier for signing
42
+ protectedHeader: {alg: 'ES256'},
43
+ payload: 'eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ',
63
44
  })
64
45
  ```
65
46
 
66
- result (some parts omited for brevity:
67
-
68
- ```json
69
- {
70
- "method": "did",
71
- "jwk": {
72
- "alg": "ES256",
73
- "kty": "EC",
74
- "crv": "P-256",
75
- "x": "GjhS83y2FihjbF38P_sMUKf935hVvMDsck0DgxxmC34",
76
- "y": "SpVOGx5levQc5M_Y3eAM2ouhfFqtUsPzU__DAITX-hI",
77
- "kid": "77_7PdYbkikec5AR6zSKVIxgNExChvuOLLULBwS6jwc"
78
- },
79
- "jwkThumbprint": "77_7PdYbkikec5AR6zSKVIxgNExChvuOLLULBwS6jwc",
80
- "identifier": {
81
- "did": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiR2poUzgzeTJGaWhqYkYzOFBfc01VS2Y5MzVoVnZNRHNjazBEZ3h4bUMzNCIsInkiOiJTcFZPR3g1bGV2UWM1TV9ZM2VBTTJvdWhmRnF0VXNQelVfX0RBSVRYLWhJIn0",
82
- "controllerKeyId": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiR2poUzgzeTJGaWhqYkYzOFBfc01VS2Y5MzVoVnZNRHNjazBEZ3h4bUMzNCIsInkiOiJTcFZPR3g1bGV2UWM1TV9ZM2VBTTJvdWhmRnF0VXNQelVfX0RBSVRYLWhJIn0#0",
83
- "keys": [
84
- {
85
- <snip>
86
- "kms": "local"
87
- }
88
- ],
89
- "services": [],
90
- "provider": "did:jwk"
91
- },
92
- "did": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiR2poUzgzeTJGaWhqYkYzOFBfc01VS2Y5MzVoVnZNRHNjazBEZ3h4bUMzNCIsInkiOiJTcFZPR3g1bGV2UWM1TV9ZM2VBTTJvdWhmRnF0VXNQelVfX0RBSVRYLWhJIn0",
93
- "controllerKeyId": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiR2poUzgzeTJGaWhqYkYzOFBfc01VS2Y5MzVoVnZNRHNjazBEZ3h4bUMzNCIsInkiOiJTcFZPR3g1bGV2UWM1TV9ZM2VBTTJvdWhmRnF0VXNQelVfX0RBSVRYLWhJIn0#0",
94
- "keys": [
95
- {
96
- <snip,
97
- see
98
- key
99
- below>
100
- }
101
- ],
102
- "key": {
103
- "type": "Secp256r1",
104
- "kid": "021a3852f37cb61628636c5dfc3ffb0c50a7fddf9855bcc0ec724d03831c660b7e",
105
- "publicKeyHex": "021a3852f37cb61628636c5dfc3ffb0c50a7fddf9855bcc0ec724d03831c660b7e",
106
- "kms": "local",
107
- "meta": <snip>
108
- },
109
- "kmsKeyRef": "021a3852f37cb61628636c5dfc3ffb0c50a7fddf9855bcc0ec724d03831c660b7e"
110
- }
111
- ```
112
-
113
- ### KMS Key reference, JWK Thumbprint
47
+ Verify the signature:
114
48
 
115
- Read a managed identifier by kmsRef, or jwkThumbprint, using the above example. The response is the same, minus the
116
- identifier object, did and controllerKey values in the result as it will be a single key only in this case.
49
+ You can optionally provide a JWK if you want to use the JWK as a key for verification. Otherwise it will automacally
50
+ resolve the header params like x5c, kid (DID), JWK to perform the resolution with
51
+ the [Universal Identifier Resolution](https://github.com/Sphereon-Opensource/SSI-SDK-crypto-extensions/tree/develop/packages/identifier-resolution)
52
+ module
117
53
 
118
54
  ```typescript
119
- // JWK Thumbprint
120
- resolution = await agent.identifierManagedGet({ identifier: '77_7PdYbkikec5AR6zSKVIxgNExChvuOLLULBwS6jwc' })
121
- // This is the same as above, but with the benefit of having fully typed response, instead of a union
122
- resolution = await agent.identifierManagedGetByKid({ identifier: '77_7PdYbkikec5AR6zSKVIxgNExChvuOLLULBwS6jwc' })
123
-
124
- // KMS Key ref
125
- resolution = await agent.identifierManagedGet({ identifier: '021a3852f37cb61628636c5dfc3ffb0c50a7fddf9855bcc0ec724d03831c660b7e' })
126
- // This is the same as above, but with the benefit of having fully typed response, instead of a union
127
- resolution = await agent.identifierManagedGetByKid({ identifier: '021a3852f37cb61628636c5dfc3ffb0c50a7fddf9855bcc0ec724d03831c660b7e' })
128
-
129
- const jwk = {
130
- alg: 'ES256',
131
- kty: 'EC',
132
- crv: 'P-256',
133
- x: 'GjhS83y2FihjbF38P_sMUKf935hVvMDsck0DgxxmC34',
134
- y: 'SpVOGx5levQc5M_Y3eAM2ouhfFqtUsPzU__DAITX-hI',
135
- kid: '77_7PdYbkikec5AR6zSKVIxgNExChvuOLLULBwS6jwc',
136
- }
137
-
138
- // By JWK object
139
- resolution = await agent.identifierManagedGet({ identifier: jwk })
140
- // This is the same as above, but with the benefit of having fully typed response, instead of a union
141
- resolution = await agent.identifierManagedGetByJwk({ identifier: jwk })
142
- ```
143
-
144
- ## External Identifiers
145
-
146
- We will use the example JWK above again, as that is an in memory construct, we can also resolve it like an external
147
- identifier
148
-
149
- ### DIDs
150
-
151
- ```typescript
152
- const did =
153
- 'did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiR2poUzgzeTJGaWhqYkYzOFBfc01VS2Y5MzVoVnZNRHNjazBEZ3h4bUMzNCIsInkiOiJTcFZPR3g1bGV2UWM1TV9ZM2VBTTJvdWhmRnF0VXNQelVfX0RBSVRYLWhJIn0'
154
-
155
- resolution = await agent.identifierExternalResolve({ identifier: did })
156
- // This is the same as above, but with the benefit of having fully typed response, instead of a union
157
- resolution = await agent.identifierExternalResolveByDid({ identifier: did })
158
- console.log(JSON.stringify(resolution, null, 2))
159
- ```
160
-
161
- Results in the following JSON, with some properties removed for brevity
162
-
163
- ```json
164
- {
165
- "method": "did",
166
- "did": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0",
167
- "jwks": [
168
- {
169
- "jwk": {
170
- "alg": "ES256",
171
- "use": "sig",
172
- "kty": "EC",
173
- "crv": "P-256",
174
- "x": "wdIEmfjmaZiGsub9Hffnhbr0xVVVmVLiUYLscgRt-3Y",
175
- "y": "ept3ke4SslZb7ZbweWKmSaM3166ZuvecZ9ciKs6PDcw",
176
- "kid": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0#0"
177
- },
178
- "jwkThumbprint": "gBT5We3eKcs3NNBAeJ40iPHbWvqAmY8C8L36rGwOAJk",
179
- "kid": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0#0"
180
- }
181
- ],
182
- "didJwks": {
183
- // These are the JWKs per verification method relationship. For a JWK this includes the above JWK, so we will not repeat it here
184
- "verificationMethod": [
185
- {
186
- <snip>
187
- }
188
- ],
189
- "assertionMethod": [
190
- {
191
- <snip>
192
- }
193
- ],
194
- "authentication": [
195
- {
196
- <snip>
197
- }
198
- ],
199
- "keyAgreement": [],
200
- "capabilityInvocation": [
201
- {
202
- <snip>
203
- }
204
- ],
205
- "capabilityDelegation": [
206
- {
207
- <snip>
208
- }
209
- ]
210
- },
211
- "didDocument": {
212
- "@context": [
213
- "https://www.w3.org/ns/did/v1",
214
- {
215
- "@vocab": "https://www.iana.org/assignments/jose#"
216
- }
217
- ],
218
- "id": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0",
219
- "verificationMethod": [
220
- {
221
- "id": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0#0",
222
- "type": "JsonWebKey2020",
223
- "controller": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0",
224
- "publicKeyJwk": {
225
- "alg": "ES256",
226
- "use": "sig",
227
- "kty": "EC",
228
- "crv": "P-256",
229
- "x": "wdIEmfjmaZiGsub9Hffnhbr0xVVVmVLiUYLscgRt-3Y",
230
- "y": "ept3ke4SslZb7ZbweWKmSaM3166ZuvecZ9ciKs6PDcw",
231
- "kid": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0#0"
232
- }
233
- }
234
- ],
235
- "assertionMethod": [
236
- "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0#0"
237
- ],
238
- "authentication": [
239
- "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0#0"
240
- ],
241
- "capabilityInvocation": [
242
- "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0#0"
243
- ],
244
- "capabilityDelegation": [
245
- "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0#0"
246
- ]
247
- },
248
- "didResolutionResult": {
249
- "didDocumentMetadata": {},
250
- "didResolutionMetadata": {
251
- "contentType": "application/did+ld+json",
252
- "pattern": "^(did:jwk:.+)$",
253
- "did": {
254
- "didString": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0",
255
- "methodSpecificId": "eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0",
256
- "method": "jwk"
257
- }
258
- }
259
- },
260
- "didParsed": {
261
- "did": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0",
262
- "method": "jwk",
263
- "id": "eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0",
264
- "didUrl": "did:jwk:eyJhbGciOiJFUzI1NiIsInVzZSI6InNpZyIsImt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4Ijoid2RJRW1mam1hWmlHc3ViOUhmZm5oYnIweFZWVm1WTGlVWUxzY2dSdC0zWSIsInkiOiJlcHQza2U0U3NsWmI3WmJ3ZVdLbVNhTTMxNjZadXZlY1o5Y2lLczZQRGN3In0"
265
- }
266
- }
267
- ```
268
-
269
- ### X.509 Certificate Chains
270
-
271
- You can provide an optional verification time as well using a Date as value. By default the X5C will be fully verified,
272
- unless the verification param is set to false.
273
-
274
- ```typescript
275
- const sphereonCA = 'PEM or DER CERT'
276
- const sphereonTest = 'PEM or DER CERT'
277
-
278
- let resolution = await agent.identifierExternalResolve({
279
- identifier: [sphereonTest, sphereonCA],
280
- trustAnchors: [sphereonCA],
281
- })
282
-
283
- // This is the same as above, but with the benefit of having fully typed response, instead of a union
284
- resolution = await agent.identifierExternalResolveByX5c({
285
- identifier: [sphereonTest, sphereonCA],
286
- trustAnchors: [sphereonCA],
55
+ const ietfJwk = {
56
+ kty: 'EC',
57
+ crv: 'P-256',
58
+ x: 'f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU',
59
+ y: 'x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0',
60
+ // d: 'jpsQnnGQmL-YBIffH1136cspYG6-0iY7X1fCE9-E9LI',
61
+ } satisfies JWK
62
+
63
+ const result = await agent.jwtVerifyJwsSignature({
64
+ jws: example.jwt,
65
+ jwk: ietfJwk,
287
66
  })
288
67
 
289
- console.log(JSON.stringify(resolution, null, 2))
290
68
  ```
291
69
 
292
- ```json
293
- {
294
- "method": "x5c",
295
- "verificationResult": {
296
- "error": false,
297
- "critical": false,
298
- "message": "Certificate chain was valid",
299
- "verificationTime": "2024-08-13T13:28:16.457Z",
300
- "certificateChain": [
301
- {
302
- "issuer": {
303
- "dn": {
304
- "DN": "C=NL,O=Sphereon International B.V.,OU=IT,CN=ca.sphereon.com",
305
- "attributes": {
306
- "C": "NL",
307
- "O": "Sphereon International B.V.",
308
- "OU": "IT",
309
- "CN": "ca.sphereon.com"
310
- }
311
- }
312
- },
313
- "subject": {
314
- "dn": {
315
- "DN": "CN=test123.test.sphereon.com",
316
- "attributes": {
317
- "CN": "test123.test.sphereon.com"
318
- }
319
- }
320
- },
321
- "publicKeyJWK": {
322
- "key_ops": ["verify"],
323
- "ext": true,
324
- "kty": "EC",
325
- "x": "pyVHVR7IdgWmG_TLb3-K_4dg3XC6GQQWDB61Lna15ns",
326
- "y": "OcVNCBD0kMmqEaKjbczwd2GvbV1AOxgE7AKsa3L0zxM",
327
- "crv": "P-256"
328
- },
329
- "notBefore": "2024-08-06T20:16:12.000Z",
330
- "notAfter": "2024-11-04T22:16:12.000Z"
331
- },
332
- {
333
- "issuer": {
334
- "dn": {
335
- "DN": "C=NL,O=Sphereon International B.V.,OU=IT,CN=ca.sphereon.com",
336
- "attributes": {
337
- "C": "NL",
338
- "O": "Sphereon International B.V.",
339
- "OU": "IT",
340
- "CN": "ca.sphereon.com"
341
- }
342
- }
343
- },
344
- "subject": {
345
- "dn": {
346
- "DN": "C=NL,O=Sphereon International B.V.,OU=IT,CN=ca.sphereon.com",
347
- "attributes": {
348
- "C": "NL",
349
- "O": "Sphereon International B.V.",
350
- "OU": "IT",
351
- "CN": "ca.sphereon.com"
352
- }
353
- }
354
- },
355
- "publicKeyJWK": {
356
- "key_ops": ["verify"],
357
- "ext": true,
358
- "kty": "EC",
359
- "x": "SIDQp4RJI2s5yYIOBrxiwGRROCjBkbCq8vaf3UlSkAw",
360
- "y": "dRSwvlVFdqdiLXnk2pQqT1vZnDG0I-x-iz2EbdsG0aY",
361
- "crv": "P-256"
362
- },
363
- "notBefore": "2024-07-28T21:26:49.000Z",
364
- "notAfter": "2034-07-28T21:26:49.000Z"
365
- }
366
- ]
367
- },
368
- "issuerJWK": {
369
- "key_ops": ["verify"],
370
- "ext": true,
371
- "kty": "EC",
372
- "x": "pyVHVR7IdgWmG_TLb3-K_4dg3XC6GQQWDB61Lna15ns",
373
- "y": "OcVNCBD0kMmqEaKjbczwd2GvbV1AOxgE7AKsa3L0zxM",
374
- "crv": "P-256"
375
- },
376
- "jwks": [
377
- {
378
- "jwk": {
379
- "key_ops": ["verify"],
380
- "ext": true,
381
- "kty": "EC",
382
- "x": "pyVHVR7IdgWmG_TLb3-K_4dg3XC6GQQWDB61Lna15ns",
383
- "y": "OcVNCBD0kMmqEaKjbczwd2GvbV1AOxgE7AKsa3L0zxM",
384
- "crv": "P-256"
385
- },
386
- "kid": "CN=test123.test.sphereon.com",
387
- "jwkThumbprint": "LlITYB6tlvSVtVrMtIEzrkkSQkMSoPslhQ3Rnk1x484"
70
+ ```typescript
71
+ const result = {
72
+ critical: false,
73
+ error: false,
74
+ jws: {
75
+ payload: 'eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ',
76
+ signatures: [
77
+ {
78
+ identifier: {
79
+ jwk: {
80
+ crv: 'P-256',
81
+ kty: 'EC',
82
+ x: 'f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU',
83
+ y: 'x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0',
84
+ },
85
+ jwks: [
86
+ {
87
+ jwk: {
88
+ crv: 'P-256',
89
+ kty: 'EC',
90
+ x: 'f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU',
91
+ y: 'x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0',
92
+ },
93
+ jwkThumbprint: 'oKIywvGUpTVTyxMQ3bwIIeQUudfr_CkLMjCE19ECD-U',
94
+ publicKeyHex: '037fcdce2770f6c45d4183cbee6fdb4b7b580733357be9ef13bacf6e3c7bd15445',
95
+ },
96
+ ],
97
+ method: 'jwk',
98
+ },
99
+ protected: 'eyJhbGciOiJFUzI1NiJ9',
100
+ signature: 'e4ZrhZdbFQ7630Tq51E6RQiJaae9bFNGJszIhtusEwzvO21rzH76Wer6yRn2Zb34VjIm3cVRl0iQctbf4uBY3w',
101
+ },
102
+ ],
388
103
  },
389
- {
390
- "jwk": {
391
- "key_ops": ["verify"],
392
- "ext": true,
393
- "kty": "EC",
394
- "x": "SIDQp4RJI2s5yYIOBrxiwGRROCjBkbCq8vaf3UlSkAw",
395
- "y": "dRSwvlVFdqdiLXnk2pQqT1vZnDG0I-x-iz2EbdsG0aY",
396
- "crv": "P-256"
397
- },
398
- "kid": "C=NL,O=Sphereon International B.V.,OU=IT,CN=ca.sphereon.com",
399
- "jwkThumbprint": "1wAefk4zZ8Q8cM-9djHoJhPUtKjVFLqG7u9VftVqulA"
400
- }
401
- ],
402
- "x5c": [
403
- "MIIC1jCCAnygAwIBAgITALtvb+InWBtzJO3mAeQZIUBXbzAKBggqhkjOPQQDAjBaMQswCQYDVQQGEwJOTDEkMCIGA1UECgwbU3BoZXJlb24gSW50ZXJuYXRpb25hbCBCLlYuMQswCQYDVQQLDAJJVDEYMBYGA1UEAwwPY2Euc3BoZXJlb24uY29tMB4XDTI0MDgwNjIwMTYxMloXDTI0MTEwNDIyMTYxMlowJDEiMCAGA1UEAwwZdGVzdDEyMy50ZXN0LnNwaGVyZW9uLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABKclR1UeyHYFphv0y29/iv+HYN1wuhkEFgwetS52teZ7OcVNCBD0kMmqEaKjbczwd2GvbV1AOxgE7AKsa3L0zxOjggFVMIIBUTAdBgNVHQ4EFgQUoWVOwL15ttB1YPUd0HgvYry0Z+UwHwYDVR0jBBgwFoAU5wfKXZVc+cig/s7jZEUegLMsMsEwYQYIKwYBBQUHAQEEVTBTMFEGCCsGAQUFBzAChkVodHRwOi8vZXUuY2VydC5lemNhLmlvL2NlcnRzL2RhYTFiNGI0LTg1ZmQtNGJhNC1iOTZiLTMzMmFkZDg5OWNlOS5jZXIwEwYDVR0lBAwwCgYIKwYBBQUHAwIwJAYDVR0RBB0wG4IZdGVzdDEyMy50ZXN0LnNwaGVyZW9uLmNvbTAOBgNVHQ8BAf8EBAMCB4AwYQYDVR0fBFowWDBWoFSgUoZQaHR0cDovL2V1LmNybC5lemNhLmlvL2NybC8yY2RmN2M1ZS1iOWNkLTQzMTctYmI1Ni0zODZkMjQ0MzgwZTIvY2FzcGhlcmVvbmNvbS5jcmwwCgYIKoZIzj0EAwIDSAAwRQIgThuggyhKePvRt5YEvfg6MD42N2/63L0ypw0vLZkM+zYCIQD+uInjqsfR6K/D+ebjuOAdhOyeD2nZAW29zN20WIQJsw==",
404
- "MIICCDCCAa6gAwIBAgITAPMgqwtYzWPBXaobHhxG9iSydTAKBggqhkjOPQQDAjBaMQswCQYDVQQGEwJOTDEkMCIGA1UECgwbU3BoZXJlb24gSW50ZXJuYXRpb25hbCBCLlYuMQswCQYDVQQLDAJJVDEYMBYGA1UEAwwPY2Euc3BoZXJlb24uY29tMB4XDTI0MDcyODIxMjY0OVoXDTM0MDcyODIxMjY0OVowWjELMAkGA1UEBhMCTkwxJDAiBgNVBAoMG1NwaGVyZW9uIEludGVybmF0aW9uYWwgQi5WLjELMAkGA1UECwwCSVQxGDAWBgNVBAMMD2NhLnNwaGVyZW9uLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABEiA0KeESSNrOcmCDga8YsBkUTgowZGwqvL2n91JUpAMdRSwvlVFdqdiLXnk2pQqT1vZnDG0I+x+iz2EbdsG0aajUzBRMB0GA1UdDgQWBBTnB8pdlVz5yKD+zuNkRR6AsywywTAOBgNVHQ8BAf8EBAMCAaYwDwYDVR0lBAgwBgYEVR0lADAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0gAMEUCIHH7ie1OAAbff5262rzZVQa8J9zENG8AQlHHFydMdgaXAiEA1Ib82mhHIYDziE0DDbHEAXOs98al+7dpo8fPGVGTeKI="
405
- ]
104
+ message: 'Signature validated',
105
+ name: 'jws',
106
+ verificationTime: '2024-08-10T23:04:23'
406
107
  }
407
108
  ```
408
109
 
409
110
  ### Installation
410
111
 
411
112
  ```shell
412
- pnpm add @sphereon/ssi-sdk-ext.identifier-resolution
113
+ pnpm add @sphereon/ssi-sdk-ext.jwt-service
413
114
  ```
414
115
 
415
116
  ### Build
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@sphereon/ssi-sdk-ext.jwt-service",
3
- "version": "0.24.1-next.106+49c6348",
3
+ "version": "0.24.1-next.109+d77358b",
4
4
  "source": "src/index.ts",
5
5
  "main": "dist/index.js",
6
6
  "types": "dist/index.d.ts",
@@ -15,11 +15,11 @@
15
15
  "generate-plugin-schema": "sphereon dev generate-plugin-schema"
16
16
  },
17
17
  "dependencies": {
18
- "@sphereon/ssi-sdk-ext.did-utils": "0.24.1-next.106+49c6348",
19
- "@sphereon/ssi-sdk-ext.identifier-resolution": "0.24.1-next.106+49c6348",
20
- "@sphereon/ssi-sdk-ext.key-manager": "0.24.1-next.106+49c6348",
21
- "@sphereon/ssi-sdk-ext.key-utils": "0.24.1-next.106+49c6348",
22
- "@sphereon/ssi-sdk-ext.x509-utils": "0.24.1-next.106+49c6348",
18
+ "@sphereon/ssi-sdk-ext.did-utils": "0.24.1-next.109+d77358b",
19
+ "@sphereon/ssi-sdk-ext.identifier-resolution": "0.24.1-next.109+d77358b",
20
+ "@sphereon/ssi-sdk-ext.key-manager": "0.24.1-next.109+d77358b",
21
+ "@sphereon/ssi-sdk-ext.key-utils": "0.24.1-next.109+d77358b",
22
+ "@sphereon/ssi-sdk-ext.x509-utils": "0.24.1-next.109+d77358b",
23
23
  "@sphereon/ssi-sdk.agent-config": "0.29.1-unstable.161",
24
24
  "@sphereon/ssi-types": "0.29.1-unstable.161",
25
25
  "@veramo/core": "4.2.0",
@@ -29,9 +29,9 @@
29
29
  "uint8arrays": "^3.1.1"
30
30
  },
31
31
  "devDependencies": {
32
- "@sphereon/ssi-sdk-ext.did-provider-jwk": "0.24.1-next.106+49c6348",
33
- "@sphereon/ssi-sdk-ext.did-resolver-jwk": "0.24.1-next.106+49c6348",
34
- "@sphereon/ssi-sdk-ext.kms-local": "0.24.1-next.106+49c6348",
32
+ "@sphereon/ssi-sdk-ext.did-provider-jwk": "0.24.1-next.109+d77358b",
33
+ "@sphereon/ssi-sdk-ext.did-resolver-jwk": "0.24.1-next.109+d77358b",
34
+ "@sphereon/ssi-sdk-ext.kms-local": "0.24.1-next.109+d77358b",
35
35
  "@sphereon/ssi-sdk.dev": "0.29.1-unstable.161",
36
36
  "@veramo/data-store": "4.2.0",
37
37
  "@veramo/did-manager": "4.2.0",
@@ -66,5 +66,5 @@
66
66
  "X.509 Certificates",
67
67
  "ARF"
68
68
  ],
69
- "gitHead": "49c6348c3e55e96cc38c28679a870493eebc872e"
69
+ "gitHead": "d77358bfb88600a764da69ce64e7b39d979c7286"
70
70
  }