@sphereon/ssi-sdk-ext.jwt-service 0.26.1-next.5 → 0.26.1-next.86

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphereon/ssi-sdk-ext.jwt-service",
-  "version": "0.26.1-next.5+3dbfe73",
+  "version": "0.26.1-next.86+650ee51",
   "source": "src/index.ts",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -15,11 +15,11 @@
     "generate-plugin-schema": "sphereon dev generate-plugin-schema"
   },
   "dependencies": {
-    "@sphereon/ssi-sdk-ext.did-utils": "0.26.1-next.5+3dbfe73",
-    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.26.1-next.5+3dbfe73",
-    "@sphereon/ssi-sdk-ext.key-manager": "0.26.1-next.5+3dbfe73",
-    "@sphereon/ssi-sdk-ext.key-utils": "0.26.1-next.5+3dbfe73",
-    "@sphereon/ssi-sdk-ext.x509-utils": "0.26.1-next.5+3dbfe73",
+    "@sphereon/ssi-sdk-ext.did-utils": "0.26.1-next.86+650ee51",
+    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.26.1-next.86+650ee51",
+    "@sphereon/ssi-sdk-ext.key-manager": "0.26.1-next.86+650ee51",
+    "@sphereon/ssi-sdk-ext.key-utils": "0.26.1-next.86+650ee51",
+    "@sphereon/ssi-sdk-ext.x509-utils": "0.26.1-next.86+650ee51",
     "@sphereon/ssi-sdk.agent-config": "0.30.2-feature.SDK.41.oidf.support.286",
     "@sphereon/ssi-types": "0.30.2-feature.SDK.41.oidf.support.286",
     "@stablelib/random": "^1.0.2",
@@ -31,9 +31,9 @@
     "uint8arrays": "^3.1.1"
   },
   "devDependencies": {
-    "@sphereon/ssi-sdk-ext.did-provider-jwk": "0.26.1-next.5+3dbfe73",
-    "@sphereon/ssi-sdk-ext.did-resolver-jwk": "0.26.1-next.5+3dbfe73",
-    "@sphereon/ssi-sdk-ext.kms-local": "0.26.1-next.5+3dbfe73",
+    "@sphereon/ssi-sdk-ext.did-provider-jwk": "0.26.1-next.86+650ee51",
+    "@sphereon/ssi-sdk-ext.did-resolver-jwk": "0.26.1-next.86+650ee51",
+    "@sphereon/ssi-sdk-ext.kms-local": "0.26.1-next.86+650ee51",
     "@sphereon/ssi-sdk.dev": "0.30.2-feature.SDK.41.oidf.support.286",
     "@veramo/data-store": "4.2.0",
     "@veramo/did-manager": "4.2.0",
@@ -68,5 +68,5 @@
     "X.509 Certificates",
     "ARF"
   ],
-  "gitHead": "3dbfe73665f102d9c51e180199348cc8288f2a9c"
+  "gitHead": "650ee51e31a6dfa4abaf1227a5dbfdc0905f4670"
 }

package/plugin.schema.json

@@ -4726,6 +4726,9 @@
             "message": {
               "type": "string"
             },
+            "detailMessage": {
+              "type": "string"
+            },
             "verificationTime": {
               "type": "string",
               "format": "date-time"
@@ -4736,6 +4739,9 @@
                 "$ref": "#/components/schemas/CertificateInfo"
               }
             },
+            "trustAnchor": {
+              "$ref": "#/components/schemas/CertificateInfo"
+            },
             "client": {
               "type": "object",
               "properties": {
@@ -5478,6 +5484,9 @@
                 "x5c": {
                   "type": "object",
                   "properties": {
+                    "allowNoTrustAnchorsFound": {
+                      "type": "boolean"
+                    },
                     "trustRootWhenNoAnchors": {
                       "type": "boolean"
                     },
@@ -5498,6 +5507,9 @@
                         }
                       ]
                     },
+                    "disallowReversedChain": {
+                      "type": "boolean"
+                    },
                     "client": {
                       "type": "object",
                       "properties": {

package/src/agent/JwtService.ts

@@ -1,111 +1,117 @@
-import {IAgentPlugin} from '@veramo/core'
-import {
-    createJwsCompact,
-    CreateJwsCompactArgs,
-    CreateJwsFlattenedArgs,
-    CreateJwsJsonArgs,
-    createJwsJsonFlattened,
-    createJwsJsonGeneral,
-    DecryptJweCompactJwtArgs,
-    EncryptJweCompactJwtArgs,
-    IJwsValidationResult,
-    IJwtService,
-    IRequiredContext,
-    jweAlg,
-    jweEnc,
-    JwsJsonFlattened,
-    JwsJsonGeneral,
-    JwtCompactResult,
-    JwtLogger,
-    PreparedJwsObject,
-    prepareJwsObject,
-    schema,
-    verifyJws,
-    VerifyJwsArgs,
-} from '..'
-import {CompactJwtEncrypter} from "../functions/JWE";
+import { IAgentPlugin } from '@veramo/core'
+import debug from 'debug'
+import { importJWK } from 'jose'
 
 import * as u8a from 'uint8arrays'
+import {
+  createJwsCompact,
+  CreateJwsCompactArgs,
+  CreateJwsFlattenedArgs,
+  CreateJwsJsonArgs,
+  createJwsJsonFlattened,
+  createJwsJsonGeneral,
+  DecryptJweCompactJwtArgs,
+  EncryptJweCompactJwtArgs,
+  IJwsValidationResult,
+  IJwtService,
+  IRequiredContext,
+  jweAlg,
+  jweEnc,
+  JwsJsonFlattened,
+  JwsJsonGeneral,
+  JwtCompactResult,
+  JwtLogger,
+  PreparedJwsObject,
+  prepareJwsObject,
+  schema,
+  verifyJws,
+  VerifyJwsArgs,
+} from '..'
+import { CompactJwtEncrypter } from '../functions/JWE'
 
 /**
  * @public
  */
 export class JwtService implements IAgentPlugin {
-    readonly schema = schema.IJwtService
-    readonly methods: IJwtService = {
-        jwtPrepareJws: this.jwtPrepareJws.bind(this),
-        jwtCreateJwsJsonGeneralSignature: this.jwtCreateJwsJsonGeneralSignature.bind(this),
-        jwtCreateJwsJsonFlattenedSignature: this.jwtCreateJwsJsonFlattenedSignature.bind(this),
-        jwtCreateJwsCompactSignature: this.jwtCreateJwsCompactSignature.bind(this),
-        jwtVerifyJwsSignature: this.jwtVerifyJwsSignature.bind(this),
-        jwtEncryptJweCompactJwt: this.jwtEncryptJweCompactJwt.bind(this),
-        jwtDecryptJweCompactJwt: this.jwtDecryptJweCompactJwt.bind(this)
-    }
+  readonly schema = schema.IJwtService
+  readonly methods: IJwtService = {
+    jwtPrepareJws: this.jwtPrepareJws.bind(this),
+    jwtCreateJwsJsonGeneralSignature: this.jwtCreateJwsJsonGeneralSignature.bind(this),
+    jwtCreateJwsJsonFlattenedSignature: this.jwtCreateJwsJsonFlattenedSignature.bind(this),
+    jwtCreateJwsCompactSignature: this.jwtCreateJwsCompactSignature.bind(this),
+    jwtVerifyJwsSignature: this.jwtVerifyJwsSignature.bind(this),
+    jwtEncryptJweCompactJwt: this.jwtEncryptJweCompactJwt.bind(this),
+    jwtDecryptJweCompactJwt: this.jwtDecryptJweCompactJwt.bind(this),
+  }
 
-    private async jwtPrepareJws(args: CreateJwsJsonArgs, context: IRequiredContext): Promise<PreparedJwsObject> {
-        return await prepareJwsObject(args, context)
-    }
+  private async jwtPrepareJws(args: CreateJwsJsonArgs, context: IRequiredContext): Promise<PreparedJwsObject> {
+    return await prepareJwsObject(args, context)
+  }
 
-    private async jwtCreateJwsJsonGeneralSignature(args: CreateJwsJsonArgs, context: IRequiredContext): Promise<JwsJsonGeneral> {
-        return await createJwsJsonGeneral(args, context)
-    }
+  private async jwtCreateJwsJsonGeneralSignature(args: CreateJwsJsonArgs, context: IRequiredContext): Promise<JwsJsonGeneral> {
+    return await createJwsJsonGeneral(args, context)
+  }
 
-    private async jwtCreateJwsJsonFlattenedSignature(args: CreateJwsFlattenedArgs, context: IRequiredContext): Promise<JwsJsonFlattened> {
-        return await createJwsJsonFlattened(args, context)
-    }
+  private async jwtCreateJwsJsonFlattenedSignature(args: CreateJwsFlattenedArgs, context: IRequiredContext): Promise<JwsJsonFlattened> {
+    return await createJwsJsonFlattened(args, context)
+  }
 
-    private async jwtCreateJwsCompactSignature(args: CreateJwsCompactArgs, context: IRequiredContext): Promise<JwtCompactResult> {
-        // We wrap it in a json object for remote REST calls
-        return {jwt: await createJwsCompact(args, context)}
-    }
+  private async jwtCreateJwsCompactSignature(args: CreateJwsCompactArgs, context: IRequiredContext): Promise<JwtCompactResult> {
+    // We wrap it in a json object for remote REST calls
+    return { jwt: await createJwsCompact(args, context) }
+  }
 
-    private async jwtVerifyJwsSignature(args: VerifyJwsArgs, context: IRequiredContext): Promise<IJwsValidationResult> {
-        return await verifyJws(args, context)
-    }
+  private async jwtVerifyJwsSignature(args: VerifyJwsArgs, context: IRequiredContext): Promise<IJwsValidationResult> {
+    return await verifyJws(args, context)
+  }
 
-    private async jwtEncryptJweCompactJwt(args: EncryptJweCompactJwtArgs, context: IRequiredContext): Promise<JwtCompactResult> {
-        const {payload, protectedHeader = {alg: args.alg, enc: args.enc}, recipientKey, issuer, expirationTime, audience} = args
+  private async jwtEncryptJweCompactJwt(args: EncryptJweCompactJwtArgs, context: IRequiredContext): Promise<JwtCompactResult> {
+    const { payload, protectedHeader = { alg: args.alg, enc: args.enc }, recipientKey, issuer, expirationTime, audience } = args
 
-        console.log(JSON.stringify(args, null, 2))
+    try {
+      debug(`JWE Encrypt: ${JSON.stringify(args, null, 2)}`)
 
-        const alg = jweAlg(args.alg) ?? jweAlg(protectedHeader.alg) ?? 'ECDH-ES'
-        const enc = jweEnc(args.enc) ?? jweEnc(protectedHeader.enc) ?? 'A256GCM'
-        const encJwks = recipientKey.jwks.length === 1 ? [recipientKey.jwks[0]] : recipientKey.jwks.filter(jwk => (jwk.kid && (jwk.kid === jwk.jwk.kid || jwk.kid === jwk.jwkThumbprint)) || jwk.jwk.use === 'enc')
-        if (encJwks.length === 0) {
-            return Promise.reject(Error(`No public JWK found that can be used to encrypt against`))
-        }
-        const jwkInfo = encJwks[0]
-        if (encJwks.length > 0) {
-            JwtLogger.warning(`More than one JWK with 'enc' usage found. Selected the first one as no 'kid' was provided`, encJwks)
-        }
-        if (jwkInfo.jwk.kty?.startsWith('EC') !== true || !alg.startsWith('ECDH')) {
-            return Promise.reject(Error(`Currently only ECDH-ES is supported for encryption. JWK alg ${jwkInfo.jwk.kty}, header alg ${alg}`)) // TODO: Probably we support way more already
-        }
-        const apuVal = protectedHeader.apu ?? args.apu
-        const apu = apuVal ? u8a.fromString(apuVal, 'base64url') : undefined
-        const apvVal = protectedHeader.apv ?? args.apv
-        const apv = apvVal ? u8a.fromString(apvVal, 'base64url') : undefined
+      const alg = jweAlg(args.alg) ?? jweAlg(protectedHeader.alg) ?? 'ECDH-ES'
+      const enc = jweEnc(args.enc) ?? jweEnc(protectedHeader.enc) ?? 'A256GCM'
+      const encJwks =
+        recipientKey.jwks.length === 1
+          ? [recipientKey.jwks[0]]
+          : recipientKey.jwks.filter((jwk) => (jwk.kid && (jwk.kid === jwk.jwk.kid || jwk.kid === jwk.jwkThumbprint)) || jwk.jwk.use === 'enc')
+      if (encJwks.length === 0) {
+        return Promise.reject(Error(`No public JWK found that can be used to encrypt against`))
+      }
+      const jwkInfo = encJwks[0]
+      if (encJwks.length > 0) {
+        JwtLogger.warning(`More than one JWK with 'enc' usage found. Selected the first one as no 'kid' was provided`, encJwks)
+      }
+      if (jwkInfo.jwk.kty?.startsWith('EC') !== true || !alg.startsWith('ECDH')) {
+        return Promise.reject(Error(`Currently only ECDH-ES is supported for encryption. JWK alg ${jwkInfo.jwk.kty}, header alg ${alg}`)) // TODO: Probably we support way more already
+      }
+      const apuVal = protectedHeader.apu ?? args.apu
+      const apu = apuVal ? u8a.fromString(apuVal, 'base64url') : undefined
+      const apvVal = protectedHeader.apv ?? args.apv
+      const apv = apvVal ? u8a.fromString(apvVal, 'base64url') : undefined
 
-        const pubKey = await crypto.subtle.importKey('jwk', jwkInfo.jwk, {
-            name: 'ECDH',
-            namedCurve: 'P-256',
-        }, true, [])
-        const encrypter = new CompactJwtEncrypter({
-            enc,
-            alg,
-            keyManagementParams: {apu, apv},
-            key: pubKey,
-            issuer,
-            expirationTime,
-            audience
-        })
+      const pubKey = await importJWK(jwkInfo.jwk)
+      const encrypter = new CompactJwtEncrypter({
+        enc,
+        alg,
+        keyManagementParams: { apu, apv },
+        key: pubKey,
+        issuer,
+        expirationTime,
+        audience,
+      })
 
-        const jwe = await encrypter.encryptCompactJWT(payload, {})
-        return {jwt: jwe}
+      const jwe = await encrypter.encryptCompactJWT(payload, {})
+      return { jwt: jwe }
+    } catch (error: any) {
+      console.error(`Error encrypting JWE: ${error.message}`, error)
+      throw error
     }
+  }
 
-    private async jwtDecryptJweCompactJwt(args: DecryptJweCompactJwtArgs, context: IRequiredContext): Promise<JwtCompactResult> {
-
-        return {jwt: "FIXME"}
-    }
+  private async jwtDecryptJweCompactJwt(args: DecryptJweCompactJwtArgs, context: IRequiredContext): Promise<JwtCompactResult> {
+    return { jwt: 'FIXME' }
+  }
 }