@sphereon/ssi-sdk-ext.jwt-service 0.28.1-feature.jose.vcdm.24 → 0.28.1-feature.jose.vcdm.26

package/dist/index.cjs

@@ -37365,8 +37365,10 @@ var JwtService = class {
 };
 
 // src/functions/index.ts
-var import_ssi_sdk_ext = require("@sphereon/ssi-sdk-ext.identifier-resolution");
-var import_ssi_sdk_ext2 = require("@sphereon/ssi-sdk-ext.key-utils");
+var import_ssi_sdk_ext = require("@sphereon/ssi-sdk-ext.did-utils");
+var import_ssi_sdk_ext2 = require("@sphereon/ssi-sdk-ext.identifier-resolution");
+var import_ssi_sdk_ext3 = require("@sphereon/ssi-sdk-ext.key-utils");
+var import_ssi_sdk = require("@sphereon/ssi-sdk.agent-config");
 var import_utils2 = require("@veramo/utils");
 var u8a3 = __toESM(require("uint8arrays"), 1);
 var { fromString: fromString3 } = u8a3;
@@ -37378,7 +37380,7 @@ var payloadToBytes = /* @__PURE__ */ __name((payload) => {
 var prepareJwsObject = /* @__PURE__ */ __name(async (args, context) => {
   const { existingSignatures, protectedHeader, unprotectedHeader, issuer, payload, mode = "auto", clientId, clientIdScheme } = args;
   const { noIdentifierInHeader = false } = issuer;
-  const identifier = await (0, import_ssi_sdk_ext.ensureManagedIdentifierResult)(issuer, context);
+  const identifier = await (0, import_ssi_sdk_ext2.ensureManagedIdentifierResult)(issuer, context);
   await checkAndUpdateJwsHeader({
     mode,
     identifier,
@@ -37439,10 +37441,14 @@ var createJwsJsonGeneral = /* @__PURE__ */ __name(async (args, context) => {
     issuer,
     mode
   }, context);
+  const alg = protectedHeader.alg ?? (0, import_ssi_sdk_ext3.signatureAlgorithmFromKeyType)({
+    type: identifier.key.type
+  });
   const signature = await context.agent.keyManagerSign({
     keyRef: identifier.kmsKeyRef,
     data: `${b64.protectedHeader}.${b64.payload}`,
-    encoding: void 0
+    encoding: void 0,
+    algorithm: alg
   });
   const jsonSignature = {
     protected: b64.protectedHeader,
@@ -37458,6 +37464,9 @@ var createJwsJsonGeneral = /* @__PURE__ */ __name(async (args, context) => {
   };
 }, "createJwsJsonGeneral");
 var checkAndUpdateJwsHeader = /* @__PURE__ */ __name(async ({ mode = "auto", identifier, header, noIdentifierInHeader = false }, context) => {
+  header.alg = header.alg ?? (0, import_ssi_sdk_ext3.signatureAlgorithmFromKeyType)({
+    type: identifier.key.type
+  });
   if (isIdentifierMode(mode, identifier.method, "did")) {
     await checkAndUpdateDidHeader({
       header,
@@ -37496,7 +37505,7 @@ var checkAndUpdateX5cHeader = /* @__PURE__ */ __name(async ({ header, identifier
       return Promise.reject(Error(`An x5c header was present, but its issuer public key did not match the provided signing public key!`));
     }
   } else if (!noIdentifierInHeader) {
-    if (!(0, import_ssi_sdk_ext.isManagedIdentifierX5cResult)(identifier)) {
+    if (!(0, import_ssi_sdk_ext2.isManagedIdentifierX5cResult)(identifier)) {
       return Promise.reject(Error("No x5c header in the JWT, but mode was x5c and also no x5x identifier was provided!"));
     } else if (header.jwk || header.kid) {
       return Promise.reject(Error("x5c mode was choosen, but jwk or kid headers were provided. These cannot be used together!"));
@@ -37514,7 +37523,7 @@ var checkAndUpdateDidHeader = /* @__PURE__ */ __name(async ({ header, identifier
       return Promise.reject(Error(`A kid header was present, but its value did not match the provided signing kid!`));
     }
   } else if (!noIdentifierInHeader) {
-    if (!(0, import_ssi_sdk_ext.isManagedIdentifierDidResult)(identifier)) {
+    if (!(0, import_ssi_sdk_ext2.isManagedIdentifierDidResult)(identifier)) {
       return Promise.reject(Error("No kid header in the JWT, but mode was did and also no DID identifier was provided!"));
     } else if (header.jwk || header.x5c) {
       return Promise.reject(Error("did mode was chosen, but jwk or x5c headers were provided. These cannot be used together!"));
@@ -37575,12 +37584,35 @@ var verifyJws = /* @__PURE__ */ __name(async (args, context) => {
     let valid;
     const data = fromString3(`${sigWithId.protected}.${jws.payload}`, "utf-8");
     const jwkInfo = sigWithId.identifier.jwks[0];
-    const signature = (0, import_utils2.base64ToBytes)(sigWithId.signature);
-    valid = await (0, import_ssi_sdk_ext2.verifyRawSignature)({
-      data,
-      signature,
-      key: jwkInfo.jwk
-    });
+    let signatureAlg = void 0;
+    if (sigWithId.protected.startsWith(`ey`)) {
+      const header = (0, import_utils2.decodeJoseBlob)(sigWithId.protected);
+      signatureAlg = header.alg;
+    }
+    if (false) {
+      const publicKeyHex = (0, import_ssi_sdk_ext.jwkTtoPublicKeyHex)(jwkInfo.jwk);
+      valid = await context.agent.keyManagerVerify({
+        signature: sigWithId.signature,
+        data,
+        publicKeyHex,
+        type: (0, import_ssi_sdk_ext3.keyTypeFromCryptographicSuite)({
+          ...jwkInfo.jwk.crv && {
+            crv: jwkInfo.jwk.crv
+          },
+          alg: signatureAlg
+        })
+      });
+    } else {
+      const signature = (0, import_utils2.base64ToBytes)(sigWithId.signature);
+      valid = await (0, import_ssi_sdk_ext3.verifyRawSignature)({
+        data,
+        signature,
+        key: jwkInfo.jwk,
+        opts: {
+          signatureAlg
+        }
+      });
+    }
     if (!valid) {
       errorMessages.push(`Signature ${index} was not valid`);
     }
@@ -37683,7 +37715,7 @@ var toJwsJsonGeneralWithIdentifiers = /* @__PURE__ */ __name(async (args, contex
   const signatures = await Promise.all(jws.signatures.map(async (signature) => {
     const protectedHeader = (0, import_utils2.decodeJoseBlob)(signature.protected);
     const jwk = loadJWK(args.jwk, protectedHeader, jws);
-    const identifier = jwk ? await (0, import_ssi_sdk_ext.resolveExternalJwkIdentifier)({
+    const identifier = jwk ? await (0, import_ssi_sdk_ext2.resolveExternalJwkIdentifier)({
       identifier: jwk,
       method: "jwk"
     }, context) : await resolveExternalIdentifierFromJwsHeader(protectedHeader, context, args);