@sphereon/ssi-sdk-ext.jwt-service 0.28.1-feature.jose.vcdm.25 → 0.28.1-feature.jose.vcdm.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphereon/ssi-sdk-ext.jwt-service",
-  "version": "0.28.1-feature.jose.vcdm.25+2116977",
+  "version": "0.28.1-feature.jose.vcdm.26+1aa66d6",
   "source": "./src/index.ts",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,11 +27,11 @@
     "generate-plugin-schema": "sphereon dev generate-plugin-schema"
   },
   "dependencies": {
-    "@sphereon/ssi-sdk-ext.did-utils": "0.28.1-feature.jose.vcdm.25+2116977",
-    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.28.1-feature.jose.vcdm.25+2116977",
-    "@sphereon/ssi-sdk-ext.key-manager": "0.28.1-feature.jose.vcdm.25+2116977",
-    "@sphereon/ssi-sdk-ext.key-utils": "0.28.1-feature.jose.vcdm.25+2116977",
-    "@sphereon/ssi-sdk-ext.x509-utils": "0.28.1-feature.jose.vcdm.25+2116977",
+    "@sphereon/ssi-sdk-ext.did-utils": "0.28.1-feature.jose.vcdm.26+1aa66d6",
+    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.28.1-feature.jose.vcdm.26+1aa66d6",
+    "@sphereon/ssi-sdk-ext.key-manager": "0.28.1-feature.jose.vcdm.26+1aa66d6",
+    "@sphereon/ssi-sdk-ext.key-utils": "0.28.1-feature.jose.vcdm.26+1aa66d6",
+    "@sphereon/ssi-sdk-ext.x509-utils": "0.28.1-feature.jose.vcdm.26+1aa66d6",
     "@sphereon/ssi-sdk.agent-config": "0.33.1-feature.jose.vcdm.56",
     "@sphereon/ssi-types": "0.33.1-feature.jose.vcdm.56",
     "@stablelib/random": "^1.0.2",
@@ -43,9 +43,10 @@
     "uint8arrays": " 3.1.1"
   },
   "devDependencies": {
-    "@sphereon/ssi-sdk-ext.did-provider-jwk": "0.28.1-feature.jose.vcdm.25+2116977",
-    "@sphereon/ssi-sdk-ext.did-resolver-jwk": "0.28.1-feature.jose.vcdm.25+2116977",
-    "@sphereon/ssi-sdk-ext.kms-local": "0.28.1-feature.jose.vcdm.25+2116977",
+    "@sphereon/ssi-sdk-ext.did-provider-jwk": "0.28.1-feature.jose.vcdm.26+1aa66d6",
+    "@sphereon/ssi-sdk-ext.did-provider-web": "0.28.1-feature.jose.vcdm.26+1aa66d6",
+    "@sphereon/ssi-sdk-ext.did-resolver-jwk": "0.28.1-feature.jose.vcdm.26+1aa66d6",
+    "@sphereon/ssi-sdk-ext.kms-local": "0.28.1-feature.jose.vcdm.26+1aa66d6",
     "@sphereon/ssi-sdk.dev": "0.33.1-feature.jose.vcdm.56",
     "@veramo/data-store": "4.2.0",
     "@veramo/did-manager": "4.2.0",
@@ -57,7 +58,8 @@
     "did-resolver": "^4.1.0",
     "express": "^4.21.2",
     "js-crypto-key-utils": "^1.0.7",
-    "typeorm": "0.3.20"
+    "typeorm": "0.3.20",
+    "web-did-resolver": "^2.0.30"
   },
   "files": [
     "dist",
@@ -81,5 +83,5 @@
     "X.509 Certificates",
     "ARF"
   ],
-  "gitHead": "2116977b572c00af55b280f2ee954526b2e7af00"
+  "gitHead": "1aa66d64d3e4050f5bc798f6f903f7aa64246d72"
 }

package/src/functions/index.ts

@@ -1,3 +1,4 @@
+import { jwkTtoPublicKeyHex } from '@sphereon/ssi-sdk-ext.did-utils'
 import {
   ensureManagedIdentifierResult,
   type ExternalIdentifierDidOpts,
@@ -9,14 +10,13 @@ import {
   type ManagedIdentifierResult,
   resolveExternalJwkIdentifier,
 } from '@sphereon/ssi-sdk-ext.identifier-resolution'
-import { verifyRawSignature } from '@sphereon/ssi-sdk-ext.key-utils'
-import type { JWK } from '@sphereon/ssi-types'
+import { keyTypeFromCryptographicSuite, signatureAlgorithmFromKeyType, verifyRawSignature } from '@sphereon/ssi-sdk-ext.key-utils'
+import { contextHasPlugin } from '@sphereon/ssi-sdk.agent-config'
+import type { JoseSignatureAlgorithm, JWK } from '@sphereon/ssi-types'
 import type { IAgentContext } from '@veramo/core'
 import { base64ToBytes, bytesToBase64url, decodeJoseBlob, encodeJoseBlob } from '@veramo/utils'
 // @ts-ignore
 import * as u8a from 'uint8arrays'
-const { fromString } = u8a
-
 import type {
   CreateJwsCompactArgs,
   CreateJwsFlattenedArgs,
@@ -37,13 +37,9 @@ import type {
   PreparedJwsObject,
   VerifyJwsArgs,
 } from '../types/IJwtService'
+import { isJwsCompact, isJwsJsonFlattened, isJwsJsonGeneral } from '../types/IJwtService'
 
-import {
-  isJwsCompact,
-  isJwsJsonFlattened,
-  isJwsJsonGeneral,
-} from '../types/IJwtService'
-
+const { fromString } = u8a
 
 const payloadToBytes = (payload: string | JwsPayload | Uint8Array): Uint8Array => {
   const isBytes = payload instanceof Uint8Array
@@ -118,11 +114,15 @@ export const createJwsJsonGeneral = async (args: CreateJwsJsonArgs, context: IRe
     },
     context
   )
+
+  const alg: string | undefined = protectedHeader.alg ?? signatureAlgorithmFromKeyType({ type: identifier.key.type })
+
   // const algorithm = await signatureAlgorithmFromKey({ key: identifier.key })
   const signature = await context.agent.keyManagerSign({
     keyRef: identifier.kmsKeyRef,
     data: `${b64.protectedHeader}.${b64.payload}`,
     encoding: undefined,
+    algorithm: alg,
   })
   const jsonSignature = {
     protected: b64.protectedHeader,
@@ -158,6 +158,8 @@ export const checkAndUpdateJwsHeader = async (
   },
   context: IRequiredContext
 ) => {
+  // Make sure we have an alg in the header (https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.1)
+  header.alg = header.alg ?? signatureAlgorithmFromKeyType({ type: identifier.key.type })
   if (isIdentifierMode(mode, identifier.method, 'did')) {
     // kid is VM of the DID
     // @see https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.4
@@ -321,23 +323,29 @@ export const verifyJws = async (args: VerifyJwsArgs, context: IAgentContext<IIde
       let valid: boolean
       const data = fromString(`${sigWithId.protected}.${jws.payload}`, 'utf-8')
       const jwkInfo = sigWithId.identifier.jwks[0]
-      /* if (sigWithId.header?.alg === 'RSA' && contextHasPlugin(context, 'keyManagerVerify')) {
+      let signatureAlg : JoseSignatureAlgorithm | undefined = undefined
+      if (sigWithId.protected.startsWith(`ey`)) {
+        const header = decodeJoseBlob(sigWithId.protected)
+        signatureAlg = header.alg as JoseSignatureAlgorithm | undefined
+      }
+
+      if (false && signatureAlg?.startsWith('PS') && contextHasPlugin(context, 'keyManagerVerify')) {
         const publicKeyHex = jwkTtoPublicKeyHex(jwkInfo.jwk)
         valid = await context.agent.keyManagerVerify({
           signature: sigWithId.signature,
           data,
           publicKeyHex,
-          type: keyTypeFromCryptographicSuite({ crv: jwkInfo.jwk.crv ?? 'ES256' }),
+          type: keyTypeFromCryptographicSuite({ ...(jwkInfo.jwk.crv && { crv: jwkInfo.jwk.crv }), alg: signatureAlg as string }),
           // no kms arg, as the current key manager needs a bit more work
         })
-      } else {*/
-      const signature = base64ToBytes(sigWithId.signature)
-      valid = await verifyRawSignature({ data, signature, key: jwkInfo.jwk })
-      // }
+      } else {
+        const signature = base64ToBytes(sigWithId.signature)
+        valid = await verifyRawSignature({ data, signature, key: jwkInfo.jwk, opts: {signatureAlg: signatureAlg} })
+        // }
+      }
       if (!valid) {
         errorMessages.push(`Signature ${index} was not valid`)
       }
-
       return {
         sigWithId,
         valid,