@sphereon/ssi-sdk.credential-vcdm2-jose-provider 0.33.1-feature.jose.vcdm.67 → 0.33.1-feature.vcdm.verification.71

package/dist/index.js

@@ -2,14 +2,15 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/agent/CredentialProviderVcdm2Jose.ts
-import { pickSigningKey, preProcessCredentialPayload, preProcessPresentation } from "@sphereon/ssi-sdk.credential-vcdm";
-import { normalizeCredential, normalizePresentation, verifyPresentation as verifyPresentationJWT } from "did-jwt-vc";
-import { decodeJWT, JWT_ERROR as JWT_ERROR2 } from "did-jwt";
-import Debug from "debug";
-import { asArray, intersect } from "@sphereon/ssi-sdk.core";
-import { contextHasPlugin } from "@sphereon/ssi-sdk.agent-config";
 import { isDidIdentifier } from "@sphereon/ssi-sdk-ext.identifier-resolution";
+import { signatureAlgorithmFromKey } from "@sphereon/ssi-sdk-ext.key-utils";
+import { contextHasPlugin } from "@sphereon/ssi-sdk.agent-config";
+import { asArray, intersect } from "@sphereon/ssi-sdk.core";
+import { pickSigningKey, preProcessCredentialPayload, preProcessPresentation } from "@sphereon/ssi-sdk.credential-vcdm";
 import { CredentialMapper, isVcdm2Credential } from "@sphereon/ssi-types";
+import Debug from "debug";
+import { decodeJWT, JWT_ERROR as JWT_ERROR2 } from "did-jwt";
+import { normalizeCredential, normalizePresentation, verifyPresentation as verifyPresentationJWT } from "did-jwt-vc";
 
 // src/did-jwt/JWT.ts
 import canonicalizeData from "canonicalize";
@@ -409,7 +410,6 @@ var SELF_ISSUED_V2_VC_INTEROP = "https://self-issued.me/v2/openid-vc";
 var SELF_ISSUED_V0_1 = "https://self-issued.me";
 
 // src/agent/CredentialProviderVcdm2Jose.ts
-import { signatureAlgorithmFromKey } from "@sphereon/ssi-sdk-ext.key-utils";
 var debug = Debug("sphereon:ssi-sdk:credential-jwt");
 var CredentialProviderVcdm2Jose = class {
   static {
@@ -483,13 +483,10 @@ var CredentialProviderVcdm2Jose = class {
   }
   /** {@inheritdoc ICredentialVerifier.verifyCredential} */
   async verifyCredential(args, context) {
-    let {
-      credential
-      /*policies, ...otherOptions*/
-    } = args;
+    let { credential, policies } = args;
     const uniform = CredentialMapper.toUniformCredential(credential);
     if (!isVcdm2Credential(uniform)) {
-      return Promise.reject(new Error("invalid_argument: credential must be a VCDM2 credential. Context: " + credential["@context"]));
+      return Promise.reject(new Error("invalid_argument: credential must be a VCDM2 credential. Context: " + uniform["@context"]));
     }
     let verificationResult = {
       verified: false
@@ -498,8 +495,16 @@ var CredentialProviderVcdm2Jose = class {
     if (!jwt) {
       return Promise.reject(new Error("invalid_argument: credential must be a VCDM2 credential in JOSE format (string)"));
     }
+    policies = {
+      ...policies,
+      nbf: policies?.nbf ?? policies?.issuanceDate ?? policies?.validFrom,
+      iat: policies?.iat ?? policies?.issuanceDate ?? policies?.validFrom,
+      exp: policies?.exp ?? policies?.expirationDate ?? policies?.validUntil,
+      aud: policies?.aud ?? policies?.audience
+    };
     verificationResult = await verifierSignature({
-      jwt
+      jwt,
+      policies
     }, context);
     return verificationResult;
   }
@@ -599,7 +604,18 @@ var CredentialProviderVcdm2Jose = class {
       if (result) {
         return {
           verified: true,
-          verifiablePresentation: result
+          results: [
+            {
+              verified: true,
+              presentation: result.verifiablePresentation,
+              log: [
+                {
+                  id: "valid_signature",
+                  valid: true
+                }
+              ]
+            }
+          ]
         };
       }
     } catch (e) {
@@ -646,7 +662,7 @@ var CredentialProviderVcdm2Jose = class {
     };
   }
 };
-async function verifierSignature({ jwt }, verifierContext) {
+async function verifierSignature({ jwt, policies }, verifierContext) {
   let credIssuer = void 0;
   const context = assertContext(verifierContext);
   const agent = context.agent;
@@ -687,9 +703,16 @@ async function verifierSignature({ jwt }, verifierContext) {
   if (!credIssuer) {
     throw new Error(`${JWT_ERROR2.INVALID_JWT}: No DID has been found in the JWT`);
   }
-  const resolution = await agent.identifierExternalResolve({
-    identifier: credIssuer
-  });
+  let resolution = void 0;
+  try {
+    resolution = await agent.identifierExternalResolve({
+      identifier: credIssuer
+    });
+  } catch (e) {
+  }
+  const credential = CredentialMapper.toUniformCredential(jwt);
+  const validFromError = policies.nbf !== false && policies.iat !== false && "validFrom" in credential && !!credential.validFrom && Date.parse(credential.validFrom) > (/* @__PURE__ */ new Date()).getTime();
+  const expired = policies.exp !== false && "validUntil" in credential && !!credential.validUntil && Date.parse(credential.validUntil) < (/* @__PURE__ */ new Date()).getTime();
   const didOpts = {
     method: "did",
     identifier: credIssuer
@@ -697,27 +720,85 @@ async function verifierSignature({ jwt }, verifierContext) {
   const jwtResult = await agent.jwtVerifyJwsSignature({
     jws: jwt,
     // @ts-ignore
-    jwk: resolution.jwks[0].jwk,
+    jwk: resolution?.jwks[0].jwk,
     opts: {
       ...isDidIdentifier(credIssuer) && {
         did: didOpts
       }
     }
   });
-  if (jwtResult.error) {
+  const error = jwtResult.error || expired || !resolution;
+  const errorMessage = expired ? "Credential is expired" : validFromError ? "Credential is not valid yet" : !resolution ? `Issuer ${credIssuer} could not be resolved` : jwtResult.message;
+  if (error) {
+    const log2 = [
+      {
+        id: "valid_signature",
+        valid: !jwtResult.error
+      },
+      {
+        id: "issuer_did_resolves",
+        valid: resolution != void 0
+      },
+      {
+        id: "validFrom",
+        valid: !validFromError
+      },
+      {
+        id: "expiration",
+        valid: !expired
+      }
+    ];
     return {
       verified: false,
       error: {
-        message: jwtResult.message,
+        message: errorMessage,
         errorCode: jwtResult.name
       },
+      log: log2,
+      results: [
+        {
+          verified: false,
+          credential: jwt,
+          log: log2,
+          error: {
+            message: errorMessage,
+            errorCode: jwtResult.name
+          }
+        }
+      ],
       payload,
       didResolutionResult: resolution,
       jwt
     };
   }
+  const log = [
+    {
+      id: "valid_signature",
+      valid: true
+    },
+    {
+      id: "issuer_did_resolves",
+      valid: true
+    },
+    {
+      id: "validFrom",
+      valid: true
+    },
+    {
+      id: "expiration",
+      valid: true
+    }
+  ];
   return {
     verified: true,
+    log,
+    results: [
+      {
+        verified: true,
+        credential,
+        log
+      }
+    ],
     payload,
     didResolutionResult: resolution,
     jwt