@sphereon/ssi-sdk.credential-vcdm2-jose-provider 0.33.1-feature.vcdm.verification.69 → 0.33.1-feature.vcdm.verification.72

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sphereon/ssi-sdk.credential-vcdm2-jose-provider",
   "description": "Plugin for working with W3C Verifiable Credentials DataModel 2 JOSE Credentials & Presentations.",
-  "version": "0.33.1-feature.vcdm.verification.69+44037dda",
+  "version": "0.33.1-feature.vcdm.verification.72+3e51baa9",
   "source": "src/index.ts",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -30,9 +30,9 @@
     "@sphereon/ssi-sdk-ext.identifier-resolution": "0.28.1-next.53",
     "@sphereon/ssi-sdk-ext.jwt-service": "0.28.1-next.53",
     "@sphereon/ssi-sdk-ext.key-utils": "0.28.1-next.53",
-    "@sphereon/ssi-sdk.core": "0.33.1-feature.vcdm.verification.69+44037dda",
-    "@sphereon/ssi-sdk.credential-vcdm": "0.33.1-feature.vcdm.verification.69+44037dda",
-    "@sphereon/ssi-types": "0.33.1-feature.vcdm.verification.69+44037dda",
+    "@sphereon/ssi-sdk.core": "0.33.1-feature.vcdm.verification.72+3e51baa9",
+    "@sphereon/ssi-sdk.credential-vcdm": "0.33.1-feature.vcdm.verification.72+3e51baa9",
+    "@sphereon/ssi-types": "0.33.1-feature.vcdm.verification.72+3e51baa9",
     "@veramo/core": "4.2.0",
     "@veramo/utils": "4.2.0",
     "canonicalize": "^2.0.0",
@@ -47,7 +47,7 @@
     "@sphereon/ssi-sdk-ext.did-provider-key": "0.28.1-next.53",
     "@sphereon/ssi-sdk-ext.key-manager": "0.28.1-next.53",
     "@sphereon/ssi-sdk-ext.kms-local": "0.28.1-next.53",
-    "@sphereon/ssi-sdk.agent-config": "0.33.1-feature.vcdm.verification.69+44037dda",
+    "@sphereon/ssi-sdk.agent-config": "0.33.1-feature.vcdm.verification.72+3e51baa9",
     "@types/debug": "4.1.8",
     "@veramo/did-manager": "4.2.0",
     "@veramo/did-provider-ethr": "4.2.0",
@@ -84,5 +84,5 @@
     "node_modules",
     "src"
   ],
-  "gitHead": "44037ddadc9fb841c47bd711ab98d29a0d57f32d"
+  "gitHead": "3e51baa92956b7979a4f9e673369ef8c32ac5cf2"
 }

package/src/agent/CredentialProviderVcdm2Jose.ts

@@ -35,7 +35,7 @@ import type {
   IKey,
   IKeyManager,
   IResolver,
-  VerifiableCredential,
+  VerifiableCredential, VerificationPolicies,
   VerifierAgentContext
 } from '@veramo/core'
 
@@ -111,7 +111,7 @@ export class CredentialProviderVcdm2Jose implements IVcdmCredentialProvider {
       kid: key.meta?.verificationMethod?.id ?? key.kid,
       alg,
       typ: 'vc+jwt',
-      cty: 'vc',
+      cty: 'vc'
     }
 
     const jwt = await context.agent.jwtCreateJwsCompactSignature({
@@ -119,7 +119,7 @@ export class CredentialProviderVcdm2Jose implements IVcdmCredentialProvider {
       issuer: managedIdentifier,
       payload: credential,
       protectedHeader: header,
-      clientIdScheme: 'did',
+      clientIdScheme: 'did'
     })
 
     // debug(jwt)
@@ -128,7 +128,7 @@ export class CredentialProviderVcdm2Jose implements IVcdmCredentialProvider {
 
   /** {@inheritdoc ICredentialVerifier.verifyCredential} */
   async verifyCredential(args: IVerifyCredentialVcdmArgs, context: VerifierAgentContext): Promise<IVerifyResult> {
-    let { credential /*policies, ...otherOptions*/ } = args
+    let { credential, policies, /*...otherOptions*/ } = args
     const uniform = CredentialMapper.toUniformCredential(credential as OriginalVerifiableCredential)
     // let verifiedCredential: VerifiableCredential
     if (!isVcdm2Credential(uniform)) {
@@ -139,7 +139,14 @@ export class CredentialProviderVcdm2Jose implements IVcdmCredentialProvider {
     if (!jwt) {
       return Promise.reject(new Error('invalid_argument: credential must be a VCDM2 credential in JOSE format (string)'))
     }
-    verificationResult = await verifierSignature({ jwt }, context)
+    policies = {
+      ...policies,
+      nbf: policies?.nbf ?? policies?.issuanceDate ?? policies?.validFrom,
+      iat: policies?.iat ?? policies?.issuanceDate ?? policies?.validFrom,
+      exp: policies?.exp ?? policies?.expirationDate ?? policies?.validUntil,
+      aud: policies?.aud ?? policies?.audience
+    }
+    verificationResult = await verifierSignature({ jwt, policies }, context)
     return verificationResult
     /*    let errorCode, message
         const resolver = {
@@ -214,9 +221,9 @@ export class CredentialProviderVcdm2Jose implements IVcdmCredentialProvider {
     const key = await pickSigningKey(
       {
         identifier: managedIdentifier.identifier,
-        kmsKeyRef: managedIdentifier.kmsKeyRef,
+        kmsKeyRef: managedIdentifier.kmsKeyRef
       },
-      context,
+      context
     )
 
     debug('Signing VC with', identifier.did)
@@ -231,12 +238,12 @@ export class CredentialProviderVcdm2Jose implements IVcdmCredentialProvider {
       kid: key.meta.verificationMethod.id ?? key.kid,
       alg,
       typ: 'vp+jwt',
-      cty: 'vp',
+      cty: 'vp'
     }
     const payload: JwsPayload = {
       ...presentation,
       ...(domain && { aud: domain }),
-      ...(challenge && { nonce: challenge }),
+      ...(challenge && { nonce: challenge })
     }
 
     const jwt = await agent.jwtCreateJwsCompactSignature({
@@ -244,7 +251,7 @@ export class CredentialProviderVcdm2Jose implements IVcdmCredentialProvider {
       issuer: managedIdentifier,
       payload,
       protectedHeader: header,
-      clientIdScheme: 'did',
+      clientIdScheme: 'did'
     })
 
     debug(jwt)
@@ -264,8 +271,8 @@ export class CredentialProviderVcdm2Jose implements IVcdmCredentialProvider {
       resolve: (didUrl: string) =>
         context.agent.resolveDid({
           didUrl,
-          options: otherOptions?.resolutionOptions,
-        }),
+          options: otherOptions?.resolutionOptions
+        })
     } as Resolvable
 
     let audience = domain
@@ -293,9 +300,9 @@ export class CredentialProviderVcdm2Jose implements IVcdmCredentialProvider {
           nbf: policies?.nbf ?? policies?.issuanceDate,
           iat: policies?.iat ?? policies?.issuanceDate,
           exp: policies?.exp ?? policies?.expirationDate,
-          aud: policies?.aud ?? policies?.audience,
+          aud: policies?.aud ?? policies?.audience
         },
-        ...otherOptions,
+        ...otherOptions
       })
       if (result) {
         /**
@@ -314,11 +321,11 @@ export class CredentialProviderVcdm2Jose implements IVcdmCredentialProvider {
               log: [
                 {
                   id: 'valid_signature',
-                  valid: true,
-                },
-              ],
-            },
-          ],
+                  valid: true
+                }
+              ]
+            }
+          ]
         } satisfies IVerifyResult
       }
     } catch (e: any) {
@@ -329,8 +336,8 @@ export class CredentialProviderVcdm2Jose implements IVcdmCredentialProvider {
       verified: false,
       error: {
         message,
-        errorCode: errorCode ? errorCode : message?.split(':')[0],
-      },
+        errorCode: errorCode ? errorCode : message?.split(':')[0]
+      }
     }
   }
 
@@ -362,8 +369,8 @@ export class CredentialProviderVcdm2Jose implements IVcdmCredentialProvider {
 }
 
 export async function verifierSignature(
-  { jwt }: { jwt: string /*resolver: Resolvable*/ },
-  verifierContext: VerifierAgentContext,
+  { jwt, policies }: { jwt: string, policies: VerificationPolicies /*resolver: Resolvable*/ },
+  verifierContext: VerifierAgentContext
 ): Promise<IVerifyResult> {
   let credIssuer: string | undefined = undefined
   const context = assertContext(verifierContext)
@@ -410,29 +417,32 @@ export async function verifierSignature(
   let resolution: ExternalIdentifierResult | undefined = undefined
   try {
     resolution = await agent.identifierExternalResolve({ identifier: credIssuer })
-  } catch (e: any) {}
+  } catch (e: any) {
+  }
   const credential = CredentialMapper.toUniformCredential(jwt)
 
-  const expired = 'validUntil' in credential && !!credential.validUntil && Date.parse(credential.validUntil) < new Date().getTime() / 1000
+  const validFromError = (policies.nbf !== false && policies.iat !== false) && 'validFrom' in credential && !!credential.validFrom && Date.parse(credential.validFrom) > new Date().getTime()
+  const expired = policies.exp !== false && 'validUntil' in credential && !!credential.validUntil && Date.parse(credential.validUntil) < new Date().getTime()
 
   const didOpts = { method: 'did', identifier: credIssuer } satisfies ExternalIdentifierDidOpts
   const jwtResult = await agent.jwtVerifyJwsSignature({
     jws: jwt,
     // @ts-ignore
     jwk: resolution?.jwks[0].jwk,
-    opts: { ...(isDidIdentifier(credIssuer) && { did: didOpts }) },
+    opts: { ...(isDidIdentifier(credIssuer) && { did: didOpts }) }
   })
   const error = jwtResult.error || expired || !resolution
-  const errorMessage = expired ? 'Credential is expired' : !resolution ? `Issuer ${credIssuer} could not be resolved` : jwtResult.message
+  const errorMessage = expired ? 'Credential is expired' : validFromError ? 'Credential is not valid yet' : !resolution ? `Issuer ${credIssuer} could not be resolved` : jwtResult.message
 
   if (error) {
     const log = [
       {
         id: 'valid_signature',
-        valid: false,
+        valid: !jwtResult.error
       },
       { id: 'issuer_did_resolves', valid: resolution != undefined },
-      { id: 'expiration', valid: !expired },
+      { id: 'validFrom', valid: policies.nbf !== false && !validFromError },
+      { id: 'expiration', valid: policies.exp !== false && !expired }
     ]
     return {
       verified: false,
@@ -443,28 +453,32 @@ export async function verifierSignature(
           verified: false,
           credential: jwt,
           log,
-          error: { message: errorMessage, errorCode: jwtResult.name },
-        },
+          error: { message: errorMessage, errorCode: jwtResult.name }
+        }
       ],
       payload,
       didResolutionResult: resolution,
-      jwt,
+      jwt
     } satisfies IVerifyResult
   }
 
   const log = [
     {
       id: 'valid_signature',
-      valid: true,
+      valid: true
     },
     {
       id: 'issuer_did_resolves',
-      valid: true,
+      valid: true
     },
     {
-      id: 'expiration',
-      valid: true,
+      id: 'validFrom',
+      valid: true
     },
+    {
+      id: 'expiration',
+      valid: true
+    }
   ]
   return {
     verified: true,
@@ -473,12 +487,12 @@ export async function verifierSignature(
       {
         verified: true,
         credential,
-        log,
-      },
+        log
+      }
     ],
     payload,
     didResolutionResult: resolution,
-    jwt,
+    jwt
   } satisfies IVerifyResult
 }
 
@@ -621,17 +635,17 @@ export function validateContext(value: string | string[]): void {
 }
 */
 function assertContext(
-  context: IVcdmIssuerAgentContext | IVcdmVerifierAgentContext,
+  context: IVcdmIssuerAgentContext | IVcdmVerifierAgentContext
 ): IAgentContext<
   IResolver & IDIDManager & Pick<IKeyManager, 'keyManagerGet' | 'keyManagerSign' | 'keyManagerVerify'> & IJwtService & IIdentifierResolution
 > {
   if (!contextHasPlugin<IJwtService>(context, 'jwtPrepareJws')) {
     throw Error(
-      'JwtService plugin not found, which is required for JWT signing in the VCDM2 Jose credential provider. Please add the JwtService plugin to your agent configuration.',
+      'JwtService plugin not found, which is required for JWT signing in the VCDM2 Jose credential provider. Please add the JwtService plugin to your agent configuration.'
     )
   } else if (!contextHasPlugin<IIdentifierResolution>(context, 'identifierManagedGet')) {
     throw Error(
-      'Identifier resolution plugin not found, which is required for JWT signing in the VCDM2 Jose credential provider. Please add the JwtService plugin to your agent configuration.',
+      'Identifier resolution plugin not found, which is required for JWT signing in the VCDM2 Jose credential provider. Please add the JwtService plugin to your agent configuration.'
     )
   }
   return context as IAgentContext<