@sphereon/ssi-sdk.data-store 0.38.1-next.3 → 0.40.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphereon/ssi-sdk.data-store",
-  "version": "0.38.1-next.3+da87d17a",
+  "version": "0.40.0",
   "source": "src/index.ts",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -28,12 +28,12 @@
   "dependencies": {
     "@sphereon/kmp-mdoc-core": "0.2.0-SNAPSHOT.26",
     "@sphereon/pex": "5.0.0-unstable.28",
-    "@sphereon/ssi-sdk-ext.did-utils": "0.38.1-next.3+da87d17a",
-    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.38.1-next.3+da87d17a",
-    "@sphereon/ssi-sdk.agent-config": "0.38.1-next.3+da87d17a",
-    "@sphereon/ssi-sdk.core": "0.38.1-next.3+da87d17a",
-    "@sphereon/ssi-sdk.data-store-types": "0.38.1-next.3+da87d17a",
-    "@sphereon/ssi-types": "0.38.1-next.3+da87d17a",
+    "@sphereon/ssi-sdk-ext.did-utils": "0.40.0",
+    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.40.0",
+    "@sphereon/ssi-sdk.agent-config": "0.40.0",
+    "@sphereon/ssi-sdk.core": "0.40.0",
+    "@sphereon/ssi-sdk.data-store-types": "0.40.0",
+    "@sphereon/ssi-types": "0.40.0",
     "@veramo/core": "4.2.0",
     "@veramo/data-store": "4.2.0",
     "@veramo/utils": "4.2.0",
@@ -67,5 +67,5 @@
     "PostgreSQL",
     "Contact Store"
   ],
-  "gitHead": "da87d17a9e92168943cc846da4b93dc27d1b5590"
+  "gitHead": "6e7254a91be198632e878a3485acfe59804c7f1d"
 }

package/src/migrations/generic/20-AddUntrustedCredentialState.ts

@@ -0,0 +1,66 @@
+import Debug, { Debugger } from 'debug'
+import { DatabaseType, MigrationInterface, QueryRunner } from 'typeorm'
+import { AddUntrustedCredentialState1780000000011 } from '../postgres/1780000000011-AddUntrustedCredentialState'
+import { AddUntrustedCredentialState1780000000012 } from '../sqlite/1780000000012-AddUntrustedCredentialState'
+
+const debug: Debugger = Debug('sphereon:ssi-sdk:migrations')
+
+export class AddUntrustedCredentialState1780000000010 implements MigrationInterface {
+  name: string = 'AddUntrustedCredentialState1780000000010'
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    debug('migration: widening DigitalCredential verified_state to include UNTRUSTED')
+    const dbType: DatabaseType = queryRunner.connection.driver.options.type
+
+    switch (dbType) {
+      case 'postgres': {
+        debug('using postgres migration file for AddUntrustedCredentialState')
+        const mig: AddUntrustedCredentialState1780000000011 = new AddUntrustedCredentialState1780000000011()
+        await mig.up(queryRunner)
+        debug('Postgres migration statements for AddUntrustedCredentialState executed')
+        return
+      }
+      case 'sqlite':
+      case 'expo':
+      case 'react-native': {
+        debug('using sqlite/react-native migration file for AddUntrustedCredentialState')
+        const mig: AddUntrustedCredentialState1780000000012 = new AddUntrustedCredentialState1780000000012()
+        await mig.up(queryRunner)
+        debug('SQLite migration statements for AddUntrustedCredentialState executed')
+        return
+      }
+      default:
+        return Promise.reject(
+          `Migrations are currently only supported for sqlite, react-native, expo, and postgres for AddUntrustedCredentialState. Was ${dbType}. Please run your database without migrations and with 'migrationsRun: false' and 'synchronize: true' for now`,
+        )
+    }
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    debug('migration: reverting DigitalCredential verified_state UNTRUSTED widening')
+    const dbType: DatabaseType = queryRunner.connection.driver.options.type
+
+    switch (dbType) {
+      case 'postgres': {
+        debug('using postgres migration file for AddUntrustedCredentialState')
+        const mig: AddUntrustedCredentialState1780000000011 = new AddUntrustedCredentialState1780000000011()
+        await mig.down(queryRunner)
+        debug('Postgres migration statements for AddUntrustedCredentialState reverted')
+        return
+      }
+      case 'sqlite':
+      case 'expo':
+      case 'react-native': {
+        debug('using sqlite/react-native migration file for AddUntrustedCredentialState')
+        const mig: AddUntrustedCredentialState1780000000012 = new AddUntrustedCredentialState1780000000012()
+        await mig.down(queryRunner)
+        debug('SQLite migration statements for AddUntrustedCredentialState reverted')
+        return
+      }
+      default:
+        return Promise.reject(
+          `Migrations are currently only supported for sqlite, react-native, expo, and postgres for AddUntrustedCredentialState. Was ${dbType}. Please run your database without migrations and with 'migrationsRun: false' and 'synchronize: true' for now`,
+        )
+    }
+  }
+}

package/src/migrations/generic/index.ts

@@ -19,6 +19,7 @@ import { CreateContacts1708525189000 } from './8-CreateContacts'
 import { CreateContacts1715761125000 } from './9-CreateContacts'
 import { AddCredentialDesigns1773657426000 } from './18-AddCredentialDesigns'
 import { AddCredentialStatusFields1780000000000 } from './19-AddCredentialStatusFields'
+import { AddUntrustedCredentialState1780000000010 } from './20-AddUntrustedCredentialState'
 
 /**
  * The migrations array that SHOULD be used when initializing a TypeORM database connection.
@@ -53,6 +54,7 @@ export const DataStoreDigitalCredentialMigrations = [
   CreateDigitalCredential1708525189000,
   AddLinkedVpFields1763387280000,
   AddCredentialStatusFields1780000000000,
+  AddUntrustedCredentialState1780000000010,
 ]
 export const DataStoreMachineStateMigrations = [CreateMachineStateStore1708098041262]
 export const DataStorePresentationDefinitionMigrations = [CreatePresentationDefinitions1716533767523, CreateDcqlQueryItem1726617600000]

package/src/migrations/postgres/1780000000011-AddUntrustedCredentialState.ts

@@ -0,0 +1,28 @@
+import { MigrationInterface, QueryRunner } from 'typeorm'
+
+/**
+ * Adds 'UNTRUSTED' to the digital_credential_state_type enum (a status list that could not be
+ * cryptographically trusted). Uses the transaction-safe recreate-type approach.
+ */
+export class AddUntrustedCredentialState1780000000011 implements MigrationInterface {
+  name = 'AddUntrustedCredentialState1780000000011'
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`CREATE TYPE "digital_credential_state_type_v3" AS ENUM('REVOKED', 'VERIFIED', 'EXPIRED', 'SUSPENDED', 'UNTRUSTED')`)
+    await queryRunner.query(
+      `ALTER TABLE "DigitalCredential" ALTER COLUMN "verified_state" TYPE "digital_credential_state_type_v3" USING "verified_state"::text::"digital_credential_state_type_v3"`,
+    )
+    await queryRunner.query(`DROP TYPE "digital_credential_state_type"`)
+    await queryRunner.query(`ALTER TYPE "digital_credential_state_type_v3" RENAME TO "digital_credential_state_type"`)
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`UPDATE "DigitalCredential" SET "verified_state" = NULL WHERE "verified_state" = 'UNTRUSTED'`)
+    await queryRunner.query(`CREATE TYPE "digital_credential_state_type_old" AS ENUM('REVOKED', 'VERIFIED', 'EXPIRED', 'SUSPENDED')`)
+    await queryRunner.query(
+      `ALTER TABLE "DigitalCredential" ALTER COLUMN "verified_state" TYPE "digital_credential_state_type_old" USING "verified_state"::text::"digital_credential_state_type_old"`,
+    )
+    await queryRunner.query(`DROP TYPE "digital_credential_state_type"`)
+    await queryRunner.query(`ALTER TYPE "digital_credential_state_type_old" RENAME TO "digital_credential_state_type"`)
+  }
+}

package/src/migrations/sqlite/1780000000012-AddUntrustedCredentialState.ts

@@ -0,0 +1,138 @@
+import { MigrationInterface, QueryRunner } from 'typeorm'
+
+/**
+ * Widens the DigitalCredential "verified_state" CHECK constraint to include 'UNTRUSTED' (a status list
+ * that could not be cryptographically trusted). SQLite cannot ALTER a CHECK constraint in place, so the
+ * table is rebuilt. Must run AFTER AddCredentialStatusFields (1780000000002), so the rebuilt schema
+ * includes 'SUSPENDED' and the status_last_checked_at column.
+ */
+export class AddUntrustedCredentialState1780000000012 implements MigrationInterface {
+  name = 'AddUntrustedCredentialState1780000000012'
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      CREATE TABLE "DigitalCredential_new" (
+        "id" varchar PRIMARY KEY NOT NULL,
+        "parent_id" text,
+        "document_type" varchar CHECK( "document_type" IN ('VC', 'VP', 'C', 'P') ) NOT NULL,
+        "regulation_type" varchar CHECK( "regulation_type" IN ('PID', 'QEAA', 'EAA', 'NON_REGULATED') ) NOT NULL DEFAULT 'NON_REGULATED',
+        "document_format" varchar CHECK( "document_format" IN ('JSON_LD', 'JWT', 'SD_JWT', 'MSO_MDOC') ) NOT NULL,
+        "credential_role" varchar CHECK( "credential_role" IN ('ISSUER', 'VERIFIER', 'HOLDER', 'FEDERATION_TRUST_ANCHOR') ) NOT NULL,
+        "raw_document" text NOT NULL,
+        "uniform_document" text NOT NULL,
+        "credential_id" text,
+        "hash" text NOT NULL,
+        "kms_key_ref" text,
+        "identifier_method" text,
+        "issuer_correlation_type" varchar CHECK( "issuer_correlation_type" IN ('DID', 'KID', 'URL', 'X509_SAN') ) NOT NULL,
+        "subject_correlation_type" varchar CHECK( "subject_correlation_type" IN ('DID', 'KID', 'URL', 'X509_SAN') ),
+        "issuer_correlation_id" text NOT NULL,
+        "subject_correlation_id" text,
+        "issuer_signed" boolean,
+        "rp_correlation_id" text,
+        "rp_correlation_type" varchar CHECK( "issuer_correlation_type" IN ('DID', 'KID', 'URL', 'X509_SAN') ),
+        "verified_state" varchar CHECK( "verified_state" IN ('REVOKED', 'VERIFIED', 'EXPIRED', 'SUSPENDED', 'UNTRUSTED') ),
+        "tenant_id" text,
+        "created_at" datetime NOT NULL DEFAULT (datetime('now')),
+        "last_updated_at" datetime NOT NULL DEFAULT (datetime('now')),
+        "presented_at" datetime,
+        "valid_from" datetime,
+        "valid_until" datetime,
+        "verified_at" datetime,
+        "revoked_at" datetime,
+        "linked_vp_id" text,
+        "linked_vp_from" datetime,
+        "linked_vp_until" datetime,
+        "status_last_checked_at" datetime,
+        UNIQUE ("hash", "credential_role")
+      )
+    `)
+
+    await queryRunner.query(`
+      INSERT INTO "DigitalCredential_new" (
+        "id","parent_id","document_type","regulation_type","document_format","credential_role",
+        "raw_document","uniform_document","credential_id","hash","kms_key_ref","identifier_method",
+        "issuer_correlation_type","subject_correlation_type","issuer_correlation_id","subject_correlation_id",
+        "issuer_signed","rp_correlation_id","rp_correlation_type","verified_state","tenant_id",
+        "created_at","last_updated_at","presented_at","valid_from","valid_until","verified_at","revoked_at",
+        "linked_vp_id","linked_vp_from","linked_vp_until","status_last_checked_at"
+      )
+      SELECT
+        "id","parent_id","document_type","regulation_type","document_format","credential_role",
+        "raw_document","uniform_document","credential_id","hash","kms_key_ref","identifier_method",
+        "issuer_correlation_type","subject_correlation_type","issuer_correlation_id","subject_correlation_id",
+        "issuer_signed","rp_correlation_id","rp_correlation_type","verified_state","tenant_id",
+        "created_at","last_updated_at","presented_at","valid_from","valid_until","verified_at","revoked_at",
+        "linked_vp_id","linked_vp_from","linked_vp_until","status_last_checked_at"
+      FROM "DigitalCredential"
+    `)
+
+    await queryRunner.query(`DROP TABLE "DigitalCredential"`)
+    await queryRunner.query(`ALTER TABLE "DigitalCredential_new" RENAME TO "DigitalCredential"`)
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    // Collapse UNTRUSTED to NULL so the narrowed CHECK does not reject existing rows
+    await queryRunner.query(`UPDATE "DigitalCredential" SET "verified_state" = NULL WHERE "verified_state" = 'UNTRUSTED'`)
+
+    await queryRunner.query(`
+      CREATE TABLE "DigitalCredential_old" (
+        "id" varchar PRIMARY KEY NOT NULL,
+        "parent_id" text,
+        "document_type" varchar CHECK( "document_type" IN ('VC', 'VP', 'C', 'P') ) NOT NULL,
+        "regulation_type" varchar CHECK( "regulation_type" IN ('PID', 'QEAA', 'EAA', 'NON_REGULATED') ) NOT NULL DEFAULT 'NON_REGULATED',
+        "document_format" varchar CHECK( "document_format" IN ('JSON_LD', 'JWT', 'SD_JWT', 'MSO_MDOC') ) NOT NULL,
+        "credential_role" varchar CHECK( "credential_role" IN ('ISSUER', 'VERIFIER', 'HOLDER', 'FEDERATION_TRUST_ANCHOR') ) NOT NULL,
+        "raw_document" text NOT NULL,
+        "uniform_document" text NOT NULL,
+        "credential_id" text,
+        "hash" text NOT NULL,
+        "kms_key_ref" text,
+        "identifier_method" text,
+        "issuer_correlation_type" varchar CHECK( "issuer_correlation_type" IN ('DID', 'KID', 'URL', 'X509_SAN') ) NOT NULL,
+        "subject_correlation_type" varchar CHECK( "subject_correlation_type" IN ('DID', 'KID', 'URL', 'X509_SAN') ),
+        "issuer_correlation_id" text NOT NULL,
+        "subject_correlation_id" text,
+        "issuer_signed" boolean,
+        "rp_correlation_id" text,
+        "rp_correlation_type" varchar CHECK( "issuer_correlation_type" IN ('DID', 'KID', 'URL', 'X509_SAN') ),
+        "verified_state" varchar CHECK( "verified_state" IN ('REVOKED', 'VERIFIED', 'EXPIRED', 'SUSPENDED') ),
+        "tenant_id" text,
+        "created_at" datetime NOT NULL DEFAULT (datetime('now')),
+        "last_updated_at" datetime NOT NULL DEFAULT (datetime('now')),
+        "presented_at" datetime,
+        "valid_from" datetime,
+        "valid_until" datetime,
+        "verified_at" datetime,
+        "revoked_at" datetime,
+        "linked_vp_id" text,
+        "linked_vp_from" datetime,
+        "linked_vp_until" datetime,
+        "status_last_checked_at" datetime,
+        UNIQUE ("hash", "credential_role")
+      )
+    `)
+
+    await queryRunner.query(`
+      INSERT INTO "DigitalCredential_old" (
+        "id","parent_id","document_type","regulation_type","document_format","credential_role",
+        "raw_document","uniform_document","credential_id","hash","kms_key_ref","identifier_method",
+        "issuer_correlation_type","subject_correlation_type","issuer_correlation_id","subject_correlation_id",
+        "issuer_signed","rp_correlation_id","rp_correlation_type","verified_state","tenant_id",
+        "created_at","last_updated_at","presented_at","valid_from","valid_until","verified_at","revoked_at",
+        "linked_vp_id","linked_vp_from","linked_vp_until","status_last_checked_at"
+      )
+      SELECT
+        "id","parent_id","document_type","regulation_type","document_format","credential_role",
+        "raw_document","uniform_document","credential_id","hash","kms_key_ref","identifier_method",
+        "issuer_correlation_type","subject_correlation_type","issuer_correlation_id","subject_correlation_id",
+        "issuer_signed","rp_correlation_id","rp_correlation_type","verified_state","tenant_id",
+        "created_at","last_updated_at","presented_at","valid_from","valid_until","verified_at","revoked_at",
+        "linked_vp_id","linked_vp_from","linked_vp_until","status_last_checked_at"
+      FROM "DigitalCredential"
+    `)
+
+    await queryRunner.query(`DROP TABLE "DigitalCredential"`)
+    await queryRunner.query(`ALTER TABLE "DigitalCredential_old" RENAME TO "DigitalCredential"`)
+  }
+}