@sphereon/ssi-sdk.ebsi-support 0.26.1-unstable.101

package/src/functions/Attestation.ts

@@ -0,0 +1,262 @@
+import { OpenID4VCIClient } from '@sphereon/oid4vci-client'
+import {
+  Alg,
+  AuthorizationDetails,
+  AuthorizationRequestOpts,
+  AuthzFlowType,
+  CredentialConfigurationSupported,
+  getJson,
+  getTypesFromCredentialSupported,
+  ProofOfPossessionCallbacks,
+} from '@sphereon/oid4vci-common'
+import { getAuthenticationKey, getIdentifier, SupportedDidMethodEnum } from '@sphereon/ssi-sdk-ext.did-utils'
+import { calculateJwkThumbprintForKey } from '@sphereon/ssi-sdk-ext.key-utils'
+import {
+  IssuanceOpts,
+  OID4VCICallbackStateListener,
+  OID4VCIMachineInterpreter,
+  OID4VCIMachineState,
+  OID4VCIMachineStates,
+  PrepareStartArgs,
+  signatureAlgorithmFromKey,
+  signCallback,
+} from '@sphereon/ssi-sdk.oid4vci-holder'
+import {
+  OID4VPCallbackStateListener,
+  Siopv2MachineInterpreter,
+  Siopv2MachineState,
+  Siopv2MachineStates,
+} from '@sphereon/ssi-sdk.siopv2-oid4vp-op-auth'
+import { Siopv2OID4VPLinkHandler } from '@sphereon/ssi-sdk.siopv2-oid4vp-op-auth/dist/link-handler'
+import { IIdentifier } from '@veramo/core'
+import { _ExtendedIKey } from '@veramo/utils'
+import { waitFor } from 'xstate/lib/waitFor'
+import { logger } from '../index'
+import { AttestationResult, CreateAttestationAuthRequestURLArgs, EbsiEnvironment, GetAttestationArgs, IRequiredContext } from '../types/IEbsiSupport'
+import {
+  addContactCallback,
+  authorizationCodeUrlCallback,
+  handleErrorCallback,
+  reviewCredentialsCallback,
+  selectCredentialsCallback,
+  siopDoneCallback,
+} from './AttestationHeadlessCallbacks'
+import { getEbsiApiBaseUrl } from './index'
+
+export interface AttestationAuthRequestUrlResult extends Omit<Required<PrepareStartArgs>, 'issuanceOpt'> {
+  issuanceOpt?: IssuanceOpts
+  authorizationCodeURL: string
+  identifier: IIdentifier
+  authKey: _ExtendedIKey
+}
+
+/**
+ * Method to generate an authz url for getting attestation credentials from a (R)TAO on EBSI using a cloud/service wallet
+ *
+ * This method can be used standalone. But it can also be used as input for the `oid4vciHolderStart` agent method,
+ * to start a OID4VCI holder flow.
+ *
+ * @param opts
+ * @param context
+ */
+export const ebsiCreateAttestationAuthRequestURL = async (
+  {
+    clientId: clientIdArg,
+    credentialIssuer,
+    credentialType,
+    idOpts,
+    redirectUri,
+    requestObjectOpts,
+    formats = ['jwt_vc', 'jwt_vc_json'],
+  }: CreateAttestationAuthRequestURLArgs,
+  context: IRequiredContext,
+): Promise<AttestationAuthRequestUrlResult> => {
+  const identifier = await getIdentifier(idOpts, context)
+  if (identifier.provider !== 'did:ebsi' && identifier.provider !== 'did:key') {
+    throw Error(
+      `EBSI only supports did:key for natural persons and did:ebsi for legal persons. Provider: ${identifier.provider}, did: ${identifier.did}`,
+    )
+  }
+  // This only works if the DID is actually registered, otherwise use our internal KMS;
+  // that is why the offline argument is passed in when type is Verifiable Auth to Onboard, as no DID is present at that point yet
+  const authKey = await getAuthenticationKey(identifier, context, credentialType === 'VerifiableAuthorisationToOnboard', true)
+  const kid = authKey.meta?.jwkThumbprint ?? calculateJwkThumbprintForKey({ key: authKey })
+  const clientId = clientIdArg ?? identifier.did
+
+  const vciClient = await OpenID4VCIClient.fromCredentialIssuer({
+    credentialIssuer,
+    kid,
+    clientId,
+    createAuthorizationRequestURL: false, // We will do that down below
+    retrieveServerMetadata: true,
+  })
+
+  const allMatches = vciClient.getCredentialsSupported(false)
+  let arrayMatches: Array<CredentialConfigurationSupported>
+  if (Array.isArray(allMatches)) {
+    arrayMatches = allMatches
+  } else {
+    arrayMatches = Object.entries(allMatches).map(([id, supported]) => {
+      supported.id = id
+      return supported
+    })
+  }
+  const supportedConfigurations = arrayMatches
+    .filter((supported) => getTypesFromCredentialSupported(supported, { filterVerifiableCredential: false }).includes(credentialType))
+    .filter((supported) => (supported.format === 'jwt_vc' || supported.format === 'jwt_vc_json') && formats.includes(supported.format))
+  if (supportedConfigurations.length === 0) {
+    throw Error(`Could not find '${credentialType}' with format(s) '${formats.join(',')}' in list of supported types for issuer: ${credentialIssuer}`)
+  }
+  const authorizationDetails = supportedConfigurations.map((supported) => {
+    return {
+      type: 'openid_credential',
+      format: supported.format,
+      types: getTypesFromCredentialSupported(supported),
+    } as AuthorizationDetails
+  })
+
+  const signCallbacks: ProofOfPossessionCallbacks<never> = requestObjectOpts.signCallbacks ?? {
+    signCallback: signCallback(vciClient, idOpts, context),
+  }
+  const authorizationRequestOpts = {
+    redirectUri,
+    clientId,
+    authorizationDetails,
+    requestObjectOpts: {
+      ...requestObjectOpts,
+      signCallbacks,
+      kid: requestObjectOpts.kid ?? kid,
+    },
+  } satisfies AuthorizationRequestOpts
+  // todo: Do we really need to do this, or can we just set the create option to true at this point? We are passing in the authzReq opts
+  const authorizationCodeURL = await vciClient.createAuthorizationRequestUrl({
+    authorizationRequest: authorizationRequestOpts,
+  })
+
+  return {
+    requestData: {
+      createAuthorizationRequestURL: false,
+      flowType: AuthzFlowType.AUTHORIZATION_CODE_FLOW,
+      uri: credentialIssuer,
+      existingClientState: JSON.parse(await vciClient.exportState()),
+    },
+    accessTokenOpts: {
+      clientOpts: {
+        alg: Alg[await signatureAlgorithmFromKey({ key: authKey })],
+        clientId,
+        kid,
+        signCallbacks,
+        clientAssertionType: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
+      },
+    },
+    authorizationRequestOpts,
+    authorizationCodeURL,
+    identifier,
+    // @ts-ignore
+    authKey,
+    didMethodPreferences: [SupportedDidMethodEnum.DID_EBSI, SupportedDidMethodEnum.DID_KEY],
+  }
+}
+
+export const ebsiGetAttestationInterpreter = async (
+  { clientId, authReqResult }: Omit<GetAttestationArgs, 'opts'>,
+  context: IRequiredContext,
+): Promise<OID4VCIMachineInterpreter> => {
+  const identifier = authReqResult.identifier
+  const vciStateCallbacks = new Map<OID4VCIMachineStates, (oid4vciMachine: OID4VCIMachineInterpreter, state: OID4VCIMachineState) => Promise<void>>()
+  const vpStateCallbacks = new Map<Siopv2MachineStates, (oid4vpMachine: Siopv2MachineInterpreter, state: Siopv2MachineState) => Promise<void>>()
+
+  const oid4vciMachine = await context.agent.oid4vciHolderGetMachineInterpreter({
+    ...authReqResult,
+    issuanceOpt: {
+      identifier,
+      didMethod: SupportedDidMethodEnum.DID_EBSI,
+      kid: authReqResult.authKey.meta?.jwkThumbprint ?? authReqResult.authKey.kid,
+    },
+    clientOpts: {
+      clientAssertionType: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
+      kid: authReqResult.authKey.meta?.jwkThumbprint ?? authReqResult.authKey.kid,
+      clientId,
+    },
+    didMethodPreferences: [SupportedDidMethodEnum.DID_EBSI, SupportedDidMethodEnum.DID_KEY],
+    stateNavigationListener: OID4VCICallbackStateListener(vciStateCallbacks),
+  })
+  const vpLinkHandler = new Siopv2OID4VPLinkHandler({
+    protocols: ['openid:'],
+    // @ts-ignore
+    context,
+    noStateMachinePersistence: true,
+    stateNavigationListener: OID4VPCallbackStateListener(vpStateCallbacks),
+  })
+
+  vpStateCallbacks
+    .set(Siopv2MachineStates.done, siopDoneCallback({ oid4vciMachine }, context))
+    .set(Siopv2MachineStates.handleError, handleErrorCallback(context))
+
+  vciStateCallbacks
+    .set(OID4VCIMachineStates.handleError, handleErrorCallback(context))
+    .set(OID4VCIMachineStates.addContact, addContactCallback(context))
+    .set(OID4VCIMachineStates.selectCredentials, selectCredentialsCallback(context))
+    .set(
+      OID4VCIMachineStates.initiateAuthorizationRequest,
+      authorizationCodeUrlCallback(
+        {
+          authReqResult,
+          vpLinkHandler,
+        },
+        context,
+      ),
+    )
+    .set(OID4VCIMachineStates.reviewCredentials, reviewCredentialsCallback(context))
+
+  return oid4vciMachine.interpreter
+}
+
+export const ebsiGetAttestation = async (
+  { clientId, authReqResult, opts = { timeout: 30_000 } }: GetAttestationArgs,
+  context: IRequiredContext,
+): Promise<AttestationResult> => {
+  const interpreter = await ebsiGetAttestationInterpreter({ clientId, authReqResult }, context)
+  const state = await waitFor(interpreter.start(), (state) => state.matches('done') || state.matches('handleError'), {
+    timeout: opts.timeout ?? 30_000,
+  })
+  if (state.matches('handleError')) {
+    console.error(JSON.stringify(state.context.error))
+    throw Error(JSON.stringify(state.context.error))
+  }
+
+  return {
+    contactAlias: state.context.contactAlias,
+    contact: state.context.contact!,
+    credentialBranding: state.context.credentialBranding,
+    identifier: state.context.issuanceOpt?.identifier ?? authReqResult.identifier,
+    error: state.context.error,
+    credentials: state.context.credentialsToAccept,
+  }
+}
+
+/**
+ * Normally you would use the browser to let the user make this call in the front channel,
+ * however EBSI mainly uses mocks at present, and we want to be able to test as well
+ */
+export const ebsiAuthRequestExecution = async (authRequestResult: AttestationAuthRequestUrlResult, opts?: {}) => {
+  const { requestData, authorizationCodeURL } = authRequestResult
+  const vciClient = await OpenID4VCIClient.fromState({ state: requestData?.existingClientState! })
+
+  logger.debug(`URL: ${authorizationCodeURL}, according to client: ${vciClient.authorizationURL}`)
+
+  const authResponse = await getJson<any>(authorizationCodeURL)
+  const location: string | null = authResponse.origResponse.headers.get('location')
+  logger.debug(`LOCATION: ${location}`)
+}
+
+export const ebsiGetIssuer = ({ credentialIssuer, environment = 'pilot' }: { credentialIssuer?: string; environment?: EbsiEnvironment }): string => {
+  if (credentialIssuer) {
+    return credentialIssuer
+  }
+  if (environment !== 'pilot') {
+    return `${getEbsiApiBaseUrl({ environment, version: 'v3' })}/issuer-mock`
+  }
+
+  throw Error(`EBSI environment ${environment} needs explicit credential issuer`)
+}

package/src/functions/AttestationHeadlessCallbacks.ts

@@ -0,0 +1,242 @@
+import { getIssuerName } from '@sphereon/oid4vci-common'
+import {
+  ConnectionType,
+  CorrelationIdentifierType,
+  CredentialRole,
+  IdentityOrigin,
+  NonPersistedParty,
+  Party,
+  PartyOrigin,
+  PartyTypeType,
+} from '@sphereon/ssi-sdk.data-store'
+import { OID4VCIMachine, OID4VCIMachineEvents, OID4VCIMachineInterpreter, OID4VCIMachineState } from '@sphereon/ssi-sdk.oid4vci-holder'
+import { Siopv2MachineInterpreter, Siopv2MachineState } from '@sphereon/ssi-sdk.siopv2-oid4vp-op-auth'
+import { Siopv2OID4VPLinkHandler } from '@sphereon/ssi-sdk.siopv2-oid4vp-op-auth/dist/link-handler'
+import fetch from 'cross-fetch'
+import { logger } from '../index'
+import { IRequiredContext } from '../types/IEbsiSupport'
+import { AttestationAuthRequestUrlResult } from './Attestation'
+
+export const addContactCallback = (context: IRequiredContext) => {
+  return async (oid4vciMachine: OID4VCIMachineInterpreter, state: OID4VCIMachineState) => {
+    const { serverMetadata, hasContactConsent, contactAlias } = state.context
+
+    if (!serverMetadata) {
+      return Promise.reject(Error('Missing serverMetadata in context'))
+    }
+
+    const issuerUrl: URL = new URL(serverMetadata.issuer)
+    const correlationId: string = `${issuerUrl.protocol}//${issuerUrl.hostname}`
+    let issuerName: string = getIssuerName(correlationId, serverMetadata.credentialIssuerMetadata)
+
+    const party: NonPersistedParty = {
+      contact: {
+        displayName: issuerName,
+        legalName: issuerName,
+      },
+      // FIXME maybe its nicer if we can also just use the id only
+      // TODO using the predefined party type from the contact migrations here
+      // TODO this is not used as the screen itself adds one, look at the params of the screen, this is not being passed in
+      partyType: {
+        id: '3875c12e-fdaa-4ef6-a340-c936e054b627',
+        origin: PartyOrigin.EXTERNAL,
+        type: PartyTypeType.ORGANIZATION,
+        name: 'Sphereon_default_type',
+        tenantId: '95e09cfc-c974-4174-86aa-7bf1d5251fb4',
+      },
+      uri: correlationId,
+      identities: [
+        {
+          alias: correlationId,
+          roles: [CredentialRole.ISSUER],
+          origin: IdentityOrigin.EXTERNAL,
+          identifier: {
+            type: CorrelationIdentifierType.URL,
+            correlationId: issuerUrl.hostname,
+          },
+          // TODO WAL-476 add support for correct connection
+          connection: {
+            type: ConnectionType.OPENID_CONNECT,
+            config: {
+              clientId: '138d7bf8-c930-4c6e-b928-97d3a4928b01',
+              clientSecret: '03b3955f-d020-4f2a-8a27-4e452d4e27a0',
+              scopes: ['auth'],
+              issuer: 'https://example.com/app-test',
+              redirectUrl: 'app:/callback',
+              dangerouslyAllowInsecureHttpRequests: true,
+              clientAuthMethod: 'post' as const,
+            },
+          },
+        },
+      ],
+    }
+
+    const onCreate = async ({
+      party,
+      issuerUrl,
+      issuerName,
+      correlationId,
+    }: {
+      party: NonPersistedParty
+      issuerUrl: string
+      issuerName: string
+      correlationId: string
+    }): Promise<void> => {
+      const displayName = party.contact.displayName ?? issuerName
+      const contacts: Array<Party> = await context.agent.cmGetContacts({
+        filter: [
+          {
+            contact: {
+              // Searching on legalName as displayName is not unique, and we only support organizations for now
+              legalName: displayName,
+            },
+          },
+        ],
+      })
+      if (contacts.length === 0 || !contacts[0]?.contact) {
+        const contact = await context.agent.cmAddContact({
+          ...party,
+          displayName,
+          legalName: displayName,
+          contactType: {
+            type: PartyTypeType.ORGANIZATION,
+            name: displayName,
+            origin: PartyOrigin.EXTERNAL,
+            tenantId: party.tenantId ?? '1',
+          },
+        })
+        oid4vciMachine.send({
+          type: OID4VCIMachineEvents.CREATE_CONTACT,
+          data: contact,
+        })
+      }
+    }
+
+    const onConsentChange = async (hasConsent: boolean): Promise<void> => {
+      oid4vciMachine.send({
+        type: OID4VCIMachineEvents.SET_CONTACT_CONSENT,
+        data: hasConsent,
+      })
+    }
+
+    const onAliasChange = async (alias: string): Promise<void> => {
+      oid4vciMachine.send({
+        type: OID4VCIMachineEvents.SET_CONTACT_ALIAS,
+        data: alias,
+      })
+    }
+
+    if (!issuerName) {
+      issuerName = `EBSI unknown (${issuerUrl})`
+    } else if (issuerName.startsWith('http')) {
+      issuerName = `EBSI ${issuerName.replace(/https?:\/\//, '')}`
+    }
+    if (!contactAlias) {
+      return await onAliasChange(issuerName)
+    }
+    issuerName = contactAlias
+    if (!hasContactConsent) {
+      return await onConsentChange(true)
+    }
+    await onCreate({ party, issuerName, issuerUrl: issuerUrl.toString(), correlationId })
+  }
+}
+
+export const handleErrorCallback = (context: IRequiredContext) => {
+  return async (oid4vciMachine: OID4VCIMachineInterpreter | Siopv2MachineInterpreter, state: OID4VCIMachineState | Siopv2MachineState) => {
+    console.error(`error callback event: ${state.event}`, state.context.error)
+  }
+}
+
+export const selectCredentialsCallback = (context: IRequiredContext) => {
+  return async (oid4vciMachine: OID4VCIMachineInterpreter, state: OID4VCIMachineState) => {
+    const { contact, credentialToSelectFrom, selectedCredentials } = state.context
+
+    if (selectedCredentials && selectedCredentials.length > 0) {
+      logger.info(`selected: ${selectedCredentials.join(', ')}`)
+      oid4vciMachine.send({
+        type: OID4VCIMachineEvents.NEXT,
+      })
+      return
+    } else if (!contact) {
+      return Promise.reject(Error('Missing contact in context'))
+    }
+
+    const onSelectType = async (selectedCredentials: Array<string>): Promise<void> => {
+      console.log(`Selected credentials: ${selectedCredentials.join(', ')}`)
+      oid4vciMachine.send({
+        type: OID4VCIMachineEvents.SET_SELECTED_CREDENTIALS,
+        data: selectedCredentials,
+      })
+    }
+
+    await onSelectType(credentialToSelectFrom.map((sel) => sel.credentialId))
+  }
+}
+
+export const authorizationCodeUrlCallback = (
+  {
+    authReqResult,
+    vpLinkHandler,
+  }: {
+    authReqResult: AttestationAuthRequestUrlResult
+    vpLinkHandler: Siopv2OID4VPLinkHandler
+  },
+  context: IRequiredContext,
+) => {
+  return async (oid4vciMachine: OID4VCIMachineInterpreter, state: OID4VCIMachineState) => {
+    const url = state.context.authorizationCodeURL
+    console.log('navigateAuthorizationCodeURL: ', url)
+    if (!url) {
+      return Promise.reject(Error('Missing authorization URL in context'))
+    }
+    const onOpenAuthorizationUrl = async (url: string): Promise<void> => {
+      console.log('onOpenAuthorizationUrl being invoked: ', url)
+      oid4vciMachine.send({
+        type: OID4VCIMachineEvents.INVOKED_AUTHORIZATION_CODE_REQUEST,
+        data: url,
+      })
+      const response = await fetch(url, { redirect: 'manual' })
+      if (response.status < 301 || response.status > 302) {
+        throw Error(`When doing a headless auth, we expect to be redirected on getting the authz URL`)
+      }
+      const openidUri = response.headers.get('location')
+      if (!openidUri || !openidUri.startsWith('openid://')) {
+        throw Error(
+          `Expected a openid:// URI to be returned from EBSI in headless mode. Returned: ${openidUri}, ${JSON.stringify(await response.text())}`,
+        )
+      }
+
+      console.log(`onOpenAuthorizationUrl after openUrl: ${url}`)
+      const kid = authReqResult.authKey.meta?.jwkThumbprint
+        ? `${authReqResult.identifier.did}#${authReqResult.authKey.meta.jwkThumbprint}`
+        : authReqResult.authKey.kid
+      await vpLinkHandler.handle(openidUri, { idOpts: { identifier: authReqResult.identifier, kid } })
+    }
+    await onOpenAuthorizationUrl(url)
+  }
+}
+
+export const reviewCredentialsCallback = (context: IRequiredContext) => {
+  return async (oid4vciMachine: OID4VCIMachineInterpreter, state: OID4VCIMachineState) => {
+    console.log(`# REVIEW CREDENTIALS:`)
+    console.log(JSON.stringify(state.context.credentialsToAccept, null, 2))
+    oid4vciMachine.send({
+      type: OID4VCIMachineEvents.NEXT,
+    })
+  }
+}
+
+export const siopDoneCallback = ({ oid4vciMachine }: { oid4vciMachine: OID4VCIMachine }, context: IRequiredContext) => {
+  return async (oid4vpMachine: Siopv2MachineInterpreter, state: Siopv2MachineState) => {
+    // console.log('SIOP result:')
+    // console.log(JSON.stringify(state.context, null , 2))
+    if (!state.context.authorizationResponseData?.queryParams?.code) {
+      throw Error(`No code was returned from the authorization step`)
+    }
+    oid4vciMachine.interpreter.send({
+      type: OID4VCIMachineEvents.PROVIDE_AUTHORIZATION_CODE_RESPONSE,
+      data: state.context.authorizationResponseData.url!,
+    })
+  }
+}

package/src/functions/index.ts

@@ -0,0 +1,15 @@
+import { ApiOpts, EbsiEnvironment } from '../types/IEbsiSupport'
+
+export const getEbsiApiBaseUrl = ({
+  environment = 'pilot',
+  version,
+  system = 'pilot',
+}: ApiOpts & { system?: 'authorisation' | 'conformance' | 'did-registry' | EbsiEnvironment }) => {
+  return `https://api-${environment}.ebsi.eu/${system}/${version}`
+}
+
+export const wait = async (timeoutInMS: number) => {
+  return new Promise((resolve) => setTimeout(resolve, timeoutInMS))
+}
+
+export * from './Attestation'

package/src/index.ts

@@ -0,0 +1,8 @@
+import { Loggers } from '@sphereon/ssi-types'
+
+export const logger = Loggers.DEFAULT.get('sphereon:ebsi-support')
+const schema = require('../plugin.schema.json')
+export { schema }
+export { EbsiSupport } from './agent/EbsiSupport'
+export * from './types/IEbsiSupport'
+export { EbsiDidProvider } from './did'