@sphereon/ssi-sdk.siopv2-oid4vp-op-auth 0.34.1-feature.SSISDK.58.host.nonce.endpoint.194 → 0.34.1-feature.SSISDK.62.219

package/dist/index.cjs

@@ -423,9 +423,9 @@ var plugin_schema_default = {
 };
 
 // src/agent/DidAuthSiopOpAuthenticator.ts
-var import_did_auth_siop5 = require("@sphereon/did-auth-siop");
-var import_ssi_sdk6 = require("@sphereon/ssi-sdk.data-store");
-var import_ssi_types8 = require("@sphereon/ssi-types");
+var import_did_auth_siop4 = require("@sphereon/did-auth-siop");
+var import_ssi_sdk7 = require("@sphereon/ssi-sdk.data-store");
+var import_ssi_types7 = require("@sphereon/ssi-types");
 var import_uuid2 = require("uuid");
 
 // src/session/functions.ts
@@ -1344,13 +1344,14 @@ var Siopv2Machine = class {
 };
 
 // src/services/Siopv2MachineService.ts
-var import_did_auth_siop4 = require("@sphereon/did-auth-siop");
-var import_ssi_sdk_ext3 = require("@sphereon/ssi-sdk-ext.identifier-resolution");
-var import_ssi_sdk3 = require("@sphereon/ssi-sdk.credential-store");
-var import_ssi_sdk4 = require("@sphereon/ssi-sdk.data-store");
+var import_utils = require("@sphereon/pex/dist/main/lib/utils");
+var import_ssi_sdk_ext3 = require("@sphereon/ssi-sdk-ext.did-utils");
+var import_ssi_sdk_ext4 = require("@sphereon/ssi-sdk-ext.identifier-resolution");
+var import_ssi_sdk3 = require("@sphereon/ssi-sdk.core");
+var import_ssi_sdk4 = require("@sphereon/ssi-sdk.credential-store");
+var import_ssi_sdk5 = require("@sphereon/ssi-sdk.data-store");
+var import_ssi_sdk6 = require("@sphereon/ssi-sdk.sd-jwt");
 var import_ssi_types6 = require("@sphereon/ssi-types");
-var import_ssi_types7 = require("@sphereon/ssi-types");
-var import_ssi_sdk5 = require("@sphereon/ssi-sdk.core");
 var import_dcql = require("dcql");
 
 // src/utils/dcql.ts
@@ -1391,12 +1392,12 @@ function convertToDcqlCredentials(credential, hasher) {
 __name(convertToDcqlCredentials, "convertToDcqlCredentials");
 
 // src/services/Siopv2MachineService.ts
-var import_ssi_sdk_ext4 = require("@sphereon/ssi-sdk-ext.did-utils");
-var logger3 = import_ssi_types7.Loggers.DEFAULT.get(LOGGER_NAMESPACE);
+var CLOCK_SKEW = 120;
+var logger3 = import_ssi_types6.Loggers.DEFAULT.get(LOGGER_NAMESPACE);
 var siopSendAuthorizationResponse = /* @__PURE__ */ __name(async (connectionType, args, context) => {
   const { agent } = context;
   const { credentials } = args;
-  if (connectionType !== import_ssi_sdk4.ConnectionType.SIOPv2_OpenID4VP) {
+  if (connectionType !== import_ssi_sdk5.ConnectionType.SIOPv2_OpenID4VP) {
     return Promise.reject(Error(`No supported authentication provider for type: ${connectionType}`));
   }
   const session = await agent.siopGetOPSession({
@@ -1406,7 +1407,7 @@ var siopSendAuthorizationResponse = /* @__PURE__ */ __name(async (connectionType
   const aud = request.authorizationRequest.getMergedProperty("aud");
   logger3.debug(`AUD: ${aud}`);
   logger3.debug(JSON.stringify(request.authorizationRequest));
-  const domain = await request.authorizationRequest.getMergedProperty("client_id") ?? request.issuer ?? (request.versions.includes(import_did_auth_siop4.SupportedVersion.JWT_VC_PRESENTATION_PROFILE_v1) ? "https://self-issued.me/v2/openid-vc" : "https://self-issued.me/v2");
+  const domain = await request.authorizationRequest.getMergedProperty("client_id") ?? request.issuer ?? "https://self-issued.me/v2";
   logger3.debug(`NONCE: ${session.nonce}, domain: ${domain}`);
   const firstUniqueDC = credentials[0];
   if (typeof firstUniqueDC !== "object" || !("digitalCredential" in firstUniqueDC)) {
@@ -1415,9 +1416,9 @@ var siopSendAuthorizationResponse = /* @__PURE__ */ __name(async (connectionType
   let identifier;
   const digitalCredential = firstUniqueDC.digitalCredential;
   const firstVC = firstUniqueDC.uniformVerifiableCredential;
-  const holder = import_ssi_types7.CredentialMapper.isSdJwtDecodedCredential(firstVC) ? firstVC.decodedPayload.cnf?.jwk ? (
+  const holder = import_ssi_types6.CredentialMapper.isSdJwtDecodedCredential(firstVC) ? firstVC.decodedPayload.cnf?.jwk ? (
     //doesn't apply to did:jwk only, as you can represent any DID key as a JWK. So whenever you encounter a JWK it doesn't mean it had to come from a did:jwk in the system. It just can always be represented as a did:jwk
-    `did:jwk:${(0, import_ssi_sdk5.encodeJoseBlob)(firstVC.decodedPayload.cnf?.jwk)}#0`
+    `did:jwk:${(0, import_ssi_sdk3.encodeJoseBlob)(firstVC.decodedPayload.cnf?.jwk)}#0`
   ) : firstVC.decodedPayload.sub : Array.isArray(firstVC.credentialSubject) ? firstVC.credentialSubject[0].id : firstVC.credentialSubject.id;
   if (!digitalCredential.kmsKeyRef) {
     if (!holder) {
@@ -1431,7 +1432,7 @@ var siopSendAuthorizationResponse = /* @__PURE__ */ __name(async (connectionType
       logger3.debug(`Holder DID not found: ${holder}`);
       throw e;
     }
-  } else if ((0, import_ssi_sdk_ext3.isOID4VCIssuerIdentifier)(digitalCredential.kmsKeyRef)) {
+  } else if ((0, import_ssi_sdk_ext4.isOID4VCIssuerIdentifier)(digitalCredential.kmsKeyRef)) {
     identifier = await session.context.agent.identifierManagedGetByOID4VCIssuer({
       identifier: firstUniqueDC.digitalCredential.kmsKeyRef
     });
@@ -1472,8 +1473,23 @@ var siopSendAuthorizationResponse = /* @__PURE__ */ __name(async (connectionType
       if (!originalVc) {
         continue;
       }
+      const decodedSdJwt = await import_ssi_types6.CredentialMapper.decodeSdJwtVcAsync(originalVc, import_ssi_sdk6.defaultGenerateDigest);
+      const updatedSdJwt = updateSdJwtCredential(decodedSdJwt, request.requestObject?.getPayload()?.nonce, domain);
+      const presentationResult = await context.agent.createSdJwtPresentation({
+        presentation: updatedSdJwt.compactSdJwtVc,
+        kb: {
+          payload: {
+            ...updatedSdJwt.kbJwt?.payload,
+            // FIXME SSISDK-44
+            nonce: updatedSdJwt.kbJwt?.payload.nonce ?? request.requestObject.getPayload().nonce,
+            // FIXME SSISDK-44
+            aud: updatedSdJwt.kbJwt?.payload.aud ?? domain,
+            iat: updatedSdJwt.kbJwt?.payload?.iat ?? Math.floor(Date.now() / 1e3 - CLOCK_SKEW)
+          }
+        }
+      });
       if (originalVc) {
-        presentation[key] = originalVc;
+        presentation[key] = presentationResult.presentation;
       }
     }
   }
@@ -1497,7 +1513,7 @@ var getSelectableCredentials = /* @__PURE__ */ __name(async (dcqlQuery, context)
   };
   const { agent } = agentContext;
   const uniqueVerifiableCredentials = await agent.crsGetUniqueCredentials({
-    filter: (0, import_ssi_sdk3.verifiableCredentialForRoleFilter)(import_ssi_types6.CredentialRole.HOLDER)
+    filter: (0, import_ssi_sdk4.verifiableCredentialForRoleFilter)(import_ssi_types6.CredentialRole.HOLDER)
   });
   const branding = await agent.ibGetCredentialBranding();
   const dcqlCredentialsWithCredentials = new Map(uniqueVerifiableCredentials.map((vc) => [
@@ -1566,9 +1582,34 @@ var translateCorrelationIdToName = /* @__PURE__ */ __name(async (correlationId,
   }
   return contacts[0].contact.displayName;
 }, "translateCorrelationIdToName");
+var updateSdJwtCredential = /* @__PURE__ */ __name((credential, nonce, aud) => {
+  const sdJwtCredential = credential;
+  const hashAlg = sdJwtCredential.signedPayload._sd_alg ?? "sha-256";
+  const sdHash = (0, import_utils.calculateSdHash)(sdJwtCredential.compactSdJwtVc, hashAlg, import_ssi_sdk6.defaultGenerateDigest);
+  const kbJwt = {
+    // alg MUST be set by the signer
+    header: {
+      typ: "kb+jwt"
+    },
+    payload: {
+      iat: Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3),
+      sd_hash: sdHash,
+      ...nonce && {
+        nonce
+      },
+      ...aud && {
+        aud
+      }
+    }
+  };
+  return {
+    ...sdJwtCredential,
+    kbJwt
+  };
+}, "updateSdJwtCredential");
 
 // src/agent/DidAuthSiopOpAuthenticator.ts
-var logger4 = import_ssi_types8.Loggers.DEFAULT.options(LOGGER_NAMESPACE, {}).get(LOGGER_NAMESPACE);
+var logger4 = import_ssi_types7.Loggers.DEFAULT.options(LOGGER_NAMESPACE, {}).get(LOGGER_NAMESPACE);
 var didAuthSiopOpAuthenticatorMethods = [
   "cmGetContacts",
   "cmGetContact",
@@ -1784,12 +1825,12 @@ var DidAuthSiopOpAuthenticator = class {
     if (correlationId) {
       const identity = {
         alias: correlationId,
-        origin: import_ssi_sdk6.IdentityOrigin.EXTERNAL,
+        origin: import_ssi_sdk7.IdentityOrigin.EXTERNAL,
         roles: [
-          import_ssi_types8.CredentialRole.ISSUER
+          import_ssi_types7.CredentialRole.ISSUER
         ],
         identifier: {
-          type: correlationId.startsWith("did:") ? import_ssi_sdk6.CorrelationIdentifierType.DID : import_ssi_sdk6.CorrelationIdentifierType.URL,
+          type: correlationId.startsWith("did:") ? import_ssi_sdk7.CorrelationIdentifierType.DID : import_ssi_sdk7.CorrelationIdentifierType.URL,
           correlationId
         }
       };
@@ -1812,7 +1853,7 @@ var DidAuthSiopOpAuthenticator = class {
     if (authorizationRequestData === void 0) {
       return Promise.reject(Error("Missing authorization request data in context"));
     }
-    const response = await siopSendAuthorizationResponse(import_ssi_sdk6.ConnectionType.SIOPv2_OpenID4VP, {
+    const response = await siopSendAuthorizationResponse(import_ssi_sdk7.ConnectionType.SIOPv2_OpenID4VP, {
       sessionId: didAuthConfig.sessionId,
       ...args.idOpts && {
         idOpts: args.idOpts
@@ -1830,7 +1871,7 @@ var DidAuthSiopOpAuthenticator = class {
     return {
       body: responseBody,
       url: response?.url,
-      queryParams: (0, import_did_auth_siop5.decodeUriAsJson)(response?.url)
+      queryParams: (0, import_did_auth_siop4.decodeUriAsJson)(response?.url)
     };
   }
   async siopGetSelectableCredentials(args, context) {
@@ -1843,11 +1884,11 @@ var DidAuthSiopOpAuthenticator = class {
 };
 
 // src/machine/CallbackStateListener.ts
-var import_ssi_types9 = require("@sphereon/ssi-types");
-var logger5 = import_ssi_types9.Loggers.DEFAULT.options("sphereon:siopv2-oid4vp:op-auth", {
-  defaultLogLevel: import_ssi_types9.LogLevel.DEBUG,
+var import_ssi_types8 = require("@sphereon/ssi-types");
+var logger5 = import_ssi_types8.Loggers.DEFAULT.options("sphereon:siopv2-oid4vp:op-auth", {
+  defaultLogLevel: import_ssi_types8.LogLevel.DEBUG,
   methods: [
-    import_ssi_types9.LogMethod.CONSOLE
+    import_ssi_types8.LogMethod.CONSOLE
   ]
 }).get("sphereon:siopv2-oid4vp:op-auth");
 var OID4VPCallbackStateListener = /* @__PURE__ */ __name((callbacks) => {
@@ -1877,12 +1918,12 @@ var OID4VPCallbackStateListener = /* @__PURE__ */ __name((callbacks) => {
 }, "OID4VPCallbackStateListener");
 
 // src/link-handler/index.ts
-var import_ssi_sdk7 = require("@sphereon/ssi-sdk.agent-config");
-var import_ssi_sdk8 = require("@sphereon/ssi-sdk.core");
-var import_ssi_sdk9 = require("@sphereon/ssi-sdk.xstate-machine-persistence");
-var import_ssi_types10 = require("@sphereon/ssi-types");
-var logger6 = import_ssi_types10.Loggers.DEFAULT.options(LOGGER_NAMESPACE, {}).get(LOGGER_NAMESPACE);
-var Siopv2OID4VPLinkHandler = class extends import_ssi_sdk8.LinkHandlerAdapter {
+var import_ssi_sdk8 = require("@sphereon/ssi-sdk.agent-config");
+var import_ssi_sdk9 = require("@sphereon/ssi-sdk.core");
+var import_ssi_sdk10 = require("@sphereon/ssi-sdk.xstate-machine-persistence");
+var import_ssi_types9 = require("@sphereon/ssi-types");
+var logger6 = import_ssi_types9.Loggers.DEFAULT.options(LOGGER_NAMESPACE, {}).get(LOGGER_NAMESPACE);
+var Siopv2OID4VPLinkHandler = class extends import_ssi_sdk9.LinkHandlerAdapter {
   static {
     __name(this, "Siopv2OID4VPLinkHandler");
   }
@@ -1908,8 +1949,8 @@ var Siopv2OID4VPLinkHandler = class extends import_ssi_sdk8.LinkHandlerAdapter {
       stateNavigationListener: this.stateNavigationListener
     });
     const interpreter = siopv2Machine.interpreter;
-    if (!this.noStateMachinePersistence && !opts?.machineState && (0, import_ssi_sdk7.contextHasPlugin)(this.context, "machineStatesFindActive")) {
-      const init = await (0, import_ssi_sdk9.interpreterStartOrResume)({
+    if (!this.noStateMachinePersistence && !opts?.machineState && (0, import_ssi_sdk8.contextHasPlugin)(this.context, "machineStatesFindActive")) {
+      const init = await (0, import_ssi_sdk10.interpreterStartOrResume)({
         interpreter,
         context: this.context,
         cleanupAllOtherInstances: true,