@sphereon/ssi-sdk.siopv2-oid4vp-op-auth 0.34.1-next.29 → 0.34.1-next.299
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +629 -1112
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +710 -112
- package/dist/index.d.ts +710 -112
- package/dist/index.js +563 -1046
- package/dist/index.js.map +1 -1
- package/package.json +24 -24
- package/src/agent/DidAuthSiopOpAuthenticator.ts +10 -145
- package/src/index.ts +2 -1
- package/src/machine/Siopv2Machine.ts +5 -5
- package/src/services/Siopv2MachineService.ts +189 -265
- package/src/session/OID4VP.ts +310 -300
- package/src/session/OpSession.ts +22 -114
- package/src/session/functions.ts +1 -8
- package/src/types/IDidAuthSiopOpAuthenticator.ts +6 -59
- package/src/types/identifier/index.ts +0 -4
- package/src/types/machine/index.ts +1 -1
- package/src/types/siop-service/index.ts +12 -10
- package/src/utils/CredentialUtils.ts +2 -40
- package/src/utils/dcql.ts +22 -19
package/src/session/OID4VP.ts
CHANGED
|
@@ -1,322 +1,332 @@
|
|
|
1
|
-
import { PresentationDefinitionWithLocation, PresentationExchange } from '@sphereon/did-auth-siop'
|
|
2
|
-
import { SelectResults, Status, SubmissionRequirementMatch } from '@sphereon/pex'
|
|
3
|
-
import { Format } from '@sphereon/pex-models'
|
|
1
|
+
// import { PresentationDefinitionWithLocation, PresentationExchange } from '@sphereon/did-auth-siop'
|
|
2
|
+
// import { SelectResults, Status, SubmissionRequirementMatch } from '@sphereon/pex'
|
|
3
|
+
//import { Format } from '@sphereon/pex-models'
|
|
4
|
+
// import {
|
|
5
|
+
// //isManagedIdentifierDidResult,
|
|
6
|
+
// isOID4VCIssuerIdentifier,
|
|
7
|
+
// ManagedIdentifierOptsOrResult,
|
|
8
|
+
// ManagedIdentifierResult,
|
|
9
|
+
// } from '@sphereon/ssi-sdk-ext.identifier-resolution'
|
|
10
|
+
// import { defaultHasher,
|
|
11
|
+
// // ProofOptions
|
|
12
|
+
// } from '@sphereon/ssi-sdk.core'
|
|
13
|
+
//import { UniqueDigitalCredential, verifiableCredentialForRoleFilter } from '@sphereon/ssi-sdk.credential-store'
|
|
14
|
+
//import { CredentialRole, FindDigitalCredentialArgs } from '@sphereon/ssi-sdk.data-store-types'
|
|
4
15
|
import {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
} from '@sphereon/ssi-sdk-ext.identifier-resolution'
|
|
10
|
-
import { defaultHasher, ProofOptions } from '@sphereon/ssi-sdk.core'
|
|
11
|
-
import { UniqueDigitalCredential, verifiableCredentialForRoleFilter } from '@sphereon/ssi-sdk.credential-store'
|
|
12
|
-
import { CredentialRole, FindDigitalCredentialArgs } from '@sphereon/ssi-sdk.data-store'
|
|
13
|
-
import { CompactJWT, HasherSync, IProof, OriginalVerifiableCredential } from '@sphereon/ssi-types'
|
|
16
|
+
//CompactJWT,
|
|
17
|
+
HasherSync,
|
|
18
|
+
//IProof, OriginalVerifiableCredential
|
|
19
|
+
} from '@sphereon/ssi-types'
|
|
14
20
|
import {
|
|
15
|
-
DEFAULT_JWT_PROOF_TYPE,
|
|
16
|
-
IGetPresentationExchangeArgs,
|
|
21
|
+
//DEFAULT_JWT_PROOF_TYPE,
|
|
22
|
+
//IGetPresentationExchangeArgs,
|
|
17
23
|
IOID4VPArgs,
|
|
18
|
-
VerifiableCredentialsWithDefinition,
|
|
19
|
-
VerifiablePresentationWithDefinition,
|
|
24
|
+
//VerifiableCredentialsWithDefinition,
|
|
25
|
+
//VerifiablePresentationWithDefinition,
|
|
20
26
|
} from '../types'
|
|
21
|
-
import { createOID4VPPresentationSignCallback } from './functions'
|
|
27
|
+
//import { createOID4VPPresentationSignCallback } from './functions'
|
|
22
28
|
import { OpSession } from './OpSession'
|
|
23
29
|
|
|
30
|
+
// FIXME SSISDK-44 add support for DCQL presentations
|
|
31
|
+
|
|
24
32
|
export class OID4VP {
|
|
25
|
-
private readonly session: OpSession
|
|
26
|
-
private readonly allIdentifiers: string[]
|
|
27
|
-
private readonly hasher?: HasherSync
|
|
33
|
+
//private readonly session: OpSession
|
|
34
|
+
// private readonly allIdentifiers: string[]
|
|
35
|
+
// private readonly hasher?: HasherSync
|
|
28
36
|
|
|
29
37
|
private constructor(args: IOID4VPArgs) {
|
|
30
|
-
const { session,
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
this.
|
|
34
|
-
this.
|
|
38
|
+
// const { session,
|
|
39
|
+
// // allIdentifiers, hasher = defaultHasher
|
|
40
|
+
// } = args
|
|
41
|
+
//this.session = session
|
|
42
|
+
// this.allIdentifiers = allIdentifiers ?? []
|
|
43
|
+
// this.hasher = hasher
|
|
35
44
|
}
|
|
36
45
|
|
|
37
46
|
public static async init(session: OpSession, allIdentifiers: string[], hasher?: HasherSync): Promise<OID4VP> {
|
|
38
47
|
return new OID4VP({ session, allIdentifiers: allIdentifiers ?? (await session.getSupportedDIDs()), hasher })
|
|
39
48
|
}
|
|
40
49
|
|
|
41
|
-
public async getPresentationDefinitions(): Promise<PresentationDefinitionWithLocation[] | undefined> {
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
}
|
|
48
|
-
|
|
49
|
-
private getPresentationExchange(args: IGetPresentationExchangeArgs): PresentationExchange {
|
|
50
|
-
const { verifiableCredentials, allIdentifiers, hasher } = args
|
|
51
|
-
|
|
52
|
-
return new PresentationExchange({
|
|
53
|
-
allDIDs: allIdentifiers ?? this.allIdentifiers,
|
|
54
|
-
allVerifiableCredentials: verifiableCredentials,
|
|
55
|
-
hasher: hasher ?? this.hasher,
|
|
56
|
-
})
|
|
57
|
-
}
|
|
58
|
-
|
|
59
|
-
public async createVerifiablePresentations(
|
|
60
|
-
credentialRole: CredentialRole,
|
|
61
|
-
credentialsWithDefinitions: VerifiableCredentialsWithDefinition[],
|
|
62
|
-
opts?: {
|
|
63
|
-
forceNoCredentialsInVP?: boolean // Allow to create a VP without credentials, like EBSI is using it. Defaults to false
|
|
64
|
-
restrictToFormats?: Format
|
|
65
|
-
restrictToDIDMethods?: string[]
|
|
66
|
-
proofOpts?: ProofOptions
|
|
67
|
-
idOpts?: ManagedIdentifierOptsOrResult
|
|
68
|
-
skipDidResolution?: boolean
|
|
69
|
-
holderDID?: string
|
|
70
|
-
subjectIsHolder?: boolean
|
|
71
|
-
hasher?: HasherSync
|
|
72
|
-
applyFilter?: boolean
|
|
73
|
-
},
|
|
74
|
-
): Promise<VerifiablePresentationWithDefinition[]> {
|
|
75
|
-
return await Promise.all(credentialsWithDefinitions.map((cred) => this.createVerifiablePresentation(credentialRole, cred, opts)))
|
|
76
|
-
}
|
|
77
|
-
|
|
78
|
-
public async createVerifiablePresentation(
|
|
79
|
-
credentialRole: CredentialRole,
|
|
80
|
-
selectedVerifiableCredentials: VerifiableCredentialsWithDefinition,
|
|
81
|
-
opts?: {
|
|
82
|
-
forceNoCredentialsInVP?: boolean // Allow to create a VP without credentials, like EBSI is using it. Defaults to false
|
|
83
|
-
restrictToFormats?: Format
|
|
84
|
-
restrictToDIDMethods?: string[]
|
|
85
|
-
proofOpts?: ProofOptions
|
|
86
|
-
idOpts?: ManagedIdentifierOptsOrResult
|
|
87
|
-
skipDidResolution?: boolean
|
|
88
|
-
holder?: string
|
|
89
|
-
subjectIsHolder?: boolean
|
|
90
|
-
applyFilter?: boolean
|
|
91
|
-
hasher?: HasherSync
|
|
92
|
-
},
|
|
93
|
-
): Promise<VerifiablePresentationWithDefinition> {
|
|
94
|
-
const { subjectIsHolder, holder, forceNoCredentialsInVP = false } = { ...opts }
|
|
95
|
-
if (subjectIsHolder && holder) {
|
|
96
|
-
throw Error('Cannot both have subject is holder and a holderDID value at the same time (programming error)')
|
|
97
|
-
}
|
|
98
|
-
if (forceNoCredentialsInVP) {
|
|
99
|
-
selectedVerifiableCredentials.credentials = []
|
|
100
|
-
} else if (!selectedVerifiableCredentials?.credentials || selectedVerifiableCredentials.credentials.length === 0) {
|
|
101
|
-
throw Error('No verifiable verifiableCredentials provided for presentation definition')
|
|
102
|
-
}
|
|
103
|
-
|
|
104
|
-
const proofOptions: ProofOptions = {
|
|
105
|
-
...opts?.proofOpts,
|
|
106
|
-
challenge: opts?.proofOpts?.nonce ?? opts?.proofOpts?.challenge ?? this.session.nonce,
|
|
107
|
-
domain: opts?.proofOpts?.domain ?? (await this.session.getRedirectUri()),
|
|
108
|
-
}
|
|
109
|
-
|
|
110
|
-
let idOpts = opts?.idOpts
|
|
111
|
-
if (!idOpts) {
|
|
112
|
-
if (opts?.subjectIsHolder) {
|
|
113
|
-
if (forceNoCredentialsInVP) {
|
|
114
|
-
return Promise.reject(
|
|
115
|
-
Error(
|
|
116
|
-
`Cannot have subject is holder, when force no credentials is being used, as we could never determine the holder then. Please provide holderDID`,
|
|
117
|
-
),
|
|
118
|
-
)
|
|
119
|
-
}
|
|
120
|
-
const firstUniqueDC = selectedVerifiableCredentials.credentials[0]
|
|
121
|
-
// const firstVC = firstUniqueDC.uniformVerifiableCredential!
|
|
122
|
-
if (typeof firstUniqueDC !== 'object' || !('digitalCredential' in firstUniqueDC)) {
|
|
123
|
-
return Promise.reject(Error('If no opts provided, credentials should be of type UniqueDigitalCredential'))
|
|
124
|
-
}
|
|
125
|
-
|
|
126
|
-
idOpts = isOID4VCIssuerIdentifier(firstUniqueDC.digitalCredential.kmsKeyRef)
|
|
127
|
-
? await this.session.context.agent.identifierManagedGetByIssuer({
|
|
128
|
-
identifier: firstUniqueDC.digitalCredential.kmsKeyRef,
|
|
129
|
-
})
|
|
130
|
-
: await this.session.context.agent.identifierManagedGetByKid({
|
|
131
|
-
identifier: firstUniqueDC.digitalCredential.kmsKeyRef,
|
|
132
|
-
kmsKeyRef: firstUniqueDC.digitalCredential.kmsKeyRef,
|
|
133
|
-
})
|
|
134
|
-
|
|
135
|
-
/*
|
|
136
|
-
const holder = CredentialMapper.isSdJwtDecodedCredential(firstVC)
|
|
137
|
-
? firstVC.decodedPayload.cnf?.jwk
|
|
138
|
-
? //TODO SDK-19: convert the JWK to hex and search for the appropriate key and associated DID
|
|
139
|
-
//doesn't apply to did:jwk only, as you can represent any DID key as a JWK. So whenever you encounter a JWK it doesn't mean it had to come from a did:jwk in the system. It just can always be represented as a did:jwk
|
|
140
|
-
`did:jwk:${encodeJoseBlob(firstVC.decodedPayload.cnf?.jwk)}#0`
|
|
141
|
-
: firstVC.decodedPayload.sub
|
|
142
|
-
: Array.isArray(firstVC.credentialSubject)
|
|
143
|
-
? firstVC.credentialSubject[0].id
|
|
144
|
-
: firstVC.credentialSubject.id
|
|
145
|
-
if (holder) {
|
|
146
|
-
idOpts = { identifier: holder }
|
|
147
|
-
}
|
|
148
|
-
*/
|
|
149
|
-
} else if (opts?.holder) {
|
|
150
|
-
idOpts = { identifier: opts.holder }
|
|
151
|
-
}
|
|
152
|
-
}
|
|
153
|
-
|
|
154
|
-
// We are making sure to filter, in case the user submitted all verifiableCredentials in the wallet/agent. We also make sure to get original formats back
|
|
155
|
-
const vcs = forceNoCredentialsInVP
|
|
156
|
-
? selectedVerifiableCredentials
|
|
157
|
-
: opts?.applyFilter
|
|
158
|
-
? await this.filterCredentials(credentialRole, selectedVerifiableCredentials.definition, {
|
|
159
|
-
restrictToFormats: opts?.restrictToFormats,
|
|
160
|
-
restrictToDIDMethods: opts?.restrictToDIDMethods,
|
|
161
|
-
filterOpts: {
|
|
162
|
-
verifiableCredentials: selectedVerifiableCredentials.credentials,
|
|
163
|
-
},
|
|
164
|
-
})
|
|
165
|
-
: {
|
|
166
|
-
definition: selectedVerifiableCredentials.definition,
|
|
167
|
-
credentials: selectedVerifiableCredentials.credentials,
|
|
168
|
-
}
|
|
169
|
-
|
|
170
|
-
if (!idOpts) {
|
|
171
|
-
return Promise.reject(Error(`No identifier options present at this point`))
|
|
172
|
-
}
|
|
173
|
-
|
|
174
|
-
const signCallback = await createOID4VPPresentationSignCallback({
|
|
175
|
-
presentationSignCallback: this.session.options.presentationSignCallback,
|
|
176
|
-
idOpts,
|
|
177
|
-
context: this.session.context,
|
|
178
|
-
domain: proofOptions.domain,
|
|
179
|
-
challenge: proofOptions.challenge,
|
|
180
|
-
format: opts?.restrictToFormats ?? selectedVerifiableCredentials.definition.definition.format,
|
|
181
|
-
skipDidResolution: opts?.skipDidResolution ?? false,
|
|
182
|
-
})
|
|
183
|
-
const identifier: ManagedIdentifierResult = await this.session.context.agent.identifierManagedGet(idOpts)
|
|
184
|
-
const verifiableCredentials = vcs.credentials.map((credential) =>
|
|
185
|
-
typeof credential === 'object' && 'digitalCredential' in credential ? credential.originalVerifiableCredential! : credential,
|
|
186
|
-
)
|
|
187
|
-
const presentationResult = await this.getPresentationExchange({
|
|
188
|
-
verifiableCredentials: verifiableCredentials,
|
|
189
|
-
allIdentifiers: this.allIdentifiers,
|
|
190
|
-
hasher: opts?.hasher,
|
|
191
|
-
}).createVerifiablePresentation(vcs.definition.definition, verifiableCredentials, signCallback, {
|
|
192
|
-
proofOptions,
|
|
193
|
-
// fixme: Update to newer siop-vp to not require dids here. But when Veramo is creating the VP it's still looking at this field to pass into didManagerGet
|
|
194
|
-
...(identifier && isManagedIdentifierDidResult(identifier) && { holderDID: identifier.did }),
|
|
195
|
-
})
|
|
196
|
-
|
|
197
|
-
const verifiablePresentations = presentationResult.verifiablePresentations.map((verifiablePresentation) =>
|
|
198
|
-
typeof verifiablePresentation !== 'string' &&
|
|
199
|
-
'proof' in verifiablePresentation &&
|
|
200
|
-
'jwt' in verifiablePresentation.proof &&
|
|
201
|
-
verifiablePresentation.proof.jwt
|
|
202
|
-
? verifiablePresentation.proof.jwt
|
|
203
|
-
: verifiablePresentation,
|
|
204
|
-
)
|
|
205
|
-
|
|
206
|
-
return {
|
|
207
|
-
...presentationResult,
|
|
208
|
-
verifiablePresentations,
|
|
209
|
-
verifiableCredentials: verifiableCredentials,
|
|
210
|
-
definition: selectedVerifiableCredentials.definition,
|
|
211
|
-
idOpts,
|
|
212
|
-
}
|
|
213
|
-
}
|
|
214
|
-
|
|
215
|
-
public async filterCredentialsAgainstAllDefinitions(
|
|
216
|
-
credentialRole: CredentialRole,
|
|
217
|
-
opts?: {
|
|
218
|
-
filterOpts?: {
|
|
219
|
-
verifiableCredentials?: UniqueDigitalCredential[]
|
|
220
|
-
filter?: FindDigitalCredentialArgs
|
|
221
|
-
}
|
|
222
|
-
holderDIDs?: string[]
|
|
223
|
-
restrictToFormats?: Format
|
|
224
|
-
restrictToDIDMethods?: string[]
|
|
225
|
-
},
|
|
226
|
-
): Promise<VerifiableCredentialsWithDefinition[]> {
|
|
227
|
-
const defs = await this.getPresentationDefinitions()
|
|
228
|
-
const result: VerifiableCredentialsWithDefinition[] = []
|
|
229
|
-
if (defs) {
|
|
230
|
-
for (const definition of defs) {
|
|
231
|
-
result.push(await this.filterCredentials(credentialRole, definition, opts))
|
|
232
|
-
}
|
|
233
|
-
}
|
|
234
|
-
return result
|
|
235
|
-
}
|
|
50
|
+
// public async getPresentationDefinitions(): Promise<PresentationDefinitionWithLocation[] | undefined> {
|
|
51
|
+
// const definitions = await this.session.getPresentationDefinitions()
|
|
52
|
+
// if (definitions) {
|
|
53
|
+
// PresentationExchange.assertValidPresentationDefinitionWithLocations(definitions)
|
|
54
|
+
// }
|
|
55
|
+
// return definitions
|
|
56
|
+
// }
|
|
236
57
|
|
|
237
|
-
|
|
238
|
-
|
|
239
|
-
|
|
240
|
-
|
|
241
|
-
|
|
242
|
-
|
|
243
|
-
|
|
244
|
-
|
|
245
|
-
|
|
246
|
-
): Promise<VerifiableCredentialsWithDefinition> {
|
|
247
|
-
const udcMap = new Map<OriginalVerifiableCredential, UniqueDigitalCredential | OriginalVerifiableCredential>()
|
|
248
|
-
opts?.filterOpts?.verifiableCredentials?.forEach((credential) => {
|
|
249
|
-
if (typeof credential === 'object' && 'digitalCredential' in credential) {
|
|
250
|
-
udcMap.set(credential.originalVerifiableCredential!, credential)
|
|
251
|
-
} else {
|
|
252
|
-
udcMap.set(credential, credential)
|
|
253
|
-
}
|
|
254
|
-
})
|
|
58
|
+
// private getPresentationExchange(args: IGetPresentationExchangeArgs): PresentationExchange {
|
|
59
|
+
// const { verifiableCredentials, allIdentifiers, hasher } = args
|
|
60
|
+
//
|
|
61
|
+
// return new PresentationExchange({
|
|
62
|
+
// allDIDs: allIdentifiers ?? this.allIdentifiers,
|
|
63
|
+
// allVerifiableCredentials: verifiableCredentials,
|
|
64
|
+
// hasher: hasher ?? this.hasher,
|
|
65
|
+
// })
|
|
66
|
+
// }
|
|
255
67
|
|
|
256
|
-
|
|
257
|
-
|
|
258
|
-
|
|
259
|
-
|
|
260
|
-
|
|
261
|
-
|
|
262
|
-
|
|
263
|
-
|
|
264
|
-
|
|
265
|
-
|
|
266
|
-
|
|
267
|
-
|
|
268
|
-
|
|
269
|
-
|
|
270
|
-
|
|
271
|
-
|
|
272
|
-
|
|
273
|
-
|
|
274
|
-
}
|
|
68
|
+
// public async createVerifiablePresentations(
|
|
69
|
+
// credentialRole: CredentialRole,
|
|
70
|
+
// credentialsWithDefinitions: VerifiableCredentialsWithDefinition[],
|
|
71
|
+
// opts?: {
|
|
72
|
+
// forceNoCredentialsInVP?: boolean // Allow to create a VP without credentials, like EBSI is using it. Defaults to false
|
|
73
|
+
// restrictToFormats?: Format
|
|
74
|
+
// restrictToDIDMethods?: string[]
|
|
75
|
+
// proofOpts?: ProofOptions
|
|
76
|
+
// idOpts?: ManagedIdentifierOptsOrResult
|
|
77
|
+
// skipDidResolution?: boolean
|
|
78
|
+
// holderDID?: string
|
|
79
|
+
// subjectIsHolder?: boolean
|
|
80
|
+
// hasher?: HasherSync
|
|
81
|
+
// applyFilter?: boolean
|
|
82
|
+
// },
|
|
83
|
+
// ): Promise<VerifiablePresentationWithDefinition[]> {
|
|
84
|
+
// return await Promise.all(credentialsWithDefinitions.map((cred) => this.createVerifiablePresentation(credentialRole, cred, opts)))
|
|
85
|
+
// }
|
|
275
86
|
|
|
276
|
-
public async
|
|
277
|
-
|
|
278
|
-
|
|
279
|
-
|
|
280
|
-
|
|
281
|
-
|
|
282
|
-
|
|
283
|
-
|
|
284
|
-
|
|
285
|
-
|
|
286
|
-
|
|
287
|
-
|
|
288
|
-
|
|
289
|
-
|
|
290
|
-
|
|
291
|
-
|
|
292
|
-
|
|
293
|
-
|
|
87
|
+
// public async createVerifiablePresentation(
|
|
88
|
+
// credentialRole: CredentialRole,
|
|
89
|
+
// selectedVerifiableCredentials: VerifiableCredentialsWithDefinition,
|
|
90
|
+
// opts?: {
|
|
91
|
+
// forceNoCredentialsInVP?: boolean // Allow to create a VP without credentials, like EBSI is using it. Defaults to false
|
|
92
|
+
// restrictToFormats?: Format
|
|
93
|
+
// restrictToDIDMethods?: string[]
|
|
94
|
+
// proofOpts?: ProofOptions
|
|
95
|
+
// idOpts?: ManagedIdentifierOptsOrResult
|
|
96
|
+
// skipDidResolution?: boolean
|
|
97
|
+
// holder?: string
|
|
98
|
+
// subjectIsHolder?: boolean
|
|
99
|
+
// applyFilter?: boolean
|
|
100
|
+
// hasher?: HasherSync
|
|
101
|
+
// },
|
|
102
|
+
// ): Promise<VerifiablePresentationWithDefinition> {
|
|
103
|
+
// const { subjectIsHolder, holder, forceNoCredentialsInVP = false } = { ...opts }
|
|
104
|
+
// if (subjectIsHolder && holder) {
|
|
105
|
+
// throw Error('Cannot both have subject is holder and a holderDID value at the same time (programming error)')
|
|
106
|
+
// }
|
|
107
|
+
// if (forceNoCredentialsInVP) {
|
|
108
|
+
// selectedVerifiableCredentials.credentials = []
|
|
109
|
+
// } else if (!selectedVerifiableCredentials?.credentials || selectedVerifiableCredentials.credentials.length === 0) {
|
|
110
|
+
// throw Error('No verifiable verifiableCredentials provided for presentation definition')
|
|
111
|
+
// }
|
|
112
|
+
//
|
|
113
|
+
// // const proofOptions: ProofOptions = {
|
|
114
|
+
// // ...opts?.proofOpts,
|
|
115
|
+
// // challenge: opts?.proofOpts?.nonce ?? opts?.proofOpts?.challenge ?? this.session.nonce,
|
|
116
|
+
// // domain: opts?.proofOpts?.domain ?? (await this.session.getRedirectUri()),
|
|
117
|
+
// // }
|
|
118
|
+
//
|
|
119
|
+
// let idOpts = opts?.idOpts
|
|
120
|
+
// if (!idOpts) {
|
|
121
|
+
// if (opts?.subjectIsHolder) {
|
|
122
|
+
// if (forceNoCredentialsInVP) {
|
|
123
|
+
// return Promise.reject(
|
|
124
|
+
// Error(
|
|
125
|
+
// `Cannot have subject is holder, when force no credentials is being used, as we could never determine the holder then. Please provide holderDID`,
|
|
126
|
+
// ),
|
|
127
|
+
// )
|
|
128
|
+
// }
|
|
129
|
+
// const firstUniqueDC = selectedVerifiableCredentials.credentials[0]
|
|
130
|
+
// // const firstVC = firstUniqueDC.uniformVerifiableCredential!
|
|
131
|
+
// if (typeof firstUniqueDC !== 'object' || !('digitalCredential' in firstUniqueDC)) {
|
|
132
|
+
// return Promise.reject(Error('If no opts provided, credentials should be of type UniqueDigitalCredential'))
|
|
133
|
+
// }
|
|
134
|
+
//
|
|
135
|
+
// idOpts = isOID4VCIssuerIdentifier(firstUniqueDC.digitalCredential.kmsKeyRef)
|
|
136
|
+
// ? await this.session.context.agent.identifierManagedGetByIssuer({
|
|
137
|
+
// identifier: firstUniqueDC.digitalCredential.kmsKeyRef,
|
|
138
|
+
// })
|
|
139
|
+
// : await this.session.context.agent.identifierManagedGetByKid({
|
|
140
|
+
// identifier: firstUniqueDC.digitalCredential.kmsKeyRef,
|
|
141
|
+
// kmsKeyRef: firstUniqueDC.digitalCredential.kmsKeyRef,
|
|
142
|
+
// })
|
|
143
|
+
//
|
|
144
|
+
// /*
|
|
145
|
+
// const holder = CredentialMapper.isSdJwtDecodedCredential(firstVC)
|
|
146
|
+
// ? firstVC.decodedPayload.cnf?.jwk
|
|
147
|
+
// ? //TODO SDK-19: convert the JWK to hex and search for the appropriate key and associated DID
|
|
148
|
+
// //doesn't apply to did:jwk only, as you can represent any DID key as a JWK. So whenever you encounter a JWK it doesn't mean it had to come from a did:jwk in the system. It just can always be represented as a did:jwk
|
|
149
|
+
// `did:jwk:${encodeJoseBlob(firstVC.decodedPayload.cnf?.jwk)}#0`
|
|
150
|
+
// : firstVC.decodedPayload.sub
|
|
151
|
+
// : Array.isArray(firstVC.credentialSubject)
|
|
152
|
+
// ? firstVC.credentialSubject[0].id
|
|
153
|
+
// : firstVC.credentialSubject.id
|
|
154
|
+
// if (holder) {
|
|
155
|
+
// idOpts = { identifier: holder }
|
|
156
|
+
// }
|
|
157
|
+
// */
|
|
158
|
+
// } else if (opts?.holder) {
|
|
159
|
+
// idOpts = { identifier: opts.holder }
|
|
160
|
+
// }
|
|
161
|
+
// }
|
|
162
|
+
//
|
|
163
|
+
// // We are making sure to filter, in case the user submitted all verifiableCredentials in the wallet/agent. We also make sure to get original formats back
|
|
164
|
+
// const vcs = forceNoCredentialsInVP
|
|
165
|
+
// ? selectedVerifiableCredentials
|
|
166
|
+
// : opts?.applyFilter
|
|
167
|
+
// ? await this.filterCredentials(credentialRole, selectedVerifiableCredentials.dcqlQuery, {
|
|
168
|
+
// restrictToFormats: opts?.restrictToFormats,
|
|
169
|
+
// restrictToDIDMethods: opts?.restrictToDIDMethods,
|
|
170
|
+
// filterOpts: {
|
|
171
|
+
// verifiableCredentials: selectedVerifiableCredentials.credentials,
|
|
172
|
+
// },
|
|
173
|
+
// })
|
|
174
|
+
// : {
|
|
175
|
+
// definition: selectedVerifiableCredentials.dcqlQuery,
|
|
176
|
+
// credentials: selectedVerifiableCredentials.credentials,
|
|
177
|
+
// }
|
|
178
|
+
//
|
|
179
|
+
// if (!idOpts) {
|
|
180
|
+
// return Promise.reject(Error(`No identifier options present at this point`))
|
|
181
|
+
// }
|
|
182
|
+
//
|
|
183
|
+
// // const signCallback = await createOID4VPPresentationSignCallback({
|
|
184
|
+
// // presentationSignCallback: this.session.options.presentationSignCallback,
|
|
185
|
+
// // idOpts,
|
|
186
|
+
// // context: this.session.context,
|
|
187
|
+
// // domain: proofOptions.domain,
|
|
188
|
+
// // challenge: proofOptions.challenge,
|
|
189
|
+
// // format: opts?.restrictToFormats ?? selectedVerifiableCredentials.dcqlQuery.dcqlQuery.format,
|
|
190
|
+
// // skipDidResolution: opts?.skipDidResolution ?? false,
|
|
191
|
+
// // })
|
|
192
|
+
// const identifier: ManagedIdentifierResult = await this.session.context.agent.identifierManagedGet(idOpts)
|
|
193
|
+
// const verifiableCredentials = vcs.credentials.map((credential) =>
|
|
194
|
+
// typeof credential === 'object' && 'digitalCredential' in credential ? credential.originalVerifiableCredential! : credential,
|
|
195
|
+
// )
|
|
196
|
+
// // const presentationResult = await this.getPresentationExchange({
|
|
197
|
+
// // verifiableCredentials: verifiableCredentials,
|
|
198
|
+
// // allIdentifiers: this.allIdentifiers,
|
|
199
|
+
// // hasher: opts?.hasher,
|
|
200
|
+
// // }).createVerifiablePresentation(vcs.dcqlQuery.dcqlQuery, verifiableCredentials, signCallback, {
|
|
201
|
+
// // proofOptions,
|
|
202
|
+
// // // fixme: Update to newer siop-vp to not require dids here. But when Veramo is creating the VP it's still looking at this field to pass into didManagerGet
|
|
203
|
+
// // ...(identifier && isManagedIdentifierDidResult(identifier) && { holderDID: identifier.did }),
|
|
204
|
+
// // })
|
|
205
|
+
//
|
|
206
|
+
// const verifiablePresentations = presentationResult.verifiablePresentations.map((verifiablePresentation) =>
|
|
207
|
+
// typeof verifiablePresentation !== 'string' &&
|
|
208
|
+
// 'proof' in verifiablePresentation &&
|
|
209
|
+
// 'jwt' in verifiablePresentation.proof &&
|
|
210
|
+
// verifiablePresentation.proof.jwt
|
|
211
|
+
// ? verifiablePresentation.proof.jwt
|
|
212
|
+
// : verifiablePresentation,
|
|
213
|
+
// )
|
|
214
|
+
//
|
|
215
|
+
// return {
|
|
216
|
+
// ...presentationResult,
|
|
217
|
+
// verifiablePresentations,
|
|
218
|
+
// verifiableCredentials: verifiableCredentials,
|
|
219
|
+
// dcqlQuery: selectedVerifiableCredentials.dcqlQuery,
|
|
220
|
+
// idOpts,
|
|
221
|
+
// }
|
|
222
|
+
// }
|
|
294
223
|
|
|
295
|
-
|
|
296
|
-
|
|
297
|
-
|
|
298
|
-
|
|
299
|
-
|
|
300
|
-
|
|
224
|
+
// public async filterCredentialsAgainstAllDefinitions(
|
|
225
|
+
// credentialRole: CredentialRole,
|
|
226
|
+
// opts?: {
|
|
227
|
+
// filterOpts?: {
|
|
228
|
+
// verifiableCredentials?: UniqueDigitalCredential[]
|
|
229
|
+
// filter?: FindDigitalCredentialArgs
|
|
230
|
+
// }
|
|
231
|
+
// holderDIDs?: string[]
|
|
232
|
+
// restrictToFormats?: Format
|
|
233
|
+
// restrictToDIDMethods?: string[]
|
|
234
|
+
// },
|
|
235
|
+
// ): Promise<VerifiableCredentialsWithDefinition[]> {
|
|
236
|
+
// const defs = await this.getPresentationDefinitions()
|
|
237
|
+
// const result: VerifiableCredentialsWithDefinition[] = []
|
|
238
|
+
// if (defs) {
|
|
239
|
+
// for (const definition of defs) {
|
|
240
|
+
// result.push(await this.filterCredentials(credentialRole, definition, opts))
|
|
241
|
+
// }
|
|
242
|
+
// }
|
|
243
|
+
// return result
|
|
244
|
+
// }
|
|
301
245
|
|
|
302
|
-
|
|
303
|
-
|
|
304
|
-
|
|
305
|
-
|
|
306
|
-
|
|
307
|
-
|
|
308
|
-
|
|
309
|
-
|
|
310
|
-
|
|
311
|
-
|
|
246
|
+
// public async filterCredentials(
|
|
247
|
+
// credentialRole: CredentialRole,
|
|
248
|
+
// presentationDefinition: PresentationDefinitionWithLocation,
|
|
249
|
+
// opts?: {
|
|
250
|
+
// filterOpts?: { verifiableCredentials?: (UniqueDigitalCredential | OriginalVerifiableCredential)[]; filter?: FindDigitalCredentialArgs }
|
|
251
|
+
// holderDIDs?: string[]
|
|
252
|
+
// restrictToFormats?: Format
|
|
253
|
+
// restrictToDIDMethods?: string[]
|
|
254
|
+
// },
|
|
255
|
+
// ): Promise<VerifiableCredentialsWithDefinition> {
|
|
256
|
+
// const udcMap = new Map<OriginalVerifiableCredential, UniqueDigitalCredential | OriginalVerifiableCredential>()
|
|
257
|
+
// opts?.filterOpts?.verifiableCredentials?.forEach((credential) => {
|
|
258
|
+
// if (typeof credential === 'object' && 'digitalCredential' in credential) {
|
|
259
|
+
// udcMap.set(credential.originalVerifiableCredential!, credential)
|
|
260
|
+
// } else {
|
|
261
|
+
// udcMap.set(credential, credential)
|
|
262
|
+
// }
|
|
263
|
+
// })
|
|
264
|
+
//
|
|
265
|
+
// const credentials = (
|
|
266
|
+
// await this.filterCredentialsWithSelectionStatus(credentialRole, presentationDefinition, {
|
|
267
|
+
// ...opts,
|
|
268
|
+
// filterOpts: {
|
|
269
|
+
// verifiableCredentials: opts?.filterOpts?.verifiableCredentials?.map((credential) => {
|
|
270
|
+
// if (typeof credential === 'object' && 'digitalCredential' in credential) {
|
|
271
|
+
// return credential.originalVerifiableCredential!
|
|
272
|
+
// } else {
|
|
273
|
+
// return credential
|
|
274
|
+
// }
|
|
275
|
+
// }),
|
|
276
|
+
// },
|
|
277
|
+
// })
|
|
278
|
+
// ).verifiableCredential
|
|
279
|
+
//
|
|
280
|
+
// return {
|
|
281
|
+
// dcqlQuery: presentationDefinition,
|
|
282
|
+
// credentials: credentials?.map((vc) => udcMap.get(vc)!) ?? [],
|
|
283
|
+
// }
|
|
284
|
+
// }
|
|
312
285
|
|
|
313
|
-
|
|
314
|
-
|
|
315
|
-
|
|
316
|
-
|
|
317
|
-
|
|
318
|
-
|
|
319
|
-
|
|
320
|
-
|
|
321
|
-
}
|
|
286
|
+
// public async filterCredentialsWithSelectionStatus(
|
|
287
|
+
// credentialRole: CredentialRole,
|
|
288
|
+
// presentationDefinition: PresentationDefinitionWithLocation,
|
|
289
|
+
// opts?: {
|
|
290
|
+
// filterOpts?: { verifiableCredentials?: OriginalVerifiableCredential[]; filter?: FindDigitalCredentialArgs }
|
|
291
|
+
// holderDIDs?: string[]
|
|
292
|
+
// restrictToFormats?: Format
|
|
293
|
+
// restrictToDIDMethods?: string[]
|
|
294
|
+
// },
|
|
295
|
+
// ): Promise<SelectResults> {
|
|
296
|
+
// const selectionResults: SelectResults = await this.getPresentationExchange({
|
|
297
|
+
// verifiableCredentials: await this.getCredentials(credentialRole, opts?.filterOpts),
|
|
298
|
+
// }).selectVerifiableCredentialsForSubmission(presentationDefinition.definition, opts)
|
|
299
|
+
// if (selectionResults.errors && selectionResults.errors.length > 0) {
|
|
300
|
+
// throw Error(JSON.stringify(selectionResults.errors))
|
|
301
|
+
// } else if (selectionResults.areRequiredCredentialsPresent === Status.ERROR) {
|
|
302
|
+
// throw Error(`Not all required credentials are available to satisfy the relying party's request`)
|
|
303
|
+
// }
|
|
304
|
+
//
|
|
305
|
+
// const matches: SubmissionRequirementMatch[] | undefined = selectionResults.matches
|
|
306
|
+
// if (!matches || matches.length === 0 || !selectionResults.verifiableCredential || selectionResults.verifiableCredential.length === 0) {
|
|
307
|
+
// throw Error(JSON.stringify(selectionResults.errors))
|
|
308
|
+
// }
|
|
309
|
+
// return selectionResults
|
|
310
|
+
// }
|
|
311
|
+
//
|
|
312
|
+
// private async getCredentials(
|
|
313
|
+
// credentialRole: CredentialRole,
|
|
314
|
+
// filterOpts?: {
|
|
315
|
+
// verifiableCredentials?: OriginalVerifiableCredential[]
|
|
316
|
+
// filter?: FindDigitalCredentialArgs
|
|
317
|
+
// },
|
|
318
|
+
// ): Promise<OriginalVerifiableCredential[]> {
|
|
319
|
+
// if (filterOpts?.verifiableCredentials && filterOpts.verifiableCredentials.length > 0) {
|
|
320
|
+
// return filterOpts.verifiableCredentials
|
|
321
|
+
// }
|
|
322
|
+
//
|
|
323
|
+
// const filter = verifiableCredentialForRoleFilter(credentialRole, filterOpts?.filter)
|
|
324
|
+
// const uniqueCredentials = await this.session.context.agent.crsGetUniqueCredentials({ filter })
|
|
325
|
+
// return uniqueCredentials.map((uniqueVC: UniqueDigitalCredential) => {
|
|
326
|
+
// const vc = uniqueVC.uniformVerifiableCredential!
|
|
327
|
+
// const proof = Array.isArray(vc.proof) ? vc.proof : [vc.proof]
|
|
328
|
+
// const jwtProof = proof.find((p: IProof) => p?.type === DEFAULT_JWT_PROOF_TYPE)
|
|
329
|
+
// return jwtProof ? (jwtProof.jwt as CompactJWT) : vc
|
|
330
|
+
// })
|
|
331
|
+
// }
|
|
322
332
|
}
|