@sphereon/ssi-sdk.siopv2-oid4vp-rp-auth 0.34.1-feature.SSISDK.47.43 → 0.34.1-feature.SSISDK.50.100

package/src/agent/SIOPv2RP.ts

@@ -3,9 +3,8 @@ import {
   AuthorizationResponsePayload,
   AuthorizationResponseState,
   AuthorizationResponseStateStatus,
-  AuthorizationResponseStateWithVerifiedData,
   decodeUriAsJson,
-  VerifiedAuthorizationResponse
+  VerifiedAuthorizationResponse,
 } from '@sphereon/did-auth-siop'
 import { getAgentResolver } from '@sphereon/ssi-sdk-ext.did-utils'
 import {
@@ -23,7 +22,9 @@ import {
   SdJwtDecodedVerifiableCredential,
 } from '@sphereon/ssi-types'
 import { IAgentPlugin } from '@veramo/core'
+import { DcqlQuery } from 'dcql'
 import {
+  AuthorizationResponseStateWithVerifiedData,
   IAuthorizationRequestPayloads,
   ICreateAuthRequestArgs,
   IGetAuthRequestStateArgs,
@@ -42,9 +43,9 @@ import {
   VerifiedDataMode,
 } from '../index'
 import { RPInstance } from '../RPInstance'
+
 import { ISIOPv2RP } from '../types/ISIOPv2RP'
 import { shaHasher as defaultHasher } from '@sphereon/ssi-sdk.core'
-import { DcqlQuery } from 'dcql'
 
 export class SIOPv2RP implements IAgentPlugin {
   private readonly opts: ISiopv2RPOpts
@@ -84,7 +85,7 @@ export class SIOPv2RP implements IAgentPlugin {
   }
 
   private async createAuthorizationRequestURI(createArgs: ICreateAuthRequestArgs, context: IRequiredContext): Promise<string> {
-    return await this.getRPInstance({ responseRedirectURI: createArgs.responseRedirectURI, ...(createArgs.useQueryIdInstance === true && { queryId: createArgs.queryId } ) }, context)
+    return await this.getRPInstance({ definitionId: createArgs.definitionId, responseRedirectURI: createArgs.responseRedirectURI }, context)
       .then((rp) => rp.createAuthorizationRequestURI(createArgs, context))
       .then((URI) => URI.encodedUri)
   }
@@ -93,23 +94,21 @@ export class SIOPv2RP implements IAgentPlugin {
     createArgs: ICreateAuthRequestArgs,
     context: IRequiredContext,
   ): Promise<IAuthorizationRequestPayloads> {
-    return await this.getRPInstance({ queryId: createArgs.queryId }, context)
+    return await this.getRPInstance({ definitionId: createArgs.definitionId }, context)
       .then((rp) => rp.createAuthorizationRequest(createArgs, context))
       .then(async (request) => {
         const authRequest: IAuthorizationRequestPayloads = {
           authorizationRequest: request.payload,
           requestObject: await request.requestObjectJwt(),
-          requestObjectDecoded: request.requestObject?.getPayload(),
+          requestObjectDecoded: await request.requestObject?.getPayload(),
         }
         return authRequest
       })
   }
 
   private async siopGetRequestState(args: IGetAuthRequestStateArgs, context: IRequiredContext): Promise<AuthorizationRequestState | undefined> {
-    return await this.getRPInstance({ queryId: args.queryId }, context).then((rp) =>
-      rp.get(context).then((rp) =>
-        rp.sessionManager.getRequestStateByCorrelationId(args.correlationId, args.errorOnNotFound)
-      ),
+    return await this.getRPInstance({ definitionId: args.definitionId }, context).then((rp) =>
+      rp.get(context).then((rp) => rp.sessionManager.getRequestStateByCorrelationId(args.correlationId, args.errorOnNotFound)),
     )
   }
 
@@ -117,7 +116,7 @@ export class SIOPv2RP implements IAgentPlugin {
     args: IGetAuthResponseStateArgs,
     context: IRequiredContext,
   ): Promise<AuthorizationResponseStateWithVerifiedData | undefined> {
-    const rpInstance: RPInstance = await this.getRPInstance({ queryId: args.queryId }, context)
+    const rpInstance: RPInstance = await this.getRPInstance({ definitionId: args.definitionId }, context)
     const authorizationResponseState: AuthorizationResponseState | undefined = await rpInstance
       .get(context)
       .then((rp) => rp.sessionManager.getResponseStateByCorrelationId(args.correlationId, args.errorOnNotFound))
@@ -194,10 +193,10 @@ export class SIOPv2RP implements IAgentPlugin {
       : CredentialMapper.toUniformPresentation(presentationDecoded as OriginalVerifiablePresentation)
 
   private async siopUpdateRequestState(args: IUpdateRequestStateArgs, context: IRequiredContext): Promise<AuthorizationRequestState> {
-    if (args.state !== 'authorization_request_created') {
-      throw Error(`Only 'authorization_request_created' status is supported for this method at this point`)
+    if (args.state !== 'sent') {
+      throw Error(`Only 'sent' status is supported for this method at this point`)
     }
-    return await this.getRPInstance({ queryId: args.queryId }, context)
+    return await this.getRPInstance({ definitionId: args.definitionId }, context)
       // todo: In the SIOP library we need to update the signal method to be more like this method
       .then((rp) =>
         rp.get(context).then(async (rp) => {
@@ -211,7 +210,7 @@ export class SIOPv2RP implements IAgentPlugin {
   }
 
   private async siopDeleteState(args: IGetAuthResponseStateArgs, context: IRequiredContext): Promise<boolean> {
-    return await this.getRPInstance({ queryId: args.queryId }, context)
+    return await this.getRPInstance({ definitionId: args.definitionId }, context)
       .then((rp) => rp.get(context).then((rp) => rp.sessionManager.deleteStateForCorrelationId(args.correlationId)))
       .then(() => true)
   }
@@ -224,12 +223,11 @@ export class SIOPv2RP implements IAgentPlugin {
       typeof args.authorizationResponse === 'string'
         ? (decodeUriAsJson(args.authorizationResponse) as AuthorizationResponsePayload)
         : args.authorizationResponse
-    return await this.getRPInstance({ queryId: args.queryId }, context).then((rp) =>
+    return await this.getRPInstance({ definitionId: args.definitionId }, context).then((rp) =>
       rp.get(context).then((rp) =>
         rp.verifyAuthorizationResponse(authResponse, {
           correlationId: args.correlationId,
-          ...(args.presentationDefinitions && !args.dcqlQuery ? { presentationDefinitions: args.presentationDefinitions } : {}),
-          ...(args.dcqlQuery ? { dcqlQuery: args.dcqlQuery as DcqlQuery } : {}), // TODO BEFORE PR, check compatibility and whether we can remove local type
+          ...(args.dcqlQueryPayload ? { dcqlQuery: args.dcqlQueryPayload.dcqlQuery } : {}),
           audience: args.audience,
         }),
       ),
@@ -237,15 +235,29 @@ export class SIOPv2RP implements IAgentPlugin {
   }
 
   private async siopImportDefinitions(args: ImportDefinitionsArgs, context: IRequiredContext): Promise<void> {
-    const { queries, tenantId, version, versionControlMode } = args
+    const { definitions, tenantId, version, versionControlMode } = args
     await Promise.all(
-      queries.map(async (definitionPair) => {
+      definitions.map(async (definitionPair) => {
         const definitionPayload = definitionPair.definitionPayload
-        await context.agent.pexValidateDefinition({ definition: definitionPayload })
+        if (!definitionPayload && !definitionPair.dcqlPayload) {
+          return Promise.reject(Error('Either dcqlPayload or definitionPayload must be suppplied'))
+        }
+
+        let definitionId: string
+        if (definitionPair.dcqlPayload) {
+          DcqlQuery.validate(definitionPair.dcqlPayload.dcqlQuery)
+          console.log(`persisting DCQL definition ${definitionPair.dcqlPayload.queryId} with versionControlMode ${versionControlMode}`)
+          definitionId = definitionPair.dcqlPayload.queryId
+        }
+        if (definitionPayload) {
+          await context.agent.pexValidateDefinition({ definition: definitionPayload })
+          console.log(`persisting PEX definition ${definitionPayload.id} / ${definitionPayload.name} with versionControlMode ${versionControlMode}`)
+          definitionId = definitionPayload.id
+        }
 
-        console.log(`persisting definition ${definitionPayload.id} / ${definitionPayload.name} with versionControlMode ${versionControlMode}`)
         return context.agent.pdmPersistDefinition({
           definitionItem: {
+            definitionId: definitionId!,
             tenantId: tenantId,
             version: version,
             definitionPayload,
@@ -258,7 +270,7 @@ export class SIOPv2RP implements IAgentPlugin {
   }
 
   private async siopGetRedirectURI(args: IGetRedirectUriArgs, context: IRequiredContext): Promise<string | undefined> {
-    const instanceId = args.queryId ?? SIOPv2RP._DEFAULT_OPTS_KEY
+    const instanceId = args.definitionId ?? SIOPv2RP._DEFAULT_OPTS_KEY
     if (this.instances.has(instanceId)) {
       const rpInstance = this.instances.get(instanceId)
       if (rpInstance !== undefined) {
@@ -273,17 +285,17 @@ export class SIOPv2RP implements IAgentPlugin {
     return undefined
   }
 
-  async getRPInstance({ queryId, responseRedirectURI }: ISiopRPInstanceArgs, context: IRequiredContext): Promise<RPInstance> {
-    const instanceId = queryId ?? SIOPv2RP._DEFAULT_OPTS_KEY
+  async getRPInstance({ definitionId, responseRedirectURI }: ISiopRPInstanceArgs, context: IRequiredContext): Promise<RPInstance> {
+    const instanceId = definitionId ?? SIOPv2RP._DEFAULT_OPTS_KEY
     if (!this.instances.has(instanceId)) {
-      const instanceOpts = this.getInstanceOpts(queryId)
-      const rpOpts = await this.getRPOptions(context, { queryId, responseRedirectURI: responseRedirectURI })
+      const instanceOpts = this.getInstanceOpts(definitionId)
+      const rpOpts = await this.getRPOptions(context, { definitionId, responseRedirectURI: responseRedirectURI })
       if (!rpOpts.identifierOpts.resolveOpts?.resolver || typeof rpOpts.identifierOpts.resolveOpts.resolver.resolve !== 'function') {
         if (!rpOpts.identifierOpts?.resolveOpts) {
           rpOpts.identifierOpts = { ...rpOpts.identifierOpts }
           rpOpts.identifierOpts.resolveOpts = { ...rpOpts.identifierOpts.resolveOpts }
         }
-        console.log('Using agent DID resolver for RP instance with definition id ' + queryId)
+        console.log('Using agent DID resolver for RP instance with definition id ' + definitionId)
         rpOpts.identifierOpts.resolveOpts.resolver = getAgentResolver(context, {
           uniresolverResolution: true,
           localResolution: true,
@@ -299,11 +311,11 @@ export class SIOPv2RP implements IAgentPlugin {
     return rpInstance
   }
 
-  async getRPOptions(context: IRequiredContext, opts: { queryId?: string; responseRedirectURI?: string }): Promise<IRPOptions> {
-    const { queryId, responseRedirectURI: responseRedirectURI } = opts
-    const options = this.getInstanceOpts(queryId)?.rpOpts ?? this.opts.defaultOpts
+  async getRPOptions(context: IRequiredContext, opts: { definitionId?: string; responseRedirectURI?: string }): Promise<IRPOptions> {
+    const { definitionId, responseRedirectURI: responseRedirectURI } = opts
+    const options = this.getInstanceOpts(definitionId)?.rpOpts ?? this.opts.defaultOpts
     if (!options) {
-      throw Error(`Could not get specific nor default options for definition ${queryId}`)
+      throw Error(`Could not get specific nor default options for definition ${definitionId}`)
     }
     if (this.opts.defaultOpts) {
       if (!options.identifierOpts) {
@@ -337,7 +349,7 @@ export class SIOPv2RP implements IAgentPlugin {
   getInstanceOpts(definitionId?: string): IPEXInstanceOptions | undefined {
     if (!this.opts.instanceOpts) return undefined
 
-    const instanceOpt = definitionId ? this.opts.instanceOpts.find((i) => i.queryId === definitionId) : undefined
+    const instanceOpt = definitionId ? this.opts.instanceOpts.find((i) => i.definitionId === definitionId) : undefined
 
     return instanceOpt ?? this.getDefaultOptions(definitionId)
   }
@@ -345,11 +357,11 @@ export class SIOPv2RP implements IAgentPlugin {
   private getDefaultOptions(definitionId: string | undefined) {
     if (!this.opts.instanceOpts) return undefined
 
-    const defaultOptions = this.opts.instanceOpts.find((i) => i.queryId === 'default')
+    const defaultOptions = this.opts.instanceOpts.find((i) => i.definitionId === 'default')
     if (defaultOptions) {
       const clonedOptions = { ...defaultOptions }
       if (definitionId !== undefined) {
-        clonedOptions.queryId = definitionId
+        clonedOptions.definitionId = definitionId
       }
       return clonedOptions
     }

package/src/functions.ts

@@ -113,11 +113,11 @@ export async function createRPBuilder(args: {
   let definition: IPresentationDefinition | undefined = args.definition
   let dcqlQuery: DcqlQuery | undefined = args.dcql
 
-  if (!definition && pexOpts && pexOpts.queryId) {
+  if (!definition && pexOpts && pexOpts.definitionId) {
     const presentationDefinitionItems = await context.agent.pdmGetDefinitions({
       filter: [
         {
-          definitionId: pexOpts.queryId,
+          definitionId: pexOpts.definitionId,
           version: pexOpts.version,
           tenantId: pexOpts.tenantId,
         },

package/src/index.ts

@@ -1,7 +1,7 @@
 /**
  * @public
  */
-import schema from '../plugin.schema.json'
+const schema = require('../plugin.schema.json')
 export { schema }
 export { SIOPv2RP } from './agent/SIOPv2RP'
 export * from './types/ISIOPv2RP'

package/src/types/ISIOPv2RP.ts

@@ -2,40 +2,37 @@ import {
   AuthorizationRequestPayload,
   AuthorizationRequestState,
   AuthorizationResponsePayload,
-  AuthorizationResponseStateWithVerifiedData,
-  CallbackOpts,
+  AuthorizationResponseState,
   ClaimPayloadCommonOpts,
   ClientMetadataOpts,
   IRPSessionManager,
-  PresentationDefinitionWithLocation,
   PresentationVerificationCallback,
   RequestObjectPayload,
   ResponseMode,
   ResponseURIType,
   SupportedVersion,
-  VerifiablePresentationTypeFormat,
   VerifiedAuthorizationResponse,
   VerifyJwtCallback,
-  VPTokenLocation
 } from '@sphereon/did-auth-siop'
-import { ExternalIdentifierOIDFEntityIdOpts, IIdentifierResolution, ManagedIdentifierOptsOrResult } from '@sphereon/ssi-sdk-ext.identifier-resolution'
-import { IAgentContext, ICredentialIssuer, ICredentialVerifier, IDIDManager, IKeyManager, IPluginMethodMap, IResolver } from '@veramo/core'
-import { DcqlQueryREST, HasherSync, W3CVerifiablePresentation } from '@sphereon/ssi-types'
-import { Resolvable } from 'did-resolver'
+import { CheckLinkedDomain } from '@sphereon/did-auth-siop-adapter'
 import { DIDDocument } from '@sphereon/did-uni-client'
-import { EventEmitter } from 'events'
+import { JwtIssuer } from '@sphereon/oid4vc-common'
 import { IPresentationDefinition } from '@sphereon/pex'
 import { IDIDOptions } from '@sphereon/ssi-sdk-ext.did-utils'
-import { IPresentationExchange } from '@sphereon/ssi-sdk.presentation-exchange'
-import { VerifyCallback } from '@sphereon/wellknown-dids-client'
-import { AuthorizationRequestStateStatus } from '@sphereon/ssi-sdk.siopv2-oid4vp-common'
-import { IPDManager, VersionControlMode } from '@sphereon/ssi-sdk.pd-manager'
-import { CheckLinkedDomain } from '@sphereon/did-auth-siop-adapter'
-import { ISDJwtPlugin } from '@sphereon/ssi-sdk.sd-jwt'
+import { ExternalIdentifierOIDFEntityIdOpts, IIdentifierResolution, ManagedIdentifierOptsOrResult } from '@sphereon/ssi-sdk-ext.identifier-resolution'
 import { IJwtService } from '@sphereon/ssi-sdk-ext.jwt-service'
-import { JwtIssuer } from '@sphereon/oid4vc-common'
-import { ImDLMdoc } from '@sphereon/ssi-sdk.mdl-mdoc'
 import { ICredentialValidation, SchemaValidation } from '@sphereon/ssi-sdk.credential-validation'
+import { ImDLMdoc } from '@sphereon/ssi-sdk.mdl-mdoc'
+import { IPDManager, VersionControlMode } from '@sphereon/ssi-sdk.pd-manager'
+import { IPresentationExchange } from '@sphereon/ssi-sdk.presentation-exchange'
+import { ISDJwtPlugin } from '@sphereon/ssi-sdk.sd-jwt'
+import { AuthorizationRequestStateStatus } from '@sphereon/ssi-sdk.siopv2-oid4vp-common'
+import { AdditionalClaims, DcqlQueryPayload, HasherSync } from '@sphereon/ssi-types'
+import { VerifyCallback } from '@sphereon/wellknown-dids-client'
+import { IAgentContext, ICredentialIssuer, ICredentialVerifier, IDIDManager, IKeyManager, IPluginMethodMap, IResolver } from '@veramo/core'
+
+import { Resolvable } from 'did-resolver'
+import { EventEmitter } from 'events'
 
 export enum VerifiedDataMode {
   NONE = 'none',
@@ -55,6 +52,7 @@ export interface ISIOPv2RP extends IPluginMethodMap {
   siopDeleteAuthState(args: IDeleteAuthStateArgs, context: IRequiredContext): Promise<boolean>
   siopVerifyAuthResponse(args: IVerifyAuthResponseStateArgs, context: IRequiredContext): Promise<VerifiedAuthorizationResponse>
   siopImportDefinitions(args: ImportDefinitionsArgs, context: IRequiredContext): Promise<void>
+
   siopGetRedirectURI(args: IGetRedirectUriArgs, context: IRequiredContext): Promise<string | undefined>
 }
 
@@ -66,9 +64,8 @@ export interface ISiopv2RPOpts {
 export interface IRPDefaultOpts extends IRPOptions {}
 
 export interface ICreateAuthRequestArgs {
-  queryId: string
+  definitionId: string
   correlationId: string
-  useQueryIdInstance?: boolean
   responseURIType: ResponseURIType
   responseURI: string
   responseRedirectURI?: string
@@ -77,25 +74,24 @@ export interface ICreateAuthRequestArgs {
   nonce?: string
   state?: string
   claims?: ClaimPayloadCommonOpts
-  callback?: CallbackOpts
 }
 
 export interface IGetAuthRequestStateArgs {
   correlationId: string
-  queryId?: string
+  definitionId: string
   errorOnNotFound?: boolean
 }
 
 export interface IGetAuthResponseStateArgs {
   correlationId: string
-  queryId?: string
+  definitionId: string
   errorOnNotFound?: boolean
   progressRequestStateTo?: AuthorizationRequestStateStatus
   includeVerifiedData?: VerifiedDataMode
 }
 
 export interface IUpdateRequestStateArgs {
-  queryId: string
+  definitionId: string
   correlationId: string
   state: AuthorizationRequestStateStatus
   error?: string
@@ -103,25 +99,24 @@ export interface IUpdateRequestStateArgs {
 
 export interface IDeleteAuthStateArgs {
   correlationId: string
-  queryId?: string
+  definitionId: string
 }
 
 export interface IVerifyAuthResponseStateArgs {
   authorizationResponse: string | AuthorizationResponsePayload
-  queryId?: string
+  definitionId?: string
   correlationId: string
   audience?: string
-  presentationDefinitions?: PresentationDefinitionWithLocation | PresentationDefinitionWithLocation[]
-  dcqlQuery?: DcqlQueryREST
+  dcqlQueryPayload?: DcqlQueryPayload
 }
 
 export interface IDefinitionPair {
-  definitionPayload: IPresentationDefinition
-  dcqlPayload?: DcqlQueryREST
+  definitionPayload?: IPresentationDefinition
+  dcqlPayload?: DcqlQueryPayload
 }
 
 export interface ImportDefinitionsArgs {
-  queries: Array<IDefinitionPair>
+  definitions: Array<IDefinitionPair>
   tenantId?: string
   version?: string
   versionControlMode?: VersionControlMode
@@ -129,7 +124,7 @@ export interface ImportDefinitionsArgs {
 
 export interface IGetRedirectUriArgs {
   correlationId: string
-  queryId?: string
+  definitionId?: string
   state?: string
 }
 
@@ -145,7 +140,7 @@ export interface IPEXDefinitionPersistArgs extends IPEXInstanceOptions {
 }
 
 export interface ISiopRPInstanceArgs {
-  queryId?: string
+  definitionId?: string
   responseRedirectURI?: string
 }
 
@@ -170,7 +165,7 @@ export interface IRPOptions {
 export interface IPEXOptions {
   presentationVerifyCallback?: PresentationVerificationCallback
   // definition?: IPresentationDefinition
-  queryId: string
+  definitionId: string
   version?: string
   tenantId?: string
 }
@@ -187,17 +182,9 @@ export interface PerDidResolver {
 export interface IAuthRequestDetails {
   rpDIDDocument?: DIDDocument
   id: string
-  verifiablePresentationMatches: IPresentationWithDefinition[]
   alsoKnownAs?: string[]
 }
 
-export interface IPresentationWithDefinition {
-  location: VPTokenLocation
-  definition: PresentationDefinitionWithLocation
-  format: VerifiablePresentationTypeFormat
-  presentation: W3CVerifiablePresentation
-}
-
 export interface ISIOPIdentifierOptions extends Omit<IDIDOptions, 'idOpts'> {
   // we replace the legacy idOpts with the Managed Identifier opts from the identifier resolution module
   idOpts: ManagedIdentifierOptsOrResult
@@ -211,6 +198,10 @@ export type CredentialOpts = {
   hasher?: HasherSync
 }
 
+export interface AuthorizationResponseStateWithVerifiedData extends AuthorizationResponseState {
+  verifiedData?: AdditionalClaims
+}
+
 export type IRequiredContext = IAgentContext<
   IResolver &
     IDIDManager &