@trustvc/trustvc 2.0.7 → 2.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +21 -6
- package/dist/cjs/verify/fragments/document-integrity/bbs2023W3CSignatureIntegrity.js +11 -0
- package/dist/cjs/verify/fragments/document-integrity/ecdsaW3CSignatureIntegrity.js +6 -82
- package/dist/cjs/verify/fragments/document-integrity/w3cModernSignatureIntegrityFactory.js +90 -0
- package/dist/cjs/verify/verify.js +2 -0
- package/dist/esm/verify/fragments/document-integrity/bbs2023W3CSignatureIntegrity.js +9 -0
- package/dist/esm/verify/fragments/document-integrity/ecdsaW3CSignatureIntegrity.js +6 -82
- package/dist/esm/verify/fragments/document-integrity/w3cModernSignatureIntegrityFactory.js +88 -0
- package/dist/esm/verify/verify.js +2 -0
- package/dist/types/core/documentBuilder.d.ts +2 -2
- package/dist/types/verify/fragments/document-integrity/bbs2023W3CSignatureIntegrity.d.ts +5 -0
- package/dist/types/verify/fragments/document-integrity/w3cModernSignatureIntegrityFactory.d.ts +13 -0
- package/dist/types/w3c/derive.d.ts +3 -3
- package/dist/types/w3c/sign.d.ts +2 -2
- package/package.json +6 -6
package/README.md
CHANGED
|
@@ -155,7 +155,7 @@ const signedWrappedDocument = await signOA(wrappedDocument, {
|
|
|
155
155
|
|
|
156
156
|
#### b) TrustVC W3C Signing (signW3C)
|
|
157
157
|
|
|
158
|
-
The `signW3C` function signs W3C Verifiable Credentials using the provided cryptographic suite and key pair. By default, it uses the **ecdsa-sd-2023** crypto suite unless otherwise specified.
|
|
158
|
+
The `signW3C` function signs W3C Verifiable Credentials using the provided cryptographic suite and key pair. By default, it uses the **ecdsa-sd-2023** crypto suite unless otherwise specified. It also supports **bbs-2023** for modern BBS signatures.
|
|
159
159
|
|
|
160
160
|
```ts
|
|
161
161
|
import { signW3C, VerificationType } from '@trustvc/trustvc';
|
|
@@ -195,7 +195,7 @@ const signingResult = await signW3C(rawDocument, {
|
|
|
195
195
|
secretKeyMultibase: '<secretKeyMultibase>'
|
|
196
196
|
});
|
|
197
197
|
|
|
198
|
-
// You can also specify mandatory pointers for selective disclosure with ecdsa-sd-2023
|
|
198
|
+
// You can also specify mandatory pointers for selective disclosure with ecdsa-sd-2023 / bbs-2023
|
|
199
199
|
const signingResultWithPointers = await signW3C(
|
|
200
200
|
rawDocument,
|
|
201
201
|
{
|
|
@@ -212,7 +212,22 @@ const signingResultWithPointers = await signW3C(
|
|
|
212
212
|
}
|
|
213
213
|
);
|
|
214
214
|
|
|
215
|
-
//
|
|
215
|
+
// Using BBS-2023 cryptosuite
|
|
216
|
+
const signingResultWithBbs2023 = await signW3C(
|
|
217
|
+
rawDocument,
|
|
218
|
+
{
|
|
219
|
+
'@context': 'https://w3id.org/security/multikey/v1',
|
|
220
|
+
id: 'did:web:trustvc.github.io:did:1#multikey-2',
|
|
221
|
+
type: VerificationType.Multikey,
|
|
222
|
+
controller: 'did:web:trustvc.github.io:did:1',
|
|
223
|
+
publicKeyMultibase: 'zUC75kRac7BdtjawFUxowfgD6mzqnRHFxAfMDaBynebdYgakviQkPS1KNJEw7uGWqj91H3hSE4pTERb3EZKLgKXjpqHWrN8dyE8SKyPBE3k7kUGjBNAqJoNGgUzqUW3DSaWrcNr',
|
|
224
|
+
secretKeyMultibase: '<secretKeyMultibase>',
|
|
225
|
+
},
|
|
226
|
+
'bbs-2023'
|
|
227
|
+
);
|
|
228
|
+
|
|
229
|
+
// ⚠️ DEPRECATED: BbsBlsSignature2020 is no longer supported
|
|
230
|
+
// Use 'ecdsa-sd-2023 or bbs-2023' cryptosuite instead as shown above
|
|
216
231
|
const signingResultWithBbs = await signW3C(
|
|
217
232
|
rawDocument,
|
|
218
233
|
{
|
|
@@ -222,7 +237,7 @@ const signingResultWithBbs = await signW3C(
|
|
|
222
237
|
publicKeyBase58: 'oRfEeWFresvhRtXCkihZbxyoi2JER7gHTJ5psXhHsdCoU1MttRMi3Yp9b9fpjmKh7bMgfWKLESiK2YovRd8KGzJsGuamoAXfqDDVhckxuc9nmsJ84skCSTijKeU4pfAcxeJ',
|
|
223
238
|
privateKeyBase58: '<privateKeyBase58>',
|
|
224
239
|
},
|
|
225
|
-
'BbsBlsSignature2020'
|
|
240
|
+
'BbsBlsSignature2020' // This will return an error
|
|
226
241
|
);
|
|
227
242
|
|
|
228
243
|
```
|
|
@@ -231,7 +246,7 @@ const signingResultWithBbs = await signW3C(
|
|
|
231
246
|
|
|
232
247
|
### 3. **Deriving (Selective Disclosure)**
|
|
233
248
|
|
|
234
|
-
> When using ECDSA-SD-2023 crypto
|
|
249
|
+
> When using ECDSA-SD-2023 or BBS-2023 crypto suites, we can derive a new credential with selective disclosure. This means you can choose which parts of the credential to reveal while keeping others hidden.
|
|
235
250
|
|
|
236
251
|
```ts
|
|
237
252
|
import { deriveW3C } from '@trustvc/trustvc';
|
|
@@ -282,7 +297,7 @@ const derivationResult = await deriveW3C(signedDocument, {
|
|
|
282
297
|
|
|
283
298
|
### 4. **Verifying**
|
|
284
299
|
|
|
285
|
-
> TrustVC simplifies the verification process with a single function that supports both W3C Verifiable Credentials (VCs) and OpenAttestation Verifiable Documents (VDs). Whether you're working with W3C standards or OpenAttestation standards, TrustVC handles the verification seamlessly. For ECDSA-signed documents, which normally require derivation before verification, TrustVC automatically handles this process internally - if a document is not derived, the `verifyDocument` function will automatically derive and verify the document in a single step.
|
|
300
|
+
> TrustVC simplifies the verification process with a single function that supports both W3C Verifiable Credentials (VCs) and OpenAttestation Verifiable Documents (VDs). Whether you're working with W3C standards or OpenAttestation standards, TrustVC handles the verification seamlessly. For ECDSA-SD-2023 and BBS-2023 signed documents, which normally require derivation before verification, TrustVC automatically handles this process internally - if a document is not derived, the `verifyDocument` function will automatically derive and verify the document in a single step.
|
|
286
301
|
|
|
287
302
|
```ts
|
|
288
303
|
import { verifyDocument } from '@trustvc/trustvc';
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
'use strict';
|
|
2
|
+
|
|
3
|
+
var w3cModernSignatureIntegrityFactory = require('./w3cModernSignatureIntegrityFactory');
|
|
4
|
+
|
|
5
|
+
const bbs2023W3CSignatureIntegrity = w3cModernSignatureIntegrityFactory.createW3CSignatureIntegrityVerifier({
|
|
6
|
+
cryptosuite: "bbs-2023",
|
|
7
|
+
name: "Bbs2023W3CSignatureIntegrity",
|
|
8
|
+
derivationPaths: []
|
|
9
|
+
});
|
|
10
|
+
|
|
11
|
+
exports.bbs2023W3CSignatureIntegrity = bbs2023W3CSignatureIntegrity;
|
|
@@ -1,87 +1,11 @@
|
|
|
1
1
|
'use strict';
|
|
2
2
|
|
|
3
|
-
var
|
|
4
|
-
var w3cVc = require('@trustvc/w3c-vc');
|
|
3
|
+
var w3cModernSignatureIntegrityFactory = require('./w3cModernSignatureIntegrityFactory');
|
|
5
4
|
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
function isSignedVerifiableCredential(document) {
|
|
12
|
-
return typeof document === "object" && document !== null && "proof" in document;
|
|
13
|
-
}
|
|
14
|
-
__name(isSignedVerifiableCredential, "isSignedVerifiableCredential");
|
|
15
|
-
const ecdsaW3CSignatureIntegrity = {
|
|
16
|
-
skip: /* @__PURE__ */ __name(async () => {
|
|
17
|
-
return {
|
|
18
|
-
type: "DOCUMENT_INTEGRITY",
|
|
19
|
-
name: "EcdsaW3CSignatureIntegrity",
|
|
20
|
-
reason: {
|
|
21
|
-
code: 0,
|
|
22
|
-
codeString: "SKIPPED",
|
|
23
|
-
message: `Document either has no proof or proof type is not '${PROOF_TYPE}' or proof cryptosuite is not '${CRYPTOSUITE}'.`
|
|
24
|
-
},
|
|
25
|
-
status: "SKIPPED"
|
|
26
|
-
};
|
|
27
|
-
}, "skip"),
|
|
28
|
-
test: /* @__PURE__ */ __name((document) => {
|
|
29
|
-
const doc = document;
|
|
30
|
-
return doc.proof?.type === "DataIntegrityProof" && doc.proof?.cryptosuite === "ecdsa-sd-2023";
|
|
31
|
-
}, "test"),
|
|
32
|
-
verify: /* @__PURE__ */ __name(async (document, verifierOptions) => {
|
|
33
|
-
if (!isSignedVerifiableCredential(document)) {
|
|
34
|
-
return {
|
|
35
|
-
type: "DOCUMENT_INTEGRITY",
|
|
36
|
-
name: "EcdsaW3CSignatureIntegrity",
|
|
37
|
-
data: false,
|
|
38
|
-
reason: {
|
|
39
|
-
message: "Document is not a valid SignedVerifiableCredential"
|
|
40
|
-
},
|
|
41
|
-
status: "INVALID"
|
|
42
|
-
};
|
|
43
|
-
}
|
|
44
|
-
try {
|
|
45
|
-
let verificationResult = await verify.verifyW3CSignature(document, verifierOptions);
|
|
46
|
-
let isDerived = true;
|
|
47
|
-
if (!verificationResult.verified && verificationResult.error?.includes(DERIVE_CREDENTIAL_ERROR)) {
|
|
48
|
-
const derivedCredential = await w3cVc.deriveCredential(document, []);
|
|
49
|
-
verificationResult = await verify.verifyW3CSignature(derivedCredential.derived, verifierOptions);
|
|
50
|
-
isDerived = false;
|
|
51
|
-
}
|
|
52
|
-
if (verificationResult.verified) {
|
|
53
|
-
return {
|
|
54
|
-
type: "DOCUMENT_INTEGRITY",
|
|
55
|
-
name: "EcdsaW3CSignatureIntegrity",
|
|
56
|
-
data: true,
|
|
57
|
-
reason: {
|
|
58
|
-
message: isDerived ? "Document verified successfully" : "Document verified after derivation"
|
|
59
|
-
},
|
|
60
|
-
status: "VALID"
|
|
61
|
-
};
|
|
62
|
-
} else {
|
|
63
|
-
return {
|
|
64
|
-
type: "DOCUMENT_INTEGRITY",
|
|
65
|
-
name: "EcdsaW3CSignatureIntegrity",
|
|
66
|
-
data: false,
|
|
67
|
-
reason: {
|
|
68
|
-
message: verificationResult.error || "Verification failed"
|
|
69
|
-
},
|
|
70
|
-
status: "INVALID"
|
|
71
|
-
};
|
|
72
|
-
}
|
|
73
|
-
} catch (error) {
|
|
74
|
-
return {
|
|
75
|
-
type: "DOCUMENT_INTEGRITY",
|
|
76
|
-
name: "EcdsaW3CSignatureIntegrity",
|
|
77
|
-
data: false,
|
|
78
|
-
reason: {
|
|
79
|
-
message: error instanceof Error ? error.message : "Unknown verification error"
|
|
80
|
-
},
|
|
81
|
-
status: "INVALID"
|
|
82
|
-
};
|
|
83
|
-
}
|
|
84
|
-
}, "verify")
|
|
85
|
-
};
|
|
5
|
+
const ecdsaW3CSignatureIntegrity = w3cModernSignatureIntegrityFactory.createW3CSignatureIntegrityVerifier({
|
|
6
|
+
cryptosuite: "ecdsa-sd-2023",
|
|
7
|
+
name: "EcdsaW3CSignatureIntegrity",
|
|
8
|
+
derivationPaths: []
|
|
9
|
+
});
|
|
86
10
|
|
|
87
11
|
exports.ecdsaW3CSignatureIntegrity = ecdsaW3CSignatureIntegrity;
|
|
@@ -0,0 +1,90 @@
|
|
|
1
|
+
'use strict';
|
|
2
|
+
|
|
3
|
+
var w3cVc = require('@trustvc/w3c-vc');
|
|
4
|
+
var verify = require('../../../w3c/verify');
|
|
5
|
+
|
|
6
|
+
var __defProp = Object.defineProperty;
|
|
7
|
+
var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
|
|
8
|
+
const PROOF_TYPE = "DataIntegrityProof";
|
|
9
|
+
const DERIVE_CREDENTIAL_ERROR = "Use deriveCredential() first";
|
|
10
|
+
function isSignedVerifiableCredential(document) {
|
|
11
|
+
return typeof document === "object" && document !== null && "proof" in document;
|
|
12
|
+
}
|
|
13
|
+
__name(isSignedVerifiableCredential, "isSignedVerifiableCredential");
|
|
14
|
+
function createW3CSignatureIntegrityVerifier(config) {
|
|
15
|
+
const { cryptosuite, name, derivationPaths = [] } = config;
|
|
16
|
+
return {
|
|
17
|
+
skip: /* @__PURE__ */ __name(async () => {
|
|
18
|
+
return {
|
|
19
|
+
type: "DOCUMENT_INTEGRITY",
|
|
20
|
+
name,
|
|
21
|
+
reason: {
|
|
22
|
+
code: 0,
|
|
23
|
+
codeString: "SKIPPED",
|
|
24
|
+
message: `Document either has no proof or proof type is not '${PROOF_TYPE}' or proof cryptosuite is not '${cryptosuite}'.`
|
|
25
|
+
},
|
|
26
|
+
status: "SKIPPED"
|
|
27
|
+
};
|
|
28
|
+
}, "skip"),
|
|
29
|
+
test: /* @__PURE__ */ __name((document) => {
|
|
30
|
+
const doc = document;
|
|
31
|
+
return doc.proof?.type === PROOF_TYPE && doc.proof?.cryptosuite === cryptosuite;
|
|
32
|
+
}, "test"),
|
|
33
|
+
verify: /* @__PURE__ */ __name(async (document, verifierOptions) => {
|
|
34
|
+
if (!isSignedVerifiableCredential(document)) {
|
|
35
|
+
return {
|
|
36
|
+
type: "DOCUMENT_INTEGRITY",
|
|
37
|
+
name,
|
|
38
|
+
data: false,
|
|
39
|
+
reason: {
|
|
40
|
+
message: "Document is not a valid SignedVerifiableCredential"
|
|
41
|
+
},
|
|
42
|
+
status: "INVALID"
|
|
43
|
+
};
|
|
44
|
+
}
|
|
45
|
+
try {
|
|
46
|
+
let verificationResult = await verify.verifyW3CSignature(document, verifierOptions);
|
|
47
|
+
let isDerived = true;
|
|
48
|
+
if (!verificationResult.verified && verificationResult.error?.includes(DERIVE_CREDENTIAL_ERROR)) {
|
|
49
|
+
const derivedCredential = await w3cVc.deriveCredential(document, derivationPaths);
|
|
50
|
+
verificationResult = await verify.verifyW3CSignature(derivedCredential.derived, verifierOptions);
|
|
51
|
+
isDerived = false;
|
|
52
|
+
}
|
|
53
|
+
if (verificationResult.verified) {
|
|
54
|
+
return {
|
|
55
|
+
type: "DOCUMENT_INTEGRITY",
|
|
56
|
+
name,
|
|
57
|
+
data: true,
|
|
58
|
+
reason: {
|
|
59
|
+
message: isDerived ? "Document verified successfully" : "Document verified after derivation"
|
|
60
|
+
},
|
|
61
|
+
status: "VALID"
|
|
62
|
+
};
|
|
63
|
+
} else {
|
|
64
|
+
return {
|
|
65
|
+
type: "DOCUMENT_INTEGRITY",
|
|
66
|
+
name,
|
|
67
|
+
data: false,
|
|
68
|
+
reason: {
|
|
69
|
+
message: verificationResult.error || "Verification failed"
|
|
70
|
+
},
|
|
71
|
+
status: "INVALID"
|
|
72
|
+
};
|
|
73
|
+
}
|
|
74
|
+
} catch (error) {
|
|
75
|
+
return {
|
|
76
|
+
type: "DOCUMENT_INTEGRITY",
|
|
77
|
+
name,
|
|
78
|
+
data: false,
|
|
79
|
+
reason: {
|
|
80
|
+
message: error instanceof Error ? error.message : "Unknown verification error"
|
|
81
|
+
},
|
|
82
|
+
status: "INVALID"
|
|
83
|
+
};
|
|
84
|
+
}
|
|
85
|
+
}, "verify")
|
|
86
|
+
};
|
|
87
|
+
}
|
|
88
|
+
__name(createW3CSignatureIntegrityVerifier, "createW3CSignatureIntegrityVerifier");
|
|
89
|
+
|
|
90
|
+
exports.createW3CSignatureIntegrityVerifier = createW3CSignatureIntegrityVerifier;
|
|
@@ -7,6 +7,7 @@ var transferableRecordVerifier = require('./fragments/document-status/transferab
|
|
|
7
7
|
var w3cCredentialStatus = require('./fragments/document-status/w3cCredentialStatus');
|
|
8
8
|
var w3cIssuerIdentity = require('./fragments/issuer-identity/w3cIssuerIdentity');
|
|
9
9
|
var fragments = require('./fragments');
|
|
10
|
+
var bbs2023W3CSignatureIntegrity = require('./fragments/document-integrity/bbs2023W3CSignatureIntegrity');
|
|
10
11
|
|
|
11
12
|
const verifiers = {
|
|
12
13
|
documentIntegrity: {
|
|
@@ -35,6 +36,7 @@ const openAttestationVerifiers = [
|
|
|
35
36
|
const w3cVerifiers = [
|
|
36
37
|
w3cSignatureIntegrity.w3cSignatureIntegrity,
|
|
37
38
|
ecdsaW3CSignatureIntegrity.ecdsaW3CSignatureIntegrity,
|
|
39
|
+
bbs2023W3CSignatureIntegrity.bbs2023W3CSignatureIntegrity,
|
|
38
40
|
w3cCredentialStatus.w3cCredentialStatus,
|
|
39
41
|
transferableRecordVerifier.credentialStatusTransferableRecordVerifier,
|
|
40
42
|
fragments.w3cEmptyCredentialStatus,
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
import { createW3CSignatureIntegrityVerifier } from './w3cModernSignatureIntegrityFactory';
|
|
2
|
+
|
|
3
|
+
const bbs2023W3CSignatureIntegrity = createW3CSignatureIntegrityVerifier({
|
|
4
|
+
cryptosuite: "bbs-2023",
|
|
5
|
+
name: "Bbs2023W3CSignatureIntegrity",
|
|
6
|
+
derivationPaths: []
|
|
7
|
+
});
|
|
8
|
+
|
|
9
|
+
export { bbs2023W3CSignatureIntegrity };
|
|
@@ -1,85 +1,9 @@
|
|
|
1
|
-
import {
|
|
2
|
-
import { deriveCredential } from '@trustvc/w3c-vc';
|
|
1
|
+
import { createW3CSignatureIntegrityVerifier } from './w3cModernSignatureIntegrityFactory';
|
|
3
2
|
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
function isSignedVerifiableCredential(document) {
|
|
10
|
-
return typeof document === "object" && document !== null && "proof" in document;
|
|
11
|
-
}
|
|
12
|
-
__name(isSignedVerifiableCredential, "isSignedVerifiableCredential");
|
|
13
|
-
const ecdsaW3CSignatureIntegrity = {
|
|
14
|
-
skip: /* @__PURE__ */ __name(async () => {
|
|
15
|
-
return {
|
|
16
|
-
type: "DOCUMENT_INTEGRITY",
|
|
17
|
-
name: "EcdsaW3CSignatureIntegrity",
|
|
18
|
-
reason: {
|
|
19
|
-
code: 0,
|
|
20
|
-
codeString: "SKIPPED",
|
|
21
|
-
message: `Document either has no proof or proof type is not '${PROOF_TYPE}' or proof cryptosuite is not '${CRYPTOSUITE}'.`
|
|
22
|
-
},
|
|
23
|
-
status: "SKIPPED"
|
|
24
|
-
};
|
|
25
|
-
}, "skip"),
|
|
26
|
-
test: /* @__PURE__ */ __name((document) => {
|
|
27
|
-
const doc = document;
|
|
28
|
-
return doc.proof?.type === "DataIntegrityProof" && doc.proof?.cryptosuite === "ecdsa-sd-2023";
|
|
29
|
-
}, "test"),
|
|
30
|
-
verify: /* @__PURE__ */ __name(async (document, verifierOptions) => {
|
|
31
|
-
if (!isSignedVerifiableCredential(document)) {
|
|
32
|
-
return {
|
|
33
|
-
type: "DOCUMENT_INTEGRITY",
|
|
34
|
-
name: "EcdsaW3CSignatureIntegrity",
|
|
35
|
-
data: false,
|
|
36
|
-
reason: {
|
|
37
|
-
message: "Document is not a valid SignedVerifiableCredential"
|
|
38
|
-
},
|
|
39
|
-
status: "INVALID"
|
|
40
|
-
};
|
|
41
|
-
}
|
|
42
|
-
try {
|
|
43
|
-
let verificationResult = await verifyW3CSignature(document, verifierOptions);
|
|
44
|
-
let isDerived = true;
|
|
45
|
-
if (!verificationResult.verified && verificationResult.error?.includes(DERIVE_CREDENTIAL_ERROR)) {
|
|
46
|
-
const derivedCredential = await deriveCredential(document, []);
|
|
47
|
-
verificationResult = await verifyW3CSignature(derivedCredential.derived, verifierOptions);
|
|
48
|
-
isDerived = false;
|
|
49
|
-
}
|
|
50
|
-
if (verificationResult.verified) {
|
|
51
|
-
return {
|
|
52
|
-
type: "DOCUMENT_INTEGRITY",
|
|
53
|
-
name: "EcdsaW3CSignatureIntegrity",
|
|
54
|
-
data: true,
|
|
55
|
-
reason: {
|
|
56
|
-
message: isDerived ? "Document verified successfully" : "Document verified after derivation"
|
|
57
|
-
},
|
|
58
|
-
status: "VALID"
|
|
59
|
-
};
|
|
60
|
-
} else {
|
|
61
|
-
return {
|
|
62
|
-
type: "DOCUMENT_INTEGRITY",
|
|
63
|
-
name: "EcdsaW3CSignatureIntegrity",
|
|
64
|
-
data: false,
|
|
65
|
-
reason: {
|
|
66
|
-
message: verificationResult.error || "Verification failed"
|
|
67
|
-
},
|
|
68
|
-
status: "INVALID"
|
|
69
|
-
};
|
|
70
|
-
}
|
|
71
|
-
} catch (error) {
|
|
72
|
-
return {
|
|
73
|
-
type: "DOCUMENT_INTEGRITY",
|
|
74
|
-
name: "EcdsaW3CSignatureIntegrity",
|
|
75
|
-
data: false,
|
|
76
|
-
reason: {
|
|
77
|
-
message: error instanceof Error ? error.message : "Unknown verification error"
|
|
78
|
-
},
|
|
79
|
-
status: "INVALID"
|
|
80
|
-
};
|
|
81
|
-
}
|
|
82
|
-
}, "verify")
|
|
83
|
-
};
|
|
3
|
+
const ecdsaW3CSignatureIntegrity = createW3CSignatureIntegrityVerifier({
|
|
4
|
+
cryptosuite: "ecdsa-sd-2023",
|
|
5
|
+
name: "EcdsaW3CSignatureIntegrity",
|
|
6
|
+
derivationPaths: []
|
|
7
|
+
});
|
|
84
8
|
|
|
85
9
|
export { ecdsaW3CSignatureIntegrity };
|
|
@@ -0,0 +1,88 @@
|
|
|
1
|
+
import { deriveCredential } from '@trustvc/w3c-vc';
|
|
2
|
+
import { verifyW3CSignature } from '../../../w3c/verify';
|
|
3
|
+
|
|
4
|
+
var __defProp = Object.defineProperty;
|
|
5
|
+
var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
|
|
6
|
+
const PROOF_TYPE = "DataIntegrityProof";
|
|
7
|
+
const DERIVE_CREDENTIAL_ERROR = "Use deriveCredential() first";
|
|
8
|
+
function isSignedVerifiableCredential(document) {
|
|
9
|
+
return typeof document === "object" && document !== null && "proof" in document;
|
|
10
|
+
}
|
|
11
|
+
__name(isSignedVerifiableCredential, "isSignedVerifiableCredential");
|
|
12
|
+
function createW3CSignatureIntegrityVerifier(config) {
|
|
13
|
+
const { cryptosuite, name, derivationPaths = [] } = config;
|
|
14
|
+
return {
|
|
15
|
+
skip: /* @__PURE__ */ __name(async () => {
|
|
16
|
+
return {
|
|
17
|
+
type: "DOCUMENT_INTEGRITY",
|
|
18
|
+
name,
|
|
19
|
+
reason: {
|
|
20
|
+
code: 0,
|
|
21
|
+
codeString: "SKIPPED",
|
|
22
|
+
message: `Document either has no proof or proof type is not '${PROOF_TYPE}' or proof cryptosuite is not '${cryptosuite}'.`
|
|
23
|
+
},
|
|
24
|
+
status: "SKIPPED"
|
|
25
|
+
};
|
|
26
|
+
}, "skip"),
|
|
27
|
+
test: /* @__PURE__ */ __name((document) => {
|
|
28
|
+
const doc = document;
|
|
29
|
+
return doc.proof?.type === PROOF_TYPE && doc.proof?.cryptosuite === cryptosuite;
|
|
30
|
+
}, "test"),
|
|
31
|
+
verify: /* @__PURE__ */ __name(async (document, verifierOptions) => {
|
|
32
|
+
if (!isSignedVerifiableCredential(document)) {
|
|
33
|
+
return {
|
|
34
|
+
type: "DOCUMENT_INTEGRITY",
|
|
35
|
+
name,
|
|
36
|
+
data: false,
|
|
37
|
+
reason: {
|
|
38
|
+
message: "Document is not a valid SignedVerifiableCredential"
|
|
39
|
+
},
|
|
40
|
+
status: "INVALID"
|
|
41
|
+
};
|
|
42
|
+
}
|
|
43
|
+
try {
|
|
44
|
+
let verificationResult = await verifyW3CSignature(document, verifierOptions);
|
|
45
|
+
let isDerived = true;
|
|
46
|
+
if (!verificationResult.verified && verificationResult.error?.includes(DERIVE_CREDENTIAL_ERROR)) {
|
|
47
|
+
const derivedCredential = await deriveCredential(document, derivationPaths);
|
|
48
|
+
verificationResult = await verifyW3CSignature(derivedCredential.derived, verifierOptions);
|
|
49
|
+
isDerived = false;
|
|
50
|
+
}
|
|
51
|
+
if (verificationResult.verified) {
|
|
52
|
+
return {
|
|
53
|
+
type: "DOCUMENT_INTEGRITY",
|
|
54
|
+
name,
|
|
55
|
+
data: true,
|
|
56
|
+
reason: {
|
|
57
|
+
message: isDerived ? "Document verified successfully" : "Document verified after derivation"
|
|
58
|
+
},
|
|
59
|
+
status: "VALID"
|
|
60
|
+
};
|
|
61
|
+
} else {
|
|
62
|
+
return {
|
|
63
|
+
type: "DOCUMENT_INTEGRITY",
|
|
64
|
+
name,
|
|
65
|
+
data: false,
|
|
66
|
+
reason: {
|
|
67
|
+
message: verificationResult.error || "Verification failed"
|
|
68
|
+
},
|
|
69
|
+
status: "INVALID"
|
|
70
|
+
};
|
|
71
|
+
}
|
|
72
|
+
} catch (error) {
|
|
73
|
+
return {
|
|
74
|
+
type: "DOCUMENT_INTEGRITY",
|
|
75
|
+
name,
|
|
76
|
+
data: false,
|
|
77
|
+
reason: {
|
|
78
|
+
message: error instanceof Error ? error.message : "Unknown verification error"
|
|
79
|
+
},
|
|
80
|
+
status: "INVALID"
|
|
81
|
+
};
|
|
82
|
+
}
|
|
83
|
+
}, "verify")
|
|
84
|
+
};
|
|
85
|
+
}
|
|
86
|
+
__name(createW3CSignatureIntegrityVerifier, "createW3CSignatureIntegrityVerifier");
|
|
87
|
+
|
|
88
|
+
export { createW3CSignatureIntegrityVerifier };
|
|
@@ -6,6 +6,7 @@ import { credentialStatusTransferableRecordVerifier } from './fragments/document
|
|
|
6
6
|
import { w3cCredentialStatus } from './fragments/document-status/w3cCredentialStatus';
|
|
7
7
|
import { w3cIssuerIdentity } from './fragments/issuer-identity/w3cIssuerIdentity';
|
|
8
8
|
import { w3cEmptyCredentialStatus } from './fragments';
|
|
9
|
+
import { bbs2023W3CSignatureIntegrity } from './fragments/document-integrity/bbs2023W3CSignatureIntegrity';
|
|
9
10
|
|
|
10
11
|
const verifiers = {
|
|
11
12
|
documentIntegrity: {
|
|
@@ -34,6 +35,7 @@ const openAttestationVerifiers = [
|
|
|
34
35
|
const w3cVerifiers = [
|
|
35
36
|
w3cSignatureIntegrity,
|
|
36
37
|
ecdsaW3CSignatureIntegrity,
|
|
38
|
+
bbs2023W3CSignatureIntegrity,
|
|
37
39
|
w3cCredentialStatus,
|
|
38
40
|
credentialStatusTransferableRecordVerifier,
|
|
39
41
|
w3cEmptyCredentialStatus,
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { PrivateKeyPair } from '@trustvc/w3c-issuer';
|
|
2
|
-
import { VerifiableCredential, CryptoSuiteName, SignedVerifiableCredential
|
|
2
|
+
import { VerifiableCredential, CryptoSuiteName, SignedVerifiableCredential } from '@trustvc/w3c-vc';
|
|
3
3
|
|
|
4
4
|
/**
|
|
5
5
|
* Configuration for a W3C Verifiable Document using a Bitstring Status List.
|
|
@@ -79,7 +79,7 @@ declare class DocumentBuilder {
|
|
|
79
79
|
renderMethod(method: RenderMethod): this;
|
|
80
80
|
qrCode(method: qrCode): this;
|
|
81
81
|
sign(privateKey: PrivateKeyPair, cryptoSuite?: CryptoSuiteName, options?: SignOptions): Promise<SignedVerifiableCredential>;
|
|
82
|
-
derive(revealedAttributes:
|
|
82
|
+
derive(revealedAttributes: string[]): Promise<SignedVerifiableCredential>;
|
|
83
83
|
verify(): Promise<boolean>;
|
|
84
84
|
toString(): string;
|
|
85
85
|
private isTransferableRecordsConfig;
|
package/dist/types/verify/fragments/document-integrity/w3cModernSignatureIntegrityFactory.d.ts
ADDED
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
import { Verifier, VerificationFragment } from '@tradetrust-tt/tt-verify';
|
|
2
|
+
|
|
3
|
+
interface CryptosuiteConfig {
|
|
4
|
+
/** The cryptosuite identifier (e.g., 'bbs-2023', 'ecdsa-sd-2023') */
|
|
5
|
+
cryptosuite: string;
|
|
6
|
+
/** Display name for the verifier (e.g., 'Bbs2023W3CSignatureIntegrity') */
|
|
7
|
+
name: string;
|
|
8
|
+
/** Optional array of JSON paths to derive from the credential */
|
|
9
|
+
derivationPaths?: string[];
|
|
10
|
+
}
|
|
11
|
+
declare function createW3CSignatureIntegrityVerifier(config: CryptosuiteConfig): Verifier<VerificationFragment>;
|
|
12
|
+
|
|
13
|
+
export { type CryptosuiteConfig, createW3CSignatureIntegrityVerifier };
|
|
@@ -1,11 +1,11 @@
|
|
|
1
|
-
import { SignedVerifiableCredential,
|
|
1
|
+
import { SignedVerifiableCredential, DerivedResult } from '@trustvc/w3c-vc';
|
|
2
2
|
|
|
3
3
|
/**
|
|
4
4
|
* Derives a credential with selective disclosure based on revealed attributes.
|
|
5
5
|
* @param {object} credential - The verifiable credential to be selectively disclosed.
|
|
6
|
-
* @param {
|
|
6
|
+
* @param {string[]} revealedAttributes - Array of selective pointers.
|
|
7
7
|
* @returns {Promise<DerivedResult>} A DerivedResult containing the derived proof or an error message.
|
|
8
8
|
*/
|
|
9
|
-
declare const deriveW3C: (credential: SignedVerifiableCredential, revealedAttributes:
|
|
9
|
+
declare const deriveW3C: (credential: SignedVerifiableCredential, revealedAttributes: string[]) => Promise<DerivedResult>;
|
|
10
10
|
|
|
11
11
|
export { deriveW3C };
|
package/dist/types/w3c/sign.d.ts
CHANGED
|
@@ -6,8 +6,8 @@ import { PrivateKeyPair } from '@trustvc/w3c-issuer';
|
|
|
6
6
|
* @param {RawVerifiableCredential} credential - The verifiable credential object that needs to be signed.
|
|
7
7
|
* @param {PrivateKeyPair} keyPair - The private and public key pair used for signing the credential.
|
|
8
8
|
* @param {CryptoSuiteName} [cryptoSuite='ecdsa-sd-2023'] - The cryptographic suite to be used for signing (default is 'ecdsa-sd-2023').
|
|
9
|
-
* @param {object} [options] - Optional parameters including mandatoryPointers for ECDSA-SD-2023.
|
|
10
|
-
* @param {string[]} [options.mandatoryPointers] - Optional mandatory pointers for ECDSA-SD-2023.
|
|
9
|
+
* @param {object} [options] - Optional parameters including mandatoryPointers for both ECDSA-SD-2023 / BBS-2023.
|
|
10
|
+
* @param {string[]} [options.mandatoryPointers] - Optional mandatory pointers for both ECDSA-SD-2023 / BBS-2023.
|
|
11
11
|
* @returns {Promise<SigningResult>} A promise that resolves to the result of the signing operation, which includes the signed credential.
|
|
12
12
|
*/
|
|
13
13
|
declare const signW3C: (credential: RawVerifiableCredential, keyPair: PrivateKeyPair, cryptoSuite?: CryptoSuiteName, options?: {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@trustvc/trustvc",
|
|
3
|
-
"version": "2.0
|
|
3
|
+
"version": "2.2.0",
|
|
4
4
|
"description": "TrustVC library",
|
|
5
5
|
"main": "dist/cjs/index.js",
|
|
6
6
|
"module": "dist/esm/index.js",
|
|
@@ -122,11 +122,11 @@
|
|
|
122
122
|
"@tradetrust-tt/tradetrust": "^6.10.2",
|
|
123
123
|
"@tradetrust-tt/tradetrust-utils": "^2.4.2",
|
|
124
124
|
"@tradetrust-tt/tt-verify": "^9.6.0",
|
|
125
|
-
"@trustvc/w3c": "^1.3.0-alpha.
|
|
126
|
-
"@trustvc/w3c-context": "^1.3.0-alpha.
|
|
127
|
-
"@trustvc/w3c-credential-status": "^1.3.0-alpha.
|
|
128
|
-
"@trustvc/w3c-issuer": "^1.3.0-alpha.
|
|
129
|
-
"@trustvc/w3c-vc": "^1.3.0-alpha.
|
|
125
|
+
"@trustvc/w3c": "^1.3.0-alpha.14",
|
|
126
|
+
"@trustvc/w3c-context": "^1.3.0-alpha.12",
|
|
127
|
+
"@trustvc/w3c-credential-status": "^1.3.0-alpha.12",
|
|
128
|
+
"@trustvc/w3c-issuer": "^1.3.0-alpha.10",
|
|
129
|
+
"@trustvc/w3c-vc": "^1.3.0-alpha.14",
|
|
130
130
|
"ethers": "^5.8.0",
|
|
131
131
|
"ethersV6": "npm:ethers@^6.14.4",
|
|
132
132
|
"js-sha3": "^0.9.3",
|