@twin.org/identity-connector-entity-storage 0.0.1-next.3 → 0.0.1-next.31

package/dist/cjs/index.cjs

@@ -3,6 +3,7 @@
 var entity = require('@twin.org/entity');
 var core = require('@twin.org/core');
 var crypto = require('@twin.org/crypto');
+var dataJsonLd = require('@twin.org/data-json-ld');
 var entityStorageModels = require('@twin.org/entity-storage-models');
 var identityModels = require('@twin.org/identity-models');
 var standardsW3cDid = require('@twin.org/standards-w3c-did');
@@ -118,14 +119,34 @@ class EntityStorageIdentityConnector {
     _vaultConnector;
     /**
      * Create a new instance of EntityStorageIdentityConnector.
-     * @param options The dependencies for the identity connector.
-     * @param options.didDocumentEntityStorageType The entity storage for the did documents, defaults to "identity-document".
-     * @param options.vaultConnectorType The vault for the private keys, defaults to "vault".
+     * @param options The options for the identity connector.
      */
     constructor(options) {
         this._didDocumentEntityStorage = entityStorageModels.EntityStorageConnectorFactory.get(options?.didDocumentEntityStorageType ?? "identity-document");
         this._vaultConnector = vaultModels.VaultConnectorFactory.get(options?.vaultConnectorType ?? "vault");
     }
+    /**
+     * Build the key name to access the specified key in the vault.
+     * @param identity The identity of the user to access the vault keys.
+     * @returns The vault key.
+     * @internal
+     */
+    static buildVaultKey(identity, key) {
+        return `${identity}/${key}`;
+    }
+    /**
+     * Verify the document in storage.
+     * @param didDocument The did document that was stored.
+     * @internal
+     */
+    static async verifyDocument(didDocument, vaultConnector) {
+        const stringifiedDocument = core.JsonHelper.canonicalize(didDocument.document);
+        const docBytes = core.Converter.utf8ToBytes(stringifiedDocument);
+        const verified = await vaultConnector.verify(EntityStorageIdentityConnector.buildVaultKey(didDocument.id, "did"), docBytes, core.Converter.base64ToBytes(didDocument.signature));
+        if (!verified) {
+            throw new core.GeneralError("EntityStorageIdentityResolverConnector", "signatureVerificationFailed");
+        }
+    }
     /**
      * Create a new document.
      * @param controller The controller of the identity who can make changes.
@@ -135,10 +156,11 @@ class EntityStorageIdentityConnector {
         core.Guards.stringValue(this.CLASS_NAME, "controller", controller);
         try {
             const did = `did:${EntityStorageIdentityConnector.NAMESPACE}:${core.Converter.bytesToHex(core.RandomHelper.generate(32), true)}`;
-            await this._vaultConnector.createKey(this.buildVaultKey(did, did), vaultModels.VaultKeyType.Ed25519);
+            await this._vaultConnector.createKey(EntityStorageIdentityConnector.buildVaultKey(did, "did"), vaultModels.VaultKeyType.Ed25519);
             const bitString = new core.BitString(EntityStorageIdentityConnector._REVOCATION_BITS_SIZE);
             const compressed = await core.Compression.compress(bitString.getBits(), core.CompressionType.Gzip);
             const didDocument = {
+                "@context": standardsW3cDid.DidContexts.Context,
                 id: did,
                 service: [
                     {
@@ -155,26 +177,6 @@ class EntityStorageIdentityConnector {
             throw new core.GeneralError(this.CLASS_NAME, "createDocumentFailed", undefined, error);
         }
     }
-    /**
-     * Resolve a document from its id.
-     * @param documentId The id of the document to resolve.
-     * @returns The resolved document.
-     * @throws NotFoundError if the id can not be resolved.
-     */
-    async resolveDocument(documentId) {
-        core.Guards.stringValue(this.CLASS_NAME, "documentId", documentId);
-        try {
-            const didIdentityDocument = await this._didDocumentEntityStorage.get(documentId);
-            if (core.Is.undefined(didIdentityDocument)) {
-                throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", documentId);
-            }
-            await this.verifyDocument(didIdentityDocument);
-            return didIdentityDocument.document;
-        }
-        catch (error) {
-            throw new core.GeneralError(this.CLASS_NAME, "resolveDocumentFailed", undefined, error);
-        }
-    }
     /**
      * Add a verification method to the document in JSON Web key Format.
      * @param controller The controller of the identity who can make changes.
@@ -194,10 +196,10 @@ class EntityStorageIdentityConnector {
             if (core.Is.undefined(didIdentityDocument)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", documentId);
             }
-            await this.verifyDocument(didIdentityDocument);
+            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
             const didDocument = didIdentityDocument.document;
-            const tempKeyId = `temp-${core.Converter.bytesToBase64Url(core.RandomHelper.generate(32))}`;
-            const verificationPublicKey = await this._vaultConnector.createKey(this.buildVaultKey(didDocument.id, tempKeyId), vaultModels.VaultKeyType.Ed25519);
+            const tempKeyId = `temp-vm-${core.Converter.bytesToBase64Url(core.RandomHelper.generate(16))}`;
+            const verificationPublicKey = await this._vaultConnector.createKey(EntityStorageIdentityConnector.buildVaultKey(didDocument.id, tempKeyId), vaultModels.VaultKeyType.Ed25519);
             const jwkParams = {
                 alg: "EdDSA",
                 kty: "OKP",
@@ -206,7 +208,7 @@ class EntityStorageIdentityConnector {
             };
             const kid = core.Converter.bytesToBase64Url(crypto.Sha256.sum256(core.Converter.utf8ToBytes(JSON.stringify(jwkParams))));
             const methodId = `${documentId}#${verificationMethodId ?? kid}`;
-            await this._vaultConnector.renameKey(this.buildVaultKey(didDocument.id, tempKeyId), this.buildVaultKey(didDocument.id, methodId));
+            await this._vaultConnector.renameKey(EntityStorageIdentityConnector.buildVaultKey(didDocument.id, tempKeyId), EntityStorageIdentityConnector.buildVaultKey(didDocument.id, verificationMethodId ?? kid));
             const methods = this.getAllMethods(didDocument);
             const existingMethodIndex = methods.findIndex(m => {
                 if (core.Is.string(m.method)) {
@@ -214,7 +216,7 @@ class EntityStorageIdentityConnector {
                 }
                 return m.method.id === methodId;
             });
-            if (existingMethodIndex >= 0) {
+            if (existingMethodIndex !== -1) {
                 const methodArray = didDocument[methods[existingMethodIndex].arrayKey];
                 if (core.Is.array(methodArray)) {
                     methodArray.splice(existingMethodIndex, 1);
@@ -250,15 +252,15 @@ class EntityStorageIdentityConnector {
         core.Guards.stringValue(this.CLASS_NAME, "controller", controller);
         core.Guards.stringValue(this.CLASS_NAME, "verificationMethodId", verificationMethodId);
         try {
-            const idParts = identityModels.DocumentHelper.parse(verificationMethodId);
-            if (core.Is.empty(idParts.hash)) {
+            const idParts = identityModels.DocumentHelper.parseId(verificationMethodId);
+            if (core.Is.empty(idParts.fragment)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "missingDid", verificationMethodId);
             }
             const didIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
             if (core.Is.undefined(didIdentityDocument)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", idParts.id);
             }
-            await this.verifyDocument(didIdentityDocument);
+            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
             const didDocument = didIdentityDocument.document;
             const methods = this.getAllMethods(didDocument);
             const existingMethodIndex = methods.findIndex(m => {
@@ -267,7 +269,7 @@ class EntityStorageIdentityConnector {
                 }
                 return m.method.id === verificationMethodId;
             });
-            if (existingMethodIndex >= 0) {
+            if (existingMethodIndex !== -1) {
                 const methodArray = didDocument[methods[existingMethodIndex].arrayKey];
                 if (core.Is.array(methodArray)) {
                     methodArray.splice(existingMethodIndex, 1);
@@ -299,19 +301,29 @@ class EntityStorageIdentityConnector {
         core.Guards.stringValue(this.CLASS_NAME, "controller", controller);
         core.Guards.stringValue(this.CLASS_NAME, "documentId", documentId);
         core.Guards.stringValue(this.CLASS_NAME, "serviceId", serviceId);
-        core.Guards.stringValue(this.CLASS_NAME, "serviceType", serviceType);
-        core.Guards.stringValue(this.CLASS_NAME, "serviceEndpoint", serviceEndpoint);
+        if (core.Is.array(serviceType)) {
+            core.Guards.arrayValue(this.CLASS_NAME, "serviceType", serviceType);
+        }
+        else {
+            core.Guards.stringValue(this.CLASS_NAME, "serviceType", serviceType);
+        }
+        if (core.Is.array(serviceEndpoint)) {
+            core.Guards.arrayValue(this.CLASS_NAME, "serviceEndpoint", serviceEndpoint);
+        }
+        else {
+            core.Guards.stringValue(this.CLASS_NAME, "serviceEndpoint", serviceEndpoint);
+        }
         try {
             const didIdentityDocument = await this._didDocumentEntityStorage.get(documentId);
             if (core.Is.undefined(didIdentityDocument)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", documentId);
             }
-            await this.verifyDocument(didIdentityDocument);
+            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
             const didDocument = didIdentityDocument.document;
             const fullServiceId = serviceId.includes("#") ? serviceId : `${documentId}#${serviceId}`;
             if (core.Is.array(didDocument.service)) {
                 const existingServiceIndex = didDocument.service.findIndex(s => s.id === fullServiceId);
-                if (existingServiceIndex >= 0) {
+                if (existingServiceIndex !== -1) {
                     didDocument.service?.splice(existingServiceIndex, 1);
                 }
             }
@@ -340,19 +352,19 @@ class EntityStorageIdentityConnector {
         core.Guards.stringValue(this.CLASS_NAME, "controller", controller);
         core.Guards.stringValue(this.CLASS_NAME, "serviceId", serviceId);
         try {
-            const idParts = identityModels.DocumentHelper.parse(serviceId);
-            if (core.Is.empty(idParts.hash)) {
+            const idParts = identityModels.DocumentHelper.parseId(serviceId);
+            if (core.Is.empty(idParts.fragment)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "missingDid", serviceId);
             }
             const didIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
             if (core.Is.undefined(didIdentityDocument)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", idParts.id);
             }
-            await this.verifyDocument(didIdentityDocument);
+            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
             const didDocument = didIdentityDocument.document;
             if (core.Is.array(didDocument.service)) {
                 const existingServiceIndex = didDocument.service.findIndex(s => s.id === serviceId);
-                if (existingServiceIndex >= 0) {
+                if (existingServiceIndex !== -1) {
                     didDocument.service?.splice(existingServiceIndex, 1);
                     if (didDocument.service?.length === 0) {
                         delete didDocument.service;
@@ -372,51 +384,29 @@ class EntityStorageIdentityConnector {
      * Create a verifiable credential for a verification method.
      * @param controller The controller of the identity who can make changes.
      * @param verificationMethodId The verification method id to use.
-     * @param credentialId The id of the credential.
-     * @param types The type for the data stored in the verifiable credential.
-     * @param subject The subject data to store for the credential.
-     * @param contexts Additional contexts to include in the credential.
+     * @param id The id of the credential.
+     * @param subject The credential subject to store in the verifiable credential.
      * @param revocationIndex The bitmap revocation index of the credential, if undefined will not have revocation status.
      * @returns The created verifiable credential and its token.
      * @throws NotFoundError if the id can not be resolved.
      */
-    async createVerifiableCredential(controller, verificationMethodId, credentialId, types, subject, contexts, revocationIndex) {
+    async createVerifiableCredential(controller, verificationMethodId, id, subject, revocationIndex) {
         core.Guards.stringValue(this.CLASS_NAME, "controller", controller);
         core.Guards.stringValue(this.CLASS_NAME, "verificationMethodId", verificationMethodId);
-        if (!core.Is.undefined(credentialId)) {
-            core.Guards.stringValue(this.CLASS_NAME, "credentialId", credentialId);
-        }
-        if (core.Is.array(types)) {
-            core.Guards.array(this.CLASS_NAME, "types", types);
-        }
-        else if (!core.Is.undefined(types)) {
-            core.Guards.stringValue(this.CLASS_NAME, "types", types);
-        }
-        if (core.Is.array(subject)) {
-            core.Guards.arrayValue(this.CLASS_NAME, "subject", subject);
-        }
-        else {
-            core.Guards.object(this.CLASS_NAME, "subject", subject);
-        }
-        if (core.Is.array(contexts)) {
-            core.Guards.array(this.CLASS_NAME, "contexts", contexts);
-        }
-        else if (!core.Is.undefined(contexts)) {
-            core.Guards.stringValue(this.CLASS_NAME, "contexts", contexts);
-        }
+        core.Guards.object(this.CLASS_NAME, "subject", subject);
         if (!core.Is.undefined(revocationIndex)) {
             core.Guards.number(this.CLASS_NAME, "revocationIndex", revocationIndex);
         }
         try {
-            const idParts = identityModels.DocumentHelper.parse(verificationMethodId);
-            if (core.Is.empty(idParts.hash)) {
+            const idParts = identityModels.DocumentHelper.parseId(verificationMethodId);
+            if (core.Is.empty(idParts.fragment)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "missingDid", verificationMethodId);
             }
             const issuerIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
             if (core.Is.undefined(issuerIdentityDocument)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", idParts.id);
             }
-            await this.verifyDocument(issuerIdentityDocument);
+            await EntityStorageIdentityConnector.verifyDocument(issuerIdentityDocument, this._vaultConnector);
             const issuerDidDocument = issuerIdentityDocument.document;
             const methods = this.getAllMethods(issuerDidDocument);
             const methodAndArray = methods.find(m => {
@@ -426,32 +416,30 @@ class EntityStorageIdentityConnector {
                 return m.method.id === verificationMethodId;
             });
             if (!methodAndArray) {
-                throw new core.GeneralError(this.CLASS_NAME, "methodMissing");
+                throw new core.GeneralError(this.CLASS_NAME, "methodMissing", { method: verificationMethodId });
             }
             const verificationDidMethod = methodAndArray.method;
             if (!core.Is.stringValue(verificationDidMethod.publicKeyJwk?.x)) {
-                throw new core.GeneralError(this.CLASS_NAME, "publicKeyJwkMissing");
+                throw new core.GeneralError(this.CLASS_NAME, "publicKeyJwkMissing", {
+                    method: verificationMethodId
+                });
             }
             const revocationService = issuerDidDocument.service?.find(s => s.id.endsWith("#revocation"));
-            const finalTypes = ["VerifiableCredential"];
-            if (core.Is.array(types)) {
-                finalTypes.push(...types);
-            }
-            else if (core.Is.stringValue(types)) {
-                finalTypes.push(types);
-            }
-            const finalContexts = ["https://www.w3.org/2018/credentials/v1"];
-            if (core.Is.array(contexts)) {
-                finalContexts.push(...contexts);
-            }
-            else if (core.Is.stringValue(contexts)) {
-                finalContexts.push(contexts);
+            const subjectClone = core.ObjectHelper.clone(subject);
+            const finalTypes = [standardsW3cDid.DidTypes.VerifiableCredential];
+            const credContext = core.ObjectHelper.extractProperty(subjectClone, [
+                "@context"
+            ]);
+            const credId = core.ObjectHelper.extractProperty(subjectClone, ["@id", "id"], false);
+            const credType = core.ObjectHelper.extractProperty(subjectClone, ["@type", "type"]);
+            if (core.Is.stringValue(credType)) {
+                finalTypes.push(credType);
             }
             const verifiableCredential = {
-                "@context": finalContexts,
-                id: credentialId,
+                "@context": dataJsonLd.JsonLdProcessor.combineContexts(standardsW3cDid.DidContexts.ContextVCv2, credContext),
+                id,
                 type: finalTypes,
-                credentialSubject: subject,
+                credentialSubject: subjectClone,
                 issuer: issuerDidDocument.id,
                 issuanceDate: new Date().toISOString(),
                 credentialStatus: revocationService && !core.Is.undefined(revocationIndex)
@@ -488,15 +476,10 @@ class EntityStorageIdentityConnector {
                 iss: idParts.id,
                 nbf: Math.floor(Date.now() / 1000),
                 jti: verifiableCredential.id,
-                sub: core.Is.array(subject)
-                    ? core.ObjectHelper.propertyGet(subject[0], "id")
-                    : core.ObjectHelper.propertyGet(subject, "id"),
+                sub: credId,
                 vc: jwtVc
             };
-            const signature = await web.Jwt.encodeWithSigner(jwtHeader, jwtPayload, async (alg, key, payload) => {
-                const sig = await this._vaultConnector.sign(this.buildVaultKey(idParts.id, verificationMethodId), payload);
-                return sig;
-            });
+            const signature = await web.Jwt.encodeWithSigner(jwtHeader, jwtPayload, async (header, payload) => vaultModels.VaultConnectorHelper.jwtSigner(this._vaultConnector, EntityStorageIdentityConnector.buildVaultKey(idParts.id, idParts.fragment ?? ""), header, payload));
             return {
                 verifiableCredential,
                 jwt: signature
@@ -529,7 +512,7 @@ class EntityStorageIdentityConnector {
             if (core.Is.undefined(issuerIdentityDocument)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", issuerDocumentId);
             }
-            await this.verifyDocument(issuerIdentityDocument);
+            await EntityStorageIdentityConnector.verifyDocument(issuerIdentityDocument, this._vaultConnector);
             const issuerDidDocument = issuerIdentityDocument.document;
             const methods = this.getAllMethods(issuerDidDocument);
             const methodAndArray = methods.find(m => {
@@ -539,16 +522,13 @@ class EntityStorageIdentityConnector {
                 return m.method.id === jwtHeader.kid;
             });
             if (!methodAndArray) {
-                throw new core.GeneralError(this.CLASS_NAME, "methodMissing");
+                throw new core.GeneralError(this.CLASS_NAME, "methodMissing", { method: jwtHeader.kid });
             }
             const didMethod = methodAndArray.method;
             if (!core.Is.stringValue(didMethod.publicKeyJwk?.x)) {
-                throw new core.GeneralError(this.CLASS_NAME, "publicKeyJwkMissing");
-            }
-            const verified = web.Jwt.verifySignature(jwtHeader, jwtPayload, jwtSignature, core.Converter.base64UrlToBytes(didMethod.publicKeyJwk.x));
-            if (!verified) {
-                throw new core.GeneralError(this.CLASS_NAME, "jwkSignatureFailed");
+                throw new core.GeneralError(this.CLASS_NAME, "publicKeyJwkMissing", { method: jwtHeader.kid });
             }
+            await web.Jwt.verifySignature(credentialJwt, await web.Jwk.toCryptoKey(didMethod.publicKeyJwk));
             const verifiableCredential = jwtPayload.vc;
             if (core.Is.object(verifiableCredential)) {
                 if (core.Is.string(jwtPayload.jti)) {
@@ -568,7 +548,19 @@ class EntityStorageIdentityConnector {
                     core.ObjectHelper.propertySet(verifiableCredential.credentialSubject, "id", jwtPayload.sub);
                 }
             }
-            const revoked = await this.checkRevocation(issuerDidDocument, verifiableCredential.credentialStatus?.revocationBitmapIndex);
+            const credentialStatus = verifiableCredential.credentialStatus;
+            let revoked = false;
+            if (core.Is.object(credentialStatus)) {
+                revoked = await this.checkRevocation(issuerDidDocument, credentialStatus.revocationBitmapIndex);
+            }
+            else if (core.Is.arrayValue(credentialStatus)) {
+                for (let i = 0; i < credentialStatus.length; i++) {
+                    revoked = await this.checkRevocation(issuerDidDocument, credentialStatus[i].revocationBitmapIndex);
+                    if (revoked) {
+                        break;
+                    }
+                }
+            }
             return {
                 revoked,
                 verifiableCredential: revoked ? undefined : verifiableCredential
@@ -594,7 +586,7 @@ class EntityStorageIdentityConnector {
             if (core.Is.undefined(issuerIdentityDocument)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", issuerDocumentId);
             }
-            await this.verifyDocument(issuerIdentityDocument);
+            await EntityStorageIdentityConnector.verifyDocument(issuerIdentityDocument, this._vaultConnector);
             const issuerDidDocument = issuerIdentityDocument.document;
             const revocationService = issuerDidDocument.service?.find(s => s.id.endsWith("#revocation"));
             if (revocationService &&
@@ -634,7 +626,7 @@ class EntityStorageIdentityConnector {
             if (core.Is.undefined(issuerIdentityDocument)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", issuerDocumentId);
             }
-            await this.verifyDocument(issuerIdentityDocument);
+            await EntityStorageIdentityConnector.verifyDocument(issuerIdentityDocument, this._vaultConnector);
             const issuerDidDocument = issuerIdentityDocument.document;
             const revocationService = issuerDidDocument.service?.find(s => s.id.endsWith("#revocation"));
             if (revocationService &&
@@ -661,17 +653,18 @@ class EntityStorageIdentityConnector {
     /**
      * Create a verifiable presentation from the supplied verifiable credentials.
      * @param controller The controller of the identity who can make changes.
-     * @param presentationMethodId The method to associate with the presentation.
+     * @param verificationMethodId The method to associate with the presentation.
+     * @param presentationId The id of the presentation.
+     * @param contexts The contexts for the data stored in the verifiable credential.
      * @param types The types for the data stored in the verifiable credential.
      * @param verifiableCredentials The credentials to use for creating the presentation in jwt format.
-     * @param contexts Additional contexts to include in the presentation.
      * @param expiresInMinutes The time in minutes for the presentation to expire.
      * @returns The created verifiable presentation and its token.
      * @throws NotFoundError if the id can not be resolved.
      */
-    async createVerifiablePresentation(controller, presentationMethodId, types, verifiableCredentials, contexts, expiresInMinutes) {
+    async createVerifiablePresentation(controller, verificationMethodId, presentationId, contexts, types, verifiableCredentials, expiresInMinutes) {
         core.Guards.stringValue(this.CLASS_NAME, "controller", controller);
-        core.Guards.stringValue(this.CLASS_NAME, "presentationMethodId", presentationMethodId);
+        core.Guards.stringValue(this.CLASS_NAME, "verificationMethodId", verificationMethodId);
         if (core.Is.array(types)) {
             core.Guards.arrayValue(this.CLASS_NAME, "types", types);
         }
@@ -679,56 +672,46 @@ class EntityStorageIdentityConnector {
             core.Guards.stringValue(this.CLASS_NAME, "types", types);
         }
         core.Guards.arrayValue(this.CLASS_NAME, "verifiableCredentials", verifiableCredentials);
-        if (core.Is.array(contexts)) {
-            core.Guards.arrayValue(this.CLASS_NAME, "contexts", contexts);
-        }
-        else if (core.Is.string(contexts)) {
-            core.Guards.stringValue(this.CLASS_NAME, "contexts", contexts);
-        }
         if (!core.Is.undefined(expiresInMinutes)) {
             core.Guards.integer(this.CLASS_NAME, "expiresInMinutes", expiresInMinutes);
         }
         try {
-            const idParts = identityModels.DocumentHelper.parse(presentationMethodId);
-            if (core.Is.empty(idParts.hash)) {
-                throw new core.NotFoundError(this.CLASS_NAME, "missingDid", presentationMethodId);
+            const idParts = identityModels.DocumentHelper.parseId(verificationMethodId);
+            if (core.Is.empty(idParts.fragment)) {
+                throw new core.NotFoundError(this.CLASS_NAME, "missingDid", verificationMethodId);
             }
             const holderIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
             if (core.Is.undefined(holderIdentityDocument)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", idParts.id);
             }
-            await this.verifyDocument(holderIdentityDocument);
+            await EntityStorageIdentityConnector.verifyDocument(holderIdentityDocument, this._vaultConnector);
             const holderDidDocument = holderIdentityDocument.document;
             const methods = this.getAllMethods(holderDidDocument);
             const methodAndArray = methods.find(m => {
                 if (core.Is.string(m.method)) {
-                    return m.method === presentationMethodId;
+                    return m.method === verificationMethodId;
                 }
-                return m.method.id === presentationMethodId;
+                return m.method.id === verificationMethodId;
             });
             if (!methodAndArray) {
-                throw new core.GeneralError(this.CLASS_NAME, "methodMissing");
+                throw new core.GeneralError(this.CLASS_NAME, "methodMissing", { method: verificationMethodId });
             }
             const didMethod = methodAndArray.method;
             if (!core.Is.stringValue(didMethod.publicKeyJwk?.x)) {
-                throw new core.GeneralError(this.CLASS_NAME, "publicKeyJwkMissing");
+                throw new core.GeneralError(this.CLASS_NAME, "publicKeyJwkMissing", {
+                    method: verificationMethodId
+                });
             }
-            const finalTypes = ["VerifiablePresentation"];
+            const finalTypes = [standardsW3cDid.DidTypes.VerifiablePresentation];
             if (core.Is.array(types)) {
                 finalTypes.push(...types);
             }
             else if (core.Is.stringValue(types)) {
                 finalTypes.push(types);
             }
-            const finalContexts = ["https://www.w3.org/2018/credentials/v1"];
-            if (core.Is.array(contexts)) {
-                finalContexts.push(...contexts);
-            }
-            else if (core.Is.stringValue(contexts)) {
-                finalContexts.push(contexts);
-            }
             const verifiablePresentation = {
-                "@context": finalContexts,
+                "@context": dataJsonLd.JsonLdProcessor.combineContexts(standardsW3cDid.DidContexts.ContextVCv2, contexts),
+                id: presentationId,
                 type: finalTypes,
                 verifiableCredential: verifiableCredentials,
                 holder: idParts.id
@@ -752,10 +735,7 @@ class EntityStorageIdentityConnector {
                 const expiresInSeconds = expiresInMinutes * 60;
                 jwtPayload.exp = Math.floor(Date.now() / 1000) + expiresInSeconds;
             }
-            const signature = await web.Jwt.encodeWithSigner(jwtHeader, jwtPayload, async (alg, key, payload) => {
-                const sig = await this._vaultConnector.sign(this.buildVaultKey(idParts.id, presentationMethodId), payload);
-                return sig;
-            });
+            const signature = await web.Jwt.encodeWithSigner(jwtHeader, jwtPayload, async (header, payload) => vaultModels.VaultConnectorHelper.jwtSigner(this._vaultConnector, EntityStorageIdentityConnector.buildVaultKey(idParts.id, idParts.fragment ?? ""), header, payload));
             return {
                 verifiablePresentation,
                 jwt: signature
@@ -788,29 +768,54 @@ class EntityStorageIdentityConnector {
             if (core.Is.undefined(holderIdentityDocument)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", holderDocumentId);
             }
-            await this.verifyDocument(holderIdentityDocument);
+            await EntityStorageIdentityConnector.verifyDocument(holderIdentityDocument, this._vaultConnector);
             const issuers = [];
             const tokensRevoked = [];
             const verifiablePresentation = jwtPayload?.vp;
             if (core.Is.object(verifiablePresentation) &&
                 core.Is.array(verifiablePresentation.verifiableCredential)) {
                 for (const vcJwt of verifiablePresentation.verifiableCredential) {
-                    const jwt = await web.Jwt.decode(vcJwt);
                     let revoked = true;
-                    if (core.Is.string(jwt.payload?.iss)) {
-                        const issuerDocumentId = jwt.payload.iss;
-                        verifiablePresentation.holder = issuerDocumentId;
-                        const issuerDidDocument = await this._didDocumentEntityStorage.get(issuerDocumentId);
-                        if (core.Is.undefined(issuerDidDocument)) {
-                            throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", issuerDocumentId);
-                        }
-                        await this.verifyDocument(issuerDidDocument);
-                        issuers.push(issuerDidDocument);
-                        const vc = jwt.payload.vc;
-                        if (core.Is.object(vc)) {
-                            revoked = await this.checkRevocation(issuerDidDocument, vc.credentialStatus?.revocationBitmapIndex);
+                    if (core.Is.stringValue(vcJwt)) {
+                        const jwt = await web.Jwt.decode(vcJwt);
+                        if (core.Is.string(jwt.payload?.iss)) {
+                            const issuerDocumentId = jwt.payload.iss;
+                            verifiablePresentation.holder = issuerDocumentId;
+                            const issuerDidDocument = await this._didDocumentEntityStorage.get(issuerDocumentId);
+                            if (core.Is.undefined(issuerDidDocument)) {
+                                throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", issuerDocumentId);
+                            }
+                            await EntityStorageIdentityConnector.verifyDocument(issuerDidDocument, this._vaultConnector);
+                            issuers.push({
+                                "@context": standardsW3cDid.DidContexts.Context,
+                                ...issuerDidDocument
+                            });
+                            const vc = jwt.payload.vc;
+                            if (core.Is.object(vc)) {
+                                const credentialStatus = vc.credentialStatus;
+                                if (core.Is.object(credentialStatus)) {
+                                    revoked = await this.checkRevocation({
+                                        "@context": standardsW3cDid.DidContexts.Context,
+                                        ...issuerDidDocument
+                                    }, credentialStatus.revocationBitmapIndex);
+                                }
+                                else if (core.Is.arrayValue(credentialStatus)) {
+                                    for (let i = 0; i < credentialStatus.length; i++) {
+                                        revoked = await this.checkRevocation({
+                                            "@context": standardsW3cDid.DidContexts.Context,
+                                            ...issuerDidDocument
+                                        }, credentialStatus[i].revocationBitmapIndex);
+                                        if (revoked) {
+                                            break;
+                                        }
+                                    }
+                                }
+                            }
                         }
                     }
+                    else {
+                        revoked = false;
+                    }
                     tokensRevoked.push(revoked);
                 }
             }
@@ -833,23 +838,25 @@ class EntityStorageIdentityConnector {
      * Create a proof for arbitrary data with the specified verification method.
      * @param controller The controller of the identity who can make changes.
      * @param verificationMethodId The verification method id to use.
-     * @param bytes The data bytes to sign.
-     * @returns The proof signature type and value.
+     * @param proofType The type of proof to create.
+     * @param unsecureDocument The unsecure document to create the proof for.
+     * @returns The proof.
      */
-    async createProof(controller, verificationMethodId, bytes) {
+    async createProof(controller, verificationMethodId, proofType, unsecureDocument) {
         core.Guards.stringValue(this.CLASS_NAME, "controller", controller);
         core.Guards.stringValue(this.CLASS_NAME, "verificationMethodId", verificationMethodId);
-        core.Guards.uint8Array(this.CLASS_NAME, "bytes", bytes);
+        core.Guards.arrayOneOf(this.CLASS_NAME, "proofType", proofType, Object.values(standardsW3cDid.ProofTypes));
+        core.Guards.object(this.CLASS_NAME, "unsecureDocument", unsecureDocument);
         try {
-            const idParts = identityModels.DocumentHelper.parse(verificationMethodId);
-            if (core.Is.empty(idParts.hash)) {
+            const idParts = identityModels.DocumentHelper.parseId(verificationMethodId);
+            if (core.Is.empty(idParts.fragment)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "missingDid", verificationMethodId);
             }
             const didIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
             if (core.Is.undefined(didIdentityDocument)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", idParts.id);
             }
-            await this.verifyDocument(didIdentityDocument);
+            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
             const didDocument = didIdentityDocument.document;
             const methods = this.getAllMethods(didDocument);
             const methodAndArray = methods.find(m => {
@@ -859,17 +866,18 @@ class EntityStorageIdentityConnector {
                 return m.method.id === verificationMethodId;
             });
             if (!methodAndArray) {
-                throw new core.GeneralError(this.CLASS_NAME, "methodMissing");
+                throw new core.GeneralError(this.CLASS_NAME, "methodMissing", { method: verificationMethodId });
             }
             const didMethod = methodAndArray.method;
             if (!core.Is.stringValue(didMethod.publicKeyJwk?.x)) {
-                throw new core.GeneralError(this.CLASS_NAME, "publicKeyJwkMissing");
+                throw new core.GeneralError(this.CLASS_NAME, "publicKeyJwkMissing", {
+                    method: verificationMethodId
+                });
             }
-            const signature = await this._vaultConnector.sign(this.buildVaultKey(didDocument.id, verificationMethodId), bytes);
-            return {
-                type: "Ed25519",
-                value: signature
-            };
+            const vaultKey = EntityStorageIdentityConnector.buildVaultKey(didDocument.id, idParts.fragment ?? "");
+            const key = await this._vaultConnector.getKey(vaultKey);
+            const signedProof = await standardsW3cDid.ProofHelper.createProof(proofType, unsecureDocument, standardsW3cDid.ProofHelper.createUnsignedProof(proofType, verificationMethodId), await web.Jwk.fromEd25519Private(key.privateKey));
+            return signedProof;
         }
         catch (error) {
             throw new core.GeneralError(this.CLASS_NAME, "createProofFailed", undefined, error);
@@ -877,43 +885,44 @@ class EntityStorageIdentityConnector {
     }
     /**
      * Verify proof for arbitrary data with the specified verification method.
-     * @param verificationMethodId The verification method id to use.
-     * @param bytes The data bytes to verify.
-     * @param signatureType The type of the signature for the proof.
-     * @param signatureValue The value of the signature for the proof.
-     * @returns True if the signature is valid.
+     * @param document The document to verify.
+     * @param proof The proof to verify.
+     * @returns True if the proof is verified.
      */
-    async verifyProof(verificationMethodId, bytes, signatureType, signatureValue) {
-        core.Guards.stringValue(this.CLASS_NAME, "verificationMethodId", verificationMethodId);
-        core.Guards.uint8Array(this.CLASS_NAME, "bytes", bytes);
-        core.Guards.stringValue(this.CLASS_NAME, "signatureType", signatureType);
-        core.Guards.uint8Array(this.CLASS_NAME, "signatureValue", signatureValue);
+    async verifyProof(document, proof) {
+        core.Guards.object(this.CLASS_NAME, "document", document);
+        core.Guards.object(this.CLASS_NAME, "proof", proof);
+        core.Guards.stringValue(this.CLASS_NAME, "proof.verificationMethod", proof.verificationMethod);
         try {
-            const idParts = identityModels.DocumentHelper.parse(verificationMethodId);
-            if (core.Is.empty(idParts.hash)) {
-                throw new core.NotFoundError(this.CLASS_NAME, "missingDid", verificationMethodId);
+            const idParts = identityModels.DocumentHelper.parseId(proof.verificationMethod);
+            if (core.Is.empty(idParts.fragment)) {
+                throw new core.NotFoundError(this.CLASS_NAME, "missingDid", proof.verificationMethod);
             }
             const didIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
             if (core.Is.undefined(didIdentityDocument)) {
                 throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", idParts.id);
             }
-            await this.verifyDocument(didIdentityDocument);
+            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
             const didDocument = didIdentityDocument.document;
             const methods = this.getAllMethods(didDocument);
             const methodAndArray = methods.find(m => {
                 if (core.Is.string(m.method)) {
-                    return m.method === verificationMethodId;
+                    return m.method === proof.verificationMethod;
                 }
-                return m.method.id === verificationMethodId;
+                return m.method.id === proof.verificationMethod;
             });
             if (!methodAndArray) {
-                throw new core.GeneralError(this.CLASS_NAME, "methodMissing");
+                throw new core.GeneralError(this.CLASS_NAME, "methodMissing", {
+                    method: proof.verificationMethod
+                });
             }
             const didMethod = methodAndArray.method;
             if (!core.Is.stringValue(didMethod.publicKeyJwk?.x)) {
-                throw new core.GeneralError(this.CLASS_NAME, "publicKeyJwkMissing");
+                throw new core.GeneralError(this.CLASS_NAME, "publicKeyJwkMissing", {
+                    method: proof.verificationMethod
+                });
             }
-            return this._vaultConnector.verify(this.buildVaultKey(didIdentityDocument.id, verificationMethodId), bytes, signatureValue);
+            return standardsW3cDid.ProofHelper.verifyProof(document, proof, didMethod.publicKeyJwk);
         }
         catch (error) {
             throw new core.GeneralError(this.CLASS_NAME, "verifyProofFailed", undefined, error);
@@ -966,19 +975,6 @@ class EntityStorageIdentityConnector {
         }
         return false;
     }
-    /**
-     * Verify the document in storage.
-     * @param didDocument The did document that was stored.
-     * @internal
-     */
-    async verifyDocument(didDocument) {
-        const stringifiedDocument = core.JsonHelper.canonicalize(didDocument.document);
-        const docBytes = core.Converter.utf8ToBytes(stringifiedDocument);
-        const verified = await this._vaultConnector.verify(this.buildVaultKey(didDocument.id, didDocument.id), docBytes, core.Converter.base64ToBytes(didDocument.signature));
-        if (!verified) {
-            throw new core.GeneralError(this.CLASS_NAME, "signatureVerificationFailed");
-        }
-    }
     /**
      * Update the document in storage.
      * @param controller The controller of the document.
@@ -988,7 +984,7 @@ class EntityStorageIdentityConnector {
     async updateDocument(controller, didDocument) {
         const stringifiedDocument = core.JsonHelper.canonicalize(didDocument);
         const docBytes = core.Converter.utf8ToBytes(stringifiedDocument);
-        const signature = await this._vaultConnector.sign(this.buildVaultKey(didDocument.id, didDocument.id), docBytes);
+        const signature = await this._vaultConnector.sign(EntityStorageIdentityConnector.buildVaultKey(didDocument.id, "did"), docBytes);
         await this._didDocumentEntityStorage.set({
             id: didDocument.id,
             document: didDocument,
@@ -996,15 +992,6 @@ class EntityStorageIdentityConnector {
             controller
         });
     }
-    /**
-     * Build the key name to access the specified key in the vault.
-     * @param identity The identity of the user to access the vault keys.
-     * @returns The vault key.
-     * @internal
-     */
-    buildVaultKey(identity, key) {
-        return `${identity}/${key}`;
-    }
 }
 
 // Copyright 2024 IOTA Stiftung.
@@ -1027,9 +1014,8 @@ class EntityStorageIdentityProfileConnector {
      */
     _profileEntityStorage;
     /**
-     * Create a new instance of Identity.
-     * @param options The dependencies for the identity service.
-     * @param options.profileEntityStorageType The storage connector for the profiles, default to "identity-profile".
+     * Create a new instance of EntityStorageIdentityProfileConnector.
+     * @param options The options for the identity service.
      */
     constructor(options) {
         this._profileEntityStorage = entityStorageModels.EntityStorageConnectorFactory.get(options?.profileEntityStorageType ?? "identity-profile");
@@ -1201,6 +1187,60 @@ class EntityStorageIdentityProfileConnector {
     }
 }
 
+// Copyright 2024 IOTA Stiftung.
+// SPDX-License-Identifier: Apache-2.0.
+/**
+ * Class for performing identity operations using entity storage.
+ */
+class EntityStorageIdentityResolverConnector {
+    /**
+     * The namespace supported by the identity connector.
+     */
+    static NAMESPACE = "entity-storage";
+    /**
+     * Runtime name for the class.
+     */
+    CLASS_NAME = "EntityStorageIdentityResolverConnector";
+    /**
+     * The entity storage for identities.
+     * @internal
+     */
+    _didDocumentEntityStorage;
+    /**
+     * The vault for the keys.
+     * @internal
+     */
+    _vaultConnector;
+    /**
+     * Create a new instance of EntityStorageIdentityResolverConnector.
+     * @param options The options for the identity connector.
+     */
+    constructor(options) {
+        this._didDocumentEntityStorage = entityStorageModels.EntityStorageConnectorFactory.get(options?.didDocumentEntityStorageType ?? "identity-document");
+        this._vaultConnector = vaultModels.VaultConnectorFactory.get(options?.vaultConnectorType ?? "vault");
+    }
+    /**
+     * Resolve a document from its id.
+     * @param documentId The id of the document to resolve.
+     * @returns The resolved document.
+     * @throws NotFoundError if the id can not be resolved.
+     */
+    async resolveDocument(documentId) {
+        core.Guards.stringValue(this.CLASS_NAME, "documentId", documentId);
+        try {
+            const didIdentityDocument = await this._didDocumentEntityStorage.get(documentId);
+            if (core.Is.undefined(didIdentityDocument)) {
+                throw new core.NotFoundError(this.CLASS_NAME, "documentNotFound", documentId);
+            }
+            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
+            return didIdentityDocument.document;
+        }
+        catch (error) {
+            throw new core.GeneralError(this.CLASS_NAME, "resolveDocumentFailed", undefined, error);
+        }
+    }
+}
+
 // Copyright 2024 IOTA Stiftung.
 // SPDX-License-Identifier: Apache-2.0.
 /**
@@ -1220,4 +1260,5 @@ function initSchema(options) {
 
 exports.EntityStorageIdentityConnector = EntityStorageIdentityConnector;
 exports.EntityStorageIdentityProfileConnector = EntityStorageIdentityProfileConnector;
+exports.EntityStorageIdentityResolverConnector = EntityStorageIdentityResolverConnector;
 exports.initSchema = initSchema;