@twin.org/identity-connector-entity-storage 0.9.2 → 0.9.3-next.1

package/dist/es/entityStorageIdentityConnector.js

@@ -1,9 +1,9 @@
 // Copyright 2024 IOTA Stiftung.
 // SPDX-License-Identifier: Apache-2.0.
-import { ArrayHelper, BaseError, BitString, Coerce, Compression, CompressionType, Converter, GeneralError, Guards, Is, JsonHelper, NotFoundError, ObjectHelper, RandomHelper, Url, Urn } from "@twin.org/core";
+import { ArrayHelper, BaseError, BitString, Coerce, Compression, CompressionType, Converter, GeneralError, Guards, Is, JsonHelper, LruCache, NotFoundError, ObjectHelper, RandomHelper, Url, Urn } from "@twin.org/core";
 import { JsonLdHelper, JsonLdProcessor } from "@twin.org/data-json-ld";
 import { EntityStorageConnectorFactory } from "@twin.org/entity-storage-models";
-import { DocumentHelper } from "@twin.org/identity-models";
+import { DocumentHelper, VerificationHelper } from "@twin.org/identity-models";
 import { DidContexts, DidTypes, DidVerificationMethodType, JwsAlgorithms, ProofHelper, ProofTypes } from "@twin.org/standards-w3c-did";
 import { VaultConnectorFactory, VaultConnectorHelper, VaultKeyType } from "@twin.org/vault-models";
 import { Jwk, Jwt } from "@twin.org/web";
@@ -34,6 +34,28 @@ export class EntityStorageIdentityConnector {
      * @internal
      */
     _vaultConnector;
+    /**
+     * TTL in ms for caching DID documents resolved for this connector's own sign/mutate
+     * operations. 0 disables caching (see resolveOwnDocumentCached). Never applied to proof or
+     * credential verification of third-party claims.
+     * @internal
+     */
+    _didResolutionCacheTtlMs;
+    /**
+     * Maximum number of own DID documents retained in cache.
+     * @internal
+     */
+    _didResolutionCacheCapacity;
+    /**
+     * Maximum wait time for own DID cache getOrSet mutex acquisition in milliseconds.
+     * @internal
+     */
+    _didResolutionCacheMutexTimeoutMs;
+    /**
+     * LRU cache for own DID documents. Undefined when caching is disabled (ttl is 0).
+     * @internal
+     */
+    _didResolutionCache;
     /**
      * Create a new instance of EntityStorageIdentityConnector.
      * @param options The options for the identity connector.
@@ -41,6 +63,18 @@ export class EntityStorageIdentityConnector {
     constructor(options) {
         this._didDocumentEntityStorage = EntityStorageConnectorFactory.get(options?.didDocumentEntityStorageType ?? "identity-document");
         this._vaultConnector = VaultConnectorFactory.get(options?.vaultConnectorType ?? "vault");
+        const config = options?.config ?? {};
+        this._didResolutionCacheTtlMs = config.didResolutionCacheTtlMs ?? 30_000;
+        this._didResolutionCacheCapacity = config.didResolutionCacheCapacity ?? 1000;
+        this._didResolutionCacheMutexTimeoutMs = config.didResolutionCacheMutexTimeoutMs;
+        this._didResolutionCache =
+            this._didResolutionCacheTtlMs > 0
+                ? new LruCache({
+                    capacity: this._didResolutionCacheCapacity,
+                    ttiMs: this._didResolutionCacheTtlMs,
+                    mutexTimeoutMs: this._didResolutionCacheMutexTimeoutMs
+                })
+                : undefined;
     }
     /**
      * Build the key name to access the specified key in the vault.
@@ -75,6 +109,15 @@ export class EntityStorageIdentityConnector {
     className() {
         return EntityStorageIdentityConnector.CLASS_NAME;
     }
+    /**
+     * Stop the service.
+     * Destroys in-memory resources owned by this component.
+     * @param nodeLoggingComponentType The node logging component type.
+     * @returns A promise that resolves when the service has stopped.
+     */
+    async stop(nodeLoggingComponentType) {
+        this._didResolutionCache?.destroy();
+    }
     /**
      * Create a new document.
      * @param controller The controller of the identity who can make changes.
@@ -122,6 +165,7 @@ export class EntityStorageIdentityConnector {
                 throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", documentId);
             }
             await this._didDocumentEntityStorage.remove(documentId);
+            this._didResolutionCache?.delete(this.ownDidCacheKey(documentId));
             if (options?.removeKeys ?? false) {
                 const methods = this.getAllMethods(didDocument.document);
                 for (const { method } of methods) {
@@ -158,11 +202,7 @@ export class EntityStorageIdentityConnector {
         Guards.arrayOneOf(EntityStorageIdentityConnector.CLASS_NAME, "verificationMethodType", verificationMethodType, Object.values(DidVerificationMethodType));
         let tempKeyId;
         try {
-            const didIdentityDocument = await this._didDocumentEntityStorage.get(documentId);
-            if (Is.undefined(didIdentityDocument)) {
-                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", documentId);
-            }
-            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
+            const didIdentityDocument = await this.resolveOwnDocumentCached(documentId);
             const didDocument = didIdentityDocument.document;
             let methodKeyPublic;
             if (Is.stringValue(verificationMethodId)) {
@@ -250,11 +290,7 @@ export class EntityStorageIdentityConnector {
             if (Is.empty(idParts.fragment)) {
                 throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "missingDid", verificationMethodId);
             }
-            const didIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
-            if (Is.undefined(didIdentityDocument)) {
-                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", idParts.id);
-            }
-            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
+            const didIdentityDocument = await this.resolveOwnDocumentCached(idParts.id);
             const didDocument = didIdentityDocument.document;
             const methods = this.getAllMethods(didDocument);
             const existingMethodIndex = methods.findIndex(m => {
@@ -314,11 +350,7 @@ export class EntityStorageIdentityConnector {
             Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "serviceEndpoint", serviceEndpoint);
         }
         try {
-            const didIdentityDocument = await this._didDocumentEntityStorage.get(documentId);
-            if (Is.undefined(didIdentityDocument)) {
-                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", documentId);
-            }
-            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
+            const didIdentityDocument = await this.resolveOwnDocumentCached(documentId);
             const didDocument = didIdentityDocument.document;
             const fullServiceId = serviceId.includes("#") ? serviceId : `${documentId}#${serviceId}`;
             if (Is.array(didDocument.service)) {
@@ -356,11 +388,7 @@ export class EntityStorageIdentityConnector {
             if (Is.empty(idParts.fragment)) {
                 throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "missingDid", serviceId);
             }
-            const didIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
-            if (Is.undefined(didIdentityDocument)) {
-                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", idParts.id);
-            }
-            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
+            const didIdentityDocument = await this.resolveOwnDocumentCached(idParts.id);
             const didDocument = didIdentityDocument.document;
             if (Is.array(didDocument.service)) {
                 const existingServiceIndex = didDocument.service.findIndex(s => s.id === serviceId);
@@ -401,11 +429,7 @@ export class EntityStorageIdentityConnector {
             throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "invalidAlias", { alias });
         }
         try {
-            const didIdentityDocument = await this._didDocumentEntityStorage.get(documentId);
-            if (Is.undefined(didIdentityDocument)) {
-                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", documentId);
-            }
-            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
+            const didIdentityDocument = await this.resolveOwnDocumentCached(documentId);
             const didDocument = didIdentityDocument.document;
             const existing = Is.array(didDocument.alsoKnownAs) ? didDocument.alsoKnownAs : [];
             if (existing.includes(alias)) {
@@ -436,11 +460,7 @@ export class EntityStorageIdentityConnector {
             throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "invalidAlias", { alias });
         }
         try {
-            const didIdentityDocument = await this._didDocumentEntityStorage.get(documentId);
-            if (Is.undefined(didIdentityDocument)) {
-                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", documentId);
-            }
-            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
+            const didIdentityDocument = await this.resolveOwnDocumentCached(documentId);
             const didDocument = didIdentityDocument.document;
             if (!Is.array(didDocument.alsoKnownAs) || !didDocument.alsoKnownAs.includes(alias)) {
                 return;
@@ -487,11 +507,7 @@ export class EntityStorageIdentityConnector {
             if (Is.empty(idParts.fragment)) {
                 throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "missingDid", verificationMethodId);
             }
-            const issuerIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
-            if (Is.undefined(issuerIdentityDocument)) {
-                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", idParts.id);
-            }
-            await EntityStorageIdentityConnector.verifyDocument(issuerIdentityDocument, this._vaultConnector);
+            const issuerIdentityDocument = await this.resolveOwnDocumentCached(idParts.id);
             const issuerDidDocument = issuerIdentityDocument.document;
             const methods = this.getAllMethods(issuerDidDocument);
             const methodAndArray = methods.find(m => {
@@ -552,7 +568,7 @@ export class EntityStorageIdentityConnector {
             ]);
             // Add the proof to the VC after extracting the jwt data
             // as the jwt does not include the proof
-            verifiableCredential.proof = await this.createProof(controller, verificationMethodId, ProofTypes.DataIntegrityProof, JsonLdHelper.toNodeObject(verifiableCredential));
+            verifiableCredential.proof = await this.createProof(controller, verificationMethodId, ProofTypes.DataIntegrityProof, JsonLdHelper.toNodeObject(verifiableCredential), issuerDidDocument);
             // As we are adding the receipt to the data we update the JSON-LD context
             const proofContext = verifiableCredential.proof["@context"];
             if (!Is.empty(proofContext)) {
@@ -598,14 +614,28 @@ export class EntityStorageIdentityConnector {
         if (Is.object(credential)) {
             Guards.objectValue(EntityStorageIdentityConnector.CLASS_NAME, "credential", credential);
             Guards.objectValue(EntityStorageIdentityConnector.CLASS_NAME, "credential.proof", credential.proof);
+            VerificationHelper.checkValidityPeriod(credential);
             const { proof, ...doc } = credential;
-            const credentialVerified = await this.verifyProof(JsonLdHelper.toNodeObject(doc), ArrayHelper.fromObjectOrArray(proof)[0]);
+            const proofEntry = ArrayHelper.fromObjectOrArray(proof)[0];
+            Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "proofEntry.verificationMethod", proofEntry.verificationMethod);
+            const issuer = Is.object(doc.issuer) ? doc.issuer.id : doc.issuer;
+            const signerDid = DocumentHelper.parseId(proofEntry.verificationMethod).id;
+            if (Is.stringValue(issuer) && issuer !== signerDid) {
+                throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "issuerMismatch", {
+                    issuer,
+                    method: proofEntry.verificationMethod
+                });
+            }
+            const issuerDidDocument = await this.resolveAssertionMethodDocument(proofEntry.verificationMethod);
+            const publicKeyJwk = DocumentHelper.getJwk(issuerDidDocument, proofEntry.verificationMethod, DidVerificationMethodType.AssertionMethod);
+            const credentialVerified = await ProofHelper.verifyProof(JsonLdHelper.toNodeObject(doc), proofEntry, publicKeyJwk);
             if (!credentialVerified) {
                 throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "signatureVerificationFailed");
             }
+            const revoked = await this.checkCredentialStatusRevoked(issuerDidDocument, doc.credentialStatus);
             return {
-                revoked: false,
-                verifiableCredential: doc
+                revoked,
+                verifiableCredential: revoked ? undefined : doc
             };
         }
         Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "credential", credential);
@@ -627,25 +657,9 @@ export class EntityStorageIdentityConnector {
             }
             await EntityStorageIdentityConnector.verifyDocument(issuerIdentityDocument, this._vaultConnector);
             const issuerDidDocument = issuerIdentityDocument.document;
-            const methods = this.getAllMethods(issuerDidDocument);
-            const methodAndArray = methods.find(m => {
-                if (Is.string(m.method)) {
-                    return m.method === jwtHeader.kid;
-                }
-                return m.method.id === jwtHeader.kid;
-            });
-            if (!methodAndArray) {
-                throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "methodMissing", {
-                    method: jwtHeader.kid
-                });
-            }
-            const didMethod = methodAndArray.method;
-            if (!Is.stringValue(didMethod.publicKeyJwk?.x)) {
-                throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "publicKeyJwkMissing", {
-                    method: jwtHeader.kid
-                });
-            }
-            await Jwt.verifySignature(credential, await Jwk.toCryptoKey(didMethod.publicKeyJwk));
+            Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "jwtHeader.kid", jwtHeader.kid);
+            const publicKeyJwk = DocumentHelper.getJwk(issuerDidDocument, jwtHeader.kid, DidVerificationMethodType.AssertionMethod);
+            await Jwt.verifySignature(credential, await Jwk.toCryptoKey(publicKeyJwk));
             const verifiableCredential = jwtPayload.vc;
             if (Is.object(verifiableCredential)) {
                 if (Is.string(jwtPayload.jti)) {
@@ -655,6 +669,9 @@ export class EntityStorageIdentityConnector {
                 if (Is.number(jwtPayload.nbf)) {
                     verifiableCredential.issuanceDate = new Date(jwtPayload.nbf * 1000).toISOString();
                 }
+                if (Is.number(jwtPayload.exp)) {
+                    verifiableCredential.expirationDate = new Date(jwtPayload.exp * 1000).toISOString();
+                }
                 if (Is.array(verifiableCredential.credentialSubject)) {
                     verifiableCredential.credentialSubject = verifiableCredential.credentialSubject.map(c => {
                         ObjectHelper.propertySet(c, "id", jwtPayload.sub);
@@ -665,19 +682,8 @@ export class EntityStorageIdentityConnector {
                     ObjectHelper.propertySet(verifiableCredential.credentialSubject, "id", jwtPayload.sub);
                 }
             }
-            const credentialStatus = verifiableCredential.credentialStatus;
-            let revoked = false;
-            if (Is.object(credentialStatus)) {
-                revoked = await this.checkRevocation(issuerDidDocument, credentialStatus.revocationBitmapIndex);
-            }
-            else if (Is.arrayValue(credentialStatus)) {
-                for (let i = 0; i < credentialStatus.length; i++) {
-                    revoked = await this.checkRevocation(issuerDidDocument, credentialStatus[i].revocationBitmapIndex);
-                    if (revoked) {
-                        break;
-                    }
-                }
-            }
+            VerificationHelper.checkValidityPeriod(verifiableCredential);
+            const revoked = await this.checkCredentialStatusRevoked(issuerDidDocument, verifiableCredential.credentialStatus);
             return {
                 revoked,
                 verifiableCredential: revoked ? undefined : verifiableCredential
@@ -699,11 +705,7 @@ export class EntityStorageIdentityConnector {
         Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "issuerDocumentId", issuerDocumentId);
         Guards.arrayValue(EntityStorageIdentityConnector.CLASS_NAME, "credentialIndices", credentialIndices);
         try {
-            const issuerIdentityDocument = await this._didDocumentEntityStorage.get(issuerDocumentId);
-            if (Is.undefined(issuerIdentityDocument)) {
-                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", issuerDocumentId);
-            }
-            await EntityStorageIdentityConnector.verifyDocument(issuerIdentityDocument, this._vaultConnector);
+            const issuerIdentityDocument = await this.resolveOwnDocumentCached(issuerDocumentId);
             const issuerDidDocument = issuerIdentityDocument.document;
             const revocationService = issuerDidDocument.service?.find(s => s.id.endsWith("#revocation"));
             if (revocationService &&
@@ -739,11 +741,7 @@ export class EntityStorageIdentityConnector {
         Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "issuerDocumentId", issuerDocumentId);
         Guards.arrayValue(EntityStorageIdentityConnector.CLASS_NAME, "credentialIndices", credentialIndices);
         try {
-            const issuerIdentityDocument = await this._didDocumentEntityStorage.get(issuerDocumentId);
-            if (Is.undefined(issuerIdentityDocument)) {
-                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", issuerDocumentId);
-            }
-            await EntityStorageIdentityConnector.verifyDocument(issuerIdentityDocument, this._vaultConnector);
+            const issuerIdentityDocument = await this.resolveOwnDocumentCached(issuerDocumentId);
             const issuerDidDocument = issuerIdentityDocument.document;
             const revocationService = issuerDidDocument.service?.find(s => s.id.endsWith("#revocation"));
             if (revocationService &&
@@ -800,11 +798,7 @@ export class EntityStorageIdentityConnector {
             if (Is.empty(idParts.fragment)) {
                 throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "missingDid", verificationMethodId);
             }
-            const holderIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
-            if (Is.undefined(holderIdentityDocument)) {
-                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", idParts.id);
-            }
-            await EntityStorageIdentityConnector.verifyDocument(holderIdentityDocument, this._vaultConnector);
+            const holderIdentityDocument = await this.resolveOwnDocumentCached(idParts.id);
             const holderDidDocument = holderIdentityDocument.document;
             const methods = this.getAllMethods(holderDidDocument);
             const methodAndArray = methods.find(m => {
@@ -853,7 +847,7 @@ export class EntityStorageIdentityConnector {
             ]);
             // Add the proof to the VP after extracting the jwt data
             // as the jwt does not include the proof
-            verifiablePresentation.proof = await this.createProof(controller, verificationMethodId, ProofTypes.DataIntegrityProof, JsonLdHelper.toNodeObject(verifiablePresentation));
+            verifiablePresentation.proof = await this.createProof(controller, verificationMethodId, ProofTypes.DataIntegrityProof, JsonLdHelper.toNodeObject(verifiablePresentation), holderDidDocument);
             const jwtPayload = {
                 ...options?.jwtPayloadFields,
                 iss: verifiablePresentation.holder,
@@ -887,7 +881,15 @@ export class EntityStorageIdentityConnector {
             if (!presentationVerified) {
                 throw new GeneralError(EntityStorageIdentityConnector.CLASS_NAME, "signatureVerificationFailed");
             }
-            return { revoked: false, verifiablePresentation: doc };
+            let revoked = false;
+            for (const embeddedCredential of doc.verifiableCredential ?? []) {
+                const credentialCheck = await this.checkVerifiableCredential(embeddedCredential);
+                if (credentialCheck.revoked) {
+                    revoked = true;
+                    break;
+                }
+            }
+            return { revoked, verifiablePresentation: doc };
         }
         Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "presentation", presentation);
         const presentationJwt = presentation;
@@ -914,7 +916,7 @@ export class EntityStorageIdentityConnector {
             if (Is.object(verifiablePresentation) &&
                 Is.array(verifiablePresentation.verifiableCredential)) {
                 for (const vcJwt of verifiablePresentation.verifiableCredential) {
-                    let revoked = true;
+                    let revoked = false;
                     if (Is.stringValue(vcJwt)) {
                         const jwt = await Jwt.decode(vcJwt);
                         if (Is.string(jwt.payload?.iss)) {
@@ -929,31 +931,9 @@ export class EntityStorageIdentityConnector {
                                 "@context": DidContexts.Context,
                                 ...issuerDidDocument
                             });
-                            const vc = jwt.payload.vc;
-                            if (Is.object(vc)) {
-                                const credentialStatus = vc.credentialStatus;
-                                if (Is.object(credentialStatus)) {
-                                    revoked = await this.checkRevocation({
-                                        "@context": DidContexts.Context,
-                                        ...issuerDidDocument
-                                    }, credentialStatus.revocationBitmapIndex);
-                                }
-                                else if (Is.arrayValue(credentialStatus)) {
-                                    for (let i = 0; i < credentialStatus.length; i++) {
-                                        revoked = await this.checkRevocation({
-                                            "@context": DidContexts.Context,
-                                            ...issuerDidDocument
-                                        }, credentialStatus[i].revocationBitmapIndex);
-                                        if (revoked) {
-                                            break;
-                                        }
-                                    }
-                                }
-                            }
                         }
-                    }
-                    else {
-                        revoked = false;
+                        const credentialCheck = await this.checkVerifiableCredential(vcJwt);
+                        revoked = credentialCheck.revoked;
                     }
                     tokensRevoked.push(revoked);
                 }
@@ -981,26 +961,29 @@ export class EntityStorageIdentityConnector {
      * @param verificationMethodId The verification method id to use.
      * @param proofType The type of proof to create.
      * @param unsecureDocument The unsecure document to create the proof for.
+     * @param resolvedDocument Optional already-resolved document for the DID, so a caller that
+     * just resolved it (e.g. createVerifiableCredential) skips a redundant re-resolve. Resolves
+     * it itself if omitted.
      * @returns The proof.
      * @throws NotFoundError if the identity or method is not found.
      * @throws GeneralError if algorithm doesn't match key type or proof creation fails.
      */
-    async createProof(controller, verificationMethodId, proofType, unsecureDocument) {
+    async createProof(controller, verificationMethodId, proofType, unsecureDocument, resolvedDocument) {
         Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "controller", controller);
         Guards.stringValue(EntityStorageIdentityConnector.CLASS_NAME, "verificationMethodId", verificationMethodId);
         Guards.arrayOneOf(EntityStorageIdentityConnector.CLASS_NAME, "proofType", proofType, Object.values(ProofTypes));
         Guards.object(EntityStorageIdentityConnector.CLASS_NAME, "unsecureDocument", unsecureDocument);
+        if (!Is.undefined(resolvedDocument)) {
+            Guards.object(EntityStorageIdentityConnector.CLASS_NAME, "resolvedDocument", resolvedDocument);
+        }
         try {
             const idParts = DocumentHelper.parseId(verificationMethodId);
             if (Is.empty(idParts.fragment)) {
                 throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "missingDid", verificationMethodId);
             }
-            const didIdentityDocument = await this._didDocumentEntityStorage.get(idParts.id);
-            if (Is.undefined(didIdentityDocument)) {
-                throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", idParts.id);
-            }
-            await EntityStorageIdentityConnector.verifyDocument(didIdentityDocument, this._vaultConnector);
-            const didDocument = didIdentityDocument.document;
+            const didDocument = Is.undefined(resolvedDocument)
+                ? (await this.resolveOwnDocumentCached(idParts.id)).document
+                : resolvedDocument;
             const methods = this.getAllMethods(didDocument);
             const methodAndArray = methods.find(m => {
                 if (Is.string(m.method)) {
@@ -1121,6 +1104,92 @@ export class EntityStorageIdentityConnector {
         }
         return methods;
     }
+    /**
+     * Resolve the issuer document for a verification method, verified against its stored signature.
+     * @param verificationMethodId The verification method id whose owning DID to resolve.
+     * @returns The resolved document.
+     * @throws NotFoundError if the id has no DID, or the DID cannot be resolved.
+     * @internal
+     */
+    async resolveAssertionMethodDocument(verificationMethodId) {
+        const idParts = DocumentHelper.parseId(verificationMethodId);
+        if (Is.empty(idParts.fragment)) {
+            throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "missingDid", verificationMethodId);
+        }
+        const identityDocument = await this._didDocumentEntityStorage.get(idParts.id);
+        if (Is.undefined(identityDocument)) {
+            throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", idParts.id);
+        }
+        await EntityStorageIdentityConnector.verifyDocument(identityDocument, this._vaultConnector);
+        return identityDocument.document;
+    }
+    /**
+     * Cache key for a DID resolved for this connector's own sign/mutate operations (role 1).
+     * Deliberately namespaced ("own") and never shared with proof/credential verification of
+     * third-party claims (role 2/3), which this connector never caches.
+     * @param documentId The DID being resolved.
+     * @returns The cache key.
+     * @internal
+     */
+    ownDidCacheKey(documentId) {
+        return `${EntityStorageIdentityConnector.CLASS_NAME}:own:${documentId}`;
+    }
+    /**
+     * Load and verify a document's own storage entity, uncached.
+     * @param documentId The DID to load.
+     * @returns The verified storage entity.
+     * @throws NotFoundError if the DID could not be resolved.
+     * @internal
+     */
+    async loadOwnDocument(documentId) {
+        const identityDocument = await this._didDocumentEntityStorage.get(documentId);
+        if (Is.undefined(identityDocument)) {
+            throw new NotFoundError(EntityStorageIdentityConnector.CLASS_NAME, "documentNotFound", documentId);
+        }
+        await EntityStorageIdentityConnector.verifyDocument(identityDocument, this._vaultConnector);
+        return identityDocument;
+    }
+    /**
+     * Resolve a document's own storage entity for this connector's own sign/mutate operations,
+     * cached for didResolutionCacheTtlMs (0 disables caching and resolves fresh every call).
+     * Only ever used for the connector's own create/update/revoke paths - never for verifyProof
+     * or credential/presentation verification, which must stay uncached.
+     * A clone is always returned: mutators edit the entity in place before storing it, and the
+     * cached instance must never be handed out by reference.
+     * @param documentId The DID to resolve.
+     * @returns The verified storage entity.
+     * @throws NotFoundError if the DID could not be resolved.
+     * @internal
+     */
+    async resolveOwnDocumentCached(documentId) {
+        if (Is.undefined(this._didResolutionCache)) {
+            return this.loadOwnDocument(documentId);
+        }
+        const identityDocument = await this._didResolutionCache.getOrSet(this.ownDidCacheKey(documentId), async () => this.loadOwnDocument(documentId));
+        return ObjectHelper.clone(identityDocument);
+    }
+    /**
+     * Check whether a credential's status entry or entries report it as revoked.
+     * @param document The issuer document owning the revocation bitmap service.
+     * @param credentialStatus The credential's status entry or entries to check.
+     * @returns True if any entry is reported revoked.
+     * @internal
+     */
+    async checkCredentialStatusRevoked(document, credentialStatus) {
+        let statuses = [];
+        if (Is.array(credentialStatus)) {
+            statuses = credentialStatus;
+        }
+        else if (Is.object(credentialStatus)) {
+            statuses = [credentialStatus];
+        }
+        for (const status of statuses) {
+            if (await this.checkRevocation(document, status.revocationBitmapIndex)) {
+                return true;
+            }
+        }
+        return false;
+    }
     /**
      * Check if a revocation index is revoked.
      * @param document The document to check.
@@ -1129,20 +1198,18 @@ export class EntityStorageIdentityConnector {
      * @internal
      */
     async checkRevocation(document, revocationBitmapIndex) {
-        if (Is.stringValue(revocationBitmapIndex)) {
-            const revocationIndex = Coerce.number(revocationBitmapIndex);
-            if (Is.number(revocationIndex)) {
-                const revocationService = document.service?.find(s => s.id.endsWith("#revocation"));
-                if (revocationService &&
-                    Is.string(revocationService.serviceEndpoint) &&
-                    revocationService.type === "BitstringStatusList") {
-                    const revocationParts = revocationService.serviceEndpoint.split(",");
-                    if (revocationParts.length === 2) {
-                        const compressedRevocationBytes = Converter.base64UrlToBytes(revocationParts[1]);
-                        const decompressed = await Compression.decompress(compressedRevocationBytes, CompressionType.Gzip);
-                        const bitString = BitString.fromBits(decompressed, EntityStorageIdentityConnector._REVOCATION_BITS_SIZE);
-                        return bitString.getBit(revocationIndex);
-                    }
+        const revocationIndex = Coerce.number(revocationBitmapIndex);
+        if (Is.number(revocationIndex)) {
+            const revocationService = document.service?.find(s => s.id.endsWith("#revocation"));
+            if (revocationService &&
+                Is.string(revocationService.serviceEndpoint) &&
+                revocationService.type === "BitstringStatusList") {
+                const revocationParts = revocationService.serviceEndpoint.split(",");
+                if (revocationParts.length === 2) {
+                    const compressedRevocationBytes = Converter.base64UrlToBytes(revocationParts[1]);
+                    const decompressed = await Compression.decompress(compressedRevocationBytes, CompressionType.Gzip);
+                    const bitString = BitString.fromBits(decompressed, EntityStorageIdentityConnector._REVOCATION_BITS_SIZE);
+                    return bitString.getBit(revocationIndex);
                 }
             }
         }
@@ -1159,12 +1226,14 @@ export class EntityStorageIdentityConnector {
         const stringifiedDocument = JsonHelper.canonicalize(didDocument);
         const docBytes = Converter.utf8ToBytes(stringifiedDocument);
         const signature = await this._vaultConnector.sign(EntityStorageIdentityConnector.buildVaultKey(didDocument.id, "did"), docBytes);
-        await this._didDocumentEntityStorage.set({
+        const identityDocument = {
             id: didDocument.id,
             document: didDocument,
             signature: Converter.bytesToBase64(signature),
             controller
-        });
+        };
+        await this._didDocumentEntityStorage.set(identityDocument);
+        this._didResolutionCache?.set(this.ownDidCacheKey(didDocument.id), ObjectHelper.clone(identityDocument));
     }
 }
 //# sourceMappingURL=entityStorageIdentityConnector.js.map