@twin.org/identity-service 0.9.1 → 0.9.2-next.10

package/dist/es/identityService.js

@@ -1,9 +1,14 @@
 // Copyright 2024 IOTA Stiftung.
 // SPDX-License-Identifier: Apache-2.0.
-import { ComponentFactory, GeneralError, Guards, Is, Urn } from "@twin.org/core";
-import { DocumentHelper, IdentityConnectorFactory, IdentityMetricIds, IdentityMetrics } from "@twin.org/identity-models";
+import { HealthCategory, HealthStatus } from "@twin.org/api-models";
+import { ContextIdKeys, ContextIdStore } from "@twin.org/context";
+import { BaseError, ComponentFactory, GeneralError, Guards, Is, Urn } from "@twin.org/core";
+import { AccountHelper } from "@twin.org/dlt-account";
+import { DocumentHelper, IdentityConnectorFactory, IdentityMetricIds, IdentitySpanAttributes, IdentitySpanNames, IdentityMetrics, IdentityResolverConnectorFactory } from "@twin.org/identity-models";
 import { DidVerificationMethodType, ProofTypes } from "@twin.org/standards-w3c-did";
 import { MetricHelper } from "@twin.org/telemetry-models";
+import { TracingHelper } from "@twin.org/tracing-models";
+import { VaultConnectorFactory } from "@twin.org/vault-models";
 import { Jwt } from "@twin.org/web";
 /**
  * Class which implements the identity contract.
@@ -18,11 +23,21 @@ export class IdentityService {
      * @internal
      */
     _defaultNamespace;
+    /**
+     * The vault connector type used for mnemonic migration during health check init.
+     * @internal
+     */
+    _vaultConnector;
     /**
      * The telemetry component.
      * @internal
      */
     _telemetryComponent;
+    /**
+     * The optional tracing component for recording spans.
+     * @internal
+     */
+    _tracingComponent;
     /**
      * Create a new instance of IdentityService.
      * @param options The options for the service.
@@ -34,7 +49,9 @@ export class IdentityService {
             throw new GeneralError(IdentityService.CLASS_NAME, "noConnectors");
         }
         this._defaultNamespace = options?.config?.defaultNamespace ?? names[0];
+        this._vaultConnector = VaultConnectorFactory.get(options?.vaultConnectorType ?? "vault");
         this._telemetryComponent = ComponentFactory.getIfExists(options?.telemetryComponentType);
+        this._tracingComponent = ComponentFactory.getIfExists(options?.tracingComponentType);
     }
     /**
      * Returns the class name of the component.
@@ -53,6 +70,109 @@ export class IdentityService {
         }
         await MetricHelper.createMetrics(this._telemetryComponent, IdentityMetrics);
     }
+    /**
+     * Creates a temporary DID document for the application health check.
+     * @param contextIds The context IDs accumulated by prior init steps.
+     */
+    async healthApplicationInit(contextIds) {
+        // The wallet service has already setup a temporary controller DID mnemonic for the health check
+        // so we can use that to create a new document and add a verification method to it.
+        const controller = contextIds[ContextIdKeys.Organization];
+        if (!Is.stringValue(controller)) {
+            return;
+        }
+        try {
+            const connector = this.getConnectorByNamespace();
+            const doc = await connector.createDocument(controller);
+            await connector.addVerificationMethod(controller, doc.id, DidVerificationMethodType.AssertionMethod, "health-assertion");
+            // The original seed/mnemonic/keys were created with the temp orgId
+            // so we need to migrate them to the new document id so that the health check can resolve the DID.
+            await AccountHelper.renameAccountKeys(undefined, this._vaultConnector, controller, doc.id);
+            // Replace the updated contextIds with the new document id for the health check.
+            contextIds[ContextIdKeys.Organization] = doc.id;
+        }
+        catch { }
+    }
+    /**
+     * Returns the application health status of the identity service by resolving the DID created
+     * in healthApplicationInit.
+     * @param callback Callback for deferred results.
+     * @returns The health status of the service.
+     */
+    async healthApplication(callback) {
+        const contextIds = (await ContextIdStore.getContextIds()) ?? {};
+        const orgDid = contextIds[ContextIdKeys.Organization];
+        if (!Is.stringValue(orgDid)) {
+            return [
+                {
+                    source: IdentityService.CLASS_NAME,
+                    category: HealthCategory.Application,
+                    status: HealthStatus.Error,
+                    description: "healthDescription",
+                    message: "createDocumentFailed",
+                    data: {
+                        did: orgDid
+                    }
+                }
+            ];
+        }
+        try {
+            const resolverConnector = IdentityResolverConnectorFactory.getIfExists(this._defaultNamespace);
+            if (!Is.undefined(resolverConnector)) {
+                const resolved = await resolverConnector.resolveDocument(orgDid);
+                return [
+                    {
+                        source: IdentityService.CLASS_NAME,
+                        category: HealthCategory.Application,
+                        status: Is.object(resolved) ? HealthStatus.Ok : HealthStatus.Error,
+                        description: "healthDescription",
+                        message: Is.object(resolved) ? undefined : "resolveDocumentFailed",
+                        data: { did: orgDid }
+                    }
+                ];
+            }
+            return [
+                {
+                    source: IdentityService.CLASS_NAME,
+                    category: HealthCategory.Application,
+                    status: HealthStatus.Ok,
+                    description: "healthDescription",
+                    data: { did: orgDid }
+                }
+            ];
+        }
+        catch (error) {
+            return [
+                {
+                    source: IdentityService.CLASS_NAME,
+                    category: HealthCategory.Application,
+                    status: HealthStatus.Error,
+                    description: "healthDescription",
+                    message: "resolveDocumentFailed",
+                    data: { did: orgDid },
+                    error: BaseError.fromError(error)
+                }
+            ];
+        }
+    }
+    /**
+     * Removes the DID document created in healthApplicationInit.
+     */
+    async healthApplicationTeardown() {
+        const contextIds = await ContextIdStore.getContextIds();
+        const orgId = contextIds?.[ContextIdKeys.Organization];
+        if (!Is.stringValue(orgId)) {
+            return;
+        }
+        try {
+            const connector = this.getConnectorByNamespace();
+            await connector.removeVerificationMethod(orgId, `${orgId}#health-assertion`, {
+                removeKeys: true
+            });
+            await connector.removeDocument(orgId, orgId);
+        }
+        catch { }
+    }
     /**
      * Create a new identity.
      * @param namespace The namespace of the connector to use for the identity, defaults to service configured namespace.
@@ -61,36 +181,42 @@ export class IdentityService {
      */
     async identityCreate(namespace, controller) {
         Guards.stringValue(IdentityService.CLASS_NAME, "controller", controller);
-        try {
-            const identityConnector = this.getConnectorByNamespace(namespace);
-            const result = await identityConnector.createDocument(controller);
-            await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.DidsCreated, {
-                namespace: namespace ?? this._defaultNamespace
-            });
-            return result;
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "identityCreateFailed", undefined, error);
-        }
+        return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.Create, undefined, async () => {
+            try {
+                const identityConnector = this.getConnectorByNamespace(namespace);
+                const result = await identityConnector.createDocument(controller);
+                await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.DidsCreated, {
+                    namespace: namespace ?? this._defaultNamespace
+                });
+                return result;
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "identityCreateFailed", undefined, error);
+            }
+        });
     }
     /**
      * Remove an identity.
      * @param identity The id of the document to remove.
+     * @param options Optional settings.
+     * @param options.removeKeys Also remove any associated private keys from the vault.
      * @param controller The controller of the identity who can make changes.
      * @returns A promise that resolves when the identity has been removed.
      */
-    async identityRemove(identity, controller) {
+    async identityRemove(identity, options, controller) {
         Guards.stringValue(IdentityService.CLASS_NAME, "identity", identity);
         Guards.stringValue(IdentityService.CLASS_NAME, "controller", controller);
-        try {
-            const identityConnector = this.getConnectorByUri(identity);
-            const result = await identityConnector.removeDocument(controller, identity);
-            await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.DidsRemoved);
-            return result;
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "identityRemoveFailed", { identity }, error);
-        }
+        return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.Remove, { attributes: { [IdentitySpanAttributes.Id]: identity } }, async () => {
+            try {
+                const identityConnector = this.getConnectorByUri(identity);
+                const result = await identityConnector.removeDocument(controller, identity, options);
+                await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.DidsRemoved);
+                return result;
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "identityRemoveFailed", { identity }, error);
+            }
+        });
     }
     /**
      * Add a verification method to the document in JSON Web key Format.
@@ -106,34 +232,40 @@ export class IdentityService {
         Guards.stringValue(IdentityService.CLASS_NAME, "controller", controller);
         Urn.guard(IdentityService.CLASS_NAME, "identity", identity);
         Guards.arrayOneOf(IdentityService.CLASS_NAME, "verificationMethodType", verificationMethodType, Object.values(DidVerificationMethodType));
-        try {
-            const identityConnector = this.getConnectorByUri(identity);
-            const verificationMethod = await identityConnector.addVerificationMethod(controller, identity, verificationMethodType, verificationMethodId);
-            return verificationMethod;
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "verificationMethodCreateFailed", { identity }, error);
-        }
+        return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.VerificationMethodCreate, { attributes: { [IdentitySpanAttributes.Id]: identity } }, async () => {
+            try {
+                const identityConnector = this.getConnectorByUri(identity);
+                const verificationMethod = await identityConnector.addVerificationMethod(controller, identity, verificationMethodType, verificationMethodId);
+                return verificationMethod;
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "verificationMethodCreateFailed", { identity }, error);
+            }
+        });
     }
     /**
      * Remove a verification method from the document.
      * @param verificationMethodId The id of the verification method.
+     * @param options Optional settings.
+     * @param options.removeKeys Also remove any associated private key from the vault.
      * @param controller The controller of the identity who can make changes.
      * @returns A promise that resolves when the verification method has been removed.
      * @throws NotFoundError if the id can not be resolved.
      * @throws NotSupportedError if the platform does not support multiple revocable keys.
      */
-    async verificationMethodRemove(verificationMethodId, controller) {
+    async verificationMethodRemove(verificationMethodId, options, controller) {
         Guards.stringValue(IdentityService.CLASS_NAME, "controller", controller);
         Urn.guard(IdentityService.CLASS_NAME, "verificationMethodId", verificationMethodId);
-        try {
-            const idParts = DocumentHelper.parseId(verificationMethodId);
-            const identityConnector = this.getConnectorByUri(idParts.id);
-            await identityConnector.removeVerificationMethod(controller, verificationMethodId);
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "verificationMethodRemoveFailed", { verificationMethodId }, error);
-        }
+        await TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.VerificationMethodRemove, { attributes: { [IdentitySpanAttributes.VerificationMethodId]: verificationMethodId } }, async () => {
+            try {
+                const idParts = DocumentHelper.parseId(verificationMethodId);
+                const identityConnector = this.getConnectorByUri(idParts.id);
+                await identityConnector.removeVerificationMethod(controller, verificationMethodId, options);
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "verificationMethodRemoveFailed", { verificationMethodId }, error);
+            }
+        });
     }
     /**
      * Add a service to the document.
@@ -161,14 +293,16 @@ export class IdentityService {
         else {
             Guards.stringValue(IdentityService.CLASS_NAME, "serviceEndpoint", serviceEndpoint);
         }
-        try {
-            const identityConnector = this.getConnectorByUri(identity);
-            const service = await identityConnector.addService(controller, identity, serviceId, serviceType, serviceEndpoint);
-            return service;
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "serviceCreateFailed", { identity, serviceId }, error);
-        }
+        return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.ServiceCreate, { attributes: { [IdentitySpanAttributes.Id]: identity } }, async () => {
+            try {
+                const identityConnector = this.getConnectorByUri(identity);
+                const service = await identityConnector.addService(controller, identity, serviceId, serviceType, serviceEndpoint);
+                return service;
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "serviceCreateFailed", { identity, serviceId }, error);
+            }
+        });
     }
     /**
      * Remove a service from the document.
@@ -180,14 +314,16 @@ export class IdentityService {
     async serviceRemove(serviceId, controller) {
         Guards.stringValue(IdentityService.CLASS_NAME, "controller", controller);
         Urn.guard(IdentityService.CLASS_NAME, "serviceId", serviceId);
-        try {
-            const idParts = DocumentHelper.parseId(serviceId);
-            const identityConnector = this.getConnectorByUri(idParts.id);
-            await identityConnector.removeService(controller, serviceId);
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "serviceRemoveFailed", { serviceId }, error);
-        }
+        await TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.ServiceRemove, { attributes: { [IdentitySpanAttributes.ServiceId]: serviceId } }, async () => {
+            try {
+                const idParts = DocumentHelper.parseId(serviceId);
+                const identityConnector = this.getConnectorByUri(idParts.id);
+                await identityConnector.removeService(controller, serviceId);
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "serviceRemoveFailed", { serviceId }, error);
+            }
+        });
     }
     /**
      * Add an alias to the alsoKnownAs property on the document.
@@ -203,14 +339,16 @@ export class IdentityService {
         Guards.stringValue(IdentityService.CLASS_NAME, "controller", controller);
         Guards.stringValue(IdentityService.CLASS_NAME, "documentId", documentId);
         Guards.stringValue(IdentityService.CLASS_NAME, "alias", alias);
-        try {
-            const idParts = DocumentHelper.parseId(documentId);
-            const identityConnector = this.getConnectorByUri(idParts.id);
-            await identityConnector.addAlsoKnownAs(controller, documentId, alias);
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "alsoKnownAsAddFailed", { identity: documentId, alias }, error);
-        }
+        await TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.AlsoKnownAsAdd, { attributes: { [IdentitySpanAttributes.Id]: documentId } }, async () => {
+            try {
+                const idParts = DocumentHelper.parseId(documentId);
+                const identityConnector = this.getConnectorByUri(idParts.id);
+                await identityConnector.addAlsoKnownAs(controller, documentId, alias);
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "alsoKnownAsAddFailed", { identity: documentId, alias }, error);
+            }
+        });
     }
     /**
      * Remove an alias from the alsoKnownAs property on the document.
@@ -226,14 +364,16 @@ export class IdentityService {
         Guards.stringValue(IdentityService.CLASS_NAME, "controller", controller);
         Guards.stringValue(IdentityService.CLASS_NAME, "documentId", documentId);
         Guards.stringValue(IdentityService.CLASS_NAME, "alias", alias);
-        try {
-            const idParts = DocumentHelper.parseId(documentId);
-            const identityConnector = this.getConnectorByUri(idParts.id);
-            await identityConnector.removeAlsoKnownAs(controller, documentId, alias);
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "alsoKnownAsRemoveFailed", { identity: documentId, alias }, error);
-        }
+        await TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.AlsoKnownAsRemove, { attributes: { [IdentitySpanAttributes.Id]: documentId } }, async () => {
+            try {
+                const idParts = DocumentHelper.parseId(documentId);
+                const identityConnector = this.getConnectorByUri(idParts.id);
+                await identityConnector.removeAlsoKnownAs(controller, documentId, alias);
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "alsoKnownAsRemoveFailed", { identity: documentId, alias }, error);
+            }
+        });
     }
     /**
      * Create a verifiable credential for a verification method.
@@ -253,19 +393,21 @@ export class IdentityService {
         Guards.stringValue(IdentityService.CLASS_NAME, "controller", controller);
         Urn.guard(IdentityService.CLASS_NAME, "verificationMethodId", verificationMethodId);
         Guards.object(IdentityService.CLASS_NAME, "subject", subject);
-        try {
-            const idParts = DocumentHelper.parseId(verificationMethodId);
-            const identityConnector = this.getConnectorByUri(idParts.id);
-            const service = await identityConnector.createVerifiableCredential(controller, verificationMethodId, id, subject, options);
-            await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsCreated, {
-                hasRevocation: Is.number(options?.revocationIndex),
-                hasExpiration: Is.date(options?.expirationDate)
-            });
-            return service;
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "verifiableCredentialCreateFailed", { verificationMethodId }, error);
-        }
+        return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.VerifiableCredentialCreate, { attributes: { [IdentitySpanAttributes.VerificationMethodId]: verificationMethodId } }, async () => {
+            try {
+                const idParts = DocumentHelper.parseId(verificationMethodId);
+                const identityConnector = this.getConnectorByUri(idParts.id);
+                const service = await identityConnector.createVerifiableCredential(controller, verificationMethodId, id, subject, options);
+                await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsCreated, {
+                    hasRevocation: Is.number(options?.revocationIndex),
+                    hasExpiration: Is.date(options?.expirationDate)
+                });
+                return service;
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "verifiableCredentialCreateFailed", { verificationMethodId }, error);
+            }
+        });
     }
     /**
      * Verify a verifiable credential is valid.
@@ -277,20 +419,24 @@ export class IdentityService {
             Guards.objectValue(IdentityService.CLASS_NAME, "credential", credential);
             Guards.stringValue(IdentityService.CLASS_NAME, "credential.issuer", credential.issuer);
             Guards.objectValue(IdentityService.CLASS_NAME, "credential.proof", credential.proof);
-            try {
-                const identityConnector = this.getConnectorByUri(credential.issuer);
-                const service = await identityConnector.checkVerifiableCredential(credential);
-                if (service.revoked) {
-                    await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsVerificationFailed, { failureReason: "revoked" });
+            const issuer = credential.issuer;
+            const verifiableCredential = credential;
+            return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.VerifiableCredentialVerify, undefined, async () => {
+                try {
+                    const identityConnector = this.getConnectorByUri(issuer);
+                    const service = await identityConnector.checkVerifiableCredential(verifiableCredential);
+                    if (service.revoked) {
+                        await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsVerificationFailed, { failureReason: "revoked" });
+                    }
+                    else {
+                        await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsVerified);
+                    }
+                    return service;
                 }
-                else {
-                    await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsVerified);
+                catch (error) {
+                    throw new GeneralError(IdentityService.CLASS_NAME, "verifiableCredentialVerifyFailed", undefined, error);
                 }
-                return service;
-            }
-            catch (error) {
-                throw new GeneralError(IdentityService.CLASS_NAME, "verifiableCredentialVerifyFailed", undefined, error);
-            }
+            });
         }
         Guards.stringValue(IdentityService.CLASS_NAME, "credential", credential);
         const jwtDecoded = await Jwt.decode(credential);
@@ -303,20 +449,23 @@ export class IdentityService {
             Is.undefined(jwtSignature)) {
             throw new GeneralError(IdentityService.CLASS_NAME, "jwtDecodeFailed");
         }
-        try {
-            const identityConnector = this.getConnectorByUri(jwtPayload.iss);
-            const service = await identityConnector.checkVerifiableCredential(credential);
-            if (service.revoked) {
-                await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsVerificationFailed, { failureReason: "revoked" });
+        const issuer = jwtPayload.iss;
+        return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.VerifiableCredentialVerify, undefined, async () => {
+            try {
+                const identityConnector = this.getConnectorByUri(issuer);
+                const service = await identityConnector.checkVerifiableCredential(credential);
+                if (service.revoked) {
+                    await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsVerificationFailed, { failureReason: "revoked" });
+                }
+                else {
+                    await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsVerified);
+                }
+                return service;
             }
-            else {
-                await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsVerified);
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "verifiableCredentialVerifyFailed", undefined, error);
             }
-            return service;
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "verifiableCredentialVerifyFailed", undefined, error);
-        }
+        });
     }
     /**
      * Revoke verifiable credential.
@@ -329,16 +478,18 @@ export class IdentityService {
         Guards.stringValue(IdentityService.CLASS_NAME, "controller", controller);
         Guards.stringValue(IdentityService.CLASS_NAME, "issuerIdentity", issuerIdentity);
         Guards.number(IdentityService.CLASS_NAME, "credentialIndex", credentialIndex);
-        try {
-            const idParts = DocumentHelper.parseId(issuerIdentity);
-            const identityConnector = this.getConnectorByUri(idParts.id);
-            const result = await identityConnector.revokeVerifiableCredentials(controller, issuerIdentity, [credentialIndex]);
-            await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsRevoked);
-            return result;
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "verifiableCredentialRevokeFailed", { issuerIdentity, credentialIndex }, error);
-        }
+        return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.VerifiableCredentialRevoke, { attributes: { [IdentitySpanAttributes.Id]: issuerIdentity } }, async () => {
+            try {
+                const idParts = DocumentHelper.parseId(issuerIdentity);
+                const identityConnector = this.getConnectorByUri(idParts.id);
+                const result = await identityConnector.revokeVerifiableCredentials(controller, issuerIdentity, [credentialIndex]);
+                await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsRevoked);
+                return result;
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "verifiableCredentialRevokeFailed", { issuerIdentity, credentialIndex }, error);
+            }
+        });
     }
     /**
      * Unrevoke verifiable credential.
@@ -351,16 +502,18 @@ export class IdentityService {
         Guards.stringValue(IdentityService.CLASS_NAME, "controller", controller);
         Guards.stringValue(IdentityService.CLASS_NAME, "issuerIdentity", issuerIdentity);
         Guards.number(IdentityService.CLASS_NAME, "credentialIndex", credentialIndex);
-        try {
-            const idParts = DocumentHelper.parseId(issuerIdentity);
-            const identityConnector = this.getConnectorByUri(idParts.id);
-            const result = await identityConnector.unrevokeVerifiableCredentials(controller, issuerIdentity, [credentialIndex]);
-            await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsUnrevoked);
-            return result;
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "verifiableCredentialUnrevokeFailed", { issuerIdentity, credentialIndex }, error);
-        }
+        return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.VerifiableCredentialUnrevoke, { attributes: { [IdentitySpanAttributes.Id]: issuerIdentity } }, async () => {
+            try {
+                const idParts = DocumentHelper.parseId(issuerIdentity);
+                const identityConnector = this.getConnectorByUri(idParts.id);
+                const result = await identityConnector.unrevokeVerifiableCredentials(controller, issuerIdentity, [credentialIndex]);
+                await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VcsUnrevoked);
+                return result;
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "verifiableCredentialUnrevokeFailed", { issuerIdentity, credentialIndex }, error);
+            }
+        });
     }
     /**
      * Create a verifiable presentation from the supplied verifiable credentials.
@@ -380,18 +533,20 @@ export class IdentityService {
     async verifiablePresentationCreate(verificationMethodId, presentationId, contexts, types, verifiableCredentials, options, controller) {
         Guards.stringValue(IdentityService.CLASS_NAME, "controller", controller);
         Guards.stringValue(IdentityService.CLASS_NAME, "verificationMethodId", verificationMethodId);
-        try {
-            const idParts = DocumentHelper.parseId(verificationMethodId);
-            const identityConnector = this.getConnectorByUri(idParts.id);
-            const result = await identityConnector.createVerifiablePresentation(controller, verificationMethodId, presentationId, contexts, types, verifiableCredentials, options);
-            await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VpsCreated, {
-                credentialCount: verifiableCredentials.length
-            });
-            return result;
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "verifiablePresentationCreateFailed", { verificationMethodId }, error);
-        }
+        return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.VerifiablePresentationCreate, { attributes: { [IdentitySpanAttributes.VerificationMethodId]: verificationMethodId } }, async () => {
+            try {
+                const idParts = DocumentHelper.parseId(verificationMethodId);
+                const identityConnector = this.getConnectorByUri(idParts.id);
+                const result = await identityConnector.createVerifiablePresentation(controller, verificationMethodId, presentationId, contexts, types, verifiableCredentials, options);
+                await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VpsCreated, {
+                    credentialCount: verifiableCredentials.length
+                });
+                return result;
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "verifiablePresentationCreateFailed", { verificationMethodId }, error);
+            }
+        });
     }
     /**
      * Verify a verifiable presentation is valid.
@@ -418,20 +573,22 @@ export class IdentityService {
             holder = presentation.holder;
         }
         Guards.stringValue(IdentityService.CLASS_NAME, "holder", holder);
-        try {
-            const identityConnector = this.getConnectorByUri(holder);
-            const service = await identityConnector.checkVerifiablePresentation(presentation);
-            if (service.revoked) {
-                await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VpsVerificationFailed, { failureReason: "revoked" });
+        return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.VerifiablePresentationVerify, undefined, async () => {
+            try {
+                const identityConnector = this.getConnectorByUri(holder);
+                const service = await identityConnector.checkVerifiablePresentation(presentation);
+                if (service.revoked) {
+                    await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VpsVerificationFailed, { failureReason: "revoked" });
+                }
+                else {
+                    await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VpsVerified);
+                }
+                return service;
             }
-            else {
-                await MetricHelper.metricIncrement(this._telemetryComponent, IdentityMetricIds.VpsVerified);
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "verifiablePresentationVerifyFailed", undefined, error);
             }
-            return service;
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "verifiablePresentationVerifyFailed", undefined, error);
-        }
+        });
     }
     /**
      * Create a proof for a document with the specified verification method.
@@ -446,15 +603,17 @@ export class IdentityService {
         Guards.stringValue(IdentityService.CLASS_NAME, "verificationMethodId", verificationMethodId);
         Guards.arrayOneOf(IdentityService.CLASS_NAME, "proofType", proofType, Object.values(ProofTypes));
         Guards.object(IdentityService.CLASS_NAME, "unsecureDocument", unsecureDocument);
-        try {
-            const idParts = DocumentHelper.parseId(verificationMethodId);
-            const identityConnector = this.getConnectorByUri(idParts.id);
-            const result = await identityConnector.createProof(controller, verificationMethodId, proofType, unsecureDocument);
-            return result;
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "proofCreateFailed", { verificationMethodId }, error);
-        }
+        return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.ProofCreate, { attributes: { [IdentitySpanAttributes.VerificationMethodId]: verificationMethodId } }, async () => {
+            try {
+                const idParts = DocumentHelper.parseId(verificationMethodId);
+                const identityConnector = this.getConnectorByUri(idParts.id);
+                const result = await identityConnector.createProof(controller, verificationMethodId, proofType, unsecureDocument);
+                return result;
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "proofCreateFailed", { verificationMethodId }, error);
+            }
+        });
     }
     /**
      * Verify proof for a document with the specified verification method.
@@ -466,15 +625,18 @@ export class IdentityService {
         Guards.object(IdentityService.CLASS_NAME, "document", document);
         Guards.object(IdentityService.CLASS_NAME, "proof", proof);
         Guards.stringValue(IdentityService.CLASS_NAME, "proof.verificationMethod", proof.verificationMethod);
-        try {
-            const idParts = DocumentHelper.parseId(proof.verificationMethod);
-            const identityConnector = this.getConnectorByUri(idParts.id);
-            const result = await identityConnector.verifyProof(document, proof);
-            return result;
-        }
-        catch (error) {
-            throw new GeneralError(IdentityService.CLASS_NAME, "proofVerifyFailed", undefined, error);
-        }
+        const verificationMethod = proof.verificationMethod;
+        return TracingHelper.withSpan(this._tracingComponent, IdentitySpanNames.ProofVerify, undefined, async () => {
+            try {
+                const idParts = DocumentHelper.parseId(verificationMethod);
+                const identityConnector = this.getConnectorByUri(idParts.id);
+                const result = await identityConnector.verifyProof(document, proof);
+                return result;
+            }
+            catch (error) {
+                throw new GeneralError(IdentityService.CLASS_NAME, "proofVerifyFailed", undefined, error);
+            }
+        });
     }
     /**
      * Get the connector from the namespace.