@velocitycareerlabs/server-careerwallet 1.25.0-dev-build.12642c864

package/test/jwt-controller.test.js

@@ -0,0 +1,1519 @@
+const AWS = require('aws-sdk');
+const { ObjectId } = require('mongodb');
+const { omit } = require('lodash/fp');
+const { nanoid } = require('nanoid');
+const { generateKeyPair } = require('@velocitycareerlabs/crypto');
+const {
+  jwtSign,
+  jwtDecode,
+  generateDocJwt,
+  hexFromJwk,
+  jwtVerify,
+  verifyPresentationJwt,
+  stringifyJwk,
+  jwkFromStringified,
+} = require('@velocitycareerlabs/jwt');
+const { getDidUriFromJwk } = require('@velocitycareerlabs/did-doc');
+const {
+  generateKeyPairInHexAndJwk,
+  errorResponseMatcher,
+} = require('@velocitycareerlabs/tests-helpers');
+const { mongoDb } = require('@spencejs/spence-mongo-repos');
+const { formatISODuration } = require('date-fns');
+const buildFastify = require('./helpers/careerwallet-build-fastify');
+const initKeyPairsRepo = require('../src/entities/key-pairs/repos/key-pairs.repo');
+const initDevicesFactory = require('./factories/devices-factory');
+const keyPairsFactory = require('./factories/key-pairs-factory');
+const accountsFactory = require('./factories/accounts-factory');
+const {
+  missingAccessTokenExpectation,
+  incorrectAccessTokenExpectation,
+  incorrectScopeExpectation,
+} = require('./helpers/access-token');
+
+const expectedHeader = {
+  header: {
+    alg: 'ES256K',
+    jwk: {
+      crv: 'secp256k1',
+      kty: 'EC',
+      use: 'sig',
+      x: expect.any(String),
+      y: expect.any(String),
+    },
+    typ: 'JWT',
+  },
+};
+
+const expected400ResponsePayloadStatusCodeAndError = {
+  statusCode: 400,
+  error: 'Bad Request',
+};
+
+const buildUrl = () => '/jwt';
+describe('JWT Controller Test Suite', () => {
+  const aliasName = 'alias/my-key-alias';
+
+  let fastify;
+
+  let privateKey;
+  let privateJwk;
+  let publicJwk;
+
+  let persistKeyPairs;
+  let persistDevices;
+  let persistAccounts;
+
+  let testClient;
+  let keyPairsRepo;
+
+  let validBearer;
+  let withoutScopeBearer;
+
+  let privk;
+  let publicKey;
+
+  beforeAll(async () => {
+    testClient = new AWS.KMS({
+      credentials: new AWS.Credentials('tests-kei-id', 'tests-key'),
+      region: 'us-west-1',
+      endpoint: 'http://localhost:4566',
+    });
+
+    const createKeyResponse = await testClient.createKey().promise();
+    const createAliasParams = {
+      AliasName: aliasName,
+      TargetKeyId: createKeyResponse.KeyMetadata.Arn,
+    };
+    await testClient.createAlias(createAliasParams).promise();
+    ({ publicKey, privateKey: privk } = generateKeyPair({ format: 'jwk' }));
+    fastify = await buildFastify({
+      holderAppServerAccessTokenPublicKey: publicKey,
+      holderAppServerAccessTokenSigningKey: hexFromJwk(privk),
+      awsRegion: 'us-west-1',
+      awsEndpoint: 'http://localhost:4566',
+      oauthVerificationDisabledEndpoints: [
+        'POST:/jwt/verify',
+        'POST:/jwt/decode',
+        'POST:/jwt/sign',
+      ],
+      managedAccountsKeyId: aliasName,
+    });
+    await fastify.ready();
+    ({ privateKey, privateJwk, publicJwk } = generateKeyPairInHexAndJwk());
+    ({ persistKeyPairs } = keyPairsFactory(fastify));
+    ({ persistDevices } = initDevicesFactory(fastify));
+    ({ persistAccounts } = accountsFactory(fastify));
+    keyPairsRepo = initKeyPairsRepo(fastify)({
+      log: fastify.log,
+      config: fastify.config,
+    });
+
+    validBearer = await generateDocJwt(
+      { scope: 'jwt test key:create', sub: 'abc' },
+      privk
+    );
+    withoutScopeBearer = await generateDocJwt(
+      { scope: 'test', sub: 'abc' },
+      privk
+    );
+  });
+
+  beforeEach(async () => {
+    await mongoDb().collection('keyPairs').deleteMany({});
+    await mongoDb().collection('accounts').deleteMany({});
+  });
+
+  afterAll(async () => {
+    await testClient.deleteAlias({ AliasName: aliasName }).promise();
+    await fastify.close();
+  });
+
+  describe('Access Token verification disabled', () => {
+    describe('/jwt', () => {
+      describe('JWT Decoding Tests', () => {
+        it('should decode a jwt', async () => {
+          const obj = {
+            field1: 'value1',
+          };
+          const jwtString = await generateDocJwt(obj, privateKey);
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/decode`,
+            payload: {
+              jwt: jwtString,
+            },
+          });
+
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            payload: {
+              ...obj,
+              iat: expect.any(Number),
+              nbf: expect.any(Number),
+            },
+            ...expectedHeader,
+          });
+        });
+
+        it('should fail to decode a malformed jwt', async () => {
+          const obj = {
+            field1: 'value1',
+          };
+          const jwtString = await generateDocJwt(obj, privateKey);
+          const malformedJwtString = `asd${jwtString}`;
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/decode`,
+            payload: {
+              jwt: malformedJwtString,
+            },
+          });
+          expect(response.statusCode).toEqual(500);
+          expect(response.json).toEqual(
+            errorResponseMatcher({
+              statusCode: 500,
+              error: 'Internal Server Error',
+              message: 'Invalid Token or Protected Header formatting',
+              errorCode: 'missing_error_code',
+            })
+          );
+        });
+      });
+
+      describe('JWT Signing Tests', () => {
+        it('should sign a jwt with options: issuer, audience, subject, expiresIn', async () => {
+          const issuerValue = nanoid();
+          const audienceValue = nanoid();
+          const subjectValue = nanoid();
+          const durationObj = { days: 7 };
+          const expiresInValue = formatISODuration(durationObj);
+          const obj = {
+            field1: 'value1',
+          };
+          const options = {
+            issuer: issuerValue,
+            audience: audienceValue,
+            subject: subjectValue,
+            expiresIn: expiresInValue,
+          };
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/sign`,
+            payload: {
+              payload: obj,
+              options,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          const decodedJwt = jwtDecode(response.json.jwt);
+          expect(decodedJwt).toEqual({
+            payload: {
+              ...obj,
+              sub: subjectValue,
+              aud: audienceValue,
+              iss: issuerValue,
+              jti: expect.any(String),
+              iat: expect.any(Number),
+              nbf: expect.any(Number),
+              exp: expect.any(Number),
+            },
+            ...expectedHeader,
+          });
+        });
+
+        it('should sign a jwt with options: issuer, audience, subject', async () => {
+          const issuerValue = nanoid();
+          const audienceValue = nanoid();
+          const subjectValue = nanoid();
+          const obj = {
+            field1: 'value1',
+          };
+          const options = {
+            issuer: issuerValue,
+            audience: audienceValue,
+            subject: subjectValue,
+          };
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/sign`,
+            payload: {
+              payload: obj,
+              options,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          const decodedJwt = jwtDecode(response.json.jwt);
+          expect(decodedJwt).toEqual({
+            payload: {
+              ...obj,
+              sub: subjectValue,
+              aud: audienceValue,
+              iss: issuerValue,
+              jti: expect.any(String),
+              iat: expect.any(Number),
+              nbf: expect.any(Number),
+              exp: undefined,
+            },
+            ...expectedHeader,
+          });
+        });
+
+        it('should sign a jwt with options: issuer, subject, expiresIn', async () => {
+          const durationObj = { days: 7 };
+          const issuerValue = nanoid();
+          const subjectValue = nanoid();
+          const expiresInValue = formatISODuration(durationObj);
+          const obj = {
+            field1: 'value1',
+          };
+          const options = {
+            issuer: issuerValue,
+            subject: subjectValue,
+            expiresIn: expiresInValue,
+          };
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/sign`,
+            payload: {
+              payload: obj,
+              options,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          const decodedJwt = jwtDecode(response.json.jwt);
+          expect(decodedJwt).toEqual({
+            payload: {
+              ...obj,
+              sub: subjectValue,
+              aud: undefined,
+              iss: issuerValue,
+              jti: expect.any(String),
+              iat: expect.any(Number),
+              nbf: expect.any(Number),
+              exp: expect.any(Number),
+            },
+            ...expectedHeader,
+          });
+        });
+
+        it('should sign a jwt with just the required options: issuer and subject', async () => {
+          const issuerValue = nanoid();
+          const subjectValue = nanoid();
+          const obj = {
+            field1: 'value1',
+          };
+          const options = {
+            issuer: issuerValue,
+            subject: subjectValue,
+          };
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/sign`,
+            payload: {
+              payload: obj,
+              options,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          const decodedJwt = jwtDecode(response.json.jwt);
+          expect(decodedJwt).toEqual({
+            payload: {
+              ...obj,
+              sub: subjectValue,
+              aud: undefined,
+              iss: issuerValue,
+              jti: expect.any(String),
+              iat: expect.any(Number),
+              nbf: expect.any(Number),
+              exp: undefined,
+            },
+            ...expectedHeader,
+          });
+        });
+
+        it('should fail to sign with missing required option: subject', async () => {
+          const issuerValue = nanoid();
+          const obj = {
+            field1: 'value1',
+          };
+          const options = {
+            issuer: issuerValue,
+          };
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/sign`,
+            payload: {
+              payload: obj,
+              options,
+            },
+          });
+          expect(response.statusCode).toEqual(400);
+          expect(response.json).toEqual(
+            errorResponseMatcher({
+              ...expected400ResponsePayloadStatusCodeAndError,
+              message: "body/options must have required property 'subject'",
+              errorCode: 'request_validation_failed',
+            })
+          );
+        });
+
+        it('should fail to sign with missing required option: issuer', async () => {
+          const subjectValue = nanoid();
+          const obj = {
+            field1: 'value1',
+          };
+          const options = {
+            subject: subjectValue,
+          };
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/sign`,
+            payload: {
+              payload: obj,
+              options,
+            },
+          });
+          expect(response.statusCode).toEqual(400);
+          expect(response.json).toEqual(
+            errorResponseMatcher({
+              ...expected400ResponsePayloadStatusCodeAndError,
+              message: "body/options must have required property 'issuer'",
+              errorCode: 'request_validation_failed',
+            })
+          );
+        });
+
+        it('should fail to sign a jwt with no options', async () => {
+          const obj = {
+            field1: 'value1',
+          };
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/sign`,
+            payload: {
+              payload: obj,
+            },
+          });
+          expect(response.statusCode).toEqual(400);
+          expect(response.json).toEqual(
+            errorResponseMatcher({
+              ...expected400ResponsePayloadStatusCodeAndError,
+              message: "body must have required property 'options'",
+              errorCode: 'request_validation_failed',
+            })
+          );
+        });
+
+        it('should fail to sign with missing payload', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/sign`,
+            payload: {},
+          });
+          expect(response.statusCode).toEqual(400);
+          expect(response.json).toEqual(
+            errorResponseMatcher({
+              ...expected400ResponsePayloadStatusCodeAndError,
+              message: "body must have required property 'payload'",
+              errorCode: 'request_validation_failed',
+            })
+          );
+        });
+      });
+
+      describe('JWT Verification Tests', () => {
+        it('should verify a jwt using an explicit public key', async () => {
+          const obj = {
+            field1: 'value1',
+          };
+          const jwt = await jwtSign(obj, privateJwk);
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/verify`,
+            payload: {
+              jwt,
+              publicKey: publicJwk,
+            },
+          });
+
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            verified: true,
+          });
+        });
+
+        it('should verify a jwt using a public key as a jwt header jwk', async () => {
+          const obj = {
+            field1: 'value1',
+          };
+          const jwt = await generateDocJwt(obj, privateKey);
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/verify`,
+            payload: {
+              jwt,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            verified: true,
+          });
+        });
+
+        it('should fail to verify a jwt using the wrong public key', async () => {
+          const obj = {
+            field1: 'value1',
+          };
+          const { publicJwk: wrongPublicJwk } = generateKeyPairInHexAndJwk();
+          const jwt = await jwtSign(obj, privateJwk);
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/verify`,
+            payload: {
+              jwt,
+              publicKey: wrongPublicJwk,
+            },
+          });
+
+          expect(response.json).toEqual({
+            verified: false,
+            error:
+              'JWSSignatureVerificationFailed: signature verification failed',
+          });
+        });
+
+        it('verification should 400 with no public key', async () => {
+          const obj = {
+            field1: 'value1',
+          };
+          const jwt = await jwtSign(obj, privateJwk);
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/verify`,
+            payload: {
+              jwt,
+            },
+          });
+          expect(response.statusCode).toEqual(400);
+          expect(response.json).toEqual(
+            errorResponseMatcher({
+              ...expected400ResponsePayloadStatusCodeAndError,
+              message: 'Public key is missing',
+              errorCode: 'missing_error_code',
+            })
+          );
+        });
+
+        it('verification should 200 with an error with a malformed public key', async () => {
+          const obj = {
+            field1: 'value1',
+          };
+          const jwt = await jwtSign(obj, privateJwk);
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/verify`,
+            payload: {
+              jwt,
+              publicKey: omit('x', publicJwk),
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            verified: false,
+            error: expect.any(String),
+          });
+        });
+      });
+    });
+  });
+
+  describe('Access Token verification enabled', () => {
+    beforeAll(async () => {
+      fastify.overrides.reqConfig = (config) => ({
+        ...config,
+        oauthVerificationDisabledEndpoints: [], // enabled for all endpoints
+      });
+    });
+
+    describe('/api/v0.6/jwt', () => {
+      const api = '/api/v0.6/jwt';
+
+      describe('sign jwt test suite', () => {
+        it('should fail to sign a jwt with missing payload in body', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {},
+            },
+            headers: {
+              authorization: `Bearer ${validBearer}`,
+            },
+          });
+          expect(response.statusCode).toEqual(400);
+          expect(response.json).toEqual(
+            errorResponseMatcher({
+              error: 'Bad Request',
+              errorCode: 'request_validation_failed',
+              message: "body must have required property 'payload'",
+              statusCode: 400,
+            })
+          );
+        });
+
+        it('should fail to sign a jwt with empty keyId in options', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {},
+              payload: {},
+              options: {
+                keyId: '',
+              },
+            },
+            headers: {
+              authorization: `Bearer ${validBearer}`,
+            },
+          });
+          expect(response.statusCode).toEqual(400);
+          expect(response.json).toEqual(
+            errorResponseMatcher({
+              error: 'Bad Request',
+              errorCode: 'request_validation_failed',
+              message:
+                // eslint-disable-next-line max-len
+                "body/options must have required property 'kid', body/options/keyId must NOT have fewer than 1 characters, body/options must match exactly one schema in oneOf",
+              statusCode: 400,
+            })
+          );
+        });
+
+        it('should fail to sign a jwt with empty kid in options', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {},
+              payload: {},
+              options: {
+                kid: '',
+              },
+            },
+            headers: {
+              authorization: `Bearer ${validBearer}`,
+            },
+          });
+          expect(response.statusCode).toEqual(400);
+          expect(response.json).toEqual(
+            errorResponseMatcher({
+              error: 'Bad Request',
+              errorCode: 'request_validation_failed',
+              message:
+                // eslint-disable-next-line max-len
+                "body/options/kid must NOT have fewer than 1 characters, body/options must have required property 'keyId', body/options must match exactly one schema in oneOf",
+              statusCode: 400,
+            })
+          );
+        });
+
+        it('should fail to sign a jwt when no access token is provided', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {},
+              payload: {},
+              options: {
+                keyId: 'abc',
+              },
+            },
+          });
+
+          missingAccessTokenExpectation(response);
+        });
+
+        it('should fail to sign a jwt when incorrect access token is provided', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {},
+
+              payload: {},
+              options: {
+                keyId: 'abc',
+              },
+            },
+            headers: {
+              authorization: 'Bearer incorrect_access_token',
+            },
+          });
+
+          incorrectAccessTokenExpectation(response);
+        });
+
+        it('should fail to sign a jwt when incorrect scope is provided', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            headers: {
+              authorization: `Bearer ${withoutScopeBearer}`,
+            },
+          });
+
+          incorrectScopeExpectation(response);
+        });
+
+        it('should fail when a key pair could not be found by kid', async () => {
+          const { publicKey: pubK } = generateKeyPair({
+            curve: 'P-256',
+            format: 'jwk',
+          });
+          const didJwk = getDidUriFromJwk(pubK);
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {},
+              payload: {
+                abc: 'abv',
+              },
+              options: {
+                kid: didJwk,
+              },
+            },
+            headers: {
+              Authorization: `Bearer ${validBearer}`,
+            },
+          });
+          expect(response.statusCode).toEqual(400);
+          expect(response.json).toEqual(
+            errorResponseMatcher({
+              error: 'Bad Request',
+              errorCode: 'invalid_kid',
+              message: 'Key pair not found',
+              statusCode: 400,
+            })
+          );
+        });
+
+        it('should fail when a key pair could not be found by keyId', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {},
+              payload: {
+                abc: 'abv',
+              },
+              options: {
+                keyId: new ObjectId().toString(),
+              },
+            },
+            headers: {
+              Authorization: `Bearer ${validBearer}`,
+            },
+          });
+          expect(response.statusCode).toEqual(400);
+          expect(response.json).toEqual(
+            errorResponseMatcher({
+              error: 'Bad Request',
+              errorCode: 'invalid_key_id',
+              message: 'Key pair not found',
+              statusCode: 400,
+            })
+          );
+        });
+
+        it('should throw error if account does not have key', async () => {
+          const { publicKey: pubK, privateKey: pk } = generateKeyPair({
+            curve: 'P-256',
+            format: 'jwk',
+          });
+          const params = {
+            KeyId: fastify.config.managedAccountsKeyId,
+            Plaintext: stringifyJwk(pk),
+          };
+          const { CiphertextBlob } = await testClient.encrypt(params).promise();
+          const keyPairDb = await persistKeyPairs({
+            encryptedPrivateKey: CiphertextBlob,
+            publicKey: pubK,
+          });
+          const account = await persistAccounts({
+            didKeyMetadatum: [],
+          });
+          validBearer = await generateDocJwt(
+            { scope: 'jwt test key:create', sub: account._id.toString() },
+            privk
+          );
+          const response1 = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {},
+              payload: {
+                abc: 'abv',
+              },
+              options: {
+                keyId: keyPairDb._id.toString(),
+              },
+            },
+            headers: {
+              Authorization: `Bearer ${validBearer}`,
+            },
+          });
+          const response2 = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {},
+              payload: {
+                abc: 'abv',
+              },
+              options: {
+                kid: getDidUriFromJwk(pubK),
+              },
+            },
+            headers: {
+              Authorization: `Bearer ${validBearer}`,
+            },
+          });
+          expect(response1.statusCode).toEqual(400);
+          expect(response1.json).toEqual(
+            errorResponseMatcher({
+              error: 'Bad Request',
+              errorCode: 'invalid_key_id',
+              message: 'Key pair not found',
+              statusCode: 400,
+            })
+          );
+          expect(response2.statusCode).toEqual(400);
+          expect(response2.json).toEqual(
+            errorResponseMatcher({
+              error: 'Bad Request',
+              errorCode: 'invalid_kid',
+              message: 'Key pair not found',
+              statusCode: 400,
+            })
+          );
+        });
+
+        it('should sign a jwt with keyId', async () => {
+          const { publicKey: pubK, privateKey: pk } = generateKeyPair({
+            curve: 'P-256',
+            format: 'jwk',
+          });
+          const params = {
+            KeyId: fastify.config.managedAccountsKeyId,
+            Plaintext: stringifyJwk(pk),
+          };
+          const { CiphertextBlob } = await testClient.encrypt(params).promise();
+          const keyPairDb = await persistKeyPairs({
+            encryptedPrivateKey: CiphertextBlob,
+            publicKey: pubK,
+          });
+          const account = await persistAccounts({
+            didKeyMetadatum: [
+              {
+                kid: getDidUriFromJwk(pubK),
+                keyId: new ObjectId(keyPairDb._id),
+              },
+            ],
+          });
+          validBearer = await generateDocJwt(
+            { scope: 'jwt test key:create', sub: account._id.toString() },
+            privk
+          );
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {},
+              payload: {
+                abc: 'abv',
+              },
+              options: {
+                keyId: keyPairDb._id.toString(),
+              },
+            },
+            headers: {
+              Authorization: `Bearer ${validBearer}`,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            compactJwt: expect.any(String),
+          });
+          const keyPair = await keyPairsRepo.findOne({
+            filter: {
+              _id: keyPairDb._id,
+            },
+          });
+          const decryptedPrivateKey = await testClient
+            .decrypt({
+              CiphertextBlob: Buffer.from(keyPair.encryptedPrivateKey.buffer),
+            })
+            .promise();
+
+          const { payload } = await jwtVerify(
+            response.json.compactJwt,
+            jwkFromStringified(decryptedPrivateKey.Plaintext.toString())
+          );
+          expect(payload.abc).toEqual('abv');
+        });
+
+        it('should sign a jwt with keyId of a specific account when token has admin scope', async () => {
+          const { publicKey: pubK, privateKey: pk } = generateKeyPair({
+            curve: 'P-256',
+            format: 'jwk',
+          });
+          const params = {
+            KeyId: fastify.config.managedAccountsKeyId,
+            Plaintext: stringifyJwk(pk),
+          };
+          const { CiphertextBlob } = await testClient.encrypt(params).promise();
+          const keyPairDb = await persistKeyPairs({
+            encryptedPrivateKey: CiphertextBlob,
+            publicKey: pubK,
+          });
+          await persistAccounts({
+            didKeyMetadatum: [
+              {
+                kid: getDidUriFromJwk(pubK),
+                keyId: new ObjectId(keyPairDb._id),
+              },
+            ],
+          });
+          validBearer = await generateDocJwt(
+            { scope: 'jwt test key:create admin:client', sub: 'not-the-user' },
+            privk
+          );
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {},
+              payload: {
+                abc: 'abv',
+              },
+              options: {
+                keyId: keyPairDb._id.toString(),
+              },
+            },
+            headers: {
+              Authorization: `Bearer ${validBearer}`,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            compactJwt: expect.any(String),
+          });
+          const keyPair = await keyPairsRepo.findOne({
+            filter: {
+              _id: keyPairDb._id,
+            },
+          });
+          const decryptedPrivateKey = await testClient
+            .decrypt({
+              CiphertextBlob: Buffer.from(keyPair.encryptedPrivateKey.buffer),
+            })
+            .promise();
+
+          const { payload } = await jwtVerify(
+            response.json.compactJwt,
+            jwkFromStringified(decryptedPrivateKey.Plaintext.toString())
+          );
+          expect(payload.abc).toEqual('abv');
+        });
+
+        it('should sign a jwt and verify P-256', async () => {
+          const payload = {
+            vp: {
+              presentation_submission: {
+                descriptor_map: [],
+                definition_id:
+                  '65d4f928ffbbda0ea32d159c.634e5620fe258ef4580d3c63',
+                id: 'B424D9E8-4773-49EC-8B66-1D22EACBE848',
+              },
+            },
+          };
+          const { publicKey: pubK, privateKey: pk } = generateKeyPair({
+            curve: 'P-256',
+            format: 'jwk',
+          });
+          const params = {
+            KeyId: fastify.config.managedAccountsKeyId,
+            Plaintext: stringifyJwk(pk),
+          };
+          const { CiphertextBlob } = await testClient.encrypt(params).promise();
+          const keyPairDb = await persistKeyPairs({
+            encryptedPrivateKey: CiphertextBlob,
+            publicKey: pubK,
+          });
+          const account = await persistAccounts({
+            didKeyMetadatum: [
+              {
+                kid: getDidUriFromJwk(pubK),
+                keyId: new ObjectId(keyPairDb._id),
+              },
+            ],
+          });
+          validBearer = await generateDocJwt(
+            { scope: 'jwt test key:create', sub: account._id.toString() },
+            privk
+          );
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {
+                jwk: pubK,
+              },
+              payload,
+              options: {
+                keyId: keyPairDb._id.toString(),
+              },
+            },
+            headers: {
+              Authorization: `Bearer ${validBearer}`,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            compactJwt: expect.any(String),
+          });
+          const presentation = await verifyPresentationJwt(
+            response.json.compactJwt
+          );
+          expect(presentation.presentation_submission).toEqual(
+            payload.vp.presentation_submission
+          );
+        });
+
+        it('should sign a jwt and verify secp256k1', async () => {
+          const payload = {
+            vp: {
+              presentation_submission: {
+                descriptor_map: [],
+                definition_id:
+                  '65d4f928ffbbda0ea32d159c.634e5620fe258ef4580d3c63',
+                id: 'B424D9E8-4773-49EC-8B66-1D22EACBE848',
+              },
+            },
+          };
+          const { publicKey: pubK, privateKey: pk } = generateKeyPair({
+            curve: 'secp256k1',
+            format: 'jwk',
+          });
+          const params = {
+            KeyId: fastify.config.managedAccountsKeyId,
+            Plaintext: stringifyJwk(pk),
+          };
+          const { CiphertextBlob } = await testClient.encrypt(params).promise();
+          const keyPairDb = await persistKeyPairs({
+            encryptedPrivateKey: CiphertextBlob,
+            publicKey: pubK,
+          });
+          const account = await persistAccounts({
+            didKeyMetadatum: [
+              {
+                kid: getDidUriFromJwk(pubK),
+                keyId: new ObjectId(keyPairDb._id),
+              },
+            ],
+          });
+          validBearer = await generateDocJwt(
+            { scope: 'jwt test key:create', sub: account._id.toString() },
+            privk
+          );
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {
+                jwk: pubK,
+              },
+              payload,
+              options: {
+                keyId: keyPairDb._id.toString(),
+              },
+            },
+            headers: {
+              Authorization: `Bearer ${validBearer}`,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            compactJwt: expect.any(String),
+          });
+          const presentation = await verifyPresentationJwt(
+            response.json.compactJwt
+          );
+          expect(presentation.presentation_submission).toEqual(
+            payload.vp.presentation_submission
+          );
+        });
+
+        it('should sign a jwt with kid', async () => {
+          const { publicKey: pubK, privateKey: pk } = generateKeyPair({
+            curve: 'P-256',
+            format: 'jwk',
+          });
+          const params = {
+            KeyId: fastify.config.managedAccountsKeyId,
+            Plaintext: stringifyJwk(pk),
+          };
+          const { CiphertextBlob } = await testClient.encrypt(params).promise();
+          const keyPairDb = await persistKeyPairs({
+            encryptedPrivateKey: CiphertextBlob,
+            publicKey: pubK,
+          });
+
+          const didJwk = getDidUriFromJwk(pubK);
+          const account = await persistAccounts({
+            didKeyMetadatum: [
+              {
+                kid: getDidUriFromJwk(pubK),
+                keyId: keyPairDb._id,
+              },
+            ],
+          });
+          validBearer = await generateDocJwt(
+            { scope: 'jwt test key:create', sub: account._id.toString() },
+            privk
+          );
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {},
+              payload: {
+                abc: 'abv',
+              },
+              options: {
+                kid: didJwk,
+              },
+            },
+            headers: {
+              Authorization: `Bearer ${validBearer}`,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            compactJwt: expect.any(String),
+          });
+
+          const keyPair = await keyPairsRepo.findOne({
+            filter: {
+              _id: keyPairDb._id,
+            },
+          });
+          const decryptedPrivateKey = await testClient
+            .decrypt({
+              CiphertextBlob: Buffer.from(keyPair.encryptedPrivateKey.buffer),
+            })
+            .promise();
+          const { payload } = await jwtVerify(
+            response.json.compactJwt,
+            jwkFromStringified(decryptedPrivateKey.Plaintext.toString())
+          );
+          expect(payload.abc).toEqual('abv');
+        });
+
+        it('Onboarding new account should successfully sign a jwt with P-256 curv', async () => {
+          const deviceId = nanoid();
+          await persistDevices({ deviceId });
+          const accountResponse = await fastify.injectJson({
+            method: 'POST',
+            url: '/api/v0.6/accounts',
+            payload: {
+              account: {
+                accountType: 'temp',
+                device: {
+                  deviceId,
+                  deviceType: 'phone',
+                  deviceOS: 'ios',
+                },
+              },
+            },
+          });
+          expect(accountResponse.statusCode).toEqual(200);
+
+          const didKeyResponse = await fastify.injectJson({
+            method: 'POST',
+            url: '/api/v0.6/create_did_key',
+            payload: {
+              crv: 'P-256',
+            },
+            headers: {
+              Authorization: `Bearer ${accountResponse.json.access_token}`,
+            },
+          });
+          expect(didKeyResponse.statusCode).toEqual(200);
+
+          const refreshResponse = await fastify.injectJson({
+            method: 'POST',
+            url: '/api/v0.6/oauth/token',
+            payload: {
+              grant_type: 'refresh_token',
+              client_id: 'abc',
+              scope: 'jwt',
+              audience: 'walletapi.velocitycareerlabs.io',
+              refresh_token: accountResponse.json.refresh_token,
+            },
+          });
+          expect(refreshResponse.statusCode).toEqual(200);
+
+          const payload = {
+            vp: {
+              presentation_submission: {
+                descriptor_map: [],
+                definition_id:
+                  '65d4f928ffbbda0ea32d159c.634e5620fe258ef4580d3c63',
+                id: 'B424D9E8-4773-49EC-8B66-1D22EACBE848',
+              },
+            },
+          };
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {
+                jwk: didKeyResponse.json.publicJwk,
+                kid: didKeyResponse.json.kid,
+              },
+              payload,
+              options: {
+                keyId: didKeyResponse.json.keyId,
+              },
+            },
+            headers: {
+              Authorization: `Bearer ${refreshResponse.json.access_token}`,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            compactJwt: expect.any(String),
+          });
+          const presentation = await verifyPresentationJwt(
+            response.json.compactJwt
+          );
+          expect(presentation.presentation_submission).toEqual(
+            payload.vp.presentation_submission
+          );
+        });
+
+        it('Onboarding new account should successfully sign a jwt with secp256k1 curv', async () => {
+          const deviceId = nanoid();
+          await persistDevices({ deviceId });
+          const accountResponse = await fastify.injectJson({
+            method: 'POST',
+            url: '/api/v0.6/accounts',
+            payload: {
+              account: {
+                accountType: 'temp',
+                device: {
+                  deviceId,
+                  deviceType: 'phone',
+                  deviceOS: 'ios',
+                },
+              },
+            },
+          });
+          expect(accountResponse.statusCode).toEqual(200);
+
+          const didKeyResponse = await fastify.injectJson({
+            method: 'POST',
+            url: '/api/v0.6/create_did_key',
+            payload: {
+              crv: 'secp256k1',
+            },
+            headers: {
+              Authorization: `Bearer ${accountResponse.json.access_token}`,
+            },
+          });
+          expect(didKeyResponse.statusCode).toEqual(200);
+
+          const refreshResponse = await fastify.injectJson({
+            method: 'POST',
+            url: '/api/v0.6/oauth/token',
+            payload: {
+              grant_type: 'refresh_token',
+              client_id: 'abc',
+              scope: 'jwt',
+              audience: 'walletapi.velocitycareerlabs.io',
+              refresh_token: accountResponse.json.refresh_token,
+            },
+          });
+          expect(refreshResponse.statusCode).toEqual(200);
+
+          const payload = {
+            vp: {
+              presentation_submission: {
+                descriptor_map: [],
+                definition_id:
+                  '65d4f928ffbbda0ea32d159c.634e5620fe258ef4580d3c63',
+                id: 'B424D9E8-4773-49EC-8B66-1D22EACBE848',
+              },
+            },
+          };
+          const account = await persistAccounts({
+            didKeyMetadatum: [
+              {
+                kid: didKeyResponse.json.kid,
+                keyId: didKeyResponse.json.keyId,
+              },
+            ],
+          });
+          validBearer = await generateDocJwt(
+            { scope: 'jwt test key:create', sub: account._id.toString() },
+            privk
+          );
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${api}/sign`,
+            payload: {
+              header: {
+                jwk: didKeyResponse.json.publicJwk,
+                kid: didKeyResponse.json.kid,
+              },
+              payload,
+              options: {
+                keyId: didKeyResponse.json.keyId,
+              },
+            },
+            headers: {
+              Authorization: `Bearer ${refreshResponse.json.access_token}`,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            compactJwt: expect.any(String),
+          });
+          const presentation = await verifyPresentationJwt(
+            response.json.compactJwt
+          );
+          expect(presentation.presentation_submission).toEqual(
+            payload.vp.presentation_submission
+          );
+        });
+      });
+    });
+
+    describe('/jwt', () => {
+      describe('JWT Decoding Tests', () => {
+        it('should decode a jwt if correct access token is provided', async () => {
+          const obj = {
+            field1: 'value1',
+          };
+          const jwtString = await generateDocJwt(obj, privateKey);
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/decode`,
+            payload: {
+              jwt: jwtString,
+            },
+            headers: {
+              authorization: `Bearer ${validBearer}`,
+            },
+          });
+
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            payload: {
+              ...obj,
+              iat: expect.any(Number),
+              nbf: expect.any(Number),
+            },
+            ...expectedHeader,
+          });
+        });
+
+        it('should return 401 when no access token is provided', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/decode`,
+          });
+
+          missingAccessTokenExpectation(response);
+        });
+
+        it('should return 401 when incorrect access token is provided', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/decode`,
+            headers: {
+              authorization: 'Bearer incorrect_access_token',
+            },
+          });
+
+          incorrectAccessTokenExpectation(response);
+        });
+
+        it('should return 403 when incorrect scope is provided', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/decode`,
+            headers: {
+              authorization: `Bearer ${withoutScopeBearer}`,
+            },
+          });
+
+          incorrectScopeExpectation(response);
+        });
+      });
+
+      describe('JWT Signing Tests', () => {
+        it('should sign a jwt with options if correct access token is provided', async () => {
+          const issuerValue = nanoid();
+          const audienceValue = nanoid();
+          const subjectValue = nanoid();
+          const durationObj = { days: 7 };
+          const expiresInValue = formatISODuration(durationObj);
+          const obj = {
+            field1: 'value1',
+          };
+          const options = {
+            issuer: issuerValue,
+            audience: audienceValue,
+            subject: subjectValue,
+            expiresIn: expiresInValue,
+          };
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/sign`,
+            payload: {
+              payload: obj,
+              options,
+            },
+            headers: {
+              authorization: `Bearer ${validBearer}`,
+            },
+          });
+          expect(response.statusCode).toEqual(200);
+          const decodedJwt = jwtDecode(response.json.jwt);
+          expect(decodedJwt).toEqual({
+            payload: {
+              ...obj,
+              sub: subjectValue,
+              aud: audienceValue,
+              iss: issuerValue,
+              jti: expect.any(String),
+              iat: expect.any(Number),
+              nbf: expect.any(Number),
+              exp: expect.any(Number),
+            },
+            ...expectedHeader,
+          });
+        });
+
+        it('should return 401 when no access token is provided', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/sign`,
+          });
+
+          missingAccessTokenExpectation(response);
+        });
+
+        it('should return 401 when incorrect access token is provided', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/sign`,
+            headers: {
+              authorization: 'Bearer incorrect_access_token',
+            },
+          });
+
+          incorrectAccessTokenExpectation(response);
+        });
+
+        it('should return 403 when incorrect scope is provided', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/sign`,
+            headers: {
+              authorization: `Bearer ${withoutScopeBearer}`,
+            },
+          });
+
+          incorrectScopeExpectation(response);
+        });
+      });
+
+      describe('JWT Verification Tests', () => {
+        it('should verify a jwt using an explicit public key if correct access token is provided', async () => {
+          const obj = {
+            field1: 'value1',
+          };
+          const jwt = await jwtSign(obj, privateJwk);
+
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/verify`,
+            payload: {
+              jwt,
+              publicKey: publicJwk,
+            },
+            headers: {
+              authorization: `Bearer ${validBearer}`,
+            },
+          });
+
+          expect(response.statusCode).toEqual(200);
+          expect(response.json).toEqual({
+            verified: true,
+          });
+        });
+
+        it('should return 401 when no access token is provided', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/verify`,
+          });
+
+          missingAccessTokenExpectation(response);
+        });
+
+        it('should return 401 when incorrect access token is provided', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/verify`,
+            headers: {
+              authorization: 'Bearer incorrect_access_token',
+            },
+          });
+
+          incorrectAccessTokenExpectation(response);
+        });
+
+        it('should return 403 when incorrect scope is provided', async () => {
+          const response = await fastify.injectJson({
+            method: 'POST',
+            url: `${buildUrl()}/verify`,
+            headers: {
+              authorization: `Bearer ${withoutScopeBearer}`,
+            },
+          });
+
+          incorrectScopeExpectation(response);
+        });
+      });
+    });
+  });
+});