@veramo/credential-ld 3.1.1-next.8

package/src/action-handler.ts

@@ -0,0 +1,229 @@
+import {
+  CredentialPayload,
+  IAgentContext,
+  IAgentPlugin,
+  IIdentifier,
+  IKey,
+  IResolver,
+  PresentationPayload,
+  VerifiableCredential,
+  VerifiablePresentation,
+} from '@veramo/core'
+import { schema, VeramoLdSignature } from './'
+import Debug from 'debug'
+import { LdContextLoader } from './ld-context-loader'
+import {
+  _ExtendedIKey,
+  extractIssuer,
+  isDefined,
+  MANDATORY_CREDENTIAL_CONTEXT,
+  mapIdentifierKeysToDoc,
+  OrPromise,
+  processEntryToArray,
+  RecordLike,
+} from '@veramo/utils'
+
+import { LdCredentialModule } from './ld-credential-module'
+import { LdSuiteLoader } from './ld-suite-loader'
+import {
+  ContextDoc,
+  ICreateVerifiableCredentialLDArgs,
+  ICreateVerifiablePresentationLDArgs,
+  ICredentialIssuerLD,
+  IRequiredContext,
+  IVerifyCredentialLDArgs,
+  IVerifyPresentationLDArgs,
+} from './types'
+
+const debug = Debug('veramo:w3c:action-handler')
+
+/**
+ * A Veramo plugin that implements the {@link ICredentialIssuerLD} methods.
+ *
+ * @public
+ */
+export class CredentialIssuerLD implements IAgentPlugin {
+  readonly methods: ICredentialIssuerLD
+  readonly schema = schema.ICredentialIssuer
+
+  private ldCredentialModule: LdCredentialModule
+
+  constructor(options: { contextMaps: RecordLike<OrPromise<ContextDoc>>[]; suites: VeramoLdSignature[] }) {
+    this.ldCredentialModule = new LdCredentialModule({
+      ldContextLoader: new LdContextLoader({ contextsPaths: options.contextMaps }),
+      ldSuiteLoader: new LdSuiteLoader({ veramoLdSignatures: options.suites }),
+    })
+
+    this.methods = {
+      createVerifiablePresentationLD: this.createVerifiablePresentationLD.bind(this),
+      createVerifiableCredentialLD: this.createVerifiableCredentialLD.bind(this),
+      verifyCredentialLD: this.verifyCredentialLD.bind(this),
+      verifyPresentationLD: this.verifyPresentationLD.bind(this),
+    }
+  }
+
+  /** {@inheritdoc ICredentialIssuerLD.createVerifiablePresentationLD} */
+  public async createVerifiablePresentationLD(
+    args: ICreateVerifiablePresentationLDArgs,
+    context: IRequiredContext,
+  ): Promise<VerifiablePresentation> {
+    const presentationContext = processEntryToArray(
+      args?.presentation?.['@context'],
+      MANDATORY_CREDENTIAL_CONTEXT,
+    )
+    const presentationType = processEntryToArray(args?.presentation?.type, 'VerifiablePresentation')
+
+    const presentation: PresentationPayload = {
+      ...args?.presentation,
+      '@context': presentationContext,
+      type: presentationType,
+    }
+
+    if (!isDefined(presentation.holder)) {
+      throw new Error('invalid_argument: args.presentation.holder must not be empty')
+    }
+
+    if (args.presentation.verifiableCredential) {
+      const credentials = args.presentation.verifiableCredential.map((cred) => {
+        if (typeof cred !== 'string' && cred.proof.jwt) {
+          return cred.proof.jwt
+        } else {
+          return cred
+        }
+      })
+      presentation.verifiableCredential = credentials
+    }
+
+    //issuanceDate must not be present for presentations because it is not defined in a @context
+    delete presentation.issuanceDate
+
+    let identifier: IIdentifier
+    try {
+      identifier = await context.agent.didManagerGet({ did: presentation.holder })
+    } catch (e) {
+      throw new Error('invalid_argument: args.presentation.holder must be a DID managed by this agent')
+    }
+    try {
+      const { signingKey, verificationMethodId } = await this.findSigningKeyWithId(
+        context,
+        identifier,
+        args.keyRef,
+      )
+
+      return await this.ldCredentialModule.signLDVerifiablePresentation(
+        presentation,
+        identifier.did,
+        signingKey,
+        verificationMethodId,
+        args.challenge,
+        args.domain,
+        context,
+      )
+    } catch (error) {
+      debug(error)
+      return Promise.reject(error)
+    }
+  }
+
+  /** {@inheritdoc ICredentialIssuerLD.createVerifiableCredentialLD} */
+  public async createVerifiableCredentialLD(
+    args: ICreateVerifiableCredentialLDArgs,
+    context: IRequiredContext,
+  ): Promise<VerifiableCredential> {
+    const credentialContext = processEntryToArray(
+      args?.credential?.['@context'],
+      MANDATORY_CREDENTIAL_CONTEXT,
+    )
+    const credentialType = processEntryToArray(args?.credential?.type, 'VerifiableCredential')
+    let issuanceDate = args?.credential?.issuanceDate || new Date().toISOString()
+    if (issuanceDate instanceof Date) {
+      issuanceDate = issuanceDate.toISOString()
+    }
+    const credential: CredentialPayload = {
+      ...args?.credential,
+      '@context': credentialContext,
+      type: credentialType,
+      issuanceDate,
+    }
+
+    const issuer = extractIssuer(credential)
+    if (!issuer || typeof issuer === 'undefined') {
+      throw new Error('invalid_argument: args.credential.issuer must not be empty')
+    }
+
+    let identifier: IIdentifier
+    try {
+      identifier = await context.agent.didManagerGet({ did: issuer })
+    } catch (e) {
+      throw new Error(`invalid_argument: args.credential.issuer must be a DID managed by this agent. ${e}`)
+    }
+    try {
+      const { signingKey, verificationMethodId } = await this.findSigningKeyWithId(
+        context,
+        identifier,
+        args.keyRef,
+      )
+
+      return await this.ldCredentialModule.issueLDVerifiableCredential(
+        credential,
+        identifier.did,
+        signingKey,
+        verificationMethodId,
+        context,
+      )
+    } catch (error) {
+      debug(error)
+      return Promise.reject(error)
+    }
+  }
+
+  /** {@inheritdoc ICredentialIssuerLD.verifyCredentialLD} */
+  public async verifyCredentialLD(
+    args: IVerifyCredentialLDArgs,
+    context: IRequiredContext,
+  ): Promise<boolean> {
+    const credential = args.credential
+    return this.ldCredentialModule.verifyCredential(credential, context)
+  }
+
+  /** {@inheritdoc ICredentialIssuerLD.verifyPresentationLD} */
+  public async verifyPresentationLD(
+    args: IVerifyPresentationLDArgs,
+    context: IRequiredContext,
+  ): Promise<boolean> {
+    const presentation = args.presentation
+    return this.ldCredentialModule.verifyPresentation(presentation, args.challenge, args.domain, context)
+  }
+
+  private async findSigningKeyWithId(
+    context: IAgentContext<IResolver>,
+    identifier: IIdentifier,
+    keyRef?: string,
+  ): Promise<{ signingKey: IKey; verificationMethodId: string }> {
+    const extendedKeys: _ExtendedIKey[] = await mapIdentifierKeysToDoc(identifier, 'assertionMethod', context)
+    let supportedTypes = this.ldCredentialModule.ldSuiteLoader.getAllSignatureSuiteTypes()
+    let signingKey: _ExtendedIKey | undefined
+    let verificationMethodId: string
+    if (keyRef) {
+      signingKey = extendedKeys.find((k) => k.kid === keyRef)
+    }
+    if (signingKey && !supportedTypes.includes(signingKey.meta.verificationMethod.type)) {
+      debug(
+        'WARNING: requested signing key DOES NOT correspond to a supported Signature suite type. Looking for the next best key.',
+      )
+      signingKey = undefined
+    }
+    if (!signingKey) {
+      if (keyRef) {
+        debug(
+          'WARNING: no signing key was found that matches the reference provided. Searching for the first available signing key.',
+        )
+      }
+      signingKey = extendedKeys.find((k) => supportedTypes.includes(k.meta.verificationMethod.type))
+    }
+
+    if (!signingKey) throw Error(`key_not_found: No suitable signing key found for ${identifier.did}`)
+    verificationMethodId = signingKey.meta.verificationMethod.id
+    return { signingKey, verificationMethodId }
+  }
+}

package/src/index.ts

@@ -0,0 +1,14 @@
+/**
+ * Provides a {@link @veramo/credential-ld#CredentialIssuerLD | plugin} for the {@link @veramo/core#Agent} that implements
+ * {@link @veramo/credential-ld#ICredentialIssuerLD} interface.
+ *
+ * @packageDocumentation
+ */
+export { CredentialIssuerLD } from './action-handler'
+export * from './types'
+export { LdDefaultContexts } from './ld-default-contexts'
+export { VeramoLdSignature } from './ld-suites'
+export * from './suites/EcdsaSecp256k1RecoverySignature2020'
+export * from './suites/Ed25519Signature2018'
+const schema = require('../plugin.schema.json')
+export { schema }

package/src/ld-context-loader.ts

@@ -0,0 +1,29 @@
+/**
+ * The LdContextLoader is initialized with a List of Map<string, ContextDoc>
+ * that it unifies into a single Map to provide to the documentLoader within
+ * the w3c credential module.
+ */
+import { OrPromise, RecordLike } from '@veramo/utils'
+import { ContextDoc } from './types'
+
+export class LdContextLoader {
+  private contexts: Record<string, OrPromise<ContextDoc>>
+
+  constructor(options: { contextsPaths: RecordLike<OrPromise<ContextDoc>>[] }) {
+    this.contexts = {}
+    // generate-plugin-schema is failing unless we use the cast to `any[]`
+    Array.from(options.contextsPaths as any[], (mapItem) => {
+      for (const [key, value] of mapItem) {
+        this.contexts[key] = value
+      }
+    })
+  }
+
+  has(url: string): boolean {
+    return this.contexts[url] !== null && typeof this.contexts[url] !== 'undefined'
+  }
+
+  async get(url: string): Promise<ContextDoc> {
+    return this.contexts[url]
+  }
+}

package/src/ld-credential-module.ts

@@ -0,0 +1,170 @@
+import {
+  CredentialPayload,
+  IAgentContext,
+  IKey,
+  IResolver,
+  PresentationPayload,
+  VerifiableCredential,
+  VerifiablePresentation,
+} from '@veramo/core'
+import Debug from 'debug'
+import { extendContextLoader, purposes } from 'jsonld-signatures'
+import * as vc from 'vc-js'
+import { LdContextLoader } from './ld-context-loader'
+import { LdSuiteLoader } from './ld-suite-loader'
+import { RequiredAgentMethods } from './ld-suites'
+
+const AssertionProofPurpose = purposes.AssertionProofPurpose
+
+const debug = Debug('veramo:w3c:ld-credential-module')
+
+export class LdCredentialModule {
+  /**
+   * TODO: General Implementation Notes
+   * - (SOLVED) EcdsaSecp256k1Signature2019 (Signature) and EcdsaSecp256k1VerificationKey2019 (Key)
+   * are not useable right now, since they are not able to work with blockChainId and ECRecover.
+   * - DID Fragment Resolution.
+   * - Key Manager and Verification Methods: Veramo currently implements no link between those.
+   */
+
+  private ldContextLoader: LdContextLoader
+  ldSuiteLoader: LdSuiteLoader
+  constructor(options: { ldContextLoader: LdContextLoader; ldSuiteLoader: LdSuiteLoader }) {
+    this.ldContextLoader = options.ldContextLoader
+    this.ldSuiteLoader = options.ldSuiteLoader
+  }
+
+  getDocumentLoader(context: IAgentContext<IResolver>) {
+    return extendContextLoader(async (url: string) => {
+      // console.log(`resolving context for: ${url}`)
+
+      // did resolution
+      if (url.toLowerCase().startsWith('did:')) {
+        const resolutionResult = await context.agent.resolveDid({ didUrl: url })
+        const didDoc = resolutionResult.didDocument
+
+        if (!didDoc) return
+
+        // currently Veramo LD suites can modify the resolution response for DIDs from
+        // the document Loader. This allows to fix incompatibilities between DID Documents
+        // and LD suites to be fixed specifically within the Veramo LD Suites definition
+        this.ldSuiteLoader.getAllSignatureSuites().forEach((x) => x.preDidResolutionModification(url, didDoc))
+
+        // console.log(`Returning from Documentloader: ${JSON.stringify(returnDocument)}`)
+        return {
+          contextUrl: null,
+          documentUrl: url,
+          document: didDoc,
+        }
+      }
+
+      if (this.ldContextLoader.has(url)) {
+        const contextDoc = await this.ldContextLoader.get(url)
+        return {
+          contextUrl: null,
+          documentUrl: url,
+          document: contextDoc,
+        }
+      }
+
+      debug('WARNING: Possible unknown context/identifier for', url)
+      console.log(`WARNING: Possible unknown context/identifier for: ${url}`)
+
+      return vc.defaultDocumentLoader(url)
+    })
+  }
+
+  async issueLDVerifiableCredential(
+    credential: CredentialPayload,
+    issuerDid: string,
+    key: IKey,
+    verificationMethodId: string,
+    context: IAgentContext<RequiredAgentMethods>,
+  ): Promise<VerifiableCredential> {
+    const suite = this.ldSuiteLoader.getSignatureSuiteForKeyType(key.type)
+    const documentLoader = this.getDocumentLoader(context)
+
+    // some suites can modify the incoming credential (e.g. add required contexts)W
+    suite.preSigningCredModification(credential)
+
+    return await vc.issue({
+      credential,
+      suite: suite.getSuiteForSigning(key, issuerDid, verificationMethodId, context),
+      documentLoader,
+      compactProof: false,
+    })
+  }
+
+  async signLDVerifiablePresentation(
+    presentation: PresentationPayload,
+    holderDid: string,
+    key: IKey,
+    verificationMethodId: string,
+    challenge: string | undefined,
+    domain: string | undefined,
+    context: IAgentContext<RequiredAgentMethods>,
+  ): Promise<VerifiablePresentation> {
+    const suite = this.ldSuiteLoader.getSignatureSuiteForKeyType(key.type)
+    const documentLoader = this.getDocumentLoader(context)
+
+    suite.preSigningPresModification(presentation)
+
+    return await vc.signPresentation({
+      presentation,
+      suite: suite.getSuiteForSigning(key, holderDid, verificationMethodId, context),
+      challenge,
+      domain,
+      documentLoader,
+      purpose: new AssertionProofPurpose(),
+      compactProof: false,
+    })
+  }
+
+  async verifyCredential(
+    credential: VerifiableCredential,
+    context: IAgentContext<IResolver>,
+  ): Promise<boolean> {
+    const result = await vc.verifyCredential({
+      credential,
+      suite: this.ldSuiteLoader.getAllSignatureSuites().map((x) => x.getSuiteForVerification()),
+      documentLoader: this.getDocumentLoader(context),
+      purpose: new AssertionProofPurpose(),
+      compactProof: false,
+    })
+
+    if (result.verified) return true
+
+    // NOT verified.
+
+    // result can include raw Error
+    debug(`Error verifying LD Verifiable Credential: ${JSON.stringify(result, null, 2)}`)
+    // console.log(JSON.stringify(result, null, 2));
+    throw Error('Error verifying LD Verifiable Credential')
+  }
+
+  async verifyPresentation(
+    presentation: VerifiablePresentation,
+    challenge: string | undefined,
+    domain: string | undefined,
+    context: IAgentContext<IResolver>,
+  ): Promise<boolean> {
+    const result = await vc.verify({
+      presentation,
+      suite: this.ldSuiteLoader.getAllSignatureSuites().map((x) => x.getSuiteForVerification()),
+      documentLoader: this.getDocumentLoader(context),
+      challenge,
+      domain,
+      purpose: new AssertionProofPurpose(),
+      compactProof: false,
+    })
+
+    if (result.verified) return true
+
+    // NOT verified.
+
+    // result can include raw Error
+    console.log(`Error verifying LD Verifiable Presentation`)
+    console.log(JSON.stringify(result, null, 2))
+    throw Error('Error verifying LD Verifiable Presentation')
+  }
+}

package/src/ld-default-contexts.ts

@@ -0,0 +1,21 @@
+import * as fs from 'fs'
+import * as path from 'path'
+
+function _read(_path: string) {
+  return JSON.parse(fs.readFileSync(path.join(__dirname, '../contexts', _path), { encoding: 'utf8' }))
+}
+
+export const LdDefaultContexts = new Map([
+  ['https://veramo.io/contexts/socialmedia/v1', _read('socialmedia-v1.jsonld')],
+  ['https://veramo.io/contexts/kyc/v1', _read('kyc-v1.jsonld')],
+  ['https://veramo.io/contexts/profile/v1', _read('profile-v1.jsonld')],
+  ['https://www.w3.org/ns/did/v1', _read('security_context_v1.jsonld')],
+  ['https://w3id.org/did/v0.11', _read('did_v0.11.jsonld')],
+  ['https://ns.did.ai/transmute/v1', _read('transmute_v1.jsonld')],
+  [
+    'https://identity.foundation/EcdsaSecp256k1RecoverySignature2020/lds-ecdsa-secp256k1-recovery2020-0.0.jsonld',
+    _read('lds-ecdsa-secp256k1-recovery2020-0.0.jsonld'),
+  ],
+  ['https://w3id.org/security/suites/ed25519-2018/v1', _read('ed25519-signature-2018-v1.jsonld')],
+  ['https://w3id.org/security/suites/x25519-2019/v1', _read('X25519KeyAgreementKey2019.jsonld')],
+])

package/src/ld-suite-loader.ts

@@ -0,0 +1,29 @@
+import { VeramoLdSignature } from './ld-suites'
+import { TKeyType } from '@veramo/core'
+
+/**
+ * Initializes a list of Veramo-wrapped LD Signature suites and exposes those to the Agent Module
+ */
+export class LdSuiteLoader {
+  constructor(options: { veramoLdSignatures: VeramoLdSignature[] }) {
+    options.veramoLdSignatures.forEach((obj) => {
+      this.signatureMap[obj.getSupportedVeramoKeyType()] = obj
+    })
+  }
+  private signatureMap: Record<string, VeramoLdSignature> = {}
+
+  getSignatureSuiteForKeyType(type: TKeyType) {
+    const suite = this.signatureMap[type]
+    if (suite) return suite
+
+    throw new Error('No Veramo LD Signature Suite for ' + type)
+  }
+
+  getAllSignatureSuites() {
+    return Object.values(this.signatureMap)
+  }
+
+  getAllSignatureSuiteTypes() {
+    return Object.values(this.signatureMap).map((x) => x.getSupportedVerificationType())
+  }
+}

package/src/ld-suites.ts

@@ -0,0 +1,45 @@
+import {
+  CredentialPayload,
+  IAgentContext,
+  IKey,
+  IKeyManager,
+  IResolver,
+  PresentationPayload,
+  TKeyType,
+} from '@veramo/core'
+import { DIDDocument } from 'did-resolver/src/resolver'
+
+export type RequiredAgentMethods = IResolver & Pick<IKeyManager, 'keyManagerGet' | 'keyManagerSign'>
+
+export abstract class VeramoLdSignature {
+  // LinkedDataSignature Suites according to
+  // https://github.com/digitalbazaar/jsonld-signatures/blob/main/lib/suites/LinkedDataSignature.js
+  // Add type definition as soon as https://github.com/digitalbazaar/jsonld-signatures
+  // supports those.
+
+  abstract getSupportedVerificationType(): string
+
+  abstract getSupportedVeramoKeyType(): TKeyType
+
+  abstract getSuiteForSigning(
+    key: IKey,
+    issuerDid: string,
+    verificationMethodId: string,
+    context: IAgentContext<RequiredAgentMethods>,
+  ): any
+
+  abstract getSuiteForVerification(): any
+
+  abstract preDidResolutionModification(didUrl: string, didDoc: DIDDocument): void
+
+  abstract preSigningCredModification(credential: CredentialPayload): void
+
+  preSigningPresModification(presentation: PresentationPayload): void {
+    // TODO: Remove invalid field 'verifiers' from Presentation. Needs to be adapted for LD credentials
+    // Only remove empty array (vc.signPresentation will throw then)
+    const sanitizedPresentation = presentation as any
+    if (sanitizedPresentation.verifier.length == 0) {
+      delete sanitizedPresentation.verifier
+    }
+  }
+}

package/src/suites/EcdsaSecp256k1RecoverySignature2020.ts

@@ -0,0 +1,83 @@
+import { RequiredAgentMethods, VeramoLdSignature } from '../ld-suites'
+import { CredentialPayload, DIDDocument, IAgentContext, IKey, TKeyType } from '@veramo/core'
+import {
+  EcdsaSecp256k1RecoveryMethod2020,
+  EcdsaSecp256k1RecoverySignature2020,
+} from '@transmute/lds-ecdsa-secp256k1-recovery2020'
+
+import * as u8a from 'uint8arrays'
+import { asArray, encodeJoseBlob } from '@veramo/utils'
+
+export class VeramoEcdsaSecp256k1RecoverySignature2020 extends VeramoLdSignature {
+  getSupportedVerificationType(): string {
+    return 'EcdsaSecp256k1RecoveryMethod2020'
+  }
+
+  getSupportedVeramoKeyType(): TKeyType {
+    return 'Secp256k1'
+  }
+
+  getSuiteForSigning(
+    key: IKey,
+    did: string,
+    verifiableMethodId: string,
+    context: IAgentContext<RequiredAgentMethods>,
+  ): any {
+    const controller = did
+    const signer = {
+      //returns a JWS detached
+      sign: async (args: { data: Uint8Array }): Promise<string> => {
+        const header = {
+          alg: 'ES256K-R',
+          b64: false,
+          crit: ['b64'],
+        }
+        const headerString = encodeJoseBlob(header)
+        const messageBuffer = u8a.concat([u8a.fromString(`${headerString}.`, 'utf-8'), args.data])
+        const messageString = u8a.toString(messageBuffer, 'base64')
+        const signature = await context.agent.keyManagerSign({
+          keyRef: key.kid,
+          algorithm: 'ES256K-R',
+          data: messageString,
+          encoding: 'base64',
+        })
+        return `${headerString}..${signature}`
+      },
+    }
+
+    return new EcdsaSecp256k1RecoverySignature2020({
+      // signer,
+      key: new EcdsaSecp256k1RecoveryMethod2020({
+        publicKeyHex: key.publicKeyHex,
+        signer: () => signer,
+        type: this.getSupportedVerificationType(),
+        controller,
+        id: verifiableMethodId,
+      }),
+    })
+  }
+
+  getSuiteForVerification(): any {
+    return new EcdsaSecp256k1RecoverySignature2020()
+  }
+
+  preSigningCredModification(credential: CredentialPayload): void {
+    credential['@context'] = [
+      ...asArray(credential['@context'] || []),
+      'https://identity.foundation/EcdsaSecp256k1RecoverySignature2020/lds-ecdsa-secp256k1-recovery2020-0.0.jsonld',
+    ]
+  }
+
+  preDidResolutionModification(didUrl: string, didDoc: DIDDocument): void {
+    // did:ethr
+    if (didUrl.toLowerCase().startsWith('did:ethr')) {
+      // TODO: EcdsaSecp256k1RecoveryMethod2020 does not support blockchainAccountId
+      // blockchainAccountId to ethereumAddress
+      didDoc.verificationMethod?.forEach((x) => {
+        if (x.blockchainAccountId) {
+          x.ethereumAddress = x.blockchainAccountId.substring(0, x.blockchainAccountId.lastIndexOf('@'))
+        }
+      })
+    }
+  }
+}