@verii/server-credentialagent 1.0.0-pre.1752076816

package/src/entities/presentations/orchestrators/create-presentation-request.js

@@ -0,0 +1,148 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const { map } = require('lodash/fp');
+const { mapWithIndex } = require('@verii/common-functions');
+const {
+  getOrganizationVerifiedProfile,
+  getCredentialTypeDescriptor,
+} = require('@verii/common-fetchers');
+const { ExchangeTypes } = require('../../exchanges/domains');
+
+const GROUP_ID = 'A';
+
+const createPresentationRequest = async (disclosure, exchange, context) => {
+  const { tenant } = context;
+  const orgProfile = await getOrgProfile(tenant.did, context);
+
+  return {
+    exchange_id: exchange._id,
+    metadata: buildMetadata(disclosure, exchange, orgProfile, context),
+    presentation_definition: await buildPresentationDefinition(
+      disclosure,
+      exchange,
+      context
+    ),
+  };
+};
+
+const buildPresentationDefinition = async (disclosure, exchange, context) => {
+  const id = `${exchange._id}.${disclosure._id}`;
+  const format = {
+    jwt_vp: { alg: ['secp256k1'] }, // hardcoded
+  };
+
+  if (disclosure.presentationDefinition) {
+    const purpose =
+      disclosure.presentationDefinition.purpose ?? disclosure.purpose;
+    return {
+      ...disclosure.presentationDefinition,
+      purpose,
+      format,
+      id,
+    };
+  }
+  const rawDescriptors = await Promise.all(
+    map(
+      ({ type }) =>
+        getCredentialTypeDescriptor({ type, includeDisplay: false }, context),
+      disclosure.types
+    )
+  );
+
+  return {
+    id,
+    purpose: disclosure?.purpose,
+    name: disclosure?.description,
+    format,
+    input_descriptors: buildInputDescriptors(disclosure.types, rawDescriptors),
+    submission_requirements: buildSubmissionRequirements(
+      exchange,
+      rawDescriptors
+    ),
+  };
+};
+
+const getOrgProfile = async (tenantDid, context) => {
+  const { credentialSubject: orgProfile } =
+    await getOrganizationVerifiedProfile(tenantDid, context);
+
+  return orgProfile;
+};
+
+const buildMetadata = (
+  disclosure,
+  exchange,
+  orgProfile,
+  { config: { hostUrl }, tenant }
+) => {
+  const baseUrl = `${hostUrl}/api/holder/v0.6/org/${encodeURI(tenant.did)}`;
+
+  const clientName = disclosure.commercialEntityName ?? orgProfile?.name;
+  const logoUri = disclosure.commercialEntityLogo ?? orgProfile?.logo;
+  const metadata = {
+    client_name: clientName,
+    logo_uri: logoUri,
+    tos_uri: disclosure?.termsUrl,
+    max_retention_period: disclosure?.duration,
+    progress_uri: `${baseUrl}/get-exchange-progress`,
+    auth_token_uri: `${baseUrl}/oauth/token`,
+    feed: disclosure?.feed,
+  };
+
+  if (exchange.type === ExchangeTypes.ISSUING) {
+    metadata.submit_presentation_uri =
+      exchange.protocolMetadata?.redirect_uri ??
+      `${baseUrl}/issue/submit-identification`;
+    metadata.check_offers_uri = `${baseUrl}/issue/credential-offers`;
+    metadata.finalize_offers_uri = `${baseUrl}/issue/finalize-offers`;
+  } else {
+    metadata.submit_presentation_uri =
+      exchange.protocolMetadata?.redirect_uri ??
+      `${baseUrl}/inspect/submit-presentation`;
+  }
+
+  return metadata;
+};
+
+const buildSubmissionRequirements = ({ type }, rawDescriptors) => {
+  if (type === ExchangeTypes.ISSUING) {
+    return [
+      {
+        rule: 'all',
+        from: GROUP_ID,
+        min: rawDescriptors.length,
+      },
+    ];
+  }
+
+  return [
+    {
+      rule: 'pick',
+      from: GROUP_ID,
+      min: 1,
+    },
+  ];
+};
+
+const buildInputDescriptors = (types, rawDescriptors) =>
+  mapWithIndex((type, idx) => ({
+    ...rawDescriptors[idx],
+    group: [GROUP_ID],
+  }))(types);
+
+module.exports = { createPresentationRequest };

package/src/entities/presentations/orchestrators/deduplicate-disclosure-exchange.js

@@ -0,0 +1,52 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const newError = require('http-errors');
+const { ExchangeStates } = require('../../exchanges');
+
+// TODO refactor as exchange extension
+const deduplicateDisclosureExchange = async (
+  presentation,
+  { repos, exchange }
+) => {
+  const dbUpdateResult = await repos.exchanges.collection().updateOne(
+    {
+      _id: exchange._id,
+      presentationId: { $ne: presentation.id },
+    },
+    {
+      $set: {
+        presentationId: presentation.id,
+        disclosureConsentedAt: new Date(),
+      },
+      $push: {
+        events: {
+          state: ExchangeStates.DISCLOSURE_RECEIVED,
+          timestamp: new Date(),
+        },
+      },
+    }
+  );
+
+  if (dbUpdateResult.modifiedCount === 0) {
+    throw newError(409, 'Presentation has already been submitted', {
+      errorCode: 'presentation_duplicate',
+    });
+  }
+};
+
+module.exports = { deduplicateDisclosureExchange };

package/src/entities/presentations/orchestrators/handle-presentation-submission.js

@@ -0,0 +1,47 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { buildExchangeProgress } = require('../../exchanges');
+const { sharePresentation } = require('./share-presentation');
+const { generateAccessToken } = require('../../tokens');
+
+const handlePresentationSubmission = async (presentation, context) => {
+  const { exchange, user, disclosure } = await sharePresentation(
+    presentation,
+    context
+  );
+
+  if (context.user) {
+    await context.repos.feeds.updateLatestFeedTimestamp({
+      vendorUserId: context.user.vendorUserId,
+    });
+  }
+
+  const token = await generateAccessToken(
+    exchange._id.toString(),
+    user?._id,
+    disclosure,
+    exchange,
+    context
+  );
+
+  return {
+    exchange: buildExchangeProgress(exchange),
+    token,
+  };
+};
+
+module.exports = { handlePresentationSubmission };

package/src/entities/presentations/orchestrators/index.js

@@ -0,0 +1,20 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./create-presentation-request'),
+  ...require('./handle-presentation-submission'),
+};

package/src/entities/presentations/orchestrators/match-identity-on-exchange.js

@@ -0,0 +1,114 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const newError = require('http-errors');
+const {
+  flatten,
+  isEmpty,
+  first,
+  includes,
+  toLower,
+  every,
+} = require('lodash/fp');
+const { ExchangeStates } = require('../../exchanges');
+const { PresentationErrors } = require('../domains');
+const { getJsonAtPath } = require('../../common');
+
+const doFindExchange = async (docValue, rule, exchangeCursor) => {
+  for await (const exchange of exchangeCursor) {
+    if (
+      exchange.identityMatcherValues &&
+      evalRule(flatten(docValue), rule, exchange.identityMatcherValues)
+    ) {
+      return exchange;
+    }
+  }
+  return null;
+};
+const findExchange = async (docValue, rule, context) => {
+  const { tenant, exchange, repos } = context;
+  if (exchange.identityMatcherValues) {
+    return doFindExchange(docValue, rule, [exchange]);
+  }
+  const exchangeCursor = repos.exchanges
+    .collection()
+    .find({ disclosureId: exchange.disclosureId, tenantId: tenant._id });
+  const matchingExchange = await doFindExchange(docValue, rule, exchangeCursor);
+  await exchangeCursor.close();
+  return matchingExchange;
+};
+const matchIdentityOnExchange = async (
+  identityDoc,
+  { identityMatchers },
+  context
+) => {
+  const { vendorUserIdIndex } = identityMatchers;
+  const { docValue, rule } = validatePresentation(
+    identityDoc,
+    identityMatchers
+  );
+
+  const matchingExchange = await findExchange(docValue, rule, context);
+
+  if (matchingExchange == null) {
+    throw newError(401, 'User Not Found', {
+      exchangeErrorState: ExchangeStates.NOT_IDENTIFIED,
+      errorCode: 'integrated_identification_user_not_found',
+    });
+  }
+  return {
+    vendorUserId: matchingExchange.identityMatcherValues[vendorUserIdIndex],
+  };
+};
+
+const validatePresentation = (identityDoc, identityMatchers) => {
+  const { rules } = identityMatchers;
+
+  const rule = first(rules);
+
+  const docValue = getJsonAtPath(first(rule.path), identityDoc);
+  if (isEmpty(docValue)) {
+    throw newError(
+      400,
+      PresentationErrors.PRESENTATION_JSON_PATH_MISSING(rule),
+      { errorCode: 'presentation_credential_jsonpath_empty' }
+    );
+  }
+
+  return { docValue, rule };
+};
+
+const evalRule = (docValue, { rule, valueIndex }, values) => {
+  switch (rule) {
+    case 'pick': {
+      return includes(toLower(values[valueIndex]), toLower(docValue));
+    }
+    case 'all': {
+      return (
+        docValue.length > 0 &&
+        every((val) => toLower(val) === toLower(values[valueIndex]), docValue)
+      );
+    }
+    default: {
+      throw newError.InternalServerError(
+        PresentationErrors.INVALID_INTEGRATED_IDENTIFICATION_RULE
+      );
+    }
+  }
+};
+
+module.exports = { matchIdentityOnExchange };

package/src/entities/presentations/orchestrators/share-identification-credentials.js

@@ -0,0 +1,110 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const newError = require('http-errors');
+const { isString, isEmpty } = require('lodash/fp');
+const {
+  buildFailedCheckResultError,
+} = require('@verii/verifiable-credentials');
+const { ExchangeStates } = require('../../exchanges');
+const { identifyUserOnVendor } = require('../../../fetchers');
+const { VendorEndpoint } = require('../../disclosures');
+const {
+  buildIdentityDoc,
+  buildVendorData,
+  mergeCredentialCheckResults,
+} = require('../domains');
+const { matchIdentityOnExchange } = require('./match-identity-on-exchange');
+
+const shareIdentificationCredentials = async (
+  disclosure,
+  vendorOriginContext,
+  checkedCredentials,
+  context
+) => {
+  if (context.config.autoIdentityCheck) {
+    throwOnFailedCheckResultError(checkedCredentials, context);
+  }
+
+  const identityDoc = buildIdentityDoc(checkedCredentials, context);
+  const vendorUser =
+    disclosure.vendorEndpoint === VendorEndpoint.ISSUING_IDENTIFICATION
+      ? await sendIdentification(
+          identityDoc,
+          buildVendorData(disclosure, vendorOriginContext, context),
+          context
+        )
+      : await matchIdentityOnExchange(identityDoc, disclosure, context);
+
+  return {
+    checkedCredentials: mergeCredentialCheckResults(checkedCredentials),
+    vendorUser,
+  };
+};
+
+const sendIdentification = async (identityDoc, vendorData, context) => {
+  const { tenant, exchange } = context;
+  const payload = {
+    ...identityDoc,
+    vendorOrganizationId: tenant.vendorOrganizationId,
+    tenantDID: tenant.did,
+    tenantId: tenant._id,
+    exchangeId: exchange._id,
+  };
+  if (vendorData.vendorOriginContext != null) {
+    payload.vendorOriginContext = vendorData.vendorOriginContext;
+  }
+
+  let vendorUser;
+  try {
+    vendorUser = await identifyUserOnVendor(payload, context);
+  } catch (error) {
+    if (error.response?.statusCode === 404) {
+      throw newError(401, 'user not found', {
+        exchangeErrorState: ExchangeStates.NOT_IDENTIFIED,
+        errorCode: 'upstream_user_not_found',
+      });
+    }
+    throw error;
+  }
+
+  if (isEmpty(vendorUser?.vendorUserId) || !isString(vendorUser.vendorUserId)) {
+    throw newError(
+      401,
+      'user not found - vendorUserId property should be a string value',
+      {
+        exchangeErrorState: ExchangeStates.NOT_IDENTIFIED,
+        errorCode: 'upstream_userid_not_string',
+      }
+    );
+  }
+
+  return vendorUser;
+};
+
+const throwOnFailedCheckResultError = (checkedCredentials, context) => {
+  for (const checkedCredential of checkedCredentials) {
+    const error = buildFailedCheckResultError(checkedCredential, context);
+    if (error != null) {
+      throw error;
+    }
+  }
+};
+
+module.exports = {
+  shareIdentificationCredentials,
+};