@verii/server-credentialagent 1.0.0-pre.1752076816

package/test/operator/generate-push-gateway-token.test.js

@@ -0,0 +1,116 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const { split, last, first } = require('lodash/fp');
+const { jwtDecode, jwtSign, jwtVerify } = require('@verii/jwt');
+const {
+  KeyPurposes,
+  generateKeyPair,
+  createCommitment,
+} = require('@verii/crypto');
+const {
+  generatePushGatewayToken,
+} = require('../../src/fetchers/push-gateway/generate-push-gateway-token');
+
+describe('Generate authorization token for push gateway', () => {
+  const { privateKey, publicKey } = generateKeyPair({ format: 'jwk' });
+  const oracleUrl = 'https://oracle.vnf';
+  const pushUrl = 'https:/push.oracle.vnf/push';
+  const pushUrlOrigin = new URL(pushUrl).origin;
+  const traceId = '123';
+  const did = 'did:velocity:123';
+  const kidFragment = '#key-1';
+  const exchangeId = '234';
+  const body = {
+    testUndefined: undefined,
+    data: {
+      exchangeId,
+    },
+  };
+  const context = {
+    tenant: { did, _id: '321' },
+    traceId,
+    tenantKeysByPurpose: { [KeyPurposes.EXCHANGES]: { kidFragment } },
+    config: { oracleUrl },
+    kms: {
+      signJwt: (payload, keyId, headers) =>
+        jwtSign(payload, privateKey, headers),
+    },
+  };
+
+  it('Verify jwt token payload, header and hash of push gateway params', async () => {
+    const authHeader = await generatePushGatewayToken(body, pushUrl, context);
+
+    const token = last(split('Bearer ', authHeader));
+    const decodedToken = jwtDecode(token);
+    const {
+      payload: { hash },
+    } = decodedToken;
+
+    expect(hash).toEqual(createCommitment(JSON.stringify(body)));
+    expect(decodedToken).toEqual({
+      header: {
+        alg: 'ES256K',
+        kid: `${did}${kidFragment}`,
+        typ: 'JWT',
+      },
+      payload: {
+        aud: pushUrlOrigin,
+        hash,
+        iss: did,
+        jti: traceId,
+        sub: exchangeId,
+        iat: expect.any(Number),
+        nbf: expect.any(Number),
+        exp: expect.any(Number),
+      },
+    });
+  });
+
+  it('Verify jwt token signature and claims', async () => {
+    const authHeader = await generatePushGatewayToken(body, pushUrl, context);
+
+    const token = last(split('Bearer ', authHeader));
+    const decodedToken = jwtDecode(token);
+    const {
+      header: { kid },
+    } = decodedToken;
+    await jwtVerify(token, publicKey, {
+      issuer: first(split('#', kid)),
+      audience: pushUrlOrigin,
+      jti: traceId,
+      subject: exchangeId,
+    });
+  });
+
+  it('Verify jwt token fails if an invalid aud claim', async () => {
+    const authHeader = await generatePushGatewayToken(body, pushUrl, context);
+
+    const token = last(split('Bearer ', authHeader));
+    const decodedToken = jwtDecode(token);
+    const {
+      header: { kid },
+    } = decodedToken;
+    await expect(() =>
+      jwtVerify(token, publicKey, {
+        issuer: first(split('#', kid)),
+        audience: 'https:/oracle.vnf',
+        jti: traceId,
+        subject: exchangeId,
+      })
+    ).rejects.toThrow();
+  });
+});

package/test/operator/groups-controller.test.js

@@ -0,0 +1,145 @@
+const { mongoDb } = require('@spencejs/spence-mongo-repos');
+const { omit } = require('lodash/fp');
+const { errorResponseMatcher } = require('@verii/tests-helpers');
+const buildFastify = require('./helpers/credentialagent-operator-build-fastify');
+const { initGroupsFactory } = require('../../src/entities');
+
+const groupUrl = '/groups/';
+
+const groupMatcher = (group) => ({
+  ...omit(['_id'], group),
+  did: group._id,
+  id: group._id,
+  createdAt: expect.any(String),
+  updatedAt: expect.any(String),
+});
+
+describe('Groups controller test suite', () => {
+  let fastify;
+  let persistGroup;
+
+  beforeAll(async () => {
+    fastify = buildFastify({
+      clientSecret: 'abc',
+    });
+    await fastify.ready();
+
+    ({ persistGroup } = initGroupsFactory(fastify));
+  });
+
+  beforeEach(async () => {
+    await mongoDb().collection('groups').deleteMany({});
+  });
+
+  afterAll(async () => {
+    await fastify.close();
+  });
+
+  describe('GET /groups', () => {
+    it('should return all groups', async () => {
+      const group1 = await persistGroup();
+      const group2 = await persistGroup();
+
+      const response = await fastify.inject({
+        method: 'GET',
+        url: groupUrl,
+      });
+
+      expect(response.statusCode).toBe(200);
+      expect(response.json()).toEqual({
+        groups: [groupMatcher(group2), groupMatcher(group1)],
+      });
+    });
+
+    it('should return empty response', async () => {
+      const response = await fastify.inject({
+        method: 'GET',
+        url: groupUrl,
+      });
+
+      expect(response.statusCode).toBe(200);
+      expect(response.json()).toEqual({
+        groups: [],
+      });
+    });
+  });
+  describe('POST /groups', () => {
+    it('should create a group', async () => {
+      const group = {
+        slug: 'test-group',
+        did: 'did:example:123',
+      };
+
+      const response = await fastify.inject({
+        method: 'POST',
+        url: groupUrl,
+        payload: group,
+      });
+
+      expect(response.statusCode).toBe(200);
+      expect(response.json()).toEqual({
+        group: {
+          id: group.did,
+          did: group.did,
+          slug: group.slug,
+          createdAt: expect.any(String),
+          updatedAt: expect.any(String),
+        },
+      });
+    });
+
+    it('should return error if slug already exists', async () => {
+      const group = {
+        slug: 'test-group',
+        did: 'did:example:123',
+      };
+
+      await persistGroup(group);
+
+      const response = await fastify.inject({
+        method: 'POST',
+        url: groupUrl,
+        payload: group,
+      });
+
+      expect(response.statusCode).toBe(400);
+      expect(response.json()).toEqual(
+        errorResponseMatcher({
+          error: 'Bad Request',
+          errorCode: 'slug_already_exist',
+          message: 'Group with the given SLUG already exists',
+          statusCode: 400,
+        })
+      );
+    });
+
+    it('should return error if did already exists', async () => {
+      const did = 'did:example:123';
+      const group = {
+        slug: 'test-group',
+        did,
+      };
+
+      await persistGroup({ ...group, _id: did });
+
+      const response = await fastify.inject({
+        method: 'POST',
+        url: groupUrl,
+        payload: {
+          ...group,
+          slug: 'test-group-2',
+        },
+      });
+
+      expect(response.statusCode).toBe(400);
+      expect(response.json()).toEqual(
+        errorResponseMatcher({
+          error: 'Bad Request',
+          errorCode: 'did_already_exist',
+          message: 'Group with the given DID already exists',
+          statusCode: 400,
+        })
+      );
+    });
+  });
+});

package/test/operator/groups-id-controller.test.js

@@ -0,0 +1,287 @@
+const { mongoDb } = require('@spencejs/spence-mongo-repos');
+const { omit } = require('lodash/fp');
+const { errorResponseMatcher } = require('@verii/tests-helpers');
+const buildFastify = require('./helpers/credentialagent-operator-build-fastify');
+const { initGroupsFactory, groupRepoPlugin } = require('../../src/entities');
+
+const groupUrl = '/groups/';
+
+const groupMatcher = (group) => ({
+  ...omit(['_id'], group),
+  did: group._id.toString(),
+  id: group._id.toString(),
+  createdAt: expect.any(String),
+  updatedAt: expect.any(String),
+});
+
+describe('Groups controller test suite', () => {
+  let fastify;
+  let persistGroup;
+  let groupRepo;
+
+  beforeAll(async () => {
+    fastify = buildFastify();
+    await fastify.ready();
+
+    ({ persistGroup } = initGroupsFactory(fastify));
+
+    groupRepo = groupRepoPlugin({})(fastify);
+  });
+
+  beforeEach(async () => {
+    await mongoDb().collection('groups').deleteMany({});
+  });
+
+  afterAll(async () => {
+    await fastify.close();
+  });
+
+  describe('GET /groups/:id', () => {
+    it('should throw error if a group not found', async () => {
+      const response = await fastify.inject({
+        method: 'GET',
+        url: `${groupUrl}123`,
+      });
+      expect(response.statusCode).toEqual(404);
+      expect(response.json()).toEqual(
+        errorResponseMatcher({
+          error: 'Not Found',
+          errorCode: 'group_does_not_exist',
+          message: 'Group does not exist',
+          statusCode: 404,
+        })
+      );
+    });
+    it('should return a group', async () => {
+      const group = await persistGroup({
+        slug: 'test-group',
+        did: 'did:example:123',
+      });
+      const response = await fastify.inject({
+        method: 'GET',
+        url: `${groupUrl}${group._id.toString()}`,
+      });
+      expect(response.statusCode).toEqual(200);
+      expect(response.json()).toEqual({
+        group: groupMatcher(group),
+      });
+    });
+  });
+  describe('PUT /groups/:id', () => {
+    it('should throw error if a group not found', async () => {
+      const response = await fastify.inject({
+        method: 'PUT',
+        url: `${groupUrl}123`,
+        body: {
+          slug: 'new-slug',
+          did: 'did:example:123',
+        },
+      });
+      expect(response.statusCode).toEqual(404);
+      expect(response.json()).toEqual(
+        errorResponseMatcher({
+          error: 'Not Found',
+          errorCode: 'group_does_not_exist',
+          message: 'Group does not exist',
+          statusCode: 404,
+        })
+      );
+    });
+    it('should throw error if a slug already exists', async () => {
+      await persistGroup({
+        slug: 'new-test-group',
+      });
+      const group = await persistGroup({
+        slug: 'test-group',
+        _id: 'did:example:123',
+      });
+      const response = await fastify.inject({
+        method: 'PUT',
+        url: `${groupUrl}${group._id.toString()}`,
+        body: {
+          ...group,
+          slug: 'new-test-group',
+        },
+      });
+      expect(response.statusCode).toEqual(400);
+      expect(response.json()).toEqual(
+        errorResponseMatcher({
+          error: 'Bad Request',
+          errorCode: 'slug_already_exist',
+          message: 'Group with the given SLUG already exists',
+          statusCode: 400,
+        })
+      );
+    });
+    it('should update a group', async () => {
+      const group = await persistGroup({
+        slug: 'test-group',
+        _id: 'did:example:123',
+      });
+      const response = await fastify.inject({
+        method: 'PUT',
+        url: `${groupUrl}${group._id.toString()}`,
+        payload: {
+          slug: 'new-slug',
+        },
+      });
+      expect(response.statusCode).toEqual(200);
+      expect(response.json()).toEqual({
+        group: groupMatcher({ ...group, slug: 'new-slug' }),
+      });
+
+      const groupDb = await groupRepo.findById(group._id);
+      expect(groupDb).toEqual({
+        ...group,
+        slug: 'new-slug',
+        _id: expect.anything(),
+        createdAt: expect.anything(),
+        updatedAt: expect.anything(),
+      });
+    });
+  });
+  describe('DELETE /groups/:id', () => {
+    it('should throw error if a group not found', async () => {
+      const response = await fastify.inject({
+        method: 'DELETE',
+        url: `${groupUrl}123`,
+      });
+      expect(response.statusCode).toEqual(404);
+      expect(response.json()).toEqual(
+        errorResponseMatcher({
+          error: 'Not Found',
+          errorCode: 'group_does_not_exist',
+          message: 'Group does not exist',
+          statusCode: 404,
+        })
+      );
+    });
+    it('should throw error if a group has tenants', async () => {
+      const group = await persistGroup({
+        slug: 'test-group',
+        _id: 'did:example:123',
+        dids: ['did:example:456'],
+      });
+      const response = await fastify.inject({
+        method: 'DELETE',
+        url: `${groupUrl}${group._id}`,
+      });
+      expect(response.statusCode).toEqual(400);
+      expect(response.json()).toEqual(
+        errorResponseMatcher({
+          error: 'Bad Request',
+          errorCode: 'group_has_tenants',
+          message: 'Group has tenants associated with it',
+          statusCode: 400,
+        })
+      );
+    });
+    it('should delete a group', async () => {
+      const group = await persistGroup({
+        slug: 'test-group',
+        _id: 'did:example:123',
+      });
+      const response = await fastify.inject({
+        method: 'DELETE',
+        url: `${groupUrl}${group._id}`,
+      });
+      expect(response.statusCode).toEqual(204);
+
+      const groupDb = await groupRepo.findOne({
+        filter: {
+          _id: group._id,
+        },
+      });
+      expect(groupDb).toBeNull();
+    });
+  });
+
+  describe('POST /groups/:id/add-did', () => {
+    it('should throw error if a group not found', async () => {
+      const response = await fastify.inject({
+        method: 'POST',
+        url: `${groupUrl}123/add-did`,
+        body: {
+          did: 'did:example:123',
+        },
+      });
+      expect(response.statusCode).toEqual(404);
+      expect(response.json()).toEqual(
+        errorResponseMatcher({
+          error: 'Not Found',
+          errorCode: 'group_does_not_exist',
+          message: 'Group does not exist',
+          statusCode: 404,
+        })
+      );
+      const groupDb = await groupRepo.count({ filter: {} });
+      expect(groupDb).toBe(0);
+    });
+    it('should throw error if a did already linked', async () => {
+      await persistGroup({
+        dids: ['did:linked:123'],
+      });
+      const group = await persistGroup({
+        _id: 'did:example:123',
+      });
+      const response = await fastify.inject({
+        method: 'POST',
+        url: `${groupUrl}${group._id.toString()}/add-did`,
+        body: {
+          did: 'did:linked:123',
+        },
+      });
+      expect(response.statusCode).toEqual(400);
+      expect(response.json()).toEqual(
+        errorResponseMatcher({
+          error: 'Bad Request',
+          errorCode: 'did_already_in_group',
+          message: 'Did already linked to a group',
+          statusCode: 400,
+        })
+      );
+    });
+    it('should add a did to a group if a did already linked to the same group', async () => {
+      const group = await persistGroup({
+        dids: ['did:linked:123', 'did:linked:124', 'did:linked:125'],
+      });
+      const response = await fastify.inject({
+        method: 'POST',
+        url: `${groupUrl}${group._id.toString()}/add-did`,
+        body: {
+          did: 'did:linked:124',
+        },
+      });
+      expect(response.statusCode).toEqual(204);
+      const groupDb = await groupRepo.findById(group._id);
+      expect(groupDb).toEqual({
+        ...group,
+        _id: expect.anything(),
+        dids: ['did:linked:123', 'did:linked:124', 'did:linked:125'],
+        createdAt: expect.anything(),
+        updatedAt: expect.anything(),
+      });
+    });
+    it('should add a did to a group', async () => {
+      const group = await persistGroup({
+        _id: 'did:example:123',
+      });
+      const response = await fastify.inject({
+        method: 'POST',
+        url: `${groupUrl}${group._id.toString()}/add-did`,
+        payload: {
+          did: 'did:linked:123',
+        },
+      });
+      expect(response.statusCode).toEqual(204);
+      const groupDb = await groupRepo.findById(group._id);
+      expect(groupDb).toEqual({
+        ...group,
+        _id: expect.anything(),
+        dids: ['did:linked:123'],
+        createdAt: expect.anything(),
+        updatedAt: expect.anything(),
+      });
+    });
+  });
+});

package/test/operator/helpers/create-test-org-doc.js

@@ -0,0 +1,60 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const { generateKeyPair } = require('@verii/crypto');
+const { jwkFromSecp256k1Key } = require('@verii/jwt');
+const { nanoid } = require('nanoid/non-secure');
+
+const createOrgDoc = async () => {
+  const { privateKey, publicKey } = generateKeyPair();
+  const publicKeyJwk = jwkFromSecp256k1Key(publicKey, false);
+  const key = {
+    id: '#velocity-key-1',
+    publicKeyJwk,
+    algorithm: 'SECP256K1',
+    encoding: 'hex',
+    controller: 'did:key:01230123012',
+  };
+
+  const did = `did:nanoid:${nanoid(20)}`;
+  return {
+    orgDoc: {
+      '@context': [
+        'https://www.w3.org/ns/did/v1',
+        {
+          '@base': did,
+        },
+      ],
+      id: did,
+      alsoKnownAs: ['did:aka:foo'],
+      service: [
+        {
+          id: '#test-service',
+          type: 'VlcCareerIssuer_v1',
+          credentialTypes: ['CurrentEmploymentPosition'],
+          serviceEndpoint: 'https://agent.samplevendor.com/acme',
+        },
+      ],
+      assertionMethod: [key.id],
+      verificationMethod: [key],
+    },
+    orgKey: privateKey,
+    orgPublicKey: publicKey,
+  };
+};
+module.exports = {
+  createOrgDoc,
+};

package/test/operator/helpers/credentialagent-operator-build-fastify.js

@@ -0,0 +1,32 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const { createTestServer } = require('@verii/server-provider');
+const { loadTestEnv, buildMongoConnection } = require('@verii/tests-helpers');
+
+loadTestEnv();
+
+const { flow } = require('lodash/fp');
+const { operatorConfig } = require('../../../src/config');
+const { initOperatorServer } = require('../../../src/init-operator-server');
+
+const mongoConnection = buildMongoConnection('test-credential-agent');
+
+module.exports = (overrideConfig = {}) =>
+  flow(
+    createTestServer,
+    initOperatorServer
+  )({ ...operatorConfig, ...overrideConfig, mongoConnection });

package/test/operator/helpers/find-kms-key.js

@@ -0,0 +1,31 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const { mongoDb } = require('@spencejs/spence-mongo-repos');
+const { decryptCollection } = require('@verii/crypto');
+
+const initFindKmsKey = (fastify) => async (filter) => {
+  const key = await mongoDb()
+    .collection('keys')
+    .findOne(filter, {
+      projection: { kidFragment: 1, key: 1 },
+    });
+  key.key = JSON.parse(decryptCollection(key.key, fastify.config.mongoSecret));
+  return key;
+};
+
+module.exports = { initFindKmsKey };