@verii/server-credentialing-hub 2.0.0

package/src/entities/exchanges/orchestrators/authenticate.js

@@ -0,0 +1,67 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { split } = require('lodash/fp');
+const newError = require('http-errors');
+const { isPreauthCodeAuth } = require('../../links');
+const {
+  ExchangeErrors,
+  ExchangeStates,
+  validatePreauth,
+  validateReferencedService,
+} = require('../domain');
+
+const authenticate = async (exchangeId, authJwtPayload, context) => {
+  const { repos } = context;
+  const exchange = await repos.exchanges.addState(
+    exchangeId,
+    ExchangeStates.AUTHENTICATION_REQUEST,
+    {
+      disclosureConsentedAt: new Date(),
+    },
+  );
+  const issuerService = await repos.issuerServices.findOne({
+    filter: { _id: exchange.serviceId },
+  });
+
+  validateReferencedService(issuerService);
+  if (!isPreauthCodeAuth(issuerService)) {
+    throw newError(400, ExchangeErrors.AUTHENTICATION_METHOD_UNSUPPORTED, {
+      errorCode: ExchangeErrors.AUTHENTICATION_METHOD_UNSUPPORTED,
+    });
+  }
+  const depot = await preauthCodeAuthHandler(authJwtPayload, context);
+
+  const authenticatedExchange = await repos.exchanges.addState(
+    exchangeId,
+    ExchangeStates.AUTHENTICATION_SUCCESS,
+    { depotId: depot._id },
+  );
+
+  return [issuerService, authenticatedExchange];
+};
+
+const preauthCodeAuthHandler = async ({ vendorOriginContext }, context) => {
+  const { repos } = context;
+  const preauthCodeParts = split(':', vendorOriginContext);
+  const depot = await repos.depots.findOne({
+    filter: { _id: preauthCodeParts?.[1] },
+  });
+  validatePreauth(preauthCodeParts?.[2], depot, context);
+  return depot;
+};
+
+module.exports = { authenticate };

package/src/entities/exchanges/orchestrators/credential-offer-request.js

@@ -0,0 +1,70 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { map, uniqBy } = require('lodash/fp');
+const newError = require('http-errors');
+const {
+  ExchangeStates,
+  authorizeExchange,
+  generateIssuingChallenge,
+} = require('../domain');
+const { parseAccessToken } = require('../../tokens');
+
+// eslint-disable-next-line default-param-last
+const credentialOfferRequest = async (token, offerHashes = [], context) => {
+  const { log, repos } = context;
+  const { exchangeId, depotId } = parseAccessToken(token);
+  const exchange = await repos.exchanges
+    .addState(exchangeId, ExchangeStates.OFFERS_REQUESTED)
+    .catch((error) => {
+      log.error(error);
+      throw newError(401, 'Unauthorized');
+    });
+  authorizeExchange(exchange, depotId);
+
+  const credentials = await repos.credentials.findByDepotId({
+    depotId,
+    credentialTypes: exchange.credentialTypes,
+    omitContentHashes: offerHashes,
+    claimable: true,
+  });
+
+  const { challenge } = await generateIssuingChallenge(exchangeId, context);
+
+  await repos.exchanges.addState(exchangeId, ExchangeStates.OFFERS_SENT, {
+    credentialIds: map('_id', credentials),
+  });
+
+  return {
+    challenge,
+    offers: map(
+      (credential) => buildOffer(credential, context),
+      uniqBy('contentHash', credentials),
+    ),
+  };
+};
+
+const buildOffer = (credential, { tenant }) => ({
+  ...credential.content,
+  id: credential._id,
+  hash: credential.contentHash,
+  issuer: {
+    ...(credential.content?.issuer ?? {}),
+    id: tenant.did,
+  },
+});
+
+module.exports = { credentialOfferRequest };

package/src/entities/exchanges/orchestrators/get-credential-manifest.js

@@ -0,0 +1,84 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { map } = require('lodash/fp');
+const { ObjectId } = require('mongodb');
+const {
+  validateNewExchange,
+  buildCredentialManifest,
+  ExchangeTypes,
+  ExchangeProtocols,
+  ExchangeStates,
+} = require('../domain');
+const { fetchCredentialTypeDescriptors } = require('../../credential-types');
+
+const getCredentialManifest = async (
+  serviceId,
+  credentialTypes,
+  locale,
+  messagingSettings,
+  context,
+) => {
+  const { repos, tenant } = context;
+
+  // setup exchange
+  const newExchange = {
+    type: ExchangeTypes.ISSUER,
+    serviceId: new ObjectId(serviceId),
+    protocolMetadata: {
+      protocol: ExchangeProtocols.VN_API,
+    },
+    credentialTypes,
+    messagingSettings,
+  };
+
+  // load issuer service
+  const issuerService = await repos.issuerServices.findOne({
+    filter: { _id: serviceId },
+  });
+
+  validateNewExchange(newExchange, issuerService);
+
+  const exchange = await repos.exchanges.insertWithInitialState(newExchange, [
+    ExchangeStates.CREDENTIAL_MANIFEST_REQUESTED,
+  ]);
+  // eslint-disable-next-line better-mutation/no-mutation
+  context.exchange = exchange; // added onto the request for the exchange error handler
+
+  const inputDescriptors = await fetchCredentialTypeDescriptors(
+    map('type', issuerService?.disclosureRequest?.types),
+    false,
+    undefined,
+    context,
+  );
+
+  const outputDescriptors = await fetchCredentialTypeDescriptors(
+    credentialTypes,
+    true,
+    locale,
+    context,
+  );
+
+  return buildCredentialManifest(
+    tenant,
+    issuerService,
+    exchange,
+    inputDescriptors,
+    outputDescriptors,
+  );
+};
+
+module.exports = { getCredentialManifest };

package/src/entities/exchanges/orchestrators/get-presentation-request.js

@@ -0,0 +1,114 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { ObjectId } = require('mongodb');
+const newError = require('http-errors');
+const { map, split, startsWith } = require('lodash/fp');
+const {
+  ExchangeErrors,
+  ExchangeTypes,
+  ExchangeProtocols,
+  ExchangeStates,
+  buildPresentationRequest,
+  validateMessagingSettings,
+} = require('../domain');
+const { fetchCredentialTypeDescriptors } = require('../../credential-types');
+const {
+  validateReferencedService,
+} = require('../domain/validate-referenced-service');
+
+const getPresentationRequest = async (
+  serviceId,
+  locale,
+  messagingSettings,
+  vendorOriginContext,
+  context,
+) => {
+  const { repos, tenant } = context;
+
+  // load issuer service
+  const relyingPartyService = await repos.relyingPartyServices.findOne({
+    filter: { _id: serviceId },
+  });
+
+  validateMessagingSettings(messagingSettings);
+  validateReferencedService(relyingPartyService);
+
+  const depot = await loadDepot(serviceId, vendorOriginContext, context);
+
+  // setup exchange
+  const newExchange = {
+    type: ExchangeTypes.RELYING_PARTY,
+    serviceId: new ObjectId(serviceId),
+    protocolMetadata: {
+      protocol: ExchangeProtocols.VN_API,
+    },
+    locale,
+    messagingSettings,
+    depotId: depot._id,
+  };
+
+  const exchange = await repos.exchanges.insertWithInitialState(newExchange, [
+    ExchangeStates.PRESENTATION_REQUEST_REQUESTED,
+  ]);
+  // eslint-disable-next-line better-mutation/no-mutation
+  context.exchange = exchange; // added onto the request for the exchange error handler
+
+  const inputDescriptors = await fetchCredentialTypeDescriptors(
+    map('type', relyingPartyService?.disclosureRequest?.types),
+    false,
+    undefined,
+    context,
+  );
+
+  return buildPresentationRequest(
+    tenant,
+    relyingPartyService,
+    exchange,
+    inputDescriptors,
+  );
+};
+
+const loadDepot = async (serviceId, vendorOriginContext, context) => {
+  const depotId = parseDepotId(vendorOriginContext);
+  if (depotId == null) {
+    return context.repos.depots.insert({
+      serviceId: new ObjectId(serviceId),
+    });
+  }
+
+  const depot = await context.repos.depots.findOne({
+    filter: { _id: depotId },
+  });
+  if (!isMatchingDepot(depot, serviceId)) {
+    throw newError(400, ExchangeErrors.REFERENCED_DEPOT_NOT_FOUND, {
+      errorCode: ExchangeErrors.REFERENCED_DEPOT_NOT_FOUND,
+    });
+  }
+  return depot;
+};
+
+const parseDepotId = (vendorOriginContext) => {
+  if (!startsWith('depot:', vendorOriginContext)) {
+    return undefined;
+  }
+  return split(':', vendorOriginContext)[1];
+};
+
+const isMatchingDepot = (depot, serviceId) =>
+  depot != null && depot.serviceId?.toString() === serviceId.toString();
+
+module.exports = { getPresentationRequest };

package/src/entities/exchanges/orchestrators/index.js

@@ -0,0 +1,24 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./authenticate'),
+  ...require('./credential-offer-request'),
+  ...require('./get-credential-manifest'),
+  ...require('./get-presentation-request'),
+  ...require('./post-presentation'),
+  ...require('./issue-credentials'),
+};

package/src/entities/exchanges/orchestrators/issue-credentials.js

@@ -0,0 +1,132 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const newError = require('http-errors');
+const { isEmpty, map, uniq } = require('lodash/fp');
+const { mapWithIndex } = require('@verii/common-functions');
+const { jwtDecode } = require('@verii/jwt');
+const { parseAccessToken } = require('../../tokens');
+const { ExchangeStates, verifyProofOfKeyPossession } = require('../domain');
+const { authorizeExchange } = require('../domain/authorize-exchange');
+const { issueVeriiCredentialsFacade } = require('../../credentials');
+
+const issueCredentials = async (
+  token,
+  approvedCredentialIds,
+  rejectedCredentialIds,
+  keyPossessionProof,
+  context,
+) => {
+  const { log, repos } = context;
+  const { exchangeId, depotId } = parseAccessToken(token);
+  const exchange = await repos.exchanges
+    .addState(exchangeId, ExchangeStates.CLAIMING_IN_PROGRESS)
+    .catch((error) => {
+      log.error(error);
+      throw newError(401, 'Unauthorized');
+    });
+  authorizeExchange(exchange, depotId);
+  const issuerService = await repos.issuerServices.findById(exchange.serviceId);
+
+  const rejectedCredentials = await rejectCredentials(
+    rejectedCredentialIds,
+    context,
+  );
+
+  const [issuedCredentials, jwtVcs] = await issueApprovedCredentials(
+    approvedCredentialIds,
+    keyPossessionProof,
+    exchange,
+    issuerService,
+    context,
+  );
+
+  await repos.exchanges.addState(exchange._id, ExchangeStates.COMPLETE, {
+    finalizedCredentialIds: uniq([
+      ...(exchange.finalizedCredentialIds ?? []),
+      ...map('_id', rejectedCredentials),
+      ...map('_id', issuedCredentials),
+    ]),
+  });
+
+  return jwtVcs;
+};
+
+const rejectCredentials = (credentialIds, { repos }) => {
+  if (!isEmpty(credentialIds)) {
+    return repos.credentials.updateUsingFilter(
+      { filter: { _id: { $in: credentialIds } } },
+      { rejectedAt: new Date() },
+    );
+  }
+
+  return Promise.resolve([]);
+};
+
+const issueApprovedCredentials = async (
+  credentialIds,
+  proof,
+  exchange,
+  issuerService,
+  context,
+) => {
+  const { repos, log } = context;
+
+  if (isEmpty(credentialIds)) {
+    return Promise.resolve([[], []]);
+  }
+
+  const approvedCredentials =
+    await repos.credentials.findNonFinal(credentialIds);
+
+  if (isEmpty(approvedCredentials)) {
+    log.info('approved credentials not found');
+    return [[], []];
+  }
+
+  const credentialSubjectId = await verifyProofOfKeyPossession(
+    proof,
+    exchange,
+    context,
+  );
+
+  const jwtVcs = await issueVeriiCredentialsFacade(
+    map('content', approvedCredentials),
+    credentialSubjectId,
+    map('typeMetadata', approvedCredentials),
+    issuerService,
+    context,
+  );
+
+  const issuedCredentials = await Promise.all(
+    mapWithIndex(
+      async (credential, i) =>
+        repos.credentials.updateIssuedCredential(
+          credential._id,
+          jwtDecode(jwtVcs[i]).payload.vc.id,
+          jwtVcs[i],
+          credentialSubjectId,
+          true,
+        ),
+      approvedCredentials,
+    ),
+  );
+
+  return [issuedCredentials, jwtVcs];
+};
+
+module.exports = { issueCredentials };

package/src/entities/exchanges/orchestrators/post-presentation.js

@@ -0,0 +1,58 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const {
+  verifyVerifiablePresentationJwt,
+} = require('@verii/verii-verification');
+const { ExchangeStates, validateReferencedService } = require('../domain');
+const {
+  PresentationFormat,
+  validatePresentation,
+} = require('../../presentations');
+
+const postPresentation = async (
+  exchangeId,
+  jwtPresentationSubmission,
+  context,
+) => {
+  const { repos } = context;
+
+  const vp = await verifyVerifiablePresentationJwt(jwtPresentationSubmission, {
+    vnfProtocolVersion: 2,
+  });
+
+  const exchange = await repos.exchanges.addState(
+    exchangeId,
+    ExchangeStates.PRESENTATION_SUBMISSION_RECEIVED,
+    {
+      disclosureConsentedAt: new Date(),
+    },
+  );
+  const relyingPartyService = await repos.relyingPartyServices.findOne({
+    filter: { _id: exchange.serviceId },
+  });
+  validateReferencedService(relyingPartyService);
+  validatePresentation(vp, exchange, context, vp.presentation_submission);
+  const presentation = await repos.presentations.insert({
+    depotId: exchange.depotId,
+    exchangeId,
+    format: PresentationFormat.JWT_VP,
+    presentation: jwtPresentationSubmission,
+  });
+  return [relyingPartyService, exchange, presentation];
+};
+
+module.exports = { postPresentation };

package/src/entities/exchanges/repo/exchange-state-repo-extension.js

@@ -0,0 +1,78 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const { isEmpty, map } = require('lodash/fp');
+const newError = require('http-errors');
+const { ExchangeStates } = require('../domain');
+const { ExchangeErrors } = require('../domain/exchange-errors');
+
+const exchangeStateRepoExtension = (parent) => ({
+  insertWithInitialState: (val, states, ...args) => {
+    const timestamp = new Date();
+    return parent.insert(
+      {
+        events: [
+          {
+            state: ExchangeStates.NEW,
+            timestamp,
+          },
+          ...map((state) => ({ state, timestamp }), states),
+        ],
+        ...val,
+      },
+      ...args,
+    );
+  },
+  addState: async (
+    exchangeId,
+    state,
+    $set,
+    projection = parent.defaultColumnsSelection,
+  ) => {
+    const filter = {
+      _id: exchangeId,
+      'events.state': { $ne: ExchangeStates.COMPLETE },
+    };
+
+    let updateStatement = {
+      $push: { events: { state, timestamp: new Date() } },
+    };
+    if ($set) {
+      updateStatement = {
+        ...updateStatement,
+        $set: parent.prepModification($set),
+      };
+    }
+    const result = await parent
+      .collection()
+      .findOneAndUpdate(parent.prepFilter(filter), updateStatement, {
+        returnDocument: 'after',
+        includeResultMetadata: true,
+        projection,
+      });
+
+    if (isEmpty(result.value)) {
+      throw newError(400, 'Referenced exchange not found', {
+        errorCode: ExchangeErrors.REFERENCED_EXCHANGE_NOT_FOUND,
+      });
+    }
+
+    return result.value;
+  },
+  extensions: parent.extensions.concat(['exchangeStateRepoExtension']),
+});
+
+module.exports = { exchangeStateRepoExtension };

package/src/entities/exchanges/repo/index.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  exchangesRepoPlugin: require('./repo'),
+};

package/src/entities/exchanges/repo/repo.js

@@ -0,0 +1,52 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const {
+  repoFactory,
+  autoboxIdsExtension,
+} = require('@spencejs/spence-mongo-repos');
+const { multitenantExtension } = require('@verii/spencer-mongo-extensions');
+const {
+  exchangeStateRepoExtension,
+} = require('./exchange-state-repo-extension');
+
+module.exports = (app, options, next = () => {}) => {
+  next();
+  return repoFactory(
+    {
+      name: 'exchanges',
+      entityName: 'exchange',
+      defaultProjection: {
+        _id: 1,
+        serviceId: 1,
+        depotId: 1,
+        type: 1,
+        protocolMetadata: 1,
+        credentialTypes: 1,
+        messagingSettings: 1,
+        locale: 1,
+        events: 1,
+        createdAt: 1,
+      },
+      extensions: [
+        autoboxIdsExtension,
+        multitenantExtension(),
+        exchangeStateRepoExtension,
+      ],
+    },
+    app,
+  );
+};