@verii/server-credentialing-hub 2.0.0

package/src/entities/openid4vci/domain/openid4vci-errors.js

@@ -0,0 +1,24 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const Oidc4vciErrors = {
+  PRE_AUTHORIZATION_CODE_NOT_MATCHED: 'pre_authorization_code_not_matched',
+  UNKNOWN_CREDENTIAL_IDENTIFIER: 'unknown_credential_identifier',
+  INVALID_NOTIFICATION_ID: 'invalid_notification_id',
+  INVALID_NOTIFICATION_REQUEST: 'invalid_notification_request',
+};
+module.exports = { Oidc4vciErrors };

package/src/entities/openid4vci/domain/to-credential-configuration-id.js

@@ -0,0 +1,21 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const toCredentialConfigurationId = (credentialType) =>
+  `foundation.velocitynetwork.${credentialType}`;
+
+module.exports = { toCredentialConfigurationId };

package/src/entities/openid4vci/index.js

@@ -0,0 +1,21 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./domain'),
+  ...require('./orchestrators'),
+  ...require('./plugins'),
+};

package/src/entities/openid4vci/orchestrators/create-access-token.js

@@ -0,0 +1,85 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { filter, flow, isEmpty, map } = require('lodash/fp');
+const { calcSha384 } = require('@verii/crypto');
+const { toCredentialConfigurationId } = require('../domain');
+
+const createAccessToken = async (accessTokenParameters, context) => {
+  const openid4VciIssuer = await context.getOpenId4VciIssuer();
+  await openid4VciIssuer.validateAccessTokenParams(
+    accessTokenParameters,
+    context,
+  );
+  const depot = await context.repos.depots.findDepotByPreauthCode(
+    accessTokenParameters['pre-authorized_code'],
+  );
+  await openid4VciIssuer.verifyPreauthCode(
+    calcSha384(accessTokenParameters['pre-authorized_code']),
+    depot?.preauthCodeHash,
+    accessTokenParameters,
+    context,
+  );
+
+  const [credentials, issuerService] = await Promise.all([
+    context.repos.credentials.findByDepotId({
+      depotId: depot._id,
+      claimable: true,
+    }),
+    context.repos.issuerServices.findById(depot.serviceId),
+  ]);
+
+  const accessTokenResponse = await openid4VciIssuer.generateAccessToken(
+    accessTokenParameters,
+    buildAuthorizationDetails(
+      credentials,
+      accessTokenParameters.authorization_details,
+    ),
+    issuerService.authTokensExpireIn,
+  );
+  return accessTokenResponse;
+};
+
+const buildAuthorizationDetails = (
+  credentials,
+  requestedAuthorizationDetails,
+) => {
+  const pipeline = [
+    map((credential) => ({
+      type: 'openid_credential',
+      credential_configuration_id: toCredentialConfigurationId(
+        credential.typeMetadata.credentialType,
+      ),
+      credential_identifiers: [`${credential._id}`],
+    })),
+  ];
+
+  if (!isEmpty(requestedAuthorizationDetails)) {
+    const requestedCredentialConfigurationIds = map(
+      'credential_configuration_id',
+      requestedAuthorizationDetails,
+    );
+    pipeline.push(
+      filter(({ credential_configuration_id: credentialConfigurationId }) =>
+        requestedCredentialConfigurationIds.includes(credentialConfigurationId),
+      ),
+    );
+  }
+
+  return flow(pipeline)(credentials);
+};
+
+module.exports = { createAccessToken };

package/src/entities/openid4vci/orchestrators/create-credential.js

@@ -0,0 +1,108 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { Oauth2ServerErrorResponseError } = require('@openid4vc/oauth2');
+const { jwtDecode } = require('@verii/jwt');
+const { nanoid } = require('nanoid');
+const { Oidc4vciErrors } = require('../domain');
+const {
+  buildExchangeEvent,
+  ExchangeProtocols,
+  ExchangeStates,
+  ExchangeTypes,
+} = require('../../exchanges');
+const { signVeriiCredentialsFacade } = require('../../credentials');
+
+const createCredential = async (credentialRequestParameters, context) => {
+  const { repos } = context;
+  const openid4VciIssuer = await context.getOpenId4VciIssuer();
+  const credentialRequest = await openid4VciIssuer.getCredentialRequest(
+    credentialRequestParameters,
+  );
+
+  const credential = await repos.credentials.findOne({
+    filter: { _id: credentialRequest.credentialIdentifier },
+  });
+
+  if (credential == null) {
+    throw new Oauth2ServerErrorResponseError({
+      error: Oidc4vciErrors.UNKNOWN_CREDENTIAL_IDENTIFIER,
+      error_description: `Error identifying credential ${credentialRequest.credentialIdentifier}`,
+    });
+  }
+
+  const depot = await repos.depots.findById(credential.depotId);
+  const service = await repos.issuerServices.findById(depot.serviceId);
+
+  try {
+    const { payload } = jwtDecode(credentialRequest.proofs.jwt[0]);
+    const credentialSubjectId = payload.iss;
+
+    const { vcJwt, credentialMetadata } = await signVeriiCredentialsFacade(
+      [credential.content],
+      credentialSubjectId,
+      [credential.typeMetadata],
+      service,
+      context,
+    );
+
+    const newExchange = buildExchange(
+      service,
+      ExchangeStates.CREDENTIALS_SIGNED,
+      { credentialMetadata },
+    );
+    await repos.credentials.updateIssuedCredential(
+      credential._id,
+      jwtDecode(vcJwt).payload.vc.id,
+      vcJwt,
+      credentialSubjectId,
+      false,
+      newExchange,
+    );
+
+    return {
+      credentials: [{ credential: vcJwt }],
+      notification_id: newExchange.id,
+    };
+  } catch (error) {
+    context.log.error(error);
+    await repos.credentials.update(credential._id, {
+      exchange: buildExchange(service, ExchangeStates.UNEXPECTED_ERROR, {
+        err: error.message,
+        errorCode: error.errorCode,
+        errorDescription: error.error_description,
+      }),
+    });
+
+    throw new Oauth2ServerErrorResponseError({
+      error: 'server_error',
+      error_description: error.message,
+    });
+  }
+};
+
+const buildExchange = (service, state, overrides) => ({
+  id: nanoid(12),
+  type: ExchangeTypes.ISSUER,
+  serviceId: service._id,
+  protocolMetadata: {
+    protocol: ExchangeProtocols.OPENID4VCI,
+  },
+  events: [buildExchangeEvent(ExchangeStates.NEW), buildExchangeEvent(state)],
+  ...overrides,
+});
+
+module.exports = { createCredential };

package/src/entities/openid4vci/orchestrators/get-authorization-server-metadata.js

@@ -0,0 +1,22 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const getAuthorizationServerMetadata = async (context) => {
+  const issuer = await context.getOpenId4VciIssuer();
+  return issuer.getAuthorizationServerMetadata({ includeSignedMetadata: true });
+};
+
+module.exports = { getAuthorizationServerMetadata };

package/src/entities/openid4vci/orchestrators/get-credential-issuer-metadata.js

@@ -0,0 +1,22 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const getCredentialIssuerMetadata = async (context) => {
+  const issuer = await context.getOpenId4VciIssuer();
+  return issuer.getCredentialIssuerMetadata();
+};
+
+module.exports = { getCredentialIssuerMetadata };

package/src/entities/openid4vci/orchestrators/handle-notification.js

@@ -0,0 +1,94 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { Oauth2ServerErrorResponseError } = require('@openid4vc/oauth2');
+const { omitBy, isNil } = require('lodash/fp');
+const { Oidc4vciErrors } = require('../domain');
+const { ExchangeStates } = require('../../exchanges');
+const { anchorVeriiCredentialsFacade } = require('../../credentials');
+
+// eslint-disable-next-line complexity
+const handleNotification = async (notificationRequest, context) => {
+  const { repos } = context;
+  const credential = await repos.credentials.findOne(
+    { filter: { 'exchange.id': notificationRequest.notification_id } },
+    { exchange: 1 },
+  );
+
+  if (credential?.exchange == null) {
+    throw new Oauth2ServerErrorResponseError({
+      error: Oidc4vciErrors.INVALID_NOTIFICATION_ID,
+      error_description: `Error identifying notification ${notificationRequest.notification_id}`,
+    });
+  }
+
+  try {
+    switch (notificationRequest.event) {
+      case 'credential_accepted': {
+        await anchorVeriiCredentialsFacade(
+          [credential?.exchange.credentialMetadata],
+          context,
+        );
+        await repos.credentials.addExchangeState(
+          credential._id,
+          ExchangeStates.COMPLETE,
+          { acceptedAt: new Date() },
+        );
+        break;
+      }
+      case 'credential_deleted':
+        await repos.credentials.addExchangeState(
+          credential._id,
+          ExchangeStates.COMPLETE,
+          { deletedAt: new Date() },
+        );
+        break;
+      case 'credential_failure':
+        await repos.credentials.addExchangeState(
+          credential._id,
+          ExchangeStates.CLIENT_ERROR,
+          {
+            'exchange.err': 'client_credential_failure',
+            'exchange.errorDescription': notificationRequest.event_description,
+            failedAt: new Date(),
+          },
+        );
+        break;
+      default:
+        throw new Oauth2ServerErrorResponseError({
+          error: Oidc4vciErrors.INVALID_NOTIFICATION_REQUEST,
+          error_description: 'event not supported',
+        });
+    }
+  } catch (error) {
+    context.log.error(error);
+    await repos.credentials.addExchangeState(
+      credential._id,
+      ExchangeStates.UNEXPECTED_ERROR,
+      omitBy(isNil, {
+        'exchange.err': error.message,
+        'exchange.errorCode': error.errorCode,
+        'exchange.errorDescription': error.error_description,
+      }),
+    );
+    throw new Oauth2ServerErrorResponseError({
+      error: 'server_error',
+      error_description: error.message,
+    });
+  }
+};
+
+module.exports = { handleNotification };

package/src/entities/openid4vci/orchestrators/index.js

@@ -0,0 +1,24 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+module.exports = {
+  ...require('./create-access-token'),
+  ...require('./get-authorization-server-metadata'),
+  ...require('./get-credential-issuer-metadata'),
+  ...require('./create-credential'),
+  ...require('./handle-notification'),
+};

package/src/entities/openid4vci/plugins/index.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./openid4vci-plugin'),
+};