@verii/server-credentialing-hub 2.0.0

package/src/entities/openid4vp/plugins/openid4vp-plugin.js

@@ -0,0 +1,174 @@
+/*
+ * Copyright 2026 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const fp = require('fastify-plugin');
+const { Openid4vpVerifier } = require('@openid4vc/openid4vp');
+const {
+  Oauth2Error,
+  Oauth2ErrorCodes,
+  Oauth2ServerErrorResponseError,
+} = require('@openid4vc/oauth2');
+const { KeyPurposes } = require('@verii/crypto');
+const { toDidUrl } = require('@verii/did-doc');
+
+const openid4vpPlugin = async (fastify) => {
+  fastify.decorateRequest(
+    'getOpenId4VpVerifier',
+    async function getOpenId4VpVerifier() {
+      return buildVerifier(this);
+    },
+  );
+  fastify.decorate('openid4vpErrorHandler', (error, request, reply) => {
+    if (error.code === 'FST_ERR_VALIDATION') {
+      reply.status(error.statusCode);
+      return {
+        error: Oauth2ErrorCodes.InvalidRequest,
+        error_description: getOpenid4vpValidationErrorDescription(error),
+      };
+    }
+    if (error.errorResponse == null) {
+      const statusCode = error.statusCode ?? 500;
+      reply.status(statusCode);
+      if (statusCode >= 500) {
+        request.log.error(error);
+        return {
+          error: Oauth2ErrorCodes.ServerError,
+          error_description: 'Unexpected server error',
+        };
+      }
+      return {
+        error: Oauth2ErrorCodes.InvalidRequest,
+        error_description: error.message,
+      };
+    }
+    reply.status(error.status);
+    return error.errorResponse;
+  });
+};
+
+const getOpenid4vpValidationErrorDescription = (error) => {
+  if (
+    error.validation?.some(
+      ({ instancePath, keyword }) =>
+        instancePath === '/vp_token' && keyword === 'pattern',
+    )
+  ) {
+    return 'OpenID4VP VP token is missing';
+  }
+
+  if (error.validation == null || error.validation.length === 0) {
+    return error.message;
+  }
+
+  return `${error.validationContext}${error.validation[0].instancePath} ${error.validation[0].message}`;
+};
+
+const buildVerifier = (context) => {
+  const { tenant } = context;
+  const exchangesKey = tenant.keysByPurpose[KeyPurposes.EXCHANGES];
+  const signer = {
+    method: 'did',
+    didUrl: toDidUrl(tenant.did, exchangesKey.kidFragment),
+    alg: 'ES256K',
+    kid: toDidUrl(tenant.did, exchangesKey.kidFragment),
+  };
+  const verifier = new Openid4vpVerifier({
+    callbacks: {
+      signJwt: (jwtSigner, jwt) => signJwt(jwtSigner, jwt, context),
+      encryptJwe: () => {
+        throw new Error('OpenID4VP encrypted responses are not supported');
+      },
+      verifyJwt: () => {
+        throw new Error('OpenID4VP response verification is not implemented');
+      },
+      decryptJwe: () => {
+        throw new Error('OpenID4VP encrypted responses are not supported');
+      },
+      hash: () => {
+        throw new Error('OpenID4VP transaction data is not implemented');
+      },
+    },
+  });
+
+  const createAuthorizationRequestJwt = async ({
+    requestId,
+    authorizationRequestPayload,
+    requestUri,
+    expiresInSeconds,
+    walletNonce,
+  }) => {
+    const { jar } = await verifier.createOpenId4vpAuthorizationRequest({
+      authorizationRequestPayload,
+      wallet: { expectedNonce: walletNonce },
+      jar: {
+        requestUri,
+        jwtSigner: signer,
+        expiresInSeconds,
+        additionalJwtPayload: {
+          iss: authorizationRequestPayload.client_id,
+          jti: requestId,
+        },
+      },
+    });
+
+    return jar.authorizationRequestJwt;
+  };
+
+  const parseAuthorizationResponse = async (options) => {
+    try {
+      return await verifier.parseOpenid4vpAuthorizationResponse(options);
+    } catch (error) {
+      if (error instanceof Oauth2ServerErrorResponseError) {
+        throw error;
+      }
+      if (error instanceof Oauth2Error) {
+        throw new Oauth2ServerErrorResponseError(
+          {
+            error: Oauth2ErrorCodes.InvalidRequest,
+            error_description: error.message,
+          },
+          { status: 400 },
+        );
+      }
+      throw error;
+    }
+  };
+
+  return { createAuthorizationRequestJwt, parseAuthorizationResponse };
+};
+
+const signJwt = async (jwtSigner, { header, payload }, context) => {
+  const { kms, tenant } = context;
+  const exchangesKey = tenant.keysByPurpose[KeyPurposes.EXCHANGES];
+  const jwt = await kms.signJwt(payload, exchangesKey._id, {
+    alg: jwtSigner.alg,
+    kid: header.kid,
+    typ: header.typ,
+  });
+
+  return {
+    jwt,
+    signerJwk: exchangesKey.publicJwk,
+  };
+};
+
+module.exports = {
+  openid4vpPlugin: fp(openid4vpPlugin, {
+    name: 'openid4vp-plugin',
+    dependencies: [],
+  }),
+};

package/src/entities/presentations/domain/index.js

@@ -0,0 +1,20 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./presentation-format'),
+  ...require('./validate-presentation'),
+};

package/src/entities/presentations/domain/presentation-format.js

@@ -0,0 +1,20 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const PresentationFormat = {
+  JWT_VP: 'JWT_VP',
+};
+module.exports = { PresentationFormat };

package/src/entities/presentations/domain/validate-presentation.js

@@ -0,0 +1,178 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const newError = require('http-errors');
+const { first, includes, isEmpty, castArray, omit } = require('lodash/fp');
+const { JSONPath } = require('jsonpath-plus');
+
+const VALID_PRESENTATION_CONTEXTS = [
+  'https://www.w3.org/2018/credentials/v1',
+  'https://www.w3.org/ns/credentials/v2',
+];
+const SUPPORTED_DESCRIPTOR_FORMATS = ['jwt_vc', 'jwt_vp'];
+const SUPPORTED_NESTED_VP_TOKEN_PATHS = ['$', '$[0]'];
+const presentationSchema = {
+  $ref: 'https://velocitycareerlabs.io/velocity-presentation-submission.schema.json#',
+};
+
+const validatePresentation = (
+  presentation,
+  exchange,
+  context,
+  presentationSubmission = presentation.presentation_submission,
+) => {
+  const submittedPresentation = {
+    ...presentation,
+    presentation_submission: presentationSubmission,
+  };
+  const validateSchema = context.compileValidationSchema(presentationSchema);
+  if (!validateSchema(submittedPresentation)) {
+    throw newError(
+      400,
+      `${validateSchema.errors[0].instancePath.substring(1)} ${
+        validateSchema.errors[0].message
+      }`,
+      {
+        errorCode: 'request_validation_failed',
+      },
+    );
+  }
+  validatePresentationContext(presentation, context);
+  verifyPresentationSubmissionAgainstDefinition(
+    presentationSubmission,
+    presentation,
+  );
+  verifyPresentationAgainstExchange(presentationSubmission, exchange);
+};
+
+const validatePresentationContext = (presentation) => {
+  if (
+    !includes(
+      first(castArray(presentation?.['@context'])),
+      VALID_PRESENTATION_CONTEXTS,
+    )
+  ) {
+    throw newError(400, 'presentation @context is invalid', {
+      errorCode: 'presentation_invalid',
+    });
+  }
+};
+
+const verifyPresentationAgainstExchange = (
+  presentationSubmission,
+  exchange,
+) => {
+  if (presentationSubmission.definition_id == null) {
+    return;
+  }
+
+  const [exchangeId, disclosureId] =
+    presentationSubmission.definition_id.split('.');
+
+  if (exchange?._id.toString() !== exchangeId) {
+    throw newError(400, 'Mismatched Exchange Ids', {
+      exchange,
+      presentationSubmission,
+      errorCode: 'presentation_mismatch_exchange',
+    });
+  }
+  if (exchange?.serviceId.toString() !== disclosureId) {
+    throw newError(400, 'Mismatched Service Ids', {
+      exchange,
+      presentationSubmission,
+      errorCode: 'presentation_mismatch_service',
+    });
+  }
+};
+
+const verifyPresentationSubmissionAgainstDefinition = (
+  presentationSubmission,
+  presentation,
+) => {
+  const presentationContent = omit(['presentation_submission'], presentation);
+  for (const descriptor of presentationSubmission.descriptor_map) {
+    validateDescriptorFormat(descriptor);
+    validateDescriptorPath(descriptor);
+    const result = getJsonAtPath(
+      getDescriptorPath(descriptor),
+      presentationContent,
+    );
+    if (isEmpty(result)) {
+      throw newError(
+        400,
+        'Presentation path descriptor does not reference any valid data: JSONPath expression returned no results',
+        {
+          descriptor,
+          json: presentationContent,
+          errorCode: 'presentation_jsonpath_empty',
+        },
+      );
+    }
+  }
+};
+
+const validateDescriptorFormat = (descriptor) => {
+  if (!SUPPORTED_DESCRIPTOR_FORMATS.includes(descriptor.format)) {
+    throw newError(
+      400,
+      "Velocity Presentation Submission only supports 'jwt_vc' or 'jwt_vp' inputs",
+      { errorCode: 'presentation_missing_jwtvc_or_jwtvp' },
+    );
+  }
+};
+
+const validateDescriptorPath = (descriptor) => {
+  if (descriptor.path_nested != null) {
+    if (descriptor.path_nested.path_nested != null) {
+      throw newError(
+        400,
+        'Presentation path descriptor uses unsupported recursive nested paths',
+        {
+          descriptor,
+          errorCode: 'presentation_jsonpath_unsupported',
+        },
+      );
+    }
+    validateDescriptorFormat(descriptor.path_nested);
+  }
+  if (
+    descriptor.path_nested != null &&
+    !SUPPORTED_NESTED_VP_TOKEN_PATHS.includes(descriptor.path)
+  ) {
+    throw newError(
+      400,
+      'Presentation path descriptor uses an unsupported nested VP-token path',
+      {
+        descriptor,
+        errorCode: 'presentation_jsonpath_unsupported',
+      },
+    );
+  }
+};
+
+const getDescriptorPath = (descriptor) =>
+  descriptor.path_nested?.path ?? descriptor.path;
+
+const getJsonAtPath = (path, json) =>
+  JSONPath({
+    path,
+    json,
+    preventEval: true,
+  });
+
+module.exports = {
+  validatePresentation,
+};

package/src/entities/presentations/factories/index.js

@@ -0,0 +1,19 @@
+/**
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module.exports = {
+  ...require('./presentation-factory'),
+};

package/src/entities/presentations/factories/presentation-factory.js

@@ -0,0 +1,96 @@
+/**
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const { register } = require('@spencejs/spence-factories');
+const { ObjectId } = require('mongodb');
+const {
+  generatePresentationJwt,
+  generateCredentialJwt,
+} = require('@verii/jwt');
+const { generateKeyPair } = require('@verii/crypto');
+const { getDidUriFromJwk } = require('@verii/did-doc/src/did-jwk');
+const { hashOffer } = require('@verii/verii-issuing');
+const { initTenantFactory } = require('../../tenants/factories');
+const { initDepotFactory } = require('../../depots/factories');
+const { initExchangeFactory } = require('../../exchanges/factories');
+const { PresentationFormat } = require('../domain/presentation-format');
+const { presentationsRepoPlugin } = require('../repo');
+
+const initPresentationFactory = (app) =>
+  register(
+    'presentation',
+    presentationsRepoPlugin(app)({ config: app.config }),
+    async (overrides, { getOrBuild }) => {
+      const tenant = await getOrBuild('tenant', initTenantFactory(app));
+      const depot = await getOrBuild('depot', initDepotFactory(app));
+      const exchange = await getOrBuild('exchange', initExchangeFactory(app));
+      const holderKeyPair = await getOrBuild('holderKey', defaultKeyPair);
+
+      const vcContent = await getOrBuild('vcContent', defaultVcContent);
+      const credentialDid = await getOrBuild(
+        'credentialDid',
+        defaultCredentialDid(vcContent),
+      );
+      const vcKeyPair = await getOrBuild('vcKeyPair', defaultKeyPair);
+
+      const holderDid = getDidUriFromJwk(holderKeyPair.publicKey);
+      const vc = await generateCredentialJwt(
+        createVcPayload(tenant, credentialDid, holderDid, vcContent),
+        vcKeyPair.privateKey,
+        `${credentialDid}#key-1`,
+      );
+
+      const presentation = await generatePresentationJwt(
+        { verifiableCredential: [vc], issuer: holderDid },
+        holderKeyPair.privateKey,
+        `${holderDid}#key`,
+      );
+
+      return {
+        format: PresentationFormat.JWT_VP,
+        exchangeId: new ObjectId(exchange._id),
+        depotId: new ObjectId(depot._id),
+        tenantId: new ObjectId(tenant._id),
+        presentation,
+        ...overrides(),
+      };
+    },
+  );
+
+const defaultCredentialDid = (vcContent) => () =>
+  `did:velocity:v2:A:1:i:${hashOffer(vcContent)}`;
+
+const createVcPayload = (tenant, credentialDid, holderDid, content) => ({
+  ...content,
+  id: credentialDid,
+  issuer: { id: tenant.did },
+  credentialSubject: {
+    id: holderDid,
+    ...content.credentialSubject,
+  },
+});
+
+const defaultVcContent = () => ({
+  type: ['Employment'],
+  credentialSubject: {
+    legalEmployer: { name: 'ExampleEmployer', identifier: 'did:example.com' },
+    roleName: 'CEO',
+  },
+});
+
+const defaultKeyPair = () => generateKeyPair({ format: 'jwk' });
+
+module.exports = { initPresentationFactory, defaultVcContent };

package/src/entities/presentations/index.js

@@ -0,0 +1,21 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./domain'),
+  ...require('./factories'),
+  ...require('./orchestrators'),
+};

package/src/entities/presentations/orchestrators/index.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./verify-presentation'),
+};

package/src/entities/presentations/orchestrators/verify-presentation.js

@@ -0,0 +1,131 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { jwtDecode, verifyPresentationJwt } = require('@verii/jwt');
+const { getJwkFromDidUri } = require('@verii/did-doc');
+const { CheckResults } = require('@verii/vc-checks');
+const { verifyCredentials } = require('@verii/verii-verification');
+const { KeyPurposes } = require('@verii/crypto');
+const {
+  resolveDid,
+  getOrganizationVerifiedProfile,
+  getCredentialTypeMetadata,
+} = require('@verii/common-fetchers');
+const { flow, every, includes, map } = require('lodash/fp');
+const { mapWithIndex } = require('@verii/common-functions');
+const newError = require('http-errors');
+const { PresentationFormat } = require('../domain/presentation-format');
+const {
+  CredentialFormat,
+} = require('../../credentials/domain/credential-format');
+
+const verifyPresentation = async (presentation, context) => {
+  const { tenant } = context;
+  const { header, payload } = jwtDecode(presentation);
+
+  try {
+    const jwk = header.jwk ?? getJwkFromDidUri(header.kid);
+    await verifyPresentationJwt(presentation, jwk);
+  } catch {
+    return {
+      format: PresentationFormat.JWT_VP,
+      presentation,
+      w3cPresentation: payload.vp,
+      verification: {
+        verified: false,
+        tamperCheck: CheckResults.FAIL,
+      },
+    };
+  }
+
+  // eslint-disable-next-line better-mutation/no-mutation
+  context.caoDid = tenant.caoDid;
+
+  const credentialCheckResults = await verifyCredentials(
+    {
+      credentials: payload.vp.verifiableCredential,
+      expectedHolderDid: payload.iss,
+      relyingParty: {
+        dltOperatorKMSKeyId:
+          tenant.keysByPurpose[KeyPurposes.DLT_TRANSACTIONS]._id,
+      },
+    },
+    {
+      resolveDid,
+      getOrganizationVerifiedProfile,
+      getCredentialTypeMetadata,
+    },
+    context,
+  );
+
+  const credentials = mapWithIndex((credentialCheckResult, index) => {
+    const conclusion = calcCredentialConclusion(
+      Object.values(credentialCheckResult.credentialChecks),
+    );
+    return {
+      format: CredentialFormat.JWT_VC,
+      credential: payload.vp.verifiableCredential[index],
+      w3cCredential: credentialCheckResult.credential,
+      conclusion,
+      verified: conclusion === CheckResults.PASS,
+      tamperCheck: credentialCheckResult.credentialChecks.UNTAMPERED,
+      trustedIssuerCheck: credentialCheckResult.credentialChecks.TRUSTED_ISSUER,
+      trustedHolderCheck: credentialCheckResult.credentialChecks.TRUSTED_HOLDER,
+      revocationCheck: credentialCheckResult.credentialChecks.UNREVOKED,
+      expiryCheck: credentialCheckResult.credentialChecks.UNEXPIRED,
+    };
+  }, credentialCheckResults);
+
+  if (
+    flow(
+      map('conclusion'),
+      includes(CheckResults.VOUCHER_RESERVE_EXHAUSTED),
+    )(credentials)
+  ) {
+    throw newError(402, 'Verification vouchers exhausted', {
+      errorCode: 'verification_payment_required',
+    });
+  }
+
+  return {
+    format: PresentationFormat.JWT_VP,
+    presentation,
+    w3cPresentation: payload.vp,
+    verification: {
+      verified: every(({ verified }) => verified, credentials),
+      tamperCheck: CheckResults.PASS,
+      credentials,
+    },
+  };
+};
+
+const calcCredentialConclusion = (vals) => {
+  for (const val of vals) {
+    if (val === CheckResults.VOUCHER_RESERVE_EXHAUSTED) {
+      return CheckResults.VOUCHER_RESERVE_EXHAUSTED;
+    }
+
+    if (![CheckResults.PASS, CheckResults.NOT_APPLICABLE].includes(val)) {
+      return CheckResults.FAIL;
+    }
+  }
+
+  return CheckResults.PASS;
+};
+
+module.exports = {
+  verifyPresentation,
+};