@verii/server-credentialing-hub 2.0.0

package/src/controllers/openid4vc/openid4vc-metadata-controller.js

@@ -0,0 +1,66 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const cors = require('@fastify/cors');
+const { KeyPurposes } = require('@verii/crypto');
+const { toDidUrl } = require('@verii/did-doc');
+const {
+  getCredentialIssuerMetadata,
+  getAuthorizationServerMetadata,
+} = require('../../entities/openid4vci');
+
+const APPLICATION_JWT_MEDIA_TYPE = 'application/jwt';
+const openid4vcMetadataController = async (fastify) => {
+  fastify
+    .register(cors, { origin: true })
+    .get(
+      '/.well-known/openid-credential-issuer/r/:tenantId',
+      async (req, reply) => {
+        const credentialIssuerMetadata = await getCredentialIssuerMetadata(req);
+        if (req.headers.accept?.includes(APPLICATION_JWT_MEDIA_TYPE)) {
+          reply.type(APPLICATION_JWT_MEDIA_TYPE);
+          const exchangesKey = req.tenant.keysByPurpose[KeyPurposes.EXCHANGES];
+          return req.kms.signJwt(credentialIssuerMetadata, exchangesKey._id, {
+            issuer: req.tenant.did,
+            subject: req.tenant.did,
+            kid: toDidUrl(req.tenant.did, exchangesKey.kidFragment),
+            expiresIn: '1w',
+          });
+        }
+        return credentialIssuerMetadata;
+      },
+    )
+    .get('/.well-known/oauth-authorization-server/r/:tenantId', async (req) => {
+      const authorizationServerMetadata =
+        await getAuthorizationServerMetadata(req);
+      const exchangesKey = req.tenant.keysByPurpose[KeyPurposes.EXCHANGES];
+      return {
+        signed_metadata: await req.kms.signJwt(
+          authorizationServerMetadata,
+          exchangesKey._id,
+          {
+            issuer: req.tenant.did,
+            subject: req.tenant.did,
+            kid: toDidUrl(req.tenant.did, exchangesKey.kidFragment),
+            expiresIn: '1w',
+          },
+        ),
+      };
+    });
+};
+
+module.exports = openid4vcMetadataController;

package/src/controllers/openid4vc/openid4vci-controller.js

@@ -0,0 +1,125 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const { Oauth2ErrorCodes } = require('@openid4vc/oauth2');
+const {
+  createCredential,
+  handleNotification,
+  Oidc4vciErrors,
+} = require('../../entities/openid4vci');
+const { oauthErrorResponseSchema } = require('../../schemas');
+
+const openid4vciController = async (fastify) => {
+  fastify
+    .post(
+      '/r/:tenantId/openid4vc/nonce',
+      {
+        schema: fastify.autoSchema({
+          params: {
+            type: 'object',
+            properties: {
+              tenantId: { type: 'string' },
+            },
+          },
+        }),
+      },
+      async (req, reply) => {
+        reply.header('Cache-Control', 'no-store');
+        const openid4vcIssuer = await req.getOpenId4VciIssuer();
+        return openid4vcIssuer.createNonce();
+      },
+    )
+    .post(
+      '/r/:tenantId/openid4vc/credential',
+      {
+        errorHandler: (e, request, reply) => {
+          const error = fastify.openid4vcErrorHandler(e, request, reply);
+          if (error.error === Oauth2ErrorCodes.InvalidRequest) {
+            // eslint-disable-next-line better-mutation/no-mutation
+            error.error = Oauth2ErrorCodes.InvalidCredentialRequest;
+          }
+          return error;
+        },
+        preHandler: (req, reply) => fastify.openid4vcBearerAuth(req, reply),
+        schema: fastify.autoSchema({
+          params: {
+            type: 'object',
+            properties: {
+              tenantId: { type: 'string' },
+            },
+          },
+          response: {
+            400: oauthErrorResponseSchema,
+            401: oauthErrorResponseSchema,
+            500: oauthErrorResponseSchema,
+          },
+        }),
+      },
+      async (req) => createCredential(req.body, req),
+    )
+    .post(
+      '/r/:tenantId/openid4vc/notification',
+      {
+        errorHandler: (e, request, reply) => {
+          const error = fastify.openid4vcErrorHandler(e, request, reply);
+          if (error.error === Oauth2ErrorCodes.InvalidRequest) {
+            // eslint-disable-next-line better-mutation/no-mutation
+            error.error = Oidc4vciErrors.INVALID_NOTIFICATION_REQUEST;
+          }
+          return error;
+        },
+        preHandler: (req, reply) => fastify.openid4vcBearerAuth(req, reply),
+        schema: fastify.autoSchema({
+          params: {
+            type: 'object',
+            properties: {
+              tenantId: { type: 'string' },
+            },
+          },
+          body: {
+            type: 'object',
+            properties: {
+              notification_id: { type: 'string' },
+              event: {
+                type: 'string',
+                enum: [
+                  'credential_accepted',
+                  'credential_deleted',
+                  'credential_failure',
+                ],
+              },
+              event_description: { type: 'string' },
+            },
+            required: ['notification_id', 'event'],
+          },
+
+          response: {
+            400: oauthErrorResponseSchema,
+            401: oauthErrorResponseSchema,
+            500: oauthErrorResponseSchema,
+          },
+        }),
+      },
+      async (req, reply) => {
+        await handleNotification(req.body, req);
+        reply.status(204);
+        return {};
+      },
+    );
+};
+
+module.exports = openid4vciController;

package/src/controllers/openid4vp/autohooks.js

@@ -0,0 +1,22 @@
+/*
+ * Copyright 2026 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { tenantLoaderPlugin } = require('../../entities/tenants');
+const { kmsPlugin } = require('../../entities/keys');
+
+module.exports = async (fastify) => {
+  fastify.register(tenantLoaderPlugin).register(kmsPlugin);
+};

package/src/controllers/openid4vp/openid4vp-controller.js

@@ -0,0 +1,177 @@
+/*
+ * Copyright 2026 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const fastifyFormBody = require('@fastify/formbody');
+const {
+  createAuthorizationRequest,
+  postAuthorizationResponse,
+} = require('../../entities/openid4vp');
+const { oauthErrorResponseSchema } = require('../../schemas');
+const {
+  presentationSubmissionSchema,
+  velocityPresentationSubmissionSchema,
+} = require('../vn-api/schemas');
+
+const openid4vpController = async (fastify) => {
+  fastify.register(fastifyFormBody);
+  fastify
+    .addSchema(presentationSubmissionSchema)
+    .addSchema(velocityPresentationSubmissionSchema);
+
+  fastify
+    .post(
+      '/r/:tenantId/openid4vp/authorization-request/:requestId',
+      {
+        errorHandler: (error, request, reply) =>
+          fastify.openid4vpErrorHandler(error, request, reply),
+        schema: fastify.autoSchema({
+          params: {
+            type: 'object',
+            properties: {
+              tenantId: { type: 'string' },
+              requestId: { type: 'string' },
+            },
+            required: ['tenantId', 'requestId'],
+          },
+          headers: {
+            type: 'object',
+            properties: {
+              'content-type': {
+                type: 'string',
+                pattern: '^application/x-www-form-urlencoded(?:\\s*;.*)?$',
+              },
+              accept: {
+                type: 'string',
+                pattern: 'application/oauth-authz-req\\+jwt',
+              },
+            },
+            required: ['content-type', 'accept'],
+          },
+          body: {
+            type: 'object',
+            properties: {
+              wallet_metadata: { type: 'string' },
+              wallet_nonce: { type: 'string', minLength: 11 },
+            },
+            required: ['wallet_metadata', 'wallet_nonce'],
+          },
+          response: {
+            200: {
+              description: 'OpenID4VP authorization request JWT',
+              content: {
+                'application/oauth-authz-req+jwt': {
+                  schema: { type: 'string' },
+                },
+              },
+            },
+            400: oauthErrorResponseSchema,
+            404: oauthErrorResponseSchema,
+            500: oauthErrorResponseSchema,
+          },
+        }),
+      },
+      async (req, reply) => {
+        const authorizationRequestJwt = await createAuthorizationRequest(
+          req.params.requestId,
+          {
+            walletMetadata: req.body.wallet_metadata,
+            walletNonce: req.body.wallet_nonce,
+          },
+          req,
+        );
+
+        reply.type('application/oauth-authz-req+jwt');
+        return authorizationRequestJwt;
+      },
+    )
+    .post(
+      '/r/:tenantId/openid4vp/direct-post',
+      {
+        errorHandler: (error, request, reply) =>
+          fastify.openid4vpErrorHandler(error, request, reply),
+        schema: fastify.autoSchema({
+          params: {
+            type: 'object',
+            properties: {
+              tenantId: { type: 'string' },
+            },
+            required: ['tenantId'],
+          },
+          headers: {
+            type: 'object',
+            properties: {
+              'content-type': {
+                type: 'string',
+                pattern: '^application/x-www-form-urlencoded(?:\\s*;.*)?$',
+              },
+            },
+            required: ['content-type'],
+          },
+          body: {
+            oneOf: [
+              {
+                type: 'object',
+                properties: {
+                  state: {
+                    type: 'string',
+                    minLength: 1,
+                    pattern: '^[0-9a-fA-F]{24}$',
+                  },
+                  vp_token: {
+                    type: 'string',
+                    minLength: 1,
+                    pattern: '^(?!\\s*\\[\\s*\\]\\s*$).+',
+                  },
+                  presentation_submission: { type: 'string', minLength: 1 },
+                },
+                required: ['state', 'vp_token', 'presentation_submission'],
+              },
+              {
+                type: 'object',
+                properties: {
+                  state: {
+                    type: 'string',
+                    minLength: 1,
+                    pattern: '^[0-9a-fA-F]{24}$',
+                  },
+                  error: { type: 'string', minLength: 1 },
+                  error_description: { type: 'string', minLength: 1 },
+                },
+                required: ['state', 'error'],
+              },
+            ],
+          },
+          response: {
+            200: {
+              type: 'object',
+              additionalProperties: false,
+              properties: {},
+            },
+            400: oauthErrorResponseSchema,
+            404: oauthErrorResponseSchema,
+            500: oauthErrorResponseSchema,
+          },
+        }),
+      },
+      async (req) => {
+        await postAuthorizationResponse(req.body, req);
+        return {};
+      },
+    );
+};
+
+module.exports = openid4vpController;

package/src/controllers/operator/autohooks.js

@@ -0,0 +1,31 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { responseRequestIdPlugin } = require('@verii/fastify-plugins');
+const fastifyBearerAuth = require('@fastify/bearer-auth');
+const { kmsPlugin } = require('../../entities/keys');
+
+module.exports = async (fastify) => {
+  if (!fastify.config.isTest) {
+    fastify.register(fastifyBearerAuth, {
+      keys: new Set([fastify.config.operatorApiToken]),
+    });
+  }
+  fastify
+    .register(kmsPlugin)
+    .register(responseRequestIdPlugin)
+    .autoSchemaPreset({ security: [{ bearerAuth: [] }] });
+};

package/src/controllers/operator/credentials/credentials-controller.js

@@ -0,0 +1,212 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const {
+  newOfferRelatedResourceSchema,
+  w3cVcSchema,
+} = require('@verii/common-schemas');
+const { validationPlugin } = require('@verii/validation');
+const { tenantLoaderPlugin } = require('../../../entities/tenants');
+const { createCredentials } = require('../../../entities/credentials');
+const { newCredentialSchema, credentialSchema } = require('./schemas');
+
+const credentialsController = async (fastify) => {
+  fastify
+    .addSchema(newOfferRelatedResourceSchema)
+    .addSchema(w3cVcSchema)
+    .addSchema(newCredentialSchema)
+    .addSchema(credentialSchema)
+    .register(tenantLoaderPlugin, { notFoundStatusCode: 400 })
+    .register(validationPlugin, {
+      ajv: { useDefaults: true, strictTypes: false },
+      decorateRequest: ['addDocSchema', 'getDocValidator'],
+    })
+    .post(
+      '/create',
+      {
+        schema: fastify.autoSchema({
+          body: {
+            type: 'object',
+            properties: {
+              tenantId: {
+                type: 'string',
+              },
+              depotId: { type: 'string' },
+              credential: {
+                $ref: 'new-credential',
+              },
+            },
+            required: ['tenantId', 'depotId', 'credential'],
+          },
+          response: {
+            200: {
+              type: 'object',
+              properties: {
+                credential: {
+                  $ref: 'Credential',
+                },
+                requestId: {
+                  type: 'string',
+                },
+              },
+            },
+          },
+        }),
+      },
+      async (req) => {
+        const { body } = req;
+        const [credential] = await createCredentials([body], req);
+        return { credential };
+      },
+    )
+    .post(
+      '/create-many',
+      {
+        schema: fastify.autoSchema({
+          body: {
+            type: 'object',
+            properties: {
+              tenantId: {
+                type: 'string',
+              },
+              items: {
+                type: 'array',
+                items: {
+                  type: 'object',
+                  properties: {
+                    depotId: { type: 'string' },
+                    credential: {
+                      $ref: 'new-credential',
+                    },
+                  },
+                  required: ['depotId', 'credential'],
+                },
+                minItems: 1,
+              },
+            },
+            required: ['tenantId', 'items'],
+          },
+          response: {
+            200: {
+              type: 'object',
+              properties: {
+                credentials: {
+                  type: 'array',
+                  items: {
+                    $ref: 'Credential',
+                  },
+                },
+                requestId: {
+                  type: 'string',
+                },
+              },
+            },
+          },
+        }),
+      },
+      async (req) => {
+        const { body } = req;
+        const credentials = await createCredentials(body.items, req);
+        return { credentials };
+      },
+    )
+    .get(
+      '/get',
+      {
+        schema: fastify.autoSchema({
+          query: {
+            type: 'object',
+            properties: {
+              tenantId: {
+                type: 'string',
+              },
+              credentialId: {
+                type: 'string',
+              },
+            },
+            required: ['tenantId'],
+          },
+          response: {
+            200: {
+              type: 'object',
+              properties: {
+                credentials: {
+                  type: 'array',
+                  items: {
+                    $ref: 'Credential',
+                  },
+                },
+                requestId: {
+                  type: 'string',
+                },
+              },
+            },
+          },
+        }),
+      },
+      async (req) => {
+        const {
+          query: { credentialId },
+          repos,
+        } = req;
+        const credentials = await repos.credentials.search({
+          credentialIds: credentialId ? [credentialId] : [],
+        });
+
+        return { credentials };
+      },
+    )
+    .post(
+      '/delete',
+      {
+        schema: fastify.autoSchema({
+          body: {
+            type: 'object',
+            properties: {
+              tenantId: {
+                type: 'string',
+              },
+              credentialIds: {
+                type: 'array',
+                items: {
+                  type: 'string',
+                },
+                minItems: 1,
+              },
+            },
+            required: ['tenantId', 'credentialIds'],
+          },
+          response: {
+            200: {
+              type: 'object',
+              properties: {
+                requestId: {
+                  type: 'string',
+                },
+              },
+            },
+          },
+        }),
+      },
+      async (req) =>
+        req.repos.credentials.delUsingFilter({
+          filter: { _id: { $in: req.body.credentialIds } },
+        }),
+    );
+};
+
+module.exports = credentialsController;

package/src/controllers/operator/credentials/schemas/credential.schema.js

@@ -0,0 +1,46 @@
+const { mutableEntitySchema } = require('@verii/common-schemas');
+const newCredentialSchema = require('./new-credential.schema.json');
+
+const credentialSchema = {
+  $id: 'Credential',
+  type: 'object',
+  properties: {
+    ...mutableEntitySchema.properties,
+    ...newCredentialSchema.properties,
+    depotId: {
+      type: 'string',
+      description: 'the depot that contains this credential',
+    },
+    contentHash: {
+      type: 'string',
+      description: 'the credential content hash',
+    },
+    acceptedAt: {
+      type: 'string',
+      description: 'when the credential was accepted',
+      format: 'date-time',
+    },
+    jwtVc: {
+      type: 'string',
+      description: 'the issued credential',
+    },
+    rejectedAt: {
+      type: 'string',
+      description: 'when the credential was rejected',
+      format: 'date-time',
+    },
+    rejectedReason: {
+      type: 'string',
+      description: 'an optional reason that was captured during rejection',
+    },
+  },
+  required: [
+    ...mutableEntitySchema.required,
+    ...newCredentialSchema.required,
+    'depotId',
+    'contentHash',
+  ],
+  $defs: newCredentialSchema.$defs,
+};
+
+module.exports = credentialSchema;

package/src/controllers/operator/credentials/schemas/index.js

@@ -0,0 +1,7 @@
+const newCredentialSchema = require('./new-credential.schema.json');
+const credentialSchema = require('./credential.schema');
+
+module.exports = {
+  credentialSchema,
+  newCredentialSchema,
+};