@verii/server-credentialing-hub 2.0.0

package/src/entities/tokens/domains/access-token.js

@@ -0,0 +1,74 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const { find, isEmpty, startsWith } = require('lodash/fp');
+const newError = require('http-errors');
+const { CihKeyPurposes } = require('../../keys/domain/cih-key-purposes');
+
+const DEFAULT_EXPIRES_IN = 10080;
+
+const exchangePrefix = 'exchange:';
+const depotPrefix = 'depot:';
+
+const generateAccessToken = (service, exchange, { kms, tenant }) => {
+  const accessTokensSecret =
+    tenant.keysByPurpose[CihKeyPurposes.HOLDER_ACCESS_TOKENS];
+  return kms.signJwt(
+    {
+      scope: [`${exchangePrefix}${exchange._id.toString()}`],
+    },
+    accessTokensSecret._id,
+    {
+      alg: 'HS384',
+      issuer: tenant.did,
+      subject: `${depotPrefix}${exchange.depotId.toString()}`,
+      nbf: new Date(),
+      expiresIn: `${service.authTokensExpireIn ?? DEFAULT_EXPIRES_IN}m`,
+    },
+  );
+};
+
+const verifyAccessToken = async (token, { kms, tenant }) =>
+  kms.verifyJwt(
+    token,
+    tenant.keysByPurpose[CihKeyPurposes.HOLDER_ACCESS_TOKENS]._id,
+    {
+      alg: 'HS384',
+      issuer: tenant.did,
+    },
+  );
+
+const parseAccessToken = (token) => {
+  const exchangeScope = find(startsWith(exchangePrefix), token.scope);
+  const exchangeId =
+    exchangeScope != null
+      ? exchangeScope.substring(exchangePrefix.length)
+      : undefined;
+  if (isEmpty(exchangeId)) {
+    throw newError(401, 'Unauthorized');
+  }
+
+  const depotId = startsWith(depotPrefix, token.sub)
+    ? token.sub.substring(depotPrefix.length)
+    : undefined;
+  if (isEmpty(depotId)) {
+    throw newError(401, 'Unauthorized');
+  }
+  return { exchangeId, depotId };
+};
+
+module.exports = { generateAccessToken, parseAccessToken, verifyAccessToken };

package/src/entities/tokens/domains/index.js

@@ -0,0 +1,19 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module.exports = {
+  ...require('./access-token'),
+};

package/src/entities/tokens/index.js

@@ -0,0 +1,19 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module.exports = {
+  ...require('./domains'),
+};

package/src/index.js

@@ -0,0 +1,3 @@
+module.exports = {
+  ...require('./start-app-server'),
+};

package/src/init-server.js

@@ -0,0 +1,88 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const path = require('node:path');
+const fastifyAutoload = require('@fastify/autoload');
+const { httpClientPlugin } = require('@verii/fastify-plugins');
+const {
+  rpcProviderPlugin,
+  authenticateVnfClientPlugin,
+} = require('@verii/base-contract-io');
+const { pick } = require('lodash/fp');
+const { openid4vciPlugin } = require('./entities/openid4vci');
+const { openid4vpPlugin } = require('./entities/openid4vp');
+
+const initServer = (server) => {
+  if (!server.config.isTest) {
+    server.register(authenticateVnfClientPlugin);
+  }
+
+  return server
+    .register(rpcProviderPlugin)
+    .register(fastifyAutoload, {
+      dir: path.join(__dirname, 'controllers'),
+      autoHooks: true,
+      cascadeHooks: true,
+      dirNameRoutePrefix: (folderParent, folderName) => {
+        if (['openid4vc', 'openid4vp'].includes(folderName)) {
+          return false;
+        }
+        return folderName;
+      },
+    })
+    .register(fastifyAutoload, {
+      dir: `${__dirname}/entities`,
+      indexPattern: /.*dont-match-indexes(\.ts|\.js|\.cjs|\.mjs)$/,
+      scriptPattern: /.*repo(\.ts|\.js|\.cjs|\.mjs)$/,
+    })
+    .register(httpClientPlugin, {
+      name: 'fetch',
+      options: {
+        ...pick(
+          [
+            'nodeEnv',
+            'requestTimeout',
+            'traceIdHeader',
+            'tlsRejectUnauthorized',
+            'isTest',
+          ],
+          server.config,
+        ),
+        rejectUnauthorized: true,
+      },
+    })
+    .register(httpClientPlugin, {
+      name: 'registrarFetch',
+      options: {
+        ...pick(
+          [
+            'nodeEnv',
+            'requestTimeout',
+            'traceIdHeader',
+            'tlsRejectUnauthorized',
+            'isTest',
+          ],
+          server.config,
+        ),
+        rejectUnauthorized: true,
+        prefixUrl: server.config.registrarUrl,
+      },
+    })
+    .register(openid4vciPlugin)
+    .register(openid4vpPlugin);
+};
+
+module.exports = { initServer };

package/src/main.js

@@ -0,0 +1,25 @@
+/**
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const { startAppServer } = require('./start-app-server');
+
+/* istanbul ignore next */
+process.on('unhandledRejection', (error) => {
+  console.error(error);
+  process.exit(1);
+});
+
+startAppServer();

package/src/schemas/index.js

@@ -0,0 +1,20 @@
+/*
+ * Copyright 2026 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+module.exports = {
+  ...require('./oauth-error-response.schema'),
+};

package/src/schemas/oauth-error-response.schema.js

@@ -0,0 +1,27 @@
+/*
+ * Copyright 2026 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const oauthErrorResponseSchema = {
+  type: 'object',
+  properties: {
+    error: { type: 'string' },
+    error_description: { type: 'string' },
+  },
+  required: ['error', 'error_description'],
+};
+
+module.exports = { oauthErrorResponseSchema };

package/src/standalone.js

@@ -0,0 +1,8 @@
+/* istanbul ignore file */
+
+const dotenv = require('dotenv');
+
+dotenv.config({ path: '.standalone.env' });
+dotenv.config({ path: '.localdev.env' });
+
+require('./main');

package/src/start-app-server.js

@@ -0,0 +1,27 @@
+/**
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const { createServer, listenServer } = require('@verii/server-provider');
+const { flow } = require('lodash/fp');
+const config = require('./config');
+const { initServer } = require('./init-server');
+
+const startAppServer = () =>
+  flow(createServer, initServer, listenServer)(config);
+
+module.exports = {
+  startAppServer,
+};