@verii/server-credentialing-hub 2.0.0

package/src/controllers/vn-api/vn-issuing-controller.js

@@ -0,0 +1,295 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const bearerAuthPlugin = require('@fastify/bearer-auth');
+const { coerceArray } = require('@verii/common-functions');
+const {
+  verifyVerifiablePresentationJwt,
+} = require('@verii/verii-verification');
+const newError = require('http-errors');
+const {
+  holderOfferSchema,
+  newOfferRelatedResourceSchema,
+} = require('@verii/common-schemas');
+const {
+  authenticate,
+  getCredentialManifest,
+  signExchangeResponse,
+  exchangeErrorHook,
+  credentialOfferRequest,
+  issueCredentials,
+} = require('../../entities/exchanges');
+const {
+  generateAccessToken,
+  verifyAccessToken,
+} = require('../../entities/tokens');
+const { ExchangeErrors, ExchangeStates } = require('../../entities/exchanges');
+const { tenantLoaderPlugin } = require('../../entities/tenants');
+const { kmsPlugin } = require('../../entities/keys');
+const {
+  presentationSubmissionSchema,
+  velocityPresentationSubmissionSchema,
+  velocityPresentationSubmissionResponseSchema,
+} = require('./schemas');
+
+const vnfIssuingController = async (fastify) => {
+  fastify
+    .register(tenantLoaderPlugin, { useDID: true })
+    .register(kmsPlugin)
+    .addSchema(presentationSubmissionSchema)
+    .addSchema(velocityPresentationSubmissionSchema)
+    .addSchema(velocityPresentationSubmissionResponseSchema)
+    .addSchema(newOfferRelatedResourceSchema)
+    .addSchema(holderOfferSchema)
+    .register(bearerAuthPlugin, {
+      auth: verifyAccessTokenAuth,
+      addHook: false,
+    })
+    .get(
+      '/r/:tenantId/get-credential-manifest',
+      {
+        schema: fastify.autoSchema({
+          params: {
+            type: 'object',
+            properties: {
+              tenantId: { type: 'string' },
+            },
+          },
+          query: {
+            type: 'object',
+            properties: {
+              id: { type: 'string' },
+              credential_types: {
+                anyOf: [
+                  { type: 'string' },
+                  {
+                    type: 'array',
+                    items: { type: 'string', minLength: 1 },
+                  },
+                ],
+              },
+              'push_delegate.push_token': { type: 'string' },
+              'push_delegate.push_url': { type: 'string' },
+              locale: { type: 'string', default: 'en' },
+              format: { type: 'string', enum: ['json', 'jwt'], default: 'jwt' },
+            },
+            required: ['id'],
+          },
+          response: {
+            200: {
+              oneOf: [
+                {
+                  issuing_request: { type: 'object' },
+                },
+                {
+                  issuing_request: { type: 'string' },
+                },
+              ],
+            },
+          },
+        }),
+      },
+      async (req) => {
+        const { query } = req;
+
+        const messagingSettings =
+          query.push_delegate != null
+            ? {
+                webhookUrl: query.push_delegate.push_url,
+                authToken: query.push_delegate.push_token,
+              }
+            : undefined;
+
+        const credentialManifest = await getCredentialManifest(
+          query.id,
+          coerceArray(query.credential_types),
+          query.locale,
+          messagingSettings,
+          req,
+        );
+
+        /* eslint-disable camelcase */
+        const issuing_request =
+          query.format !== 'json'
+            ? await signExchangeResponse(credentialManifest, {}, req)
+            : credentialManifest;
+
+        return { issuing_request };
+        /* eslint-enable */
+      },
+    )
+    .post(
+      '/r/:tenantId/authenticate',
+      {
+        schema: fastify.autoSchema({
+          body: {
+            type: 'object',
+            properties: {
+              exchange_id: { type: 'string', description: 'exchange id value' },
+              jwt_vp: {
+                type: 'string',
+                description: 'vp encoded as a jwt signed by the holder',
+              },
+            },
+            required: ['exchange_id', 'jwt_vp'],
+          },
+          response: {
+            200: {
+              $ref: 'https://velocitycareerlabs.io/velocity-presentation-submission-response.schema.json#',
+            },
+            ...fastify.UnauthorizedResponse,
+          },
+        }),
+        onError: async (req, reply, err) =>
+          exchangeErrorHook(req.body.exchange_id, err, req),
+      },
+      async (req) => {
+        const vp = await verifyVerifiablePresentationJwt(req.body.jwt_vp, {
+          vnfProtocolVersion: 2,
+        });
+        req.validateInput(vp, {
+          $ref: 'https://velocitycareerlabs.io/velocity-presentation-submission.schema.json#',
+        });
+
+        const [issuerService, exchange] = await authenticate(
+          req.body.exchange_id,
+          vp,
+          req,
+        );
+
+        const token = await generateAccessToken(issuerService, exchange, req);
+
+        return {
+          token,
+          exchange: {
+            id: exchange._id,
+            type: exchange.type,
+            disclosureComplete: true,
+            exchangeComplete: false,
+          },
+        };
+      },
+    )
+    .post(
+      '/r/:tenantId/credential-offers',
+      {
+        schema: fastify.autoSchema({
+          body: {
+            type: 'object',
+            properties: {
+              offerHashes: {
+                type: 'array',
+                items: {
+                  type: 'string',
+                },
+              },
+            },
+          },
+          response: {
+            200: {
+              type: 'object',
+              properties: {
+                offers: {
+                  type: 'array',
+                  items: {
+                    $ref: 'https://velocitycareerlabs.io/holder-offer.schema.json#',
+                  },
+                },
+                challenge: {
+                  type: 'string',
+                },
+              },
+              required: ['offers'],
+            },
+            502: {
+              $ref: 'error#',
+            },
+          },
+        }),
+        preHandler: (...args) => fastify.verifyBearerAuth(...args),
+        onError: async (req, reply, err) =>
+          exchangeErrorHook(req.body.exchange_id, err, req),
+      },
+      async (req) =>
+        credentialOfferRequest(req.token, req.body.offerHashes, req),
+    )
+    .post(
+      '/r/:tenantId/issue-credentials',
+      {
+        schema: fastify.autoSchema({
+          body: {
+            type: 'object',
+            properties: {
+              approvedOfferIds: {
+                type: 'array',
+                items: { type: 'string' },
+              },
+              rejectedOfferIds: {
+                type: 'array',
+                items: { type: 'string' },
+              },
+              proof: {
+                type: 'object',
+                properties: {
+                  proof_type: { type: 'string', enum: ['jwt'] },
+                  jwt: { type: 'string' },
+                },
+                required: ['proof_type', 'jwt'],
+              },
+            },
+          },
+          response: {
+            200: {
+              type: 'array',
+              items: {
+                type: 'string',
+              },
+            },
+          },
+        }),
+        preHandler: (...args) => fastify.verifyBearerAuth(...args),
+        onError: async (req, reply, err) =>
+          exchangeErrorHook(req.body.exchange_id, err, req),
+      },
+      async (req) =>
+        issueCredentials(
+          req.token,
+          req.body.approvedOfferIds,
+          req.body.rejectedOfferIds,
+          req.body.proof,
+          req,
+        ),
+    );
+};
+
+const verifyAccessTokenAuth = async (bearerToken, req) => {
+  try {
+    const verifiedJwt = await verifyAccessToken(bearerToken, req);
+
+    // eslint-disable-next-line better-mutation/no-mutation
+    req.token = verifiedJwt.payload;
+    return true;
+  } catch (error) {
+    req.log.error(error);
+    throw newError(401, ExchangeErrors.UNAUTHORIZED, {
+      exchangeErrorState: ExchangeStates.UNAUTHORIZED,
+      errorCode: ExchangeErrors.UNAUTHORIZED,
+    });
+  }
+};
+
+module.exports = vnfIssuingController;

package/src/entities/credential-types/fetchers/fetch-credential-type-descriptors.js

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { map } = require('lodash/fp');
+const { getCredentialTypeDescriptor } = require('@verii/common-fetchers');
+
+const fetchCredentialTypeDescriptors = (
+  types,
+  includeDisplay,
+  locale,
+  context,
+) =>
+  Promise.all(
+    map(
+      (type) =>
+        getCredentialTypeDescriptor({ type, locale, includeDisplay }, context),
+      types,
+    ),
+  );
+
+module.exports = {
+  fetchCredentialTypeDescriptors,
+};

package/src/entities/credential-types/fetchers/index.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./fetch-credential-type-descriptors'),
+};

package/src/entities/credential-types/index.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./fetchers'),
+};

package/src/entities/credentials/domain/canonicalize-credentials.js

@@ -0,0 +1,70 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { ObjectId } = require('mongodb');
+const { hashOffer } = require('@verii/verii-issuing');
+const { isEmpty, map, keyBy } = require('lodash/fp');
+
+const initCanonicalizeCredentials = (
+  relatedCredentials,
+  credentialTypeMetadatas,
+) => {
+  const defaultCredentialContent =
+    initDefaultCredentialContent(relatedCredentials);
+  return ({ credential, depotId, metadataIdx }) => ({
+    ...credential,
+    depotId: new ObjectId(depotId),
+    content: defaultCredentialContent(credential.content),
+    contentHash: hashOffer(credential.content),
+    typeMetadata: credentialTypeMetadatas[metadataIdx],
+  });
+};
+
+const initDefaultCredentialContent = (relatedCredentials) => {
+  const defaultRelatedResource = initDefaultRelatedResource(relatedCredentials);
+  return (content) => {
+    if (!isEmpty(content.relatedResource)) {
+      // eslint-disable-next-line better-mutation/no-mutation
+      content.relatedResource = map(
+        defaultRelatedResource,
+        content.relatedResource,
+      );
+    }
+
+    if (!isEmpty(content.replaces)) {
+      // eslint-disable-next-line better-mutation/no-mutation
+      content.replaces = map(defaultRelatedResource, content.replaces);
+    }
+    return content;
+  };
+};
+
+const initDefaultRelatedResource = (relatedCredentials) => {
+  const credentialRefsMap = keyBy('did', relatedCredentials);
+  return (resource) => {
+    const credentialRef = credentialRefsMap[resource.id];
+    if (!isEmpty(credentialRef)) {
+      // eslint-disable-next-line better-mutation/no-mutation
+      resource.digestSRI = resource.digestSRI ?? credentialRef.digestSRI;
+      // eslint-disable-next-line better-mutation/no-mutation
+      resource.hint = resource.hint ?? credentialRef.content.type;
+    }
+
+    return resource;
+  };
+};
+
+module.exports = { initCanonicalizeCredentials };

package/src/entities/credentials/domain/credential-errors.js

@@ -0,0 +1,25 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const CredentialErrors = {
+  REFERENCED_DEPOT_NOT_FOUND: 'referenced_depot_not_found',
+  CREDENTIAL_TYPE_NOT_FOUND: 'credential_type_not_found',
+  CREDENTIAL_TYPES_METADATA_UPSTREAM_ERROR:
+    'credential_types_metadata_upstream_error',
+  SCHEMA_UPSTREAM_ERROR: 'schema_upstream_error',
+};
+
+module.exports = { CredentialErrors };

package/src/entities/credentials/domain/credential-format.js

@@ -0,0 +1,21 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const CredentialFormat = {
+  JWT_VC: 'JWT_VC',
+};
+
+module.exports = { CredentialFormat };

package/src/entities/credentials/domain/index.js

@@ -0,0 +1,22 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./canonicalize-credentials'),
+  ...require('./credential-errors'),
+  ...require('./credential-format'),
+  ...require('./validate-credential'),
+};

package/src/entities/credentials/domain/validate-credential.js

@@ -0,0 +1,74 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { wrapValidationError } = require('@verii/validation');
+const newError = require('http-errors');
+const { keyBy, map, forEach } = require('lodash/fp');
+const { CredentialErrors } = require('./credential-errors');
+
+const initValidateCredential = (
+  depots,
+  credentialTypeMetadatas,
+  schemas,
+  context,
+) => {
+  const depotsById = keyBy('_id', depots);
+
+  forEach((schema) => {
+    context.addDocSchema(schema, true);
+  }, schemas);
+
+  const credentialSubjectValidators = map(
+    (schema) => context.getDocValidator(schema.$id),
+    schemas,
+  );
+
+  return ({ credential, depotId, metadataIdx }) => {
+    validateCredential(
+      credential,
+      depotsById[depotId],
+      credentialTypeMetadatas[metadataIdx],
+      credentialSubjectValidators[metadataIdx],
+    );
+  };
+};
+const validateCredential = (
+  credential,
+  depot,
+  credentialTypeMetadata,
+  validateCredentialSubject,
+) => {
+  if (depot == null) {
+    throw newError(400, CredentialErrors.REFERENCED_DEPOT_NOT_FOUND, {
+      errorCode: CredentialErrors.REFERENCED_DEPOT_NOT_FOUND,
+    });
+  }
+  if (credentialTypeMetadata == null) {
+    throw newError(400, CredentialErrors.CREDENTIAL_TYPE_NOT_FOUND, {
+      errorCode: CredentialErrors.CREDENTIAL_TYPE_NOT_FOUND,
+    });
+  }
+
+  validateCredentialSubject(credential.content.credentialSubject);
+  if (validateCredentialSubject.errors !== null) {
+    throw wrapValidationError(
+      validateCredentialSubject.errors,
+      'credential.content.credentialSubject',
+    );
+  }
+};
+
+module.exports = { initValidateCredential };

package/src/entities/credentials/facades/anchor-verii-credentials-facade.js

@@ -0,0 +1,45 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { anchorVeriiCredentials } = require('@verii/verii-issuing');
+const newError = require('http-errors');
+const { buildVeriiIssuer } = require('./build-verii-issuer');
+
+const anchorVeriiCredentialsFacade = (credentialMetadatas, context) => {
+  const issuer = buildVeriiIssuer(context.tenant);
+  // eslint-disable-next-line better-mutation/no-mutation
+  context.caoDid = context.tenant.caoDid;
+  return anchorVeriiCredentials(credentialMetadatas, issuer, context).catch(
+    (e) => {
+      context.log.error({
+        err: e,
+        fn: 'anchorVeriiCredentials',
+        args: { credentialMetadatas },
+      });
+
+      switch (e.errorCode) {
+        case 'career_issuing_not_permitted':
+        case 'identity_issuing_not_permitted':
+        case 'contact_issuing_not_permitted':
+          throw newError(502, e);
+        default:
+          throw e;
+      }
+    },
+  );
+};
+
+module.exports = { anchorVeriiCredentialsFacade };

package/src/entities/credentials/facades/build-verii-issuer.js

@@ -0,0 +1,44 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { toDidUrl } = require('@verii/did-doc');
+const { toEthereumAddress } = require('@verii/blockchain-functions');
+const { KeyPurposes } = require('@verii/crypto');
+
+const buildVeriiIssuer = (tenant, issuerService) => {
+  const veriiIssuer = {
+    id: tenant._id,
+    did: tenant.did,
+    issuingServiceKMSKeyId:
+      tenant.keysByPurpose[KeyPurposes.ISSUING_METADATA]._id,
+    issuingServiceDIDKeyId: toDidUrl(
+      tenant.did,
+      tenant.keysByPurpose[KeyPurposes.ISSUING_METADATA].kidFragment,
+    ),
+    dltOperatorAddress: toEthereumAddress(
+      tenant.keysByPurpose[KeyPurposes.DLT_TRANSACTIONS].publicJwk,
+    ),
+    dltOperatorKMSKeyId: tenant.keysByPurpose[KeyPurposes.DLT_TRANSACTIONS]._id,
+    dltPrimaryAddress: tenant.primaryAccount,
+  };
+  if (issuerService != null) {
+    veriiIssuer.issuingRefreshServiceId =
+      issuerService.velocityNetworkServiceId;
+  }
+  return veriiIssuer;
+};
+
+module.exports = { buildVeriiIssuer };