@verii/server-credentialing-hub 2.0.0

package/src/entities/credentials/facades/index.js

@@ -0,0 +1,22 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./build-verii-issuer'),
+  ...require('./anchor-verii-credentials-facade'),
+  ...require('./issue-verii-credentials-facade'),
+  ...require('./sign-verii-credentials-facade'),
+};

package/src/entities/credentials/facades/issue-verii-credentials-facade.js

@@ -0,0 +1,62 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const {
+  mongoAllocationListQueries,
+  issueVeriiCredentials,
+} = require('@verii/verii-issuing');
+const { mongoDb } = require('@spencejs/spence-mongo-repos');
+const { keyBy } = require('lodash/fp');
+const newError = require('http-errors');
+const { buildVeriiIssuer } = require('./build-verii-issuer');
+
+const issueVeriiCredentialsFacade = async (
+  approvedCredentialsContent,
+  credentialSubjectId,
+  credentialTypeMetadatas,
+  issuerService,
+  context,
+) => {
+  const { tenant } = context;
+
+  // eslint-disable-next-line better-mutation/no-mutation
+  context.allocationListQueries = mongoAllocationListQueries(
+    mongoDb(),
+    'allocations',
+  );
+  // eslint-disable-next-line better-mutation/no-mutation
+  context.caoDid = context.tenant.caoDid;
+
+  return issueVeriiCredentials(
+    approvedCredentialsContent,
+    credentialSubjectId,
+    keyBy('credentialType', credentialTypeMetadatas),
+    buildVeriiIssuer(tenant, issuerService),
+    context,
+  ).catch((e) => {
+    switch (e.errorCode) {
+      case 'career_issuing_not_permitted':
+      case 'identity_issuing_not_permitted':
+      case 'contact_issuing_not_permitted':
+        throw newError(502, e);
+      default:
+        throw e;
+    }
+  });
+};
+
+module.exports = { issueVeriiCredentialsFacade };

package/src/entities/credentials/facades/sign-verii-credentials-facade.js

@@ -0,0 +1,56 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const {
+  mongoAllocationListQueries,
+  signVeriiCredentials,
+} = require('@verii/verii-issuing');
+const { mongoDb } = require('@spencejs/spence-mongo-repos');
+const { keyBy } = require('lodash/fp');
+const { buildVeriiIssuer } = require('./build-verii-issuer');
+
+const signVeriiCredentialsFacade = async (
+  credentialContentList,
+  credentialSubjectId,
+  credentialTypeMetadatas,
+  issuerService,
+  context,
+) => {
+  const { tenant } = context;
+
+  // eslint-disable-next-line better-mutation/no-mutation
+  context.allocationListQueries = mongoAllocationListQueries(
+    mongoDb(),
+    'allocations',
+  );
+  // eslint-disable-next-line better-mutation/no-mutation
+  context.caoDid = context.tenant.caoDid;
+
+  const result = await signVeriiCredentials(
+    credentialContentList,
+    credentialSubjectId,
+    keyBy('credentialType', credentialTypeMetadatas),
+    buildVeriiIssuer(tenant, issuerService),
+    context,
+  );
+  return {
+    credentialMetadata: result?.[0]?.metadata,
+    vcJwt: result?.[0]?.vcJwt,
+  };
+};
+
+module.exports = { signVeriiCredentialsFacade };

package/src/entities/credentials/factories/credential-factory.js

@@ -0,0 +1,53 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const { register } = require('@spencejs/spence-factories');
+const { ObjectId } = require('mongodb');
+const { hashOffer } = require('@verii/verii-issuing');
+const { credentialRepoPlugin } = require('../repo');
+const { initTenantFactory } = require('../../tenants');
+const { initDepotFactory } = require('../../depots');
+
+const DefaultContent = () => ({
+  type: ['Employment'],
+  credentialSubject: {
+    legalEmployer: { name: 'ExampleEmployer', identifier: 'did:example.com' },
+    roleName: 'CEO',
+  },
+});
+
+const initCredentialFactory = (app) =>
+  register(
+    'credential',
+    credentialRepoPlugin(app)({ config: app.config }),
+    async (overrides, { getOrBuild }) => {
+      const tenant = await getOrBuild('tenant', initTenantFactory(app));
+      const depot = await getOrBuild('depot', initDepotFactory(app));
+      const content = await getOrBuild('content', DefaultContent);
+      const contentHash = hashOffer(content);
+      return {
+        credentialReference: 'cred1',
+        content,
+        contentHash,
+        typeMetadata: { credentialType: 'Employment' },
+        tenantId: new ObjectId(tenant._id),
+        depotId: new ObjectId(depot._id),
+        ...overrides(),
+      };
+    },
+  );
+
+module.exports = { initCredentialFactory };

package/src/entities/credentials/factories/index.js

@@ -0,0 +1,19 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module.exports = {
+  ...require('./credential-factory'),
+};

package/src/entities/credentials/index.js

@@ -0,0 +1,23 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./domain'),
+  ...require('./facades'),
+  ...require('./factories'),
+  ...require('./orchestrators'),
+  ...require('./repo'),
+};

package/src/entities/credentials/orchestrators/create-credentials.js

@@ -0,0 +1,118 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { map, forEach, findIndex, flow, uniq } = require('lodash/fp');
+const newError = require('http-errors');
+const { getCredentialTypeMetadata } = require('@verii/common-fetchers');
+const { initHttpClient } = require('@verii/http-client');
+const { extractCredentialType } = require('@verii/vc-checks');
+const {
+  initCanonicalizeCredentials,
+  initValidateCredential,
+  CredentialErrors,
+} = require('../domain');
+
+const createCredentials = async (credentialItems, context) => {
+  const { repos } = context;
+
+  const depotIds = flow(map('depotId'), uniq)(credentialItems);
+  const credentials = map('credential', credentialItems);
+  const credentialTypes = flow(
+    map(({ content }) => extractCredentialType(content)),
+    uniq,
+  )(credentials);
+
+  const [depots, relatedCredentials, credentialTypeMetadatas] =
+    await Promise.all([
+      repos.depots.findDepots(null, depotIds),
+      repos.credentials.findByRelatedResources(credentials),
+      getCredentialTypeMetadataWithErrorHandling(credentialTypes, context),
+    ]);
+  const schemas = await Promise.all(
+    map(
+      (credentialType) => loadSchemaWithErrorHandling(credentialType, context),
+      credentialTypeMetadatas,
+    ),
+  );
+
+  const validateCredential = initValidateCredential(
+    depots,
+    credentialTypeMetadatas,
+    schemas,
+    context,
+  );
+  const canonicalizeCredential = initCanonicalizeCredentials(
+    relatedCredentials,
+    credentialTypeMetadatas,
+  );
+
+  const canonicalizedCredentials = flow(
+    map((item) => ({
+      ...item,
+      metadataIdx: findIndex(
+        {
+          credentialType: extractCredentialType(item.credential.content),
+        },
+        credentialTypeMetadatas,
+      ),
+    })),
+    forEach(validateCredential),
+    map(canonicalizeCredential),
+  )(credentialItems);
+
+  return repos.credentials.insertMany(canonicalizedCredentials);
+};
+
+const loadSchema = async (credentialTypeMetadata, context) => {
+  const client = initHttpClient({
+    requestTimeout: context.config.requestTimeout,
+    traceIdHeader: context.config.traceIdHeader,
+    rejectUnauthorized: true,
+  })(context);
+  const response = await client.get(credentialTypeMetadata.schemaUrl);
+  return response.json();
+};
+
+const getCredentialTypeMetadataWithErrorHandling = async (
+  credentialTypes,
+  context,
+) => {
+  try {
+    return await getCredentialTypeMetadata(credentialTypes, context);
+  } catch (error) {
+    context.log.error('Error loading credential types', error);
+    throw newError(
+      502,
+      CredentialErrors.CREDENTIAL_TYPES_METADATA_UPSTREAM_ERROR,
+      {
+        errorCode: CredentialErrors.CREDENTIAL_TYPES_METADATA_UPSTREAM_ERROR,
+      },
+    );
+  }
+};
+
+const loadSchemaWithErrorHandling = async (credentialTypeMetadata, context) => {
+  try {
+    return await loadSchema(credentialTypeMetadata, context);
+  } catch (error) {
+    context.log.error(error, { msg: 'schema loading error' });
+    throw newError(502, CredentialErrors.SCHEMA_UPSTREAM_ERROR, {
+      errorCode: CredentialErrors.SCHEMA_UPSTREAM_ERROR,
+    });
+  }
+};
+
+module.exports = { createCredentials };

package/src/entities/credentials/orchestrators/index.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./create-credentials'),
+};

package/src/entities/credentials/repo/finders-extension.js

@@ -0,0 +1,94 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const { flow, flatMapDeep, compact, map, uniq, isEmpty } = require('lodash/fp');
+const { ObjectId } = require('mongodb');
+
+const findersExtension = (parent) => ({
+  search: async ({ credentialIds }) => {
+    const filter = {};
+    if (!isEmpty(credentialIds)) {
+      filter._id = {
+        $in: map((credentialId) => new ObjectId(credentialId), credentialIds),
+      };
+    }
+    return parent.find({ filter });
+  },
+  findByDepotId: async ({
+    depotId,
+    omitContentHashes,
+    credentialTypes,
+    claimable,
+  }) => {
+    const filter = {
+      depotId: new ObjectId(depotId),
+    };
+    if (!isEmpty(omitContentHashes)) {
+      filter.contentHash = { $nin: omitContentHashes };
+    }
+    if (!isEmpty(credentialTypes)) {
+      filter['content.type'] = { $in: credentialTypes };
+    }
+    if (claimable === true) {
+      filter.rejectedAt = { $exists: false };
+      filter.acceptedAt = { $exists: false };
+    }
+    return parent.find({ filter });
+  },
+  findByRelatedResources: async (credentials) => {
+    const identifiers = flow(
+      flatMapDeep(({ content }) => [
+        map('id', content.relatedResource),
+        map('id', content.replaces),
+      ]),
+      compact,
+      uniq,
+    )(credentials);
+
+    if (isEmpty(identifiers)) {
+      return [];
+    }
+
+    return parent.find(
+      {
+        filter: {
+          did: { $in: identifiers },
+        },
+      },
+      {
+        id: 1,
+        did: 1,
+        content: 1,
+        digestSRI: 1,
+        linkCode: 1,
+      },
+    );
+  },
+  findNonFinal: async (credentialIds) =>
+    parent.find({
+      filter: {
+        _id: { $in: credentialIds },
+        rejectedAt: { $exists: false },
+        acceptedAt: { $exists: false },
+      },
+    }),
+  extensions: parent.extensions.concat(['findersExtension']),
+});
+
+module.exports = {
+  findersExtension,
+};

package/src/entities/credentials/repo/index.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  credentialRepoPlugin: require('./repo'),
+};

package/src/entities/credentials/repo/repo.js

@@ -0,0 +1,62 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const {
+  repoFactory,
+  autoboxIdsExtension,
+} = require('@spencejs/spence-mongo-repos');
+const { multitenantExtension } = require('@verii/spencer-mongo-extensions');
+const { findersExtension } = require('./finders-extension');
+const { updateExtensions } = require('./update-issued-credential');
+
+module.exports = (app, options, next = () => {}) => {
+  next();
+  return repoFactory(
+    {
+      name: 'credentials',
+      entityName: 'credential',
+      defaultProjection: {
+        _id: 1,
+        did: 1,
+        credentialReference: 1,
+        content: 1,
+        contentHash: 1,
+        digestSRI: 1,
+        tags: 1,
+        acceptedAt: 1,
+        jwtVc: 1,
+        rejectedAt: 1,
+        failedAt: 1,
+        deletedAt: 1,
+        rejectedReason: 1,
+        typeMetadata: 1,
+        openid4vcMetadata: 1,
+        error: 1,
+        depotId: 1,
+        tenantId: 1,
+        createdAt: 1,
+        updatedAt: 1,
+      },
+      extensions: [
+        autoboxIdsExtension,
+        multitenantExtension(),
+        findersExtension,
+        updateExtensions,
+      ],
+    },
+    app,
+  );
+};

package/src/entities/credentials/repo/update-issued-credential.js

@@ -0,0 +1,60 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const { calcSha384 } = require('@verii/crypto');
+const { buildExchangeEvent } = require('../../exchanges/domain');
+
+const updateExtensions = (parent, context) => ({
+  updateIssuedCredential: async (
+    credentialId,
+    credentialDid,
+    jwtVc,
+    credentialSubjectId,
+    isAccepted,
+    exchange,
+  ) => {
+    const digestSRI = `sha384-${calcSha384(jwtVc)}`;
+    const $set = {
+      did: credentialDid,
+      credentialSubjectId,
+      digestSRI,
+    };
+    if (isAccepted) {
+      $set.acceptedAt = new Date();
+    }
+    if (exchange) {
+      $set.exchange = exchange;
+    }
+    if (context.config.autocleanFinalizedOfferPii) {
+      $set.content = {};
+    } else {
+      $set.jwtVc = jwtVc;
+    }
+
+    return parent.update(credentialId, $set);
+  },
+  addExchangeState: async (credentialId, state, props) =>
+    parent.collection().updateOne(
+      { _id: credentialId },
+      {
+        $set: props,
+        $push: { 'exchange.events': buildExchangeEvent(state) },
+      },
+    ),
+});
+
+module.exports = { updateExtensions };

package/src/entities/depots/domain/depot-errors.js

@@ -0,0 +1,23 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const DepotErrors = {
+  REFERENCED_SERVICE_NOT_FOUND: 'referenced_service_not_found',
+  RELATED_CREDENTIAL_UNDELETED: 'related_credential_undeleted',
+  INVALID_AUTH_VALUES: 'invalid_auth_values',
+};
+
+module.exports = { DepotErrors };

package/src/entities/depots/domain/index.js

@@ -0,0 +1,20 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./depot-errors'),
+  ...require('./validate-depot'),
+};