@verii/server-credentialing-hub 2.0.0

package/src/entities/depots/domain/validate-depot.js

@@ -0,0 +1,38 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const newError = require('http-errors');
+const { isEmpty } = require('lodash/fp');
+const { DepotErrors } = require('./depot-errors');
+
+const validateDepot = (depot, service) => {
+  if (service == null) {
+    throw newError(400, DepotErrors.REFERENCED_SERVICE_NOT_FOUND, {
+      errorCode: DepotErrors.REFERENCED_SERVICE_NOT_FOUND,
+    });
+  }
+  if (
+    service.authMode === 'internal' &&
+    service.authMethods.includes('verifiable_presentation') &&
+    isEmpty(depot.authValues)
+  ) {
+    throw newError(400, DepotErrors.INVALID_AUTH_VALUES, {
+      errorCode: DepotErrors.INVALID_AUTH_VALUES,
+    });
+  }
+};
+
+module.exports = { validateDepot };

package/src/entities/depots/factories/depot-factory.js

@@ -0,0 +1,50 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const { register } = require('@spencejs/spence-factories');
+const { nanoid } = require('nanoid');
+const { ObjectId } = require('mongodb');
+const { calcSha384 } = require('@verii/crypto');
+const { depotRepoPlugin } = require('../repo');
+const { initTenantFactory } = require('../../tenants');
+const { initIssuerServiceFactory } = require('../../issuer-services');
+
+const initDepotFactory = (app) =>
+  register(
+    'depot',
+    depotRepoPlugin(app)({ config: app.config }),
+    async (overrides, { getOrBuild }) => {
+      const tenant = await getOrBuild('tenant', initTenantFactory(app));
+      const service = await getOrBuild(
+        'service',
+        initIssuerServiceFactory(app),
+      );
+      const preauthCode = await getOrBuild('preauthCode', () => undefined);
+      const depot = {
+        tenantId: new ObjectId(tenant._id),
+        serviceId: new ObjectId(service._id),
+        preauthCodeHash:
+          preauthCode != null ? calcSha384(preauthCode) : undefined,
+        ...overrides(),
+      };
+      if (service.authMode) {
+        depot.userReference = nanoid();
+      }
+      return depot;
+    },
+  );
+
+module.exports = { initDepotFactory };

package/src/entities/depots/factories/index.js

@@ -0,0 +1,19 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module.exports = {
+  ...require('./depot-factory'),
+};

package/src/entities/depots/index.js

@@ -0,0 +1,22 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./domain'),
+  ...require('./factories'),
+  ...require('./orchestrators'),
+  ...require('./repo'),
+};

package/src/entities/depots/orchestrators/create-depot.js

@@ -0,0 +1,31 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { ObjectId } = require('mongodb');
+const { validateDepot } = require('../domain');
+
+const createDepot = async (newDepot, serviceId, { repos }) => {
+  const service = await repos.issuerServices.findOne({
+    filter: { _id: serviceId },
+  });
+  validateDepot(newDepot, service);
+  return repos.depots.insert({
+    ...newDepot,
+    serviceId: new ObjectId(serviceId),
+  });
+};
+
+module.exports = { createDepot };

package/src/entities/depots/orchestrators/delete-depot.js

@@ -0,0 +1,43 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { ObjectId } = require('mongodb');
+const { isEmpty, map } = require('lodash/fp');
+const newError = require('http-errors');
+const { DepotErrors } = require('../domain');
+
+const deleteDepot = async (depotId, serviceId, { repos }) => {
+  const credentials = await repos.credentials.findByDepotId({ depotId });
+  if (!isEmpty(credentials)) {
+    throw newError(
+      400,
+      `Credentials(s) ${map('_id')(
+        credentials,
+      )} must be deleted before deleting depot ${depotId}`,
+      {
+        errorCode: DepotErrors.RELATED_CREDENTIAL_UNDELETED,
+      },
+    );
+  }
+  return repos.depots.delUsingFilter({
+    filter: {
+      _id: depotId,
+      serviceId: new ObjectId(serviceId),
+    },
+  });
+};
+
+module.exports = { deleteDepot };

package/src/entities/depots/orchestrators/index.js

@@ -0,0 +1,20 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  ...require('./create-depot'),
+  ...require('./delete-depot'),
+};

package/src/entities/depots/repo/find-depot-by-preauth-code.js

@@ -0,0 +1,30 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { calcSha384 } = require('@verii/crypto');
+
+const findDepotByPreauthCodeExtension = (parent) => ({
+  findDepotByPreauthCode: async (preauthCode) => {
+    const depot = await parent.findOne({
+      filter: {
+        preauthCodeHash: calcSha384(preauthCode),
+      },
+    });
+    return depot;
+  },
+});
+
+module.exports = { findDepotByPreauthCodeExtension };

package/src/entities/depots/repo/find-depots-extension.js

@@ -0,0 +1,34 @@
+/**
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const { isEmpty, map } = require('lodash/fp');
+const { ObjectId } = require('mongodb');
+
+const findDepotsExtension = (parent) => ({
+  findDepots: async (serviceId, depotIds) => {
+    const filter = {};
+    if (serviceId) {
+      filter.serviceId = new ObjectId(serviceId);
+    }
+    if (!isEmpty(depotIds)) {
+      filter._id = { $in: map((id) => new ObjectId(id), depotIds) };
+    }
+    return parent.find({ filter });
+  },
+  extensions: parent.extensions.concat(['findDepotsExtension']),
+});
+
+module.exports = { findDepotsExtension };

package/src/entities/depots/repo/index.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = {
+  depotRepoPlugin: require('./repo'),
+};

package/src/entities/depots/repo/refresh-preauth-code.js

@@ -0,0 +1,30 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const { nanoid } = require('nanoid');
+const { calcSha384 } = require('@verii/crypto');
+
+const refreshPreauthCodeExtension = (parent) => ({
+  refreshPreauthCode: async (depotId) => {
+    const preauthCode = nanoid(16);
+    const depot = await parent.update(depotId, {
+      preauthCodeHash: calcSha384(preauthCode),
+    });
+    return { ...depot, preauthCode };
+  },
+});
+
+module.exports = { refreshPreauthCodeExtension };

package/src/entities/depots/repo/repo.js

@@ -0,0 +1,61 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const {
+  repoFactory,
+  autoboxIdsExtension,
+  mongoDb,
+} = require('@spencejs/spence-mongo-repos');
+const { multitenantExtension } = require('@verii/spencer-mongo-extensions');
+const { findDepotsExtension } = require('./find-depots-extension');
+const { refreshPreauthCodeExtension } = require('./refresh-preauth-code');
+const {
+  findDepotByPreauthCodeExtension,
+} = require('./find-depot-by-preauth-code');
+
+module.exports = (app, options, next = () => {}) => {
+  app.ready(async () => {
+    await mongoDb()
+      .collection('depots')
+      .createIndex({ tenantId: 1, preauthCodeHash: 1 });
+  });
+  next();
+  return repoFactory(
+    {
+      name: 'depots',
+      entityName: 'depot',
+      defaultProjection: {
+        _id: 1,
+        userReference: 1,
+        authValues: 1,
+        serviceId: 1,
+        messagingSettings: 1,
+        preauthCodeHash: 1,
+        tenantId: 1,
+        createdAt: 1,
+        updatedAt: 1,
+      },
+      extensions: [
+        autoboxIdsExtension,
+        multitenantExtension(),
+        findDepotsExtension,
+        findDepotByPreauthCodeExtension,
+        refreshPreauthCodeExtension,
+      ],
+    },
+    app,
+  );
+};

package/src/entities/exchanges/adapters/index.js

@@ -0,0 +1,17 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+module.exports = { ...require('./sign-exchange-response') };

package/src/entities/exchanges/adapters/sign-exchange-response.js

@@ -0,0 +1,37 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+const { KeyPurposes } = require('@verii/crypto');
+const { toDidUrl } = require('@verii/did-doc');
+
+const signExchangeResponse = async (
+  credentialManifest,
+  options = {}, // eslint-disable-line default-param-last
+  { kms, tenant },
+) => {
+  const exchangesKey = tenant.keysByPurpose[KeyPurposes.EXCHANGES];
+  return kms.signJwt(credentialManifest, exchangesKey._id, {
+    jti: credentialManifest.id,
+    issuer: tenant.did,
+    kid: toDidUrl(tenant.did, exchangesKey.kidFragment),
+    nbf: new Date(),
+    expiresIn: '1w',
+    ...options,
+  });
+};
+
+module.exports = { signExchangeResponse };

package/src/entities/exchanges/domain/authorize-exchange.js

@@ -0,0 +1,29 @@
+/*
+ * Copyright 2024 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const newError = require('http-errors');
+
+const authorizeExchange = (exchange, depotId) => {
+  if (
+    exchange == null ||
+    exchange.depotId == null ||
+    exchange.depotId.toString() !== depotId
+  ) {
+    throw newError(401, 'Unauthorized');
+  }
+};
+
+module.exports = { authorizeExchange };

package/src/entities/exchanges/domain/build-exchange-event.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const buildExchangeEvent = (state) => ({ state, timestamp: new Date() });
+
+module.exports = { buildExchangeEvent };

package/src/entities/exchanges/domain/build-presentation-request.js

@@ -0,0 +1,174 @@
+/**
+ * Copyright 2023 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+const { applyOverrides } = require('@verii/common-functions');
+const { find, map, omit } = require('lodash/fp');
+
+const DEFAULT_GROUP_ID = 'A';
+
+const buildCredentialManifest = (
+  tenant,
+  issuerService,
+  exchange,
+  inputDescriptors,
+  outputDescriptors,
+) => {
+  const baseUrl = buildBaseUrl(tenant);
+  const overrides = {
+    output_descriptors: outputDescriptors,
+    issuer: { id: tenant.did },
+    'metadata.submit_presentation_uri': `${baseUrl}/authenticate`,
+    'metadata.check_offers_uri': `${baseUrl}/credential-offers`,
+    'metadata.finalize_offers_uri': `${baseUrl}/issue-credentials`,
+  };
+
+  return buildBasePresentationRequest(
+    tenant,
+    issuerService,
+    exchange,
+    inputDescriptors,
+    {
+      rule: 'all',
+      from: DEFAULT_GROUP_ID,
+      min: issuerService.disclosureRequest?.types?.length,
+    },
+    overrides,
+  );
+};
+
+const buildPresentationRequest = (
+  tenant,
+  service,
+  exchange,
+  inputDescriptors,
+) => {
+  const baseUrl = buildBaseUrl(tenant);
+  return buildBasePresentationRequest(
+    tenant,
+    service,
+    exchange,
+    inputDescriptors,
+    {
+      rule: 'pick',
+      from: DEFAULT_GROUP_ID,
+      min: 1,
+    },
+    {
+      'metadata.submit_presentation_uri': `${baseUrl}/presentation`,
+      'metadata.auth_token_uri': `${baseUrl}/oauth/token`,
+    },
+  );
+};
+
+const buildBasePresentationRequest = (
+  tenant,
+  service,
+  exchange,
+  inputDescriptors,
+  submissionRequirements,
+  overrides,
+) => {
+  const presentationRequest = {
+    exchange_id: exchange._id,
+    metadata: buildMetadata(tenant, service),
+    presentation_definition: buildPresentationDefinition(
+      service,
+      exchange,
+      inputDescriptors,
+      submissionRequirements,
+    ),
+  };
+
+  return applyOverrides(presentationRequest, overrides);
+};
+
+const buildPresentationDefinition = (
+  service,
+  exchange,
+  rawInputDescriptors,
+  submissionRequirements,
+) => {
+  const id = `${exchange._id}.${service._id}`;
+  const format = {
+    jwt_vp: { alg: ['secp256k1'] }, // hardcoded
+  };
+
+  if (service.presentationDefinition) {
+    return buildConfiguredPresentationDefinition(service, id, format);
+  }
+
+  const inputDescriptors = buildInputDescriptors(
+    service.disclosureRequest?.types,
+    rawInputDescriptors,
+  );
+
+  return {
+    id,
+    purpose: service.disclosureRequest?.purpose ?? '',
+    name: service.description,
+    format,
+    input_descriptors: inputDescriptors,
+    submission_requirements: submissionRequirements.min
+      ? [submissionRequirements]
+      : [],
+  };
+};
+
+const buildConfiguredPresentationDefinition = (service, id, format) => {
+  const presentationDefinition = omit(['id'], service.presentationDefinition);
+  return {
+    purpose: service.presentationDefinition.purpose,
+    name: service.description,
+    format,
+    ...presentationDefinition,
+    // The presentation-definition id binds the eventual submission to this
+    // exchange and service, so caller-provided presentationDefinition.id is
+    // ignored.
+    id,
+  };
+};
+
+const buildBaseUrl = (tenant) =>
+  `${tenant.hostUrl}/vn-api/r/${encodeURI(tenant.did)}`;
+
+const buildMetadata = (tenant, service) => {
+  const metadata = {
+    client_name: tenant.name,
+    logo_uri: tenant.logo,
+    tos_uri: service.termsUrl,
+    progress_uri: `${buildBaseUrl(tenant)}/get-exchange-progress`,
+  };
+
+  if (!service.authMode) {
+    metadata.feed = service.mode === 'feed';
+  }
+
+  metadata.max_retention_period =
+    service.disclosureRequest?.retentionPeriod ?? '';
+
+  return metadata;
+};
+
+const buildInputDescriptors = (types, rawInputDescriptors) =>
+  map(
+    ({ type }) => ({
+      ...find({ id: type }, rawInputDescriptors),
+      group: [DEFAULT_GROUP_ID],
+    }),
+    types,
+  );
+
+module.exports = { buildPresentationRequest, buildCredentialManifest };