8705255638

Committed 16 Apr 2024 12:05PM UTC coverage: 65.595% (+0.09%) from 65.502%

Build # 8705255638

Build Type

Pull #196

github

Committed by

web-flow

Commit Message

Merge 8b533ea97 into 11cc07cfd

Pull Request Pull Request #196: feat(sdk-verification): Implementing DIF Presentation exchange protocol 2.0 for SDK to SDK OOB verification

Run Details

816 of 1421 branches covered (57.42%)

Branch coverage included in aggregate %.

148 of 235 new or added lines in 16 files covered. (62.98%)

3 existing lines in 3 files now uncovered.

1918 of 2747 relevant lines covered (69.82%)

13.69 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

78.53

/src/pollux/Pollux.ts

import { uuid } from "@stablelib/uuid";

import { Castor } from "../domain/buildingBlocks/Castor";
import { Pollux as IPollux, PresentationOptions } from "../domain/buildingBlocks/Pollux";
import { InvalidJWTString, InvalidVerifyCredentialError, InvalidVerifyFormatError, } from "../domain/models/errors/Pollux";
import { base64url, base64 } from "multiformats/bases/base64";
import { AnoncredsLoader } from "./AnoncredsLoader";

import {
  AttachmentDescriptor,
  CredentialRequestOptions,
  CredentialType,
  Message,
  AttachmentBase64,
  Api,
  PolluxError,
  Credential,
  PresentationDefinitionRequest,
  InputConstraints,
  InputField,
  InputLimitDisclosure,
  InputDescriptor,
  PrivateKey,
  PresentationSubmission,
  DescriptorItem,
  CastorError,
  SubmissionDescriptorFormat,
  DefinitionFormat,
  PresentationClaims,
  DID,
} from "../domain";

import { AnonCredsCredential } from "./models/AnonCredsVerifiableCredential";
import { JWTCredential } from "./models/JWTVerifiableCredential";
import { JWT } from "../apollo/utils/jwt/JWT";
import { Anoncreds } from "../domain/models/Anoncreds";
import { ApiImpl } from "../prism-agent/helpers/ApiImpl";
import { PresentationRequest } from "./models/PresentationRequest";
import { Secp256k1PrivateKey } from "../apollo/utils/Secp256k1PrivateKey";
import { DescriptorPath } from "./utils/DescriptorPath";

/**
 * Implementation of Pollux
 *
 * @export
 * @class Pollux
 * @typedef {Pollux}
 */
export default class Pollux implements IPollux {
  private _anoncreds: AnoncredsLoader | undefined;

  constructor(
    private castor: Castor,
    private api: Api = new ApiImpl(),
    private jwt = new JWT(castor)
  ) { }

  async createPresentationSubmission(
    presentationDefinitionRequest: PresentationDefinitionRequest,
    credential: Credential,
    privateKey: PrivateKey
  ): Promise<PresentationSubmission> {
    if (credential instanceof JWTCredential) {
      if (!(privateKey instanceof Secp256k1PrivateKey)) {
        throw new CastorError.InvalidKeyError()
      }
      const { presentation_definition, options: { challenge, domain } } = presentationDefinitionRequest;

      const descriptorItems: DescriptorItem[] = presentation_definition.input_descriptors.map(
        (inputDescriptor) => {
          if (!inputDescriptor.format || !inputDescriptor.format.jwt || !inputDescriptor.format.jwt.alg) {
            //TODO: Improive error
            throw new Error("Invalid format")
          }
          return {
            id: inputDescriptor.id,
            format: "jwt",
            path: "$.verifiablePresentation[0]"
          }
        });

      const subject = credential.subject;
      if (!privateKey.isSignable()) {
        throw new Error("Cannot sign the proof challenge with this key.")
      }

      if (!credential.isProvable()) {
        throw new Error("Cannot create proofs with this type of credential.")
      }


      const payload = {
        aud: domain,
        nonce: Buffer.from(privateKey.sign(Buffer.from(challenge))).toString('hex'),
        vp: credential.presentation(),
      }
      const jws = await this.jwt.sign({
        issuerDID: DID.fromString(subject),
        privateKey,
        payload
      });

      const presentationSubmission: PresentationSubmission = {
        presentation_submission: {
          id: uuid(),
          definition_id: presentation_definition.id,
          descriptor_map: descriptorItems
        },
        verifiablePresentation: [
          jws
        ]
      }

      return presentationSubmission
    } else {
      throw new PolluxError.CredsentialTypeNotSupported()
    }
  }

  parsePresentationSubmission(data: any): data is PresentationSubmission {
    //Validate object
    if (typeof data !== "object") {
      return false;
    }

    const {
      presentation_submission,
      verifiablePresentation,
    } = data;

    //Validate required fields
    if (!presentation_submission || (typeof presentation_submission !== "object")) {
      return false;
    }

    if (!verifiablePresentation ||
      !Array.isArray(verifiablePresentation)
    ) {
      return false;
    }

    return true;
  }

  async createPresentationDefinitionRequest(
    type: CredentialType,
    presentationClaims: PresentationClaims,
    options: PresentationOptions
  ): Promise<PresentationDefinitionRequest> {
    if (type !== CredentialType.JWT) {
      throw new PolluxError.CredsentialTypeNotSupported()
    }

    const jwtOptions = options.jwt;
    if (!jwtOptions) {
      //TODO: improve erorr handling
      throw new Error("Required field options jwt is undefined")
    }

    if (!jwtOptions.jwtAlg) {
      throw new PolluxError.InvalidJWTPresentationDefinitionError("Presentation options didn't include jwtAlg, jwtVcAlg or jwtVpAlg, one of them is required.")
    }

    const paths = Object.keys(presentationClaims.claims);
    const constaints: InputConstraints = {
      fields: paths.map((path) => {
        const inputField: InputField = {
          path: [
            `$.vc.credentialSubject.${path}`,
            `$.credentialSubject.${path}`
          ],
          id: uuid(),
          optional: false,
          filter: presentationClaims.claims[path],
          name: path
        }
        return inputField
      }),
      limitDisclosure: InputLimitDisclosure.REQUIRED
    };

    if (presentationClaims.issuer) {
      constaints.fields.push({
        path: ["$.vc.issuer", "$.issuer", "$.iss", "$.vc.iss"],
        id: uuid(),
        optional: false,
        name: "issuer",
        filter: {
          type: "string",
          pattern: presentationClaims.issuer
        }
      })
    }

    const format: DefinitionFormat = {
      jwt: {
        alg: jwtOptions.jwtAlg ?? []
      },
    }

    const inputDescriptor: InputDescriptor = {
      id: uuid(),
      name: options.name,
      purpose: options.purpose,
      constraints: constaints,
      format: format
    }

    const presentationDefinitionRequest: PresentationDefinitionRequest = {
      presentation_definition: {
        id: uuid(),
        input_descriptors: [
          inputDescriptor
        ],
        format: format,
      },
      options: {
        challenge: options.challenge,
        domain: options.domain
      }
    }

    return presentationDefinitionRequest
  }

  private validJWTPresentationSubmissionOptions(options: any): options is IPollux.verifyPresentationSubmission.options.JWT {
    return options && options.presentationDefinitionRequest !== undefined;
  }

  async verifyPresentationSubmission(
    presentationSubmission: any,
    options?: IPollux.verifyPresentationSubmission.options.JWT | IPollux.verifyPresentationSubmission.options.Anoncreds
  ): Promise<boolean> {
    const isValidPresentationSubmission = this.parsePresentationSubmission(presentationSubmission);
    if (!isValidPresentationSubmission) {
      throw new InvalidVerifyFormatError('PresentationSubmission format is invalid')
    }
    const validJWTPresentationSubmissionOptions = this.validJWTPresentationSubmissionOptions(options)
    if (!validJWTPresentationSubmissionOptions) {
      throw new InvalidVerifyFormatError('VerifyPresentationSubmission options are invalid')
    }

    const presentationDefinitionRequest = options.presentationDefinitionRequest;
    const inputDescriptors = presentationDefinitionRequest.presentation_definition.input_descriptors;
    const descriptorMapper = new DescriptorPath(presentationSubmission);
    const descriptorMaps = presentationSubmission.presentation_submission.descriptor_map;

    for (let descriptorItem of descriptorMaps) {
      if (descriptorItem.format === SubmissionDescriptorFormat.JWT) {
        const jws = descriptorMapper.getValue(descriptorItem.path);
        if (!jws) {
          throw new InvalidVerifyFormatError(`Invalid Submission, ${descriptorItem.path} not found in submission`);
        }
        const presentation = JWTCredential.fromJWS(jws);
        const credType = presentation.credentialType;
        const isPrismJWTCredentialType = credType === CredentialType.JWT;
        if (!isPrismJWTCredentialType) {
          throw new InvalidVerifyCredentialError(jws, "Invalid JWT Credential only prism/jwt is supported for jwt");
        }
        const issuer = presentation.issuer;
        const credentialValid = await this.jwt.verify({
          issuerDID: issuer,
          jws
        });
        if (!credentialValid) {
          throw new InvalidVerifyCredentialError(jws, "Invalid Holder Presentation JWS Signature");
        }
        const verifiablePresentation = presentation.vp;
        const vc = verifiablePresentation.verifiableCredential.at(0)
        if (!vc) {
          throw new InvalidVerifyCredentialError(jws, "Invalid Verifiable Presentation payload, cannot find vc");

        }
        const verifiableCredential = JWTCredential.fromJWS(vc);
        if (verifiableCredential.sub !== issuer) {
          throw new InvalidVerifyCredentialError(vc, "Invalid Verifiable Presentation payload, the credential has been issued to another holder");
        }

        const verifiableCredentialValid = await this.jwt.verify({
          holderDID: verifiableCredential.sub ? DID.fromString(verifiableCredential.sub) : undefined,
          issuerDID: verifiableCredential.issuer,
          jws: verifiableCredential.id
        });
        if (!verifiableCredentialValid) {
          throw new InvalidVerifyCredentialError(vc, "Invalid Presentation Credential JWS Signature");
        }
        const verifiableCredentialPropsMapper = new DescriptorPath(verifiableCredential);
        const inputDescriptor = inputDescriptors.find((inputDescriptor) => inputDescriptor.id === descriptorItem.id);
        if (inputDescriptor) {
          const constraints = inputDescriptor.constraints;
          const fields = constraints.fields;
          if (constraints.limitDisclosure === InputLimitDisclosure.REQUIRED) {
            for (let field of fields) {
              const paths = [
                ...field.path
              ];
              const optional = field.optional;
              if (!optional) {
                let validClaim = false;
                let reason = null;
                while (paths.length && !validClaim) {
                  const [path] = paths.splice(0, 1);
                  if (path) {
                    const fieldInVC = verifiableCredentialPropsMapper.getValue(path);
                    if (field.filter && fieldInVC !== null) {
                      const filter = field.filter;
                      if (filter.pattern) {
                        const pattern = new RegExp(filter.pattern);
                        if (pattern.test(fieldInVC) || fieldInVC === filter.pattern) {
                          validClaim = true
                        } else {
                          reason = `Expected the ${path} field to be "${filter.pattern}" but got "${fieldInVC}"`
                        }
                      } else if (filter.enum) {
                        if (filter.enum.includes(fieldInVC)) {
                          validClaim = true
                        } else {
                          reason = `Expected the ${path} field to be one of ${filter.enum.join(", ")} but got ${fieldInVC}`
                        }
                        validClaim = filter.enum.includes(fieldInVC)
                      } else if (filter.const && fieldInVC === filter.pattern) {
                        if (fieldInVC === filter.const) {
                          validClaim = true
                        } else {
                          reason = `Expected the ${path} field to be "${filter.const}" but got "${fieldInVC}"`
                        }
                        validClaim = fieldInVC === filter.const;
                      }
                    } else {
                      reason = `Expected one of the paths ${field.path.join(", ")} to exist.`
                    }
                  } else {
                    reason = `Expected one of the paths ${field.path.join(", ")} to exist.`
                  }
                }
                if (!validClaim) {
                  throw new InvalidVerifyCredentialError(vc, `Invalid Claim: ${reason || 'paths are not found or have unexpected value'}`);
                }
              }
            }
          }
        }
        return true;
      }

    }
    return false;
  }

  async start() {
    this._anoncreds = await AnoncredsLoader.getInstance();
  }

  // TODO: should anoncreds hidden through abstraction
  get anoncreds() {
    if (this._anoncreds === undefined) {
      throw new Error("Pollux - Anoncreds not loaded");
    }

    return this._anoncreds;
  }

  // TODO: does this function belong in Pollux, can we move to Message?
  public extractCredentialFormatFromMessage(message: Message) {
    const [attachment] = message.attachments;
    if (!attachment) {
      throw new Error("Required Attachment");
    }

    if (
      attachment.format === CredentialType.ANONCREDS_PROOF_REQUEST ||
      attachment.format === CredentialType.ANONCREDS_OFFER ||
      attachment.format === CredentialType.ANONCREDS_ISSUE ||
      attachment.format === CredentialType.ANONCREDS_REQUEST
    ) {
      return CredentialType.AnonCreds;
    }

    if (attachment.format === CredentialType.JWT) {
      return CredentialType.JWT;
    }

    return CredentialType.Unknown;
  }

  async processJWTCredential(
    offer: Message,
    options: CredentialRequestOptions = {}
  ) {
    const { did, keyPair } = options;
    if (!did) {
      throw new Error("Required did ");
    }

    if (!keyPair) {
      throw new Error("Required keyPair ");
    }

    const domainChallenge = this.extractDomainChallenge(offer.attachments);
    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
    const challenge = domainChallenge.challenge!;
    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
    const domain = domainChallenge.domain!;

    const signedJWT = await this.jwt.sign({
      issuerDID: did,
      privateKey: keyPair.privateKey.value, payload: {
        aud: domain,
        nonce: challenge,
        vp: {
          "@context": ["https://www.w3.org/2018/presentations/v1"],
          type: ["VerifiablePresentation"],
        },
      }
    });

    return signedJWT;
  }

  /**
   * handle the retrieval of a Credential Definition
   * 
   * @param credentialDefinitionId 
   * @returns 
   */
  private async fetchCredentialDefinition(
    credentialDefinitionId: string
  ): Promise<Anoncreds.CredentialDefinition> {
    const response = await this.api.request<Anoncreds.CredentialDefinition>(
      "get",
      credentialDefinitionId,
      new Map(),
      new Map(),
      null
    );

    return response.body;
  }

  /**
   * handle the retrieval of a Schema definition
   * 
   * @param {string} schemaURI - URI used to retrieve the Schema definition
   * @returns 
   */
  private async fetchSchema(schemaURI: string): Promise<any> {
    const response = await this.api.request<Anoncreds.Schema>(
      "get",
      schemaURI,
      new Map(),
      new Map(),
      null
    );

    return response.body;
  }

  private extractAttachment(body: any, attachments: AttachmentDescriptor[]) {
    const [attachment] = attachments;
    if (!attachment) {
      throw new Error("Attachment not found");
    }

    return JSON.parse(
      Buffer.from(
        base64.baseDecode((attachment.data as AttachmentBase64).base64)
      ).toString()
    );
  }

  private isAnonCredsBody(body: any): body is Anoncreds.CredentialOffer {
    const {
      cred_def_id,
      schema_id,
      key_correctness_proof,
      nonce,
      method_name,
    } = body;

    if (!cred_def_id || typeof cred_def_id !== "string") return false;
    if (!schema_id || typeof schema_id !== "string") return false;
    if (!nonce || typeof nonce !== "string") return false;
    if (!key_correctness_proof) return false;

    const { c, xr_cap, xz_cap } = key_correctness_proof;

    if (!c || !xr_cap || !xz_cap) return false;
    if (
      typeof c !== "string" ||
      !Array.isArray(xr_cap) ||
      typeof xz_cap !== "string"
    )
      return false;

    if (
      xr_cap.length <= 0 ||
      xr_cap.find(
        ([first, second]) =>
          typeof first !== "string" || typeof second !== "string"
      )
    )
      return false;

    if (method_name && typeof method_name !== "string") return false;

    return true;
  }

  async processAnonCredsCredential(
    offer: Message,
    options: CredentialRequestOptions
  ) {
    const linkSecret = options.linkSecret;
    if (!linkSecret) {
      throw new Error("Link Secret is not available.");
    }

    const body = JSON.parse(offer.body);

    const credentialOfferBody = this.extractAttachment(body, offer.attachments);

    const isAnonCredsBody = this.isAnonCredsBody(credentialOfferBody);
    if (!isAnonCredsBody) {
      throw new Error("Invalid AnonCreds offer body");
    }

    const { cred_def_id } = credentialOfferBody;
    const credentialDefinition =
      await this.fetchCredentialDefinition(cred_def_id);

    return this.anoncreds.createCredentialRequest(
      credentialOfferBody,
      credentialDefinition,
      linkSecret.secret,
      linkSecret.name
    );
  }

  async parseCredential(
    credentialBuffer: Uint8Array,
    options?: {
      type: CredentialType;
      linkSecret?: string;
      credentialMetadata?: Anoncreds.CredentialRequestMeta;
      [name: string]: any;
    }
  ) {
    const credentialType = options?.type || CredentialType.Unknown;
    const credentialString = Buffer.from(credentialBuffer).toString();

    if (credentialType === CredentialType.JWT) {
      const parts = credentialString.split(".");

      if (parts.length != 3 || parts.at(1) === undefined) {
        throw new InvalidJWTString();
      }

      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
      const jwtCredentialString = parts.at(1)!;
      const base64Data = base64url.baseDecode(jwtCredentialString);
      const jsonString = Buffer.from(base64Data).toString();
      const jsonParsed = JSON.parse(jsonString);

      return JWTCredential.fromJWT(jsonParsed, credentialString);
    }

    if (credentialType === CredentialType.AnonCreds) {
      if (options?.linkSecret === undefined) {
        throw new Error("LinkSecret is required");
      }
      if (options?.credentialMetadata === undefined) {
        throw new Error("Invalid credential metadata");
      }

      const linkSecret = options.linkSecret;
      const credentialMetadata = options.credentialMetadata;

      const credentialIssued = JSON.parse(
        credentialString
      ) as Anoncreds.CredentialIssued;

      const credentialDefinition = await this.fetchCredentialDefinition(
        credentialIssued.cred_def_id
      );

      const credential = this.anoncreds.processCredential(
        credentialDefinition,
        credentialIssued,
        credentialMetadata,
        linkSecret
      );

      return new AnonCredsCredential(credential);
    }

    throw new Error("Not implemented");
  }

  private extractDomainChallenge(attachments: AttachmentDescriptor[]) {
    return attachments.reduce(
      (_, attachment: any) => ({
        challenge: attachment?.data?.data?.options?.challenge,
        domain: attachment?.data?.data?.options?.domain,
      }),
      { challenge: undefined, domain: undefined } as {
        challenge?: string;
        domain?: string;
      }
    );
  }

  createPresentationProof(presentationRequest: PresentationRequest, credential: AnonCredsCredential, options: IPollux.createPresentationProof.options.Anoncreds): Promise<Anoncreds.Presentation>;
  createPresentationProof(presentationRequest: PresentationRequest, credential: JWTCredential, options: IPollux.createPresentationProof.options.JWT): Promise<string>;
  async createPresentationProof(
    presentationRequest: PresentationRequest,
    credential: Credential,
    options: IPollux.createPresentationProof.options
  ) {
    if (
      credential instanceof AnonCredsCredential
      && presentationRequest.isType(CredentialType.AnonCreds)
      && "linkSecret" in options
    ) {
      const schema = await this.fetchSchema(credential.schemaId);
      const schemas = { [credential.schemaId]: schema };
      const credentialDefinition = await this.fetchCredentialDefinition(credential.credentialDefinitionId);
      const credDefs = { [credential.credentialDefinitionId]: credentialDefinition };

      const result = this.anoncreds.createPresentation(
        presentationRequest.toJSON(),
        schemas,
        credDefs,
        credential.toJSON(),
        options.linkSecret.secret
      );

      return result;
    }

    if (
      credential instanceof JWTCredential
      && presentationRequest.isType(CredentialType.JWT)
      && "did" in options
      && "privateKey" in options
    ) {
      const presReqJson = presentationRequest.toJSON();
      const signedJWT = await this.jwt.sign({
        issuerDID: options.did,
        privateKey: options.privateKey,
        payload: {
          iss: options.did.toString(),
          aud: presReqJson.options.domain,
          nonce: presReqJson.options.challenge,
          vp: credential.presentation()
        }
      });

      return signedJWT;
    }

    throw new PolluxError.InvalidPresentationProofArgs();
  }
}

1	import { uuid } from "@stablelib/uuid";
2
3	import { Castor } from "../domain/buildingBlocks/Castor";
4	import { Pollux as IPollux, PresentationOptions } from "../domain/buildingBlocks/Pollux";
5	import { InvalidJWTString, InvalidVerifyCredentialError, InvalidVerifyFormatError, } from "../domain/models/errors/Pollux";
6	import { base64url, base64 } from "multiformats/bases/base64";
7	import { AnoncredsLoader } from "./AnoncredsLoader";
8
9	import {
10	AttachmentDescriptor,
11	CredentialRequestOptions,
12	CredentialType,
13	Message,
14	AttachmentBase64,
15	Api,
16	PolluxError,
17	Credential,
18	PresentationDefinitionRequest,
19	InputConstraints,
20	InputField,
21	InputLimitDisclosure,
22	InputDescriptor,
23	PrivateKey,
24	PresentationSubmission,
25	DescriptorItem,
26	CastorError,
27	SubmissionDescriptorFormat,
28	DefinitionFormat,
29	PresentationClaims,
30	DID,
31	} from "../domain";
32
33	import { AnonCredsCredential } from "./models/AnonCredsVerifiableCredential";
34	import { JWTCredential } from "./models/JWTVerifiableCredential";
35	import { JWT } from "../apollo/utils/jwt/JWT";
36	import { Anoncreds } from "../domain/models/Anoncreds";
37	import { ApiImpl } from "../prism-agent/helpers/ApiImpl";
38	import { PresentationRequest } from "./models/PresentationRequest";
39	import { Secp256k1PrivateKey } from "../apollo/utils/Secp256k1PrivateKey";
40	import { DescriptorPath } from "./utils/DescriptorPath";
41
42	/**
43	* Implementation of Pollux
44	*
45	* @export
46	* @class Pollux
47	* @typedef {Pollux}
48	*/
49	export default class Pollux implements IPollux {
50	private _anoncreds: AnoncredsLoader \| undefined;
51
52	constructor(
53	private castor: Castor,
54	private api: Api = new ApiImpl(),	126✔
55	private jwt = new JWT(castor)	120✔
56	) { }
57
58	async createPresentationSubmission(
59	presentationDefinitionRequest: PresentationDefinitionRequest,
60	credential: Credential,
61	privateKey: PrivateKey
62	): Promise<PresentationSubmission> {
63	if (credential instanceof JWTCredential) {	5!
64	if (!(privateKey instanceof Secp256k1PrivateKey)) {	5!
NEW 65	throw new CastorError.InvalidKeyError()	×
66	}
67	const { presentation_definition, options: { challenge, domain } } = presentationDefinitionRequest;	5✔
68
69	const descriptorItems: DescriptorItem[] = presentation_definition.input_descriptors.map(	5✔
70	(inputDescriptor) => {
71	if (!inputDescriptor.format \|\| !inputDescriptor.format.jwt \|\| !inputDescriptor.format.jwt.alg) {	5!
72	//TODO: Improive error
NEW 73	throw new Error("Invalid format")	×
74	}
75	return {	5✔
76	id: inputDescriptor.id,
77	format: "jwt",
78	path: "$.verifiablePresentation[0]"
79	}
80	});
81
82	const subject = credential.subject;	5✔
83	if (!privateKey.isSignable()) {	5!
NEW 84	throw new Error("Cannot sign the proof challenge with this key.")	×
85	}
86
87	if (!credential.isProvable()) {	5!
NEW 88	throw new Error("Cannot create proofs with this type of credential.")	×
89	}
90
91
92	const payload = {	5✔
93	aud: domain,
94	nonce: Buffer.from(privateKey.sign(Buffer.from(challenge))).toString('hex'),
95	vp: credential.presentation(),
96	}
97	const jws = await this.jwt.sign({	5✔
98	issuerDID: DID.fromString(subject),
99	privateKey,
100	payload
101	});
102
103	const presentationSubmission: PresentationSubmission = {	5✔
104	presentation_submission: {
105	id: uuid(),
106	definition_id: presentation_definition.id,
107	descriptor_map: descriptorItems
108	},
109	verifiablePresentation: [
110	jws
111	]
112	}
113
114	return presentationSubmission	5✔
115	} else {
NEW 116	throw new PolluxError.CredsentialTypeNotSupported()	×
117	}
118	}
119
120	parsePresentationSubmission(data: any): data is PresentationSubmission {
121	//Validate object
122	if (typeof data !== "object") {	5!
NEW 123	return false;	×
124	}
125
126	const {
127	presentation_submission,
128	verifiablePresentation,
129	} = data;	5✔
130
131	//Validate required fields
132	if (!presentation_submission \|\| (typeof presentation_submission !== "object")) {	5!
NEW 133	return false;	×
134	}
135
136	if (!verifiablePresentation \|\|	5!
137	!Array.isArray(verifiablePresentation)
138	) {
NEW 139	return false;	×
140	}
141
142	return true;	5✔
143	}
144
145	async createPresentationDefinitionRequest(
146	type: CredentialType,
147	presentationClaims: PresentationClaims,
148	options: PresentationOptions
149	): Promise<PresentationDefinitionRequest> {
150	if (type !== CredentialType.JWT) {	6!
NEW 151	throw new PolluxError.CredsentialTypeNotSupported()	×
152	}
153
154	const jwtOptions = options.jwt;	6✔
155	if (!jwtOptions) {	6!
156	//TODO: improve erorr handling
NEW 157	throw new Error("Required field options jwt is undefined")	×
158	}
159
160	if (!jwtOptions.jwtAlg) {	6!
NEW 161	throw new PolluxError.InvalidJWTPresentationDefinitionError("Presentation options didn't include jwtAlg, jwtVcAlg or jwtVpAlg, one of them is required.")	×
162	}
163
164	const paths = Object.keys(presentationClaims.claims);	6✔
165	const constaints: InputConstraints = {	6✔
166	fields: paths.map((path) => {
167	const inputField: InputField = {	6✔
168	path: [
169	`$.vc.credentialSubject.${path}`,
170	`$.credentialSubject.${path}`
171	],
172	id: uuid(),
173	optional: false,
174	filter: presentationClaims.claims[path],
175	name: path
176	}
177	return inputField	6✔
178	}),
179	limitDisclosure: InputLimitDisclosure.REQUIRED
180	};
181
182	if (presentationClaims.issuer) {	6!
183	constaints.fields.push({	6✔
184	path: ["$.vc.issuer", "$.issuer", "$.iss", "$.vc.iss"],
185	id: uuid(),
186	optional: false,
187	name: "issuer",
188	filter: {
189	type: "string",
190	pattern: presentationClaims.issuer
191	}
192	})
193	}
194
195	const format: DefinitionFormat = {	6✔
196	jwt: {
197	alg: jwtOptions.jwtAlg ?? []	6!
198	},
199	}
200
201	const inputDescriptor: InputDescriptor = {	6✔
202	id: uuid(),
203	name: options.name,
204	purpose: options.purpose,
205	constraints: constaints,
206	format: format
207	}
208
209	const presentationDefinitionRequest: PresentationDefinitionRequest = {	6✔
210	presentation_definition: {
211	id: uuid(),
212	input_descriptors: [
213	inputDescriptor
214	],
215	format: format,
216	},
217	options: {
218	challenge: options.challenge,
219	domain: options.domain
220	}
221	}
222
223	return presentationDefinitionRequest	6✔
224	}
225
226	private validJWTPresentationSubmissionOptions(options: any): options is IPollux.verifyPresentationSubmission.options.JWT {
227	return options && options.presentationDefinitionRequest !== undefined;	5✔
228	}
229
230	async verifyPresentationSubmission(
231	presentationSubmission: any,
232	options?: IPollux.verifyPresentationSubmission.options.JWT \| IPollux.verifyPresentationSubmission.options.Anoncreds
233	): Promise<boolean> {
234	const isValidPresentationSubmission = this.parsePresentationSubmission(presentationSubmission);	5✔
235	if (!isValidPresentationSubmission) {	5!
NEW 236	throw new InvalidVerifyFormatError('PresentationSubmission format is invalid')	×
237	}
238	const validJWTPresentationSubmissionOptions = this.validJWTPresentationSubmissionOptions(options)	5✔
239	if (!validJWTPresentationSubmissionOptions) {	5!
NEW 240	throw new InvalidVerifyFormatError('VerifyPresentationSubmission options are invalid')	×
241	}
242
243	const presentationDefinitionRequest = options.presentationDefinitionRequest;	5✔
244	const inputDescriptors = presentationDefinitionRequest.presentation_definition.input_descriptors;	5✔
245	const descriptorMapper = new DescriptorPath(presentationSubmission);	5✔
246	const descriptorMaps = presentationSubmission.presentation_submission.descriptor_map;	5✔
247
248	for (let descriptorItem of descriptorMaps) {	5✔
249	if (descriptorItem.format === SubmissionDescriptorFormat.JWT) {	5!
250	const jws = descriptorMapper.getValue(descriptorItem.path);	5✔
251	if (!jws) {	5!
NEW 252	throw new InvalidVerifyFormatError(`Invalid Submission, ${descriptorItem.path} not found in submission`);	×
253	}
254	const presentation = JWTCredential.fromJWS(jws);	5✔
255	const credType = presentation.credentialType;	5✔
256	const isPrismJWTCredentialType = credType === CredentialType.JWT;	5✔
257	if (!isPrismJWTCredentialType) {	5!
NEW 258	throw new InvalidVerifyCredentialError(jws, "Invalid JWT Credential only prism/jwt is supported for jwt");	×
259	}
260	const issuer = presentation.issuer;	5✔
261	const credentialValid = await this.jwt.verify({	5✔
262	issuerDID: issuer,
263	jws
264	});
265	if (!credentialValid) {	5✔
266	throw new InvalidVerifyCredentialError(jws, "Invalid Holder Presentation JWS Signature");	1✔
267	}
268	const verifiablePresentation = presentation.vp;	4✔
269	const vc = verifiablePresentation.verifiableCredential.at(0)	4✔
270	if (!vc) {	4!
NEW 271	throw new InvalidVerifyCredentialError(jws, "Invalid Verifiable Presentation payload, cannot find vc");	×
272
273	}
274	const verifiableCredential = JWTCredential.fromJWS(vc);	4✔
275	if (verifiableCredential.sub !== issuer) {	4!
NEW 276	throw new InvalidVerifyCredentialError(vc, "Invalid Verifiable Presentation payload, the credential has been issued to another holder");	×
277	}
278
279	const verifiableCredentialValid = await this.jwt.verify({	4✔
280	holderDID: verifiableCredential.sub ? DID.fromString(verifiableCredential.sub) : undefined,	4!
281	issuerDID: verifiableCredential.issuer,
282	jws: verifiableCredential.id
283	});
284	if (!verifiableCredentialValid) {	4✔
285	throw new InvalidVerifyCredentialError(vc, "Invalid Presentation Credential JWS Signature");	1✔
286	}
287	const verifiableCredentialPropsMapper = new DescriptorPath(verifiableCredential);	3✔
288	const inputDescriptor = inputDescriptors.find((inputDescriptor) => inputDescriptor.id === descriptorItem.id);	3✔
289	if (inputDescriptor) {	3!
290	const constraints = inputDescriptor.constraints;	3✔
291	const fields = constraints.fields;	3✔
292	if (constraints.limitDisclosure === InputLimitDisclosure.REQUIRED) {	3!
293	for (let field of fields) {	3✔
294	const paths = [	4✔
295	...field.path
296	];
297	const optional = field.optional;	4✔
298	if (!optional) {	4!
299	let validClaim = false;	4✔
300	let reason = null;	4✔
301	while (paths.length && !validClaim) {	4✔
302	const [path] = paths.splice(0, 1);	6✔
303	if (path) {	6!
304	const fieldInVC = verifiableCredentialPropsMapper.getValue(path);	6✔
305	if (field.filter && fieldInVC !== null) {	6✔
306	const filter = field.filter;	4✔
307	if (filter.pattern) {	4!
308	const pattern = new RegExp(filter.pattern);	4✔
309	if (pattern.test(fieldInVC) \|\| fieldInVC === filter.pattern) {	4✔
310	validClaim = true	2✔
311	} else {
312	reason = `Expected the ${path} field to be "${filter.pattern}" but got "${fieldInVC}"`	2✔
313	}
NEW 314	} else if (filter.enum) {	×
NEW 315	if (filter.enum.includes(fieldInVC)) {	×
NEW 316	validClaim = true	×
317	} else {
NEW 318	reason = `Expected the ${path} field to be one of ${filter.enum.join(", ")} but got ${fieldInVC}`	×
319	}
NEW 320	validClaim = filter.enum.includes(fieldInVC)	×
NEW 321	} else if (filter.const && fieldInVC === filter.pattern) {	×
NEW 322	if (fieldInVC === filter.const) {	×
NEW 323	validClaim = true	×
324	} else {
NEW 325	reason = `Expected the ${path} field to be "${filter.const}" but got "${fieldInVC}"`	×
326	}
NEW 327	validClaim = fieldInVC === filter.const;	×
328	}
329	} else {
330	reason = `Expected one of the paths ${field.path.join(", ")} to exist.`	2✔
331	}
332	} else {
NEW 333	reason = `Expected one of the paths ${field.path.join(", ")} to exist.`	×
334	}
335	}
336	if (!validClaim) {	4✔
337	throw new InvalidVerifyCredentialError(vc, `Invalid Claim: ${reason \|\| 'paths are not found or have unexpected value'}`);	2!
338	}
339	}
340	}
341	}
342	}
343	return true;	1✔
344	}
345
346	}
NEW 347	return false;	×
348	}
349
350	async start() {
351	this._anoncreds = await AnoncredsLoader.getInstance();	114✔
352	}
353
354	// TODO: should anoncreds hidden through abstraction
355	get anoncreds() {
356	if (this._anoncreds === undefined) {	40!
357	throw new Error("Pollux - Anoncreds not loaded");	×
358	}
359
360	return this._anoncreds;	40✔
361	}
362
363	// TODO: does this function belong in Pollux, can we move to Message?
364	public extractCredentialFormatFromMessage(message: Message) {
365	const [attachment] = message.attachments;	30✔
366	if (!attachment) {	30✔
367	throw new Error("Required Attachment");	3✔
368	}
369
370	if (	27✔
371	attachment.format === CredentialType.ANONCREDS_PROOF_REQUEST \|\|	93✔
372	attachment.format === CredentialType.ANONCREDS_OFFER \|\|
373	attachment.format === CredentialType.ANONCREDS_ISSUE \|\|
374	attachment.format === CredentialType.ANONCREDS_REQUEST
375	) {
376	return CredentialType.AnonCreds;	11✔
377	}
378
379	if (attachment.format === CredentialType.JWT) {	16✔
380	return CredentialType.JWT;	7✔
381	}
382
383	return CredentialType.Unknown;	9✔
384	}
385
386	async processJWTCredential(
387	offer: Message,
388	options: CredentialRequestOptions = {}	1✔
389	) {
390	const { did, keyPair } = options;	5✔
391	if (!did) {	5✔
392	throw new Error("Required did ");	2✔
393	}
394
395	if (!keyPair) {	3✔
396	throw new Error("Required keyPair ");	1✔
397	}
398
399	const domainChallenge = this.extractDomainChallenge(offer.attachments);	2✔
400	// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
401	const challenge = domainChallenge.challenge!;	2✔
402	// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
403	const domain = domainChallenge.domain!;	2✔
404
405	const signedJWT = await this.jwt.sign({	2✔
406	issuerDID: did,
407	privateKey: keyPair.privateKey.value, payload: {
408	aud: domain,
409	nonce: challenge,
410	vp: {
411	"@context": ["https://www.w3.org/2018/presentations/v1"],
412	type: ["VerifiablePresentation"],
413	},
414	}
415	});
416
417	return signedJWT;	2✔
418	}
419
420	/**
421	* handle the retrieval of a Credential Definition
422	*
423	* @param credentialDefinitionId
424	* @returns
425	*/
426	private async fetchCredentialDefinition(
427	credentialDefinitionId: string
428	): Promise<Anoncreds.CredentialDefinition> {
429	const response = await this.api.request<Anoncreds.CredentialDefinition>(	1✔
430	"get",
431	credentialDefinitionId,
432	new Map(),
433	new Map(),
434	null
435	);
436
437	return response.body;	×
438	}
439
440	/**
441	* handle the retrieval of a Schema definition
442	*
443	* @param {string} schemaURI - URI used to retrieve the Schema definition
444	* @returns
445	*/
446	private async fetchSchema(schemaURI: string): Promise<any> {
447	const response = await this.api.request<Anoncreds.Schema>(	×
448	"get",
449	schemaURI,
450	new Map(),
451	new Map(),
452	null
453	);
454
455	return response.body;	×
456	}
457
458	private extractAttachment(body: any, attachments: AttachmentDescriptor[]) {
459	const [attachment] = attachments;	11✔
460	if (!attachment) {	11✔
461	throw new Error("Attachment not found");	2✔
462	}
463
464	return JSON.parse(	9✔
465	Buffer.from(
466	base64.baseDecode((attachment.data as AttachmentBase64).base64)
467	).toString()
468	);
469	}
470
471	private isAnonCredsBody(body: any): body is Anoncreds.CredentialOffer {
472	const {
473	cred_def_id,
474	schema_id,
475	key_correctness_proof,
476	nonce,
477	method_name,
478	} = body;	7✔
479
480	if (!cred_def_id \|\| typeof cred_def_id !== "string") return false;	7✔
481	if (!schema_id \|\| typeof schema_id !== "string") return false;	6✔
482	if (!nonce \|\| typeof nonce !== "string") return false;	5✔
483	if (!key_correctness_proof) return false;	4✔
484
485	const { c, xr_cap, xz_cap } = key_correctness_proof;	3✔
486
487	if (!c \|\| !xr_cap \|\| !xz_cap) return false;	3!
488	if (	3!
489	typeof c !== "string" \|\|	9✔
490	!Array.isArray(xr_cap) \|\|
491	typeof xz_cap !== "string"
492	)
493	return false;	×
494
495	if (	3!
496	xr_cap.length <= 0 \|\|	6✔
497	xr_cap.find(
498	([first, second]) =>
499	typeof first !== "string" \|\| typeof second !== "string"	5✔
500	)
501	)
502	return false;	×
503
504	if (method_name && typeof method_name !== "string") return false;	3!
505
506	return true;	3✔
507	}
508
509	async processAnonCredsCredential(
510	offer: Message,
511	options: CredentialRequestOptions
512	) {
513	const linkSecret = options.linkSecret;	12✔
514	if (!linkSecret) {	12✔
515	throw new Error("Link Secret is not available.");	1✔
516	}
517
518	const body = JSON.parse(offer.body);	11✔
519
520	const credentialOfferBody = this.extractAttachment(body, offer.attachments);	11✔
521
522	const isAnonCredsBody = this.isAnonCredsBody(credentialOfferBody);	7✔
523	if (!isAnonCredsBody) {	7✔
524	throw new Error("Invalid AnonCreds offer body");	4✔
525	}
526
527	const { cred_def_id } = credentialOfferBody;	3✔
528	const credentialDefinition =
529	await this.fetchCredentialDefinition(cred_def_id);	3✔
530
531	return this.anoncreds.createCredentialRequest(	2✔
532	credentialOfferBody,
533	credentialDefinition,
534	linkSecret.secret,
535	linkSecret.name
536	);
537	}
538
539	async parseCredential(
540	credentialBuffer: Uint8Array,
541	options?: {
542	type: CredentialType;
543	linkSecret?: string;
544	credentialMetadata?: Anoncreds.CredentialRequestMeta;
545	[name: string]: any;
546	}
547	) {
548	const credentialType = options?.type \|\| CredentialType.Unknown;	21!
549	const credentialString = Buffer.from(credentialBuffer).toString();	21✔
550
551	if (credentialType === CredentialType.JWT) {	21✔
552	const parts = credentialString.split(".");	11✔
553
554	if (parts.length != 3 \|\| parts.at(1) === undefined) {	11✔
555	throw new InvalidJWTString();	5✔
556	}
557
558	// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
559	const jwtCredentialString = parts.at(1)!;	6✔
560	const base64Data = base64url.baseDecode(jwtCredentialString);	6✔
561	const jsonString = Buffer.from(base64Data).toString();	6✔
562	const jsonParsed = JSON.parse(jsonString);	6✔
563
564	return JWTCredential.fromJWT(jsonParsed, credentialString);	5✔
565	}
566
567	if (credentialType === CredentialType.AnonCreds) {	10!
568	if (options?.linkSecret === undefined) {	10✔
569	throw new Error("LinkSecret is required");	4✔
570	}
571	if (options?.credentialMetadata === undefined) {	6✔
572	throw new Error("Invalid credential metadata");	1✔
573	}
574
575	const linkSecret = options.linkSecret;	5✔
576	const credentialMetadata = options.credentialMetadata;	5✔
577
578	const credentialIssued = JSON.parse(	5✔
579	credentialString
580	) as Anoncreds.CredentialIssued;
581
582	const credentialDefinition = await this.fetchCredentialDefinition(	5✔
583	credentialIssued.cred_def_id
584	);
585
586	const credential = this.anoncreds.processCredential(	5✔
587	credentialDefinition,
588	credentialIssued,
589	credentialMetadata,
590	linkSecret
591	);
592
593	return new AnonCredsCredential(credential);	5✔
594	}
595
596	throw new Error("Not implemented");	×
597	}
598
599	private extractDomainChallenge(attachments: AttachmentDescriptor[]) {
600	return attachments.reduce(	2✔
601	(_, attachment: any) => ({	1✔
602	challenge: attachment?.data?.data?.options?.challenge,
603	domain: attachment?.data?.data?.options?.domain,
604	}),
605	{ challenge: undefined, domain: undefined } as {
606	challenge?: string;
607	domain?: string;
608	}
609	);
610	}
611
612	createPresentationProof(presentationRequest: PresentationRequest, credential: AnonCredsCredential, options: IPollux.createPresentationProof.options.Anoncreds): Promise<Anoncreds.Presentation>;
613	createPresentationProof(presentationRequest: PresentationRequest, credential: JWTCredential, options: IPollux.createPresentationProof.options.JWT): Promise<string>;
614	async createPresentationProof(
615	presentationRequest: PresentationRequest,
616	credential: Credential,
617	options: IPollux.createPresentationProof.options
618	) {
619	if (	4✔
620	credential instanceof AnonCredsCredential	8✔
621	&& presentationRequest.isType(CredentialType.AnonCreds)
622	&& "linkSecret" in options
623	) {
624	const schema = await this.fetchSchema(credential.schemaId);	2✔
625	const schemas = { [credential.schemaId]: schema };	2✔
626	const credentialDefinition = await this.fetchCredentialDefinition(credential.credentialDefinitionId);	2✔
627	const credDefs = { [credential.credentialDefinitionId]: credentialDefinition };	2✔
628
629	const result = this.anoncreds.createPresentation(	2✔
630	presentationRequest.toJSON(),
631	schemas,
632	credDefs,
633	credential.toJSON(),
634	options.linkSecret.secret
635	);
636
637	return result;	2✔
638	}
639
640	if (	2!
641	credential instanceof JWTCredential	8✔
642	&& presentationRequest.isType(CredentialType.JWT)
643	&& "did" in options
644	&& "privateKey" in options
645	) {
646	const presReqJson = presentationRequest.toJSON();	2✔
647	const signedJWT = await this.jwt.sign({	2✔
648	issuerDID: options.did,
649	privateKey: options.privateKey,
650	payload: {
651	iss: options.did.toString(),
652	aud: presReqJson.options.domain,
653	nonce: presReqJson.options.challenge,
654	vp: credential.presentation()
655	}
656	});
657
658	return signedJWT;	2✔
659	}
660
661	throw new PolluxError.InvalidPresentationProofArgs();	×
662	}
663	}

input-output-hk / atala-prism-wallet-sdk-ts / 8705255638

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous