9846405965

Committed 08 Jul 2024 08:23PM UTC coverage: 71.499%. Remained the same

Build # 9846405965

Build Type

push

github

Committed by

yshyn-iohk

Commit Message

Merge remote-tracking branch 'origin/main'

Run Details

1355 of 2085 branches covered (64.99%)

Branch coverage included in aggregate %.

1 of 2 new or added lines in 2 files covered. (50.0%)

22 existing lines in 1 file now uncovered.

2719 of 3613 relevant lines covered (75.26%)

22.33 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

51.64

/src/edge-agent/Agent.Credentials.ts

import { base64 } from "multiformats/bases/base64";

import {
  AgentError,
  Apollo,
  AttachmentDescriptor,
  Castor,
  Credential,
  CredentialType,
  CredentialIssueOptions,
  Curve,
  DID,
  KeyProperties,
  KeyTypes,
  Seed,
  Message,
  Pluto,
  Pollux,
  CredentialMetadata,
  PresentationOptions,
  Mercury,
  PresentationDefinitionRequest,
  PresentationClaims,
  AttachmentFormats,
  PolluxError,
  curveToAlg,
} from "../domain";

import { AnonCredsCredential } from "../pollux/models/AnonCredsVerifiableCredential";
import { JWTCredential } from "../pollux/models/JWTVerifiableCredential";
import { PresentationRequest } from "../pollux/models/PresentationRequest";

import { OfferCredential } from "./protocols/issueCredential/OfferCredential";
import { createRequestCredentialBody, RequestCredential } from "./protocols/issueCredential/RequestCredential";
import { IssueCredential } from "./protocols/issueCredential/IssueCredential";
import { Presentation } from "./protocols/proofPresentation/Presentation";
import { RequestPresentation } from "./protocols/proofPresentation/RequestPresentation";

import { AgentCredentials as AgentCredentialsClass, AgentDIDHigherFunctions } from "./types";
import { PrismKeyPathIndexTask } from "./Agent.PrismKeyPathIndexTask";
import { uuid } from "@stablelib/uuid";
import { ProtocolType } from "./protocols/ProtocolTypes";
import { validatePresentationClaims } from "../pollux/utils/claims";
import { SDJWTCredential } from "../pollux/models/SDJWTVerifiableCredential";

export class AgentCredentials implements AgentCredentialsClass {
  /**
   * Creates an instance of AgentCredentials.
   *
   * @constructor
   * @param {Apollo} apollo
   * @param {Castor} castor
   * @param {Pluto} pluto
   * @param {Pollux} pollux
   * @param {Seed} seed
   */
  constructor(
    protected apollo: Apollo,
    protected castor: Castor,
    protected pluto: Pluto,
    protected pollux: Pollux,
    protected seed: Seed,
    protected mercury: Mercury,
    protected agentDIDHigherFunctions: AgentDIDHigherFunctions
  ) { }





  private createPresentationDefinitionRequest<Type extends CredentialType = CredentialType.JWT>(
    type: Type,
    definition: PresentationDefinitionRequest<Type>,
    from: DID,
    to: DID
  ) {
    const attachmentFormat = type === CredentialType.JWT ?
      AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS :
      AttachmentFormats.ANONCREDS_PROOF_REQUEST;

    return new RequestPresentation(
      {
        proofTypes: [],
      },
      [
        AttachmentDescriptor.build(
          definition,
          uuid(),
          'application/json',
          undefined,
          attachmentFormat
        )
      ],
      from,
      to,
      uuid()
    );
  }

  async initiatePresentationRequest(
    type: CredentialType,
    toDID: DID,
    claims: PresentationClaims<CredentialType>
  ): Promise<RequestPresentation> {
    const didDocument = await this.castor.resolveDID(toDID.toString());
    const newPeerDID = await this.agentDIDHigherFunctions.createNewPeerDID(
      didDocument.services,
      true
    );

    if (type === CredentialType.AnonCreds) {
      if (!validatePresentationClaims(claims, CredentialType.AnonCreds)) {
        throw new PolluxError.InvalidPresentationDefinitionError("Anoncreds Claims are invalid");
      }

      const presentationDefinitionRequest = await this.pollux.createPresentationDefinitionRequest(
        type,
        claims,
        new PresentationOptions({}, CredentialType.AnonCreds)
      );

      return this.createPresentationDefinitionRequest<CredentialType.AnonCreds>(
        type,
        presentationDefinitionRequest,
        newPeerDID,
        toDID
      );
    }

    if (type === CredentialType.JWT) {
      if (!validatePresentationClaims(claims, CredentialType.JWT)) {
        throw new PolluxError.InvalidPresentationDefinitionError("JWT Claims are invalid");
      }
      const presentationDefinitionRequest = await this.pollux.createPresentationDefinitionRequest<CredentialType.JWT>(
        type,
        claims,
        new PresentationOptions({
          jwt: {
            jwtAlg: [curveToAlg(Curve.SECP256K1)]
          },
          challenge: "Sign this text " + uuid(),
          domain: 'N/A'
        })
      );
      return this.createPresentationDefinitionRequest<CredentialType.JWT>(
        type,
        presentationDefinitionRequest,
        newPeerDID,
        toDID
      );
    }

    throw new PolluxError.CredentialTypeNotSupported();
  }

  async verifiableCredentials(): Promise<Credential[]> {
    return await this.pluto.getAllCredentials();
  }

  /**
   * Extract the verifiableCredential object from the Issue credential message asyncronously
   *
   * @async
   * @param {IssueCredential} message
   * @returns {Promise<VerifiableCredential>}
   */
  async processIssuedCredentialMessage(
    issueCredential: IssueCredential
  ): Promise<Credential> {
    const message = issueCredential.makeMessage()
    const credentialType = message.credentialFormat;
    const attachment = message.attachments.at(0);

    if (!attachment) {
      throw new Error("No attachment");
    }

    if (!issueCredential.thid) {
      throw new Error("No thid");
    }

    const parseOpts: CredentialIssueOptions = {
      type: credentialType,
    };


    const payload = typeof attachment.payload === 'string' ? attachment.payload : JSON.stringify(attachment.payload);
    const credData = Uint8Array.from(Buffer.from(payload));

    if (credentialType === CredentialType.AnonCreds) {
      const linkSecret = await this.pluto.getLinkSecret();

      parseOpts.linkSecret = linkSecret?.secret;

      const credentialMetadata = await this.pluto.getCredentialMetadata(
        issueCredential.thid
      );

      if (!credentialMetadata || !credentialMetadata.isType(CredentialType.AnonCreds)) {
        throw new Error("Invalid credential Metadata");
      }

      parseOpts.credentialMetadata = credentialMetadata.toJSON();
    }

    const credential: Credential = await this.pollux.parseCredential(credData, parseOpts);

    await this.pluto.storeCredential(credential);

    return credential;
  }



  /**
   * Asyncronously prepare a request credential message from a valid offerCredential for now supporting w3c verifiable credentials offers.
   *
   * @async
   * @param {OfferCredential} offer
   * @returns {Promise<RequestCredential>}
   */
  async prepareRequestCredentialWithIssuer(
    offer: OfferCredential
  ): Promise<RequestCredential> {
    const attachment = offer.attachments.at(0);
    if (!attachment) {
      throw new Error("Invalid attachment")
    }

    const credentialType = offer.makeMessage().credentialFormat;
    const payload = attachment.payload
    let credRequestBuffer: string;

    const requestCredentialBody = createRequestCredentialBody(
      [],
      offer.body.goalCode,
      offer.body.comment
    );

    const from = offer.to;
    const to = offer.from;
    if (!from) {
      throw new Error("Missing from");
    }
    if (!to) {
      throw new Error("Missing to");
    }
    const thid = offer.thid;
    const credentialFormat =
      credentialType === CredentialType.AnonCreds ? AttachmentFormats.ANONCREDS_REQUEST :
        credentialType === CredentialType.JWT ? CredentialType.JWT :
          credentialType === CredentialType.SDJWT ? CredentialType.SDJWT :
            CredentialType.Unknown;

    if (credentialType === CredentialType.AnonCreds) {
      const metaname = offer.thid;
      if (!metaname) {
        throw new Error("Missing offer.thid");
      }

      const linkSecret = await this.pluto.getLinkSecret();
      if (!linkSecret) {
        throw new Error("No linkSecret available.");
      }

      const [credentialRequest, credentialRequestMetadata] =
        await this.pollux.processCredentialOffer<CredentialType.AnonCreds>(payload, { linkSecret });

      credRequestBuffer = JSON.stringify(credentialRequest);

      const metadata = new CredentialMetadata(CredentialType.AnonCreds, metaname, credentialRequestMetadata);

      await this.pluto.storeCredentialMetadata(metadata);
    } else if (credentialType === CredentialType.JWT) {
      const getIndexTask = new PrismKeyPathIndexTask(this.pluto);
      const privateKey = await this.apollo.createPrivateKey({
        [KeyProperties.curve]: Curve.SECP256K1,
        [KeyProperties.index]: await getIndexTask.run(),
        [KeyProperties.type]: KeyTypes.EC,
        [KeyProperties.seed]: Buffer.from(this.seed.value).toString("hex"),
      });

      const did = await this.castor.createPrismDID(privateKey.publicKey());

      await this.pluto.storeDID(did, privateKey);

      credRequestBuffer = await this.pollux.processCredentialOffer<CredentialType.JWT>(payload, {
        did: did,
        keyPair: {
          curve: Curve.SECP256K1,
          privateKey: privateKey,
          publicKey: privateKey.publicKey(),
        },
      });
    } else if (credentialType === CredentialType.SDJWT) {

      const getIndexTask = new PrismKeyPathIndexTask(this.pluto);
      const masterSk = await this.apollo.createPrivateKey({
        [KeyProperties.curve]: Curve.SECP256K1,
        [KeyProperties.index]: await getIndexTask.run(),
        [KeyProperties.type]: KeyTypes.EC,
        [KeyProperties.seed]: Buffer.from(this.seed.value).toString("hex"),
      });

      const issSK = await this.apollo.createPrivateKey({
        [KeyProperties.curve]: Curve.ED25519,
        [KeyProperties.index]: await getIndexTask.run(),
        [KeyProperties.type]: KeyTypes.EC,
        [KeyProperties.seed]: Buffer.from(this.seed.value).toString("hex"),
      });

      const did = await this.castor.createPrismDID(
        masterSk.publicKey(),
        [],
        [
          issSK.publicKey()
        ]
      );

      await this.pluto.storeDID(did, [masterSk, issSK]);

      credRequestBuffer = await this.pollux.processCredentialOffer<CredentialType.SDJWT>(payload, {
        did: did,
        sdJWT: true,
        keyPair: {
          curve: Curve.SECP256K1,
          privateKey: masterSk,
          publicKey: masterSk.publicKey(),
        },
      });
    } else {
      throw new AgentError.InvalidCredentialFormats();
    }


    const attachments = [
      new AttachmentDescriptor(
        {
          base64: base64.baseEncode(Buffer.from(credRequestBuffer)),
        },
        credentialFormat,
        undefined,
        undefined,
        // TODO: confirm what is the format that backend expects us to send AnonCreds VS JWT
        credentialFormat
      ),
    ];

    const requestCredential = new RequestCredential(
      requestCredentialBody,
      attachments,
      from,
      to,
      thid
    );

    attachments.forEach((attachment) => {
      requestCredential.body.formats.push({
        attach_id: attachment.id,
        format: `${credentialFormat}`,
      });
    });

    return requestCredential;
  }

  private async getPresentationDefinitionByThid<Type extends CredentialType = CredentialType.JWT>(thid: string): Promise<PresentationDefinitionRequest<Type>> {
    const allMessages = (await this.pluto.getAllMessages());
    const message = allMessages.find((message) => {
      return message.thid === thid && message.piuri === ProtocolType.DidcommRequestPresentation;
    });
    if (message) {
      const attachment = message.attachments.at(0);
      if (!attachment) {
        throw new AgentError.UnsupportedAttachmentType("Invalid presentation message, attachment missing");
      }
      const presentationDefinitionRequest = Message.Attachment.extractJSON(attachment);
      return presentationDefinitionRequest;
    }
    throw new AgentError.UnsupportedAttachmentType("Cannot find any message with that threadID");
  }

  async handlePresentation<Type extends CredentialType = CredentialType.JWT>(presentation: Presentation): Promise<boolean> {
    const attachment = presentation.attachments.at(0);
    if (!attachment) {
      throw new AgentError.UnsupportedAttachmentType("Invalid presentation message, attachment missing");
    }
    if (!presentation.thid) {
      throw new AgentError.UnsupportedAttachmentType("Cannot find any message with that threadID");
    }
    const presentationSubmission = typeof attachment.payload === 'string' ?
      JSON.parse(attachment.payload) :
      attachment.payload;

    const presentationDefinitionRequest = await this.getPresentationDefinitionByThid<Type>(presentation.thid);
    const options = {
      presentationDefinitionRequest
    };
    const verified = await this.pollux.verifyPresentationSubmission(
      presentationSubmission,
      options
    );
    return verified;
  }

  /**
   * Asyncronously create a verifiablePresentation from a valid stored verifiableCredential
   * This is used when the verified requests a specific verifiable credential, this will create the actual
   * instance of the presentation which we can share with the verifier.
   *
   * @async
   * @param {RequestPresentation} message
   * @param {VerifiableCredential} credential
   * @returns {Promise<Presentation>}
   */
  async createPresentationForRequestProof(
    message: RequestPresentation,
    credential: Credential
  ): Promise<Presentation> {
    const attachment = message.attachments.at(0);
    if (!attachment) {
      throw new AgentError.OfferDoesntProvideEnoughInformation();
    }
    const attachmentFormat = attachment.format ?? 'unknown';
    const presentationRequest = this.parseProofRequest(attachment);
    const proof = attachmentFormat === AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS ?
      await this.handlePresentationDefinitionRequest(presentationRequest, credential) :
      await this.handlePresentationRequest(presentationRequest, credential);

    const presentationAttachment = AttachmentDescriptor.build(
      proof,
      uuid(),
      'application/json',
      undefined,
      AttachmentFormats.ANONCREDS_PROOF
    );
    const presentation = new Presentation(
      {
        comment: message.body.comment,
        goalCode: message.body.goalCode
      },
      [
        presentationAttachment,
      ],
      message.to,
      message.from,
      message.thid ?? message.id
    );
    return presentation;
  }


  /**
   * This method can be used by holders in order to disclose the value of a Credential
   * JWT are just encoded plainText
   * Anoncreds will really need to be disclosed as the fields are encoded.
   *
   * @param {Credential} credential
   * @returns {AttributeType}
   */
  async revealCredentialFields(credential: Credential, fields: string[], linkSecret: string) {
    return this.pollux.revealCredentialFields(credential, fields, linkSecret);
  }


  /**
   * match the Proof request to return relevant PresentationRequest.
   * Proof Request comes from a Message Attachment.
   * 
   * @param {AttachmentDescriptor} data - presentation proof request
   * @returns {PresentationRequest}
   * @throws
   */
  private parseProofRequest(attachment: AttachmentDescriptor) {
    const data = Message.Attachment.extractJSON(attachment);
    if (attachment.format === AttachmentFormats.ANONCREDS_PROOF_REQUEST) {
      return new PresentationRequest(AttachmentFormats.AnonCreds, data);
    }
    if (attachment.format === CredentialType.JWT) {
      return new PresentationRequest(AttachmentFormats.JWT, data);
    }
    if (attachment.format === CredentialType.SDJWT) {
      return new PresentationRequest(AttachmentFormats.SDJWT, data);
    }
    if (attachment.format === AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS) {
      return new PresentationRequest(AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS, data);
    }
    throw new Error("Unsupported Proof Request");
  }

  private async handlePresentationDefinitionRequest(
    request: PresentationRequest<any>,
    credential: Credential,
  ): Promise<string> {
    if (request.isType(AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS)) {
      if (credential instanceof JWTCredential) {
        const privateKeys = await this.pluto.getDIDPrivateKeysByDID(DID.fromString(credential.subject));
        const privateKey = privateKeys.at(0);
        if (!privateKey) {
          throw new Error("Undefined privatekey from credential subject.");
        }
        if (!request.isType(AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS)) {
          throw new Error("Undefined privatekey from credential subject.");
        }
        const presentationSubmission = await this.pollux.createPresentationSubmission(
          request.toJSON(),
          credential,
          privateKey
        );
        return JSON.stringify(presentationSubmission);
      }
    }
    if (request.isType(AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS)) {
      if (credential instanceof AnonCredsCredential) {
        const storedLinkSecret = await this.pluto.getLinkSecret();
        if (!storedLinkSecret) {
          throw new Error("Link secret not found.");
        }

        const req = request.toJSON()
        const presentationSubmission = await this.pollux.createPresentationSubmission(
          req as any,
          credential,
          storedLinkSecret
        );
        return JSON.stringify(presentationSubmission);
      }
    }

    throw new Error("Not implemented");
  }

  private async handlePresentationRequest(
    request: PresentationRequest<any>,
    credential: Credential
  ): Promise<string> {
    if (credential instanceof SDJWTCredential && request.isType(AttachmentFormats.SDJWT)) {
      if (!credential.isProvable()) {
        throw new Error("Credential is not Provable");
      }
      const subjectDID = DID.from(credential.subject);
      const prismPrivateKeys = await this.pluto.getDIDPrivateKeysByDID(subjectDID);
      const prismPrivateKey = prismPrivateKeys.find((key) => key.curve === Curve.ED25519)
      if (prismPrivateKey === undefined) {
        throw new AgentError.CannotFindDIDPrivateKey();
      }
      const signedJWT = await this.pollux.createPresentationProof(request, credential, {
        did: subjectDID,
        privateKey: prismPrivateKey
      });
      return signedJWT;
    }
    if (credential instanceof AnonCredsCredential && request.isType(AttachmentFormats.AnonCreds)) {
      const linkSecret = await this.pluto.getLinkSecret();
      if (!linkSecret) {
        throw new AgentError.CannotFindLinkSecret();
      }
      const presentation = await this.pollux.createPresentationProof(request, credential, { linkSecret });
      return presentation;
    }
    if (credential instanceof JWTCredential && request.isType(AttachmentFormats.JWT)) {
      if (!credential.isProvable()) {
        throw new Error("Credential is not Provable");
      }
      const subjectDID = DID.from(credential.subject);
      const prismPrivateKeys = await this.pluto.getDIDPrivateKeysByDID(subjectDID);
      const prismPrivateKey = prismPrivateKeys.find((key) => key.curve === Curve.SECP256K1)
      if (prismPrivateKey === undefined) {
        throw new AgentError.CannotFindDIDPrivateKey();
      }
      const signedJWT = await this.pollux.createPresentationProof(request, credential, {
        did: subjectDID,
        privateKey: prismPrivateKey
      });
      return signedJWT;
    }

    throw new AgentError.UnhandledPresentationRequest();
  }

  async isCredentialRevoked(credential: Credential): Promise<boolean> {
    return this.pollux.isCredentialRevoked(credential)
  }

}

1	import { base64 } from "multiformats/bases/base64";
2
3	import {
4	AgentError,
5	Apollo,
6	AttachmentDescriptor,
7	Castor,
8	Credential,
9	CredentialType,
10	CredentialIssueOptions,
11	Curve,
12	DID,
13	KeyProperties,
14	KeyTypes,
15	Seed,
16	Message,
17	Pluto,
18	Pollux,
19	CredentialMetadata,
20	PresentationOptions,
21	Mercury,
22	PresentationDefinitionRequest,
23	PresentationClaims,
24	AttachmentFormats,
25	PolluxError,
26	curveToAlg,
27	} from "../domain";
28
29	import { AnonCredsCredential } from "../pollux/models/AnonCredsVerifiableCredential";
30	import { JWTCredential } from "../pollux/models/JWTVerifiableCredential";
31	import { PresentationRequest } from "../pollux/models/PresentationRequest";
32
33	import { OfferCredential } from "./protocols/issueCredential/OfferCredential";
34	import { createRequestCredentialBody, RequestCredential } from "./protocols/issueCredential/RequestCredential";
35	import { IssueCredential } from "./protocols/issueCredential/IssueCredential";
36	import { Presentation } from "./protocols/proofPresentation/Presentation";
37	import { RequestPresentation } from "./protocols/proofPresentation/RequestPresentation";
38
39	import { AgentCredentials as AgentCredentialsClass, AgentDIDHigherFunctions } from "./types";
40	import { PrismKeyPathIndexTask } from "./Agent.PrismKeyPathIndexTask";
41	import { uuid } from "@stablelib/uuid";
42	import { ProtocolType } from "./protocols/ProtocolTypes";
43	import { validatePresentationClaims } from "../pollux/utils/claims";
44	import { SDJWTCredential } from "../pollux/models/SDJWTVerifiableCredential";
45
46	export class AgentCredentials implements AgentCredentialsClass {
47	/**
48	* Creates an instance of AgentCredentials.
49	*
50	* @constructor
51	* @param {Apollo} apollo
52	* @param {Castor} castor
53	* @param {Pluto} pluto
54	* @param {Pollux} pollux
55	* @param {Seed} seed
56	*/
57	constructor(
58	protected apollo: Apollo,
59	protected castor: Castor,
60	protected pluto: Pluto,
61	protected pollux: Pollux,
62	protected seed: Seed,
63	protected mercury: Mercury,
64	protected agentDIDHigherFunctions: AgentDIDHigherFunctions
65	) { }
66
67
68
69
70
71	private createPresentationDefinitionRequest<Type extends CredentialType = CredentialType.JWT>(
72	type: Type,
73	definition: PresentationDefinitionRequest<Type>,
74	from: DID,
75	to: DID
76	) {
77	const attachmentFormat = type === CredentialType.JWT ?	×
78	AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS :
79	AttachmentFormats.ANONCREDS_PROOF_REQUEST;
80
81	return new RequestPresentation(	×
82	{
83	proofTypes: [],
84	},
85	[
86	AttachmentDescriptor.build(
87	definition,
88	uuid(),
89	'application/json',
90	undefined,
91	attachmentFormat
92	)
93	],
94	from,
95	to,
96	uuid()
97	);
98	}
99
100	async initiatePresentationRequest(
101	type: CredentialType,
102	toDID: DID,
103	claims: PresentationClaims<CredentialType>
104	): Promise<RequestPresentation> {
105	const didDocument = await this.castor.resolveDID(toDID.toString());	×
106	const newPeerDID = await this.agentDIDHigherFunctions.createNewPeerDID(	×
107	didDocument.services,
108	true
109	);
110
111	if (type === CredentialType.AnonCreds) {	×
112	if (!validatePresentationClaims(claims, CredentialType.AnonCreds)) {	×
113	throw new PolluxError.InvalidPresentationDefinitionError("Anoncreds Claims are invalid");	×
114	}
115
116	const presentationDefinitionRequest = await this.pollux.createPresentationDefinitionRequest(	×
117	type,
118	claims,
119	new PresentationOptions({}, CredentialType.AnonCreds)
120	);
121
122	return this.createPresentationDefinitionRequest<CredentialType.AnonCreds>(	×
123	type,
124	presentationDefinitionRequest,
125	newPeerDID,
126	toDID
127	);
128	}
129
130	if (type === CredentialType.JWT) {	×
131	if (!validatePresentationClaims(claims, CredentialType.JWT)) {	×
132	throw new PolluxError.InvalidPresentationDefinitionError("JWT Claims are invalid");	×
133	}
134	const presentationDefinitionRequest = await this.pollux.createPresentationDefinitionRequest<CredentialType.JWT>(	×
135	type,
136	claims,
137	new PresentationOptions({
138	jwt: {
139	jwtAlg: [curveToAlg(Curve.SECP256K1)]
140	},
141	challenge: "Sign this text " + uuid(),
142	domain: 'N/A'
143	})
144	);
145	return this.createPresentationDefinitionRequest<CredentialType.JWT>(	×
146	type,
147	presentationDefinitionRequest,
148	newPeerDID,
149	toDID
150	);
151	}
152
153	throw new PolluxError.CredentialTypeNotSupported();	×
154	}
155
156	async verifiableCredentials(): Promise<Credential[]> {
157	return await this.pluto.getAllCredentials();	×
158	}
159
160	/**
161	* Extract the verifiableCredential object from the Issue credential message asyncronously
162	*
163	* @async
164	* @param {IssueCredential} message
165	* @returns {Promise<VerifiableCredential>}
166	*/
167	async processIssuedCredentialMessage(
168	issueCredential: IssueCredential
169	): Promise<Credential> {
170	const message = issueCredential.makeMessage()	14✔
171	const credentialType = message.credentialFormat;	14✔
172	const attachment = message.attachments.at(0);	13✔
173
174	if (!attachment) {	13!
175	throw new Error("No attachment");	×
176	}
177
178	if (!issueCredential.thid) {	13!
179	throw new Error("No thid");	×
180	}
181
182	const parseOpts: CredentialIssueOptions = {	13✔
183	type: credentialType,
184	};
185
186
187	const payload = typeof attachment.payload === 'string' ? attachment.payload : JSON.stringify(attachment.payload);	13✔
188	const credData = Uint8Array.from(Buffer.from(payload));	13✔
189
190	if (credentialType === CredentialType.AnonCreds) {	13✔
191	const linkSecret = await this.pluto.getLinkSecret();	6✔
192
193	parseOpts.linkSecret = linkSecret?.secret;	6✔
194
195	const credentialMetadata = await this.pluto.getCredentialMetadata(	6✔
196	issueCredential.thid
197	);
198
199	if (!credentialMetadata \|\| !credentialMetadata.isType(CredentialType.AnonCreds)) {	6✔
200	throw new Error("Invalid credential Metadata");	1✔
201	}
202
203	parseOpts.credentialMetadata = credentialMetadata.toJSON();	5✔
204	}
205
206	const credential: Credential = await this.pollux.parseCredential(credData, parseOpts);	12✔
207
208	await this.pluto.storeCredential(credential);	12✔
209
210	return credential;	12✔
211	}
212
213
214
215	/**
216	* Asyncronously prepare a request credential message from a valid offerCredential for now supporting w3c verifiable credentials offers.
217	*
218	* @async
219	* @param {OfferCredential} offer
220	* @returns {Promise<RequestCredential>}
221	*/
222	async prepareRequestCredentialWithIssuer(
223	offer: OfferCredential
224	): Promise<RequestCredential> {
225	const attachment = offer.attachments.at(0);	6✔
226	if (!attachment) {	6✔
227	throw new Error("Invalid attachment")	2✔
228	}
229
230	const credentialType = offer.makeMessage().credentialFormat;	4✔
231	const payload = attachment.payload	4✔
232	let credRequestBuffer: string;
233
234	const requestCredentialBody = createRequestCredentialBody(	4✔
235	[],
236	offer.body.goalCode,
237	offer.body.comment
238	);
239
240	const from = offer.to;	4✔
241	const to = offer.from;	4✔
242	if (!from) {	4!
243	throw new Error("Missing from");	×
244	}
245	if (!to) {	4!
246	throw new Error("Missing to");	×
247	}
248	const thid = offer.thid;	4✔
249	const credentialFormat =
250	credentialType === CredentialType.AnonCreds ? AttachmentFormats.ANONCREDS_REQUEST :	4✔
251	credentialType === CredentialType.JWT ? CredentialType.JWT :	2✔
252	credentialType === CredentialType.SDJWT ? CredentialType.SDJWT :	1!
253	CredentialType.Unknown;
254
255	if (credentialType === CredentialType.AnonCreds) {	4✔
256	const metaname = offer.thid;	2✔
257	if (!metaname) {	2!
258	throw new Error("Missing offer.thid");	×
259	}
260
261	const linkSecret = await this.pluto.getLinkSecret();	2✔
262	if (!linkSecret) {	2✔
263	throw new Error("No linkSecret available.");	1✔
264	}
265
266	const [credentialRequest, credentialRequestMetadata] =
267	await this.pollux.processCredentialOffer<CredentialType.AnonCreds>(payload, { linkSecret });	1✔
268
269	credRequestBuffer = JSON.stringify(credentialRequest);	1✔
270
271	const metadata = new CredentialMetadata(CredentialType.AnonCreds, metaname, credentialRequestMetadata);	1✔
272
273	await this.pluto.storeCredentialMetadata(metadata);	1✔
274	} else if (credentialType === CredentialType.JWT) {	2✔
275	const getIndexTask = new PrismKeyPathIndexTask(this.pluto);	1✔
276	const privateKey = await this.apollo.createPrivateKey({	1✔
277	[KeyProperties.curve]: Curve.SECP256K1,
278	[KeyProperties.index]: await getIndexTask.run(),
279	[KeyProperties.type]: KeyTypes.EC,
280	[KeyProperties.seed]: Buffer.from(this.seed.value).toString("hex"),
281	});
282
283	const did = await this.castor.createPrismDID(privateKey.publicKey());	1✔
284
285	await this.pluto.storeDID(did, privateKey);	1✔
286
287	credRequestBuffer = await this.pollux.processCredentialOffer<CredentialType.JWT>(payload, {	1✔
288	did: did,
289	keyPair: {
290	curve: Curve.SECP256K1,
291	privateKey: privateKey,
292	publicKey: privateKey.publicKey(),
293	},
294	});
295	} else if (credentialType === CredentialType.SDJWT) {	1!
296
297	const getIndexTask = new PrismKeyPathIndexTask(this.pluto);	1✔
298	const masterSk = await this.apollo.createPrivateKey({	1✔
299	[KeyProperties.curve]: Curve.SECP256K1,
300	[KeyProperties.index]: await getIndexTask.run(),
301	[KeyProperties.type]: KeyTypes.EC,
302	[KeyProperties.seed]: Buffer.from(this.seed.value).toString("hex"),
303	});
304
305	const issSK = await this.apollo.createPrivateKey({	1✔
306	[KeyProperties.curve]: Curve.ED25519,
307	[KeyProperties.index]: await getIndexTask.run(),
308	[KeyProperties.type]: KeyTypes.EC,
309	[KeyProperties.seed]: Buffer.from(this.seed.value).toString("hex"),
310	});
311
312	const did = await this.castor.createPrismDID(	1✔
313	masterSk.publicKey(),
314	[],
315	[
316	issSK.publicKey()
317	]
318	);
319
320	await this.pluto.storeDID(did, [masterSk, issSK]);	1✔
321
322	credRequestBuffer = await this.pollux.processCredentialOffer<CredentialType.SDJWT>(payload, {	1✔
323	did: did,
324	sdJWT: true,
325	keyPair: {
326	curve: Curve.SECP256K1,
327	privateKey: masterSk,
328	publicKey: masterSk.publicKey(),
329	},
330	});
331	} else {
332	throw new AgentError.InvalidCredentialFormats();	×
333	}
334
335
336	const attachments = [	3✔
337	new AttachmentDescriptor(
338	{
339	base64: base64.baseEncode(Buffer.from(credRequestBuffer)),
340	},
341	credentialFormat,
342	undefined,
343	undefined,
344	// TODO: confirm what is the format that backend expects us to send AnonCreds VS JWT
345	credentialFormat
346	),
347	];
348
349	const requestCredential = new RequestCredential(	3✔
350	requestCredentialBody,
351	attachments,
352	from,
353	to,
354	thid
355	);
356
357	attachments.forEach((attachment) => {	3✔
358	requestCredential.body.formats.push({	3✔
359	attach_id: attachment.id,
360	format: `${credentialFormat}`,
361	});
362	});
363
364	return requestCredential;	3✔
365	}
366
367	private async getPresentationDefinitionByThid<Type extends CredentialType = CredentialType.JWT>(thid: string): Promise<PresentationDefinitionRequest<Type>> {
368	const allMessages = (await this.pluto.getAllMessages());	×
369	const message = allMessages.find((message) => {	×
370	return message.thid === thid && message.piuri === ProtocolType.DidcommRequestPresentation;	×
371	});
372	if (message) {	×
373	const attachment = message.attachments.at(0);	×
374	if (!attachment) {	×
375	throw new AgentError.UnsupportedAttachmentType("Invalid presentation message, attachment missing");	×
376	}
377	const presentationDefinitionRequest = Message.Attachment.extractJSON(attachment);	×
378	return presentationDefinitionRequest;	×
379	}
380	throw new AgentError.UnsupportedAttachmentType("Cannot find any message with that threadID");	×
381	}
382
383	async handlePresentation<Type extends CredentialType = CredentialType.JWT>(presentation: Presentation): Promise<boolean> {
384	const attachment = presentation.attachments.at(0);	×
385	if (!attachment) {	×
386	throw new AgentError.UnsupportedAttachmentType("Invalid presentation message, attachment missing");	×
387	}
388	if (!presentation.thid) {	×
389	throw new AgentError.UnsupportedAttachmentType("Cannot find any message with that threadID");	×
390	}
NEW 391	const presentationSubmission = typeof attachment.payload === 'string' ?	×
392	JSON.parse(attachment.payload) :
393	attachment.payload;
394
UNCOV 395	const presentationDefinitionRequest = await this.getPresentationDefinitionByThid<Type>(presentation.thid);	×
UNCOV 396	const options = {	×
397	presentationDefinitionRequest
398	};
399	const verified = await this.pollux.verifyPresentationSubmission(	×
400	presentationSubmission,
401	options
402	);
UNCOV 403	return verified;	×
404	}
405
406	/**
407	* Asyncronously create a verifiablePresentation from a valid stored verifiableCredential
408	* This is used when the verified requests a specific verifiable credential, this will create the actual
409	* instance of the presentation which we can share with the verifier.
410	*
411	* @async
412	* @param {RequestPresentation} message
413	* @param {VerifiableCredential} credential
414	* @returns {Promise<Presentation>}
415	*/
416	async createPresentationForRequestProof(
417	message: RequestPresentation,
418	credential: Credential
419	): Promise<Presentation> {
420	const attachment = message.attachments.at(0);	7✔
421	if (!attachment) {	7✔
422	throw new AgentError.OfferDoesntProvideEnoughInformation();	1✔
423	}
424	const attachmentFormat = attachment.format ?? 'unknown';	6!
425	const presentationRequest = this.parseProofRequest(attachment);	6✔
426	const proof = attachmentFormat === AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS ?	5!
427	await this.handlePresentationDefinitionRequest(presentationRequest, credential) :
428	await this.handlePresentationRequest(presentationRequest, credential);
429
430	const presentationAttachment = AttachmentDescriptor.build(	2✔
431	proof,
432	uuid(),
433	'application/json',
434	undefined,
435	AttachmentFormats.ANONCREDS_PROOF
436	);
437	const presentation = new Presentation(	2✔
438	{
439	comment: message.body.comment,
440	goalCode: message.body.goalCode
441	},
442	[
443	presentationAttachment,
444	],
445	message.to,
446	message.from,
447	message.thid ?? message.id	4✔
448	);
449	return presentation;	2✔
450	}
451
452
453	/**
454	* This method can be used by holders in order to disclose the value of a Credential
455	* JWT are just encoded plainText
456	* Anoncreds will really need to be disclosed as the fields are encoded.
457	*
458	* @param {Credential} credential
459	* @returns {AttributeType}
460	*/
461	async revealCredentialFields(credential: Credential, fields: string[], linkSecret: string) {
UNCOV 462	return this.pollux.revealCredentialFields(credential, fields, linkSecret);	×
463	}
464
465
466	/**
467	* match the Proof request to return relevant PresentationRequest.
468	* Proof Request comes from a Message Attachment.
469	*
470	* @param {AttachmentDescriptor} data - presentation proof request
471	* @returns {PresentationRequest}
472	* @throws
473	*/
474	private parseProofRequest(attachment: AttachmentDescriptor) {
475	const data = Message.Attachment.extractJSON(attachment);	6✔
476	if (attachment.format === AttachmentFormats.ANONCREDS_PROOF_REQUEST) {	6✔
477	return new PresentationRequest(AttachmentFormats.AnonCreds, data);	1✔
478	}
479	if (attachment.format === CredentialType.JWT) {	5✔
480	return new PresentationRequest(AttachmentFormats.JWT, data);	4✔
481	}
482	if (attachment.format === CredentialType.SDJWT) {	1!
UNCOV 483	return new PresentationRequest(AttachmentFormats.SDJWT, data);	×
484	}
485	if (attachment.format === AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS) {	1!
486	return new PresentationRequest(AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS, data);	×
487	}
488	throw new Error("Unsupported Proof Request");	1✔
489	}
490
491	private async handlePresentationDefinitionRequest(
492	request: PresentationRequest<any>,
493	credential: Credential,
494	): Promise<string> {
UNCOV 495	if (request.isType(AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS)) {	×
UNCOV 496	if (credential instanceof JWTCredential) {	×
UNCOV 497	const privateKeys = await this.pluto.getDIDPrivateKeysByDID(DID.fromString(credential.subject));	×
498	const privateKey = privateKeys.at(0);	×
499	if (!privateKey) {	×
500	throw new Error("Undefined privatekey from credential subject.");	×
501	}
502	if (!request.isType(AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS)) {	×
503	throw new Error("Undefined privatekey from credential subject.");	×
504	}
505	const presentationSubmission = await this.pollux.createPresentationSubmission(	×
506	request.toJSON(),
507	credential,
508	privateKey
509	);
UNCOV 510	return JSON.stringify(presentationSubmission);	×
511	}
512	}
513	if (request.isType(AttachmentFormats.PRESENTATION_EXCHANGE_DEFINITIONS)) {	×
UNCOV 514	if (credential instanceof AnonCredsCredential) {	×
UNCOV 515	const storedLinkSecret = await this.pluto.getLinkSecret();	×
516	if (!storedLinkSecret) {	×
517	throw new Error("Link secret not found.");	×
518	}
519
520	const req = request.toJSON()	×
UNCOV 521	const presentationSubmission = await this.pollux.createPresentationSubmission(	×
522	req as any,
523	credential,
524	storedLinkSecret
525	);
UNCOV 526	return JSON.stringify(presentationSubmission);	×
527	}
528	}
529
UNCOV 530	throw new Error("Not implemented");	×
531	}
532
533	private async handlePresentationRequest(
534	request: PresentationRequest<any>,
535	credential: Credential
536	): Promise<string> {
537	if (credential instanceof SDJWTCredential && request.isType(AttachmentFormats.SDJWT)) {	5!
UNCOV 538	if (!credential.isProvable()) {	×
UNCOV 539	throw new Error("Credential is not Provable");	×
540	}
541	const subjectDID = DID.from(credential.subject);	×
542	const prismPrivateKeys = await this.pluto.getDIDPrivateKeysByDID(subjectDID);	×
UNCOV 543	const prismPrivateKey = prismPrivateKeys.find((key) => key.curve === Curve.ED25519)	×
544	if (prismPrivateKey === undefined) {	×
545	throw new AgentError.CannotFindDIDPrivateKey();	×
546	}
547	const signedJWT = await this.pollux.createPresentationProof(request, credential, {	×
548	did: subjectDID,
549	privateKey: prismPrivateKey
550	});
UNCOV 551	return signedJWT;	×
552	}
553	if (credential instanceof AnonCredsCredential && request.isType(AttachmentFormats.AnonCreds)) {	5✔
554	const linkSecret = await this.pluto.getLinkSecret();	1✔
555	if (!linkSecret) {	1!
UNCOV 556	throw new AgentError.CannotFindLinkSecret();	×
557	}
558	const presentation = await this.pollux.createPresentationProof(request, credential, { linkSecret });	1✔
559	return presentation;	1✔
560	}
561	if (credential instanceof JWTCredential && request.isType(AttachmentFormats.JWT)) {	4!
562	if (!credential.isProvable()) {	4!
UNCOV 563	throw new Error("Credential is not Provable");	×
564	}
565	const subjectDID = DID.from(credential.subject);	4✔
566	const prismPrivateKeys = await this.pluto.getDIDPrivateKeysByDID(subjectDID);	3✔
567	const prismPrivateKey = prismPrivateKeys.find((key) => key.curve === Curve.SECP256K1)	3✔
568	if (prismPrivateKey === undefined) {	3✔
569	throw new AgentError.CannotFindDIDPrivateKey();	2✔
570	}
571	const signedJWT = await this.pollux.createPresentationProof(request, credential, {	1✔
572	did: subjectDID,
573	privateKey: prismPrivateKey
574	});
575	return signedJWT;	1✔
576	}
577
UNCOV 578	throw new AgentError.UnhandledPresentationRequest();	×
579	}
580
581	async isCredentialRevoked(credential: Credential): Promise<boolean> {
UNCOV 582	return this.pollux.isCredentialRevoked(credential)	×
583	}
584
585	}

hyperledger / identus-edge-agent-sdk-ts / 9846405965

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous