feat: [SIW-2087] Update PID data model to 0.9.1

src/credential/issuance/06-obtain-credential.ts

@@ -8,6 +8,7 @@ import type { EvaluateIssuerTrust } from "./02-evaluate-issuer-trust";
 import { hasStatusOrThrow, type Out } from "../../utils/misc";
 import type { StartUserAuthorization } from "./03-start-user-authorization";
 import {
+  IoWalletError,
   IssuerResponseError,
   IssuerResponseErrorCodes,
   ResponseErrorBuilder,
@@ -16,6 +17,7 @@ import {
 } from "../../utils/errors";
 import { CredentialResponse } from "./types";
 import { createDPopToken } from "../../utils/dpop";
+import { TypeMetadata } from "../../sd-jwt/types";
 import { v4 as uuidv4 } from "uuid";
 import { LogLevel, Logger } from "../../utils/logging";
 
@@ -213,3 +215,47 @@ const handleObtainCredentialError = (e: unknown) => {
     })
     .buildFrom(e);
 };
+
+/**
+ * Retrieve the Type Metadata for a credential and verify its integrity.
+ * @param vct The VCT as a valid HTTPS url
+ * @param vctIntegrity The integrity hash
+ * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
+ * @returns The credential metadata {@link TypeMetadata}
+ */
+export const fetchTypeMetadata = async (
+  vct: string,
+  vctIntegrity: string,
+  context: {
+    appFetch?: GlobalFetch["fetch"];
+  } = {}
+): Promise<TypeMetadata> => {
+  const { appFetch = fetch } = context;
+  const { origin, pathname } = new URL(vct);
+
+  const metadata = await appFetch(`${origin}/.well-known/vct${pathname}`, {
+    headers: {
+      "Content-Type": "application/json",
+    },
+  })
+    .then(hasStatusOrThrow(200, IssuerResponseError))
+    .then((res) => TypeMetadata.parse(res.json()));
+
+  const [alg, hash] = vctIntegrity.split(/-(.*)/s);
+
+  if (alg !== "sha256") {
+    throw new IoWalletError(`${alg} algorithm is not supported`);
+  }
+
+  // TODO: check if the hash is correctly calculated
+  const metadataHash = await sha256ToBase64(JSON.stringify(metadata));
+
+  if (metadataHash !== hash) {
+    throw new ValidationFailed({
+      message: "Unable to verify VCT integrity",
+      reason: "vct#integrity does not match the metadata hash",
+    });
+  }
+
+  return metadata;
+};

src/credential/issuance/07-verify-and-parse-credential.ts

@@ -85,14 +85,14 @@ const parseCredentialSdJwt = (
     Logger.log(LogLevel.ERROR, "Missing claims in the credential subject");
     throw new IoWalletError("Missing claims in the credential subject"); // TODO [SIW-1268]: should not be optional
   }
-  const attrDefinitions = Object.entries(credentialSubject.claims);
+  const attrDefinitions = credentialSubject.claims;
 
   // the key of the attribute defintion must match the disclosure's name
   const attrsNotInDisclosures = attrDefinitions.filter(
-    ([attrKey]) => !disclosures.some(([, name]) => name === attrKey)
+    (definition) => !disclosures.some(([, name]) => name === definition.path[0]) // Ignore nested paths for now, see https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-15.html#name-claims-path-pointer
   );
   if (attrsNotInDisclosures.length > 0) {
-    const missing = attrsNotInDisclosures.map((_) => _[0 /* key */]).join(", ");
+    const missing = attrsNotInDisclosures.map((_) => _.path[0]).join(", ");
     const received = disclosures.map((_) => _[1 /* name */]).join(", ");
     if (!ignoreMissingAttributes) {
       Logger.log(
@@ -111,13 +111,13 @@ const parseCredentialSdJwt = (
     attrDefinitions
       // retrieve the value from the disclosure set
       .map(
-        ([attrKey, definition]) =>
+        ({ path, ...definition }) =>
           [
-            attrKey,
+            path[0],
             {
               ...definition,
               value: disclosures.find(
-                (_) => _[1 /* name */] === attrKey
+                (_) => _[1 /* name */] === path[0]
               )?.[2 /* value */],
             },
           ] as const
@@ -206,7 +206,7 @@ type WithFormat<Format extends Parameters<VerifyAndParseCredential>[2]> = (
   _3: Parameters<VerifyAndParseCredential>[3]
 ) => ReturnType<VerifyAndParseCredential>;
 
-const verifyAndParseCredentialSdJwt: WithFormat<"vc+sd-jwt"> = async (
+const verifyAndParseCredentialSdJwt: WithFormat<"dc+sd-jwt"> = async (
   issuerConf,
   credential,
   _,
@@ -264,7 +264,7 @@ export const verifyAndParseCredential: VerifyAndParseCredential = async (
   format,
   context
 ) => {
-  if (format === "vc+sd-jwt") {
+  if (format === "dc+sd-jwt") {
     Logger.log(LogLevel.DEBUG, "Parsing credential in vc+sd-jwt format");
     return verifyAndParseCredentialSdJwt(
       issuerConf,

src/credential/issuance/const.ts

@@ -6,6 +6,6 @@ export type SupportedCredentialFormat = z.infer<
   typeof SupportedCredentialFormat
 >;
 export const SupportedCredentialFormat = z.union([
-  z.literal("vc+sd-jwt"),
+  z.literal("dc+sd-jwt"),
   z.literal("vc+mdoc-cbor"),
 ]);

src/credential/issuance/index.ts

@@ -21,6 +21,7 @@ import {
 import { authorizeAccess, type AuthorizeAccess } from "./05-authorize-access";
 import {
   obtainCredential,
+  fetchTypeMetadata,
   type ObtainCredential,
 } from "./06-obtain-credential";
 import {
@@ -38,6 +39,7 @@ export {
   completeUserAuthorizationWithFormPostJwtMode,
   authorizeAccess,
   obtainCredential,
+  fetchTypeMetadata,
   verifyAndParseCredential,
   parseAuthorizationResponse,
   Errors,

src/credential/presentation/07-evaluate-dcql-query.ts

@@ -56,7 +56,7 @@ const mapCredentialToObject = (jwt: string) => {
   const credentialFormat = sdJwt.header.typ;
 
   // TODO [SIW-2082]: support MDOC credentials
-  if (credentialFormat !== "vc+sd-jwt") {
+  if (credentialFormat !== "dc+sd-jwt") {
     throw new Error(`Unsupported credential format: ${credentialFormat}`);
   }
 
@@ -106,7 +106,7 @@ export const evaluateDcqlQuery: EvaluateDcqlQuery = (
     );
 
     return getDcqlQueryMatches(queryResult).map(([id, match]) => {
-      if (match.output.credential_format !== "vc+sd-jwt") {
+      if (match.output.credential_format !== "dc+sd-jwt") {
         throw new Error("Unsupported format"); // TODO [SIW-2082]: support MDOC credentials
       }
       const { vct, claims } = match.output;
@@ -167,7 +167,7 @@ export const prepareRemotePresentations: PrepareRemotePresentations = async (
         credentialId: item.id,
         requestedClaims: item.requestedClaims,
         vpToken: vp_token,
-        format: "vc+sd-jwt",
+        format: "dc+sd-jwt",
       };
     })
   );

src/credential/presentation/07-evaluate-input-descriptor.ts

@@ -292,7 +292,7 @@ export const findCredentialSdJwt = (
   }
 
   throw new CredentialNotFoundError(
-    "None of the vc+sd-jwt credentials satisfy the requirements."
+    "None of the dc+sd-jwt credentials satisfy the requirements."
   );
 };
 
@@ -323,10 +323,10 @@ export const evaluateInputDescriptors: EvaluateInputDescriptors = async (
 
   return Promise.all(
     inputDescriptors.map(async (descriptor) => {
-      if (descriptor.format?.["vc+sd-jwt"]) {
+      if (descriptor.format?.["dc+sd-jwt"]) {
         if (!decodedSdJwtCredentials.length) {
           throw new CredentialNotFoundError(
-            "vc+sd-jwt credential is not supported."
+            "dc+sd-jwt credential is not supported."
           );
         }
 
@@ -370,7 +370,7 @@ export const prepareLegacyRemotePresentations: PrepareLegacyRemotePresentations
       credentialAndDescriptors.map(async (item) => {
         const descriptor = item.inputDescriptor;
 
-        if (descriptor.format?.["vc+sd-jwt"]) {
+        if (descriptor.format?.["dc+sd-jwt"]) {
           const { vp_token } = await prepareVpToken(nonce, client_id, [
             item.credential,
             item.requestedClaims,
@@ -381,7 +381,7 @@ export const prepareLegacyRemotePresentations: PrepareLegacyRemotePresentations
             requestedClaims: item.requestedClaims,
             inputDescriptor: descriptor,
             vpToken: vp_token,
-            format: "vc+sd-jwt",
+            format: "dc+sd-jwt",
           };
         }
 

src/credential/presentation/__tests__/07-evaluate-dcql-query.test.ts

@@ -19,7 +19,7 @@ describe("evaluateDcqlQuery", () => {
       credentials: [
         {
           id: "PersonIdentificationData",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           // @ts-expect-error invalid query on purpose
           claims: [{ id: "tax_id_code", path: "tax_id_code" }],
         },
@@ -34,7 +34,7 @@ describe("evaluateDcqlQuery", () => {
       credentials: [
         {
           id: "PersonIdentificationData",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           claims: [{ id: "tax_id_code", path: ["tax_id_code"] }],
           claim_sets: [["missing_claim", "tax_id_code"]],
         },
@@ -49,7 +49,7 @@ describe("evaluateDcqlQuery", () => {
       credentials: [
         {
           id: "PersonIdentificationData",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["MissingPID"],
           },
@@ -61,7 +61,7 @@ describe("evaluateDcqlQuery", () => {
       credentials: [
         {
           id: "PersonIdentificationData",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["MissingPID"],
           },
@@ -85,7 +85,7 @@ describe("evaluateDcqlQuery", () => {
       credentials: [
         {
           id: "PID",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["PersonIdentificationData"],
           },
@@ -122,7 +122,7 @@ describe("evaluateDcqlQuery", () => {
       credentials: [
         {
           id: "PID",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["PersonIdentificationData"],
           },
@@ -134,7 +134,7 @@ describe("evaluateDcqlQuery", () => {
         },
         {
           id: "DrivingLicense",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["MDL"],
           },
@@ -177,15 +177,15 @@ describe("evaluateDcqlQuery", () => {
       credentials: [
         {
           id: "PID",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["PersonIdentificationData"],
           },
           claims: [{ path: ["given_name"] }, { path: ["family_name"] }],
         },
         {
           id: "optional",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["other_credential"],
           },
@@ -221,15 +221,15 @@ describe("evaluateDcqlQuery", () => {
       credentials: [
         {
           id: "PID",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["PersonIdentificationData"],
           },
           claims: [{ path: ["given_name"] }, { path: ["family_name"] }],
         },
         {
           id: "MDL",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["MDL"],
           },
@@ -275,7 +275,7 @@ describe("evaluateDcqlQuery", () => {
       credentials: [
         {
           id: "PID",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["PersonIdentificationData"],
           },
@@ -287,7 +287,7 @@ describe("evaluateDcqlQuery", () => {
         },
         {
           id: "MDL",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["MDL"],
           },
@@ -307,7 +307,7 @@ describe("evaluateDcqlQuery", () => {
         },
         {
           id: "optional",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["other_credential"],
           },
@@ -359,7 +359,7 @@ describe("evaluateDcqlQuery", () => {
       credentials: [
         {
           id: "PID",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["PersonIdentificationData"],
           },
@@ -371,7 +371,7 @@ describe("evaluateDcqlQuery", () => {
         },
         {
           id: "MDL",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["MDL"],
           },
@@ -383,7 +383,7 @@ describe("evaluateDcqlQuery", () => {
         },
         {
           id: "optional",
-          format: "vc+sd-jwt",
+          format: "dc+sd-jwt",
           meta: {
             vct_values: ["other_credential"],
           },