Verify presentation tokens

.ci/runChecks.sh

@@ -6,4 +6,4 @@ npm run lint:eslint
 npm run lint:prettier
 npm run --workspaces cdep
 npx --workspaces license-check
-npx better-npm-audit audit --exclude 1112030
+npx better-npm-audit audit --exclude 1112030,1115432

.dev/compose.openid4vc.yml

@@ -60,7 +60,7 @@ services:
     ports:
       - "3000:3000"
     volumes:
-      - ./eudiplo-assets:/app/assets/config
+      - ./eudiplo/config:/app/assets/config
 
 networks:
   default:

.dev/eudiplo-assets/test/info.json → .dev/eudiplo/config/test-tenant/info.json

@@ -1,4 +1,4 @@
 {
-    "name": "test",
+    "name": "test-tenant",
     "description": "test tenant"
 }

.dev/eudiplo/startEudiplo.ts

@@ -0,0 +1,25 @@
+import path from "path";
+import { GenericContainer, StartedTestContainer, Wait } from "testcontainers";
+
+export async function startEudiplo(): Promise<StartedTestContainer> {
+    return await new GenericContainer("ghcr.io/openwallet-foundation-labs/eudiplo:3.1.2@sha256:0ea3a73d42a1eb10a6edc45e3289478b08b09064bd75563c503ed12be2ed2dc6")
+        .withEnvironment({
+            PUBLIC_URL: "http://localhost:3000", // eslint-disable-line @typescript-eslint/naming-convention
+            MASTER_SECRET: "OgwrDcgVQQ2yZwcFt7kPxQm3nUF+X3etF6MdLTstZAY=", // eslint-disable-line @typescript-eslint/naming-convention
+            AUTH_CLIENT_ID: "root", // eslint-disable-line @typescript-eslint/naming-convention
+            AUTH_CLIENT_SECRET: "test", // eslint-disable-line @typescript-eslint/naming-convention
+            CONFIG_IMPORT: "true", // eslint-disable-line @typescript-eslint/naming-convention
+            CONFIG_FOLDER: "/app/assets/config", // eslint-disable-line @typescript-eslint/naming-convention
+            PORT: "3000" // eslint-disable-line @typescript-eslint/naming-convention
+        } as Record<string, string>)
+        .withExposedPorts({ container: 3000, host: 3000 })
+        .withCopyDirectoriesToContainer([
+            {
+                source: path.resolve(path.join(__dirname, "config")),
+                target: "/app/assets/config"
+            }
+        ])
+        .withStartupTimeout(60000)
+        .withWaitStrategy(Wait.forHealthCheck())
+        .start();
+}

packages/app-runtime/src/AppStringProcessor.ts

@@ -290,11 +290,12 @@ export class AppStringProcessor {
                 // RelationshipTemplates are processed by the RequestModule
                 break;
             case "Token":
-                const tokenContent = this.parseTokenContent(result.value.value.content);
+                const token = result.value.value;
+                const tokenContent = this.parseTokenContent(token.content);
 
                 if (tokenContent instanceof TokenContentVerifiablePresentation) {
-                    // TODO: add technical validation
-                    await uiBridge.showVerifiablePresentation(account, result.value.value, true);
+                    const verificationResult = await services.consumptionServices.openId4Vc.verifyPresentationToken({ token });
+                    await uiBridge.showVerifiablePresentation(account, result.value.value, verificationResult.value.isValid);
                     break;
                 }
                 return Result.fail(AppRuntimeErrors.appStringProcessor.notSupportedTokenContent());

packages/app-runtime/test/runtime/AppStringProcessor.test.ts

@@ -1,7 +1,9 @@
-import { ArbitraryRelationshipTemplateContentJSON, AuthenticationRequestItem, RelationshipTemplateContent, TokenContentVerifiablePresentation } from "@nmshd/content";
+import { EudiploClient } from "@eudiplo/sdk-core";
+import { ArbitraryRelationshipTemplateContentJSON, AuthenticationRequestItem, RelationshipTemplateContent } from "@nmshd/content";
 import { CoreDate, PasswordLocationIndicatorOptions } from "@nmshd/core-types";
 import { DeviceOnboardingInfoDTO, PeerRelationshipTemplateLoadedEvent } from "@nmshd/runtime";
 import assert from "assert";
+import { startEudiplo } from "../../../../.dev/eudiplo/startEudiplo";
 import { AppRuntime, LocalAccountSession } from "../../src";
 import { MockEventBus, MockUIBridge, TestUtil } from "../lib";
 
@@ -378,21 +380,52 @@ describe("AppStringProcessor", function () {
         });
 
         test("get a token with verifiable presentation content using a url", async function () {
-            const tokenResult = await runtime1Session.transportServices.tokens.createOwnToken({
-                content: TokenContentVerifiablePresentation.from({
-                    value: { claim: "test" },
-                    type: "dc+sd-jwt"
-                }).toJSON(),
+            const eudiploClientId = "test-admin";
+            const eudiploClientSecret = "57c9cd444bf402b2cc1f5a0d2dafd3955bd9042c0372db17a4ede2d5fbda88e5";
+            const eudiploCredentialConfigurationId = "test";
+            const eudiploBaseUrl = "http://localhost:3000";
+
+            const eudiploContainer = await startEudiplo();
+
+            const eudiploClient = new EudiploClient({
+                baseUrl: eudiploBaseUrl,
+                clientId: eudiploClientId,
+                clientSecret: eudiploClientSecret
+            });
+
+            const credentialOfferUrl = (
+                await eudiploClient.createIssuanceOffer({
+                    responseType: "uri",
+                    credentialConfigurationIds: [eudiploCredentialConfigurationId],
+                    flow: "pre_authorized_code"
+                })
+            ).uri;
+
+            const resolveCredentialOfferResult = await runtime1Session.consumptionServices.openId4Vc.resolveCredentialOffer({ credentialOfferUrl });
+            const requestCredentialsResult = await runtime1Session.consumptionServices.openId4Vc.requestCredentials({
+                credentialOffer: resolveCredentialOfferResult.value.credentialOffer,
+                credentialConfigurationIds: [eudiploCredentialConfigurationId]
+            });
+            const storedCredential = (
+                await runtime1Session.consumptionServices.openId4Vc.storeCredentials({
+                    credentialResponses: requestCredentialsResult.value.credentialResponses
+                })
+            ).value;
+
+            const createPresentationTokenResult = await runtime1Session.consumptionServices.openId4Vc.createPresentationToken({
+                attributeId: storedCredential.id,
                 expiresAt: CoreDate.utc().add({ days: 1 }).toISOString(),
                 ephemeral: true
             });
-            const token = tokenResult.value;
+            const token = createPresentationTokenResult.value;
 
             const result = await runtime4.stringProcessor.processURL(token.reference.url, runtime4Session.account);
             expect(result).toBeSuccessful();
             expect(result.value).toBeUndefined();
 
             expect(runtime4MockUiBridge).showVerifiablePresentationCalled(token.id, true);
+
+            await eudiploContainer.stop();
         });
 
         test("get a template using a url", async function () {

packages/consumption/src/modules/openid4vc/OpenId4VcController.ts

@@ -133,4 +133,8 @@ export class OpenId4VcController extends ConsumptionBaseController {
     public async createPresentationTokenContent(credential: VerifiableCredential, nonce: string): Promise<TokenContentVerifiablePresentation> {
         return await this.holder.createPresentationTokenContent(credential, nonce);
     }
+
+    public async verifyPresentationTokenContent(tokenContent: TokenContentVerifiablePresentation, expectedNonce: string): Promise<{ isValid: boolean; error?: Error }> {
+        return await this.holder.verifyPresentationTokenContent(tokenContent, expectedNonce);
+    }
 }

packages/consumption/src/modules/openid4vc/local/Holder.ts

@@ -205,7 +205,7 @@ export class Holder extends BaseAgent<ReturnType<typeof getOpenIdHolderModules>>
     // hacky solution because credo doesn't support credentials without key binding
     // TODO: use credentials without key binding once supported
     public async createPresentationTokenContent(credential: VerifiableCredential, nonce: string): Promise<TokenContentVerifiablePresentation> {
-        if (credential.type !== ClaimFormat.SdJwtDc) throw new Error("Only SD-JWT credentials have been tested so far with token presentation");
+        if (credential.type !== ClaimFormat.SdJwtDc) throw new Error("Only SD-JWT credentials are supported for token presentation");
 
         const sdJwtVcApi = this.agent.dependencyManager.resolve(SdJwtVcApi);
         const presentation = await sdJwtVcApi.present({
@@ -224,6 +224,21 @@ export class Holder extends BaseAgent<ReturnType<typeof getOpenIdHolderModules>>
         });
     }
 
+    public async verifyPresentationTokenContent(tokenContent: TokenContentVerifiablePresentation, expectedNonce: string): Promise<{ isValid: boolean; error?: Error }> {
+        if (tokenContent.type !== ClaimFormat.SdJwtDc) throw new Error("Only SD-JWT credentials are supported for token presentation");
+
+        const sdJwtVcApi = this.agent.dependencyManager.resolve(SdJwtVcApi);
+        const verificationResult = await sdJwtVcApi.verify({
+            compactSdJwtVc: tokenContent.value as string,
+            keyBinding: {
+                audience: "defaultPresentationAudience",
+                nonce: expectedNonce
+            }
+        });
+
+        return { isValid: verificationResult.isValid, error: "error" in verificationResult ? verificationResult.error : undefined };
+    }
+
     public async exit(): Promise<void> {
         await this.shutdown();
     }

packages/runtime/src/extensibility/facades/consumption/OpenId4VcFacade.ts

@@ -17,7 +17,10 @@ import {
     ResolveCredentialOfferResponse,
     ResolveCredentialOfferUseCase,
     StoreCredentialsRequest,
-    StoreCredentialsUseCase
+    StoreCredentialsUseCase,
+    VerifyPresentationTokenRequest,
+    VerifyPresentationTokenResponse,
+    VerifyPresentationTokenUseCase
 } from "../../../useCases";
 
 export class OpenId4VcFacade {
@@ -27,7 +30,8 @@ export class OpenId4VcFacade {
         @Inject private readonly storeCredentialsUseCase: StoreCredentialsUseCase,
         @Inject private readonly resolveAuthorizationRequestUseCase: ResolveAuthorizationRequestUseCase,
         @Inject private readonly acceptAuthorizationRequestUseCase: AcceptAuthorizationRequestUseCase,
-        @Inject private readonly createPresentationTokenUseCase: CreatePresentationTokenUseCase
+        @Inject private readonly createPresentationTokenUseCase: CreatePresentationTokenUseCase,
+        @Inject private readonly verifyPresentationTokenUseCase: VerifyPresentationTokenUseCase
     ) {}
 
     public async resolveCredentialOffer(request: ResolveCredentialOfferRequest): Promise<Result<ResolveCredentialOfferResponse>> {
@@ -53,4 +57,8 @@ export class OpenId4VcFacade {
     public async createPresentationToken(request: CreatePresentationTokenRequest): Promise<Result<TokenDTO>> {
         return await this.createPresentationTokenUseCase.execute(request);
     }
+
+    public async verifyPresentationToken(request: VerifyPresentationTokenRequest): Promise<Result<VerifyPresentationTokenResponse>> {
+        return await this.verifyPresentationTokenUseCase.execute(request);
+    }
 }

packages/runtime/src/useCases/common/Schemas.ts

@@ -17507,6 +17507,176 @@ export const StoreCredentialsRequest: any = {
     }
 }
 
+export const VerifyPresentationTokenRequest: any = {
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "$ref": "#/definitions/VerifyPresentationTokenRequest",
+    "definitions": {
+        "VerifyPresentationTokenRequest": {
+            "type": "object",
+            "properties": {
+                "token": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "properties": {
+                        "content": {
+                            "$ref": "#/definitions/TokenContentVerifiablePresentationJSON"
+                        },
+                        "id": {
+                            "type": "string"
+                        },
+                        "isOwn": {
+                            "type": "boolean"
+                        },
+                        "createdBy": {
+                            "type": "string"
+                        },
+                        "createdByDevice": {
+                            "type": "string"
+                        },
+                        "createdAt": {
+                            "type": "string"
+                        },
+                        "expiresAt": {
+                            "type": "string"
+                        },
+                        "forIdentity": {
+                            "type": "string"
+                        },
+                        "passwordProtection": {
+                            "$ref": "#/definitions/PasswordProtectionDTO"
+                        },
+                        "reference": {
+                            "type": "object",
+                            "properties": {
+                                "truncated": {
+                                    "type": "string"
+                                },
+                                "url": {
+                                    "type": "string"
+                                }
+                            },
+                            "required": [
+                                "truncated",
+                                "url"
+                            ],
+                            "additionalProperties": false
+                        },
+                        "isEphemeral": {
+                            "type": "boolean"
+                        }
+                    },
+                    "required": [
+                        "content",
+                        "createdAt",
+                        "createdBy",
+                        "createdByDevice",
+                        "expiresAt",
+                        "id",
+                        "isEphemeral",
+                        "isOwn",
+                        "reference"
+                    ]
+                }
+            },
+            "required": [
+                "token"
+            ],
+            "additionalProperties": false
+        },
+        "TokenContentVerifiablePresentationJSON": {
+            "type": "object",
+            "properties": {
+                "@type": {
+                    "type": "string",
+                    "const": "TokenContentVerifiablePresentation"
+                },
+                "@context": {
+                    "type": "string"
+                },
+                "@version": {
+                    "type": "string"
+                },
+                "value": {
+                    "anyOf": [
+                        {
+                            "type": "string"
+                        },
+                        {
+                            "type": "object"
+                        }
+                    ]
+                },
+                "type": {
+                    "type": "string"
+                },
+                "displayInformation": {
+                    "type": "array",
+                    "items": {
+                        "type": "object"
+                    }
+                }
+            },
+            "required": [
+                "@type",
+                "type",
+                "value"
+            ],
+            "additionalProperties": false
+        },
+        "PasswordProtectionDTO": {
+            "type": "object",
+            "properties": {
+                "password": {
+                    "type": "string"
+                },
+                "passwordIsPin": {
+                    "type": "boolean",
+                    "const": true
+                },
+                "passwordLocationIndicator": {
+                    "anyOf": [
+                        {
+                            "type": "string",
+                            "const": "RecoveryKit"
+                        },
+                        {
+                            "type": "string",
+                            "const": "Self"
+                        },
+                        {
+                            "type": "string",
+                            "const": "Letter"
+                        },
+                        {
+                            "type": "string",
+                            "const": "RegistrationLetter"
+                        },
+                        {
+                            "type": "string",
+                            "const": "Email"
+                        },
+                        {
+                            "type": "string",
+                            "const": "SMS"
+                        },
+                        {
+                            "type": "string",
+                            "const": "Website"
+                        },
+                        {
+                            "type": "number"
+                        }
+                    ]
+                }
+            },
+            "required": [
+                "password"
+            ],
+            "additionalProperties": false
+        }
+    }
+}
+
 export const CreateSettingRequest: any = {
     "$schema": "http://json-schema.org/draft-07/schema#",
     "$ref": "#/definitions/CreateSettingRequest",