integrating support for SD-JWT into an RP setup

packages/ebsi-support/src/agent/EbsiSupport.ts

@@ -201,13 +201,13 @@ export class EbsiSupport implements IAgentPlugin {
       op: { checkLinkedDomains: CheckLinkedDomain.NEVER },
       providedPresentationDefinitions: [definition],
     })
-    const oid4vp = await opSession.getOID4VP({ allDIDs: [identifier.did] })
+    const oid4vp = await opSession.getOID4VP({ allIdentifiers: [identifier.did] })
     const vp = await oid4vp.createVerifiablePresentation(
       args.credentialRole,
       { definition, credentials: pexResult.filteredCredentials },
       {
         proofOpts: { domain: openIDMetadata.issuer, nonce: v4(), created: new Date(Date.now() - 120_000).toString() },
-        holderDID: identifier.did,
+        holder: identifier.did,
         idOpts: idOpts,
         skipDidResolution,
         forceNoCredentialsInVP: !hasInputDescriptors,

packages/presentation-exchange/package.json

@@ -16,8 +16,8 @@
   "dependencies": {
     "@sphereon/pex": "^4.0.1",
     "@sphereon/pex-models": "^2.2.4",
-    "@sphereon/ssi-sdk-ext.did-utils": "0.24.1-unstable.82",
-    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.24.1-unstable.82",
+    "@sphereon/ssi-sdk-ext.did-utils": "0.24.1-next.93",
+    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.24.1-next.93",
     "@sphereon/ssi-sdk.credential-store": "workspace:*",
     "@sphereon/ssi-sdk.data-store": "workspace:*",
     "@sphereon/ssi-sdk.sd-jwt": "workspace:*",

packages/sd-jwt/src/__tests__/sd-jwt.test.ts

@@ -279,7 +279,7 @@ describe('Agent plugin', () => {
       kb: true,
     })
     expect(result).toBeDefined()
-    expect((result.verifiedPayloads.payload as typeof claims).given_name).toBe('John')
+    expect((result.payload as typeof claims).given_name).toBe('John')
   })
 
   it('verify a presentation with sub set', async () => {
@@ -316,6 +316,6 @@ describe('Agent plugin', () => {
       kb: true,
     })
     expect(result).toBeDefined()
-    expect((result.verifiedPayloads.payload as typeof claims).given_name).toBe('John')
+    expect((result.payload as typeof claims).given_name).toBe('John')
   })
 })

packages/sd-jwt/src/action-handler.ts

@@ -227,7 +227,6 @@ export class SDJwtPlugin implements IAgentPlugin {
    * @returns
    */
   async verifySdJwtPresentation(args: IVerifySdJwtPresentationArgs, context: IRequiredContext): Promise<IVerifySdJwtPresentationResult> {
-    // biome-ignore lint/style/useConst: <explanation>
     let sdjwt: SDJwtVcInstance
     const verifier: Verifier = async (data: string, signature: string) => this.verify(sdjwt, context, data, signature)
     const verifierKb: KbVerifier = async (data: string, signature: string, payload: JwtPayload) =>
@@ -239,7 +238,7 @@ export class SDJwtPlugin implements IAgentPlugin {
     })
     const verifiedPayloads = await sdjwt.verify(args.presentation, args.requiredClaimKeys, args.kb)
 
-    return { verifiedPayloads }
+    return verifiedPayloads
   }
 
   private getKeyTypeAlgorithm(keyType: string) {

packages/sd-jwt/src/types.ts

@@ -1,4 +1,4 @@
-import { Hasher, KBOptions, SaltGenerator } from '@sd-jwt/types'
+import { Hasher, kbHeader, KBOptions, kbPayload, SaltGenerator } from '@sd-jwt/types'
 import { SdJwtVcPayload as SdJwtPayload } from '@sd-jwt/sd-jwt-vc'
 import { DIDDocumentSection, IAgentContext, IDIDManager, IKeyManager, IPluginMethodMap, IResolver } from '@veramo/core'
 import { ImDLMdoc } from '@sphereon/ssi-sdk.mdl-mdoc'
@@ -175,7 +175,9 @@ export interface IVerifySdJwtPresentationArgs {
  * @beta
  */
 export type IVerifySdJwtPresentationResult = {
-  verifiedPayloads: Record<string, unknown>
+  payload: unknown //fixme: maybe this can be `SdJwtPayload`
+  header: Record<string, unknown> | undefined
+  kb?: { header: kbHeader; payload: kbPayload }
 }
 
 export type SignKeyArgs = {

packages/siopv2-oid4vp-common/package.json

@@ -12,7 +12,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@sphereon/did-auth-siop": "0.6.4",
+    "@sphereon/did-auth-siop": "0.16.1-next.8",
+    "@sphereon/did-auth-siop-adapter": "0.16.1-next.8",
+    "@sphereon/oid4vc-common": "0.16.1-next.8",
     "@sphereon/ssi-sdk.core": "workspace:*",
     "@sphereon/ssi-types": "workspace:*",
     "uint8arrays": "3.1.1"

packages/siopv2-oid4vp-common/src/index.ts

@@ -10,7 +10,6 @@ export {
   encodeJsonAsURI,
   AuthorizationResponsePayload,
   AuthorizationRequestPayload,
-  CheckLinkedDomain,
   URI,
   AuthorizationRequestState,
   RequestObjectPayload,
@@ -20,9 +19,10 @@ export {
   OP,
   OPBuilder,
   SupportedVersion,
-  SigningAlgo,
   PresentationDefinitionWithLocation,
   PresentationVerificationResult,
   PresentationVerificationCallback,
   VPTokenLocation,
 } from '@sphereon/did-auth-siop'
+export { SigningAlgo } from '@sphereon/oid4vc-common'
+export { CheckLinkedDomain } from '@sphereon/did-auth-siop-adapter'

packages/siopv2-oid4vp-op-auth/__tests__/shared/didAuthSiopOpAuthenticatorAgentLogic.ts

@@ -11,7 +11,6 @@ import {
   ResponseType,
   SubjectIdentifierType,
   UrlEncodingFormat,
-  VerificationMode,
   VerifiedAuthorizationRequest,
 } from '@sphereon/did-auth-siop'
 import { mapIdentifierKeysToDoc } from '@veramo/utils'
@@ -156,7 +155,7 @@ const createAuthorizationResponseMockedResult = {
   },
   verifyOpts: {
     verification: {
-      mode: VerificationMode.INTERNAL,
+      // mode: VerificationMode.INTERNAL,
       resolveOpts: {},
     },
   },

packages/siopv2-oid4vp-op-auth/package.json

@@ -14,11 +14,14 @@
     "build:clean": "tsc --build --clean && tsc --build"
   },
   "dependencies": {
-    "@sphereon/did-auth-siop": "0.6.4",
+    "@sphereon/did-auth-siop": "0.16.1-next.8",
+    "@sphereon/did-auth-siop-adapter": "0.16.1-next.8",
+    "@sphereon/oid4vc-common": "0.16.1-next.8",
     "@sphereon/pex": "^4.0.1",
     "@sphereon/pex-models": "2.2.4",
-    "@sphereon/ssi-sdk-ext.did-utils": "0.24.1-unstable.82",
-    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.24.1-unstable.82",
+    "@sphereon/ssi-sdk-ext.did-utils": "0.24.1-next.96",
+    "@sphereon/ssi-sdk-ext.identifier-resolution": "0.24.1-next.96",
+    "@sphereon/ssi-sdk-ext.jwt-service": "0.24.1-next.96",
     "@sphereon/ssi-sdk.contact-manager": "workspace:*",
     "@sphereon/ssi-sdk.core": "workspace:*",
     "@sphereon/ssi-sdk.credential-store": "workspace:*",
@@ -27,6 +30,7 @@
     "@sphereon/ssi-sdk.pd-manager": "workspace:*",
     "@sphereon/ssi-sdk.presentation-exchange": "workspace:*",
     "@sphereon/ssi-sdk.sd-jwt": "workspace:*",
+    "@sphereon/ssi-sdk.siopv2-oid4vp-common": "workspace:*",
     "@sphereon/ssi-sdk.xstate-machine-persistence": "workspace:*",
     "@sphereon/ssi-types": "workspace:*",
     "@sphereon/wellknown-dids-client": "^0.1.3",
@@ -41,7 +45,7 @@
   },
   "devDependencies": {
     "@sphereon/did-uni-client": "^0.6.3",
-    "@sphereon/ssi-sdk-ext.did-resolver-jwk": "0.24.1-unstable.82",
+    "@sphereon/ssi-sdk-ext.did-resolver-jwk": "0.24.1-next.84",
     "@sphereon/ssi-sdk.agent-config": "workspace:*",
     "@types/i18n-js": "^3.8.9",
     "@types/lodash.memoize": "^4.1.9",

packages/siopv2-oid4vp-op-auth/src/agent/DidAuthSiopOpAuthenticator.ts

@@ -314,7 +314,7 @@ export class DidAuthSiopOpAuthenticator implements IAgentPlugin {
         origin: IdentityOrigin.EXTERNAL,
         roles: [CredentialRole.ISSUER],
         identifier: {
-          type: CorrelationIdentifierType.DID,
+          type: correlationId.startsWith('did:') ? CorrelationIdentifierType.DID : CorrelationIdentifierType.URL,
           correlationId,
         },
       }

packages/siopv2-oid4vp-op-auth/src/link-handler/index.ts

@@ -4,6 +4,7 @@ import { IMachineStatePersistence, interpreterStartOrResume, SerializableState }
 import { IAgentContext } from '@veramo/core'
 import { Loggers } from '@sphereon/ssi-types'
 import { GetMachineArgs, IDidAuthSiopOpAuthenticator, LOGGER_NAMESPACE, Siopv2MachineInterpreter, Siopv2MachineState } from '../types'
+import { contextHasPlugin } from '@sphereon/ssi-sdk.agent-config'
 
 const logger = Loggers.DEFAULT.options(LOGGER_NAMESPACE, {}).get(LOGGER_NAMESPACE)
 
@@ -46,8 +47,7 @@ export class Siopv2OID4VPLinkHandler extends LinkHandlerAdapter {
     })
 
     const interpreter = siopv2Machine.interpreter
-    //FIXME we need a better way to check if the state persistence plugin is available in the agent
-    if (!this.noStateMachinePersistence && !opts?.machineState && this.context.agent.availableMethods().includes('machineStatesFindActive')) {
+    if (!this.noStateMachinePersistence && !opts?.machineState && contextHasPlugin(this.context, 'machineStatesFindActive')) {
       const init = await interpreterStartOrResume({
         interpreter,
         context: this.context,

packages/siopv2-oid4vp-op-auth/src/session/OID4VP.ts

@@ -1,7 +1,7 @@
 import { PresentationDefinitionWithLocation, PresentationExchange } from '@sphereon/did-auth-siop'
 import { SelectResults, Status, SubmissionRequirementMatch } from '@sphereon/pex'
 import { Format } from '@sphereon/pex-models'
-import { isManagedIdentifierDidOpts, ManagedIdentifierOpts } from '@sphereon/ssi-sdk-ext.identifier-resolution'
+import { ManagedIdentifierOpts, ManagedIdentifierResult } from '@sphereon/ssi-sdk-ext.identifier-resolution'
 import { ProofOptions } from '@sphereon/ssi-sdk.core'
 import { UniqueDigitalCredential, verifiableCredentialForRoleFilter } from '@sphereon/ssi-sdk.credential-store'
 import { CredentialRole, FindDigitalCredentialArgs } from '@sphereon/ssi-sdk.data-store'
@@ -19,19 +19,19 @@ import { OpSession } from './OpSession'
 
 export class OID4VP {
   private readonly session: OpSession
-  private readonly allDIDs: string[]
+  private readonly allIdentifiers: string[]
   private readonly hasher?: Hasher
 
   private constructor(args: IOID4VPArgs) {
-    const { session, allDIDs, hasher } = args
+    const { session, allIdentifiers, hasher } = args
 
     this.session = session
-    this.allDIDs = allDIDs ?? []
+    this.allIdentifiers = allIdentifiers ?? []
     this.hasher = hasher
   }
 
-  public static async init(session: OpSession, allDIDs: string[], hasher?: Hasher): Promise<OID4VP> {
-    return new OID4VP({ session, allDIDs: allDIDs ?? (await session.getSupportedDIDs()), hasher })
+  public static async init(session: OpSession, allIdentifiers: string[], hasher?: Hasher): Promise<OID4VP> {
+    return new OID4VP({ session, allIdentifiers: allIdentifiers ?? (await session.getSupportedDIDs()), hasher })
   }
 
   public async getPresentationDefinitions(): Promise<PresentationDefinitionWithLocation[] | undefined> {
@@ -43,10 +43,10 @@ export class OID4VP {
   }
 
   private getPresentationExchange(args: IGetPresentationExchangeArgs): PresentationExchange {
-    const { verifiableCredentials, allDIDs, hasher } = args
+    const { verifiableCredentials, allIdentifiers, hasher } = args
 
     return new PresentationExchange({
-      allDIDs: allDIDs ?? this.allDIDs,
+      allDIDs: allIdentifiers ?? this.allIdentifiers,
       allVerifiableCredentials: verifiableCredentials,
       hasher: hasher ?? this.hasher,
     })
@@ -81,14 +81,14 @@ export class OID4VP {
       proofOpts?: ProofOptions
       idOpts?: ManagedIdentifierOpts
       skipDidResolution?: boolean
-      holderDID?: string
+      holder?: string
       subjectIsHolder?: boolean
       applyFilter?: boolean
       hasher?: Hasher
     },
   ): Promise<VerifiablePresentationWithDefinition> {
-    const { subjectIsHolder, holderDID, forceNoCredentialsInVP = false } = { ...opts }
-    if (subjectIsHolder && holderDID) {
+    const { subjectIsHolder, holder, forceNoCredentialsInVP = false } = { ...opts }
+    if (subjectIsHolder && holder) {
       throw Error('Cannot both have subject is holder and a holderDID value at the same time (programming error)')
     }
     if (forceNoCredentialsInVP) {
@@ -126,8 +126,8 @@ export class OID4VP {
         if (holder) {
           idOpts = { identifier: holder }
         }
-      } else if (opts?.holderDID) {
-        idOpts = { identifier: opts.holderDID }
+      } else if (opts?.holder) {
+        idOpts = { identifier: opts.holder }
       }
     }
 
@@ -159,16 +159,15 @@ export class OID4VP {
       format: opts?.restrictToFormats ?? selectedVerifiableCredentials.definition.definition.format,
       skipDidResolution: opts?.skipDidResolution ?? false,
     })
-
+    const identifier: ManagedIdentifierResult = await this.session.context.agent.identifierManagedGet(idOpts)
     const presentationResult = await this.getPresentationExchange({
       verifiableCredentials: vcs.credentials,
-      allDIDs: this.allDIDs,
+      allIdentifiers: this.allIdentifiers,
       hasher: opts?.hasher,
     }).createVerifiablePresentation(vcs.definition.definition, vcs.credentials, signCallback, {
       proofOptions,
       // fixme: Update to newer siop-vp to not require dids here.
-
-      holderDID: isManagedIdentifierDidOpts(idOpts) ? (await this.session.context.agent.identifierManagedGetByDid(idOpts)).did : undefined,
+      holderDID: identifier.kid,
     })
 
     const verifiablePresentation =

packages/siopv2-oid4vp-op-auth/src/session/OpSession.ts

@@ -1,11 +1,9 @@
 import {
-  CheckLinkedDomain,
   PresentationDefinitionWithLocation,
   PresentationExchangeResponseOpts,
-  ResolveOpts,
   URI,
   Verification,
-  VerificationMode,
+  // VerificationMode,
   VerifiedAuthorizationRequest,
 } from '@sphereon/did-auth-siop'
 import { getAgentDIDMethods, getAgentResolver } from '@sphereon/ssi-sdk-ext.did-utils'
@@ -15,6 +13,7 @@ import Debug from 'debug'
 import { IOPOptions, IOpSessionArgs, IOpSessionGetOID4VPArgs, IOpsSendSiopAuthorizationResponseArgs, IRequiredContext } from '../types'
 import { createOP } from './functions'
 import { OID4VP } from './OID4VP'
+import { ResolveOpts } from '@sphereon/did-auth-siop-adapter'
 
 const debug = Debug(`sphereon:sdk:siop:op-session`)
 
@@ -204,7 +203,7 @@ export class OpSession {
   }
 
   public async getOID4VP(args: IOpSessionGetOID4VPArgs): Promise<OID4VP> {
-    return await OID4VP.init(this, args.allDIDs ?? [], args.hasher)
+    return await OID4VP.init(this, args.allIdentifiers ?? [], args.hasher)
   }
 
   /*private async getMergedRequestPayload(): Promise<RequestObjectPayload> {
@@ -221,12 +220,13 @@ export class OpSession {
     if (!resolveOpts.subjectSyntaxTypesSupported || resolveOpts.subjectSyntaxTypesSupported.length === 0) {
       resolveOpts.subjectSyntaxTypesSupported = await this.getSupportedDIDMethods(true)
     }
+    //todo: populate with the right verification params. In did-auth-siop we don't have any test that actually passes this parameter
+    // and furthermore, it receives a couple of parameters that don't make that much sense for OP. like presentationVerificationCallback and revocationOpts
     const verification: Verification = {
-      mode: VerificationMode.INTERNAL,
-      checkLinkedDomain: CheckLinkedDomain.IF_PRESENT,
-      resolveOpts,
+      // mode: VerificationMode.INTERNAL,
+      // checkLinkedDomain: CheckLinkedDomain.IF_PRESENT,
+      // resolveOpts,
     }
-
     const request = await this.getAuthorizationRequest()
     const hasDefinitions = await this.hasPresentationDefinitions()
     if (hasDefinitions) {
@@ -259,6 +259,7 @@ export class OpSession {
       context: this.context,
     })
 
+    //TODO change this to use the new functionalities by identifier-resolver and get the jwkIssuer for the responseOpts
     let issuer = args.responseSignerOpts.issuer
     const responseOpts = {
       verification,