Added v2 version of W3C Verifiable Credential
This commit is contained in:
Xavi Aracil
parent
4b9b1d4147
commit
50b29ee167
@ -8,6 +8,8 @@ import static org.oneedtech.inspect.vc.VerifiableCredential.Type.VerifiablePrese
|
||||
import com.fasterxml.jackson.databind.JsonNode;
|
||||
import com.google.common.base.MoreObjects;
|
||||
import com.google.common.collect.ImmutableMap;
|
||||
|
||||
import java.net.URI;
|
||||
import java.util.Collections;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
@ -26,18 +28,19 @@ import org.oneedtech.inspect.vc.util.JsonNodeUtil;
|
||||
*/
|
||||
public class VerifiableCredential extends Credential {
|
||||
final VerifiableCredential.Type credentialType;
|
||||
final VCVersion version;
|
||||
|
||||
protected VerifiableCredential(
|
||||
Resource resource,
|
||||
JsonNode data,
|
||||
String jwt,
|
||||
Map<CredentialEnum, SchemaKey> schemas,
|
||||
String issuedOnPropertyName,
|
||||
String expiresAtPropertyName) {
|
||||
super(ID, resource, data, jwt, schemas, issuedOnPropertyName, expiresAtPropertyName);
|
||||
VCVersion version) {
|
||||
super(ID, resource, data, jwt, schemas, version.issuanceDateField, version.expirationDateField);
|
||||
|
||||
JsonNode typeNode = jsonData.get("type");
|
||||
this.credentialType = VerifiableCredential.Type.valueOf(typeNode);
|
||||
this.version = version;
|
||||
}
|
||||
|
||||
public CredentialEnum getCredentialType() {
|
||||
@ -48,6 +51,10 @@ public class VerifiableCredential extends Credential {
|
||||
return jwt == null ? ProofType.EMBEDDED : ProofType.EXTERNAL;
|
||||
}
|
||||
|
||||
public VCVersion getVersion() {
|
||||
return version;
|
||||
}
|
||||
|
||||
private static final Map<CredentialEnum, SchemaKey> schemas =
|
||||
new ImmutableMap.Builder<CredentialEnum, SchemaKey>()
|
||||
.put(AchievementCredential, Catalog.OB_30_ANY_ACHIEVEMENTCREDENTIAL_JSON)
|
||||
@ -56,17 +63,19 @@ public class VerifiableCredential extends Credential {
|
||||
.put(EndorsementCredential, Catalog.OB_30_ANY_ENDORSEMENTCREDENTIAL_JSON)
|
||||
.build();
|
||||
|
||||
public static final String JSONLD_CONTEXT_W3C_CREDENTIALS_V2 = "https://www.w3.org/ns/credentials/v2";
|
||||
|
||||
private static final Map<Set<VerifiableCredential.Type>, List<String>> contextMap =
|
||||
new ImmutableMap.Builder<Set<VerifiableCredential.Type>, List<String>>()
|
||||
.put(
|
||||
Set.of(Type.OpenBadgeCredential, AchievementCredential, EndorsementCredential),
|
||||
List.of(
|
||||
"https://www.w3.org/ns/credentials/v2",
|
||||
JSONLD_CONTEXT_W3C_CREDENTIALS_V2,
|
||||
"https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json"))
|
||||
.put(
|
||||
Set.of(ClrCredential),
|
||||
List.of(
|
||||
"https://www.w3.org/ns/credentials/v2",
|
||||
JSONLD_CONTEXT_W3C_CREDENTIALS_V2,
|
||||
"https://purl.imsglobal.org/spec/clr/v2p0/context-2.0.1.json",
|
||||
"https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json"))
|
||||
.build();
|
||||
@ -82,7 +91,7 @@ public class VerifiableCredential extends Credential {
|
||||
"https://purl.imsglobal.org/spec/clr/v2p0/context-2.0.1.json",
|
||||
List.of("https://purl.imsglobal.org/spec/clr/v2p0/context.json"))
|
||||
.put(
|
||||
"https://www.w3.org/ns/credentials/v2",
|
||||
JSONLD_CONTEXT_W3C_CREDENTIALS_V2,
|
||||
List.of("https://www.w3.org/2018/credentials/v1"))
|
||||
.build();
|
||||
|
||||
@ -183,20 +192,39 @@ public class VerifiableCredential extends Credential {
|
||||
.toString();
|
||||
}
|
||||
|
||||
public static enum VCVersion {
|
||||
VCDMv2p0(ISSUED_ON_PROPERTY_NAME_V20, EXPIRES_AT_PROPERTY_NAME_V20),
|
||||
VCDMv1p1(ISSUED_ON_PROPERTY_NAME_V11, EXPIRES_AT_PROPERTY_NAME_V11);
|
||||
|
||||
final String issuanceDateField;
|
||||
final String expirationDateField;
|
||||
|
||||
VCVersion(String issuanceDateField, String expirationDateField) {
|
||||
this.issuanceDateField = issuanceDateField;
|
||||
this.expirationDateField = expirationDateField;
|
||||
}
|
||||
|
||||
static VCVersion of(JsonNode context) {
|
||||
if (JsonNodeUtil.asNodeList(context)
|
||||
.stream()
|
||||
.anyMatch(node -> node.isTextual() && node.asText().equals(JSONLD_CONTEXT_W3C_CREDENTIALS_V2)) )
|
||||
return VCDMv2p0;
|
||||
|
||||
return VCDMv1p1;
|
||||
}
|
||||
}
|
||||
|
||||
public static class Builder extends Credential.Builder<VerifiableCredential> {
|
||||
@Override
|
||||
public VerifiableCredential build() {
|
||||
boolean is2p0VC = JsonNodeUtil.asNodeList(getJsonData().get("@context"))
|
||||
.stream()
|
||||
.anyMatch(node -> node.isTextual() && node.asText().equals("https://www.w3.org/ns/credentials/v2"));
|
||||
VCVersion version = VCVersion.of(getJsonData().get("@context"));
|
||||
|
||||
return new VerifiableCredential(
|
||||
getResource(),
|
||||
getJsonData(),
|
||||
getJwt(),
|
||||
schemas,
|
||||
is2p0VC ? ISSUED_ON_PROPERTY_NAME_V20 : ISSUED_ON_PROPERTY_NAME_V11,
|
||||
is2p0VC ? EXPIRES_AT_PROPERTY_NAME_V20 : EXPIRES_AT_PROPERTY_NAME_V11);
|
||||
version);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@ -1,23 +1,33 @@
|
||||
package org.oneedtech.inspect.vc;
|
||||
|
||||
import java.io.StringReader;
|
||||
import java.util.List;
|
||||
|
||||
import org.oneedtech.inspect.vc.jsonld.JsonLDObjectUtils;
|
||||
import org.oneedtech.inspect.vc.util.CachingDocumentLoader;
|
||||
|
||||
import com.danubetech.verifiablecredentials.VerifiableCredential;
|
||||
|
||||
import info.weboftrust.ldsignatures.LdProof;
|
||||
|
||||
/**
|
||||
* Holder for W3C's Verifiable Credential
|
||||
*/
|
||||
public class W3CVCHolder {
|
||||
private VerifiableCredential credential;
|
||||
private com.danubetech.verifiablecredentials.VerifiableCredential credential;
|
||||
|
||||
public W3CVCHolder(VerifiableCredential credential) {
|
||||
this.credential = credential;
|
||||
credential.setDocumentLoader(new CachingDocumentLoader());
|
||||
switch (credential.version) {
|
||||
case VCDMv1p1:
|
||||
this.credential = com.danubetech.verifiablecredentials.VerifiableCredential
|
||||
.fromJson(new StringReader(credential.getJson().toString()));
|
||||
break;
|
||||
case VCDMv2p0:
|
||||
this.credential = W3CVerifiableCredentialDM2
|
||||
.fromJson(new StringReader(credential.getJson().toString()));
|
||||
break;
|
||||
default:
|
||||
throw new IllegalArgumentException("Unsupported version: " + credential.version);
|
||||
}
|
||||
this.credential.setDocumentLoader(new CachingDocumentLoader());
|
||||
}
|
||||
|
||||
/**
|
||||
@ -30,7 +40,7 @@ public class W3CVCHolder {
|
||||
return JsonLDObjectUtils.getListFromJsonLDObject(LdProof.class, credential);
|
||||
}
|
||||
|
||||
public VerifiableCredential getCredential() {
|
||||
public com.danubetech.verifiablecredentials.VerifiableCredential getCredential() {
|
||||
return credential;
|
||||
}
|
||||
}
|
||||
|
||||
@ -0,0 +1,22 @@
|
||||
package org.oneedtech.inspect.vc;
|
||||
|
||||
import java.net.URI;
|
||||
import java.util.Date;
|
||||
|
||||
import foundation.identity.jsonld.JsonLDUtils;
|
||||
|
||||
public class W3CVerifiableCredentialDM2 extends com.danubetech.verifiablecredentials.VerifiableCredential {
|
||||
public static final URI[] DEFAULT_JSONLD_CONTEXTS = { URI.create(VerifiableCredential.JSONLD_CONTEXT_W3C_CREDENTIALS_V2) };
|
||||
|
||||
public Date getValidFrom() {
|
||||
return JsonLDUtils.stringToDate(JsonLDUtils.jsonLdGetString(this.getJsonObject(), JSONLD_TERM_VALIDFROM));
|
||||
}
|
||||
|
||||
public Date getValidUntil() {
|
||||
return JsonLDUtils.stringToDate(JsonLDUtils.jsonLdGetString(this.getJsonObject(), JSONLD_TERM_VALIDUNTIL));
|
||||
}
|
||||
|
||||
private static final String JSONLD_TERM_VALIDFROM = "validFrom";
|
||||
private static final String JSONLD_TERM_VALIDUNTIL = "validUntil";
|
||||
|
||||
}
|
||||
@ -1,34 +1,30 @@
|
||||
package org.oneedtech.inspect.vc.probe;
|
||||
|
||||
import java.io.StringReader;
|
||||
import java.net.URI;
|
||||
import java.net.URLEncoder;
|
||||
import java.nio.charset.Charset;
|
||||
import java.util.List;
|
||||
import java.util.Optional;
|
||||
|
||||
import org.oneedtech.inspect.core.probe.Probe;
|
||||
import org.oneedtech.inspect.core.probe.RunContext;
|
||||
import org.oneedtech.inspect.core.report.ReportItems;
|
||||
import org.oneedtech.inspect.vc.VerifiableCredential;
|
||||
import org.oneedtech.inspect.vc.W3CVCHolder;
|
||||
import org.oneedtech.inspect.vc.verification.Ed25519Signature2022LdVerifier;
|
||||
|
||||
import com.apicatalog.jsonld.StringUtils;
|
||||
import com.apicatalog.jsonld.document.Document;
|
||||
import com.apicatalog.jsonld.loader.DocumentLoaderOptions;
|
||||
import com.apicatalog.multibase.Multibase;
|
||||
import com.apicatalog.multicodec.Multicodec;
|
||||
import com.apicatalog.multicodec.Multicodec.Codec;
|
||||
|
||||
import info.weboftrust.ldsignatures.LdProof;
|
||||
import info.weboftrust.ldsignatures.verifier.Ed25519Signature2020LdVerifier;
|
||||
import info.weboftrust.ldsignatures.verifier.LdVerifier;
|
||||
import jakarta.json.JsonArray;
|
||||
import jakarta.json.JsonObject;
|
||||
import jakarta.json.JsonString;
|
||||
import jakarta.json.JsonStructure;
|
||||
import jakarta.json.JsonValue;
|
||||
import java.net.URI;
|
||||
import java.net.URLEncoder;
|
||||
import java.nio.charset.Charset;
|
||||
import java.util.List;
|
||||
import java.util.Optional;
|
||||
import org.oneedtech.inspect.core.probe.Probe;
|
||||
import org.oneedtech.inspect.core.probe.RunContext;
|
||||
import org.oneedtech.inspect.core.report.ReportItems;
|
||||
import org.oneedtech.inspect.vc.VerifiableCredential;
|
||||
import org.oneedtech.inspect.vc.W3CVCHolder;
|
||||
import org.oneedtech.inspect.vc.verification.Ed25519Signature2022LdVerifier;
|
||||
import org.oneedtech.inspect.vc.verification.Ed25519Signature2022VCDM20LdVerifier;
|
||||
|
||||
/**
|
||||
* A Probe that verifies a credential's embedded proof.
|
||||
@ -37,7 +33,7 @@ import jakarta.json.JsonValue;
|
||||
*/
|
||||
public class EmbeddedProofProbe extends Probe<VerifiableCredential> {
|
||||
|
||||
private final static List<String> ALLOWED_CRYPTOSUITES = List.of("eddsa-2022", "eddsa-rdfc-2022");
|
||||
private static final List<String> ALLOWED_CRYPTOSUITES = List.of("eddsa-2022", "eddsa-rdfc-2022");
|
||||
|
||||
public EmbeddedProofProbe() {
|
||||
super(ID);
|
||||
@ -50,8 +46,7 @@ public class EmbeddedProofProbe extends Probe<VerifiableCredential> {
|
||||
@Override
|
||||
public ReportItems run(VerifiableCredential crd, RunContext ctx) throws Exception {
|
||||
|
||||
W3CVCHolder credentialHolder = new W3CVCHolder(com.danubetech.verifiablecredentials.VerifiableCredential
|
||||
.fromJson(new StringReader(crd.getJson().toString())));
|
||||
W3CVCHolder credentialHolder = new W3CVCHolder(crd);
|
||||
|
||||
List<LdProof> proofs = credentialHolder.getProofs();
|
||||
if (proofs == null || proofs.size() == 0) {
|
||||
@ -59,14 +54,24 @@ public class EmbeddedProofProbe extends Probe<VerifiableCredential> {
|
||||
}
|
||||
|
||||
// get proof of standard type and purpose
|
||||
Optional<LdProof> selectedProof = proofs.stream()
|
||||
Optional<LdProof> selectedProof =
|
||||
proofs.stream()
|
||||
.filter(proof -> proof.getProofPurpose().equals("assertionMethod"))
|
||||
.filter(proof -> proof.isType("Ed25519Signature2020") ||
|
||||
(proof.isType("DataIntegrityProof") && proof.getJsonObject().containsKey("cryptosuite") && ALLOWED_CRYPTOSUITES.contains(proof.getJsonObject().get("cryptosuite"))))
|
||||
.filter(
|
||||
proof ->
|
||||
proof.isType("Ed25519Signature2020")
|
||||
|| (proof.isType("DataIntegrityProof")
|
||||
&& proof.getJsonObject().containsKey("cryptosuite")
|
||||
&& ALLOWED_CRYPTOSUITES.contains(
|
||||
proof.getJsonObject().get("cryptosuite"))))
|
||||
.findFirst();
|
||||
|
||||
if (!selectedProof.isPresent()) {
|
||||
return error("No proof with type any of (\"Ed25519Signature2020\", \"DataIntegrityProof\" with cryptosuite attr of \"eddsa-rdfc-2022\" or \"eddsa-2022\") or proof purpose \"assertionMethod\" found", ctx);
|
||||
return error(
|
||||
"No proof with type any of (\"Ed25519Signature2020\", \"DataIntegrityProof\" with"
|
||||
+ " cryptosuite attr of \"eddsa-rdfc-2022\" or \"eddsa-2022\") or proof purpose"
|
||||
+ " \"assertionMethod\" found",
|
||||
ctx);
|
||||
}
|
||||
|
||||
LdProof proof = selectedProof.get();
|
||||
@ -137,21 +142,36 @@ public class EmbeddedProofProbe extends Probe<VerifiableCredential> {
|
||||
// resolved.
|
||||
Optional<JsonStructure> keyStructure;
|
||||
try {
|
||||
Document keyDocument = credentialHolder.getCredential().getDocumentLoader().loadDocument(uri,
|
||||
new DocumentLoaderOptions());
|
||||
Document keyDocument =
|
||||
credentialHolder
|
||||
.getCredential()
|
||||
.getDocumentLoader()
|
||||
.loadDocument(uri, new DocumentLoaderOptions());
|
||||
keyStructure = keyDocument.getJsonContent();
|
||||
} catch (Exception e) {
|
||||
return error("Key document not found at " + method + ". URI: " + uri
|
||||
+ " doesn't return a valid document. Reason: " + e.getMessage() + " ", ctx);
|
||||
return error(
|
||||
"Key document not found at "
|
||||
+ method
|
||||
+ ". URI: "
|
||||
+ uri
|
||||
+ " doesn't return a valid document. Reason: "
|
||||
+ e.getMessage()
|
||||
+ " ",
|
||||
ctx);
|
||||
}
|
||||
if (keyStructure.isEmpty()) {
|
||||
return error("Key document not found at " + method + ". URI: " + uri
|
||||
+ " doesn't return a valid document. Reason: The document is empty.", ctx);
|
||||
return error(
|
||||
"Key document not found at "
|
||||
+ method
|
||||
+ ". URI: "
|
||||
+ uri
|
||||
+ " doesn't return a valid document. Reason: The document is empty.",
|
||||
ctx);
|
||||
}
|
||||
|
||||
// check did in "assertionMethod"
|
||||
JsonArray assertionMethod = keyStructure.get().asJsonObject()
|
||||
.getJsonArray("assertionMethod");
|
||||
JsonArray assertionMethod =
|
||||
keyStructure.get().asJsonObject().getJsonArray("assertionMethod");
|
||||
if (assertionMethod == null) {
|
||||
return error("Document doesn't have a list of assertion methods at URI: " + uri, ctx);
|
||||
} else {
|
||||
@ -169,12 +189,14 @@ public class EmbeddedProofProbe extends Probe<VerifiableCredential> {
|
||||
}
|
||||
|
||||
// get keys from "verificationMethod"
|
||||
JsonArray keyVerificationMethod = keyStructure.get().asJsonObject()
|
||||
.getJsonArray("verificationMethod");
|
||||
JsonArray keyVerificationMethod =
|
||||
keyStructure.get().asJsonObject().getJsonArray("verificationMethod");
|
||||
if (keyVerificationMethod == null) {
|
||||
return error("Document doesn't have a list of verification methods at URI: " + uri, ctx);
|
||||
return error(
|
||||
"Document doesn't have a list of verification methods at URI: " + uri, ctx);
|
||||
}
|
||||
Optional<JsonValue> verificationMethodMaybe = keyVerificationMethod.stream()
|
||||
Optional<JsonValue> verificationMethodMaybe =
|
||||
keyVerificationMethod.stream()
|
||||
.filter(n -> n.asJsonObject().getString("id").equals(method.toString()))
|
||||
.findFirst();
|
||||
if (verificationMethodMaybe.isEmpty()) {
|
||||
@ -190,8 +212,11 @@ public class EmbeddedProofProbe extends Probe<VerifiableCredential> {
|
||||
}
|
||||
} else if (method.getScheme().equals("http") || method.getScheme().equals("https")) {
|
||||
try {
|
||||
Document keyDocument = credentialHolder.getCredential().getDocumentLoader().loadDocument(method,
|
||||
new DocumentLoaderOptions());
|
||||
Document keyDocument =
|
||||
credentialHolder
|
||||
.getCredential()
|
||||
.getDocumentLoader()
|
||||
.loadDocument(method, new DocumentLoaderOptions());
|
||||
Optional<JsonStructure> keyStructure = keyDocument.getJsonContent();
|
||||
if (keyStructure.isEmpty()) {
|
||||
return error("Key document not found at " + method, ctx);
|
||||
@ -203,8 +228,8 @@ public class EmbeddedProofProbe extends Probe<VerifiableCredential> {
|
||||
// Then look for a controller document (e.g. DID Document) with a
|
||||
// 'verificationMethod'
|
||||
// that is a Ed25519VerificationKey2020 document
|
||||
JsonObject keyVerificationMethod = keyStructure.get().asJsonObject()
|
||||
.getJsonObject("verificationMethod");
|
||||
JsonObject keyVerificationMethod =
|
||||
keyStructure.get().asJsonObject().getJsonObject("verificationMethod");
|
||||
if (keyVerificationMethod.isEmpty()) {
|
||||
return error("Cannot parse key document from " + method, ctx);
|
||||
}
|
||||
@ -236,7 +261,8 @@ public class EmbeddedProofProbe extends Probe<VerifiableCredential> {
|
||||
|
||||
if (controller != null) {
|
||||
if (!controller.equals(credentialHolder.getCredential().getIssuer().toString())) {
|
||||
return error("Key controller does not match issuer: " + credentialHolder.getCredential().getIssuer(),
|
||||
return error(
|
||||
"Key controller does not match issuer: " + credentialHolder.getCredential().getIssuer(),
|
||||
ctx);
|
||||
}
|
||||
}
|
||||
@ -245,7 +271,7 @@ public class EmbeddedProofProbe extends Probe<VerifiableCredential> {
|
||||
byte[] publicKey = Multicodec.decode(Codec.Ed25519PublicKey, publicKeyMulticodec);
|
||||
|
||||
// choose verifier
|
||||
LdVerifier<?> verifier = getVerifier(proof, publicKey);
|
||||
LdVerifier<?> verifier = getVerifier(proof, publicKey, crd);
|
||||
|
||||
try {
|
||||
boolean verify = verifier.verify(credentialHolder.getCredential(), proof);
|
||||
@ -259,10 +285,12 @@ public class EmbeddedProofProbe extends Probe<VerifiableCredential> {
|
||||
return success(ctx);
|
||||
}
|
||||
|
||||
private LdVerifier<?> getVerifier(LdProof proof, byte[] publicKey) {
|
||||
private LdVerifier<?> getVerifier(LdProof proof, byte[] publicKey, VerifiableCredential crd) {
|
||||
return proof.isType("Ed25519Signature2020")
|
||||
? new Ed25519Signature2020LdVerifier(publicKey)
|
||||
: new Ed25519Signature2022LdVerifier(publicKey);
|
||||
: crd.getVersion() == VerifiableCredential.VCVersion.VCDMv1p1
|
||||
? new Ed25519Signature2022LdVerifier(publicKey)
|
||||
: new Ed25519Signature2022VCDM20LdVerifier(publicKey);
|
||||
}
|
||||
|
||||
private Boolean IsValidPublicKeyMultibase(String publicKeyMultibase) {
|
||||
@ -273,7 +301,6 @@ public class EmbeddedProofProbe extends Probe<VerifiableCredential> {
|
||||
} catch (Exception e) {
|
||||
return false;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
public static final String ID = EmbeddedProofProbe.class.getSimpleName();
|
||||
|
||||
Loading…
Reference in New Issue
Block a user