Feat/jwt vc jsonld

apps/api-gateway/src/app.module.ts

@@ -25,6 +25,7 @@ import { LoggerModule } from '@credebl/logger/logger.module';
 import { NotificationModule } from './notification/notification.module';
 import { Oid4vcIssuanceModule } from './oid4vc-issuance/oid4vc-issuance.module';
 import { Oid4vpModule } from './oid4vc-verification/oid4vc-verification.module';
+
 import { OrganizationModule } from './organization/organization.module';
 import { ConfigModule as PlatformConfig } from '@credebl/config/config.module';
 import { PlatformModule } from './platform/platform.module';

apps/api-gateway/src/oid4vc-issuance/dtos/issuer-sessions.dto.ts

@@ -274,11 +274,13 @@ export class CredentialDto {
 
   @ApiProperty({
     description: 'Credential format type',
-    enum: ['mso_mdoc', 'vc+sd-jwt'],
+    enum: ['mso_mdoc', 'vc+sd-jwt', 'jwt_vc_json-ld', 'ldp_vc'],
     example: 'mso_mdoc'
   })
   @IsString()
-  @IsIn(['mso_mdoc', 'vc+sd-jwt'], { message: 'format must be either "mso_mdoc" or "vc+sd-jwt"' })
+  @IsIn(['mso_mdoc', 'vc+sd-jwt', 'jwt_vc_json-ld', 'ldp_vc'], {
+    message: 'format must be either "mso_mdoc", "vc+sd-jwt", "jwt_vc_json-ld" or "ldp_vc"'
+  })
   format: string;
 
   @ApiProperty({

apps/api-gateway/src/oid4vc-issuance/dtos/oid4vc-issuer-template.dto.ts

@@ -196,6 +196,14 @@ export class SdJwtTemplateDto {
   @IsString()
   vct: string;
 
+  @ApiPropertyOptional({
+    example: 'https://dev-schema.sovio.id/schemas/a99d55b6-c663-4af8-bcd3-4fe6699df91a',
+    description: 'JSON-LD schema URL for the credential'
+  })
+  @IsString()
+  @IsOptional()
+  schemaUrl?: string;
+
   @ApiProperty({
     type: 'array',
     items: { $ref: getSchemaPath(CredentialAttributeDto) },
@@ -229,8 +237,13 @@ export class CreateCredentialTemplateDto {
   @IsEnum(CredentialFormat)
   format: CredentialFormat;
 
-  @ValidateIf((o: CreateCredentialTemplateDto) => CredentialFormat.SdJwtVc === o.format)
-  @IsEmpty({ message: 'doctype must not be provided when format is "dc+sd-jwt"' })
+  @ValidateIf(
+    (o: CreateCredentialTemplateDto) =>
+      CredentialFormat.SdJwtVc === o.format ||
+      CredentialFormat.JwtVcJsonLd === o.format ||
+      CredentialFormat.LdpVc === o.format
+  )
+  @IsEmpty({ message: 'doctype must not be provided when format is "dc+sd-jwt", "jwt_vc_json-ld" or "ldp_vc"' })
   readonly _doctypeAbsentGuard?: unknown;
 
   @ValidateIf((o: CreateCredentialTemplateDto) => CredentialFormat.Mdoc === o.format)
@@ -246,7 +259,11 @@ export class CreateCredentialTemplateDto {
   @Type(({ object }) => {
     if (object.format === CredentialFormat.Mdoc) {
       return MdocTemplateDto;
-    } else if (object.format === CredentialFormat.SdJwtVc) {
+    } else if (
+      object.format === CredentialFormat.SdJwtVc ||
+      object.format === CredentialFormat.JwtVcJsonLd ||
+      object.format === CredentialFormat.LdpVc
+    ) {
       return SdJwtTemplateDto;
     }
   })

apps/api-gateway/src/oid4vc-issuance/oid4vc-issuance.module.ts

@@ -15,7 +15,7 @@ import { HttpModule } from '@nestjs/axios';
         name: 'NATS_CLIENT',
         transport: Transport.NATS,
         options: getNatsOptions(
-          CommonConstants.ISSUANCE_SERVICE,
+          CommonConstants.OIDC4VC_ISSUANCE_SERVICE,
           process.env.API_GATEWAY_NKEY_SEED,
           process.env.NATS_CREDS_FILE
         )

apps/api-gateway/src/oid4vc-verification/dtos/oid4vc-verifier-presentation.dto.ts

@@ -289,7 +289,7 @@ export class DcqlDto {
 @ValidatorConstraint({ name: 'OnlyOneOf', async: false })
 export class OnlyOneOfConstraint implements ValidatorConstraintInterface {
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  validate(_: any, args: ValidationArguments): Promise<boolean> | boolean {
+  validate(_: unknown, args: ValidationArguments): Promise<boolean> | boolean {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const object = args.object as Record<string, any>;
     const properties = args.constraints as string[];
@@ -356,10 +356,18 @@ export class PresentationRequestDto {
   @IsDefined()
   @IsEnum(ResponseMode)
   responseMode: ResponseMode;
-  //TODO: check e2e flow and add ResponseMode based restrictions
   @IsOptional()
   expectedOrigins: string[];
 
+  @ApiPropertyOptional({
+    description: 'OpenID4VP version to use',
+    enum: ['v1', 'v1.draft21', 'v1.draft24'],
+    example: 'v1.draft24'
+  })
+  @IsOptional()
+  @IsEnum(['v1', 'v1.draft21', 'v1.draft24'])
+  version?: 'v1' | 'v1.draft21' | 'v1.draft24';
+
   /**
    * Dummy property used to run a class-level validation ensuring mutual exclusivity.
    * This property is not serialized into requests/responses but is required so `class-validator`

apps/oid4vc-issuance/constant/issuance.ts

@@ -7,3 +7,6 @@ export const accessTokenSignerKeyType = { kty: 'OKP', crv: 'Ed25519' } as {
   crv: AccessTokenSignerKeyType;
 };
 export const batchCredentialIssuanceDefault = 0;
+
+export const CREDENTIALS_CONTEXT_V1_URL = 'https://www.w3.org/2018/credentials/v1';
+export const CREDENTIALS_CONTEXT_V2_URL = 'https://www.w3.org/ns/credentials/v2';

apps/oid4vc-issuance/interfaces/oid4vc-issuer-sessions.interfaces.ts

@@ -5,7 +5,9 @@ import { OpenId4VcIssuanceSessionState } from '@credebl/enum/enum';
  * --------------------------------------------------------- */
 export enum CredentialFormat {
   SdJwtVc = 'vc+sd-jwt',
-  MsoMdoc = 'mso_mdoc'
+  MsoMdoc = 'mso_mdoc',
+  JwtVcJsonLd = 'jwt_vc_json-ld',
+  LdpVc = 'ldp_vc'
 }
 
 export enum SignerMethodOption {

apps/oid4vc-issuance/interfaces/oid4vc-template.interfaces.ts

@@ -2,6 +2,8 @@ import { Prisma, SignerOption } from '@prisma/client';
 import { AttributeType, CredentialFormat } from '@credebl/enum/enum';
 export interface SdJwtTemplate {
   vct: string;
+  schemaUrl?: string;
+  context?: string[];
   attributes: CredentialAttribute[];
 }
 

apps/oid4vc-issuance/libs/helpers/credential-sessions.builder.ts

@@ -150,14 +150,29 @@
   if (['sd-jwt', 'dc+sd-jwt', 'vc+sd-jwt', 'sdjwt', 'sd+jwt-vc'].includes(normalized)) {
     return CredentialFormat.SdJwtVc;
   }
+  if (['jwt_vc_json-ld', 'jwt-vc-json-ld', 'w3c-jwt-json-ld'].includes(normalized)) {
+    return CredentialFormat.JwtVcJsonLd;
+  }
+  if (['ldp_vc', 'ldp-vc'].includes(normalized)) {
+    return CredentialFormat.LdpVc;
+  }
   if ('mso_mdoc' === normalized || 'mso-mdoc' === normalized || 'mdoc' === normalized) {
     return CredentialFormat.Mdoc;
   }
   throw new UnprocessableEntityException(`Unsupported template format: ${dbFormat}`);
 }
 
-function formatSuffix(apiFormat: CredentialFormat): 'sdjwt' | 'mdoc' {
-  return apiFormat === CredentialFormat.SdJwtVc ? 'sdjwt' : 'mdoc';
+function formatSuffix(apiFormat: CredentialFormat): 'sdjwt' | 'mdoc' | 'jwt-vc-json-ld' | 'ldp-vc' {
+  if (apiFormat === CredentialFormat.SdJwtVc) {
+    return 'sdjwt';
+  }
+  if (apiFormat === CredentialFormat.JwtVcJsonLd) {
+    return 'jwt-vc-json-ld';
+  }
+  if (apiFormat === CredentialFormat.LdpVc) {
+    return 'ldp-vc';
+  }
+  return 'mdoc';
 }
 
 export function buildCredentialOfferUrl(baseUrl: string, getAllCredentialOffer: GetAllCredentialOffer): string {
@@ -213,7 +228,11 @@
     }
   };
 
-  if (CredentialFormat.SdJwtVc === template.format) {
+  if (
+    CredentialFormat.SdJwtVc === template.format ||
+    CredentialFormat.JwtVcJsonLd === template.format ||
+    CredentialFormat.LdpVc === template.format
+  ) {
     validateAttributes((template.attributes as SdJwtTemplate).attributes ?? [], payload);
   } else if (CredentialFormat.Mdoc === template.format) {
     const namespaces = payload?.namespaces;
@@ -456,6 +475,137 @@
   };
 }
 
+function buildJwtVcJsonLdCredential(
+  credentialRequest: CredentialRequestDtoLike,
+  templateRecord: CredentialTemplateRecord,
+  signerOptions: ISignerOption[],
+  activeCertificateDetails?: X509CertificateRecord[]
+): BuiltCredential {
+  const payloadCopy = { ...(credentialRequest.payload as Record<string, unknown>) };
+
+  let expectedSignerMethod: SignerMethodOption;
+  if (templateRecord.signerOption === SignerOption.DID) {
+    expectedSignerMethod = SignerMethodOption.DID;
+  } else if (
+    templateRecord.signerOption === SignerOption.X509_P256 ||
+    templateRecord.signerOption === SignerOption.X509_ED25519
+  ) {
+    expectedSignerMethod = SignerMethodOption.X5C;
+  } else {
+    throw new UnprocessableEntityException(
+      `Unknown signer option "${templateRecord.signerOption}" for template ${templateRecord.id}`
+    );
+  }
+
+  const templateSignerOption: ISignerOption | undefined = signerOptions?.find((x) => x.method === expectedSignerMethod);
+  if (!templateSignerOption) {
+    throw new UnprocessableEntityException(
+      `Signer option "${expectedSignerMethod}" is not configured for template ${templateRecord.id}`
+    );
+  }
+
+  if (expectedSignerMethod === SignerMethodOption.X5C && credentialRequest.validityInfo) {
+    if (!activeCertificateDetails?.length) {
+      throw new UnprocessableEntityException('Active x.509 certificate details are required for x5c signer templates.');
+    }
+    const certificateDetail = activeCertificateDetails.find(
+      (x) => x.certificateBase64 === templateSignerOption.x5c?.[0]
+    );
+    if (!certificateDetail) {
+      throw new UnprocessableEntityException('No active x.509 certificate matches the configured signer option.');
+    }
+
+    const validationResult = validateCredentialDatesInCertificateWindow(
+      credentialRequest.validityInfo,
+      certificateDetail
+    );
+    if (!validationResult.isValid) {
+      throw new UnprocessableEntityException(`${JSON.stringify(validationResult.details)}`);
+    }
+  }
+
+  let nbf: number | undefined;
+  let exp: number | undefined;
+
+  if (credentialRequest.validityInfo) {
+    const credentialValidFrom = new Date(credentialRequest.validityInfo.validFrom);
+    const credentialValidTo = new Date(credentialRequest.validityInfo.validUntil);
+    const isCredentialDurationValid = credentialValidFrom <= credentialValidTo;
+    if (!isCredentialDurationValid) {
+      const errorDetails = {
+        credentialDurationValid: isCredentialDurationValid,
+        credentialValidFrom: credentialValidFrom.toISOString(),
+        credentialValidTo: credentialValidTo.toISOString()
+      };
+      throw new UnprocessableEntityException(`${JSON.stringify(errorDetails)}`);
+    }
+    nbf = dateToSeconds(credentialValidFrom);
+    exp = dateToSeconds(credentialValidTo);
+  }
+
+  const apiFormat = mapDbFormatToApiFormat(templateRecord.format);
+  const idSuffix = formatSuffix(apiFormat);
+  const credentialSupportedId = `${templateRecord.name}-${idSuffix}`;
+  const vct = (templateRecord.attributes as any)?.vct;
+  let typeName = '';
+  if ('string' === typeof vct) {
+    const cleanVct = vct.replace(/\/+$/, '');
+    const lastSlash = cleanVct.lastIndexOf('/');
+    typeName = -1 !== lastSlash ? cleanVct.substring(lastSlash + 1) : cleanVct;
+  } else {
+    typeName = templateRecord.name.replace(/\s+/g, '');
+  }
+
+  const templateContext = (templateRecord.attributes as any)?.context;
+  const context = Array.isArray(templateContext) ? [...templateContext] : ['https://www.w3.org/2018/credentials/v1'];
+  const requiredContextUrl = 'https://www.w3.org/2018/credentials/v1';
+  const normalizeUrlForComparison = (value: unknown): string | null => {
+    if ('string' !== typeof value) {
+      return null;
+    }
+    try {
+      return new URL(value).toString();
+    } catch {
+      return null;
+    }
+  };
+  const normalizedRequiredContext = normalizeUrlForComparison(requiredContextUrl);
+  const hasRequiredContext = context.some(
+    (ctx) => null !== normalizedRequiredContext && normalizeUrlForComparison(ctx) === normalizedRequiredContext
+  );
+
+  if (!hasRequiredContext) {
+    context.unshift(requiredContextUrl);
+  }
+
+  const wrappedPayload: Record<string, any> = {
+    '@context': context,
+    type: ['VerifiableCredential', typeName],
+    credentialSubject: payloadCopy
+  };
+
+  if (nbf !== undefined) {
+    wrappedPayload.nbf = nbf;
+  }
+  if (exp !== undefined) {
+    wrappedPayload.exp = exp;
+  }
+
+  if (credentialRequest.validityInfo) {
+    wrappedPayload.issuanceDate = new Date(credentialRequest.validityInfo.validFrom).toISOString();
+    wrappedPayload.expirationDate = new Date(credentialRequest.validityInfo.validUntil).toISOString();
+  } else {
+    wrappedPayload.issuanceDate = new Date().toISOString();
+  }
+
+  return {
+    credentialSupportedId,
+    signerOptions: templateSignerOption ? templateSignerOption : undefined,
+    format: apiFormat,
+    payload: wrappedPayload
+  };
+}
+
 export function buildCredentialOfferPayload(
   dto: CreateOidcCredentialOfferDtoLike,
   templates: credential_templates[],
@@ -489,6 +639,9 @@
     if (apiFormat === CredentialFormat.SdJwtVc) {
       return buildSdJwtCredential(credentialRequest, templateRecord, signerOptions, activeCertificateDetails);
     }
+    if (apiFormat === CredentialFormat.JwtVcJsonLd || apiFormat === CredentialFormat.LdpVc) {
+      return buildJwtVcJsonLdCredential(credentialRequest, templateRecord, signerOptions, activeCertificateDetails);
+    }
     if (apiFormat === CredentialFormat.Mdoc) {
       return buildMdocCredential(credentialRequest, templateRecord, signerOptions, activeCertificateDetails);
     }