Feat/jwt vc jsonld

apps/api-gateway/src/oid4vc-issuance/dtos/issuer-sessions.dto.ts

@@ -274,11 +274,13 @@ export class CredentialDto {
 
   @ApiProperty({
     description: 'Credential format type',
-    enum: ['mso_mdoc', 'vc+sd-jwt'],
+    enum: ['mso_mdoc', 'vc+sd-jwt', 'jwt_vc_json-ld'],
     example: 'mso_mdoc'
   })
   @IsString()
-  @IsIn(['mso_mdoc', 'vc+sd-jwt'], { message: 'format must be either "mso_mdoc" or "vc+sd-jwt"' })
+  @IsIn(['mso_mdoc', 'vc+sd-jwt', 'jwt_vc_json-ld'], {
+    message: 'format must be either "mso_mdoc", "vc+sd-jwt" or "jwt_vc_json-ld"'
+  })
   format: string;
 
   @ApiProperty({

apps/api-gateway/src/oid4vc-issuance/dtos/oid4vc-issuer-template.dto.ts

@@ -229,8 +229,11 @@ export class CreateCredentialTemplateDto {
   @IsEnum(CredentialFormat)
   format: CredentialFormat;
 
-  @ValidateIf((o: CreateCredentialTemplateDto) => CredentialFormat.SdJwtVc === o.format)
-  @IsEmpty({ message: 'doctype must not be provided when format is "dc+sd-jwt"' })
+  @ValidateIf(
+    (o: CreateCredentialTemplateDto) =>
+      CredentialFormat.SdJwtVc === o.format || CredentialFormat.JwtVcJsonLd === o.format
+  )
+  @IsEmpty({ message: 'doctype must not be provided when format is "dc+sd-jwt" or "jwt_vc_json-ld"' })
   readonly _doctypeAbsentGuard?: unknown;
 
   @ValidateIf((o: CreateCredentialTemplateDto) => CredentialFormat.Mdoc === o.format)
@@ -246,7 +249,7 @@ export class CreateCredentialTemplateDto {
   @Type(({ object }) => {
     if (object.format === CredentialFormat.Mdoc) {
       return MdocTemplateDto;
-    } else if (object.format === CredentialFormat.SdJwtVc) {
+    } else if (object.format === CredentialFormat.SdJwtVc || object.format === CredentialFormat.JwtVcJsonLd) {
       return SdJwtTemplateDto;
     }
   })

apps/oid4vc-issuance/interfaces/oid4vc-issuer-sessions.interfaces.ts

@@ -5,7 +5,8 @@ import { OpenId4VcIssuanceSessionState } from '@credebl/enum/enum';
  * --------------------------------------------------------- */
 export enum CredentialFormat {
   SdJwtVc = 'vc+sd-jwt',
-  MsoMdoc = 'mso_mdoc'
+  MsoMdoc = 'mso_mdoc',
+  JwtVcJsonLd = 'jwt_vc_json-ld'
 }
 
 export enum SignerMethodOption {

apps/oid4vc-issuance/libs/helpers/credential-sessions.builder.ts

@@ -150,14 +150,23 @@
   if (['sd-jwt', 'dc+sd-jwt', 'vc+sd-jwt', 'sdjwt', 'sd+jwt-vc'].includes(normalized)) {
     return CredentialFormat.SdJwtVc;
   }
+  if (['jwt_vc_json-ld', 'jwt-vc-json-ld', 'w3c-jwt-json-ld'].includes(normalized)) {
+    return CredentialFormat.JwtVcJsonLd;
+  }
   if ('mso_mdoc' === normalized || 'mso-mdoc' === normalized || 'mdoc' === normalized) {
     return CredentialFormat.Mdoc;
   }
   throw new UnprocessableEntityException(`Unsupported template format: ${dbFormat}`);
 }
 
-function formatSuffix(apiFormat: CredentialFormat): 'sdjwt' | 'mdoc' {
-  return apiFormat === CredentialFormat.SdJwtVc ? 'sdjwt' : 'mdoc';
+function formatSuffix(apiFormat: CredentialFormat): 'sdjwt' | 'mdoc' | 'jwt-vc-json-ld' {
+  if (apiFormat === CredentialFormat.SdJwtVc) {
+    return 'sdjwt';
+  }
+  if (apiFormat === CredentialFormat.JwtVcJsonLd) {
+    return 'jwt-vc-json-ld';
+  }
+  return 'mdoc';
 }
 
 export function buildCredentialOfferUrl(baseUrl: string, getAllCredentialOffer: GetAllCredentialOffer): string {
@@ -213,7 +222,7 @@
     }
   };
 
-  if (CredentialFormat.SdJwtVc === template.format) {
+  if (CredentialFormat.SdJwtVc === template.format || CredentialFormat.JwtVcJsonLd === template.format) {
     validateAttributes((template.attributes as SdJwtTemplate).attributes ?? [], payload);
   } else if (CredentialFormat.Mdoc === template.format) {
     const namespaces = payload?.namespaces;
@@ -456,6 +465,97 @@
   };
 }
 
+function buildJwtVcJsonLdCredential(
+  credentialRequest: CredentialRequestDtoLike,
+  templateRecord: CredentialTemplateRecord,
+  signerOptions: ISignerOption[],
+  activeCertificateDetails?: X509CertificateRecord[]
+): BuiltCredential {
+  const payloadCopy = { ...(credentialRequest.payload as Record<string, unknown>) };
+
+  let expectedSignerMethod: SignerMethodOption;
+  if (templateRecord.signerOption === SignerOption.DID) {
+    expectedSignerMethod = SignerMethodOption.DID;
+  } else if (
+    templateRecord.signerOption === SignerOption.X509_P256 ||
+    templateRecord.signerOption === SignerOption.X509_ED25519
+  ) {
+    expectedSignerMethod = SignerMethodOption.X5C;
+  } else {
+    throw new UnprocessableEntityException(
+      `Unknown signer option "${templateRecord.signerOption}" for template ${templateRecord.id}`
+    );
+  }
+
+  const templateSignerOption: ISignerOption | undefined = signerOptions?.find((x) => x.method === expectedSignerMethod);
+  if (!templateSignerOption) {
+    throw new UnprocessableEntityException(
+      `Signer option "${expectedSignerMethod}" is not configured for template ${templateRecord.id}`
+    );
+  }
+
+  if (expectedSignerMethod === SignerMethodOption.X5C && credentialRequest.validityInfo) {
+    if (!activeCertificateDetails?.length) {
+      throw new UnprocessableEntityException('Active x.509 certificate details are required for x5c signer templates.');
+    }
+    const certificateDetail = activeCertificateDetails.find(
+      (x) => x.certificateBase64 === templateSignerOption.x5c?.[0]
+    );
+    if (!certificateDetail) {
+      throw new UnprocessableEntityException('No active x.509 certificate matches the configured signer option.');
+    }
+
+    const validationResult = validateCredentialDatesInCertificateWindow(
+      credentialRequest.validityInfo,
+      certificateDetail
+    );
+    if (!validationResult.isValid) {
+      throw new UnprocessableEntityException(`${JSON.stringify(validationResult.details)}`);
+    }
+  }
+
+  let nbf: number | undefined;
+  let exp: number | undefined;
+
+  if (credentialRequest.validityInfo) {
+    const credentialValidFrom = new Date(credentialRequest.validityInfo.validFrom);
+    const credentialValidTo = new Date(credentialRequest.validityInfo.validUntil);
+    const isCredentialDurationValid = credentialValidFrom <= credentialValidTo;
+    if (!isCredentialDurationValid) {
+      const errorDetails = {
+        credentialDurationValid: isCredentialDurationValid,
+        credentialValidFrom: credentialValidFrom.toISOString(),
+        credentialValidTo: credentialValidTo.toISOString()
+      };
+      throw new UnprocessableEntityException(`${JSON.stringify(errorDetails)}`);
+    }
+    nbf = dateToSeconds(credentialValidFrom);
+    exp = dateToSeconds(credentialValidTo);
+  }
+
+  const apiFormat = mapDbFormatToApiFormat(templateRecord.format);
+  const idSuffix = formatSuffix(apiFormat);
+  const credentialSupportedId = `${templateRecord.name}-${idSuffix}`;
+
+  const wrappedPayload: Record<string, any> = {
+    credentialSubject: payloadCopy
+  };
+
+  if (nbf) {
+    wrappedPayload.nbf = nbf;
+  }
+  if (exp) {
+    wrappedPayload.exp = exp;
+  }
+
+  return {
+    credentialSupportedId,
+    signerOptions: templateSignerOption ? templateSignerOption : undefined,
+    format: apiFormat,
+    payload: wrappedPayload
+  };
+}
+
 export function buildCredentialOfferPayload(
   dto: CreateOidcCredentialOfferDtoLike,
   templates: credential_templates[],
@@ -489,6 +589,9 @@
     if (apiFormat === CredentialFormat.SdJwtVc) {
       return buildSdJwtCredential(credentialRequest, templateRecord, signerOptions, activeCertificateDetails);
     }
+    if (apiFormat === CredentialFormat.JwtVcJsonLd) {
+      return buildJwtVcJsonLdCredential(credentialRequest, templateRecord, signerOptions, activeCertificateDetails);
+    }
     if (apiFormat === CredentialFormat.Mdoc) {
       return buildMdocCredential(credentialRequest, templateRecord, signerOptions, activeCertificateDetails);
     }

apps/oid4vc-issuance/libs/helpers/issuer.metadata.ts

@@ -266,7 +266,6 @@
   return claims;
 }
 
-//TODO: Fix this eslint issue
 // eslint-disable-next-line @typescript-eslint/explicit-function-return-type
 export function buildSdJwtCredentialConfig(name: string, template: SdJwtTemplate) {
   const formatSuffix = 'sdjwt';
@@ -332,12 +331,44 @@
   };
 }
 
+// eslint-disable-next-line @typescript-eslint/explicit-function-return-type
+export function buildJwtVcJsonLdCredentialConfig(name: string, template: SdJwtTemplate) {
+  const formatSuffix = 'jwt-vc-json-ld';
+
+  // Determine the unique key for this credential configuration
+  const configKey = `${name}-${formatSuffix}`;
+  const credentialScope = `openid4vc:${template.vct}-${formatSuffix}`;
+
+  const claims = buildClaimsFromTemplate(template);
+
+  return {
+    [configKey]: {
+      format: CredentialFormat.JwtVcJsonLd,
+      scope: credentialScope,
+      vct: template.vct,
+      credential_signing_alg_values_supported: [...STATIC_CREDENTIAL_ALGS_FOR_SDJWT],
+      cryptographic_binding_methods_supported: [...STATIC_BINDING_METHODS_FOR_SDJWT],
+      proof_types_supported: {
+        jwt: {
+          proof_signing_alg_values_supported: ['ES256', 'EdDSA']
+        }
+      },
+      credential_metadata: {
+        claims,
+        display: []
+      }
+    }
+  };
+}
+
 //TODO: Fix this eslint issue
 // eslint-disable-next-line @typescript-eslint/explicit-function-return-type
 export function buildCredentialConfig(name: string, template: SdJwtTemplate | MdocTemplate, format: CredentialFormat) {
   switch (format) {
     case CredentialFormat.SdJwtVc:
       return buildSdJwtCredentialConfig(name, template as SdJwtTemplate);
+    case CredentialFormat.JwtVcJsonLd:
+      return buildJwtVcJsonLdCredentialConfig(name, template as SdJwtTemplate);
     case CredentialFormat.Mdoc:
       return buildMdocCredentialConfig(name, template as MdocTemplate);
     default:
@@ -361,7 +392,11 @@
     const credentialConfig = buildCredentialConfig(
       templateRow.name,
       templateToBuild,
-      format === CredentialFormat.Mdoc ? CredentialFormat.Mdoc : CredentialFormat.SdJwtVc
+      format === CredentialFormat.Mdoc
+        ? CredentialFormat.Mdoc
+        : format === CredentialFormat.JwtVcJsonLd
+          ? CredentialFormat.JwtVcJsonLd
+          : CredentialFormat.SdJwtVc
     );
     const appearanceJson = coerceJsonObject<unknown>(templateRow.appearance);
 

libs/enum/src/enum.ts

@@ -372,7 +372,8 @@ export enum X509ExtendedKeyUsage {
 
 export enum CredentialFormat {
   SdJwtVc = 'dc+sd-jwt',
-  Mdoc = 'mso_mdoc'
+  Mdoc = 'mso_mdoc',
+  JwtVcJsonLd = 'jwt_vc_json-ld'
 }
 
 export enum AttributeType {