Bump credo (#868)

* chore: bump credo

* fix: store legacy key id

* fix: re-add encoded credential

* test: remove only

* refactor: remove comment

* fix: only re-add for PEX

Author: Magnus-Kuhn

package-lock.json

@@ -62,8 +62,8 @@
         ]
     },
     "dependencies": {
-        "@credo-ts/core": "v0.6.0-alpha-20251110135447",
-        "@credo-ts/openid4vc": "v0.6.0-alpha-20251110135447",
+        "@credo-ts/core": "v0.6.0-alpha-20251121023030",
+        "@credo-ts/openid4vc": "v0.6.0-alpha-20251121023030",
         "@js-soft/docdb-querytranslator": "^1.1.6",
         "@js-soft/ts-serval": "2.0.14",
         "@js-soft/ts-utils": "2.3.5",

packages/consumption/package.json

@@ -71,7 +71,7 @@ export class OpenId4VcController extends ConsumptionBaseController {
         const matchedCredentialsFromPresentationExchange = authorizationRequest.presentationExchange?.credentialsForRequest.requirements
             .map((entry) =>
                 entry.submissionEntry
-                    .map((subEntry) => subEntry.verifiableCredentials.filter((vc) => vc.claimFormat === ClaimFormat.SdJwtDc).map((vc) => vc.credentialRecord.compactSdJwtVc))
+                    .map((subEntry) => subEntry.verifiableCredentials.filter((vc) => vc.claimFormat === ClaimFormat.SdJwtDc).map((vc) => vc.credentialRecord.encoded))
                     .flat()
             )
             .flat();

packages/consumption/src/modules/openid4vc/OpenId4VcController.ts

@@ -112,6 +112,10 @@ export class EnmshedHolderKeyManagmentService implements Kms.KeyManagementServic
             // store the key pair in the keystore
             await this.keyStorage.storeKey(options.keyId, JSON.stringify(jwkKeyPair));
 
+            // Credo doesn't trust the key id provided in the key binding jwk anymore, so there are two options: Storing the key id with the credential and making sure that key id is properly fetched - this turned out to be difficult - or the easy way out by storing this alternative key id computed from the public key.
+            const credoLegacyKeyId = Kms.PublicJwk.fromPublicJwk(publicJwk as any).legacyKeyId;
+            await this.keyStorage.storeKey(credoLegacyKeyId, JSON.stringify(jwkKeyPair));
+
             return { keyId: options.keyId, publicJwk: publicJwk as Kms.KmsJwkPublic } as Kms.KmsCreateKeyReturn<Type>;
         }
 

packages/consumption/src/modules/openid4vc/local/EnmeshedHolderKeyManagmentService.ts

@@ -4,14 +4,12 @@ import {
     BaseRecordConstructor,
     ClaimFormat,
     injectable,
-    Mdoc,
     MdocRecord,
     Query,
     QueryOptions,
     SdJwtVcRecord,
     StorageService,
-    W3cCredentialRecord,
-    W3cJwtVerifiableCredential
+    W3cCredentialRecord
 } from "@credo-ts/core";
 import { IdentityAttribute, VerifiableCredential } from "@nmshd/content";
 import { AccountController } from "@nmshd/transport";
@@ -123,14 +121,11 @@ export class EnmeshedStorageService<T extends BaseRecord> implements StorageServ
     private fromEncoded(type: string, encoded: string | Record<string, any>): BaseRecord<any, any> {
         switch (type) {
             case ClaimFormat.SdJwtDc:
-                return new SdJwtVcRecord({ compactSdJwtVc: encoded as string });
+                return new SdJwtVcRecord({ credentialInstances: [{ compactSdJwtVc: encoded as string }] });
             case ClaimFormat.MsoMdoc:
-                return new MdocRecord({ mdoc: Mdoc.fromBase64Url(encoded as string) });
+                return new MdocRecord({ credentialInstances: [{ issuerSignedBase64Url: encoded as string }] });
             case ClaimFormat.SdJwtW3cVc:
-                return new W3cCredentialRecord({
-                    credential: W3cJwtVerifiableCredential.fromSerializedJwt(encoded as string),
-                    tags: {}
-                });
+                return new W3cCredentialRecord({ credentialInstances: [{ credential: encoded as string }] });
             default:
                 throw new Error("Credential type not supported.");
         }

packages/consumption/src/modules/openid4vc/local/EnmeshedStorageService.ts

@@ -1,17 +1,4 @@
-import {
-    BaseRecord,
-    ClaimFormat,
-    DidJwk,
-    DidKey,
-    InjectionSymbols,
-    JwkDidCreateOptions,
-    KeyDidCreateOptions,
-    Kms,
-    Mdoc,
-    MdocRecord,
-    SdJwtVcRecord,
-    X509Module
-} from "@credo-ts/core";
+import { BaseRecord, ClaimFormat, DidJwk, DidKey, InjectionSymbols, JwkDidCreateOptions, KeyDidCreateOptions, Kms, MdocRecord, SdJwtVcRecord, X509Module } from "@credo-ts/core";
 import { OpenId4VcModule, type OpenId4VciResolvedCredentialOffer, type OpenId4VpResolvedAuthorizationRequest } from "@credo-ts/openid4vc";
 import { AccountController } from "@nmshd/transport";
 import { AttributesController, OwnIdentityAttribute } from "../../attributes";
@@ -110,7 +97,7 @@ export class Holder extends BaseAgent<ReturnType<typeof getOpenIdHolderModules>>
         const storedCredentials = await Promise.all(
             credentialResponse.credentials.map((response) => {
                 // TODO: batch issuance not yet supported
-                const credential = response.credentials[0];
+                const credential = response.record.firstCredential;
 
                 if (![ClaimFormat.SdJwtW3cVc, ClaimFormat.SdJwtDc, ClaimFormat.MsoMdoc].includes(credential.claimFormat)) {
                     throw new Error("Unsupported credential format");
@@ -166,15 +153,15 @@ export class Holder extends BaseAgent<ReturnType<typeof getOpenIdHolderModules>>
                             const record = new SdJwtVcRecord({
                                 id: recordUncast.id,
                                 createdAt: recordUncast.createdAt,
-                                compactSdJwtVc: recordUncast.compactSdJwtVc
+                                credentialInstances: [{ compactSdJwtVc: recordUncast.encoded }]
                             });
                             vc.credentialRecord = record;
                         } else if (vc.claimFormat === ClaimFormat.MsoMdoc) {
                             const recordUncast = vc.credentialRecord;
                             const record = new MdocRecord({
                                 id: recordUncast.id,
                                 createdAt: recordUncast.createdAt,
-                                mdoc: Mdoc.fromBase64Url(recordUncast.base64Url)
+                                credentialInstances: [{ issuerSignedBase64Url: recordUncast.encoded }]
                             });
                             vc.credentialRecord = record;
                         } else {

packages/consumption/src/modules/openid4vc/local/Holder.ts

@@ -33,9 +33,16 @@ export class ResolveAuthorizationRequestUseCase extends UseCase<ResolveAuthoriza
     protected override async executeInternal(request: ResolveAuthorizationRequestRequest): Promise<Result<ResolveAuthorizationRequestResponse>> {
         const result = await this.openId4VcController.resolveAuthorizationRequest(request.authorizationRequestUrl);
 
-        return Result.ok({
-            authorizationRequest: JSON.parse(stringifySafe(result.authorizationRequest)),
-            usedCredentials: AttributeMapper.toAttributeDTOList(result.usedCredentials)
-        });
+        const authorizationRequest = JSON.parse(stringifySafe(result.authorizationRequest));
+        // the 'get encoded' of the credential is lost while making it app-safe, we have to re-add it for PEX
+        // quick-fix for the simplest case with one requested credential only - otherwise every [0] would have to be generalised.
+        if (result.authorizationRequest.presentationExchange) {
+            const encodedCredential =
+                result.authorizationRequest.presentationExchange.credentialsForRequest.requirements[0].submissionEntry[0].verifiableCredentials[0].credentialRecord.encoded;
+            authorizationRequest.presentationExchange.credentialsForRequest.requirements[0].submissionEntry[0].verifiableCredentials[0].credentialRecord.encoded =
+                encodedCredential;
+        }
+
+        return Result.ok({ authorizationRequest, usedCredentials: AttributeMapper.toAttributeDTOList(result.usedCredentials) });
     }
 }

packages/runtime/src/useCases/consumption/openid4vc/ResolveAuthorizationRequest.ts

@@ -0,0 +1,21 @@
+diff --git a/node_modules/@openid4vc/oauth2/dist/index.cjs b/node_modules/@openid4vc/oauth2/dist/index.cjs
+index 3286de2..c99b244 100644
+--- a/node_modules/@openid4vc/oauth2/dist/index.cjs
++++ b/node_modules/@openid4vc/oauth2/dist/index.cjs
+@@ -1578,11 +1578,16 @@ async function createJarAuthorizationRequest(options) {
+ * @throws {Error} if parsing json from response fails
+ */
+ async function fetchWellKnownMetadata(wellKnownMetadataUrl, schema, options) {
++	try {
+ 	const { result, response } = await (0, __openid4vc_utils.createZodFetcher)(options?.fetch)(schema, options?.acceptedContentType ?? [__openid4vc_utils.ContentType.Json], wellKnownMetadataUrl);
+ 	if (response.status === 404) return null;
+ 	if (!response.ok) throw new __openid4vc_utils.InvalidFetchResponseError(`Fetching well known metadata from '${wellKnownMetadataUrl}' resulted in an unsuccessful response with status '${response.status}'.`, await response.clone().text(), response);
+ 	if (!result?.success) throw new ValidationError$1(`Validation of metadata from '${wellKnownMetadataUrl}' failed`, result?.error);
+ 	return result.data;
++	} catch (e) {
++	    console.log('Changed By JS-SOFT: Error can probably be ignored', e);
++    	return null;
++	}
+ }
+ 
+ //#endregion