feat: status list update for bbs and v2.0#89
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughThe PR updates w3c-credential-status defaults and validation to prioritize v2.0 BitstringStatusList with ecdsa-sd-2023, adds guardrails for legacy v1.1 StatusList2021 with BbsBlsSignature2020, extends tests to cover new flows and errors, and revises README to document v2.0 emphasis with legacy compatibility. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Caller
participant CS as createCredentialStatusPayload
participant VU as validateCredentialStatus
participant Net as HTTP(S) Fetch
Dev->>CS: call(options, type?, cryptoSuite?)
note over CS: Defaults: BitstringStatusListCredential + ecdsa-sd-2023
CS->>VU: validateCredentialStatus(options, type, cryptoSuite)
alt type = BitstringStatusListCredential
alt cryptoSuite = BbsBlsSignature2020
VU-->>CS: throw Error("Not supported for v2")
CS-->>Dev: Error
else cryptoSuite = ecdsa-sd-2023 or bbs-2023
VU-->>CS: OK
CS-->>Dev: Build v2 payload (no issuanceDate)
end
else type = StatusList2021Credential
alt cryptoSuite != BbsBlsSignature2020 or missing id
VU-->>CS: throw Error("Require BbsBlsSignature2020 and resolvable id")
CS-->>Dev: Error
else valid id
VU->>Net: GET options.id
alt Resolved with VC v1 context
Net-->>VU: 200 + VC (@context includes VC_V1_URL)
VU-->>CS: OK
CS-->>Dev: Build legacy v1.1 payload
else Not resolved or wrong context
Net-->>VU: 404 / wrong @context
VU-->>CS: throw Error("Use modern cryptosuite for new VCs")
CS-->>Dev: Error
end
end
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
packages/w3c-credential-status/src/lib/index.test.ts (1)
42-103: Restore spies between tests for isolationOnce you call
vi.spyOn(utils, 'validateCredentialStatus'), that mock stays active for the remainder of the suite. Adding a simpleafterEach(() => vi.restoreAllMocks());inside thisdescribekeeps later tests honest and prevents future regressions from accidentally sliding past the validation because a spy was left behind.describe('w3c-credential-status', () => { describe('createCredentialStatusVC', () => { + afterEach(() => { + vi.restoreAllMocks(); + }); + it('Should throw error when trying to create new VC with BLS cryptosuite', async () => {
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
packages/w3c-credential-status/README.md(10 hunks)packages/w3c-credential-status/src/lib/index.test.ts(5 hunks)packages/w3c-credential-status/src/lib/index.ts(2 hunks)packages/w3c-credential-status/src/lib/utils.ts(2 hunks)
| const optionsV2 = { | ||
| id: hostingUrl, | ||
| credentialSubject: { | ||
| id: `${hostingUrl}#list`, | ||
| type: 'StatusList2021', // v1.1 credential subject type | ||
| type: 'BitstringStatusList', // v2.0 credential subject type | ||
| statusPurpose: purpose, | ||
| encodedList, | ||
| }; | ||
| } | ||
|
|
||
| const credentialStatusVCV1 = await createCredentialStatusPayload( | ||
| optionsV1, | ||
| // Example with ECDSA-SD-2023 | ||
| const credentialStatusVCV2_ECDSA = await createCredentialStatusPayload( | ||
| optionsV2, | ||
| keyPair, | ||
| 'StatusList2021Credential', // v1.1 credential type | ||
| 'BbsBlsSignature2020' // legacy cryptosuite | ||
| 'BitstringStatusListCredential', // v2.0 credential type | ||
| 'ecdsa-sd-2023' // modern cryptosuite | ||
| ); | ||
|
|
||
| // Example for W3C VC Data Model v2.0 (modern) | ||
| const optionsV2 = { | ||
| // Example with BBS-2023 | ||
| const credentialStatusVCV2_BBS = await createCredentialStatusPayload( | ||
| optionsV2, | ||
| keyPair, | ||
| 'BitstringStatusListCredential', // v2.0 credential type | ||
| 'bbs-2023' // modern cryptosuite | ||
| ); | ||
|
|
||
| console.log('Credential Status VC (ECDSA):', credentialStatusVCV2_ECDSA); | ||
| console.log('Credential Status VC (BBS):', credentialStatusVCV2_BBS); | ||
|
|
||
|
|
||
| // Example for W3C VC Data Model v1.1 (legacy) - works with existing v1.1 where the hostingUrl is resolvable | ||
| const optionsV1 = { | ||
| id: hostingUrl, | ||
| credentialSubject: { | ||
| id: `${hostingUrl}#list`, | ||
| type: 'BitstringStatusList', // v2.0 credential subject type | ||
| type: 'StatusList2021', // v1.1 credential subject type | ||
| statusPurpose: purpose, | ||
| encodedList, | ||
| }; | ||
| } | ||
|
|
||
| const credentialStatusVCV2 = await createCredentialStatusPayload( | ||
| optionsV2, | ||
| const credentialStatusVCV1 = await createCredentialStatusPayload( | ||
| optionsV1, | ||
| keyPair, | ||
| 'BitstringStatusListCredential', // v2.0 credential type | ||
| 'ecdsa-sd-2023' // modern cryptosuite | ||
| 'StatusList2021Credential', // v1.1 credential type | ||
| 'BbsBlsSignature2020' // legacy cryptosuite | ||
| ); | ||
|
|
||
| console.log('Credential Status VC:', credentialStatusVCV2); | ||
|
|
||
| // Sign the credential status payload |
There was a problem hiding this comment.
Fix TypeScript snippet syntax.
The README examples won’t compile as-is. The object literals terminate with }; instead of },, and the createCredentialStatusPayload call misses a comma between the credential type and crypto suite arguments. Readers copying this code will hit syntax errors immediately. Please patch the sample:
const optionsV2 = {
id: hostingUrl,
credentialSubject: {
id: `${hostingUrl}#list`,
type: 'BitstringStatusList', // v2.0 credential subject type
statusPurpose: purpose,
encodedList,
- };
-}
+ },
+};
…
const credentialStatusVCV2_BBS = await createCredentialStatusPayload(
optionsV2,
keyPair,
- 'BitstringStatusListCredential', // v2.0 credential type
- 'bbs-2023' // modern cryptosuite
+ 'BitstringStatusListCredential', // v2.0 credential type,
+ 'bbs-2023' // modern cryptosuite
);
…
const optionsV1 = {
id: hostingUrl,
credentialSubject: {
id: `${hostingUrl}#list`,
type: 'StatusList2021', // v1.1 credential subject type
statusPurpose: purpose,
encodedList,
- };
-}
+ },
+};
…
const credentialStatusPayload = await createCredentialStatusPayload(
{
id: hostingUrl,
credentialSubject: {
id: `${hostingUrl}#list`,
type: 'BitstringStatusList',
statusPurpose: purpose,
encodedList,
},
},
keypairData, // Your key pair data
- 'BitstringStatusListCredential'
+ 'BitstringStatusListCredential',
'ecdsa-sd-2023' // Use 'ecdsa-sd-2023' or 'bbs-2023'
);Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In packages/w3c-credential-status/README.md around lines 172 to 219, the
TypeScript examples contain syntax errors: object literals end with "};" instead
of "}," and some createCredentialStatusPayload calls are missing commas between
the credential type and crypto-suite arguments. Fix by replacing the terminating
"};" on the optionsV2 and optionsV1 objects with "}," (so the surrounding code
remains valid), and add the missing comma between the third and fourth arguments
in each createCredentialStatusPayload call (e.g., between the credential type
string and the crypto-suite string) so the calls are valid comma-separated
argument lists.
| // if vc already exists with v1.1 context and StatusList2021Credential allow BbsBlsSignature2020 | ||
| try { | ||
| // eslint-disable-next-line @typescript-eslint/no-explicit-any | ||
| const credential = (await fetchCredentialStatusVC(id)) as any; | ||
| if (!credential?.['@context']?.includes(VC_V1_URL)) { | ||
| throw new Error( | ||
| 'Please use the recommended BitstringStatusListCredential with modern cryptosuite.', | ||
| ); | ||
| } | ||
| } catch { | ||
| throw new Error( | ||
| 'Credential Status VC not found. For creating new VCs, please use BitstringStatusListCredential with modern cryptosuite.', | ||
| ); | ||
| } |
There was a problem hiding this comment.
Keep the modern-cryptosuite guidance reachable
Line 215 currently throws new Error('Please use the recommended BitstringStatusListCredential…'), but the surrounding try/catch immediately swallows it and replaces it with the generic “Credential Status VC not found…” message. Callers never see the targeted guidance when the VC resolves but lacks the v1 context, which defeats the purpose of that new check. Please separate the fetch failure handling from the context validation so the specific error can bubble up.
- try {
- const credential = (await fetchCredentialStatusVC(id)) as any;
- if (!credential?.['@context']?.includes(VC_V1_URL)) {
- throw new Error(
- 'Please use the recommended BitstringStatusListCredential with modern cryptosuite.',
- );
- }
- } catch {
- throw new Error(
- 'Credential Status VC not found. For creating new VCs, please use BitstringStatusListCredential with modern cryptosuite.',
- );
- }
+ let credential: any;
+ try {
+ credential = (await fetchCredentialStatusVC(id)) as any;
+ } catch {
+ throw new Error(
+ 'Credential Status VC not found. For creating new VCs, please use BitstringStatusListCredential with modern cryptosuite.',
+ );
+ }
+
+ if (!credential?.['@context']?.includes(VC_V1_URL)) {
+ throw new Error(
+ 'Please use the recommended BitstringStatusListCredential with modern cryptosuite.',
+ );
+ }🤖 Prompt for AI Agents
In packages/w3c-credential-status/src/lib/utils.ts around lines 211 to 224, the
try/catch wraps both fetching and context validation so the specific "Please use
the recommended BitstringStatusListCredential…" Error thrown when the VC lacks
the v1 context is swallowed and replaced by the generic fetch failure message;
separate concerns by catching only fetch errors (e.g., try { credential = await
fetchCredentialStatusVC(id) } catch (err) { throw new Error('Credential Status
VC not found...') } ) and perform the context check outside that catch so the
targeted Error for missing v1 context is allowed to propagate to callers.
|
# [1.3.0-alpha.13](https://github.com/TrustVC/w3c/compare/@trustvc/w3c-credential-status@1.3.0-alpha.12...@trustvc/w3c-credential-status@1.3.0-alpha.13) (2025-10-08) ### Features * status list update for bbs and v2.0 ([#89](#89)) ([c49bbfe](c49bbfe))
|
🎉 This PR is included in version 1.3.0-alpha.13 🎉 The release is available on: Your semantic-release bot 📦🚀 |
# [1.3.0-alpha.16](https://github.com/TrustVC/w3c/compare/@trustvc/w3c-vc@1.3.0-alpha.15...@trustvc/w3c-vc@1.3.0-alpha.16) (2025-10-08) ### Features * status list update for bbs and v2.0 ([#89](#89)) ([c49bbfe](c49bbfe))
|
🎉 This PR is included in version 1.3.0-alpha.16 🎉 The release is available on: Your semantic-release bot 📦🚀 |
# [1.3.0-alpha.16](https://github.com/TrustVC/w3c/compare/@trustvc/w3c@1.3.0-alpha.15...@trustvc/w3c@1.3.0-alpha.16) (2025-10-08) ### Features * status list update for bbs and v2.0 ([#89](#89)) ([c49bbfe](c49bbfe))
|
🎉 This PR is included in version 1.3.0-alpha.16 🎉 The release is available on: Your semantic-release bot 📦🚀 |
4 participants
Summary
Summary by CodeRabbit
New Features
Documentation
Tests