generated from cyware/cyware-project-template
-
Notifications
You must be signed in to change notification settings - Fork 0
/
verification.go
198 lines (180 loc) · 7.82 KB
/
verification.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
package verification
import (
"context"
"fmt"
"strings"
credsdk "github.com/cyware/ssi-sdk/credential"
"github.com/cyware/ssi-sdk/credential/integrity"
schemalib "github.com/cyware/ssi-sdk/credential/schema"
"github.com/cyware/ssi-sdk/credential/validation"
"github.com/cyware/ssi-sdk/crypto"
"github.com/cyware/ssi-sdk/crypto/jwx"
"github.com/cyware/ssi-sdk/cryptosuite/jws2020"
"github.com/cyware/ssi-sdk/did/resolution"
sdkutil "github.com/cyware/ssi-sdk/util"
"github.com/cyware/ssi-service/config"
"github.com/cyware/ssi-service/pkg/service/framework"
"github.com/goccy/go-json"
"github.com/pkg/errors"
"github.com/cyware/ssi-service/internal/credential"
didint "github.com/cyware/ssi-service/internal/did"
"github.com/cyware/ssi-service/internal/keyaccess"
"github.com/cyware/ssi-service/internal/schema"
)
type Verifier struct {
validator *validation.CredentialValidator
didResolver resolution.Resolver
schemaResolver schema.Resolution
}
// NewVerifiableDataVerifier creates a new verifier for both verifiable credentials and verifiable presentations. The verifier
// executes both signature and static verification checks. In the future the set of verification checks will be configurable.
func NewVerifiableDataVerifier(didResolver resolution.Resolver, schemaResolver schema.Resolution) (*Verifier, error) {
if didResolver == nil {
return nil, errors.New("didResolver cannot be nil")
}
if schemaResolver == nil {
return nil, errors.New("schemaResolver cannot be nil")
}
// TODO(gabe): consider making this configurable
validators := validation.GetKnownVerifiers()
validator, err := validation.NewCredentialValidator(validators)
if err != nil {
return nil, errors.Wrap(err, "creating static validator")
}
return &Verifier{
validator: validator,
didResolver: didResolver,
schemaResolver: schemaResolver,
}, nil
}
// VerifyCredential first parses and checks the signature on the given credential. Next, it runs
// a set of static verification checks on the credential as per the service's configuration.
// Works for both JWT and LD securing mechanisms.
func (v Verifier) VerifyCredential(ctx context.Context, credential credential.Container) error {
if credential.HasJWTCredential() {
err := v.VerifyJWTCredential(ctx, *credential.CredentialJWT)
if err != nil {
return err
}
} else {
if err := v.VerifyDataIntegrityCredential(ctx, *credential.Credential); err != nil {
return err
}
}
return nil
}
// VerifyJWTCredential first parses and checks the signature on the given JWT verification. Next, it runs
// a set of static verification checks on the credential as per the service's configuration.
func (v Verifier) VerifyJWTCredential(ctx context.Context, token keyaccess.JWT) error {
_, err := integrity.VerifyJWTCredential(ctx, token.String(), v.didResolver)
if err != nil {
return errors.Wrap(err, "verifying JWT credential")
}
_, _, cred, err := integrity.ParseVerifiableCredentialFromJWT(token.String())
if err != nil {
return errors.Wrap(err, "parsing vc from jwt")
}
return v.staticValidationChecks(ctx, *cred)
}
// VerifyDataIntegrityCredential first checks the signature on the given data integrity verification. Next, it runs
// a set of static verification checks on the credential as per the service's configuration.
func (v Verifier) VerifyDataIntegrityCredential(ctx context.Context, credential credsdk.VerifiableCredential) error {
// resolve the issuer's key material
issuer, ok := credential.Issuer.(string)
if !ok {
return sdkutil.LoggingNewErrorf("could not convert issuer to string: %v", credential.Issuer)
}
maybeVerificationMethod, err := getKeyFromProof(*credential.Proof, "verificationMethod")
if err != nil {
return sdkutil.LoggingErrorMsg(err, "could not get verification method from proof")
}
verificationMethod, ok := maybeVerificationMethod.(string)
if !ok {
return sdkutil.LoggingNewErrorf("could not convert verification method to string: %v", maybeVerificationMethod)
}
pubKey, err := didint.ResolveKeyForDID(ctx, v.didResolver, issuer, verificationMethod)
if err != nil {
return sdkutil.LoggingError(err)
}
// construct a signature validator from the verification information
publicKeyJWK, err := jwx.PublicKeyToPublicKeyJWK(verificationMethod, pubKey)
if err != nil {
return sdkutil.LoggingErrorMsgf(err, "could not convert private key to JWK: %s", verificationMethod)
}
verifier, err := jws2020.NewJSONWebKeyVerifier(issuer, *publicKeyJWK)
if err != nil {
errMsg := fmt.Sprintf("could not create validator for kid %s", verificationMethod)
return sdkutil.LoggingErrorMsg(err, errMsg)
}
cryptoSuite := jws2020.GetJSONWebSignature2020Suite()
// verify the signature on the credential
if err = cryptoSuite.Verify(verifier, &credential); err != nil {
return sdkutil.LoggingErrorMsg(err, "could not verify the credential's signature")
}
return v.staticValidationChecks(ctx, credential)
}
// VerifyJWTPresentation first parses and checks the signature on the given JWT presentation. Next, it runs
// a set of static verification checks on the presentation's credentials as per the service's configuration.
func (v Verifier) VerifyJWTPresentation(ctx context.Context, token keyaccess.JWT) error {
_, err := integrity.VerifyJWTPresentation(ctx, token.String(), v.didResolver)
if err != nil {
return errors.Wrap(err, "verifying JWT presentation")
}
_, _, pres, err := integrity.ParseVerifiablePresentationFromJWT(token.String())
if err != nil {
return errors.Wrap(err, "parsing vc from jwt")
}
// for each credential in the presentation, run a set of static verification checks
creds, err := credential.NewCredentialContainerFromArray(pres.VerifiableCredential)
if err != nil {
return errors.Wrapf(err, "error parsing credentials in presentation<%s>", pres.ID)
}
for _, cred := range creds {
if err = v.staticValidationChecks(ctx, *cred.Credential); err != nil {
return errors.Wrapf(err, "error running static validation checks on credential in presentation<%v>", cred.ID)
}
}
return nil
}
func getKeyFromProof(proof crypto.Proof, key string) (any, error) {
proofBytes, err := json.Marshal(proof)
if err != nil {
return nil, err
}
var proofMap map[string]any
if err = json.Unmarshal(proofBytes, &proofMap); err != nil {
return nil, err
}
return proofMap[key], nil
}
// staticValidationChecks runs a set of static validation checks on the credential as per the
// service's configuration, such as checking the verification's schema, expiration, and object validity.
func (v Verifier) staticValidationChecks(ctx context.Context, credential credsdk.VerifiableCredential) error {
// if the credential has a schema, resolve it before it is to be used in verification
var validationOpts []validation.Option
if credential.CredentialSchema != nil {
schemaID := strings.Replace(credential.CredentialSchema.ID, config.GetServicePath(framework.Schema)+"/", "", 1)
resolvedSchema, resolvedSchemaCred, schemaType, err := v.schemaResolver.Resolve(ctx, schemaID)
if err != nil {
return errors.Wrapf(err, "for credential<%s> failed to resolve schemas: %s", credential.ID, schemaID)
}
if schemaType == schemalib.JSONSchemaType {
schemaBytes, err := json.Marshal(resolvedSchema)
if err != nil {
return errors.Wrapf(err, "for credential<%s> failed to marshal schema: %s", credential.ID, schemaID)
}
validationOpts = append(validationOpts, validation.WithSchema(string(schemaBytes)))
} else {
schemaCredBytes, err := json.Marshal(resolvedSchemaCred)
if err != nil {
return errors.Wrap(err, "marshalling json schema credential")
}
validationOpts = append(validationOpts, validation.WithSchema(string(schemaCredBytes)))
}
}
// run the configured static checks on the credential
if err := v.validator.ValidateCredential(credential, validationOpts...); err != nil {
return sdkutil.LoggingErrorMsg(err, "static credential validation failed")
}
return nil
}