@credo-ts/core/build/agent/TrustedIssuerContext.mjs

<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1

import { CredoError } from "../error/CredoError.mjs";
import "../error/index.mjs";
import { X509Certificate } from "../modules/x509/X509Certificate.mjs";
import { X509Service } from "../modules/x509/X509Service.mjs";
import { parseDid } from "../modules/dids/domain/parse.mjs";
import "../modules/dids/index.mjs";
//#region src/agent/TrustedIssuerContext.ts
var TrustedIssuerContext = class TrustedIssuerContext {
	static async getTrustedIssuersForVerification(agentContext, context) {
		const trustedIssuers = await agentContext.config.getTrustedIssuersForVerification?.(agentContext, context);
		if (!trustedIssuers) return void 0;
		for (const trustedIssuer of trustedIssuers.trustedIssuers) if (context.signer.method !== trustedIssuer.method) throw new CredoError(`All trusted issuer methods must match the signer method (${context.signer.method}). Found method ${trustedIssuer.method}`);
		return { trustedIssuers: trustedIssuers.trustedIssuers };
	}
	static async ensureTrustedSigner(agentContext, context, _trustedIssuers) {
		const signer = context.signer;
		const trustedIssuers = _trustedIssuers ?? (await TrustedIssuerContext.getTrustedIssuersForVerification(agentContext, context))?.trustedIssuers;
		if (signer.method === "x509") {
			if (!trustedIssuers) throw new CredoError("No trusted certificates configured for X509 certificate chain validation. Signer cannot be verified.");
			const x509Issuers = trustedIssuers.filter((t) => t.method === "x509");
			const trustAnchor = (await X509Service.validateCertificateChain(agentContext, {
				certificateChain: signer.certificateChain.map((certificate) => certificate.toString("base64")),
				trustedCertificates: x509Issuers.flatMap((t) => t.issuance)
			}))[0];
			return { trustedIssuer: x509Issuers.find((t) => t.issuance.some((certificate) => X509Certificate.fromEncodedCertificate(certificate).equal(trustAnchor))) };
		}
		if (signer.method === "did") {
			if (!trustedIssuers) return { trustedIssuer: void 0 };
			const didIssuers = trustedIssuers?.filter((t) => t.method === "did");
			const signerDid = parseDid(signer.didUrl);
			const trustedIssuer = didIssuers.find((t) => {
				const did = parseDid(t.issuance);
				return signerDid.did === did.did;
			});
			if (!trustedIssuer) throw new CredoError(`Signer did ${signerDid.did} is not trusted. Unable to verify signature.`);
			return { trustedIssuer };
		}
		throw new CredoError("Unknown trusted entity signer method");
	}
};
//#endregion
export { TrustedIssuerContext };

//# sourceMappingURL=TrustedIssuerContext.mjs.map