@credo-ts/core
Version:
<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1
135 lines • 6.09 kB
text/typescript
import { X509Certificate } from "./X509Certificate.mjs";
import { X509RevocationCheckOptions } from "./X509ValidationOptions.mjs";
import { SdJwtVc } from "../sd-jwt-vc/SdJwtVcService.mjs";
import { JwtPayload } from "../../crypto/jose/jwt/JwtPayload.mjs";
import { W3cJwtVerifiableCredential } from "../vc/jwt-vc/W3cJwtVerifiableCredential.mjs";
import { W3cJwtVerifiablePresentation } from "../vc/jwt-vc/W3cJwtVerifiablePresentation.mjs";
import { Mdoc } from "../mdoc/Mdoc.mjs";
import { VerificationTypeMdocReaderAuth } from "../../agent/TrustedIssuersForVerification.mjs";
import { AgentContext } from "../../agent/context/AgentContext.mjs";
//#region src/modules/x509/X509ModuleConfig.d.ts
export type X509VerificationTrustedCertificates = {
issuance: string[];
status?: string[];
};
export type X509VerificationTypeCredential = {
type: 'credential';
credential: SdJwtVc | Mdoc | W3cJwtVerifiableCredential | W3cJwtVerifiablePresentation;
/**
* The `id` of the `DidCommProofRecord` that this verification is bound to.
*/
didcommProofRecordId?: string;
/**
* The `id` of the `OpenId4VcVerificationSessionRecord` that this verification is bound to.
*/
openId4VcVerificationSessionId?: string;
};
/**
* Reader authentication on an incoming mdoc request.
*
* There is no separate legacy shape for this verification type: reader authentication is only
* resolved on the DC API paths that were added after this callback was deprecated, so the type of
* the `getTrustedIssuersForVerification` callback is reused as-is.
*/
export type X509VerificationTypeMdocReaderAuth = VerificationTypeMdocReaderAuth;
export type X509VerificationTypeOauth2SecuredAuthorizationRequest = {
type: 'oauth2SecuredAuthorizationRequest';
authorizationRequest: {
jwt: string;
payload: JwtPayload;
};
};
export type X509VerificationTypeOpenId4VciKeyAttestation = {
type: 'openId4VciKeyAttestation';
/**
* The `id` of the `OpenId4VcIssuanceSessionRecord` that this key
* attestation verification is bound to.
*/
openId4VcIssuanceSessionId: string;
keyAttestation: {
jwt: string;
payload: JwtPayload;
};
};
export type X509VerificationTypeOpenId4VciCredentialIssuerMetadata = {
type: 'openId4VciCredentialIssuerMetadata';
credentialIssuerMetadata: {
jwt: string;
payload: JwtPayload;
};
};
export type X509VerificationTypeOauth2ClientAttestation = {
type: 'oauth2ClientAttestation';
/**
* The `id` of the `OpenId4VcIssuanceSessionRecord` that this client
* attestation verification is bound to.
*/
openId4VcIssuanceSessionId: string;
clientAttestation: {
jwt: string;
payload: JwtPayload;
};
};
export interface X509VerificationContext {
/**
* The certificate chain provided with the data to be verified. The trusted certificates
* are determined before verification and thus it is not verified that the data was actually
* signed by the private key associated with the leaf certificate in the certificate chain, or
* whether the certificate chain is valid. However if the certificate
* does not match, or is not valid, verification will always fail at a later stage
*/
certificateChain: X509Certificate[];
verification: X509VerificationTypeCredential | X509VerificationTypeMdocReaderAuth | X509VerificationTypeOauth2SecuredAuthorizationRequest | X509VerificationTypeOauth2ClientAttestation | X509VerificationTypeOpenId4VciKeyAttestation | X509VerificationTypeOpenId4VciCredentialIssuerMetadata;
}
export interface X509ModuleConfigOptions {
/**
*
* Array of trusted base64-encoded certificate strings in the DER-format.
*/
trustedCertificates?: Array<string | X509Certificate>;
/**
* Optional callback method that will be called to dynamically get trusted certificates for a verification.
* It will provide the `agentContext` and `verificationContext` allowing to dynamically set the trusted certificates
* for a tenant or verification context.
*
* If no certificates should be trusted an empty array should be returned. If `undefined` is returned
* it will fallback to the globally registered trusted certificates
*
* @deprecated use the global `getTrustedIssuersForVerification` instead
* @returns An array of base64-encoded certificate strings or PEM certificate strings.
*/
getTrustedCertificatesForVerification?(agentContext: AgentContext, verificationContext: X509VerificationContext): Promise<string[] | undefined | X509VerificationTrustedCertificates[]> | string[] | X509VerificationTrustedCertificates[] | undefined;
/**
* Configuration for certificate revocation checking
* @default
* ```
* {
* mode: X509RevocationCheckMode.SoftFail, // do not fail on network error
* checkFullChain: true, // check the leaf and all intermediate CAs
* timeoutMs: 5000, // 5 seconds
* maxCrlSizeBytes: 10485760, // 10MB
* crlCacheExpirySeconds: 3600 // 1 hour
* }
* ```
*/
revocationCheck?: X509RevocationCheckOptions;
}
export declare class X509ModuleConfig {
#private;
constructor(options?: X509ModuleConfigOptions);
get trustedCertificates(): string[] | undefined;
/**
* @deprecated use the global `getTrustedIssuersForVerification` instead
*/
get getTrustedCertificatesForVerification(): ((agentContext: AgentContext, verificationContext: X509VerificationContext) => Promise<string[] | undefined | X509VerificationTrustedCertificates[]> | string[] | X509VerificationTrustedCertificates[] | undefined) | undefined;
/**
* @deprecated use the global `getTrustedIssuersForVerification` instead
*/
setTrustedCertificatesForVerification(fn: X509ModuleConfigOptions['getTrustedCertificatesForVerification']): void;
get revocationCheck(): X509RevocationCheckOptions | undefined;
setRevocationCheck(options?: X509RevocationCheckOptions): void;
setTrustedCertificates(trustedCertificates?: Array<string | X509Certificate>): void;
addTrustedCertificate(trustedCertificate: string | X509Certificate): void;
}
//#endregion
//# sourceMappingURL=X509ModuleConfig.d.mts.map