@sphereon/did-auth-siop-adapter/lib/DidJwtAdapter.ts

Self Issued OpenID V2 (SIOPv2) and OpenID 4 Verifiable Presentations (OID4VP) did adapter

import { AuthorizationRequestPayload, IDTokenPayload, JwtIssuerWithContext, JwtVerifier, RequestObjectPayload } from '@sphereon/did-auth-siop'
import { JwtHeader, JwtPayload } from '@sphereon/oid4vc-common'
import { Resolvable } from 'did-resolver'

import { getAudience, getSubDidFromPayload, signIDTokenPayload, signRequestObjectPayload, validateLinkedDomainWithDid, verifyDidJWT } from './did'
import { CheckLinkedDomain, ExternalSignature, ExternalVerification, InternalSignature, InternalVerification, SuppliedSignature } from './types'

export const verfiyDidJwtAdapter = async (
  jwtVerifier: JwtVerifier,
  jwt: { header: JwtHeader; payload: JwtPayload; raw: string },
  options: {
    verification: InternalVerification | ExternalVerification
    resolver: Resolvable
  },
): Promise<boolean> => {
  if (jwtVerifier.method === 'did') {
    const audience = options?.verification?.resolveOpts?.jwtVerifyOpts?.audience ?? getAudience(jwt.raw)

    await verifyDidJWT(jwt.raw, options.resolver, { ...options.verification?.resolveOpts?.jwtVerifyOpts, audience })

    if (jwtVerifier.type === 'request-object' && (jwt.payload as JwtPayload & { client_id?: string }).client_id?.startsWith('did:')) {
      const authorizationRequestPayload = jwt.payload as AuthorizationRequestPayload
      if (options.verification?.checkLinkedDomain && options.verification.checkLinkedDomain != CheckLinkedDomain.NEVER) {
        if (!authorizationRequestPayload.client_id) {
          return Promise.reject(Error('missing client_id from AuthorizationRequestPayload'))
        }
        await validateLinkedDomainWithDid(authorizationRequestPayload.client_id, options.verification)
      } else if (!options.verification?.checkLinkedDomain && options.verification.wellknownDIDVerifyCallback) {
        if (!authorizationRequestPayload.client_id) {
          return Promise.reject(Error('missing client_id from AuthorizationRequestPayload'))
        }
        await validateLinkedDomainWithDid(authorizationRequestPayload.client_id, options.verification)
      }
    }

    if (jwtVerifier.type === 'id-token') {
      const issuerDid = getSubDidFromPayload(jwt.payload)
      if (options.verification?.checkLinkedDomain && options.verification.checkLinkedDomain != CheckLinkedDomain.NEVER) {
        await validateLinkedDomainWithDid(issuerDid, options.verification)
      } else if (!options.verification?.checkLinkedDomain && options.verification.wellknownDIDVerifyCallback) {
        await validateLinkedDomainWithDid(issuerDid, options.verification)
      }
    }

    return true
  }

  throw new Error('Invalid use of the did-auth-siop create jwt adapter')
}

export const createDidJwtAdapter = async (
  signature: InternalSignature | ExternalSignature | SuppliedSignature,
  jwtIssuer: JwtIssuerWithContext,
  jwt: { header: JwtHeader; payload: JwtPayload },
): Promise<string> => {
  if (jwtIssuer.method === 'did') {
    const issuer = jwtIssuer.didUrl.split('#')[0]
    jwt.payload.issuer = issuer
    if (jwtIssuer.type === 'request-object') {
      return await signRequestObjectPayload(jwt.payload as RequestObjectPayload, signature)
    } else if (jwtIssuer.type === 'id-token') {
      return await signIDTokenPayload(jwt.payload as IDTokenPayload, signature)
    }
  }
  throw new Error('Invalid use of the did-auth-siop create jwt adapter')
}