Make sure JWT VC subjects are correct

Author: nodh

vck-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/openid/OpenId4VpVerifier.kt

@@ -704,9 +704,6 @@ open class OpenId4VpVerifier(
     }
 
     private fun VerifyPresentationResult.mapToAuthnResponseResult(state: String) = when (this) {
-        is VerifyPresentationResult.InvalidStructure -> AuthnResponseResult.Error("parse vp failed", state)
-            .also { Napier.w("VP error: $this") }
-
         is VerifyPresentationResult.ValidationError -> AuthnResponseResult.ValidationError("vpToken", state, cause)
             .also { Napier.w("VP error: $this", cause) }
 

vck/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/ValidatorMdoc.kt

@@ -160,8 +160,12 @@ class ValidatorMdoc(
      */
     suspend fun verifyIsoCred(it: IssuerSigned, issuerKey: CoseKey?): VerifyCredentialResult {
         Napier.d("Verifying ISO Cred $it")
-        if (!mdocInputValidator(it, issuerKey).isSuccess) {
-            return InvalidStructure(coseCompliantSerializer.encodeToByteArray(it).encodeToString(Base16Strict))
+        val mdocInputValidator = mdocInputValidator(it, issuerKey)
+        if (!mdocInputValidator.isSuccess) {
+            return InvalidStructure(
+                input = coseCompliantSerializer.encodeToByteArray(it).encodeToString(Base16Strict),
+                reason = mdocInputValidator.integrityValidationSummary.toString()
+            )
         }
         return SuccessIso(it)
     }

vck/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/ValidatorVcJws.kt

@@ -140,11 +140,27 @@ class ValidatorVcJws(
         Napier.d("Validating VC-JWS $input")
         val validationSummary = vcJwsInputValidator(input, publicKey)
         return when {
-            validationSummary !is VcJwsInputValidationResult.ContentValidationSummary -> InvalidStructure(input)
-            !validationSummary.isIntegrityGood -> InvalidStructure(input)
-            !validationSummary.contentSemanticsValidationSummary.isSuccess -> InvalidStructure(input)
-            validationSummary.subjectMatchingResult?.isSuccess == false -> ValidationError("subject not matching key")
-            validationSummary.isSuccess -> SuccessJwt(validationSummary.payload)
+            validationSummary !is VcJwsInputValidationResult.ContentValidationSummary -> InvalidStructure(
+                input = input,
+                reason = validationSummary.toString()
+            )
+
+            !validationSummary.isIntegrityGood -> InvalidStructure(
+                input = input,
+                reason = "!isIntegrityGood"
+            )
+
+            !validationSummary.contentSemanticsValidationSummary.isSuccess -> InvalidStructure(
+                input = input,
+                reason = validationSummary.contentSemanticsValidationSummary.toString()
+            )
+
+            validationSummary.subjectMatchingResult?.isSuccess == false ->
+                ValidationError("subject not matching key")
+
+            validationSummary.isSuccess ->
+                SuccessJwt(validationSummary.payload)
+
             else -> ValidationError(input) // this branch shouldn't be executed anyway
         }
     }

vck/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/Verifier.kt

@@ -72,10 +72,6 @@ interface Verifier {
             val documents: List<IsoDocumentParsed>,
         ) : VerifyPresentationResult()
 
-        data class InvalidStructure(
-            val input: String,
-        ) : VerifyPresentationResult()
-
         data class ValidationError(
             val cause: Throwable,
         ) : VerifyPresentationResult() {
@@ -102,6 +98,7 @@ interface Verifier {
 
         data class InvalidStructure(
             val input: String,
+            val reason: String,
         ) : VerifyCredentialResult()
 
         data class ValidationError(

vck/src/commonTest/kotlin/at/asitplus/wallet/lib/agent/ValidatorVcTest.kt

@@ -233,7 +233,7 @@ class ValidatorVcTest : FreeSpec() {
                     .let {
                         VerifiableCredentialJws(
                             vc = it,
-                            subject = "urn:${uuid4()}",
+                            subject = it.credentialSubject.id,
                             notBefore = it.issuanceDate,
                             issuer = it.issuer,
                             expiration = Clock.System.now() + 1.hours,
@@ -388,7 +388,7 @@ class ValidatorVcTest : FreeSpec() {
 
     private fun wrapVcInJws(
         it: VerifiableCredential,
-        subject: String = verifierKeyMaterial.identifier,
+        subject: String = it.credentialSubject.id,
         issuer: String = it.issuer,
         jwtId: String = it.id,
         issuanceDate: Instant = it.issuanceDate,