Improve validation of VP for JWT VC

Author: nodh

vck/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/ValidatorVcJws.kt

@@ -7,9 +7,15 @@ import at.asitplus.wallet.lib.agent.Verifier.VerifyCredentialResult.*
 import at.asitplus.wallet.lib.agent.Verifier.VerifyPresentationResult
 import at.asitplus.wallet.lib.agent.validation.vcJws.VcJwsInputValidationResult
 import at.asitplus.wallet.lib.agent.validation.vcJws.VcJwsInputValidator
-import at.asitplus.wallet.lib.data.*
 import at.asitplus.wallet.lib.data.VcDataModelConstants.VERIFIABLE_PRESENTATION
-import at.asitplus.wallet.lib.jws.*
+import at.asitplus.wallet.lib.data.VcJwsVerificationResultWrapper
+import at.asitplus.wallet.lib.data.VerifiableCredentialJws
+import at.asitplus.wallet.lib.data.VerifiablePresentationJws
+import at.asitplus.wallet.lib.data.VerifiablePresentationParsed
+import at.asitplus.wallet.lib.jws.VerifyJwsObject
+import at.asitplus.wallet.lib.jws.VerifyJwsObjectFun
+import at.asitplus.wallet.lib.jws.VerifyJwsSignature
+import at.asitplus.wallet.lib.jws.VerifyJwsSignatureFun
 import io.github.aakira.napier.Napier
 import kotlin.coroutines.cancellation.CancellationException
 
@@ -55,7 +61,7 @@ class ValidatorVcJws(
         }
         val vpJws = input.payload.validate(challenge, clientId)
         val vcValidationResults = vpJws.vp.verifiableCredential
-            .map { it to verifyVcJws(it, null) }
+            .map { it to verifyVcJws(it, null, input) }
 
         val invalidVcList = vcValidationResults.filter {
             it.second !is SuccessJwt
@@ -121,24 +127,28 @@ class ValidatorVcJws(
      *
      * @param input JWS in compact representation
      * @param publicKey Optionally, the local key, to verify VC was issued to the correct subject
+     * @param vpJws Optionally, the VP enclosing the VC
      */
     suspend fun verifyVcJws(
         input: JwsSigned<VerifiableCredentialJws>,
         publicKey: CryptoPublicKey?,
-    ) = verifyVcJws(input.serialize(), publicKey)
+        vpJws: JwsSigned<VerifiablePresentationJws>? = null
+    ) = verifyVcJws(input.serialize(), publicKey, vpJws)
 
     /**
      * Validates the content of a JWS, expected to contain a Verifiable Credential.
      *
      * @param input JWS in compact representation
      * @param publicKey Optionally, the local key, to verify VC was issued to the correct subject
+     * @param vpJws Optionally, the VP enclosing the VC
      */
     suspend fun verifyVcJws(
         input: String,
         publicKey: CryptoPublicKey?,
+        vpJws: JwsSigned<VerifiablePresentationJws>? = null
     ): VerifyCredentialResult {
         Napier.d("Validating VC-JWS $input")
-        val validationSummary = vcJwsInputValidator(input, publicKey)
+        val validationSummary = vcJwsInputValidator(input, publicKey, vpJws)
         return when {
             validationSummary !is VcJwsInputValidationResult.ContentValidationSummary -> InvalidStructure(
                 input = input,

vck/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/validation/vcJws/VcJwsInputValidationResult.kt

@@ -21,6 +21,7 @@ sealed interface VcJwsInputValidationResult {
         val isIntegrityGood: Boolean,
         val subjectMatchingResult: SubjectMatchingResult?,
         val contentSemanticsValidationSummary: VcJwsContentSemanticsValidationSummary,
+        val vpMappingValidationSummary: VcJwsToVpJwsMappingValidationSummary?,
     ) : VcJwsInputValidationResult {
         val payload: VerifiableCredentialJws
             get() = parsed.payload
@@ -30,6 +31,7 @@ sealed interface VcJwsInputValidationResult {
                 isIntegrityGood,
                 subjectMatchingResult?.isSuccess != false,
                 contentSemanticsValidationSummary.isSuccess,
+                vpMappingValidationSummary?.isSuccess != false,
             ).all { it }
     }
 }

vck/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/validation/vcJws/VcJwsInputValidator.kt

@@ -5,17 +5,20 @@ import at.asitplus.signum.indispensable.josef.JwsSigned
 import at.asitplus.wallet.lib.agent.matchesIdentifier
 import at.asitplus.wallet.lib.agent.validation.common.SubjectMatchingResult
 import at.asitplus.wallet.lib.data.VerifiableCredentialJws
+import at.asitplus.wallet.lib.data.VerifiablePresentationJws
 import at.asitplus.wallet.lib.data.vckJsonSerializer
 import at.asitplus.wallet.lib.jws.VerifyJwsObject
 import at.asitplus.wallet.lib.jws.VerifyJwsObjectFun
 
 data class VcJwsInputValidator(
     val vcJwsContentSemanticsValidator: VcJwsContentSemanticsValidator = VcJwsContentSemanticsValidator(),
+    val vpJwsMapsToVpJwsValidator: VcJwsToVpJwsMappingValidator = VcJwsToVpJwsMappingValidator(),
     val verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(),
 ) {
     suspend operator fun invoke(
         input: String,
         publicKey: CryptoPublicKey?,
+        vpJws: JwsSigned<VerifiablePresentationJws>?,
     ): VcJwsInputValidationResult {
         val jws = JwsSigned.deserialize<VerifiableCredentialJws>(
             VerifiableCredentialJws.serializer(),
@@ -38,6 +41,7 @@ data class VcJwsInputValidator(
                 )
             },
             contentSemanticsValidationSummary = vcJwsContentSemanticsValidator.invoke(vcJws),
+            vpMappingValidationSummary = vpJws?.let { vpJwsMapsToVpJwsValidator.invoke(vcJws, vpJws) }
         )
     }
 }

vck/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/validation/vcJws/VcJwsToVpJwsMappingValidationSummary.kt

@@ -0,0 +1,22 @@
+package at.asitplus.wallet.lib.agent.validation.vcJws
+
+import at.asitplus.signum.indispensable.CryptoPublicKey
+
+data class VcJwsToVpJwsMappingValidationSummary(
+    val inconsistentIssuerError: InconsistentIssuerError?,
+    val inconsistentPublicKeyError: InconsistentPublicKeyError?,
+) {
+    val isSuccess = listOf(
+        inconsistentIssuerError == null,
+        inconsistentPublicKeyError == null,
+    ).all { it }
+
+    data class InconsistentIssuerError(
+        val vcSubject: String,
+        val vpIssuer: String,
+    )
+    data class InconsistentPublicKeyError(
+        val vcSubject: String,
+        val vpPublicKey: CryptoPublicKey,
+    )
+}

vck/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/validation/vcJws/VcJwsToVpJwsMappingValidator.kt

@@ -0,0 +1,36 @@
+package at.asitplus.wallet.lib.agent.validation.vcJws
+
+import at.asitplus.signum.indispensable.josef.JwsSigned
+import at.asitplus.wallet.lib.agent.matchesIdentifier
+import at.asitplus.wallet.lib.data.VerifiableCredentialJws
+import at.asitplus.wallet.lib.data.VerifiablePresentationJws
+import io.github.aakira.napier.Napier
+
+class VcJwsToVpJwsMappingValidator {
+    operator fun invoke(
+        vcJws: VerifiableCredentialJws,
+        vpJws: JwsSigned<VerifiablePresentationJws>,
+    ) = VcJwsToVpJwsMappingValidationSummary(
+        inconsistentIssuerError = if (vpJws.payload.issuer != vcJws.subject) {
+            Napier.w("vp.iss invalid: ${vpJws.payload.issuer}, but in VC is ${vcJws.subject}")
+            VcJwsToVpJwsMappingValidationSummary.InconsistentIssuerError(
+                vcSubject = vcJws.subject,
+                vpIssuer = vpJws.payload.issuer,
+            )
+        } else null,
+        inconsistentPublicKeyError = vpJws.header.publicKey?.let {
+            if (!vpJws.header.publicKey!!.matchesIdentifier(vcJws.subject)) {
+                Napier.w("vp.key invalid: ${vpJws.header.publicKey}, but in VC is ${vcJws.subject}")
+                VcJwsToVpJwsMappingValidationSummary.InconsistentPublicKeyError(
+                    vcSubject = vcJws.subject,
+                    vpPublicKey = vpJws.header.publicKey!!,
+                )
+            } else null
+        }
+    ).also {
+        if (it.isSuccess) {
+            Napier.d("VC to VP mapping is valid")
+        }
+    }
+}
+

vck/src/commonTest/kotlin/at/asitplus/wallet/lib/agent/ValidatorVpTest.kt

@@ -18,6 +18,7 @@ import at.asitplus.wallet.lib.jws.SignJwtFun
 import com.benasher44.uuid.uuid4
 import io.kotest.core.spec.style.FreeSpec
 import io.kotest.matchers.collections.shouldBeEmpty
+import io.kotest.matchers.collections.shouldBeSingleton
 import io.kotest.matchers.collections.shouldHaveSize
 import io.kotest.matchers.nulls.shouldNotBeNull
 import io.kotest.matchers.shouldBe
@@ -126,6 +127,7 @@ class ValidatorVpTest : FreeSpec({
         ).getOrThrow()
         val holderVc = otherHolder.getCredentials()
             .shouldNotBeNull()
+            .shouldBeSingleton()
             .filterIsInstance<SubjectCredentialStore.StoreEntry.Vc>()
 
         val vp = verifiablePresentationFactory.createVcPresentation(
@@ -137,7 +139,7 @@ class ValidatorVpTest : FreeSpec({
             it.shouldBeInstanceOf<VerifyPresentationResult.Success>()
             it.vp.freshVerifiableCredentials.shouldBeEmpty()
             it.vp.notVerifiablyFreshVerifiableCredentials.shouldBeEmpty()
-            it.vp.invalidVerifiableCredentials.shouldBe(holderVc)
+            it.vp.invalidVerifiableCredentials.shouldBe(holderVc.map { it.vcSerialized })
         }
     }