Address CodeRabbit comments

Signed-off-by: Alexander Shenshin <alexander.shenshin@dsr-corporation.com>

Author: AlexanderShenshin

heka-identity-service/src/openid4vc/issuance-sessions/__tests__/issuance-session.service.test.ts

@@ -1,6 +1,6 @@
 import { OpenId4VciCredentialFormatProfile } from '@credo-ts/openid4vc'
 import { createMock } from '@golevelup/ts-vitest'
-import { UnprocessableEntityException } from '@nestjs/common'
+import { BadRequestException, UnprocessableEntityException } from '@nestjs/common'
 import { ConfigType } from '@nestjs/config'
 
 import { TenantAgent } from 'common/agent'
@@ -348,6 +348,15 @@ describe('OpenId4VcIssuanceSessionService', () => {
       )
       expect(result.credentialOffer).toBe('openid-credential-offer://jwt')
       expect(statusListService.addItems).toHaveBeenCalledWith(authInfo, 'sl-1', [5])
+      // The index reserved in the status list must be the one the issued credential carries,
+      // otherwise the credential points at a bit that is never set on revocation.
+      expect(tenantAgent.openid4vc.issuer.createCredentialOffer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          issuanceMetadata: expect.objectContaining({
+            credentials: [expect.objectContaining({ credentialStatus: expect.objectContaining({ index: 5 }) })],
+          }),
+        }),
+      )
     })
 
     test('should create issuance session for JwtVcJsonLd format WITH credentialStatus', async () => {
@@ -402,6 +411,13 @@ describe('OpenId4VcIssuanceSessionService', () => {
       await service.offer(authInfo, tenantAgent, req)
 
       expect(statusListService.addItems).toHaveBeenCalledWith(authInfo, 'sl-2', [10])
+      expect(tenantAgent.openid4vc.issuer.createCredentialOffer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          issuanceMetadata: expect.objectContaining({
+            credentials: [expect.objectContaining({ credentialStatus: expect.objectContaining({ index: 10 }) })],
+          }),
+        }),
+      )
     })
 
     test('should create issuance session for LdpVc format WITH credentialStatus', async () => {
@@ -456,6 +472,61 @@ describe('OpenId4VcIssuanceSessionService', () => {
       await service.offer(authInfo, tenantAgent, req)
 
       expect(statusListService.addItems).toHaveBeenCalledWith(authInfo, 'sl-3', [0])
+      expect(tenantAgent.openid4vc.issuer.createCredentialOffer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          issuanceMetadata: expect.objectContaining({
+            credentials: [expect.objectContaining({ credentialStatus: expect.objectContaining({ index: 0 }) })],
+          }),
+        }),
+      )
+    })
+
+    test('should reject an over-capacity batch before creating the credential offer', async () => {
+      const mockIssuer = issuerRecordStub({
+        issuerId: 'issuer-1',
+        credentialConfigurationsSupported: {
+          'cred-jwt-1': {
+            format: 'jwt_vc_json',
+            credential_definition: { type: ['VerifiableCredential'] },
+          },
+        },
+      })
+
+      vi.mocked(tenantAgent.openid4vc.issuer.getIssuerByIssuerId).mockResolvedValue(mockIssuer)
+      // One free slot (lastIndex 99 of size 100) but two revocable credentials requested
+      vi.mocked(statusListService.getOrCreate).mockResolvedValue({ id: 'sl-4', lastIndex: 99, size: 100 } as any)
+      vi.mocked(statusListService.location).mockReturnValue('https://example.com/status-lists/sl-4')
+      vi.mocked(tenantAgent.dids.resolve).mockResolvedValue(
+        didResolutionResultStub({
+          didDocument: { verificationMethod: [{ id: 'did:key:z6MkJwt#key-1' }] },
+        }),
+      )
+      vi.mocked(statusListService.assertHasFreeIndexes).mockImplementation(() => {
+        throw new BadRequestException('Status list does not have enough free indexes')
+      })
+
+      const req = {
+        publicIssuerId: 'issuer-1',
+        credentials: [
+          {
+            credentialSupportedId: 'cred-jwt-1',
+            format: OpenId4VciCredentialFormatProfile.JwtVcJson,
+            issuer: { did: 'did:key:z6MkJwt' },
+          },
+          {
+            credentialSupportedId: 'cred-jwt-1',
+            format: OpenId4VciCredentialFormatProfile.JwtVcJson,
+            issuer: { did: 'did:key:z6MkJwt' },
+          },
+        ],
+        baseUri: 'https://example.com',
+      } as any
+
+      await expect(service.offer(authInfo, tenantAgent, req)).rejects.toThrow(BadRequestException)
+
+      // The point of the preflight: nothing irreversible may happen once capacity is known to be short
+      expect(tenantAgent.openid4vc.issuer.createCredentialOffer).not.toHaveBeenCalled()
+      expect(statusListService.addItems).not.toHaveBeenCalled()
     })
 
     test('should create issuance session for MsoMdoc format without DID resolution or credentialStatus', async () => {

heka-identity-service/src/openid4vc/issuance-sessions/issuance-session.service.ts

@@ -129,6 +129,11 @@ export class OpenId4VcIssuanceSessionService {
       mappedCredentials.push(credentialIssuanceMeta)
     }
 
+    // Preflight status list capacity check before the offer is created
+    if (credentialIndexes.length) {
+      this.statusListService.assertHasFreeIndexes(statusList, credentialIndexes.length)
+    }
+
     const { credentialOffer, issuanceSession } = await tenantAgent.openid4vc.issuer.createCredentialOffer({
       baseUri: req.baseUri,
       credentialConfigurationIds: req.credentials.map((c) => c.credentialSupportedId),

heka-identity-service/src/revocation/status-list/__tests__/status-list.service.test.ts

@@ -1,6 +1,6 @@
 import { createMock } from '@golevelup/ts-vitest'
 import { EntityManager } from '@mikro-orm/core'
-import { BadRequestException } from '@nestjs/common'
+import { BadRequestException, InternalServerErrorException } from '@nestjs/common'
 import { ConfigType } from '@nestjs/config'
 
 import { entityStub } from '../../../../test/helpers/mock-records'
@@ -260,8 +260,27 @@ describe('StatusListService', () => {
 
       vi.mocked(em.findOneOrFail).mockResolvedValue(statusListEntity)
 
-      // Only 1 free slot remains (lastIndex 99 of size 100), so adding 2 items must be rejected
-      await expect(service.addItems(authInfo, id, [100, 101])).rejects.toThrow(BadRequestException)
+      // Only 1 free slot remains (lastIndex 99 of size 100), so adding 2 items must be rejected.
+      // The indexes are deliberately in-range so that only the capacity guard can reject them —
+      // out-of-range indexes would also trip the per-index bound and mask its removal.
+      await expect(service.addItems(authInfo, id, [0, 99])).rejects.toThrow(BadRequestException)
+      expect(mockSet).not.toHaveBeenCalled()
+      expect(em.flush).not.toHaveBeenCalled()
+    })
+
+    test('should fail as a server error when the stored list is not Multibase-encoded', async () => {
+      const id = 'status-list-1'
+      const statusListEntity = entityStub<CredentialStatusList>({
+        id,
+        encodedList: 'H4sIunprefixed-legacy-value',
+        lastIndex: 5,
+        size: 100,
+        owner: mockUser,
+      })
+
+      vi.mocked(em.findOneOrFail).mockResolvedValue(statusListEntity)
+
+      await expect(service.addItems(authInfo, id, [10])).rejects.toThrow(InternalServerErrorException)
       expect(mockSet).not.toHaveBeenCalled()
       expect(em.flush).not.toHaveBeenCalled()
     })

heka-identity-service/src/revocation/status-list/status-list.service.ts

@@ -1,6 +1,6 @@
 import { Bitstring } from '@digitalcredentials/bitstring'
 import { EntityManager } from '@mikro-orm/core'
-import { BadRequestException, Inject, Injectable } from '@nestjs/common'
+import { BadRequestException, Inject, Injectable, InternalServerErrorException } from '@nestjs/common'
 import { ConfigType } from '@nestjs/config'
 
 import { CredentialStatusList } from 'common/entities'
@@ -26,7 +26,7 @@ function toMultibaseBase64url(base64url: string): string {
 
 function fromMultibaseBase64url(encodedList: string): string {
   if (!encodedList.startsWith(MULTIBASE_BASE64URL_PREFIX)) {
-    throw new BadRequestException('Status list encodedList is not Multibase base64url-encoded')
+    throw new InternalServerErrorException('Stored status list is not Multibase base64url-encoded')
   }
   return encodedList.slice(MULTIBASE_BASE64URL_PREFIX.length)
 }
@@ -90,12 +90,16 @@ export class StatusListService {
     return list ?? (await this.create(authInfo, { issuer }))
   }
 
+  public assertHasFreeIndexes(statusList: CredentialStatusList, count: number): void {
+    if (statusList.lastIndex + count > statusList.size) {
+      throw new BadRequestException('Status list does not have enough free indexes')
+    }
+  }
+
   public async addItems(authInfo: AuthInfo, id: string, indexes: Array<number>): Promise<void> {
     const statusList = await this.em.findOneOrFail(CredentialStatusList, { id, owner: authInfo.user })
 
-    if (statusList.lastIndex + indexes.length > statusList.size) {
-      throw new BadRequestException('Status list does not have enough free indexes')
-    }
+    this.assertHasFreeIndexes(statusList, indexes.length)
 
     statusList.encodedList = await this.updatedBitstring(statusList.encodedList, statusList.size, indexes, false)
     statusList.lastIndex += indexes.length