Fix status list indexed validation (#185)

Signed-off-by: Alexander Shenshin <alexander.shenshin@dsr-corporation.com>
Co-authored-by: abhay-dev2901 <abhay-dev2901@users.noreply.github.com>

Author: AlexanderShenshin

heka-identity-service/src/common/entities/credential-status-list.entity.ts

@@ -18,7 +18,12 @@ interface CredentialStatusListProps {
   owner: User
 }
 
-export const defaultCredentialStatusListSize = 100
+// W3C Bitstring Status List v1.0 sets a 16KB = 131,072-bit minimum for herd privacy (§2.2, §3.3)
+export const defaultCredentialStatusListSize = 131072
+
+// Upper bound on a caller-supplied size: 2^23 bits = 1MB buffer
+// Without it an API request can allocate an arbitrarily large bitstring
+export const maxCredentialStatusListSize = 8388608
 
 @Entity()
 export class CredentialStatusList extends Identified {

heka-identity-service/src/openid4vc/issuance-sessions/__tests__/issuance-session.service.test.ts

@@ -1,6 +1,6 @@
 import { OpenId4VciCredentialFormatProfile } from '@credo-ts/openid4vc'
 import { createMock } from '@golevelup/ts-vitest'
-import { UnprocessableEntityException } from '@nestjs/common'
+import { BadRequestException, UnprocessableEntityException } from '@nestjs/common'
 import { ConfigType } from '@nestjs/config'
 
 import { TenantAgent } from 'common/agent'
@@ -347,7 +347,16 @@ describe('OpenId4VcIssuanceSessionService', () => {
         expect.objectContaining({ issuerId: 'issuer-1' }),
       )
       expect(result.credentialOffer).toBe('openid-credential-offer://jwt')
-      expect(statusListService.addItems).toHaveBeenCalledWith(authInfo, 'sl-1', [6])
+      expect(statusListService.addItems).toHaveBeenCalledWith(authInfo, 'sl-1', [5])
+      // The index reserved in the status list must be the one the issued credential carries,
+      // otherwise the credential points at a bit that is never set on revocation.
+      expect(tenantAgent.openid4vc.issuer.createCredentialOffer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          issuanceMetadata: expect.objectContaining({
+            credentials: [expect.objectContaining({ credentialStatus: expect.objectContaining({ index: 5 }) })],
+          }),
+        }),
+      )
     })
 
     test('should create issuance session for JwtVcJsonLd format WITH credentialStatus', async () => {
@@ -401,7 +410,14 @@ describe('OpenId4VcIssuanceSessionService', () => {
 
       await service.offer(authInfo, tenantAgent, req)
 
-      expect(statusListService.addItems).toHaveBeenCalledWith(authInfo, 'sl-2', [11])
+      expect(statusListService.addItems).toHaveBeenCalledWith(authInfo, 'sl-2', [10])
+      expect(tenantAgent.openid4vc.issuer.createCredentialOffer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          issuanceMetadata: expect.objectContaining({
+            credentials: [expect.objectContaining({ credentialStatus: expect.objectContaining({ index: 10 }) })],
+          }),
+        }),
+      )
     })
 
     test('should create issuance session for LdpVc format WITH credentialStatus', async () => {
@@ -455,7 +471,62 @@ describe('OpenId4VcIssuanceSessionService', () => {
 
       await service.offer(authInfo, tenantAgent, req)
 
-      expect(statusListService.addItems).toHaveBeenCalledWith(authInfo, 'sl-3', [1])
+      expect(statusListService.addItems).toHaveBeenCalledWith(authInfo, 'sl-3', [0])
+      expect(tenantAgent.openid4vc.issuer.createCredentialOffer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          issuanceMetadata: expect.objectContaining({
+            credentials: [expect.objectContaining({ credentialStatus: expect.objectContaining({ index: 0 }) })],
+          }),
+        }),
+      )
+    })
+
+    test('should reject an over-capacity batch before creating the credential offer', async () => {
+      const mockIssuer = issuerRecordStub({
+        issuerId: 'issuer-1',
+        credentialConfigurationsSupported: {
+          'cred-jwt-1': {
+            format: 'jwt_vc_json',
+            credential_definition: { type: ['VerifiableCredential'] },
+          },
+        },
+      })
+
+      vi.mocked(tenantAgent.openid4vc.issuer.getIssuerByIssuerId).mockResolvedValue(mockIssuer)
+      // One free slot (lastIndex 99 of size 100) but two revocable credentials requested
+      vi.mocked(statusListService.getOrCreate).mockResolvedValue({ id: 'sl-4', lastIndex: 99, size: 100 } as any)
+      vi.mocked(statusListService.location).mockReturnValue('https://example.com/status-lists/sl-4')
+      vi.mocked(tenantAgent.dids.resolve).mockResolvedValue(
+        didResolutionResultStub({
+          didDocument: { verificationMethod: [{ id: 'did:key:z6MkJwt#key-1' }] },
+        }),
+      )
+      vi.mocked(statusListService.assertHasFreeIndexes).mockImplementation(() => {
+        throw new BadRequestException('Status list does not have enough free indexes')
+      })
+
+      const req = {
+        publicIssuerId: 'issuer-1',
+        credentials: [
+          {
+            credentialSupportedId: 'cred-jwt-1',
+            format: OpenId4VciCredentialFormatProfile.JwtVcJson,
+            issuer: { did: 'did:key:z6MkJwt' },
+          },
+          {
+            credentialSupportedId: 'cred-jwt-1',
+            format: OpenId4VciCredentialFormatProfile.JwtVcJson,
+            issuer: { did: 'did:key:z6MkJwt' },
+          },
+        ],
+        baseUri: 'https://example.com',
+      } as any
+
+      await expect(service.offer(authInfo, tenantAgent, req)).rejects.toThrow(BadRequestException)
+
+      // The point of the preflight: nothing irreversible may happen once capacity is known to be short
+      expect(tenantAgent.openid4vc.issuer.createCredentialOffer).not.toHaveBeenCalled()
+      expect(statusListService.addItems).not.toHaveBeenCalled()
     })
 
     test('should create issuance session for MsoMdoc format without DID resolution or credentialStatus', async () => {

heka-identity-service/src/openid4vc/issuance-sessions/issuance-session.service.ts

@@ -1,8 +1,8 @@
 import { SdJwtVcPayload } from '@credo-ts/core'
 import {
   OpenId4VciCredentialFormatProfile,
-  OpenId4VcIssuerService,
   OpenId4VcIssuanceSessionRepository,
+  OpenId4VcIssuerService,
 } from '@credo-ts/openid4vc'
 import { Inject, Injectable, UnprocessableEntityException } from '@nestjs/common'
 import { ConfigType } from '@nestjs/config'
@@ -84,12 +84,14 @@ export class OpenId4VcIssuanceSessionService {
         credential.format === OpenId4VciCredentialFormatProfile.JwtVcJsonLd ||
         credential.format === OpenId4VciCredentialFormatProfile.LdpVc
       ) {
-        credentialIndex += 1
+        // Assign the current free index (0-based), then advance
+        // This keeps issued indexes within [0, size), consistent with capacity guard and per-index bound in StatusListService
         credentialIndexes.push(credentialIndex)
         credentialStatus = {
           location: this.statusListService.location(statusList.id),
           index: credentialIndex,
         }
+        credentialIndex += 1
       }
 
       let type: string | string[]
@@ -104,21 +106,19 @@ export class OpenId4VcIssuanceSessionService {
       let credentialIssuanceMeta: CredentialIssuanceMetadata
 
       if (credential.format === OpenId4VciCredentialFormatProfile.MsoMdoc) {
-        const mdocCredential = credential
         credentialIssuanceMeta = {
           format: credential.format,
           credentialSupportedId: credential.credentialSupportedId,
           type,
           issuer: {},
-          namespaces: mdocCredential.namespaces,
+          namespaces: credential.namespaces,
         }
       } else {
-        const didCredential = credential as { issuer: { did: string; name?: string; image?: string; url?: string } }
         credentialIssuanceMeta = {
           ...credential,
           type,
           issuer: {
-            ...didCredential.issuer,
+            ...credential.issuer,
             didUrl: issuerDidUrl,
           },
           credentialStatus,
@@ -129,6 +129,11 @@ export class OpenId4VcIssuanceSessionService {
       mappedCredentials.push(credentialIssuanceMeta)
     }
 
+    // Preflight status list capacity check before the offer is created
+    if (credentialIndexes.length) {
+      this.statusListService.assertHasFreeIndexes(statusList, credentialIndexes.length)
+    }
+
     const { credentialOffer, issuanceSession } = await tenantAgent.openid4vc.issuer.createCredentialOffer({
       baseUri: req.baseUri,
       credentialConfigurationIds: req.credentials.map((c) => c.credentialSupportedId),

heka-identity-service/src/revocation/status-list/__tests__/create-status-list.dto.test.ts

@@ -0,0 +1,58 @@
+import 'reflect-metadata'
+
+import { plainToInstance } from 'class-transformer'
+import { validate } from 'class-validator'
+
+import {
+  defaultCredentialStatusListSize,
+  maxCredentialStatusListSize,
+} from '../../../common/entities/credential-status-list.entity'
+import { CreateStatusListRequest } from '../dto/create-status-list.dto'
+
+const validateRequest = async (payload: Record<string, unknown>) => {
+  const instance = plainToInstance(CreateStatusListRequest, payload)
+  const errors = await validate(instance)
+  return { instance, errors }
+}
+
+const sizeConstraints = (errors: Awaited<ReturnType<typeof validateRequest>>['errors']) =>
+  Object.keys(errors.find((error) => error.property === 'size')?.constraints ?? {})
+
+describe('CreateStatusListRequest', () => {
+  describe('size', () => {
+    it('is optional - omitting it falls back to the default', async () => {
+      const { errors } = await validateRequest({ issuer: 'did:example:issuer' })
+
+      expect(errors).toHaveLength(0)
+    })
+
+    it.each([1, defaultCredentialStatusListSize, maxCredentialStatusListSize])('accepts %i', async (size) => {
+      const { errors } = await validateRequest({ issuer: 'did:example:issuer', size })
+
+      expect(errors).toHaveLength(0)
+    })
+
+    // `new Bitstring({ length })` throws on a non-positive or fractional length, which would surface
+    // as a 500 rather than a 400 if the DTO let these through.
+    it.each([0, -1, -131072])('rejects the non-positive size %i', async (size) => {
+      const { errors } = await validateRequest({ issuer: 'did:example:issuer', size })
+
+      expect(sizeConstraints(errors)).toContain('min')
+    })
+
+    it('rejects a fractional size', async () => {
+      const { errors } = await validateRequest({ issuer: 'did:example:issuer', size: 2.5 })
+
+      expect(sizeConstraints(errors)).toContain('isInt')
+    })
+
+    it('rejects a size above the maximum, so one request cannot allocate an oversized bitstring', async () => {
+      const { errors } = await validateRequest({
+        issuer: 'did:example:issuer',
+        size: maxCredentialStatusListSize + 1,
+      })
+
+      expect(sizeConstraints(errors)).toContain('max')
+    })
+  })
+})