adds support for the same mDL certificate to be used in mobile wallet

Signed-off-by: nodirbek.parpibaev <nodirbek.parpibaev@dsr-corporation.com>

Author: tajang97

heka-identity-service/docs/swagger-spec.yaml

@@ -3652,8 +3652,6 @@ components:
           type: boolean
         presentationExchange:
           type: object
-        dcql:
-          type: object
       required:
         - publicVerifierId
         - requestSigner

heka-identity-service/src/common/agent/agent-modules.provider.ts

@@ -130,7 +130,7 @@ function getTenantModulesMap(appConfig: ConfigType<typeof AppConfig>, agencyConf
       app: agencyConfig.oidConfig.app as any,
       issuer: {
         baseUrl: agencyConfig.oidConfig.issuanceEndpoint,
-        credentialRequestToCredentialMapper: createCredentialRequestToCredentialMapper(agencyConfig.mdlIssuerCertificate),
+        credentialRequestToCredentialMapper: createCredentialRequestToCredentialMapper(agencyConfig.mdlIssuerCertificate, agencyConfig.mdlIssuerPrivateKeyJwk),
       },
       verifier: {
         baseUrl: agencyConfig.oidConfig.verificationEndpoint,

heka-identity-service/src/common/agent/agent.provider.ts

@@ -1,4 +1,4 @@
-import { Agent as CredoAgent, BaseAgent, LogLevel } from '@credo-ts/core'
+import { Agent as CredoAgent, BaseAgent, Kms, LogLevel, X509ModuleConfig } from '@credo-ts/core'
 import { DidCommHttpOutboundTransport, DidCommWsOutboundTransport } from '@credo-ts/didcomm'
 import { agentDependencies, DidCommHttpInboundTransport, DidCommWsInboundTransport } from '@credo-ts/node'
 import { OnApplicationShutdown } from '@nestjs/common'
@@ -50,6 +50,27 @@ export class Agent extends CredoAgent<AgencyModulesMap> implements OnApplication
 
     await super.initialize()
 
+    if (this.agencyConfig.mdlIssuerCertificate) {
+      const x509Config = this.context.resolve(X509ModuleConfig)
+      x509Config.addTrustedCertificate(this.agencyConfig.mdlIssuerCertificate)
+      logger.info('MDL issuer certificate added to trusted certificates')
+    }
+
+    if (this.agencyConfig.mdlIssuerPrivateKeyJwk) {
+      const kms = this.context.resolve(Kms.KeyManagementApi)
+      try {
+        await kms.importKey({ privateJwk: this.agencyConfig.mdlIssuerPrivateKeyJwk as unknown as Kms.KmsJwkPrivate })
+        logger.info('MDL issuer private key imported into KMS')
+      } catch (e) {
+        const isDuplicateEntry = e instanceof Error && e.message === 'Duplicate entry'
+        if (e instanceof Kms.KeyManagementKeyExistsError || isDuplicateEntry) {
+          logger.debug('MDL issuer private key already present in KMS')
+        } else {
+          throw e
+        }
+      }
+    }
+
     logger.trace('<')
   }
 

heka-identity-service/src/config/agent.ts

@@ -119,6 +119,9 @@ export default registerAs('agent', () => {
   }
 
   const mdlIssuerCertificate = process.env.MDL_ISSUER_CERTIFICATE
+  const mdlIssuerPrivateKeyJwk = process.env.MDL_ISSUER_PRIVATE_KEY
+    ? (JSON.parse(process.env.MDL_ISSUER_PRIVATE_KEY) as Record<string, string>)
+    : undefined
 
   const credentialsConfiguration: CredentialsConfiguration = {
     [ProtocolType.Oid4vc]: {
@@ -160,5 +163,6 @@ export default registerAs('agent', () => {
     hederaOperatorKey,
     credentialsConfiguration,
     mdlIssuerCertificate,
+    mdlIssuerPrivateKeyJwk,
   }
 })

heka-identity-service/src/openid4vc/verification-sessions/verification-session.service.ts

@@ -132,7 +132,7 @@ export class OpenId4VcVerificationSessionService {
   private static isJwtVcJsonPresentation(
     presentation: VerifiablePresentation,
   ): presentation is W3cJwtVerifiablePresentation {
-    return (presentation as W3cJwtVerifiablePresentation).jwt.header?.typ === 'JWT'
+    return (presentation as W3cJwtVerifiablePresentation).jwt?.header?.typ === 'JWT'
   }
 
   private static isMdocPresentation(presentation: VerifiablePresentation): presentation is MdocDeviceResponse {

heka-identity-service/src/utils/oid4vc/index.ts

@@ -1,6 +1,6 @@
 import type { JsonObject } from '@credo-ts/core'
 
-import { ClaimFormat, SdJwtVcPayload, W3cCredential, W3cCredentialSubject, X509Certificate, w3cDate } from '@credo-ts/core'
+import { ClaimFormat, Kms, SdJwtVcPayload, W3cCredential, W3cCredentialSubject, X509Certificate, w3cDate } from '@credo-ts/core'
 import {
   OpenId4VciCredentialFormatProfile,
   OpenId4VciCredentialRequestToCredentialMapper,
@@ -34,8 +34,9 @@ export interface CredentialIssuanceMetadata {
 
 export const createCredentialRequestToCredentialMapper = (
   mdlIssuerCertificate?: string,
+  mdlIssuerPrivateKeyJwk?: Record<string, string>,
 ): OpenId4VciCredentialRequestToCredentialMapper =>
-  ({ issuanceSession, holderBinding, credentialConfigurationId }): OpenId4VciSignCredentials => {
+  async ({ agentContext, issuanceSession, holderBinding, credentialConfigurationId }): Promise<OpenId4VciSignCredentials> => {
     const credentials = issuanceSession.issuanceMetadata?.credentials as CredentialIssuanceMetadata[]
     if (!credentials) throw new Error('Not implemented')
 
@@ -52,6 +53,16 @@ export const createCredentialRequestToCredentialMapper = (
       if (!issuanceMetadata.namespaces) throw new Error(`Invalid credential issuance metadata: 'namespaces' is missing`)
 
       const issuerCertificate = X509Certificate.fromEncodedCertificate(mdlIssuerCertificate)
+      if (mdlIssuerPrivateKeyJwk) {
+        issuerCertificate.publicJwk.keyId = mdlIssuerPrivateKeyJwk.kid
+        const kms = agentContext.resolve(Kms.KeyManagementApi)
+        try {
+          await kms.importKey({ privateJwk: mdlIssuerPrivateKeyJwk as unknown as Kms.KmsJwkPrivate })
+        } catch (e) {
+          const isDuplicateEntry = e instanceof Error && e.message === 'Duplicate entry'
+          if (!(e instanceof Kms.KeyManagementKeyExistsError) && !isDuplicateEntry) throw e
+        }
+      }
       const holderKey = holderBinding.keys[0]?.jwk
       if (!holderKey) throw new Error('No holder key found for mdoc binding')
 

heka-wallet/app/metro.config.js

@@ -7,6 +7,12 @@ const workspaceDir = path.join(projectDir, '../')
 
 const nodeModulesDir = path.join(workspaceDir, 'node_modules')
 
+// Resolve the single canonical copy of @peculiar/asn1-schema at config load time.
+// Multiple nested copies (2.3.8) exist under @credo-ts/core, @peculiar/x509,
+// webcrypto-core, and @peculiar/webcrypto. They each get a separate AsnSchemaStorage
+// instance causing "Cannot get schema for 'Certificate' target" during mDL validation.
+const asn1SchemaEntry = require.resolve('@peculiar/asn1-schema', { paths: [workspaceDir] })
+
 const packageDirs = [
   fs.realpathSync(path.join(nodeModulesDir, '@hyperledger/aries-oca')),
   fs.realpathSync(path.join(nodeModulesDir, '@hyperledger/aries-bifold-core')),
@@ -55,7 +61,23 @@ const config = {
   resolver: {
     unstable_enablePackageExports: true,
     unstable_conditionNames: ['react-native', 'browser', 'import', 'require'],
-    blacklistRE: exclusionList(extraExclusionlist.map((m) => new RegExp(`^${escape(m)}\\/.*$`))),
+    blacklistRE: exclusionList([
+      ...extraExclusionlist.map((m) => new RegExp(`^${escape(m)}\\/.*$`)),
+      // Block all nested copies of @peculiar/asn1-schema so only the workspace-root
+      // version (2.3.13) is bundled — prevents split AsnSchemaStorage instances.
+      new RegExp(`^${escape(path.join(nodeModulesDir, '@credo-ts/core/node_modules/@peculiar/asn1-schema'))}\\/.*$`),
+      new RegExp(`^${escape(path.join(nodeModulesDir, '@peculiar/x509/node_modules/@peculiar/asn1-schema'))}\\/.*$`),
+      new RegExp(`^${escape(path.join(nodeModulesDir, 'webcrypto-core/node_modules/@peculiar/asn1-schema'))}\\/.*$`),
+      new RegExp(`^${escape(path.join(nodeModulesDir, '@peculiar/webcrypto/node_modules/@peculiar/asn1-schema'))}\\/.*$`),
+    ]),
+    resolveRequest: (context, moduleName, platform) => {
+      if (moduleName === '@peculiar/asn1-schema') {
+        // Directly return the workspace-root version — bypasses Metro's default
+        // hierarchical node_modules lookup which would find nested copies first.
+        return { filePath: asn1SchemaEntry, type: 'sourceFile' }
+      }
+      return context.resolveRequest(context, moduleName, platform)
+    },
     assetExts: assetExts.filter((ext) => ext !== 'svg'),
     sourceExts: [...sourceExts, 'svg', 'cjs'],
     extraNodeModules: {

heka-wallet/app/src/credentials/useCredentials.ts

@@ -6,7 +6,7 @@ import { TOKENS, useServices, useStore } from '@hyperledger/aries-bifold-core'
 import { isEqual } from 'lodash'
 import { useCallback, useEffect, useState } from 'react'
 
-import { useSdJwtVcRecords, useW3cCredentialRecords } from '../contexts'
+import { useMdocRecords, useSdJwtVcRecords, useW3cCredentialRecords } from '../contexts'
 
 import { mapCredentialRecord } from './mappers'
 import { Credential, CredentialRecord } from './types'
@@ -33,6 +33,7 @@ export const useCredentials = (maxCount?: number): CredentialsState => {
 
   const { w3cCredentialRecords, isLoading: isW3cCredentialsLoading } = useW3cCredentialRecords()
   const { sdJwtVcRecords, isLoading: isSdJwtCredentialsLoading } = useSdJwtVcRecords()
+  const { mdocCredentialRecords, isLoading: isMdocCredentialsLoading } = useMdocRecords()
 
   const credentialExchangeRecords = useCredentialByState([CredentialState.CredentialReceived, CredentialState.Done])
   const previousCredentialExchangeRecords = usePrevious(credentialExchangeRecords)
@@ -53,7 +54,7 @@ export const useCredentials = (maxCount?: number): CredentialsState => {
   const [isLoading, setIsLoading] = useState(true)
 
   const loadCredentials = useCallback(async () => {
-    if (!agent?.wallet.isInitialized || isW3cCredentialsLoading || isSdJwtCredentialsLoading) return
+    if (!agent?.wallet.isInitialized || isW3cCredentialsLoading || isSdJwtCredentialsLoading || isMdocCredentialsLoading) return
 
     setIsLoading(true)
     try {
@@ -79,6 +80,7 @@ export const useCredentials = (maxCount?: number): CredentialsState => {
         // Filter W3C records that already presented by Anocreds (Credential exchange) records
         ...w3cCredentialRecords.filter((record) => !w3cAnoncredsRecordIds.includes(record.id)),
         ...sdJwtVcRecords,
+        ...mdocCredentialRecords,
       ]
 
       credentialRecords.sort(compareCredentialRecordsByMostRecent)
@@ -98,9 +100,11 @@ export const useCredentials = (maxCount?: number): CredentialsState => {
     agent,
     isSdJwtCredentialsLoading,
     isW3cCredentialsLoading,
+    isMdocCredentialsLoading,
     anoncredsCredentials,
     w3cCredentialRecords,
     sdJwtVcRecords,
+    mdocCredentialRecords,
     store.preferences.developerModeEnabled,
     credentialHideList,
     maxCount,

heka-wallet/app/src/credentials/useOpenIdHandlers.ts

@@ -6,6 +6,8 @@ import {
   JwaSignatureAlgorithm,
   JwkDidCreateOptions,
   KeyDidCreateOptions,
+  Mdoc,
+  MdocRecord,
   SdJwtVcRecord,
   W3cCredentialRecord,
 } from '@credo-ts/core'
@@ -234,13 +236,15 @@ export const useOpenIdHandlers = () => {
       const [firstCredential] = credentials
       if (!firstCredential) throw new Error('Error retrieving credential.')
 
-      let record: SdJwtVcRecord | W3cCredentialRecord
+      let record: SdJwtVcRecord | W3cCredentialRecord | MdocRecord
 
       // TODO: Add claimFormat to SdJwtVc
       if ('compact' in firstCredential.credential) {
         record = new SdJwtVcRecord({
           compactSdJwtVc: firstCredential.credential.compact,
         })
+      } else if (firstCredential.credential instanceof Mdoc) {
+        record = new MdocRecord({ mdoc: firstCredential.credential })
       } else {
         record = new W3cCredentialRecord({
           credential: firstCredential.credential,

heka-wallet/app/src/utils/agent.ts

@@ -14,6 +14,7 @@ import {
   PeerDidRegistrar,
   PeerDidResolver,
   WebDidResolver,
+  X509Module,
 } from '@credo-ts/core'
 import { createPeerDidFromServices, routingToServices } from '@credo-ts/core/build/modules/connections/services/helpers'
 import { HederaAnonCredsRegistry, HederaDidRegistrar, HederaDidResolver, HederaModule } from '@credo-ts/hedera'
@@ -108,6 +109,11 @@ export async function createAgent({ credentials, indyLedgers, indyBesuConfig, wa
           },
         ],
       }),
+      x509: new X509Module({
+        trustedCertificates: [
+          'MIIBmTCCAT+gAwIBAgIUJeybJ59oAtHqC1RAo1ySrqCUdyEwCgYIKoZIzj0EAwIwIjELMAkGA1UEBhMCVVMxEzARBgNVBAMMCk1ETCBJc3N1ZXIwHhcNMjYwMzE2MTIxOTQxWhcNMjcwMzE2MTIxOTQxWjAiMQswCQYDVQQGEwJVUzETMBEGA1UEAwwKTURMIElzc3VlcjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBl3oLjMhrHR3uZxNUdyxEboo7OGsvqLdn5j3HGHFg+lL77U3yvUFZcYFtPr8Bc49tc8eRkbIBQaf3ebikmEIAKjUzBRMB0GA1UdDgQWBBRgERzGBBlp2rVChhxwubMS3rSP9jAfBgNVHSMEGDAWgBRgERzGBBlp2rVChhxwubMS3rSP9jAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0gAMEUCIQDXrhjDDTiR3yMVD1q0yjadoqC3p/5Zc8RswG20M0IBDwIgPblEkraphygeYXDEzEnuIour1SeKHsf4JJuyn2mPkYo=',
+        ],
+      }),
     },
   })
 }