feat: support w3c revocation #2024

KulkarniShashank · 2024-09-02T07:00:29Z

What

This PR introduces support for W3C credential revocation. The following changes have been made:

Refactor functionality for Verify Credential and Verify Presentation.
Integrated with the Bit String Status List for checking and updating credential status.

How

Revocation Flow: Implemented the revocation flow by checking a credential status and updating the credential issuance process to handle revocable credentials.
Integration: Integrated the new revocation features with the existing system, ensuring compatibility and proper handling of revoked credentials.

Signed-off-by: KulkarniShashank <[email protected]>

changeset-bot · 2024-09-02T07:00:32Z

⚠️ No Changeset found

Latest commit: 95d558c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Signed-off-by: KulkarniShashank <[email protected]>

TimoGlastra

Thanks for this! Left some comments

TimoGlastra · 2024-09-02T10:21:53Z

packages/core/src/modules/vc/data-integrity/W3cJsonLdCredentialService.ts

@@ -265,6 +304,52 @@ export class W3cJsonLdCredentialService {
        challenge: options.challenge,
        domain: options.domain,
        documentLoader: this.w3cCredentialsModuleConfig.documentLoader(agentContext),
+        checkStatus: async ({ credential }: { credential: W3cJsonCredential }) => {


Can you extract this into a method and reuse that for both checkStatus methods?

@TimoGlastra I have developed a common function for this purpose. However, in the checkStatus method, there are specific conditions related to credential status that are dependent on the payload received from the verifyCredential and verifyPresentation functions. Therefore, the checkStatus method invokes the common function, as it contains the identical logic.

TimoGlastra · 2024-09-02T10:24:40Z

packages/core/src/modules/vc/data-integrity/W3cJsonLdCredentialService.ts

+            const encodedBitString = bitStringCredential.credential.credentialSubject.encodedList
+            const compressedBuffer = Uint8Array.from(atob(encodedBitString), (c) => c.charCodeAt(0))
+
+            // Decompress using pako
+            const decodedBitString = pako.ungzip(compressedBuffer, { to: 'string' })
+            const statusListIndex = Number(credential.credentialStatus.statusListIndex)
+
+            if (statusListIndex < 0 || statusListIndex >= decodedBitString.length) {


We should validate the bitstring status list credential as well

TimoGlastra · 2024-09-02T10:25:31Z

packages/core/src/modules/vc/models/credential/W3cJsonCredential.ts

+  credentialStatus?: SingleOrArray<CredentialStatus>
+}
+
+type CredentialStatusType = 'BitstringStatusListEntry'


Can we move all the status list logic related to bit string status list to a separate file?

TimoGlastra · 2024-09-02T10:26:29Z

packages/core/src/modules/vc/data-integrity/W3cJsonLdCredentialService.ts

+              throw new CredoError('Invalid credential status format')
+            }
+
+            const credentialStatusURL = credential.credentialStatus.statusListCredential


We should first check the type fiets to make sure this is a bit string status type. There could be others and those are not supported at the moment.

Signed-off-by: KulkarniShashank <[email protected]>

KulkarniShashank · 2024-09-03T07:36:11Z

@TimoGlastra As per your suggestions, I have made the changes. Please review them and let me know your thoughts.

Signed-off-by: KulkarniShashank <[email protected]>

…ction. Signed-off-by: KulkarniShashank <[email protected]>

Tweeddalex · 2024-09-04T09:35:15Z

Out of interest @KulkarniShashank will this work with cheqd DIDs and on-ledger Bitstring Status Lists?

KulkarniShashank · 2024-09-04T11:53:57Z

Out of interest @KulkarniShashank will this work with cheqd DIDs and on-ledger Bitstring Status Lists?

Its can work for all the DIDs that support JSON-LD credential format

TimoGlastra · 2024-09-05T11:20:22Z

However @Tweeddalex this PR does not support cheqd yet. The current implementation only suppors https and uses fetch to retrieve the status list. For cheqd support we'd have to fetch the status list differently.

TimoGlastra · 2024-09-05T11:24:18Z

packages/core/src/modules/vc/data-integrity/W3cJsonLdCredentialService.ts

+          if ('credentialStatus' in credential) {
+            await verifyBitStringCredentialStatus(credential, agentContext)
+          }


verifyPresentation also has options.verifyCredentialStatus, can you add that check here as well?

TimoGlastra · 2024-09-05T11:26:27Z

packages/core/src/modules/vc/models/credential/W3cCredentialStatus.ts

+  @IsEnum(['BitstringStatusListEntry'])
+  @IsString()
+  public type!: CredentialStatusType
+
+  @IsEnum(CredentialStatusPurpose)
+  @IsString()
+  public statusPurpose!: CredentialStatusPurpose
+
  @IsString()
-  public type!: string
+  public statusListIndex!: string


Looking at the VC Data model specification, these properties are not required fro the credentialStatus property. Only id and type are.

We should have a generic base class and allow multiple extension points. You can look at e.g. how we solved this with the DidDocument service property, where there's a base service class and multiple possible extensions that are matched based on the type property

TimoGlastra · 2024-09-05T11:27:18Z

packages/core/src/modules/vc/models/credential/W3cCredentialStatus.ts

+// Function to validate the status using the updated method
+export const validateStatus = async (status: CredentialStatus, agentContext: AgentContext): Promise<boolean> => {
+  const entry = plainToInstance(W3cCredentialStatus, status)
+
+  try {
+    await validateOrReject(entry)
+    return true
+  } catch (errors) {
+    agentContext.config.logger.debug(`Credential status validation failed: ${errors}`, {
+      stack: errors,
+    })
+    throw new CredoError(`Invalid credential status type: ${errors}`)
+  }
 }


This validation is automatically done when transforming into a specific class instance type, so I don't think it's needed if you follow the did document service approach

TimoGlastra · 2024-09-05T11:28:24Z

packages/core/src/modules/vc/models/credential/W3cJsonCredentialStatus.ts

+export type CredentialStatusType = 'BitstringStatusListEntry'
+// The purpose can be anything apart from this as well
+export enum CredentialStatusPurpose {
+  'revocation' = 'revocation',
+  'suspension' = 'suspension',
+  'message' = 'message',
+}
+
+export interface StatusMessage {
+  // a string representing the hexadecimal value of the status prefixed with 0x
+  status: string
+  // a string used by software developers to assist with debugging which SHOULD NOT be displayed to end users
+  message?: string
+  // We can have some key value pairs as well
+  [key: string]: unknown
+}
+
+export interface CredentialStatus {
+  id: string
+  // Since currenlty we are only trying to support 'BitStringStatusListEntry'
+  type: CredentialStatusType
+  statusPurpose: CredentialStatusPurpose
+  // Unique identifier for the specific credential
+  statusListIndex: string
+  // Must be url referencing to a VC of type 'BitstringStatusListCredential'
+  statusListCredential: string
+  // The statusSize indicates the size of the status entry in bits
+  statusSize?: number
+  // Must be preset if statusPurpose is message
+  /**
+   * the length of which MUST equal the number of possible status messages indicated by statusSize
+   * (e.g., statusMessage array MUST have 2 elements if statusSize has 1 bit,
+   * 4 elements if statusSize has 2 bits, 8 elements if statusSize has 3 bits, etc.).
+   */
+  statusMessage?: StatusMessage[]
+  // An implementer MAY include the statusReference property. If present, its value MUST be a URL or an array of URLs [URL] which dereference to material related to the status
+  statusReference?: SingleOrArray<string>
+}
+
+// Define an interface for `credentialSubject`
+export interface CredentialSubject {
+  encodedList: string
+}
+
+// Define an interface for the `credential` object that uses `CredentialSubject`
+export interface Credential {
+  credentialSubject: CredentialSubject
+}
+
+// Use the `Credential` interface within `BitStringStatusListCredential`
+export interface BitStringStatusListCredential {
+  credential: Credential
+}


All these interface names should be bitstring status list specific. It is important to make a distinction between bitstring status list, and possible other credentialStatus methods that will be added in the future.

TimoGlastra · 2024-09-05T11:29:05Z

packages/core/src/modules/vc/data-integrity/VerifyBitStringCredentialStatus.ts

+  }
+}
+
+export const verifyBitStringCredentialStatus = async (credential: W3cJsonCredential, agentContext: AgentContext) => {


This doesn't validate the signature of the status list credential yet

TimoGlastra · 2024-09-05T11:39:26Z

packages/core/src/modules/credentials/CredentialsApi.ts

+   * @returns Revoke credential notification message
+   *
+   */
+  public async revokeJsonLdCredential(options: RevokeCredentialOption): Promise<{ message: string }> {


there is a lot of dupcliation in this file with the already present methods. Some suggestions:

move all the credential status logic into a specific folder in the w3c module

add the revocation related methods to the w3c credentails api, not the DIDcomm credentials api

the only thing we should add it here is a sendRevocationNotification method (which we can extend to support non-anoncreds revocadion notification messages as well)

making a POST to the credential status list url to update the status list seems implementation specific and may not work for all implementations

feat: support w3c revocation

787cce6

Signed-off-by: KulkarniShashank <[email protected]>

KulkarniShashank marked this pull request as draft September 2, 2024 07:00

fix: update pako library in package.json

cc1975a

Signed-off-by: KulkarniShashank <[email protected]>

KulkarniShashank mentioned this pull request Sep 2, 2024

W3C revocation raise PR to credo-ts credebl/platform#970

Open

3 tasks

TimoGlastra requested changes Sep 2, 2024

View reviewed changes

fix: added the function for validate the BitStringStatusList credential

67bc551

Signed-off-by: KulkarniShashank <[email protected]>

KulkarniShashank added 4 commits September 3, 2024 17:17

feat: added the revoke w3c credential function

b946e5b

Signed-off-by: KulkarniShashank <[email protected]>

refactor: added method in the credential api class

a3e0165

Signed-off-by: KulkarniShashank <[email protected]>

fix: revocation notification payload

7975139

Signed-off-by: KulkarniShashank <[email protected]>

fix: update credential API to remove the notification call in the fun…

95d558c

…ction. Signed-off-by: KulkarniShashank <[email protected]>

TimoGlastra reviewed Sep 5, 2024

View reviewed changes

This was referenced Oct 23, 2024

feat: w3c revocation using bit string status list for dedicated and multi-tenancy credebl/credo-controller#171

Draft

feat: support w3c revocation #2072

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: support w3c revocation #2024

feat: support w3c revocation #2024

KulkarniShashank commented Sep 2, 2024

changeset-bot bot commented Sep 2, 2024 •

edited

Loading

TimoGlastra left a comment

TimoGlastra Sep 2, 2024

KulkarniShashank Sep 3, 2024

TimoGlastra Sep 2, 2024

TimoGlastra Sep 2, 2024

TimoGlastra Sep 2, 2024

KulkarniShashank commented Sep 3, 2024

Tweeddalex commented Sep 4, 2024

KulkarniShashank commented Sep 4, 2024

TimoGlastra commented Sep 5, 2024

TimoGlastra Sep 5, 2024

TimoGlastra Sep 5, 2024

TimoGlastra Sep 5, 2024

TimoGlastra Sep 5, 2024

TimoGlastra Sep 5, 2024

TimoGlastra Sep 5, 2024

feat: support w3c revocation #2024

Are you sure you want to change the base?

feat: support w3c revocation #2024

Conversation

KulkarniShashank commented Sep 2, 2024

What

How

changeset-bot bot commented Sep 2, 2024 • edited Loading

⚠️ No Changeset found

TimoGlastra left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

KulkarniShashank commented Sep 3, 2024

Tweeddalex commented Sep 4, 2024

KulkarniShashank commented Sep 4, 2024

TimoGlastra commented Sep 5, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

changeset-bot bot commented Sep 2, 2024 •

edited

Loading