Skip to content

Commit acd3711

Browse files
bdeneuxbdeneux
committed
feat(credential): check authentication proof purpose for auth claim
1 parent f9492da commit acd3711

6 files changed

+96
-47
lines changed

‎credential/auth.go

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,10 @@ import (
77
"github.com/piprate/json-gold/ld"
88
)
99

10-
const ClaimToService = "toService"
10+
const (
11+
ClaimToService = "toService"
12+
ProofPurposeAuthentication = "authentication"
13+
)
1114

1215
const ErrAuthClaim MessageError = "invalid auth claim"
1316

@@ -63,9 +66,18 @@ func (ap *AuthParser) ParseSigned(raw []byte) (*AuthClaim, error) {
6366
return nil, NewVCError(ErrMalformed, err)
6467
}
6568

69+
proof, err := extractProof(cred)
70+
if err != nil {
71+
return nil, err
72+
}
73+
if proof.ProofPurpose != ProofPurposeAuthentication {
74+
return nil, NewVCError(ErrAuthClaim,
75+
fmt.Errorf("proof purpose not targeting `%s` (proof purpose: `%s`)", ProofPurposeAuthentication, proof.ProofPurpose))
76+
}
77+
6678
if cred.Issuer.ID != authClaim.ID {
6779
return nil, NewVCError(ErrAuthClaim,
68-
fmt.Errorf("subject differs from issuer (subject: %s, issuer: %s)", authClaim.ID, cred.Issuer.ID))
80+
fmt.Errorf("subject differs from issuer (subject: `%s`, issuer: `%s`)", authClaim.ID, cred.Issuer.ID))
6981
}
7082
return authClaim, nil
7183
}

‎credential/auth_test.go

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ func TestAuthParser_ParseSigned(t *testing.T) {
3636
file: "testdata/valid.jsonld",
3737
wantErr: nil,
3838
result: &credential.AuthClaim{
39-
ID: "did:key:zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr",
39+
ID: "did:key:zQ3shhCAzQcroi4RqZ48eNudKWf75Fvv9ryJsxbaWCCPsfnFj",
4040
ToService: "did:key:zQ3shZxyDoD3QorxHJrFS68EjzDgQZSqZcj3wQqc1ngbF1vgz",
4141
},
4242
},
@@ -67,7 +67,7 @@ func TestAuthParser_ParseSigned(t *testing.T) {
6767
{
6868
name: "credential with issuer different from subject",
6969
file: "testdata/invalid_issuer-differs-subject.jsonld",
70-
wantErr: credential.NewVCError(credential.ErrAuthClaim, fmt.Errorf("subject differs from issuer (subject: did:key:zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr, issuer: did:key:zQ3shZxyDoD3QorxHJrFS68EjzDgQZSqZcj3wQqc1ngbF1vgz)")),
70+
wantErr: credential.NewVCError(credential.ErrAuthClaim, fmt.Errorf("subject differs from issuer (subject: `did:key:zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr`, issuer: `did:key:zQ3shhCAzQcroi4RqZ48eNudKWf75Fvv9ryJsxbaWCCPsfnFj`)")),
7171
result: nil,
7272
},
7373
{
@@ -94,6 +94,18 @@ func TestAuthParser_ParseSigned(t *testing.T) {
9494
wantErr: credential.NewVCError(credential.ErrIssued, fmt.Errorf("2200-01-01 20:30:59.627706 +0200 +0200")),
9595
result: nil,
9696
},
97+
{
98+
name: "credential not issued now",
99+
file: "testdata/invalid_futur-issued.jsonld",
100+
wantErr: credential.NewVCError(credential.ErrIssued, fmt.Errorf("2200-01-01 20:30:59.627706 +0200 +0200")),
101+
result: nil,
102+
},
103+
{
104+
name: "credential with not authentication proof purpose",
105+
file: "testdata/invalid_not-authentication-proof.jsonld",
106+
wantErr: credential.NewVCError(credential.ErrAuthClaim, fmt.Errorf("proof purpose not targeting `authentication` (proof purpose: `assertionMethod`)")),
107+
result: nil,
108+
},
97109
}
98110

99111
for _, test := range tests {

‎credential/parser.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,13 @@ package credential
33
import (
44
"crypto/ecdsa"
55
"fmt"
6-
"github.com/hyperledger/aries-framework-go/component/models/ld/proof"
76
"time"
87

8+
"github.com/hyperledger/aries-framework-go/component/models/ld/proof"
9+
910
"github.com/btcsuite/btcd/btcec"
1011
secp "github.com/decred/dcrd/dcrec/secp256k1/v4"
12+
"github.com/hyperledger/aries-framework-go/component/models/ld/proof"
1113
"github.com/hyperledger/aries-framework-go/pkg/doc/did"
1214
"github.com/hyperledger/aries-framework-go/pkg/doc/jose/jwk/jwksupport"
1315
"github.com/hyperledger/aries-framework-go/pkg/doc/signature/suite"

‎credential/testdata/invalid_issuer-differs-subject.jsonld

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
{
2-
"@context": [
3-
"https://www.w3.org/2018/credentials/v1",
4-
"https://w3id.org/axone/ontology/v4/schema/credential/digital-service/authentication/"
5-
],
6-
"credentialSubject": {
7-
"id": "did:key:zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr",
8-
"toService": "did:key:zQ3shZxyDoD3QorxHJrFS68EjzDgQZSqZcj3wQqc1ngbF1vgz"
9-
},
10-
"id": "https://w3id.org/axone/ontology/v4/schema/credential/digital-service/authentication/72cab400-5bd6-4eb4-8605-a5ee8c1a45c9",
11-
"issuer": "did:key:zQ3shZxyDoD3QorxHJrFS68EjzDgQZSqZcj3wQqc1ngbF1vgz",
12-
"proof": {
13-
"created": "2024-08-12T21:11:26.371751+02:00",
14-
"jws": "eyJhbGciOiJ1bmtub3duIiwiYjY0IjpmYWxzZSwiY3JpdCI6WyJiNjQiXX0..c8UxNOUbNI__NATC1LRvEqWKFER3MFS9Pmze14EF-O4z_5qeIdueWv8hfgSUUtKSITEGW50qM4mZSJM-iURKQg",
15-
"proofPurpose": "assertionMethod",
16-
"type": "EcdsaSecp256k1Signature2019",
17-
"verificationMethod": "did:key:zQ3shZxyDoD3QorxHJrFS68EjzDgQZSqZcj3wQqc1ngbF1vgz#zQ3shZxyDoD3QorxHJrFS68EjzDgQZSqZcj3wQqc1ngbF1vgz"
18-
},
19-
"type": [
20-
"VerifiableCredential",
21-
"DigitalServiceAuthenticationCredential"
22-
]
2+
"@context": [
3+
"https://www.w3.org/2018/credentials/v1",
4+
"https://w3id.org/axone/ontology/v4/schema/credential/digital-service/authentication/"
5+
],
6+
"credentialSubject": {
7+
"id": "did:key:zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr",
8+
"toService": "did:key:zQ3shZxyDoD3QorxHJrFS68EjzDgQZSqZcj3wQqc1ngbF1vgz"
9+
},
10+
"id": "https://w3id.org/axone/ontology/v4/schema/credential/digital-service/authentication/72cab400-5bd6-4eb4-8605-a5ee8c1a45c9",
11+
"issuer": "did:key:zQ3shhCAzQcroi4RqZ48eNudKWf75Fvv9ryJsxbaWCCPsfnFj",
12+
"proof": {
13+
"created": "2024-08-20T11:05:22.520483+02:00",
14+
"jws": "eyJhbGciOiJ1bmtub3duIiwiYjY0IjpmYWxzZSwiY3JpdCI6WyJiNjQiXX0..W9RrEnbPbkvYl5NgHbXqQXZgzOyjbYqkoWyq2GxBTvhywQ51A7Sjj5xTCEfBOz0bnjnuNAVevRnSQnJGIPgvIw",
15+
"proofPurpose": "authentication",
16+
"type": "EcdsaSecp256k1Signature2019",
17+
"verificationMethod": "did:key:zQ3shhCAzQcroi4RqZ48eNudKWf75Fvv9ryJsxbaWCCPsfnFj#zQ3shhCAzQcroi4RqZ48eNudKWf75Fvv9ryJsxbaWCCPsfnFj"
18+
},
19+
"type": [
20+
"VerifiableCredential",
21+
"DigitalServiceAuthenticationCredential"
22+
]
2323
}

‎credential/testdata/invalid_not-authentication-proof.jsonld

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{
2+
"@context": [
3+
"https://www.w3.org/2018/credentials/v1",
4+
"https://w3id.org/axone/ontology/v4/schema/credential/digital-service/authentication/"
5+
],
6+
"credentialSubject": {
7+
"id": "did:key:zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr",
8+
"toService": "did:key:zQ3shZxyDoD3QorxHJrFS68EjzDgQZSqZcj3wQqc1ngbF1vgz"
9+
},
10+
"id": "https://w3id.org/axone/ontology/v4/schema/credential/digital-service/authentication/72cab400-5bd6-4eb4-8605-a5ee8c1a45c9",
11+
"issuer": "did:key:zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr",
12+
"proof": {
13+
"created": "2024-08-12T20:34:59.627706+02:00",
14+
"jws": "eyJhbGciOiJ1bmtub3duIiwiYjY0IjpmYWxzZSwiY3JpdCI6WyJiNjQiXX0..S24mi6JvsM_8quNQ1Out4_0uub6zwkWmzl2FT_6lrCVE9Ih5le2JcNhmAUyOjizhHiCoa0qXKldyXYXUDMMh2w",
15+
"proofPurpose": "assertionMethod",
16+
"type": "EcdsaSecp256k1Signature2019",
17+
"verificationMethod": "did:key:zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr#zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr"
18+
},
19+
"type": [
20+
"VerifiableCredential",
21+
"DigitalServiceAuthenticationCredential"
22+
]
23+
}

‎credential/testdata/valid.jsonld

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
{
2-
"@context": [
3-
"https://www.w3.org/2018/credentials/v1",
4-
"https://w3id.org/axone/ontology/v4/schema/credential/digital-service/authentication/"
5-
],
6-
"credentialSubject": {
7-
"id": "did:key:zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr",
8-
"toService": "did:key:zQ3shZxyDoD3QorxHJrFS68EjzDgQZSqZcj3wQqc1ngbF1vgz"
9-
},
10-
"id": "https://w3id.org/axone/ontology/v4/schema/credential/digital-service/authentication/72cab400-5bd6-4eb4-8605-a5ee8c1a45c9",
11-
"issuer": "did:key:zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr",
12-
"proof": {
13-
"created": "2024-08-12T20:34:59.627706+02:00",
14-
"jws": "eyJhbGciOiJ1bmtub3duIiwiYjY0IjpmYWxzZSwiY3JpdCI6WyJiNjQiXX0..S24mi6JvsM_8quNQ1Out4_0uub6zwkWmzl2FT_6lrCVE9Ih5le2JcNhmAUyOjizhHiCoa0qXKldyXYXUDMMh2w",
15-
"proofPurpose": "assertionMethod",
16-
"type": "EcdsaSecp256k1Signature2019",
17-
"verificationMethod": "did:key:zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr#zQ3shpoUHzwcgdt2gxjqHHnJnNkBVd4uX3ZBhmPiM7J93yqCr"
18-
},
19-
"type": [
20-
"VerifiableCredential",
21-
"DigitalServiceAuthenticationCredential"
22-
]
2+
"@context": [
3+
"https://www.w3.org/2018/credentials/v1",
4+
"https://w3id.org/axone/ontology/v4/schema/credential/digital-service/authentication/"
5+
],
6+
"credentialSubject": {
7+
"id": "did:key:zQ3shhCAzQcroi4RqZ48eNudKWf75Fvv9ryJsxbaWCCPsfnFj",
8+
"toService": "did:key:zQ3shZxyDoD3QorxHJrFS68EjzDgQZSqZcj3wQqc1ngbF1vgz"
9+
},
10+
"id": "https://w3id.org/axone/ontology/v4/schema/credential/digital-service/authentication/72cab400-5bd6-4eb4-8605-a5ee8c1a45c9",
11+
"issuer": "did:key:zQ3shhCAzQcroi4RqZ48eNudKWf75Fvv9ryJsxbaWCCPsfnFj",
12+
"proof": {
13+
"created": "2024-08-20T11:03:40.941182+02:00",
14+
"jws": "eyJhbGciOiJ1bmtub3duIiwiYjY0IjpmYWxzZSwiY3JpdCI6WyJiNjQiXX0..XPcHZRhGRsV2vmaswNb5Y8Ff1e00FMbzGCvbHy6gUG55wYkWDSS0T7VI5jPVSgVMZQHZi-GJT4-g8sTLCMVV6Q",
15+
"proofPurpose": "authentication",
16+
"type": "EcdsaSecp256k1Signature2019",
17+
"verificationMethod": "did:key:zQ3shhCAzQcroi4RqZ48eNudKWf75Fvv9ryJsxbaWCCPsfnFj#zQ3shhCAzQcroi4RqZ48eNudKWf75Fvv9ryJsxbaWCCPsfnFj"
18+
},
19+
"type": [
20+
"VerifiableCredential",
21+
"DigitalServiceAuthenticationCredential"
22+
]
2323
}

0 commit comments

Comments
 (0)