@digitalbazaar/vc - npm Package Compare versions

Comparing version 1.0.0 to 2.0.0

CHANGELOG.md

 # @digitalbazaar/vc ChangeLog
 
+## 2.0.0 - 2021-10-20
+
+### Changed
+- Fix validation of `credentialSubject.id`, `issuer` and `evidence` --
+  if it's not a URI, reject the credential.
+- **BREAKING**: No longer pass in custom parameters to `issue()`.
+
+### Added
+- If `issuanceDate` is not set, default to `now()` on issuing.
+
 ## 1.0.0 - 2021-04-22
@@ -4,0 +14,0 @@

lib/vc.js

@@ -102,3 +102,2 @@ /**
  * @param {object} [options.expansionMap] - An expansion map.
- * @param {boolean} [options.compactProof] - Should the proof be compacted.
  *
@@ -109,8 +108,7 @@ * @throws {Error} If missing required properties.
  */
-async function issue(options = {}) {
-  const documentLoader = options.documentLoader || defaultDocumentLoader;
-
-  const {suite} = options;
-  const purpose = options.purpose || new CredentialIssuancePurpose();
-
+async function issue({
+  credential, suite, expansionMap,
+  purpose = new CredentialIssuancePurpose(),
+  documentLoader = defaultDocumentLoader
+} = {}) {
   // check to make sure the `suite` has required params
@@ -125,10 +123,16 @@ // Note: verificationMethod defaults to publicKey.id, in suite constructor
 
-  // run common credential checks
-  const {credential} = options;
   if(!credential) {
     throw new TypeError('"credential" parameter is required for issuing.');
   }
+
+  // Set the issuance date to now(), if missing
+  if(!credential.issuanceDate) {
+    const now = (new Date()).toJSON();
+    credential.issuanceDate = `${now.substr(0, now.length - 5)}Z`;
+  }
+
+  // run common credential checks
   _checkCredential(credential);
 
-  return jsigs.sign(credential, {purpose, documentLoader, suite, ...options});
+  return jsigs.sign(credential, {purpose, documentLoader, suite, expansionMap});
 }
@@ -520,2 +524,9 @@
 
+  // If credentialSubject.id is present and is not a URI, reject it
+  if(credential.credentialSubject.id) {
+    _validateUriId({
+      id: credential.credentialSubject.id, propertyName: 'credentialSubject.id'
+    });
+  }
+
   if(!credential.issuer) {
@@ -548,3 +559,2 @@ throw new Error('"issuer" property is required.');
   // check issuer is a URL
-  // FIXME
   if('issuer' in credential) {
@@ -555,5 +565,3 @@ const issuer = _getId(credential.issuer);
     }
-    if(!issuer.includes(':')) {
-      throw new Error(`"issuer" id must be a URL: ${issuer}`);
-    }
+    _validateUriId({id: issuer, propertyName: 'issuer'});
   }
@@ -571,7 +579,6 @@
   // check evidences are URLs
-  // FIXME
   jsonld.getValues(credential, 'evidence').forEach(evidence => {
     const evidenceId = _getId(evidence);
-    if(evidenceId && !evidenceId.includes(':')) {
-      throw new Error(`"evidence" id must be a URL: ${evidence}`);
+    if(evidenceId) {
+      _validateUriId({id: evidenceId, propertyName: 'evidence'});
     }
@@ -587,1 +594,16 @@ });
 }
+
+function _validateUriId({id, propertyName}) {
+  let parsed;
+  try {
+    parsed = new URL(id);
+  } catch(e) {
+    const error = new TypeError(`"${propertyName}" must be a URI: "${id}".`);
+    error.cause = e;
+    throw error;
+  }
+
+  if(!parsed.protocol) {
+    throw new TypeError(`"${propertyName}" must be a URI: "${id}".`);
+  }
+}

package.json

 {
   "name": "@digitalbazaar/vc",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "Verifiable Credentials JavaScript library.",
@@ -30,5 +30,5 @@ "homepage": "https://github.com/digitalbazaar/vc-js",
   "dependencies": {
-    "credentials-context": "^1.0.0",
+    "credentials-context": "^2.0.0",
     "jsonld": "^5.2.0",
-    "jsonld-signatures": "^9.0.2"
+    "jsonld-signatures": "^9.3.0"
   },
@@ -42,9 +42,9 @@ "devDependencies": {
     "@digitalbazaar/ed25519-signature-2018": "^2.0.1",
-    "@digitalbazaar/ed25519-signature-2020": "^2.1.0",
-    "@digitalbazaar/ed25519-verification-key-2018": "^3.0.0",
-    "@digitalbazaar/ed25519-verification-key-2020": "^2.0.0",
+    "@digitalbazaar/ed25519-signature-2020": "^3.0.0",
+    "@digitalbazaar/ed25519-verification-key-2018": "^3.1.1",
+    "@digitalbazaar/ed25519-verification-key-2020": "^3.1.0",
     "babel-loader": "^8.2.2",
     "chai": "^4.3.3",
     "cross-env": "^7.0.3",
-    "did-context": "^3.0.1",
+    "did-context": "^3.1.1",
     "did-veres-one": "^13.0.0",
@@ -66,3 +66,3 @@ "eslint": "^7.21.0",
     "uuid": "^8.3.2",
-    "veres-one-context": "^11.0.0",
+    "veres-one-context": "^12.0.0",
     "webpack": "^5.24.3"
@@ -69,0 +69,0 @@ },

README.md

@@ -109,3 +109,3 @@ # Verifiable Credentials JS Library _(@digitalbazaar/vc)_
 
-const signedVC = await vc.issue({credential, suite});
+const signedVC = await vc.issue({credential, suite, documentLoader});
 console.log(JSON.stringify(signedVC, null, 2));
@@ -231,3 +231,3 @@ ```
 // or
-const result = await vc.verify({credential, suite, documentLoader});
+const result = await vc.verifyCredential({credential: signedVC, suite, documentLoader});
 
@@ -307,3 +307,3 @@ ```
 
-const result = await vc.verify({presentation, challenge, suite});
+const result = await vc.verify({presentation, challenge, suite, documentLoader});
 // {valid: true}
@@ -318,3 +318,3 @@ ```
 const result = await vc.verify({
-  presentation, suite, unsignedPresentation: true
+  presentation, suite, documentLoader, unsignedPresentation: true
 });
@@ -352,3 +352,3 @@ // {valid: true}
 ```js
-const result = await vc.verifyCredential({credential, suite});
+const result = await vc.verifyCredential({credential, suite, documentLoader});
 // {valid: true}
@@ -355,0 +355,0 @@ ```

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

53482

increased by1.64%

Lines of code

873

increased by2.22%

Worsened metrics

Number of medium supply chain risk alerts

1

increased byInfinity%

Dependency changes

• + Addedcredentials-context@2.0.0(transitive)

• - Removedcredentials-context@1.0.0(transitive)

• Updatedcredentials-context@^2.0.0

• Updatedjsonld-signatures@^9.3.0