import {
ApiExtraModels,
ApiHideProperty,
ApiProperty,
ApiPropertyOptional,
getSchemaPath,
} from "@nestjs/swagger";
import { JWK } from "jose";
import {
Column,
CreateDateColumn,
Entity,
JoinColumn,
ManyToOne,
UpdateDateColumn,
} from "typeorm";
import { TenantEntity } from "../../../auth/tenant/entities/tenant.entity";
import { WebhookEndpointEntity } from "../../../issuer/configuration/webhook-endpoint/entities/webhook-endpoint.entity";
import { RevocationCheckMode } from "../../../trust/types";
import { RegistrationCertificateRequest } from "../dto/vp-request.dto";
export enum TrustedAuthorityType {
ETSI_TL = "etsi_tl",
OPENID_FEDERATION = "openid_federation",
}
const DCQL_CREDENTIAL_FORMATS = ["dc+sd-jwt", "mso_mdoc"] as const;
export class TrustListRef {
@ApiPropertyOptional({
type: "string",
description:
"Managed local trust-list identifier. When provided, verifier material is resolved server-side from the trust list key chain.",
})
trustListId?: string;
@ApiPropertyOptional({
type: "string",
description:
"Trust-list JWT URL. Required for external trust lists when trustListId is not set.",
})
url!: string;
@ApiPropertyOptional({
type: "object",
additionalProperties: true,
description:
"JWK used to verify trust-list JWT signatures for external trusted authority values.",
})
verifierKey?: JWK;
@ApiPropertyOptional({
type: "string",
description:
"Base64 DER-encoded X.509 certificate used to verify trust-list JWT signatures for external trusted authority values.",
})
verifierX509Der?: string;
}
/**
* Attached attestations
*/
export class PresentationAttachment {
format!: string;
data!: any;
credential_ids?: string[];
}
export class ClaimsQuery {
id?: string;
path!: string[];
values?: string[];
}
export class MsoMdocClaimsQuery extends ClaimsQuery {
@ApiPropertyOptional({
type: "boolean",
description:
"Whether the holder should be allowed to retain the claim in an mso_mdoc response.",
})
intent_to_retain?: boolean;
}
export class DcSdJwtCredentialQueryMeta {
@ApiProperty({
type: "array",
items: { type: "string" },
description: "VCT identifiers accepted for dc+sd-jwt credentials.",
})
vct_values!: string[];
}
export class MsoMdocCredentialQueryMeta {
@ApiProperty({
type: "string",
description:
"Document type identifier accepted for mso_mdoc credentials.",
})
doctype_value!: string;
}
// TODO: extend: https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-trusted-authorities-query
abstract class TrustedAuthorityQuery {
declare type: TrustedAuthorityType;
}
export class TrustedAuthorityQueryEtsiTl extends TrustedAuthorityQuery {
@ApiProperty({
enum: [TrustedAuthorityType.ETSI_TL],
default: TrustedAuthorityType.ETSI_TL,
})
type: TrustedAuthorityType.ETSI_TL = TrustedAuthorityType.ETSI_TL;
@ApiProperty({
type: "array",
items: {
$ref: getSchemaPath(TrustListRef),
},
})
values!: TrustListRef[];
}
export class TrustedAuthorityQueryOpenIdFederation extends TrustedAuthorityQuery {
@ApiProperty({
enum: [TrustedAuthorityType.OPENID_FEDERATION],
default: TrustedAuthorityType.OPENID_FEDERATION,
})
type: TrustedAuthorityType.OPENID_FEDERATION =
TrustedAuthorityType.OPENID_FEDERATION;
@ApiProperty({
type: "array",
items: { type: "string" },
})
values!: string[];
}
type TrustedAuthorityQueryValue =
| TrustedAuthorityQueryEtsiTl
| TrustedAuthorityQueryOpenIdFederation;
export class CredentialSetQuery {
@ApiProperty({
type: "array",
items: { type: "array", items: { type: "string" } },
})
options!: string[][];
required?: boolean;
}
//TODO: extend: https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-credential-query
@ApiExtraModels(
TrustListRef,
TrustedAuthorityQueryEtsiTl,
TrustedAuthorityQueryOpenIdFederation,
DcSdJwtCredentialQueryMeta,
MsoMdocCredentialQueryMeta,
MsoMdocClaimsQuery,
)
abstract class CredentialQuery {
id!: string;
@ApiProperty({
enum: DCQL_CREDENTIAL_FORMATS,
description: "Credential format discriminator.",
})
format!: string;
multiple?: boolean;
claims?: ClaimsQuery[];
@ApiPropertyOptional({
type: "array",
items: { type: "array", items: { type: "string" } },
description:
"Ordered alternative claim combinations for this credential query.",
})
claim_sets?: string[][];
@ApiPropertyOptional({
type: "array",
description:
"Trusted authority constraints (discriminated by type) for this credential query.",
items: {
oneOf: [
{ $ref: getSchemaPath(TrustedAuthorityQueryEtsiTl) },
{
$ref: getSchemaPath(TrustedAuthorityQueryOpenIdFederation),
},
],
discriminator: {
propertyName: "type",
mapping: {
[TrustedAuthorityType.ETSI_TL]: getSchemaPath(
TrustedAuthorityQueryEtsiTl,
),
[TrustedAuthorityType.OPENID_FEDERATION]: getSchemaPath(
TrustedAuthorityQueryOpenIdFederation,
),
},
},
},
})
trusted_authorities?: TrustedAuthorityQueryValue[];
}
class CredentialQueryDcSdJwt extends CredentialQuery {
@ApiProperty({
enum: ["dc+sd-jwt"],
default: "dc+sd-jwt",
})
format = "dc+sd-jwt" as const;
@ApiProperty({
type: DcSdJwtCredentialQueryMeta,
description: "dc+sd-jwt schema metadata for the requested credential.",
})
meta!: DcSdJwtCredentialQueryMeta;
declare claims?: ClaimsQuery[];
}
class CredentialQueryMsoMdoc extends CredentialQuery {
@ApiProperty({
enum: ["mso_mdoc"],
default: "mso_mdoc",
})
format = "mso_mdoc" as const;
@ApiProperty({
type: MsoMdocCredentialQueryMeta,
description:
"mso_mdoc document type metadata for the requested credential.",
})
meta!: MsoMdocCredentialQueryMeta;
declare claims?: MsoMdocClaimsQuery[];
}
export type CredentialQueryValue =
| CredentialQueryDcSdJwt
| CredentialQueryMsoMdoc;
@ApiExtraModels(CredentialQueryDcSdJwt, CredentialQueryMsoMdoc)
export class DCQL {
@ApiPropertyOptional({
type: "array",
description: "Format-discriminated credential queries.",
items: {
oneOf: [
{ $ref: getSchemaPath(CredentialQueryDcSdJwt) },
{ $ref: getSchemaPath(CredentialQueryMsoMdoc) },
],
discriminator: {
propertyName: "format",
mapping: {
"dc+sd-jwt": getSchemaPath(CredentialQueryDcSdJwt),
mso_mdoc: getSchemaPath(CredentialQueryMsoMdoc),
},
},
},
})
credentials!: CredentialQueryValue[];
credential_sets?: CredentialSetQuery[];
}
export class TransactionData {
type!: string;
credential_ids!: string[];
[key: string]: any;
}
/**
* Cached/materialized registration certificate state for a presentation config.
*
* Server-managed; recomputed when {@link PresentationConfig.registration_cert} or
* {@link PresentationConfig.dcql_query} change, or when the JWT expires.
*/
export interface RegistrationCertCache {
/** The issued/imported registration certificate JWT. */
jwt: string;
/** Canonical-JSON hash of the cert's authorized `credentials` claim. */
fingerprint: string;
/** Canonical-JSON hash of the presentation's `dcql_query.credentials` at cache time. */
dcqlFingerprint: string;
/** Canonical-JSON hash of the {@link PresentationConfig.registration_cert} spec at cache time. */
specFingerprint: string;
/** JWT `iat` (seconds since epoch). */
issuedAt?: number;
/** JWT `exp` (seconds since epoch). */
expiresAt?: number;
/** Origin of the cached JWT. */
source: "imported" | "registrar";
}
/**
* Entity representing a configuration for a Verifiable Presentation (VP) request.
*/
@Entity()
export class PresentationConfig {
/**
* Unique identifier for the VP request.
*/
@Column("varchar", { primary: true })
id!: string;
/**
* The tenant ID for which the VP request is made.
*/
@ApiHideProperty()
@Column("varchar", { primary: true })
tenantId!: string;
/**
* The tenant that owns this object.
*/
@ManyToOne(() => TenantEntity, { cascade: true, onDelete: "CASCADE" })
tenant!: TenantEntity;
/**
* Description of the presentation configuration.
*/
@Column("varchar", { nullable: true })
description?: string | null;
/**
* Lifetime how long the presentation request is valid after creation, in seconds.
*/
@Column("int", { default: 300 })
lifeTime?: number;
/**
* Clock skew tolerance for credential JWT time validation, in seconds.
*/
@ApiPropertyOptional({
description:
"Clock skew tolerance for credential JWT time validation, in seconds.",
default: 60,
})
@Column("int", { default: 60 })
skewSeconds?: number;
/**
* Controls how credential status lists (revocation/suspension) are handled during verification.
*/
@ApiPropertyOptional({
description:
"Status list verification mode for presentations: strict (default), best_effort, or disabled.",
enum: RevocationCheckMode,
default: RevocationCheckMode.Strict,
})
@Column("varchar", { default: RevocationCheckMode.Strict })
statusCheckMode?: RevocationCheckMode;
/**
* The DCQL query to be used for the VP request.
*/
@Column("json")
dcql_query!: DCQL;
/**
*
*/
@Column("json", { nullable: true })
transaction_data?: TransactionData[];
/**
* The registration certificate request containing the necessary details.
*/
@Column("json", { nullable: true })
registration_cert?: RegistrationCertificateRequest | null;
/**
* Cached/materialized registration certificate derived from {@link registration_cert}.
*
* This is a server-managed field (not user-editable). It stores the JWT that
* was actually issued (or imported) together with fingerprints used to detect
* configuration drift. The cache is invalidated automatically when either the
* `registrationCert` spec or the `dcql_query` of this presentation config
* changes, ensuring no stale/over-broad authorizations leak into VP requests.
*
* @example
* {
* "jwt": "eyJ...",
* "fingerprint": "<canonical hash of authorized credentials[]>",
* "dcqlFingerprint": "<canonical hash of dcql_query.credentials>",
* "issuedAt": 1714050000,
* "expiresAt": 1714650000,
* "source": "registrar"
* }
*/
@ApiPropertyOptional({
description:
"Server-managed cache of the materialized registration certificate. Read-only; values supplied by clients are ignored.",
readOnly: true,
type: "object",
additionalProperties: true,
nullable: true,
})
@Column("json", { nullable: true })
registrationCertCache?: RegistrationCertCache | null;
/**
* Reference to the webhook endpoint used for notifications.
* Optional: if set, notifications will be sent to this endpoint.
*/
@Column("varchar", { nullable: true })
webhookEndpointId?: string | null;
@ApiHideProperty()
@ManyToOne(() => WebhookEndpointEntity, {
createForeignKeyConstraints: false,
})
@JoinColumn([
{ name: "webhookEndpointId", referencedColumnName: "id" },
{ name: "tenantId", referencedColumnName: "tenantId" },
])
webhookEndpoint?: WebhookEndpointEntity;
/**
* The timestamp when the VP request was created.
*/
@CreateDateColumn()
createdAt!: Date;
/**
* The timestamp when the VP request was last updated.
*/
@UpdateDateColumn()
updatedAt!: Date;
/**
* Attestation that should be attached
*/
@Column("json", { nullable: true })
attached?: PresentationAttachment[] | null;
/**
* Redirect URI to which the user-agent should be redirected after the presentation is completed.
* You can use the `{sessionId}` placeholder in the URI, which will be replaced with the actual session ID.
* @example "https://example.com/callback?session={sessionId}"
*/
@Column("varchar", { nullable: true })
redirectUri?: string | null;
/**
* Optional ID of the access certificate to use for signing the presentation request.
* If not provided, the default access certificate for the tenant will be used.
*
* Note: This is intentionally NOT a TypeORM relationship because CertEntity uses
* a composite primary key (id + tenantId), and SQLite cannot create foreign keys
* that reference only part of a composite primary key. The relationship is handled
* at the application level in the service layer.
*/
@Column("varchar", { nullable: true })
accessKeyChainId?: string | null;
/**
* Enable reader authentication for the ISO 18013-7 Annex C (DC API) flow.
*
* When `true`, the DeviceRequest embeds a detached `readerAuth` COSE_Sign1
* signed with the tenant's Access key chain (selected by
* {@link accessKeyChainId}), letting the wallet cryptographically
* authenticate the verifier — the mDOC equivalent of the signed request
* object used in the OID4VP flow. Defaults to disabled (null/false).
*
* Only affects `response_type: "iso-18013-7"` offers.
*/
@Column("boolean", { nullable: true })
readerAuth?: boolean | null;
}