feat(pollux): wire SD-JWT requiredClaimKeys from presentation request to verify - #644
Open
abhigyan1102 wants to merge 1 commit into
Open
Conversation
… to verify Extract required claim keys from the presentation request's input_descriptors.constraints.fields and forward them to SDJWT.verify() during presentation verification. Previously hardcoded to [], which meant @sd-jwt/core never enforced that required claims were actually disclosed by the holder. Fixes hyperledger-identus#366 Signed-off-by: Abhigyan Singh <abhigyansingh664@gmail.com>
|
Contributor
Author
|
@elribonazo can you review this one!! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes #366 Presentation Verification: SD-JWT Required Claims.
The Problem
During SD-JWT presentation verification,
requiredClaimKeyswas hardcoded to[]in the DIFPresentationVerifyhandler. This meant@sd-jwt/corenever enforced that required claims were actually disclosed by the holder, allowing presentations with missing mandatory fields to pass signature verification.Root Cause
The verifier's
input_descriptors.constraints.fieldsspecifies which claims must be disclosed, but these were never extracted and forwarded toSDJWT.verify().Changes
PresentationVerify.ts(~30 lines):extractRequiredClaimKeys()method extracts non-optional fields frominputDescriptor.constraints.fields,converting JSONPaths to the dot-path formatused by
@sd-jwt/core'slistKeys()(e.g.$.vc.credentialSubject.firstname→vc.credentialSubject.firstname)getCredential()to acceptinputDescriptorand forward extracted keysto
SDJWT.verify({ requiredClaimKeys })processDescriptorItem()to threadinputDescriptorthroughPresentationVerify.test.ts(3 new tests + 3 updated assertions):New:
Should fail verification when required claims are not disclosedShould pass verification when all required claims are disclosedShould not include optional fields in required claim keysUpdated: 3 existing SDJWT tests now verify against the earlier rejection layer (required claims enforcement at
@sd-jwt/corelevel instead ofvalidateField).Backward Compatibility
When no
inputDescriptoris available,requiredClaimKeysdefaults to[]preserving existing behavior for non-DIF verification paths.Testing
All 23 tests pass locally (14 JWT + 9 SDJWT including 3 new requiredClaimKeys tests).
Related
Builds on PR #624 (SD-JWT Key Binding JWT) which addressed the same presentation flow.