[INJIVER-1369] using com.authlete:cbor libray and add the unit tests#219
[INJIVER-1369] using com.authlete:cbor libray and add the unit tests#219mayuradesh merged 3 commits intoinji:developfrom
Conversation
Signed-off-by: jaswanthkumarpolisetty <jaswanthkumar.p@thoughtworks.com>
WalkthroughAdds Authlete CBOR dependency, updates CwtVerifier to parse and verify COSE_Sign1 via Authlete CBOR/COSEVerifier, and introduces unit tests plus JWKS and hex fixtures for EC-CWT verification scenarios. Changes
Sequence Diagram(s)mermaid Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Fix all issues with AI agents
In `@vc-verifier/kotlin/gradle/libs.versions.toml`:
- Line 31: Update the authleteCbor version string (the libs.versions.toml entry
named authleteCbor) to a valid released version such as "1.18" (or confirm and
set the intended pre-release if that was meant) so the dependency resolves from
Maven Central; ensure the change preserves the dual-CBOR approach alongside
co.nstant.in:cbor 0.9 if both are required.
In
`@vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt`:
- Around line 45-48: The code in CwtVerifier that constructs the JWKS URI
currently does URI(issURI.toString() + "/.well-known/jwks.json") which can
produce double slashes when issURI ends with '/', so update the branch that
handles "http"/"https" to normalize the issuer before appending: obtain the
string from issURI (or use issURI.path), trim any trailing '/' from the issuer
string (or use URI.resolve with a relative path) and then append
"/.well-known/jwks.json" to produce a single-slash canonical URI; ensure you
still return a URI instance and keep the "did" branch unchanged.
In
`@vc-verifier/kotlin/vcverifier/src/test/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifierTest.kt`:
- Around line 31-38: The test `should fail when EC CWT is verified with wrong
public key` currently only reads `coseHex` and never exercises the verifier;
update it to invoke the verification routine (e.g., call CwtVerifier.verify or
the project-specific verifier method) passing the `coseHex` and the incorrect
public key, and assert the negative outcome—either with assertThrows for an
expected exception or assertFalse/assertEquals for a boolean/error result—so the
test actually fails verification when given the wrong key.
🧹 Nitpick comments (1)
vc-verifier/kotlin/vcverifier/src/test/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifierTest.kt (1)
17-21: Consider unmocking the NetworkManagerClient after tests.
mockkObjectin a PER_CLASS lifecycle can leak mocks to other tests; an@AfterAllunmock helps keep tests isolated.♻️ Suggested teardown
+import io.mockk.unmockkObject +import org.junit.jupiter.api.AfterAll + +@AfterAll +fun tearDown() { + unmockkObject(NetworkManagerClient.Companion) +}
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (8)
vc-verifier/kotlin/gradle/libs.versions.tomlvc-verifier/kotlin/vcverifier/build.gradle.ktsvc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.ktvc-verifier/kotlin/vcverifier/src/test/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifierTest.ktvc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/invalid-ec-cwt.hexvc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/public_key/jwksECkey.jsonvc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/public_key/jwksinvalidECkey.jsonvc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/valid-ec-cwt.hex
🧰 Additional context used
🧠 Learnings (4)
📓 Common learnings
Learnt from: jaswanthkumartw
Repo: inji/vc-verifier PR: 216
File: vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt:22-26
Timestamp: 2026-01-09T06:10:25.708Z
Learning: In the CWT verification flow for the CwtVerifier and CwtValidator classes, validation is performed before verification. CwtValidator.validate() checks structure and claims first, then CwtVerifier.verify() performs signature verification. The verifier does not need to duplicate detailed structure validation since it's already handled by the validator.
📚 Learning: 2026-01-09T05:57:56.476Z
Learnt from: jaswanthkumartw
Repo: inji/vc-verifier PR: 216
File: vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/keyResolver/Utils.kt:79-85
Timestamp: 2026-01-09T05:57:56.476Z
Learning: In the file vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/keyResolver/Utils.kt, the constant JWK_KEY_TYPE_EC is defined as "EC", so when this constant is used in pattern matching, it already covers the raw "EC" string value.
Applied to files:
vc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/valid-ec-cwt.hexvc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/invalid-ec-cwt.hexvc-verifier/kotlin/vcverifier/src/test/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifierTest.ktvc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/public_key/jwksECkey.jsonvc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/public_key/jwksinvalidECkey.json
📚 Learning: 2026-01-09T06:10:25.708Z
Learnt from: jaswanthkumartw
Repo: inji/vc-verifier PR: 216
File: vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt:22-26
Timestamp: 2026-01-09T06:10:25.708Z
Learning: In the CWT verification flow for the CwtVerifier and CwtValidator classes, validation is performed before verification. CwtValidator.validate() checks structure and claims first, then CwtVerifier.verify() performs signature verification. The verifier does not need to duplicate detailed structure validation since it's already handled by the validator.
Applied to files:
vc-verifier/kotlin/vcverifier/src/test/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifierTest.ktvc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt
📚 Learning: 2026-01-07T10:57:37.322Z
Learnt from: jaswanthkumartw
Repo: inji/vc-verifier PR: 216
File: vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt:95-123
Timestamp: 2026-01-07T10:57:37.322Z
Learning: In the CwtVerifier class, the `PublicKeyResolverFactory().get(issuer)` method throws `PublicKeyNotFoundException` when a key cannot be resolved, rather than returning null.
Applied to files:
vc-verifier/kotlin/vcverifier/src/test/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifierTest.ktvc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt
🧬 Code graph analysis (1)
vc-verifier/kotlin/vcverifier/src/test/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifierTest.kt (1)
vc-verifier/kotlin/vcverifier/src/test/java/testutils/TestUtils.kt (2)
readClasspathFile(8-9)mockHttpResponse(13-17)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build-maven-vc-verifier / maven-build
🔇 Additional comments (6)
vc-verifier/kotlin/vcverifier/build.gradle.kts (1)
72-72: LGTM!The dependency addition is correctly configured and aligns with the version catalog entry in
libs.versions.toml.vc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/invalid-ec-cwt.hex (1)
1-1: LGTM!The invalid EC-CWT test fixture is appropriately added for negative test scenarios. Having both valid and invalid test resources ensures comprehensive coverage of the verification flow.
vc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/valid-ec-cwt.hex (1)
1-1: LGTM!The valid EC-CWT test fixture is correctly structured (CBOR tag 18 prefix
d284indicates COSE_Sign1) and appropriately added for positive test scenarios.vc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/public_key/jwksECkey.json (1)
1-13: LGTM!The JWKS test fixture is well-formed and follows RFC 7517 structure correctly. The EC P-256 key with ES256 algorithm is appropriate for testing the COSEVerifier-based verification flow.
vc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/public_key/jwksinvalidECkey.json (1)
1-13: Test JWKS fixture looks consistent.Fields required for an ES256 EC public key are present and well-formed for test usage.
vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt (1)
100-108: Confirm tagged-only COSE_Sign1 parsing is intentional.
parseCoseSign1now rejects untagged COSE_Sign1 inputs. If any issuers produce untagged Sign1 (allowed in some profiles), verification will fail despitevalidateCoseStructurepassing. Please verify expected input format and Authlete decoder behavior; if untagged tokens are possible, accept both tagged and untagged forms.
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
...erifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt
Show resolved
Hide resolved
...ier/src/test/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifierTest.kt
Show resolved
Hide resolved
…t case Signed-off-by: jaswanthkumarpolisetty <jaswanthkumar.p@thoughtworks.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@vc-verifier/kotlin/gradle/libs.versions.toml`:
- Line 31: Update the pinned dependency value for authleteCbor in the
libs.versions.toml by changing the authleteCbor entry from "1.18" to "1.19"
(replace the authleteCbor = "1.18" line with authleteCbor = "1.19") so the
project uses the latest release; run a quick build to confirm no compatibility
issues after the version bump.
🧹 Nitpick comments (1)
vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt (1)
121-121: Usevalinstead ofvar.
issueris never reassigned, so it should be declared asvalfor immutability.🔧 Suggested fix
- var issuer = extractIssuer(claims) + val issuer = extractIssuer(claims)
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
vc-verifier/kotlin/gradle/libs.versions.tomlvc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.ktvc-verifier/kotlin/vcverifier/src/test/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifierTest.ktvc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/public_key/jwksinvalidECkey.json
🚧 Files skipped from review as they are similar to previous changes (2)
- vc-verifier/kotlin/vcverifier/src/test/resources/cwt_vc/public_key/jwksinvalidECkey.json
- vc-verifier/kotlin/vcverifier/src/test/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifierTest.kt
🧰 Additional context used
🧠 Learnings (2)
📚 Learning: 2026-01-09T06:10:25.708Z
Learnt from: jaswanthkumartw
Repo: inji/vc-verifier PR: 216
File: vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt:22-26
Timestamp: 2026-01-09T06:10:25.708Z
Learning: In the CWT verification flow for the CwtVerifier and CwtValidator classes, validation is performed before verification. CwtValidator.validate() checks structure and claims first, then CwtVerifier.verify() performs signature verification. The verifier does not need to duplicate detailed structure validation since it's already handled by the validator.
Applied to files:
vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt
📚 Learning: 2026-01-07T10:57:37.322Z
Learnt from: jaswanthkumartw
Repo: inji/vc-verifier PR: 216
File: vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt:95-123
Timestamp: 2026-01-07T10:57:37.322Z
Learning: In the CwtVerifier class, the `PublicKeyResolverFactory().get(issuer)` method throws `PublicKeyNotFoundException` when a key cannot be resolved, rather than returning null.
Applied to files:
vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt
🪛 detekt (1.23.8)
vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt
[warning] 95-95: The caught exception is swallowed. The original exception could be lost.
(detekt.exceptions.SwallowedException)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build-maven-vc-verifier / maven-build
🔇 Additional comments (5)
vc-verifier/kotlin/vcverifier/src/main/java/io/mosip/vercred/vcverifier/credentialverifier/verifier/CwtVerifier.kt (4)
3-6: LGTM!The new Authlete CBOR/COSE imports align well with the updated verification flow.
44-47: LGTM - previous review concern addressed.The use of
removeSuffix("/")properly handles trailing slashes in the issuer URI, preventing double-slash issues in the constructed JWKS URL.
100-109: LGTM!The
parseCoseSign1method has good defensive error handling with clear, specific error messages for each failure case (empty input, missing tag, invalid structure).
93-97: The suggested fix won't compile; SignatureVerificationException doesn't accept a cause parameter.The current constructor for
SignatureVerificationExceptiononly accepts amessage: String?parameter and doesn't support passing a cause. The parent classBaseUncheckedExceptionsimilarly only acceptserrorMessage: String?and passes it toRuntimeException.To implement the suggestion of passing the original exception as a cause, the exception hierarchy would need to be modified first:
- Update
BaseUncheckedExceptionto accept and pass acauseparameter toRuntimeException- Update
SignatureVerificationExceptionto accept and pass acauseparameter toBaseUncheckedException- Then update the call site to pass the exception as the cause
Without these changes, the current code is correct for the existing constructor signature.
Likely an incorrect or invalid review comment.
vc-verifier/kotlin/gradle/libs.versions.toml (1)
68-68: Catalog alias wiring is correct and properly used.The
authlete-cboralias is correctly defined with a valid version reference (authleteCbor = "1.18") and is actively referenced invcverifier/build.gradle.kts(line 72). The dependency is imported and used inCwtVerifier.kt.
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
Signed-off-by: jaswanthkumarpolisetty <jaswanthkumar.p@thoughtworks.com>
mayuradesh
changed the title
2 participants
Summary by CodeRabbit
Dependencies
Improvements
Tests
✏️ Tip: You can customize this high-level summary in your review settings.