diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index 650b3c6..1801c92 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -33,3 +33,24 @@ jobs: path: '**/*.md' check_filenames: true ignore_words_list: tekst + + build: + name: Build documentation + needs: quality + runs-on: [ubuntu-latest] + + steps: + - name: Run docs build + if: github.event_name != 'pull_request' + uses: actions/github-script@v8 + with: + # Token has to be generated on a user account that controls the docs-repository. + # The _only_ scope to select is "Access public repositories", nothing more. + github-token: ${{ secrets.PAT_TOKEN }} + script: | + await github.rest.actions.createWorkflowDispatch({ + owner: 'simplesamlphp', + repo: 'docs', + workflow_id: 'mk_docs.yml', + ref: 'main' + }) diff --git a/.github/workflows/php.yml b/.github/workflows/php.yml index 60f8158..e3c6bd2 100644 --- a/.github/workflows/php.yml +++ b/.github/workflows/php.yml @@ -120,7 +120,7 @@ jobs: uses: shivammathur/setup-php@v2 with: php-version: ${{ matrix.php-versions }} - extensions: ctype, date, dom, filter, hash, mbstring, openssl, pcre, soap, spl, xml, sodium + extensions: ctype, date, dom, filter, hash, mbstring, openssl, pcre, soap, spl, xml, sodium, gmp tools: composer ini-values: error_reporting=E_ALL coverage: none diff --git a/README.md b/README.md index 8265ede..1e41de2 100644 --- a/README.md +++ b/README.md @@ -3,281 +3,23 @@ [![Build Status](https://github.com/simplesamlphp/openid/actions/workflows/php.yml/badge.svg)](https://github.com/simplesamlphp/openid/actions/workflows/php.yml) [![Coverage Status](https://codecov.io/gh/simplesamlphp/openid/branch/master/graph/badge.svg)](https://app.codecov.io/gh/simplesamlphp/openid) -The library is under development, and you can expect braking changes along the way. +The library provides some common tools that you might find useful when working with the OpenID family of specifications. -The library provides some common tools that you might find useful when working with OpenID family of specifications. +> The library is under development, and you can expect braking changes along the way. -## Installation - -Library can be installed by using Composer: - -```shell -composer require simplesamlphp/openid -``` - -## OpenID Federation (draft 43) - -The initial functionality of the library revolves around the OpenID Federation specification. To use it, create an -instance of the class `\SimpleSAML\OpenID\Federation` - -```php -cache, // \Psr\SimpleCache\CacheInterface - logger: $this->logger, // \Psr\Log\LoggerInterface - ); - - // Continue with using available tools ... - - return new Response(); - } -} -``` - -### Trust chain resolver - -Once you have a `\SimpleSAML\OpenID\Federation` instantiated, you can continue with using available tools. The first -tool we will take a look at is trust chain resolver. This tool can be used to try and resolve the (shortest) trust chain -for given leaf entity (subject) and trusted anchors: - -```php - -// ... - -try { - /** @var \SimpleSAML\OpenID\Federation $federationTools */ - /** @var \SimpleSAML\OpenID\Federation\TrustChainBag $trustChainBag */ - $trustChainBag = $federationTools->trustChainResolver()->for( - 'https://leaf-entity-id.example.org/', // Trust chain subject (leaf entity). - [ - // List of valid trust anchors. - 'https://trust-achor-id.example.org/', - 'https://other-trust-achor-id.example.org/', - ], - ); -} catch (\Throwable $exception) { - $this->logger->error('Could not resolve trust chain: ' . $exception->getMessage()) - return; -} - -``` - -If the trust chain is successfully resolved, this will return an instance of -`\SimpleSAML\OpenID\Federation\TrustChainBag`. Otherwise, exception will be thrown. -From the TrustChainBag you can get the TrustChain using several methods. - -```php - -// ... - -try { - /** @var \SimpleSAML\OpenID\Federation\TrustChain $trustChain */ - /** @var \SimpleSAML\OpenID\Federation\TrustChainBag $trustChainBag */ - // Simply get the shortest available chain. - $trustChain = $trustChainBag->getShortest(); - // Get the shortest chain, but take into account the Trust Anchor priority. - $trustChain = $trustChainBag->getShortestByTrustAnchorPriority( - 'https://other-trust-achor-id.example.org/', // Get chain for this Trust Anchor even if the chain is longer. - 'https://trust-achor-id.example.org/', - ); -} catch (\Throwable $exception) { - $this->logger->error('Could not resolve trust chain: ' . $exception->getMessage()) - return; -} - -``` - -Once you have the Trust Chain, you can try and get the resolved metadata for particular entity type. Resolved metadata -means that all metadata policies from all intermediates have been successfully applied. Here is one example for trying -to get metadata for OpenID RP, which will return an array (or null if no metadata is available for given entity type): - -```php -// ... - -$entityType = \SimpleSAML\OpenID\Codebooks\EntityTypesEnum::OpenIdRelyingParty; - -try { - /** @var \SimpleSAML\OpenID\Federation\TrustChain $trustChain */ - $metadata = $trustChain->getResolvedMetadata($entityType); -} catch (\Throwable $exception) { - $this->logger->error( - sprintf( - 'Error resolving metadata for entity type %s. Error: %s.', - $entityType->value, - $exception->getMessage(), - ), - ); - return; -} - -if (is_null($metadata)) { - $this->logger->error( - sprintf( - 'No metadata available for entity type %s.', - $entityType->value, - ), - ); - return; -} ``` - -If getting metadata results in an exception, the metadata is considered invalid and is to be discarded. - -### Additional verification of signatures - -The whole trust chain (each entity statement) has been verified using public keys from JWKS claims in configuration / -subordinate statements. As per specification recommendation, you can also validate the signature of the Trust Chain -Configuration Statement by using the Trust Anchor public keys (JWKS) that you have acquired in some secure out-of-band -way (so to not only rely on TLS protection while fetching Trust Anchor Configuration Statement): - -```php - -// ... - -// Get entity statement for the resolved Trust Anchor: -/** @var \SimpleSAML\OpenID\Federation\TrustChain $trustChain */ -$trustAnchorConfigurationStatement = $trustChain->getResolvedTrustAnchor(); -// Get data that you need to prepare appropriate public keys, for example, the entity ID: -$trustAnchorEntityId = $trustAnchorConfigurationStatement->getIssuer(); - -// Prepare JWKS array containing Trust Anchor public keys that you have acquired in secure out-of-band way ... -/** @var array $trustAnchorJwks */ - -try { - $trustAnchorConfigurationStatement->verifyWithKeySet($trustAnchorJwks); -} catch (\Throwable $exception) { - $this->logger->error('Could not verify trust anchor configuration statement signature: ' . - $exception->getMessage()); - return; -} - +/* + * + * | + * \ ___ / _________ + * _ / \ _ GÉANT | * * | Co-Funded by + * | ~ | Trust & Identity | * * | the European + * \_/ Incubator |__*_*__| Union + * = + * + */ ``` -### Fetching Trust Marks - -Federation tools expose Trust Mark Fetcher which you can use to dynamically fetch or refresh (short-living) Trust Marks. - -```php -// ... - -/** @var \SimpleSAML\OpenID\Federation $federationTools */ +To get started, refer to [library documentation](docs/1-openid.md). -// Trust Mark Type that you want to fetch. -$trustMarkType = 'https://example.com/trust-mark/member'; -// ID of Subject for which to fetch the Trust Mark. -$subjectId = 'https://leaf-entity.org' -// ID of the Trust Mark Issuer from which to fetch the Trust Mark. -$trustMarkIssuerEntityId = 'https://trust-mark-issuer.org' -try { - // First, fetch the Configuration Statement for Trust Mark Issuer. - $trustMarkIssuerConfigurationStatement = $this->federation - ->entityStatementFetcher() - ->fromCacheOrWellKnownEndpoint($trustMarkIssuerEntityId); - - // Fetch the Trust Mark from Issuer. - $trustMarkEntity = $federationTools->trustMarkFetcher()->fromCacheOrFederationTrustMarkEndpoint( - $trustMarkType, - $subjectId, - $trustMarkIssuerConfigurationStatement - ); - -} catch (\Throwable $exception) { - $this->logger->error('Trust Mark fetch failed. Error was: ' . $exception->getMessage()); - return; -} - -``` - -### Validating Trust Marks - -Federation tools expose Trust Mark Validator with several methods for validating -Trust Marks, with the most common one being the one to validate Trust Mark for -some entity simply based on the Trust Mark Type. - -If cache is used, Trust Mark validation will be cached with cache TTL being the minimum expiration -time of Trust Mark, Leaf Entity Statement or `maxCacheDuration`, whatever is smaller. - -```php -// ... - -/** @var \SimpleSAML\OpenID\Federation $federationTools */ -/** @var \SimpleSAML\OpenID\Federation\TrustChain $trustChain */ - - -// Trust Mark Type that you want to validate. -$trustMarkType = 'https://example.com/trust-mark/member'; -// Leaf for which you want to validate the Trust Mark with ID above. -$leafEntityConfigurationStatement = $trustChain->getResolvedLeaf(); -// Trust Anchor under which you want to validate Trust Mark. -$trustAnchorConfigurationStatement = $trustChain->getResolvedTrustAnchor(); - -try { - // Example which queries cache for previously validated Trust Mark and does formal validation if not cached. - $federationTools->trustMarkValidator()->fromCacheOrDoForTrustMarkType( - $trustMarkType, - $leafEntityConfigurationStatement, - $trustAnchorConfigurationStatement, - $expectedJwtType = \SimpleSAML\OpenID\Codebooks\JwtTypesEnum::TrustMarkJwt, - ); - - // Example which always does formal validation (does not use cache), and requires usage of Trust Mark - // Status Endpoint for non-expiring Trust Marks. - $federationTools->trustMarkValidator()->doForTrustMarkType( - $trustMarkType, - $leafEntityConfigurationStatement, - $trustAnchorConfigurationStatement, - $expectedJwtType = \SimpleSAML\OpenID\Codebooks\JwtTypesEnum::TrustMarkJwt, - \SimpleSAML\OpenID\Codebooks\TrustMarkStatusEndpointUsagePolicyEnum::RequiredForNonExpiringTrustMarksOnly, - ); -} catch (\Throwable $exception) { - $this->logger->error('Trust Mark validation failed. Error was: ' . $exception->getMessage()); - return; -} - -``` diff --git a/composer.json b/composer.json index 86d8d7d..0c44e2d 100644 --- a/composer.json +++ b/composer.json @@ -22,7 +22,10 @@ }, "require": { "php": "^8.2", + "ext-gmp": "*", "ext-filter": "*", + "ext-mbstring": "*", + "ext-hash": "*", "guzzlehttp/guzzle": "^7.8", "psr/http-client": "^1", diff --git a/docs/1-openid.md b/docs/1-openid.md new file mode 100644 index 0000000..b088151 --- /dev/null +++ b/docs/1-openid.md @@ -0,0 +1,5 @@ +# OpenID Tools Library + +1. [Installation](2-installation.md) +2. [OpenID Federation Tools](3-federation.md) +3. [OpenID for Verifiable Credential Issuance (OpenID4VCI) Tools](4-vci.md) diff --git a/docs/2-installation.md b/docs/2-installation.md new file mode 100644 index 0000000..3652bb6 --- /dev/null +++ b/docs/2-installation.md @@ -0,0 +1,7 @@ +## OpenID Tools Library Installation + +Library can be installed by using Composer: + +```shell +composer require simplesamlphp/openid +``` \ No newline at end of file diff --git a/docs/3-federation.md b/docs/3-federation.md new file mode 100644 index 0000000..2951930 --- /dev/null +++ b/docs/3-federation.md @@ -0,0 +1,287 @@ +## OpenID Federation Tools (draft 44) + +To use it, create an instance of the class `\SimpleSAML\OpenID\Federation`. + +```php +cache, // \Psr\SimpleCache\CacheInterface + logger: $this->logger, // \Psr\Log\LoggerInterface + ); + + // Continue with using available tools ... + + return new Response(); + } +} +``` + +### Trust chain resolver + +Once you have a `\SimpleSAML\OpenID\Federation` instantiated, you can continue +with using available tools. The first tool we will take a look at is the Trust +Chain Resolver. This tool can be used to try and resolve the (shortest) trust +chain for a given leaf entity (subject) and trusted anchors: + +```php + +// ... + +try { + /** @var \SimpleSAML\OpenID\Federation $federationTools */ + /** @var \SimpleSAML\OpenID\Federation\TrustChainBag $trustChainBag */ + $trustChainBag = $federationTools->trustChainResolver()->for( + 'https://leaf-entity-id.example.org/', // Trust chain subject (leaf). + [ + // List of valid trust anchors. + 'https://trust-achor-id.example.org/', + 'https://other-trust-achor-id.example.org/', + ], + ); +} catch (\Throwable $exception) { + $this->logger->error('Could not resolve trust chain: ' . + $exception->getMessage()) + return; +} + +``` + +If the trust chain is successfully resolved, this will return an instance of +`\SimpleSAML\OpenID\Federation\TrustChainBag`. Otherwise, an exception will + be thrown. From the TrustChainBag you can get the TrustChain using several +methods. + +```php + +// ... + +try { + /** @var \SimpleSAML\OpenID\Federation\TrustChain $trustChain */ + /** @var \SimpleSAML\OpenID\Federation\TrustChainBag $trustChainBag */ + // Simply get the shortest available chain. + $trustChain = $trustChainBag->getShortest(); + // Get the shortest chain, but take into account the Trust Anchor priority. + $trustChain = $trustChainBag->getShortestByTrustAnchorPriority( + // Get a chain for this Trust Anchor even if the chain is longer. + 'https://other-trust-achor-id.example.org/', + 'https://trust-achor-id.example.org/', + ); +} catch (\Throwable $exception) { + $this->logger->error('Could not resolve trust chain: ' . + $exception->getMessage()) + return; +} + +``` + +Once you have the Trust Chain, you can try and get the resolved metadata for +a particular entity type. Resolved metadata means that all metadata policies +from all intermediates have been successfully applied. Here is one example +for trying to get metadata for OpenID RP, which will return an array +(or null if no metadata is available for a given entity type): + +```php +// ... + +$entityType = \SimpleSAML\OpenID\Codebooks\EntityTypesEnum::OpenIdRelyingParty; + +try { + /** @var \SimpleSAML\OpenID\Federation\TrustChain $trustChain */ + $metadata = $trustChain->getResolvedMetadata($entityType); +} catch (\Throwable $exception) { + $this->logger->error( + sprintf( + 'Error resolving metadata for entity type %s. Error: %s.', + $entityType->value, + $exception->getMessage(), + ), + ); + return; +} + +if (is_null($metadata)) { + $this->logger->error( + sprintf( + 'No metadata available for entity type %s.', + $entityType->value, + ), + ); + return; +} +``` + +If getting metadata results in an exception, the metadata is considered invalid +and is to be discarded. + +### Additional verification of signatures + +The whole trust chain (each entity statement) has been verified using public +keys from JWKS claims in configuration / subordinate statements. As per +specification recommendation, you can also validate the signature of the +Trust Chain Configuration Statement by using the Trust Anchor public +keys (JWKS) that you have acquired in some secure out-of-band way +(so to not only rely on TLS protection while fetching Trust Anchor +Configuration Statement): + +```php + +// ... + +// Get entity statement for the resolved Trust Anchor: +/** @var \SimpleSAML\OpenID\Federation\TrustChain $trustChain */ +$trustAnchorConfigurationStatement = $trustChain->getResolvedTrustAnchor(); +// Get data that you need to prepare appropriate public keys, for example, +// the entity ID: +$trustAnchorEntityId = $trustAnchorConfigurationStatement->getIssuer(); + +// Prepare a JWKS array containing Trust Anchor public keys that you have +// acquired in a secure out-of-band way... +/** @var array $trustAnchorJwks */ + +try { + $trustAnchorConfigurationStatement->verifyWithKeySet($trustAnchorJwks); +} catch (\Throwable $exception) { + $this->logger->error( + 'Could not verify trust anchor configuration statement signature: ' . + $exception->getMessage(), + ); + return; +} + +``` + +### Fetching Trust Marks + +Federation tools expose Trust Mark Fetcher, which you can use to dynamically +fetch or refresh (short-living) Trust Marks. + +```php +// ... + +/** @var \SimpleSAML\OpenID\Federation $federationTools */ + +// Trust Mark Type that you want to fetch. +$trustMarkType = 'https://example.com/trust-mark/member'; +// ID of Subject for which to fetch the Trust Mark. +$subjectId = 'https://leaf-entity.org' +// ID of the Trust Mark Issuer from which to fetch the Trust Mark. +$trustMarkIssuerEntityId = 'https://trust-mark-issuer.org' + +try { + // First, fetch the Configuration Statement for Trust Mark Issuer. + $trustMarkIssuerConfigurationStatement = $this->federation + ->entityStatementFetcher() + ->fromCacheOrWellKnownEndpoint($trustMarkIssuerEntityId); + + // Fetch the Trust Mark from Issuer. + $trustMarkEntity = $federationTools->trustMarkFetcher() + ->fromCacheOrFederationTrustMarkEndpoint( + $trustMarkType, + $subjectId, + $trustMarkIssuerConfigurationStatement + ); + +} catch (\Throwable $exception) { + $this->logger->error('Trust Mark fetch failed. Error was: ' . + $exception->getMessage()); + return; +} + +``` + +### Validating Trust Marks + +Federation tools expose Trust Mark Validator with several methods for validating +Trust Marks, with the most common one being the one to validate Trust Mark for +some entity simply based on the Trust Mark Type. + +If cache is used, Trust Mark validation will be cached with cache TTL being the +minimum expiration time of Trust Mark, Leaf Entity Statement or +`maxCacheDuration`, whatever is smaller. + +```php +// ... + +/** @var \SimpleSAML\OpenID\Federation $federationTools */ +/** @var \SimpleSAML\OpenID\Federation\TrustChain $trustChain */ + + +// Trust Mark Type that you want to validate. +$trustMarkType = 'https://example.com/trust-mark/member'; +// Leaf for which you want to validate the Trust Mark with ID above. +$leafEntityConfigurationStatement = $trustChain->getResolvedLeaf(); +// Trust Anchor, under which you want to validate Trust Mark. +$trustAnchorConfigurationStatement = $trustChain->getResolvedTrustAnchor(); + +try { + // Example which queries cache for previously validated Trust Mark and does + // formal validation if not cached. + $federationTools->trustMarkValidator()->fromCacheOrDoForTrustMarkType( + $trustMarkType, + $leafEntityConfigurationStatement, + $trustAnchorConfigurationStatement, + $expectedJwtType = \SimpleSAML\OpenID\Codebooks\JwtTypesEnum::TrustMarkJwt, + ); + + // Example which always does formal validation (does not use cache), and + // requires usage of Trust Mark Status Endpoint for non-expiring Trust + // Marks. + $federationTools->trustMarkValidator()->doForTrustMarkType( + $trustMarkType, + $leafEntityConfigurationStatement, + $trustAnchorConfigurationStatement, + $expectedJwtType = \SimpleSAML\OpenID\Codebooks\JwtTypesEnum::TrustMarkJwt, + \SimpleSAML\OpenID\Codebooks\TrustMarkStatusEndpointUsagePolicyEnum::RequiredForNonExpiringTrustMarksOnly, + ); +} catch (\Throwable $exception) { + $this->logger->error('Trust Mark validation failed. Error was: ' . $exception->getMessage()); + return; +} + +``` \ No newline at end of file diff --git a/docs/4-vci.md b/docs/4-vci.md new file mode 100644 index 0000000..261cd16 --- /dev/null +++ b/docs/4-vci.md @@ -0,0 +1,121 @@ +## OpenID for Verifiable Credential Issuance (OpenID4VCI) Tools + +To use it, create an instance of the `\SimpleSAML\OpenID\VerifiableCredentials` +class. + +```php + +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmBag; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; +use SimpleSAML\OpenID\Jwk; +use SimpleSAML\OpenID\Serializers\JwsSerializerBag; +use SimpleSAML\OpenID\Serializers\JwsSerializerEnum; +use SimpleSAML\OpenID\SupportedAlgorithms; +use SimpleSAML\OpenID\VerifiableCredentials; + +// Prepare supported JWS serializers. +$jwsSerializerBag = new JwsSerializerBag( + JwsSerializerEnum::Compact, +); + +// Prepare supported signature algorithms. +$supportedAlgorithms = new SupportedAlgorithms( + new SignatureAlgorithmBag( + SignatureAlgorithmEnum::RS256, + SignatureAlgorithmEnum::RS384, + SignatureAlgorithmEnum::RS512, + SignatureAlgorithmEnum::ES256, + SignatureAlgorithmEnum::ES384, + SignatureAlgorithmEnum::ES512, + SignatureAlgorithmEnum::PS256, + SignatureAlgorithmEnum::PS384, + SignatureAlgorithmEnum::PS512, + ), +); + +// Choose the leeway time used when validate timestamps like `exp`, `iat`, etc. +$timestampValidationLeeway = new DateInterval('PT1M'); + +$verifiableCredentialTools = new VerifiableCredentials( + $jwsSerializerBag, + $supportedAlgorithms, + $timestampValidationLeeway, +); + +// You can also use the JWK Tools to create a JWK decorator from a private key file. +$jwkTools = new Jwk(); +``` + +You can now use the `$verifiableCredentialTools` instance to create and verify +verifiable credentials. + +### Creating SD-JWT VCs + +The following example shows how to create a SD-JWT VC. + +```php + +use SimpleSAML\OpenID\Codebooks\ClaimsEnum; + +/** @var \SimpleSAML\OpenID\VerifiableCredentials $verifiableCredentialTools */ +/** @var \SimpleSAML\OpenID\Jwk $jwkTools */ + +// Use any logic necessary to prepare data to be disclosed. +$disclosedData = [ + 'name' => 'John', + // ... +]; + +// Prepare a disclosure bag. +$disclosureBag = $verifiableCredentialTools->disclosureBagFactory()->build(); + +// Add disclosures to the bag. +foreach ($disclosedData as $key => $value) { + $disclosure = $verifiableCredentialTools->disclosureFactory()->build( + value: $value, + name: $key, + path: [], // Or set a path as ['path', 'to', 'value'] + saltBlacklist: $disclosureBag->salts(), // To prevent salt collisions. + ); + + $disclosureBag->add($disclosure); +} + +$issuedAt = new \DateTimeImmutable(); + +// Use any logic necessary to prepare basic JWT payload data. +$jwtPayload = [ + ClaimsEnum::Iss->value => 'https://example.com/issuer', + ClaimsEnum::Iat->value => $issuedAt->getTimestamp(), + ClaimsEnum::Nbf->value => $issuedAt->getTimestamp(), + ClaimsEnum::Sub->value => 'subject-id', + ClaimsEnum::Jti->value => 'vc-id', + ClaimsEnum::Vct->value => 'https://credentials.example.com/identity_credential', + // ... +]; + +// Use any logic necessary to prepare SD JWT header data. +$jwtHeader = [ + //... +]; + +// Prepare a signing key decorator. Check other methods on `jwkDecoratorFactory` +// for alternative ways to create a key decorator. +$signingKey = $jwkTools->jwkDecoratorFactory()->fromPkcs1Or8KeyFile( + '/path/to/private/key.pem', +); + +// Set the signature algorithm to use. +$signatureAlgorithm = SignatureAlgorithmEnum::ES256; + +$verifiableCredential = $verifiableCredentialTools->sdJwtVcFactory()->fromData( + $signingKey, + $signatureAlgorithm, + $jwtPayload, + $jwtHeader, + $disclosureBag, +); + +// Get the credential token string. +$token = $verifiableCredential->getToken(); +``` diff --git a/phpstan-dev.neon b/phpstan-dev.neon index f6d28bc..b7a1e81 100644 --- a/phpstan-dev.neon +++ b/phpstan-dev.neon @@ -1,6 +1,6 @@ parameters: - level: 4 + level: 3 paths: - tests tmpDir: build/phpstan/dev \ No newline at end of file diff --git a/src/Algorithms/SignatureAlgorithmBag.php b/src/Algorithms/SignatureAlgorithmBag.php index fe66a42..323787d 100644 --- a/src/Algorithms/SignatureAlgorithmBag.php +++ b/src/Algorithms/SignatureAlgorithmBag.php @@ -14,13 +14,15 @@ class SignatureAlgorithmBag public function __construct(SignatureAlgorithmEnum $algorithm, SignatureAlgorithmEnum ...$algorithms) { - $this->algorithms = [$algorithm, ...$algorithms]; + $this->algorithms = array_unique([$algorithm, ...$algorithms], SORT_REGULAR); } public function add(SignatureAlgorithmEnum $algorithm): void { - $this->algorithms[] = $algorithm; + if (!in_array($algorithm, $this->algorithms, true)) { + $this->algorithms[] = $algorithm; + } } diff --git a/src/Algorithms/SignatureAlgorithmEnum.php b/src/Algorithms/SignatureAlgorithmEnum.php index 28ddf29..df84f0f 100644 --- a/src/Algorithms/SignatureAlgorithmEnum.php +++ b/src/Algorithms/SignatureAlgorithmEnum.php @@ -48,4 +48,10 @@ public function instance(): SignatureAlgorithm self::RS512 => new RS512(), }; } + + + public function isNone(): bool + { + return $this === SignatureAlgorithmEnum::none; + } } diff --git a/src/Codebooks/AtContextsEnum.php b/src/Codebooks/AtContextsEnum.php new file mode 100644 index 0000000..912e997 --- /dev/null +++ b/src/Codebooks/AtContextsEnum.php @@ -0,0 +1,10 @@ + true, + default => false, + }; + } } diff --git a/src/Codebooks/HashAlgorithmsEnum.php b/src/Codebooks/HashAlgorithmsEnum.php new file mode 100644 index 0000000..95dd8f9 --- /dev/null +++ b/src/Codebooks/HashAlgorithmsEnum.php @@ -0,0 +1,63 @@ +value; + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException + */ + public function phpName(): string + { + return match ($this) { + self::SHA_256 => 'sha256', + self::SHA_384 => 'sha384', + self::SHA_512 => 'sha512', + self::SHA3_224 => 'sha3-224', + self::SHA3_256 => 'sha3-256', + self::SHA3_384 => 'sha3-384', + self::SHA3_512 => 'sha3-512', + self::SHA_256_128, + self::SHA_256_120, + self::SHA_256_96, + self::SHA_256_64, + self::SHA_256_32, + self::BLAKE2S_256, + self::BLAKE2B_256, + self::BLAKE2B_512, + self::K12_256, + self::K12_512 => throw new OpenIdException('Hash algorithm not supported (.' . $this->ianaName() . ').',), + }; + } +} diff --git a/src/Codebooks/JwtTypesEnum.php b/src/Codebooks/JwtTypesEnum.php index 181687b..e64cdb3 100644 --- a/src/Codebooks/JwtTypesEnum.php +++ b/src/Codebooks/JwtTypesEnum.php @@ -6,9 +6,14 @@ enum JwtTypesEnum: string { + case DcSdJwt = 'dc+sd-jwt'; case EntityStatementJwt = 'entity-statement+jwt'; + case ExampleSdJwt = 'example+sd-jwt'; case JwkSetJwt = 'jwk-set+jwt'; + case Jwt = 'JWT'; + case OpenId4VciProofJwt = 'openid4vci-proof+jwt'; case TrustMarkJwt = 'trust-mark+jwt'; case TrustMarkDelegationJwt = 'trust-mark-delegation+jwt'; case TrustMarkStatusResponseJwt = 'trust-mark-status-response+jwt'; + case VcSdJwt = 'vc+sd-jwt'; } diff --git a/src/Codebooks/LanguageTagsEnum.php b/src/Codebooks/LanguageTagsEnum.php new file mode 100644 index 0000000..6b7a8a3 --- /dev/null +++ b/src/Codebooks/LanguageTagsEnum.php @@ -0,0 +1,144 @@ +requestObjectFactory ??= new RequestObjectFactory( - $this->jwsParser(), + $this->jwsDecoratorBuilder(), $this->jwsVerifierDecorator(), - $this->jwksFactory(), + $this->jwksDecoratorFactory(), $this->jwsSerializerManagerDecorator(), $this->timestampValidationLeewayDecorator, $this->helpers(), @@ -86,9 +89,9 @@ public function requestObjectFactory(): RequestObjectFactory public function clientAssertionFactory(): ClientAssertionFactory { return $this->clientAssertionFactory ??= new ClientAssertionFactory( - $this->jwsParser(), + $this->jwsDecoratorBuilder(), $this->jwsVerifierDecorator(), - $this->jwksFactory(), + $this->jwksDecoratorFactory(), $this->jwsSerializerManagerDecorator(), $this->timestampValidationLeewayDecorator, $this->helpers(), @@ -113,6 +116,13 @@ public function algorithmManagerDecoratorFactory(): AlgorithmManagerDecoratorFac } + public function algorithmManagerDecorator(): AlgorithmManagerDecorator + { + return $this->algorithmManagerDecorator ??= $this->algorithmManagerDecoratorFactory() + ->build($this->supportedAlgorithms); + } + + public function jwsSerializerManagerDecoratorFactory(): JwsSerializerManagerDecoratorFactory { if (is_null($this->jwsSerializerManagerDecoratorFactory)) { @@ -123,13 +133,13 @@ public function jwsSerializerManagerDecoratorFactory(): JwsSerializerManagerDeco } - public function jwsParserFactory(): JwsParserFactory + public function jwsDecoratorBuilderFactory(): JwsDecoratorBuilderFactory { - if (is_null($this->jwsParserFactory)) { - $this->jwsParserFactory = new JwsParserFactory(); + if (is_null($this->jwsDecoratorBuilderFactory)) { + $this->jwsDecoratorBuilderFactory = new JwsDecoratorBuilderFactory(); } - return $this->jwsParserFactory; + return $this->jwsDecoratorBuilderFactory; } @@ -143,9 +153,9 @@ public function jwsVerifierDecoratorFactory(): JwsVerifierDecoratorFactory } - public function jwksFactory(): JwksFactory + public function jwksDecoratorFactory(): JwksDecoratorFactory { - return $this->jwksFactory ??= new JwksFactory(); + return $this->jwksDecoratorFactory ??= new JwksDecoratorFactory(); } @@ -170,13 +180,17 @@ public function jwsSerializerManagerDecorator(): JwsSerializerManagerDecorator } - public function jwsParser(): JwsParser + public function jwsDecoratorBuilder(): JwsDecoratorBuilder { - if (is_null($this->jwsParser)) { - $this->jwsParser = $this->jwsParserFactory()->build($this->jwsSerializerManagerDecorator()); + if (is_null($this->jwsDecoratorBuilder)) { + $this->jwsDecoratorBuilder = $this->jwsDecoratorBuilderFactory()->build( + $this->jwsSerializerManagerDecorator(), + $this->algorithmManagerDecorator(), + $this->helpers(), + ); } - return $this->jwsParser; + return $this->jwsDecoratorBuilder; } @@ -184,7 +198,7 @@ public function jwsVerifierDecorator(): JwsVerifierDecorator { if (is_null($this->jwsVerifierDecorator)) { $this->jwsVerifierDecorator = $this->jwsVerifierDecoratorFactory()->build( - $this->algorithmManagerDecoratorFactory()->build($this->supportedAlgorithms), + $this->algorithmManagerDecorator(), ); } diff --git a/src/Core/Factories/ClientAssertionFactory.php b/src/Core/Factories/ClientAssertionFactory.php index b15ea27..af6a1a3 100644 --- a/src/Core/Factories/ClientAssertionFactory.php +++ b/src/Core/Factories/ClientAssertionFactory.php @@ -4,7 +4,9 @@ namespace SimpleSAML\OpenID\Core\Factories; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; use SimpleSAML\OpenID\Core\ClientAssertion; +use SimpleSAML\OpenID\Jwk\JwkDecorator; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; class ClientAssertionFactory extends ParsedJwsFactory @@ -12,9 +14,37 @@ class ClientAssertionFactory extends ParsedJwsFactory public function fromToken(string $token): ClientAssertion { return new ClientAssertion( - $this->jwsParser->parse($token), + $this->jwsDecoratorBuilder->fromToken($token), $this->jwsVerifierDecorator, - $this->jwksFactory, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + ); + } + + + /** + * @param array $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + ): ClientAssertion { + return new ClientAssertion( + $this->jwsDecoratorBuilder->fromData( + $signingKey, + $signatureAlgorithm, + $payload, + $header, + ), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, $this->jwsSerializerManagerDecorator, $this->timestampValidationLeeway, $this->helpers, diff --git a/src/Core/Factories/RequestObjectFactory.php b/src/Core/Factories/RequestObjectFactory.php index 4721dda..757a6dd 100644 --- a/src/Core/Factories/RequestObjectFactory.php +++ b/src/Core/Factories/RequestObjectFactory.php @@ -4,7 +4,9 @@ namespace SimpleSAML\OpenID\Core\Factories; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; use SimpleSAML\OpenID\Core\RequestObject; +use SimpleSAML\OpenID\Jwk\JwkDecorator; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; class RequestObjectFactory extends ParsedJwsFactory @@ -12,9 +14,37 @@ class RequestObjectFactory extends ParsedJwsFactory public function fromToken(string $token): RequestObject { return new RequestObject( - $this->jwsParser->parse($token), + $this->jwsDecoratorBuilder->fromToken($token), $this->jwsVerifierDecorator, - $this->jwksFactory, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + ); + } + + + /** + * @param array $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + ): RequestObject { + return new RequestObject( + $this->jwsDecoratorBuilder->fromData( + $signingKey, + $signatureAlgorithm, + $payload, + $header, + ), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, $this->jwsSerializerManagerDecorator, $this->timestampValidationLeeway, $this->helpers, diff --git a/src/Did.php b/src/Did.php new file mode 100644 index 0000000..7f73736 --- /dev/null +++ b/src/Did.php @@ -0,0 +1,28 @@ +didKeyResolver ??= new DidKeyJwkResolver( + $this->helpers(), + ); + } + + + public function helpers(): Helpers + { + return $this->helpers ??= new Helpers(); + } +} diff --git a/src/Did/DidKeyJwkResolver.php b/src/Did/DidKeyJwkResolver.php new file mode 100644 index 0000000..7df4ba8 --- /dev/null +++ b/src/Did/DidKeyJwkResolver.php @@ -0,0 +1,422 @@ +base58BtcDecode($base58Key); + + // Get the multicodec identifier and its length + [$multicodecIdentifier, $prefixLength] = $this->varintDecode($decodedKey); + + // Extract the actual key bytes (skip the multicodec bytes) + $keyBytes = substr($decodedKey, $prefixLength); + + // Determine the key type based on the multicodec identifier + // See: https://github.com/multiformats/multicodec/blob/master/table.csv + return match ($multicodecIdentifier) { + // Ed25519 public key (0xed in multicodec table) + 0xed => $this->createEd25519Jwk($keyBytes), + // X25519 public key (0xec in multicodec table) + 0xec => $this->createX25519Jwk($keyBytes), + // Secp256k1 public key (multicodec 0xe7) + // The original code had `0xe70, 0x01e7`. If the varint bytes are `\xe7\x01`, + // varintDecode will return 231 (0xe7). If the intended multicodec value is 0x01e7 (487), + // its varint encoding would be different (e.g., \xDF\x03). + // Assuming the multicodec code itself is 0xe7 (231). + 0xe7 => $this->createSecp256k1Jwk($keyBytes), + // P-256 (NIST) public key (multicodec 0x1200 for uncompressed, 0x1201 for compressed - typically + // 0x1200 used with JWK). Also adding 0x1102 as another possible identifier for P-256 keys + 0x1200, 0x1201, 0x1102 => $this->createP256Jwk($keyBytes), + // P-384 (NIST) public key (multicodec 0x1202) + 0x1202 => $this->createP384Jwk($keyBytes), + // P-521 (NIST) public key (multicodec 0x1203) + 0x1203 => $this->createP521Jwk($keyBytes), + // JSON JWK public key (0xeb51 in multicodec table) + 0xeb51 => $this->createJwkFromRawJson($keyBytes), + default => throw new DidException( + sprintf('Unsupported key type with multicodec identifier: 0x%04x', $multicodecIdentifier), + ), + }; + } catch (\Exception $exception) { + // It's good practice to re-throw with context, but avoid concatenating messages directly + // if the original exception message might contain sensitive info or be too verbose. + // Wrapping it is generally better. + throw new DidException('Error processing did:key: ' . $exception->getMessage(), 0, $exception); + } + } + + + /** + * Decode a variable integer (varint) from bytes. + * + * This follows the multiformats varint specification where each byte uses 7 bits for the value + * and 1 bit to indicate if there are more bytes in the varint. + * As per the specification, varints must be encoded with the minimum number of bytes necessary. + * + * @see https://github.com/multiformats/unsigned-varint + * + * @param string $bytes Binary string containing a varint + * @return array{0: int, 1: int} Array containing [decoded value, number of bytes consumed] + * @throws \SimpleSAML\OpenID\Exceptions\DidException If the varint has invalid format + */ + public function varintDecode(string $bytes): array + { + if ($bytes === '') { + throw new DidException('Invalid varint: input is empty'); + } + + $result = 0; + $shift = 0; + $bytesRead = 0; + + for ($i = 0; $i < strlen($bytes); ++$i) { + $byte = ord($bytes[$i]); + ++$bytesRead; + + // Implementations typically support up to 10 bytes for u64. + // This implementation limits to 9 bytes, fitting PHP_INT_MAX (2^63-1). + if ($bytesRead > 9) { + throw new DidException('Invalid varint: too many bytes (max 9 for this implementation).'); + } + + $valuePart = $byte & 0x7F; + + // Add value part to result. + // PHP integers are signed 64-bit. Max shift is 7*8=56 for the 9th byte. + // (X << 56) is safe. Result should not overflow PHP_INT_MAX for valid multicodec IDs. + $result |= ($valuePart << $shift); + + if (($byte & 0x80) === 0) { // This is the last byte in the varint sequence + // Check for overlong encoding (violates minimality constraint): + // 1. If the varint is multi-byte (bytesRead > 1) and the last byte is 0x00. + // This covers cases like `\x81\x00` for 1, or `\x80\x00` for 0. + // 2. The value 0 must be encoded as a single `\x00`. If result is 0 and bytesRead > 1, + // it's an overlong encoding of 0 (e.g. `\x80\x00`), which is caught by the first condition. + if ($byte === 0x00 && $bytesRead > 1) { + throw new DidException('Invalid varint: overlong encoding (minimality constraint violated).'); + } + + return [$result, $bytesRead]; + } + + $shift += 7; + // Check if the next shift would overflow standard integer types (more relevant for fixed-size integers). + // For PHP's arbitrary precision integers (when they become floats/GMP objects), this is less of an issue, + // but for multicodec IDs, values are small and fit in standard integers. + } + + // If the loop finishes, it means the last byte had its MSB set, indicating an incomplete sequence. + throw new DidException('Invalid varint: incomplete sequence (unterminated).'); + } + + /** + * Decode a base58 encoded string. + */ + // In SimpleSAML\OpenID\Did\DidKeyJwkResolver.php + public function base58BtcDecode(string $base58encodedString): string + { + $alphabet = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'; + $base = strlen($alphabet); + +// if ($base58encodedString === 'ABnLTmg5e1PhaB9S2qAvL9L3Q') { +// error_log("[base58BtcDecode] Input: " . $base58encodedString); +// error_log("[base58BtcDecode] Alphabet: " . $alphabet); +// error_log("[base58BtcDecode] Alphabet Length (base): " . $base); +// } + + $num = gmp_init(0); + for ($i = 0; $i < strlen($base58encodedString); ++$i) { + $char = $base58encodedString[$i]; + $pos = strpos($alphabet, $char); + + if ($pos === false) { + throw new \InvalidArgumentException('Invalid character in base58 string: ' . $char); + } + +// if ($base58encodedString === 'ABnLTmg5e1PhaB9S2qAvL9L3Q') { +// error_log("[base58BtcDecode] char: '{$char}', pos: {$pos}"); +// } + + $num = gmp_add(gmp_mul($num, $base), $pos); + } + +// if ($base58encodedString === 'ABnLTmg5e1PhaB9S2qAvL9L3Q') { +// error_log("[base58BtcDecode] Calculated GMP num (hex): " . gmp_strval($num, 16)); +// } + + // ... rest of the method ... + $result = ''; + /** @phpstan-ignore argument.type */ + while (gmp_cmp($num, 0) > 0) { + /** @phpstan-ignore argument.type */ + [$numQuotient, $remainder] = gmp_div_qr($num, 256); // Use a different variable for quotient + $num = $numQuotient; // Reassign $num + /** @phpstan-ignore argument.type */ + $result = chr(gmp_intval($remainder)) . $result; + } + + // Add leading zeros + for ($j = 0; $j < strlen($base58encodedString) && $base58encodedString[$j] === '1'; ++$j) { + $result = "\0" . $result; + } + + return $result; + } + + + /** + * Create a JWK for an Ed25519 public key. + * + * @param string $rawKeyBytes The raw key bytes + * @return mixed[] The JWK representation + */ + public function createEd25519Jwk(string $rawKeyBytes): array + { + return [ + 'kty' => 'OKP', + 'crv' => 'Ed25519', + 'x' => $this->helpers->base64Url()->encode($rawKeyBytes), + 'use' => 'sig', + ]; + } + + + /** + * Create a JWK for an X25519 public key. + * + * @param string $rawKeyBytes The raw key bytes + * @return mixed[] The JWK representation + */ + public function createX25519Jwk(string $rawKeyBytes): array + { + return [ + 'kty' => 'OKP', + 'crv' => 'X25519', + 'x' => $this->helpers->base64Url()->encode($rawKeyBytes), + 'use' => 'enc', + ]; + } + + + /** + * Create a JWK for a Secp256k1 public key. + * + * @param string $rawKeyBytes The raw key bytes + * @return mixed[] The JWK representation + * @throws \SimpleSAML\OpenID\Exceptions\DidException + */ + public function createSecp256k1Jwk(string $rawKeyBytes): array + { + // For Secp256k1, we need to extract x and y coordinates from the compressed or uncompressed point + $firstByte = ord($rawKeyBytes[0]); + + if ($firstByte === 0x04 && strlen($rawKeyBytes) === 65) { + // Uncompressed point format (0x04 || x || y) + $x = substr($rawKeyBytes, 1, 32); + $y = substr($rawKeyBytes, 33, 32); + } elseif (($firstByte === 0x02 || $firstByte === 0x03) && strlen($rawKeyBytes) === 33) { + // Compressed point format - would need to decompress + // This is complex and requires secp256k1 library support + throw new DidException('Compressed Secp256k1 keys are not currently supported'); + } else { + throw new DidException('Invalid Secp256k1 public key format'); + } + + return [ + 'kty' => 'EC', + 'crv' => 'secp256k1', + 'x' => $this->helpers->base64Url()->encode($x), + 'y' => $this->helpers->base64Url()->encode($y), + 'use' => 'sig', + ]; + } + + + /** + * Create a JWK for a P-256 (NIST) public key. + * + * @param string $rawKeyBytes The raw key bytes + * @return mixed[] The JWK representation + * @throws \SimpleSAML\OpenID\Exceptions\DidException + */ + public function createP256Jwk(string $rawKeyBytes): array + { + // Similar to Secp256k1, we need to extract x and y coordinates + $firstByte = ord($rawKeyBytes[0]); + + if ($firstByte === 0x04 && strlen($rawKeyBytes) === 65) { + // Uncompressed point format (0x04 || x || y) + $x = substr($rawKeyBytes, 1, 32); + $y = substr($rawKeyBytes, 33, 32); + } elseif (($firstByte === 0x02 || $firstByte === 0x03) && strlen($rawKeyBytes) === 33) { + // Compressed point format - would need to decompress + // This is complex and requires specific library support + throw new DidException('Compressed P-256 keys are not currently supported'); + } elseif (strlen($rawKeyBytes) === 64) { + // Some implementations might not include the leading 0x04 byte + // Try to interpret as raw x || y coordinates + $x = substr($rawKeyBytes, 0, 32); + $y = substr($rawKeyBytes, 32, 32); + } else { + throw new DidException('Invalid P-256 public key format'); + } + + return [ + 'kty' => 'EC', + 'crv' => 'P-256', + 'x' => $this->helpers->base64Url()->encode($x), + 'y' => $this->helpers->base64Url()->encode($y), + 'use' => 'sig', + ]; + } + + + /** + * Create a JWK for a P-384 (NIST) public key. + * + * @param string $rawKeyBytes The raw key bytes + * @return mixed[] The JWK representation + * @throws \SimpleSAML\OpenID\Exceptions\DidException + */ + public function createP384Jwk(string $rawKeyBytes): array + { + $firstByte = ord($rawKeyBytes[0]); + + if ($firstByte === 0x04 && strlen($rawKeyBytes) === 97) { + // Uncompressed point format (0x04 || x || y) + $x = substr($rawKeyBytes, 1, 48); + $y = substr($rawKeyBytes, 49, 48); + } else { + throw new DidException('Invalid P-384 public key format'); + } + + return [ + 'kty' => 'EC', + 'crv' => 'P-384', + 'x' => $this->helpers->base64Url()->encode($x), + 'y' => $this->helpers->base64Url()->encode($y), + 'use' => 'sig', + ]; + } + + + /** + * Create a JWK for a P-521 (NIST) public key. + * + * @return mixed[] The JWK representation + * @throws \SimpleSAML\OpenID\Exceptions\DidException + */ + public function createP521Jwk(string $rawKeyBytes): array + { + $firstByte = ord($rawKeyBytes[0]); + + if ($firstByte === 0x04 && strlen($rawKeyBytes) === 133) { + // Uncompressed point format (0x04 || x || y) + $x = substr($rawKeyBytes, 1, 66); + $y = substr($rawKeyBytes, 67, 66); + } else { + throw new DidException('Invalid P-521 public key format'); + } + + return [ + 'kty' => 'EC', + 'crv' => 'P-521', + 'x' => $this->helpers->base64Url()->encode($x), + 'y' => $this->helpers->base64Url()->encode($y), + 'use' => 'sig', + ]; + } + + + /** + * Create a JWK from raw JSON data. + * + * Used for multicodec identifier 0xeb51, which represents a JSON object containing + * only the required members of a JWK (RFC 7518 and RFC 7517) representing the public key. + * Serialization is based on JCS (RFC 8785). + * + * @param string $rawJsonBytes The raw JSON bytes + * @return mixed[] The JWK representation + * @throws \SimpleSAML\OpenID\Exceptions\DidException + */ + public function createJwkFromRawJson(string $rawJsonBytes): array + { + try { + $jwk = $this->helpers->json()->decode($rawJsonBytes); + + // Validate that this is a valid JWK + if (!is_array($jwk) || !isset($jwk['kty'])) { + throw new DidException('Invalid JWK format: missing required "kty" property'); + } + + // For EC keys, validate required parameters + if ($jwk['kty'] === 'EC') { + if (!isset($jwk['crv'], $jwk['x'], $jwk['y'])) { + throw new DidException('Invalid EC JWK format: missing required properties'); + } + } elseif ($jwk['kty'] === 'OKP') { + if (!isset($jwk['crv'], $jwk['x'])) { + throw new DidException('Invalid OKP JWK format: missing required properties'); + } + } elseif ($jwk['kty'] === 'RSA') { + if (!isset($jwk['n'], $jwk['e'])) { + throw new DidException('Invalid RSA JWK format: missing required properties'); + } + } + + // Default to 'sig' use if not specified + if (!isset($jwk['use'])) { + $jwk['use'] = 'sig'; + } + + return $jwk; + } catch (\JsonException $jsonException) { + throw new DidException('Failed to parse JWK JSON: ' . $jsonException->getMessage()); + } + } +} diff --git a/src/Exceptions/ClaimsPathPointerException.php b/src/Exceptions/ClaimsPathPointerException.php new file mode 100644 index 0000000..a509913 --- /dev/null +++ b/src/Exceptions/ClaimsPathPointerException.php @@ -0,0 +1,11 @@ +vcDataModelClaimFactory ??= new VcDataModelClaimFactory( + $this->helpers, + $this, + ); + } + + /** * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException */ diff --git a/src/Federation.php b/src/Federation.php index b489ce0..eb8eba6 100644 --- a/src/Federation.php +++ b/src/Federation.php @@ -8,6 +8,7 @@ use GuzzleHttp\Client; use Psr\Log\LoggerInterface; use Psr\SimpleCache\CacheInterface; +use SimpleSAML\OpenID\Algorithms\AlgorithmManagerDecorator; use SimpleSAML\OpenID\Codebooks\TrustMarkStatusEndpointUsagePolicyEnum; use SimpleSAML\OpenID\Decorators\CacheDecorator; use SimpleSAML\OpenID\Decorators\DateIntervalDecorator; @@ -32,10 +33,10 @@ use SimpleSAML\OpenID\Federation\TrustMarkFetcher; use SimpleSAML\OpenID\Federation\TrustMarkStatusResponseFetcher; use SimpleSAML\OpenID\Federation\TrustMarkValidator; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; -use SimpleSAML\OpenID\Jws\Factories\JwsParserFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; +use SimpleSAML\OpenID\Jws\Factories\JwsDecoratorBuilderFactory; use SimpleSAML\OpenID\Jws\Factories\JwsVerifierDecoratorFactory; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; use SimpleSAML\OpenID\Utils\ArtifactFetcher; @@ -54,7 +55,7 @@ class Federation protected ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null; - protected ?JwsParser $jwsParser = null; + protected ?JwsDecoratorBuilder $jwsDecoratorBuilder = null; protected ?JwsVerifierDecorator $jwsVerifierDecorator = null; @@ -80,11 +81,11 @@ class Federation protected ?JwsSerializerManagerDecoratorFactory $jwsSerializerManagerDecoratorFactory = null; - protected ?JwsParserFactory $jwsParserFactory = null; + protected ?JwsDecoratorBuilderFactory $jwsDecoratorBuilderFactory = null; protected ?JwsVerifierDecoratorFactory $jwsVerifierDecoratorFactory = null; - protected ?JwksFactory $jwksFactory = null; + protected ?JwksDecoratorFactory $jwksDecoratorFactory = null; protected ?DateIntervalDecoratorFactory $dateIntervalDecoratorFactory = null; @@ -104,6 +105,8 @@ class Federation protected ?TrustMarkFetcher $trustMarkFetcher = null; + protected ?AlgorithmManagerDecorator $algorithmManagerDecorator = null; + protected ?TrustMarkStatusResponseFactory $trustMarkStatusResponseFactory = null; protected ?TrustMarkStatusResponseFetcher $trustMarkStatusResponseFetcher = null; @@ -133,14 +136,18 @@ public function __construct( public function jwsVerifierDecorator(): JwsVerifierDecorator { return $this->jwsVerifierDecorator ??= $this->jwsVerifierDecoratorFactory()->build( - $this->algorithmManagerDecoratorFactory()->build($this->supportedAlgorithms), + $this->algorithmManagerDecorator(), ); } - public function jwsParser(): JwsParser + public function jwsDecoratorBuilder(): JwsDecoratorBuilder { - return $this->jwsParser ??= $this->jwsParserFactory()->build($this->jwsSerializerManagerDecorator()); + return $this->jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderFactory()->build( + $this->jwsSerializerManagerDecorator(), + $this->algorithmManagerDecorator(), + $this->helpers(), + ); } @@ -204,9 +211,9 @@ public function trustChainResolver(): TrustChainResolver public function entityStatementFactory(): EntityStatementFactory { return $this->entityStatementFactory ??= new EntityStatementFactory( - $this->jwsParser(), + $this->jwsDecoratorBuilder(), $this->jwsVerifierDecorator(), - $this->jwksFactory(), + $this->jwksDecoratorFactory(), $this->jwsSerializerManagerDecorator(), $this->timestampValidationLeewayDecorator, $this->helpers(), @@ -218,9 +225,9 @@ public function entityStatementFactory(): EntityStatementFactory public function requestObjectFactory(): RequestObjectFactory { return $this->requestObjectFactory ??= new RequestObjectFactory( - $this->jwsParser(), + $this->jwsDecoratorBuilder(), $this->jwsVerifierDecorator(), - $this->jwksFactory(), + $this->jwksDecoratorFactory(), $this->jwsSerializerManagerDecorator(), $this->timestampValidationLeewayDecorator, $this->helpers(), @@ -232,9 +239,9 @@ public function requestObjectFactory(): RequestObjectFactory public function trustMarkFactory(): TrustMarkFactory { return $this->trustMarkFactory ??= new TrustMarkFactory( - $this->jwsParser(), + $this->jwsDecoratorBuilder(), $this->jwsVerifierDecorator(), - $this->jwksFactory(), + $this->jwksDecoratorFactory(), $this->jwsSerializerManagerDecorator(), $this->timestampValidationLeewayDecorator, $this->helpers(), @@ -246,9 +253,9 @@ public function trustMarkFactory(): TrustMarkFactory public function trustMarkDelegationFactory(): TrustMarkDelegationFactory { return $this->trustMarkDelegationFactory ?? new TrustMarkDelegationFactory( - $this->jwsParser(), + $this->jwsDecoratorBuilder(), $this->jwsVerifierDecorator(), - $this->jwksFactory(), + $this->jwksDecoratorFactory(), $this->jwsSerializerManagerDecorator(), $this->timestampValidationLeewayDecorator, $this->helpers(), @@ -260,9 +267,9 @@ public function trustMarkDelegationFactory(): TrustMarkDelegationFactory public function trustMarkStatusResponseFactory(): TrustMarkStatusResponseFactory { return $this->trustMarkStatusResponseFactory ??= new TrustMarkStatusResponseFactory( - $this->jwsParser(), + $this->jwsDecoratorBuilder(), $this->jwsVerifierDecorator(), - $this->jwksFactory(), + $this->jwksDecoratorFactory(), $this->jwsSerializerManagerDecorator(), $this->timestampValidationLeewayDecorator, $this->helpers(), @@ -322,15 +329,22 @@ public function algorithmManagerDecoratorFactory(): AlgorithmManagerDecoratorFac } + public function algorithmManagerDecorator(): AlgorithmManagerDecorator + { + return $this->algorithmManagerDecorator ??= $this->algorithmManagerDecoratorFactory() + ->build($this->supportedAlgorithms); + } + + public function jwsSerializerManagerDecoratorFactory(): JwsSerializerManagerDecoratorFactory { return $this->jwsSerializerManagerDecoratorFactory ??= new JwsSerializerManagerDecoratorFactory(); } - public function jwsParserFactory(): JwsParserFactory + public function jwsDecoratorBuilderFactory(): JwsDecoratorBuilderFactory { - return $this->jwsParserFactory ??= new JwsParserFactory(); + return $this->jwsDecoratorBuilderFactory ??= new JwsDecoratorBuilderFactory(); } @@ -340,9 +354,9 @@ public function jwsVerifierDecoratorFactory(): JwsVerifierDecoratorFactory } - public function jwksFactory(): JwksFactory + public function jwksDecoratorFactory(): JwksDecoratorFactory { - return $this->jwksFactory ??= new JwksFactory(); + return $this->jwksDecoratorFactory ??= new JwksDecoratorFactory(); } diff --git a/src/Federation/Factories/EntityStatementFactory.php b/src/Federation/Factories/EntityStatementFactory.php index 447facf..d3dd577 100644 --- a/src/Federation/Factories/EntityStatementFactory.php +++ b/src/Federation/Factories/EntityStatementFactory.php @@ -4,7 +4,11 @@ namespace SimpleSAML\OpenID\Federation\Factories; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; +use SimpleSAML\OpenID\Codebooks\ClaimsEnum; +use SimpleSAML\OpenID\Codebooks\JwtTypesEnum; use SimpleSAML\OpenID\Federation\EntityStatement; +use SimpleSAML\OpenID\Jwk\JwkDecorator; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; class EntityStatementFactory extends ParsedJwsFactory @@ -16,9 +20,39 @@ class EntityStatementFactory extends ParsedJwsFactory public function fromToken(string $token): EntityStatement { return new EntityStatement( - $this->jwsParser->parse($token), + $this->jwsDecoratorBuilder->fromToken($token), $this->jwsVerifierDecorator, - $this->jwksFactory, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + ); + } + + + /** + * @param array $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + ): EntityStatement { + $header[ClaimsEnum::Typ->value] = JwtTypesEnum::EntityStatementJwt->value; + + return new EntityStatement( + $this->jwsDecoratorBuilder->fromData( + $signingKey, + $signatureAlgorithm, + $payload, + $header, + ), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, $this->jwsSerializerManagerDecorator, $this->timestampValidationLeeway, $this->helpers, diff --git a/src/Federation/Factories/RequestObjectFactory.php b/src/Federation/Factories/RequestObjectFactory.php index 04edb98..0ed9126 100644 --- a/src/Federation/Factories/RequestObjectFactory.php +++ b/src/Federation/Factories/RequestObjectFactory.php @@ -4,7 +4,9 @@ namespace SimpleSAML\OpenID\Federation\Factories; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; use SimpleSAML\OpenID\Federation\RequestObject; +use SimpleSAML\OpenID\Jwk\JwkDecorator; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; class RequestObjectFactory extends ParsedJwsFactory @@ -16,9 +18,37 @@ class RequestObjectFactory extends ParsedJwsFactory public function fromToken(string $token): RequestObject { return new RequestObject( - $this->jwsParser->parse($token), + $this->jwsDecoratorBuilder->fromToken($token), $this->jwsVerifierDecorator, - $this->jwksFactory, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + ); + } + + + /** + * @param array $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + ): RequestObject { + return new RequestObject( + $this->jwsDecoratorBuilder->fromData( + $signingKey, + $signatureAlgorithm, + $payload, + $header, + ), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, $this->jwsSerializerManagerDecorator, $this->timestampValidationLeeway, $this->helpers, diff --git a/src/Federation/Factories/TrustMarkDelegationFactory.php b/src/Federation/Factories/TrustMarkDelegationFactory.php index 29b54cd..16978ef 100644 --- a/src/Federation/Factories/TrustMarkDelegationFactory.php +++ b/src/Federation/Factories/TrustMarkDelegationFactory.php @@ -4,7 +4,11 @@ namespace SimpleSAML\OpenID\Federation\Factories; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; +use SimpleSAML\OpenID\Codebooks\ClaimsEnum; +use SimpleSAML\OpenID\Codebooks\JwtTypesEnum; use SimpleSAML\OpenID\Federation\TrustMarkDelegation; +use SimpleSAML\OpenID\Jwk\JwkDecorator; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; class TrustMarkDelegationFactory extends ParsedJwsFactory @@ -12,9 +16,39 @@ class TrustMarkDelegationFactory extends ParsedJwsFactory public function fromToken(string $token): TrustMarkDelegation { return new TrustMarkDelegation( - $this->jwsParser->parse($token), + $this->jwsDecoratorBuilder->fromToken($token), $this->jwsVerifierDecorator, - $this->jwksFactory, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + ); + } + + + /** + * @param array $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + ): TrustMarkDelegation { + $header[ClaimsEnum::Typ->value] = JwtTypesEnum::TrustMarkDelegationJwt->value; + + return new TrustMarkDelegation( + $this->jwsDecoratorBuilder->fromData( + $signingKey, + $signatureAlgorithm, + $payload, + $header, + ), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, $this->jwsSerializerManagerDecorator, $this->timestampValidationLeeway, $this->helpers, diff --git a/src/Federation/Factories/TrustMarkFactory.php b/src/Federation/Factories/TrustMarkFactory.php index de4c825..73e6d2b 100644 --- a/src/Federation/Factories/TrustMarkFactory.php +++ b/src/Federation/Factories/TrustMarkFactory.php @@ -4,8 +4,11 @@ namespace SimpleSAML\OpenID\Federation\Factories; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; +use SimpleSAML\OpenID\Codebooks\ClaimsEnum; use SimpleSAML\OpenID\Codebooks\JwtTypesEnum; use SimpleSAML\OpenID\Federation\TrustMark; +use SimpleSAML\OpenID\Jwk\JwkDecorator; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; class TrustMarkFactory extends ParsedJwsFactory @@ -15,9 +18,41 @@ public function fromToken( JwtTypesEnum $expectedJwtType = JwtTypesEnum::TrustMarkJwt, ): TrustMark { return new TrustMark( - $this->jwsParser->parse($token), + $this->jwsDecoratorBuilder->fromToken($token), $this->jwsVerifierDecorator, - $this->jwksFactory, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + $expectedJwtType, + ); + } + + + /** + * @param array $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + JwtTypesEnum $expectedJwtType = JwtTypesEnum::TrustMarkJwt, + ): TrustMark { + $header[ClaimsEnum::Typ->value] = $expectedJwtType; + + return new TrustMark( + $this->jwsDecoratorBuilder->fromData( + $signingKey, + $signatureAlgorithm, + $payload, + $header, + ), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, $this->jwsSerializerManagerDecorator, $this->timestampValidationLeeway, $this->helpers, diff --git a/src/Federation/Factories/TrustMarkStatusResponseFactory.php b/src/Federation/Factories/TrustMarkStatusResponseFactory.php index 58e7f18..f5ca5b3 100644 --- a/src/Federation/Factories/TrustMarkStatusResponseFactory.php +++ b/src/Federation/Factories/TrustMarkStatusResponseFactory.php @@ -12,9 +12,9 @@ class TrustMarkStatusResponseFactory extends ParsedJwsFactory public function fromToken(string $token): TrustMarkStatusResponse { return new TrustMarkStatusResponse( - $this->jwsParser->parse($token), + $this->jwsDecoratorBuilder->fromToken($token), $this->jwsVerifierDecorator, - $this->jwksFactory, + $this->jwksDecoratorFactory, $this->jwsSerializerManagerDecorator, $this->timestampValidationLeeway, $this->helpers, diff --git a/src/Federation/MetadataPolicyApplicator.php b/src/Federation/MetadataPolicyApplicator.php index 697a67b..1da20af 100644 --- a/src/Federation/MetadataPolicyApplicator.php +++ b/src/Federation/MetadataPolicyApplicator.php @@ -49,9 +49,12 @@ public function for( continue; } - $this->helpers->arr()->ensureArrayDepth($metadata, $policyParameterName); - $metadata[$policyParameterName] = $this->resolveParameterValueAfterPolicy( - $operatorValue, + $this->helpers->arr()->setNestedValue( + $metadata, + $this->resolveParameterValueAfterPolicy( + $operatorValue, + $policyParameterName, + ), $policyParameterName, ); } elseif ($metadataPolicyOperatorEnum === MetadataPolicyOperatorsEnum::Add) { diff --git a/src/Federation/MetadataPolicyResolver.php b/src/Federation/MetadataPolicyResolver.php index ca6e5c8..a6cc216 100644 --- a/src/Federation/MetadataPolicyResolver.php +++ b/src/Federation/MetadataPolicyResolver.php @@ -122,14 +122,12 @@ public function for( (!is_array($currentPolicy[$nextPolicyParameter])) || (!array_key_exists($metadataPolicyOperatorEnum->value, $currentPolicy[$nextPolicyParameter])) ) { - $this->helpers->arr()->ensureArrayDepth( + $this->helpers->arr()->setNestedValue( $currentPolicy, + $operatorValue, $nextPolicyParameter, $metadataPolicyOperatorEnum->value, ); - // @phpstan-ignore offsetAccess.nonOffsetAccessible (We ensured this is array.) - $currentPolicy[$nextPolicyParameter][$metadataPolicyOperatorEnum->value] = - $operatorValue; // It exists, so we have to check special cases for merging. } elseif ( diff --git a/src/Federation/TrustMark.php b/src/Federation/TrustMark.php index 8ab166c..9ab7e8b 100644 --- a/src/Federation/TrustMark.php +++ b/src/Federation/TrustMark.php @@ -10,7 +10,7 @@ use SimpleSAML\OpenID\Exceptions\TrustMarkException; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; @@ -21,7 +21,7 @@ class TrustMark extends ParsedJws public function __construct( JwsDecorator $jwsDecorator, JwsVerifierDecorator $jwsVerifierDecorator, - JwksFactory $jwksFactory, + JwksDecoratorFactory $jwksDecoratorFactory, JwsSerializerManagerDecorator $jwsSerializerManagerDecorator, DateIntervalDecorator $timestampValidationLeeway, Helpers $helpers, @@ -31,7 +31,7 @@ public function __construct( parent::__construct( $jwsDecorator, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $timestampValidationLeeway, $helpers, diff --git a/src/Federation/TrustMarkDelegation.php b/src/Federation/TrustMarkDelegation.php index 38879f0..bc3f300 100644 --- a/src/Federation/TrustMarkDelegation.php +++ b/src/Federation/TrustMarkDelegation.php @@ -26,6 +26,7 @@ public function getIssuer(): string * @return non-empty-string * @throws \SimpleSAML\OpenID\Exceptions\JwsException * @throws \SimpleSAML\OpenID\Exceptions\TrustMarkDelegationException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException */ public function getSubject(): string { @@ -36,6 +37,7 @@ public function getSubject(): string /** * @return non-empty-string * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException */ public function getTrustMarkType(): string { diff --git a/src/Helpers.php b/src/Helpers.php index 32548fc..bcfda27 100644 --- a/src/Helpers.php +++ b/src/Helpers.php @@ -5,7 +5,11 @@ namespace SimpleSAML\OpenID; use SimpleSAML\OpenID\Helpers\Arr; +use SimpleSAML\OpenID\Helpers\Base64Url; +use SimpleSAML\OpenID\Helpers\DateTime; +use SimpleSAML\OpenID\Helpers\Hash; use SimpleSAML\OpenID\Helpers\Json; +use SimpleSAML\OpenID\Helpers\Random; use SimpleSAML\OpenID\Helpers\Type; use SimpleSAML\OpenID\Helpers\Url; @@ -19,6 +23,14 @@ class Helpers protected static ?Type $type = null; + protected static ?DateTime $dateTime = null; + + protected static ?Base64Url $base64Url = null; + + protected static ?Hash $hash = null; + + protected static ?Random $random = null; + public function url(): Url { @@ -42,4 +54,28 @@ public function type(): Type { return self::$type ??= new Type(); } + + + public function dateTime(): DateTime + { + return self::$dateTime ??= new DateTime(); + } + + + public function base64Url(): Base64Url + { + return self::$base64Url ??= new Base64Url(); + } + + + public function hash(): Hash + { + return self::$hash ??= new Hash(); + } + + + public function random(): Random + { + return self::$random ??= new Random(); + } } diff --git a/src/Helpers/Arr.php b/src/Helpers/Arr.php index f07528c..cd14b32 100644 --- a/src/Helpers/Arr.php +++ b/src/Helpers/Arr.php @@ -8,14 +8,36 @@ class Arr { + public const MAX_DEPTH = 99; + + /** - * @phpstan-ignore missingType.iterableValue (We can handle mixed type) + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException */ - public function ensureArrayDepth(array &$array, int|string ...$keys): void + public function validateMaxDepth(int $depth): void { - if (count($keys) > 99) { - throw new OpenIdException('Refusing to recurse to given depth.'); + if ($depth > self::MAX_DEPTH) { + throw new OpenIdException( + sprintf( + 'Refusing to recurse to given depth %s. Max depth is %s.', + $depth, + self::MAX_DEPTH, + ), + ); } + } + + + /** + * Ensure the existence of nested arrays for given keys. Note that this will create / overwrite any non-array + * nested values and make them an array. + * + * @param mixed[] $array + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException + */ + public function ensureArrayDepth(array &$array, int|string ...$keys): void + { + $this->validateMaxDepth(count($keys)); $key = array_shift($keys); @@ -31,6 +53,82 @@ public function ensureArrayDepth(array &$array, int|string ...$keys): void } + /** + * Get nested value reference at a given path. Creates nested arrays dynamically if the key is not present. + * + * @param mixed[] $array + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException If a non-array value exists on the path. + */ + public function &getNestedValueReference(array &$array, int|string ...$keys): mixed + { + $this->validateMaxDepth(count($keys)); + + $nested = &$array; + + foreach ($keys as $key) { + if (!is_array($nested)) { + throw new OpenIdException( + sprintf( + 'Refusing to operate on non-array value for key: %s, path: %s, array: %s.', + $key, + implode('.', $keys), + var_export($array, true), + ), + ); + } + + if (!isset($nested[$key])) { + $nested[$key] = []; + } + + $nested = &$nested[$key]; + } + + return $nested; + } + + + /** + * Set a value at a path. + * + * @param mixed[] $array + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException + */ + public function setNestedValue(array &$array, mixed $value, int|string ...$keys): void + { + if (count($keys) < 1) { + return; + } + + $reference =& $this->getNestedValueReference($array, ...$keys); + + $reference = $value; + } + + + /** + * @param mixed[] $array + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException + */ + public function addNestedValue(array &$array, mixed $value, int|string ...$keys): void + { + $reference =& $this->getNestedValueReference($array, ...$keys); + + if (!is_array($reference)) { + throw new OpenIdException( + sprintf( + 'Refusing to add value to non-array value. Array: %s, path: %s, value: %s.', + var_export($array, true), + implode('.', $keys), + var_export($value, true), + ), + ); + } + + $reference[] = $value; + } + + /** * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException * @param mixed[] $array @@ -57,4 +155,77 @@ public function getNestedValue(array $array, int|string ...$keys): mixed return $this->getNestedValue($nestedArray, ...$keys); } + + + /** + * @param mixed[] $array + */ + public function isAssociative(array $array): bool + { + // Has at least one string key or non-sequential numeric keys + return array_keys($array) !== range(0, count($array) - 1); + } + + + /** + * Is an array of arrays. + * @param mixed[] $array + */ + public function isOfArrays(array $array): bool + { + foreach ($array as $value) { + if (!is_array($value)) { + return false; + } + } + + return true; + } + + + /** + * Recursively check if an array contains the key, at any level. + * + * @param mixed[] $array + */ + public function containsKey(array $array, string|int $key): bool + { + foreach ($array as $currentKey => $value) { + if ($currentKey === $key) { + return true; + } + + if (is_array($value) && $this->containsKey($value, $key)) { + return true; + } + } + + return false; + } + + + /** + * Recursively sort an array by keys if keys are strings and values if keys are numeric. + * + * @param mixed[] $array + */ + public function hybridSort(array &$array): void + { + // Determine if keys are numeric or string + $allNumeric = array_keys($array) === array_keys(array_values($array)); + + // Sort appropriately + if ($allNumeric) { + sort($array); // numeric indexes: sort by value + } else { + ksort($array); // string keys: sort by key + } + + // Recurse into nested arrays + foreach ($array as &$value) { + if (is_array($value)) { + $this->hybridSort($value); + } + } + } } diff --git a/src/Helpers/Base64Url.php b/src/Helpers/Base64Url.php new file mode 100644 index 0000000..d6b7344 --- /dev/null +++ b/src/Helpers/Base64Url.php @@ -0,0 +1,56 @@ +getUtc()->setTimestamp($timestamp); + } +} diff --git a/src/Helpers/Hash.php b/src/Helpers/Hash.php new file mode 100644 index 0000000..87e1bbe --- /dev/null +++ b/src/Helpers/Hash.php @@ -0,0 +1,20 @@ + 0) { + try { + $random = bin2hex(random_bytes($byteLength)); + // @codeCoverageIgnoreStart + } catch (Throwable $e) { + $errors[] = $e->getMessage(); + continue; + } + + // @codeCoverageIgnoreEnd + + if ($blacklist !== null && in_array($random, $blacklist, true)) { + $errors[] = sprintf( + 'Random string %s is in the blacklist [%s], skipping.', + $random, + implode(', ', $blacklist), + ); + continue; + } + + return ($prefix ?? '') . $random . ($suffix ?? ''); + } + + throw new OpenIdException( + 'Could not generate a random string, errors were: ' . implode(', ', $errors) . '.', + ); + } +} diff --git a/src/Helpers/Type.php b/src/Helpers/Type.php index e318391..c4ec90c 100644 --- a/src/Helpers/Type.php +++ b/src/Helpers/Type.php @@ -24,9 +24,11 @@ public function ensureString(mixed $value, ?string $context = null): string return (string)$value; } - $error = 'Unsafe string casting, aborting.'; - $error .= is_string($context) ? ' Context: ' . $context : ''; - $error .= ' Value was: ' . var_export($value, true); + $error = $this->prepareErrorMessage( + 'Unsafe string casting, aborting.', + $value, + $context, + ); throw new InvalidValueException($error); } @@ -44,9 +46,11 @@ public function ensureNonEmptyString(mixed $value, ?string $context = null): str return $value; } - $error = 'Empty string value encountered, aborting.'; - $error .= is_string($context) ? ' Context: ' . $context : ''; - $error .= ' Value was: ' . var_export($value, true); + $error = $this->prepareErrorMessage( + 'Empty string value encountered, aborting.', + $value, + $context, + ); throw new InvalidValueException($error); } @@ -75,9 +79,11 @@ public function ensureArray(mixed $value, ?string $context = null): array // Converts object properties to an array } - $error = 'Unsafe array casting, aborting.'; - $error .= is_string($context) ? 'Context: ' . $context : ''; - $error .= ' Value was: ' . var_export($value, true); + $error = $this->prepareErrorMessage( + 'Unsafe array casting, aborting.', + $value, + $context, + ); throw new InvalidValueException($error); } @@ -212,10 +218,155 @@ public function ensureInt(mixed $value, ?string $context = null): int return (int)$value; } - $error = 'Unsafe integer casting, aborting.'; - $error .= is_string($context) ? 'Context: ' . $context : ''; - $error .= ' Value was: ' . var_export($value, true); + $error = $this->prepareErrorMessage( + 'Unsafe integer casting, aborting.', + $value, + $context, + ); throw new InvalidValueException($error); } + + + /** + * @return non-empty-string + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function enforceRegex( + mixed $value, + string $pattern, + ?string $context = null, + ): string { + $value = $this->ensureNonEmptyString($value, $context); + + $error = $this->prepareErrorMessage( + 'Regex match failed, aborting.', + $value, + $context, + ); + + preg_match($pattern, $value) || throw new InvalidValueException($error); + + return $value; + } + + + /** + * @return non-empty-string + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function enforceUri( + mixed $value, + ?string $context = null, + string $pattern = '/^[a-zA-Z][a-zA-Z0-9+.-]*:[^\s]*$/', + ): string { + try { + $value = $this->enforceRegex($value, $pattern, $context); + } catch (InvalidValueException) { + $error = $this->prepareErrorMessage( + 'URI regex match failed, aborting.', + $value, + $context, + ); + + throw new InvalidValueException($error); + } + + return $value; + } + + + /** + * @param mixed[] $array + * @return array + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function enforceArrayOfArrays(array $array, ?string $context = null): array + { + foreach ($array as $value) { + if (!is_array($value)) { + $error = $this->prepareErrorMessage( + 'Non-array value encountered, aborting.', + $array, + $context, + ); + + throw new InvalidValueException($error); + } + } + + /** @var array $array */ + return $array; + } + + + /** + * @param mixed[] $array + * @return non-empty-array + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function enforceNonEmptyArray(array $array, ?string $context = null): array + { + if ($array === []) { + $error = $this->prepareErrorMessage( + 'Empty array encountered, aborting.', + $array, + $context, + ); + throw new InvalidValueException($error); + } + + return $array; + } + + + /** + * @param mixed[] $array + * @return non-empty-array + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function enforceNonEmptyArrayWithValuesAsNonEmptyStrings(array $array, ?string $context = null): array + { + $array = $this->ensureArrayWithValuesAsNonEmptyStrings($array, $context); + $array = $this->enforceNonEmptyArray($array, $context); + + /** @var non-empty-array $array */ + return $array; + } + + + /** + * @param mixed[] $array + * @return non-empty-array + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function enforceNonEmptyArrayOfNonEmptyArrays(array $array, ?string $context = null): array + { + $array = $this->enforceNonEmptyArray($array, $context); + + foreach ($array as $value) { + if (!is_array($value)) { + $error = $this->prepareErrorMessage( + 'Non-array value encountered, aborting.', + $array, + $context, + ); + + throw new InvalidValueException($error); + } + + $this->enforceNonEmptyArray($value, $context); + } + + /** @var non-empty-array $array */ + return $array; + } + + + protected function prepareErrorMessage(string $message, mixed $value, ?string $context = null): string + { + return $message . + (is_string($context) ? ' Context: ' . $context : '') . + ' Value was: ' . var_export($value, true); + } } diff --git a/src/Jwk.php b/src/Jwk.php new file mode 100644 index 0000000..6660c12 --- /dev/null +++ b/src/Jwk.php @@ -0,0 +1,18 @@ +jwkDecoratorFactory ??= new JwkDecoratorFactory(); + } +} diff --git a/src/Jwk/Factories/JwkDecoratorFactory.php b/src/Jwk/Factories/JwkDecoratorFactory.php new file mode 100644 index 0000000..261d995 --- /dev/null +++ b/src/Jwk/Factories/JwkDecoratorFactory.php @@ -0,0 +1,95 @@ +jwk; + } +} diff --git a/src/Jwks.php b/src/Jwks.php index 0eafa66..64f55e8 100644 --- a/src/Jwks.php +++ b/src/Jwks.php @@ -8,6 +8,7 @@ use GuzzleHttp\Client; use Psr\Log\LoggerInterface; use Psr\SimpleCache\CacheInterface; +use SimpleSAML\OpenID\Algorithms\AlgorithmManagerDecorator; use SimpleSAML\OpenID\Decorators\CacheDecorator; use SimpleSAML\OpenID\Decorators\DateIntervalDecorator; use SimpleSAML\OpenID\Decorators\HttpClientDecorator; @@ -17,12 +18,12 @@ use SimpleSAML\OpenID\Factories\DateIntervalDecoratorFactory; use SimpleSAML\OpenID\Factories\HttpClientDecoratorFactory; use SimpleSAML\OpenID\Factories\JwsSerializerManagerDecoratorFactory; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jwks\Factories\SignedJwksFactory; use SimpleSAML\OpenID\Jwks\JwksFetcher; -use SimpleSAML\OpenID\Jws\Factories\JwsParserFactory; +use SimpleSAML\OpenID\Jws\Factories\JwsDecoratorBuilderFactory; use SimpleSAML\OpenID\Jws\Factories\JwsVerifierDecoratorFactory; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; @@ -40,11 +41,11 @@ class Jwks protected ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null; - protected ?JwsParser $jwsParser = null; + protected ?JwsDecoratorBuilder $jwsDecoratorBuilder = null; protected ?JwsVerifierDecorator $jwsVerifierDecorator = null; - protected ?JwksFactory $jwksFactory = null; + protected ?JwksDecoratorFactory $jwksDecoratorFactory = null; protected ?SignedJwksFactory $signedJwksFactory = null; @@ -54,7 +55,7 @@ class Jwks protected ?JwsSerializerManagerDecoratorFactory $jwsSerializerManagerDecoratorFactory = null; - protected ?JwsParserFactory $jwsParserFactory = null; + protected ?JwsDecoratorBuilderFactory $jwsDecoratorBuilderFactory = null; protected ?JwsVerifierDecoratorFactory $jwsVerifierDecoratorFactory = null; @@ -66,6 +67,8 @@ class Jwks protected ?ClaimFactory $claimFactory = null; + protected ?AlgorithmManagerDecorator $algorithmManagerDecorator = null; + public function __construct( protected readonly SupportedAlgorithms $supportedAlgorithms = new SupportedAlgorithms(), @@ -84,18 +87,18 @@ public function __construct( } - public function jwksFactory(): JwksFactory + public function jwksDecoratorFactory(): JwksDecoratorFactory { - return $this->jwksFactory ??= new JwksFactory(); + return $this->jwksDecoratorFactory ??= new JwksDecoratorFactory(); } public function signedJwksFactory(): SignedJwksFactory { return $this->signedJwksFactory ??= new SignedJwksFactory( - $this->jwsParser(), + $this->jwsDecoratorBuilder(), $this->jwsVerifierDecorator(), - $this->jwksFactory(), + $this->jwksDecoratorFactory(), $this->jwsSerializerManagerDecorator(), $this->timestampValidationLeewayDecorator, $this->helpers(), @@ -108,7 +111,7 @@ public function jwksFetcher(): JwksFetcher { return $this->jwksFetcher ??= new JwksFetcher( $this->httpClientDecorator, - $this->jwksFactory(), + $this->jwksDecoratorFactory(), $this->signedJwksFactory(), $this->maxCacheDurationDecorator, $this->helpers(), @@ -135,6 +138,14 @@ public function algorithmManagerDecoratorFactory(): AlgorithmManagerDecoratorFac } + public function algorithmManagerDecorator(): AlgorithmManagerDecorator + { + return $this->algorithmManagerDecorator ??= $this->algorithmManagerDecoratorFactory()->build( + $this->supportedAlgorithms, + ); + } + + public function jwsSerializerManagerDecoratorFactory(): JwsSerializerManagerDecoratorFactory { if (is_null($this->jwsSerializerManagerDecoratorFactory)) { @@ -145,13 +156,13 @@ public function jwsSerializerManagerDecoratorFactory(): JwsSerializerManagerDeco } - public function jwsParserFactory(): JwsParserFactory + public function jwsDecoratorBuilderFactory(): JwsDecoratorBuilderFactory { - if (is_null($this->jwsParserFactory)) { - $this->jwsParserFactory = new JwsParserFactory(); + if (is_null($this->jwsDecoratorBuilderFactory)) { + $this->jwsDecoratorBuilderFactory = new JwsDecoratorBuilderFactory(); } - return $this->jwsParserFactory; + return $this->jwsDecoratorBuilderFactory; } @@ -203,9 +214,13 @@ public function jwsVerifierDecorator(): JwsVerifierDecorator } - public function jwsParser(): JwsParser + public function jwsDecoratorBuilder(): JwsDecoratorBuilder { - return $this->jwsParser ??= $this->jwsParserFactory()->build($this->jwsSerializerManagerDecorator()); + return $this->jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderFactory()->build( + $this->jwsSerializerManagerDecorator(), + $this->algorithmManagerDecorator(), + $this->helpers(), + ); } diff --git a/src/Jwks/Factories/JwksFactory.php b/src/Jwks/Factories/JwksDecoratorFactory.php similarity index 78% rename from src/Jwks/Factories/JwksFactory.php rename to src/Jwks/Factories/JwksDecoratorFactory.php index 8cd2b95..f5f5458 100644 --- a/src/Jwks/Factories/JwksFactory.php +++ b/src/Jwks/Factories/JwksDecoratorFactory.php @@ -7,12 +7,12 @@ use Jose\Component\Core\JWKSet; use SimpleSAML\OpenID\Jwks\JwksDecorator; -class JwksFactory +class JwksDecoratorFactory { /** * @phpstan-ignore missingType.iterableValue (JWKS array is validated later) */ - public function fromKeyData(array $jwks): JwksDecorator + public function fromKeySetData(array $jwks): JwksDecorator { return new JwksDecorator(JWKSet::createFromKeyData($jwks)); } diff --git a/src/Jwks/Factories/SignedJwksFactory.php b/src/Jwks/Factories/SignedJwksFactory.php index 1ec7161..3ce6d08 100644 --- a/src/Jwks/Factories/SignedJwksFactory.php +++ b/src/Jwks/Factories/SignedJwksFactory.php @@ -4,6 +4,10 @@ namespace SimpleSAML\OpenID\Jwks\Factories; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; +use SimpleSAML\OpenID\Codebooks\ClaimsEnum; +use SimpleSAML\OpenID\Codebooks\JwtTypesEnum; +use SimpleSAML\OpenID\Jwk\JwkDecorator; use SimpleSAML\OpenID\Jwks\SignedJwks; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; @@ -15,9 +19,39 @@ class SignedJwksFactory extends ParsedJwsFactory public function fromToken(string $token): SignedJwks { return new SignedJwks( - $this->jwsParser->parse($token), + $this->jwsDecoratorBuilder->fromToken($token), $this->jwsVerifierDecorator, - $this->jwksFactory, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + ); + } + + + /** + * @param array $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + ): SignedJwks { + $header[ClaimsEnum::Typ->value] = JwtTypesEnum::JwkSetJwt->value; + + return new SignedJwks( + $this->jwsDecoratorBuilder->fromData( + $signingKey, + $signatureAlgorithm, + $payload, + $header, + ), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, $this->jwsSerializerManagerDecorator, $this->timestampValidationLeeway, $this->helpers, diff --git a/src/Jwks/JwksFetcher.php b/src/Jwks/JwksFetcher.php index abc62c9..43b99ef 100644 --- a/src/Jwks/JwksFetcher.php +++ b/src/Jwks/JwksFetcher.php @@ -13,7 +13,7 @@ use SimpleSAML\OpenID\Exceptions\JwksException; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jwks\Factories\SignedJwksFactory; use Throwable; @@ -21,7 +21,7 @@ class JwksFetcher { public function __construct( protected readonly HttpClientDecorator $httpClientDecorator, - protected readonly JwksFactory $jwksFactory, + protected readonly JwksDecoratorFactory $jwksDecoratorFactory, protected readonly SignedJwksFactory $signedJwksFactory, protected readonly DateIntervalDecorator $maxCacheDurationDecorator, protected readonly Helpers $helpers, @@ -94,7 +94,7 @@ public function fromCache(string $uri): ?JwksDecorator $this->logger?->debug('JWKS JSON decoded, proceeding to instance building.', ['uri' => $uri, 'jwks' => $jwks]); - return $this->jwksFactory->fromKeyData($jwks); + return $this->jwksDecoratorFactory->fromKeySetData($jwks); } @@ -156,7 +156,7 @@ public function fromJwksUri(string $uri): ?JwksDecorator $this->logger?->debug('Proceeding to instance building.', ['uri' => $uri, 'jwks' => $jwks]); - return $this->jwksFactory->fromKeyData($jwks); + return $this->jwksDecoratorFactory->fromKeySetData($jwks); } @@ -222,6 +222,6 @@ public function fromSignedJwksUri(string $uri, array $federationJwks): ?JwksDeco ); } - return $this->jwksFactory->fromKeyData($signedJwks->jsonSerialize()); + return $this->jwksDecoratorFactory->fromKeySetData($signedJwks->jsonSerialize()); } } diff --git a/src/Jws/Factories/JwsDecoratorBuilderFactory.php b/src/Jws/Factories/JwsDecoratorBuilderFactory.php new file mode 100644 index 0000000..61a2c12 --- /dev/null +++ b/src/Jws/Factories/JwsDecoratorBuilderFactory.php @@ -0,0 +1,26 @@ +algorithmManager()), + $helpers, + ); + } +} diff --git a/src/Jws/Factories/JwsParserFactory.php b/src/Jws/Factories/JwsParserFactory.php deleted file mode 100644 index d637963..0000000 --- a/src/Jws/Factories/JwsParserFactory.php +++ /dev/null @@ -1,16 +0,0 @@ -jwsParser->parse($token), + $this->jwsDecoratorBuilder->fromToken($token), $this->jwsVerifierDecorator, - $this->jwksFactory, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + ); + } + + + /** + * @param array $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + ): ParsedJws { + return new ParsedJws( + $this->jwsDecoratorBuilder->fromData( + $signingKey, + $signatureAlgorithm, + $payload, + $header, + ), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, $this->jwsSerializerManagerDecorator, $this->timestampValidationLeeway, $this->helpers, diff --git a/src/Jws/JwsDecoratorBuilder.php b/src/Jws/JwsDecoratorBuilder.php new file mode 100644 index 0000000..27e71d5 --- /dev/null +++ b/src/Jws/JwsDecoratorBuilder.php @@ -0,0 +1,68 @@ +serializerManagerDecorator->unserialize($token); + } catch (Throwable $throwable) { + throw new JwsException('Unable to parse token.', (int)$throwable->getCode(), $throwable); + } + } + + + /** + * @param array $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + ): JwsDecorator { + $header = array_merge( + $header, + [ClaimsEnum::Alg->value => $signatureAlgorithm->value], + ); + + try { + return new JwsDecorator( + $this->jwsBuilder->create()->withPayload( + $this->helpers->json()->encode($payload), + )->addSignature( + $signingKey->jwk(), + $header, + )->build(), + ); + } catch (Throwable $throwable) { + throw new JwsException('Unable to build JWS.', (int)$throwable->getCode(), $throwable); + } + } +} diff --git a/src/Jws/JwsParser.php b/src/Jws/JwsParser.php deleted file mode 100644 index cd85827..0000000 --- a/src/Jws/JwsParser.php +++ /dev/null @@ -1,30 +0,0 @@ -serializerManagerDecorator->unserialize($token); - } catch (Throwable $throwable) { - throw new JwsException('Unable to parse token.', (int)$throwable->getCode(), $throwable); - } - } -} diff --git a/src/Jws/ParsedJws.php b/src/Jws/ParsedJws.php index d5ec0e1..e3e0cf3 100644 --- a/src/Jws/ParsedJws.php +++ b/src/Jws/ParsedJws.php @@ -10,7 +10,7 @@ use SimpleSAML\OpenID\Exceptions\JwsException; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Serializers\JwsSerializerEnum; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; use Throwable; @@ -33,7 +33,7 @@ class ParsedJws public function __construct( protected readonly JwsDecorator $jwsDecorator, protected readonly JwsVerifierDecorator $jwsVerifierDecorator, - protected readonly JwksFactory $jwksFactory, + protected readonly JwksDecoratorFactory $jwksDecoratorFactory, protected readonly JwsSerializerManagerDecorator $jwsSerializerManagerDecorator, protected readonly DateIntervalDecorator $timestampValidationLeeway, protected readonly Helpers $helpers, @@ -102,6 +102,15 @@ public function getPayloadClaim(string $key): mixed } + public function getNestedPayloadClaim(int|string ...$keys): mixed + { + return $this->helpers->arr()->getNestedValue( + $this->getPayload(), + ...$keys, + ); + } + + public function getToken( JwsSerializerEnum $jwsSerializerEnum = JwsSerializerEnum::Compact, ?int $signatureIndex = null, @@ -148,7 +157,7 @@ public function verifyWithKeySet(array $jwks, int $signatureIndex = 0): void if ( !$this->jwsVerifierDecorator->verifyWithKeySet( $this->jwsDecorator, - $this->jwksFactory->fromKeyData($jwks), + $this->jwksDecoratorFactory->fromKeySetData($jwks), $signatureIndex, ) ) { @@ -158,8 +167,24 @@ public function verifyWithKeySet(array $jwks, int $signatureIndex = 0): void /** + * @param mixed[] $key * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * + */ + public function verifyWithKey(array $key): void + { + $this->verifyWithKeySet([ + 'keys' => [ + $key, + ], + ]); + } + + + /** * @return ?non-empty-string + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\JwsException */ public function getIssuer(): ?string { @@ -174,8 +199,9 @@ public function getIssuer(): ?string /** - * @throws \SimpleSAML\OpenID\Exceptions\JwsException * @return ?non-empty-string + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\JwsException */ public function getSubject(): ?string { @@ -188,8 +214,9 @@ public function getSubject(): ?string /** - * @throws \SimpleSAML\OpenID\Exceptions\JwsException * @return ?string[] + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\JwsException */ public function getAudience(): ?array { @@ -215,6 +242,7 @@ public function getAudience(): ?array /** * @throws \SimpleSAML\OpenID\Exceptions\JwsException * @throws \SimpleSAML\OpenID\Exceptions\ClientAssertionException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException * @return ?non-empty-string */ public function getJwtId(): ?string @@ -251,6 +279,29 @@ public function getExpirationTime(): ?int /** * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function getNotBefore(): ?int + { + $nbf = $this->getPayloadClaim(ClaimsEnum::Nbf->value); + + if (is_null($nbf)) { + return null; + } + + $nbf = $this->helpers->type()->ensureInt($nbf); + + if ($nbf - $this->timestampValidationLeeway->getInSeconds() > time()) { + throw new JwsException(sprintf('Not Before claim (%d) is higher than current time.', $nbf)); + } + + return $nbf; + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException */ public function getIssuedAt(): ?int { @@ -273,6 +324,7 @@ public function getIssuedAt(): ?int /** * @return ?non-empty-string * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException */ public function getIdentifier(): ?string { @@ -289,6 +341,7 @@ public function getIdentifier(): ?string /** * @return ?non-empty-string * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException */ public function getKeyId(): ?string { @@ -303,6 +356,7 @@ public function getKeyId(): ?string /** * @return ?non-empty-string * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException */ public function getType(): ?string { @@ -312,4 +366,19 @@ public function getType(): ?string return is_null($typ) ? null : $this->helpers->type()->ensureNonEmptyString($typ, $claimKey); } + + + /** + * @return ?non-empty-string + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function getAlgorithm(): ?string + { + $claimKey = ClaimsEnum::Alg->value; + + $typ = $this->getHeaderClaim($claimKey); + + return is_null($typ) ? null : $this->helpers->type()->ensureNonEmptyString($typ, $claimKey); + } } diff --git a/src/SdJwt/Disclosure.php b/src/SdJwt/Disclosure.php new file mode 100644 index 0000000..aaba379 --- /dev/null +++ b/src/SdJwt/Disclosure.php @@ -0,0 +1,153 @@ + + */ + public const FORBIDDEN_NAMES = [ + ClaimsEnum::_SdAlg->value, + ClaimsEnum::_Sd->value, + ClaimsEnum::DotDotDot->value, + ]; + + + /** + * @var non-empty-string|null + */ + protected ?string $encoded = null; + + /** + * @var non-empty-string|null + */ + protected ?string $digest = null; + + + /** + * @param array $path + * @throws \SimpleSAML\OpenID\Exceptions\SdJwtException + */ + public function __construct( + protected readonly Helpers $helpers, + protected readonly string $salt, + protected readonly mixed $value, + protected readonly ?string $name = null, + protected readonly array $path = [], + protected readonly HashAlgorithmsEnum $selectiveDisclosureAlgorithm = HashAlgorithmsEnum::SHA_256, + ) { + if ($this->name !== null && in_array($this->name, self::FORBIDDEN_NAMES, true)) { + throw new SdJwtException('Disclosure name cannot be one of the forbidden names.'); + } + + if ($this->name === null && $this->path === []) { + throw new SdJwtException('Disclosure name and path cannot be both empty.'); + } + } + + + public function getSalt(): string + { + return $this->salt; + } + + + public function getValue(): mixed + { + return $this->value; + } + + + public function getName(): ?string + { + return $this->name; + } + + + /** + * @return array + */ + public function getPath(): array + { + return $this->path; + } + + + /** + * @return array + */ + public function jsonSerialize(): array + { + if ($this->name === null) { + return [$this->salt, $this->value]; + } + + return [$this->salt, $this->name, $this->value]; + } + + + public function getType(): SdJwtDisclosureType + { + if ($this->name === null) { + return SdJwtDisclosureType::ArrayElement; + } + + return SdJwtDisclosureType::ObjectProperty; + } + + + public function getEncoded(): string + { + return $this->encoded ??= $this->helpers->type()->ensureNonEmptyString( + $this->helpers->base64Url()->encode( + $this->helpers->json()->encode( + $this->jsonSerialize(), + ), + ), + ); + } + + + /** + * @return non-empty-string + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException + */ + public function getDigest(): string + { + return $this->digest ??= $this->helpers->type()->ensureNonEmptyString( + $this->helpers->base64Url()->encode( + $this->helpers->hash()->for( + $this->selectiveDisclosureAlgorithm->phpName(), + $this->getEncoded(), + true, + ), + ), + ); + } + + + /** + * @return non-empty-string|array{"...": non-empty-string} + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException + */ + public function getDigestRepresentation(): string|array + { + if ($this->getType() === SdJwtDisclosureType::ArrayElement) { + return [ + ClaimsEnum::DotDotDot->value => $this->getDigest(), + ]; + } + + return $this->getDigest(); + } +} diff --git a/src/SdJwt/DisclosureBag.php b/src/SdJwt/DisclosureBag.php new file mode 100644 index 0000000..041e5d3 --- /dev/null +++ b/src/SdJwt/DisclosureBag.php @@ -0,0 +1,54 @@ +add(...$disclosures); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\SdJwtException + */ + public function add(Disclosure ...$disclosures): void + { + foreach ($disclosures as $disclosure) { + if (array_key_exists($disclosure->getSalt(), $this->disclosures)) { + throw new SdJwtException('Disclosure with the same salt already exists in the bag.'); + } + + $this->disclosures[$disclosure->getSalt()] = $disclosure; + } + } + + + /** + * @return \SimpleSAML\OpenID\SdJwt\Disclosure[] + */ + public function all(): array + { + return $this->disclosures; + } + + + /** + * @return string[] + */ + public function salts(): array + { + return array_keys($this->disclosures); + } +} diff --git a/src/SdJwt/Factories/DisclosureBagFactory.php b/src/SdJwt/Factories/DisclosureBagFactory.php new file mode 100644 index 0000000..0a428b7 --- /dev/null +++ b/src/SdJwt/Factories/DisclosureBagFactory.php @@ -0,0 +1,16 @@ + $path + * @param string[] $saltBlacklist + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException + */ + public function build( + mixed $value, + ?string $name = null, + ?string $salt = null, + array $path = [], + HashAlgorithmsEnum $selectiveDisclosureAlgorithm = HashAlgorithmsEnum::SHA_256, + array $saltBlacklist = [], + ): Disclosure { + + $salt ??= $this->helpers->random()->string( + blacklist: $saltBlacklist, + ); + + return new Disclosure( + $this->helpers, + $salt, + $value, + $name, + $path, + $selectiveDisclosureAlgorithm, + ); + } + + + /** + * @param array $path + * @param string[] $saltBlacklist + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException + */ + public function buildDecoy( + SdJwtDisclosureType $sdJwtDisclosureType, + array $path, + HashAlgorithmsEnum $selectiveDisclosureAlgorithm = HashAlgorithmsEnum::SHA_256, + array $saltBlacklist = [], + ): Disclosure { + $salt = $this->helpers->random()->string(blacklist: $saltBlacklist); + $value = $this->helpers->random()->string(); + $name = $this->helpers->random()->string(); + + if ($sdJwtDisclosureType === SdJwtDisclosureType::ArrayElement) { + $name = null; + if ($path === []) { + $path = [ + $this->helpers->random()->string(), + ]; + } + } + + return $this->build( + $value, + $name, + $salt, + $path, + $selectiveDisclosureAlgorithm, + ); + } +} diff --git a/src/SdJwt/Factories/SdJwtFactory.php b/src/SdJwt/Factories/SdJwtFactory.php new file mode 100644 index 0000000..e38e670 --- /dev/null +++ b/src/SdJwt/Factories/SdJwtFactory.php @@ -0,0 +1,171 @@ + $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + ?DisclosureBag $disclosureBag = null, + ?KbJwt $kbJwt = null, + JwtTypesEnum $jwtTypesEnum = JwtTypesEnum::ExampleSdJwt, + HashAlgorithmsEnum $hashAlgorithmsEnum = HashAlgorithmsEnum::SHA_256, + ): SdJwt { + $header[ClaimsEnum::Typ->value] = $jwtTypesEnum->value; + + if ($disclosureBag instanceof DisclosureBag) { + $payload = $this->updatePayloadWithDisclosures($payload, $disclosureBag, $hashAlgorithmsEnum); + } + + /** @var array $payload */ + + return new SdJwt( + $this->jwsDecoratorBuilder->fromData( + $signingKey, + $signatureAlgorithm, + $payload, + $header, + ), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + $disclosureBag, + $kbJwt, + ); + } + + + /** + * @param array $payload + * @return array + * @throws \SimpleSAML\OpenID\Exceptions\SdJwtException + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException + */ + public function updatePayloadWithDisclosures( + array $payload, + DisclosureBag $disclosureBag, + HashAlgorithmsEnum $hashAlgorithmsEnum, + int $minDecoys = 1, + int $maxDecoys = 5, + ): array { + $disclosures = $disclosureBag->all(); + + if ($disclosures === []) { + return $payload; + } + + $payload[ClaimsEnum::_SdAlg->value] = $hashAlgorithmsEnum->ianaName(); + + $disclosurePaths = []; + + $usedDecoys = 0; + + foreach ($disclosures as $disclosure) { + $disclosurePath = $disclosure->getPath(); + + $disclosureType = $disclosure->getType(); + + if ($disclosureType === SdJwtDisclosureType::ObjectProperty) { + $disclosurePath = [...$disclosure->getPath(), ClaimsEnum::_Sd->value]; + } + + if (!in_array($disclosurePath, $disclosurePaths, true)) { + $disclosurePaths[] = $disclosurePath; + } + + $this->helpers->arr()->addNestedValue( + $payload, + $disclosure->getDigestRepresentation(), + ...$disclosurePath, + ); + + // Ensure minimum and maximum number of decoys, otherwise add them + // randomly. + if ( + ($usedDecoys < $minDecoys && $usedDecoys <= $maxDecoys) || + random_int(0, 1) !== 0 + ) { + $disclosurePathReference =& $this->helpers->arr()->getNestedValueReference( + $payload, + ...$disclosurePath, + ); + + if (is_array($disclosurePathReference)) { + $disclosureDecoy = $this->disclosureFactory->buildDecoy( + $disclosureType, + $disclosurePath, + $hashAlgorithmsEnum, + $disclosureBag->salts(), + ); + + // Make sure that we never add duplicates. + if (!in_array($disclosureDecoy->getDigestRepresentation(), $disclosurePathReference, true)) { + $disclosurePathReference[] = $disclosureDecoy->getDigestRepresentation(); + } + + if ($disclosureType === SdJwtDisclosureType::ObjectProperty) { + shuffle($disclosurePathReference); + } + } + } + } + + /** @var array $payload */ + + return $payload; + } +} diff --git a/src/SdJwt/KbJwt.php b/src/SdJwt/KbJwt.php new file mode 100644 index 0000000..1de7bb2 --- /dev/null +++ b/src/SdJwt/KbJwt.php @@ -0,0 +1,11 @@ +value; + + $_sdAlg = $this->getPayloadClaim($claimKey); + + return is_null($_sdAlg) ? + null : + HashAlgorithmsEnum::from($this->helpers->type()->ensureNonEmptyString($_sdAlg, $claimKey)); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @return ?mixed[] + */ + public function getConfirmation(): ?array + { + $claimKey = ClaimsEnum::Cnf->value; + + $cnf = $this->getPayloadClaim($claimKey); + + return is_null($cnf) ? + null : + $this->helpers->type()->ensureArray($cnf, $claimKey); + } + + + public function getDisclosureBag(): ?DisclosureBag + { + return $this->disclosureBag; + } + + + public function getKbJwt(): ?KbJwt + { + return $this->kbJwt; + } + + + /** + * @param \SimpleSAML\OpenID\SdJwt\DisclosureBag|null $disclosureBag If provided, only disclosures with matching + * salts will be included. + * @throws \JsonException + */ + public function getToken( + JwsSerializerEnum $jwsSerializerEnum = JwsSerializerEnum::Compact, + ?int $signatureIndex = null, + ?DisclosureBag $disclosureBag = null, + ): string { + $token = parent::getToken($jwsSerializerEnum, $signatureIndex) . self::TILDE; + $disclosures = $this->disclosureBag?->all() ?? []; + + if ($disclosureBag instanceof DisclosureBag) { + $disclosures = array_filter( + $disclosureBag->all(), + fn (Disclosure $disclosure): bool => array_key_exists($disclosure->getSalt(), $disclosures), + ); + } + + foreach ($disclosures as $disclosure) { + $token .= $this->helpers->base64Url()->encode( + $this->helpers->json()->encode($disclosure->jsonSerialize()), + ) . self::TILDE; + } + + if ($this->kbJwt instanceof KbJwt) { + $token .= $this->kbJwt->getToken($jwsSerializerEnum, $signatureIndex); + } + + return $token; + } + + + public function getUndisclosedToken( + JwsSerializerEnum $jwsSerializerEnum = JwsSerializerEnum::Compact, + ?int $signatureIndex = null, + ): string { + return parent::getToken($jwsSerializerEnum, $signatureIndex); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\EntityStatementException + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException + */ + protected function validate(): void + { + $this->validateByCallbacks( + $this->getSelectiveDisclosureAlgorithm(...), + $this->getExpirationTime(...), + $this->getIssuedAt(...), + $this->getNotBefore(...), + ); + } +} diff --git a/src/VerifiableCredentials.php b/src/VerifiableCredentials.php new file mode 100644 index 0000000..ddf4642 --- /dev/null +++ b/src/VerifiableCredentials.php @@ -0,0 +1,245 @@ +timestampValidationLeewayDecorator = $this->dateIntervalDecoratorFactory() + ->build($timestampValidationLeeway); + } + + + public function dateIntervalDecoratorFactory(): DateIntervalDecoratorFactory + { + return $this->dateIntervalDecoratorFactory ??= new DateIntervalDecoratorFactory(); + } + + + public function helpers(): Helpers + { + return $this->helpers ??= new Helpers(); + } + + + public function claimsPathPointerResolver(): ClaimsPathPointerResolver + { + return $this->claimsPathPointerResolver ??= new ClaimsPathPointerResolver( + $this->helpers(), + ); + } + + + public function jwsDecoratorBuilderFactory(): JwsDecoratorBuilderFactory + { + return $this->jwsDecoratorBuilderFactory ??= new JwsDecoratorBuilderFactory(); + } + + + public function jwsSerializerManagerDecoratorFactory(): JwsSerializerManagerDecoratorFactory + { + return $this->jwsSerializerManagerDecoratorFactory ??= new JwsSerializerManagerDecoratorFactory(); + } + + + public function jwsSerializerManagerDecorator(): JwsSerializerManagerDecorator + { + return $this->jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorFactory() + ->build($this->supportedSerializers); + } + + + public function algorithmManagerDecoratorFactory(): AlgorithmManagerDecoratorFactory + { + return $this->algorithmManagerDecoratorFactory ??= new AlgorithmManagerDecoratorFactory(); + } + + + public function algorithmManagerDecorator(): AlgorithmManagerDecorator + { + return $this->algorithmManagerDecorator ??= $this->algorithmManagerDecoratorFactory() + ->build($this->supportedAlgorithms); + } + + + public function jwsDecoratorBuilder(): JwsDecoratorBuilder + { + return $this->jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderFactory()->build( + $this->jwsSerializerManagerDecorator(), + $this->algorithmManagerDecorator(), + $this->helpers(), + ); + } + + + public function jwsVerifierDecoratorFactory(): JwsVerifierDecoratorFactory + { + return $this->jwsVerifierDecoratorFactory ??= new JwsVerifierDecoratorFactory(); + } + + + public function jwsVerifierDecorator(): JwsVerifierDecorator + { + return $this->jwsVerifierDecorator ??= $this->jwsVerifierDecoratorFactory()->build( + $this->algorithmManagerDecorator(), + ); + } + + + public function jwksDecoratorFactory(): JwksDecoratorFactory + { + return $this->jwksDecoratorFactory ??= new JwksDecoratorFactory(); + } + + + public function claimFactory(): ClaimFactory + { + return $this->claimFactory ??= new ClaimFactory( + $this->helpers(), + ); + } + + + public function jwtVcJsonFactory(): JwtVcJsonFactory + { + return $this->jwtVcJsonFactory ??= new JwtVcJsonFactory( + $this->jwsDecoratorBuilder(), + $this->jwsVerifierDecorator(), + $this->jwksDecoratorFactory(), + $this->jwsSerializerManagerDecorator(), + $this->timestampValidationLeewayDecorator, + $this->helpers(), + $this->claimFactory(), + ); + } + + + public function credentialOfferFactory(): CredentialOfferFactory + { + return $this->credentialOfferFactory ??= new CredentialOfferFactory( + $this->helpers(), + ); + } + + + public function openId4VciProofFactory(): OpenId4VciProofFactory + { + return $this->openId4VciProofFactory ??= new OpenId4VciProofFactory( + $this->jwsDecoratorBuilder(), + $this->jwsVerifierDecorator(), + $this->jwksDecoratorFactory(), + $this->jwsSerializerManagerDecorator(), + $this->timestampValidationLeewayDecorator, + $this->helpers(), + $this->claimFactory(), + ); + } + + + public function disclosureFactory(): DisclosureFactory + { + return $this->disclosureFactory ??= new DisclosureFactory( + $this->helpers(), + ); + } + + + public function disclosureBagFactory(): DisclosureBagFactory + { + return $this->disclosureBagFactory ??= new DisclosureBagFactory(); + } + + + public function sdJwtVcFactory(): SdJwtVcFactory + { + return $this->sdJwtVcFactory ??= new SdJwtVcFactory( + $this->jwsDecoratorBuilder(), + $this->jwsVerifierDecorator(), + $this->jwksDecoratorFactory(), + $this->jwsSerializerManagerDecorator(), + $this->timestampValidationLeewayDecorator, + $this->helpers(), + $this->claimFactory(), + $this->disclosureFactory(), + ); + } + + + public function txCodeFactory(): TxCodeFactory + { + return $this->txCodeFactory ??= new TxCodeFactory(); + } +} diff --git a/src/VerifiableCredentials/ClaimsPathPointerResolver.php b/src/VerifiableCredentials/ClaimsPathPointerResolver.php new file mode 100644 index 0000000..e1341e7 --- /dev/null +++ b/src/VerifiableCredentials/ClaimsPathPointerResolver.php @@ -0,0 +1,97 @@ + $path + * @return mixed[] + * @throws \SimpleSAML\OpenID\Exceptions\ClaimsPathPointerException + */ + public function forJsonBased(array $data, array $path): array + { + // Start with the root element as the only “selected” element + $selected = [$data]; + + foreach ($path as $pathComponent) { + $nextSelected = []; + + // Process each currently selected element + foreach ($selected as $selectedElement) { + if (is_string($pathComponent)) { + // String -> object key + if ( + (!is_array($selectedElement)) || + (!$this->helpers->arr()->isAssociative($selectedElement)) + ) { + throw new ClaimsPathPointerException('Expected object for string path component.'); + } + + if (array_key_exists($pathComponent, $selectedElement)) { + $nextSelected[] = $selectedElement[$pathComponent]; + } + + // else: drop this element + } elseif (is_null($pathComponent)) { + // Null -> all elements of an array + if ( + (!is_array($selectedElement)) || + $this->helpers->arr()->isAssociative($selectedElement) + ) { + throw new ClaimsPathPointerException('Expected array for null path component.'); + } + + foreach ($selectedElement as $item) { + $nextSelected[] = $item; + } + } elseif (is_int($pathComponent) && $pathComponent >= 0) { + // Integer → array index + if ( + (!is_array($selectedElement)) || + $this->helpers->arr()->isAssociative($selectedElement) + ) { + throw new ClaimsPathPointerException('Expected array for integer path component.'); + } + + if (array_key_exists($pathComponent, $selectedElement)) { + $nextSelected[] = $selectedElement[$pathComponent]; + } + + // else: drop this element + } else { + throw new ClaimsPathPointerException( + 'Path component must be string, null, or non-negative integer.', + ); + } + } + + // If nothing remains, error out + if ($nextSelected === []) { + throw new ClaimsPathPointerException('No elements selected at path component'); + } + + $selected = $nextSelected; + } + + // The final result is the set of selected JSON elements. + return $selected; + } +} diff --git a/src/VerifiableCredentials/CredentialOffer.php b/src/VerifiableCredentials/CredentialOffer.php new file mode 100644 index 0000000..ba262d2 --- /dev/null +++ b/src/VerifiableCredentials/CredentialOffer.php @@ -0,0 +1,35 @@ +credentialOfferParameters instanceof CredentialOfferParameters) { + return $this->credentialOfferParameters->jsonSerialize(); + } + + if ($this->uri !== null) { + return $this->uri; + } + + throw new CredentialOfferException('Invalid parameters or uri.'); + } +} diff --git a/src/VerifiableCredentials/CredentialOffer/CredentialOfferGrantsBag.php b/src/VerifiableCredentials/CredentialOffer/CredentialOfferGrantsBag.php new file mode 100644 index 0000000..b2e2a7a --- /dev/null +++ b/src/VerifiableCredentials/CredentialOffer/CredentialOfferGrantsBag.php @@ -0,0 +1,34 @@ +credentialOfferGrantsValues = $credentialOfferGrantsValues; + } + + + /** + * @return array + */ + public function jsonSerialize(): array + { + $value = []; + + foreach ($this->credentialOfferGrantsValues as $credentialOfferGrantsValue) { + $value = array_merge($value, $credentialOfferGrantsValue->jsonSerialize()); + } + + return $value; + } +} diff --git a/src/VerifiableCredentials/CredentialOffer/CredentialOfferGrantsValue.php b/src/VerifiableCredentials/CredentialOffer/CredentialOfferGrantsValue.php new file mode 100644 index 0000000..c76e047 --- /dev/null +++ b/src/VerifiableCredentials/CredentialOffer/CredentialOfferGrantsValue.php @@ -0,0 +1,96 @@ +type === GrantTypesEnum::AuthorizationCode->value) { + if ( + isset($this->claims[ClaimsEnum::IssuerState->value]) && + !is_string($this->claims[ClaimsEnum::IssuerState->value]) + ) { + throw new CredentialOfferException('Invalid Issuer State claim.'); + } + + if ( + isset($this->claims[ClaimsEnum::AuthorizationServer->value]) && + !is_string($this->claims[ClaimsEnum::AuthorizationServer->value]) + ) { + throw new CredentialOfferException('Invalid Authorization Server claim.'); + } + } + + if ($this->type === GrantTypesEnum::PreAuthorizedCode->value) { + if ( + !isset($this->claims[ClaimsEnum::PreAuthorizedCode->value]) || + !is_string($this->claims[ClaimsEnum::PreAuthorizedCode->value]) + ) { + throw new CredentialOfferException('Invalid Pre-authorized Code claim.'); + } + + if (isset($this->claims[ClaimsEnum::TxCode->value])) { + if (!is_array($this->claims[ClaimsEnum::TxCode->value])) { + throw new CredentialOfferException('Invalid TxCode claim.'); + } + + if ( + isset($this->claims[ClaimsEnum::TxCode->value][ClaimsEnum::InputMode->value]) && + !in_array( + $this->claims[ClaimsEnum::TxCode->value][ClaimsEnum::InputMode->value], + ['numeric', 'text'], + ) + ) { + throw new CredentialOfferException('Invalid Transaction Code Input Mode claim.'); + } + + if ( + isset($this->claims[ClaimsEnum::TxCode->value][ClaimsEnum::Length->value]) && + !is_int($this->claims[ClaimsEnum::TxCode->value][ClaimsEnum::Length->value]) + ) { + throw new CredentialOfferException('Invalid Transaction Code Length claim.'); + } + + if ( + isset($this->claims[ClaimsEnum::TxCode->value][ClaimsEnum::Description->value]) && + !is_string($this->claims[ClaimsEnum::TxCode->value][ClaimsEnum::Description->value]) + ) { + throw new CredentialOfferException('Invalid Transaction Code Description claim.'); + } + + if ( + isset($this->claims[ClaimsEnum::AuthorizationServer->value]) && + !is_string($this->claims[ClaimsEnum::AuthorizationServer->value]) + ) { + throw new CredentialOfferException('Invalid Authorization Server claim.'); + } + } + } + } + + + /** + * @return array + */ + public function jsonSerialize(): array + { + return [ + $this->type => $this->claims, + ]; + } +} diff --git a/src/VerifiableCredentials/CredentialOffer/CredentialOfferParameters.php b/src/VerifiableCredentials/CredentialOffer/CredentialOfferParameters.php new file mode 100644 index 0000000..6fd385f --- /dev/null +++ b/src/VerifiableCredentials/CredentialOffer/CredentialOfferParameters.php @@ -0,0 +1,39 @@ + + */ + public function jsonSerialize(): array + { + $value = [ + ClaimsEnum::CredentialIssuer->value => $this->credentialIssuer, + ClaimsEnum::CredentialConfigurationIds->value => $this->credentialConfigurationIds, + ]; + + if ($this->credentialOfferGrantsBag instanceof CredentialOfferGrantsBag) { + $value[ClaimsEnum::Grants->value] = $this->credentialOfferGrantsBag->jsonSerialize(); + } + + return $value; + } +} diff --git a/src/VerifiableCredentials/Factories/CredentialOfferFactory.php b/src/VerifiableCredentials/Factories/CredentialOfferFactory.php new file mode 100644 index 0000000..966176e --- /dev/null +++ b/src/VerifiableCredentials/Factories/CredentialOfferFactory.php @@ -0,0 +1,79 @@ +value] ?? null; + $credentialIssuer = $this->helpers->type()->ensureNonEmptyString( + $credentialIssuer, + ClaimsEnum::CredentialIssuer->value, + ); + + $credentialConfigurationIds = $parameters[ClaimsEnum::CredentialConfigurationIds->value] ?? null; + $credentialConfigurationIds = $this->helpers->type()->enforceNonEmptyArrayWithValuesAsNonEmptyStrings( + $this->helpers->type()->ensureArray($credentialConfigurationIds), + ClaimsEnum::CredentialConfigurationIds->value, + ); + + $grants = $parameters[ClaimsEnum::Grants->value] ?? null; + $credentialOfferGrantsBag = null; + + if (is_array($grants)) { + $credentialOfferGrantsValues = []; + + foreach ($grants as $type => $claims) { + if (!is_string($type) || !is_array($claims)) { + throw new CredentialOfferException('Invalid Grants claim.'); + } + + $credentialOfferGrantsValues[] = new CredentialOfferGrantsValue($type, $claims); + } + + $credentialOfferGrantsBag = new CredentialOfferGrantsBag(...$credentialOfferGrantsValues); + } + + return new CredentialOffer( + credentialOfferParameters: new CredentialOfferParameters( + credentialIssuer: $credentialIssuer, + credentialConfigurationIds: $credentialConfigurationIds, + credentialOfferGrantsBag: $credentialOfferGrantsBag, + ), + ); + } + + if ($uri !== null && $parameters === null) { + return new CredentialOffer( + uri: $uri, + ); + } + + throw new CredentialOfferException('Only one of parameters or uri must be provided.'); + } +} diff --git a/src/VerifiableCredentials/Factories/OpenId4VciProofFactory.php b/src/VerifiableCredentials/Factories/OpenId4VciProofFactory.php new file mode 100644 index 0000000..42d6f3d --- /dev/null +++ b/src/VerifiableCredentials/Factories/OpenId4VciProofFactory.php @@ -0,0 +1,58 @@ +jwsDecoratorBuilder->fromToken($token), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + ); + } + + + /** + * @param array $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + ): OpenId4VciProof { + $header[ClaimsEnum::Typ->value] = JwtTypesEnum::OpenId4VciProofJwt->value; + + return new OpenId4VciProof( + $this->jwsDecoratorBuilder->fromData( + $signingKey, + $signatureAlgorithm, + $payload, + $header, + ), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + ); + } +} diff --git a/src/VerifiableCredentials/Factories/TxCodeFactory.php b/src/VerifiableCredentials/Factories/TxCodeFactory.php new file mode 100644 index 0000000..4839f26 --- /dev/null +++ b/src/VerifiableCredentials/Factories/TxCodeFactory.php @@ -0,0 +1,17 @@ +isNone()) { + throw new OpenId4VciProofException('Invalid Algorithm header claim (none).'); + } + + return $alg; + } + + + /** + * @return non-empty-string + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\OpenId4VciProofException + * @throws \SimpleSAML\OpenID\Exceptions\TrustMarkDelegationException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function getType(): string + { + $typ = parent::getType() ?? throw new OpenId4VciProofException('No Type header claim found.'); + + if ($typ !== JwtTypesEnum::OpenId4VciProofJwt->value) { + throw new OpenId4VciProofException('Invalid Type header claim.'); + } + + return $typ; + } + + + /** + * @return ?mixed[] + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function getJsonWebKey(): ?array + { + $claimKey = ClaimsEnum::Jwk->value; + + $jwk = $this->getHeaderClaim($claimKey); + + return is_null($jwk) ? null : $this->helpers->type()->ensureArray($jwk, $claimKey); + } + + + /** + * @return ?non-empty-string[] + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function getX509CertificateChain(): ?array + { + $claimKey = ClaimsEnum::X5c->value; + + $x5c = $this->getHeaderClaim($claimKey); + + return is_null($x5c) ? null : $this->helpers->type()->ensureArrayWithValuesAsNonEmptyStrings($x5c, $claimKey); + } + + + /** + * @return string[] + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\OpenId4VciProofException + */ + public function getAudience(): array + { + return parent::getAudience() ?? throw new OpenId4VciProofException('No Audience claim found.'); + } + + + public function getIssuedAt(): int + { + return parent::getIssuedAt() ?? throw new OpenId4VciProofException('No IssuedAt claim found.'); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function getNonce(): ?string + { + $claimKey = ClaimsEnum::Nonce->value; + + $nonce = $this->getHeaderClaim($claimKey); + + return is_null($nonce) ? null : $this->helpers->type()->ensureNonEmptyString($nonce, $claimKey); + } + + // TODO + // key_attestation: OPTIONAL + // trust_chain: OPTIONAL + + /** + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\TrustMarkDelegationException + */ + protected function validate(): void + { + $this->validateByCallbacks( + $this->getAlgorithm(...), + $this->getType(...), + $this->getKeyId(...), + $this->getJsonWebKey(...), + $this->getX509CertificateChain(...), + $this->getIssuer(...), + $this->getAudience(...), + $this->getIssuedAt(...), + $this->getExpirationTime(...), + $this->getNonce(...), + ); + } +} diff --git a/src/VerifiableCredentials/SdJwtVc/Factories/SdJwtVcFactory.php b/src/VerifiableCredentials/SdJwtVc/Factories/SdJwtVcFactory.php new file mode 100644 index 0000000..4c57bf7 --- /dev/null +++ b/src/VerifiableCredentials/SdJwtVc/Factories/SdJwtVcFactory.php @@ -0,0 +1,60 @@ + $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\OpenIdException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + ?DisclosureBag $disclosureBag = null, + ?KbJwt $kbJwt = null, + JwtTypesEnum $jwtTypesEnum = JwtTypesEnum::DcSdJwt, + HashAlgorithmsEnum $hashAlgorithmsEnum = HashAlgorithmsEnum::SHA_256, + ): SdJwtVc { + $header[ClaimsEnum::Typ->value] = $jwtTypesEnum->value; + + if ($disclosureBag instanceof DisclosureBag) { + $payload = $this->updatePayloadWithDisclosures($payload, $disclosureBag, $hashAlgorithmsEnum); + } + + /** @var array $payload */ + + return new SdJwtVc( + $this->jwsDecoratorBuilder->fromData( + $signingKey, + $signatureAlgorithm, + $payload, + $header, + ), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + $disclosureBag, + $kbJwt, + ); + } +} diff --git a/src/VerifiableCredentials/SdJwtVc/SdJwtVc.php b/src/VerifiableCredentials/SdJwtVc/SdJwtVc.php new file mode 100644 index 0000000..0e66b42 --- /dev/null +++ b/src/VerifiableCredentials/SdJwtVc/SdJwtVc.php @@ -0,0 +1,121 @@ +value, + ClaimsEnum::Nbf->value, + ClaimsEnum::Exp->value, + ClaimsEnum::Cnf->value, + ClaimsEnum::Vct->value, + ClaimsEnum::Status->value, + ]; + + + public function getType(): string + { + $typ = parent::getType() ?? throw new SdJwtVcException('No Type header claim found.'); + + if (!in_array($typ, [JwtTypesEnum::DcSdJwt->value, JwtTypesEnum::VcSdJwt->value], true)) { + throw new SdJwtVcException('Invalid Type header claim.'); + } + + return $typ; + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\SdJwtVcException + */ + public function getVerifiableCredentialType(): string + { + $claimKey = ClaimsEnum::Vct->value; + + ($vct = $this->getPayloadClaim($claimKey)) ?? throw new SdJwtVcException( + 'No Verifiable Credential Type claim found.', + ); + + return $this->helpers->type()->ensureNonEmptyString($vct, $claimKey); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\SdJwtVcException + */ + protected function ensureNonSelectivelyDisclosableClaims(): void + { + if (! $this->disclosureBag instanceof DisclosureBag) { + return; + } + + $disclosureNames = array_filter(array_map( + fn (Disclosure $disclosure): ?string => $disclosure->getName(), + $this->disclosureBag->all(), + )); + + $nonDisclosableClaims = array_intersect($disclosureNames, self::NON_SELECTIVELY_DISCLOSABLE_CLAIMS); + + if ($nonDisclosableClaims !== []) { + throw new SdJwtVcException( + sprintf( + 'The following claims are not selectively disclosable: %s', + implode(', ', $nonDisclosableClaims), + ), + ); + } + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\SdJwtVcException + */ + protected function ensureNoSdClaimWhenNoDisclosures(): void + { + if ( + $this->disclosureBag instanceof DisclosureBag && + ($this->disclosureBag->all() !== []) + ) { + return; + } + + if ( + $this->helpers->arr()->containsKey( + $this->getPayload(), + ClaimsEnum::_Sd->value, + ) + ) { + throw new SdJwtVcException( + 'The _Sd claim is not allowed when no disclosures are specified.', + ); + } + } + + + protected function validate(): void + { + $this->validateByCallbacks( + $this->getType(...), + $this->getVerifiableCredentialType(...), + $this->ensureNonSelectivelyDisclosableClaims(...), + $this->ensureNoSdClaimWhenNoDisclosures(...), + ); + } +} diff --git a/src/VerifiableCredentials/TxCode.php b/src/VerifiableCredentials/TxCode.php new file mode 100644 index 0000000..491a74c --- /dev/null +++ b/src/VerifiableCredentials/TxCode.php @@ -0,0 +1,71 @@ +code) && $this->code < 0) { + throw new \InvalidArgumentException('TxCode must be a positive integer or a string.'); + } + + $this->inputMode = is_numeric($this->code) ? TxCodeInputModeEnum::Numeric : TxCodeInputModeEnum::Text; + $this->length = mb_strlen((string)$this->code); + } + + + public function getCode(): int|string + { + return $this->code; + } + + + public function getCodeAsString(): string + { + return (string)$this->code; + } + + + public function getDescription(): string + { + return $this->description; + } + + + public function getInputMode(): TxCodeInputModeEnum + { + return $this->inputMode; + } + + + public function getLength(): int + { + return $this->length; + } + + + /** + * @return array + */ + public function jsonSerialize(): array + { + return [ + ClaimsEnum::InputMode->value => $this->inputMode->value, + ClaimsEnum::Length->value => $this->length, + ClaimsEnum::Description->value => $this->description, + ]; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/AbstractIdentifiedTypedClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/AbstractIdentifiedTypedClaimValue.php new file mode 100644 index 0000000..37e74ad --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/AbstractIdentifiedTypedClaimValue.php @@ -0,0 +1,73 @@ + */ + protected readonly array $data; + + + /** + * @param non-empty-string $id, + * @param mixed[] $otherClaims + */ + public function __construct( + protected readonly string $id, + protected readonly TypeClaimValue $typeClaimValue, + array $otherClaims = [], + ) { + $this->data = array_merge( + $otherClaims, + [ClaimsEnum::Id->value => $this->id], + [ClaimsEnum::Type->value => $this->typeClaimValue->jsonSerialize()], + ); + } + + + /** + * @return non-empty-string + */ + public function getId(): string + { + return $this->id; + } + + + public function getType(): TypeClaimValue + { + return $this->typeClaimValue; + } + + + public function getKey(int|string $key): mixed + { + return $this->data[$key] ?? null; + } + + + abstract public function getName(): string; + + + /** + * @return non-empty-array + */ + public function getValue(): array + { + return $this->data; + } + + + /** + * @return non-empty-array + */ + public function jsonSerialize(): array + { + return $this->getValue(); + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/AbstractTypedClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/AbstractTypedClaimValue.php new file mode 100644 index 0000000..3289ab1 --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/AbstractTypedClaimValue.php @@ -0,0 +1,61 @@ + */ + protected readonly array $data; + + + /** + * @param mixed[] $otherClaims + */ + public function __construct( + protected readonly TypeClaimValue $typeClaimValue, + array $otherClaims = [], + ) { + $this->data = array_merge( + $otherClaims, + [ClaimsEnum::Type->value => $this->typeClaimValue->jsonSerialize()], + ); + } + + + public function getType(): TypeClaimValue + { + return $this->typeClaimValue; + } + + + public function getKey(int|string $key): mixed + { + return $this->data[$key] ?? null; + } + + + abstract public function getName(): string; + + + /** + * @return non-empty-array + */ + public function getValue(): array + { + return $this->data; + } + + + /** + * @return non-empty-array + */ + public function jsonSerialize(): array + { + return $this->getValue(); + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/TypeClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/TypeClaimValue.php new file mode 100644 index 0000000..0e1df1d --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/TypeClaimValue.php @@ -0,0 +1,58 @@ +value; + } + + + /** + * @return non-empty-string[] + */ + public function getValue(): array + { + return $this->types; + } + + + /** + * @return non-empty-string|non-empty-string[] + */ + public function jsonSerialize(): string|array + { + $value = $this->getValue(); + + if (count($value) === 1) { + return $value[0]; + } + + return $value; + } + + + /** + * @param non-empty-string $type + */ + public function has(string $type): bool + { + return in_array($type, $this->types); + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcAtContextClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/VcAtContextClaimValue.php new file mode 100644 index 0000000..195d08a --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcAtContextClaimValue.php @@ -0,0 +1,72 @@ +baseContext !== AtContextsEnum::W3Org2018CredentialsV1->value) { + throw new VcDataModelException(sprintf( + 'Invalid VC @context claim. Base context should be %s, %s given.', + AtContextsEnum::W3Org2018CredentialsV1->value, + $this->baseContext, + )); + } + } + + + /** + * @return mixed[] + */ + public function jsonSerialize(): array + { + return $this->getValue(); + } + + + public function getBaseContext(): string + { + return $this->baseContext; + } + + + /** + * @return mixed[] + */ + public function getOtherContexts(): array + { + return $this->otherContexts; + } + + + public function getName(): string + { + return ClaimsEnum::AtContext->value; + } + + + /** + * @return mixed[] + */ + public function getValue(): array + { + return[ + $this->baseContext, + ...$this->otherContexts, + ]; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/VcClaimValue.php new file mode 100644 index 0000000..e8d8578 --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcClaimValue.php @@ -0,0 +1,152 @@ +getValue(); + } + + + public function getAtContext(): VcAtContextClaimValue + { + return $this->atContextClaimValue; + } + + + /** + * @return non-empty-string|null + */ + public function getId(): ?string + { + return $this->id; + } + + + public function getType(): TypeClaimValue + { + return $this->typeClaimValue; + } + + + public function getCredentialSubject(): VcCredentialSubjectClaimBag + { + return $this->credentialSubjectClaimBag; + } + + + public function getIssuer(): VcIssuerClaimValue + { + return $this->issuerClaimValue; + } + + + public function getIssuanceDate(): DateTimeImmutable + { + return $this->issuanceDate; + } + + + public function getProof(): ?VcProofClaimValue + { + return $this->proofClaimValue; + } + + + public function getExpirationDate(): ?DateTimeImmutable + { + return $this->expirationDate; + } + + + public function getCredentialStatus(): ?VcCredentialStatusClaimValue + { + return $this->credentialStatusClaimValue; + } + + + public function getCredentialSchema(): ?VcCredentialSchemaClaimBag + { + return $this->credentialSchemaClaimBag; + } + + + public function getRefreshService(): ?VcRefreshServiceClaimBag + { + return $this->refreshServiceClaimBag; + } + + + public function getTermsOfUse(): ?VcTermsOfUseClaimBag + { + return $this->termsOfUseClaimBag; + } + + + public function getEvidence(): ?VcEvidenceClaimBag + { + return $this->evidenceClaimBag; + } + + + public function getName(): string + { + return ClaimsEnum::Vc->value; + } + + + /** + * @return mixed[] + */ + public function getValue(): array + { + return array_filter([ + ClaimsEnum::AtContext->value => $this->getAtContext()->jsonSerialize(), + ClaimsEnum::Id->value => $this->getId(), + ClaimsEnum::Type->value => $this->getType()->jsonSerialize(), + ClaimsEnum::Issuer->value => $this->getIssuer()->jsonSerialize(), + ClaimsEnum::Issuance_Date->value => $this->getIssuanceDate()->format(\DateTimeInterface::RFC3339), + ClaimsEnum::Credential_Subject->value => $this->getCredentialSubject()->jsonSerialize(), + ClaimsEnum::Proof->value => $this->getProof()?->jsonSerialize(), + ClaimsEnum::Expiration_Date->value => $this->getExpirationDate()?->format(\DateTimeInterface::RFC3339), + ClaimsEnum::Credential_Status->value => $this->getCredentialStatus()?->jsonSerialize(), + ClaimsEnum::Credential_Schema->value => $this->getCredentialSchema()?->jsonSerialize(), + ClaimsEnum::Refresh_Service->value => $this->getRefreshService()?->jsonSerialize(), + ClaimsEnum::Terms_Of_Use->value => $this->getTermsOfUse()?->jsonSerialize(), + ClaimsEnum::Evidence->value => $this->getEvidence()?->jsonSerialize(), + ]); + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSchemaClaimBag.php b/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSchemaClaimBag.php new file mode 100644 index 0000000..cd60966 --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSchemaClaimBag.php @@ -0,0 +1,54 @@ +vcCredentialSchemaClaimValueValues = [ + $vcCredentialSchemaClaimValue, + ...$vcCredentialSchemaClaimValueValues, + ]; + } + + + /** + * @return mixed[] + */ + public function jsonSerialize(): array + { + return array_map( + fn( + VcCredentialSchemaClaimValue $vcCredentialSchemaClaimValue, + ): array => $vcCredentialSchemaClaimValue->jsonSerialize(), + $this->getValue(), + ); + } + + + public function getName(): string + { + return ClaimsEnum::Credential_Schema->value; + } + + + /** + * @return \SimpleSAML\OpenID\VerifiableCredentials\VcDataModel\Claims\VcCredentialSchemaClaimValue[] + */ + public function getValue(): array + { + return $this->vcCredentialSchemaClaimValueValues; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSchemaClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSchemaClaimValue.php new file mode 100644 index 0000000..027d946 --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSchemaClaimValue.php @@ -0,0 +1,15 @@ +value; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialStatusClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialStatusClaimValue.php new file mode 100644 index 0000000..1690386 --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialStatusClaimValue.php @@ -0,0 +1,15 @@ +value; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSubjectClaimBag.php b/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSubjectClaimBag.php new file mode 100644 index 0000000..e9714af --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSubjectClaimBag.php @@ -0,0 +1,54 @@ +vcCredentialSubjectClaimValueValues = [ + $vcCredentialSubjectClaimValue, + ...$vcCredentialSubjectClaimValueValues, + ]; + } + + + /** + * @return mixed[] + */ + public function jsonSerialize(): array + { + return array_map( + fn( + VcCredentialSubjectClaimValue $vcCredentialSubjectClaimValue, + ): array => $vcCredentialSubjectClaimValue->jsonSerialize(), + $this->getValue(), + ); + } + + + public function getName(): string + { + return ClaimsEnum::Credential_Subject->value; + } + + + /** + * @return \SimpleSAML\OpenID\VerifiableCredentials\VcDataModel\Claims\VcCredentialSubjectClaimValue[] + */ + public function getValue(): array + { + return $this->vcCredentialSubjectClaimValueValues; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSubjectClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSubjectClaimValue.php new file mode 100644 index 0000000..ae93e33 --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSubjectClaimValue.php @@ -0,0 +1,48 @@ + $data + */ + public function __construct(protected readonly array $data) + { + } + + + public function get(int|string $key): mixed + { + return $this->data[$key] ?? null; + } + + + /** + * @return non-empty-array + */ + public function jsonSerialize(): array + { + return $this->getValue(); + } + + + public function getName(): string + { + return ClaimsEnum::Credential_Subject->value; + } + + + /** + * @return non-empty-array + */ + public function getValue(): array + { + return $this->data; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcEvidenceClaimBag.php b/src/VerifiableCredentials/VcDataModel/Claims/VcEvidenceClaimBag.php new file mode 100644 index 0000000..6da2648 --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcEvidenceClaimBag.php @@ -0,0 +1,54 @@ +vcEvidenceClaimValueValues = [ + $vcEvidenceClaimValue, + ...$vcEvidenceClaimValueValues, + ]; + } + + + /** + * @return mixed[] + */ + public function jsonSerialize(): array + { + return array_map( + fn( + VcEvidenceClaimValue $vcEvidenceClaimValue, + ): array => $vcEvidenceClaimValue->jsonSerialize(), + $this->getValue(), + ); + } + + + public function getName(): string + { + return ClaimsEnum::Evidence->value; + } + + + /** + * @return \SimpleSAML\OpenID\VerifiableCredentials\VcDataModel\Claims\VcEvidenceClaimValue[] + */ + public function getValue(): array + { + return $this->vcEvidenceClaimValueValues; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcEvidenceClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/VcEvidenceClaimValue.php new file mode 100644 index 0000000..d55fca2 --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcEvidenceClaimValue.php @@ -0,0 +1,15 @@ +value; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcIssuerClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/VcIssuerClaimValue.php new file mode 100644 index 0000000..d349eba --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcIssuerClaimValue.php @@ -0,0 +1,68 @@ + */ + protected array $data; + + + /** + * @param non-empty-string $id + * @param mixed[] $otherClaims + */ + public function __construct( + protected string $id, + array $otherClaims = [], + ) { + $this->data = array_merge( + $otherClaims, + [ClaimsEnum::Id->value => $this->id], + ); + } + + + /** + * @return non-empty-string + */ + public function getId(): string + { + return $this->id; + } + + + public function getKey(int|string $key): mixed + { + return $this->data[$key] ?? null; + } + + + public function getName(): string + { + return ClaimsEnum::Issuer->value; + } + + + /** + * @return non-empty-array + */ + public function getValue(): array + { + return $this->data; + } + + + /** + * @return non-empty-array + */ + public function jsonSerialize(): array + { + return $this->getValue(); + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcProofClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/VcProofClaimValue.php new file mode 100644 index 0000000..ede1e1e --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcProofClaimValue.php @@ -0,0 +1,15 @@ +value; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcRefreshServiceClaimBag.php b/src/VerifiableCredentials/VcDataModel/Claims/VcRefreshServiceClaimBag.php new file mode 100644 index 0000000..cf4924d --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcRefreshServiceClaimBag.php @@ -0,0 +1,54 @@ +vcRefreshServiceClaimValueValues = [ + $vcRefreshServiceClaimValue, + ...$vcRefreshServiceClaimValueValues, + ]; + } + + + /** + * @return mixed[] + */ + public function jsonSerialize(): array + { + return array_map( + fn( + VcRefreshServiceClaimValue $vcRefreshServiceClaimValue, + ): array => $vcRefreshServiceClaimValue->jsonSerialize(), + $this->getValue(), + ); + } + + + public function getName(): string + { + return ClaimsEnum::Refresh_Service->value; + } + + + /** + * @return \SimpleSAML\OpenID\VerifiableCredentials\VcDataModel\Claims\VcRefreshServiceClaimValue[] + */ + public function getValue(): array + { + return $this->vcRefreshServiceClaimValueValues; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcRefreshServiceClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/VcRefreshServiceClaimValue.php new file mode 100644 index 0000000..3973d89 --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcRefreshServiceClaimValue.php @@ -0,0 +1,15 @@ +value; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcTermsOfUseClaimBag.php b/src/VerifiableCredentials/VcDataModel/Claims/VcTermsOfUseClaimBag.php new file mode 100644 index 0000000..81c0ad8 --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcTermsOfUseClaimBag.php @@ -0,0 +1,54 @@ +vcTermsOfUseClaimValueValues = [ + $vcTermsOfUseClaimValue, + ...$vcTermsOfUseClaimValueValues, + ]; + } + + + /** + * @return mixed[] + */ + public function jsonSerialize(): array + { + return array_map( + fn( + VcTermsOfUseClaimValue $vcTermsOfUseClaimValue, + ): array => $vcTermsOfUseClaimValue->jsonSerialize(), + $this->getValue(), + ); + } + + + public function getName(): string + { + return ClaimsEnum::Terms_Of_Use->value; + } + + + /** + * @return \SimpleSAML\OpenID\VerifiableCredentials\VcDataModel\Claims\VcTermsOfUseClaimValue[] + */ + public function getValue(): array + { + return $this->vcTermsOfUseClaimValueValues; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Claims/VcTermsOfUseClaimValue.php b/src/VerifiableCredentials/VcDataModel/Claims/VcTermsOfUseClaimValue.php new file mode 100644 index 0000000..16310ce --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Claims/VcTermsOfUseClaimValue.php @@ -0,0 +1,15 @@ +value; + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Factories/JwtVcJsonFactory.php b/src/VerifiableCredentials/VcDataModel/Factories/JwtVcJsonFactory.php new file mode 100644 index 0000000..36f27c9 --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Factories/JwtVcJsonFactory.php @@ -0,0 +1,58 @@ +jwsDecoratorBuilder->fromToken($token), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + ); + } + + + /** + * @param array $payload + * @param array $header + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function fromData( + JwkDecorator $signingKey, + SignatureAlgorithmEnum $signatureAlgorithm, + array $payload, + array $header, + ): JwtVcJson { + $header[ClaimsEnum::Typ->value] = JwtTypesEnum::Jwt->value; + + return new JwtVcJson( + $this->jwsDecoratorBuilder->fromData( + $signingKey, + $signatureAlgorithm, + $payload, + $header, + ), + $this->jwsVerifierDecorator, + $this->jwksDecoratorFactory, + $this->jwsSerializerManagerDecorator, + $this->timestampValidationLeeway, + $this->helpers, + $this->claimFactory, + ); + } +} diff --git a/src/VerifiableCredentials/VcDataModel/Factories/VcDataModelClaimFactory.php b/src/VerifiableCredentials/VcDataModel/Factories/VcDataModelClaimFactory.php new file mode 100644 index 0000000..372635e --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/Factories/VcDataModelClaimFactory.php @@ -0,0 +1,403 @@ +helpers->type()->enforceNonEmptyArrayWithValuesAsNonEmptyStrings( + $data, + ), + ); + } + + + /** + * @param non-empty-array $data + */ + public function buildVcCredentialSubjectClaimValue(array $data, ?string $id = null): VcCredentialSubjectClaimValue + { + return new VcCredentialSubjectClaimValue($data); + } + + + /** + * @param mixed[] $data + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + */ + public function buildVcCredentialSubjectClaimBag( + array $data, + ?string $subClaimValue = null, + ): VcCredentialSubjectClaimBag { + if ($this->helpers->arr()->isAssociative($data)) { + $data = [$data]; + } + + $data = $this->helpers->type()->enforceNonEmptyArrayOfNonEmptyArrays($data); + + if (is_string($subClaimValue) && (count($data) !== 1)) { + throw new VcDataModelException( + 'Refusing to set credentialSubject ID claim value for multiple subjects.', + ); + } + + $vcCredentialSubjectClaimValueData = array_shift($data); + + // If we have the 'sub' claim in JWT, we must use it as the credentialSubject ID value. However, we can't do + // that if we have more than one credentialSubject. + if (is_string($subClaimValue) && $data === []) { + $vcCredentialSubjectClaimValueData[ClaimsEnum::Id->value] = $subClaimValue; + } + + $vcCredentialSubjectClaimValue = $this->buildVcCredentialSubjectClaimValue($vcCredentialSubjectClaimValueData); + + $vcCredentialSubjectClaimValues = array_map( + fn (array $data): VcCredentialSubjectClaimValue => $this->buildVcCredentialSubjectClaimValue($data), + $data, + ); + + return new VcCredentialSubjectClaimBag( + $vcCredentialSubjectClaimValue, + ...$vcCredentialSubjectClaimValues, + ); + } + + + /** + * @param mixed[] $data + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function buildVcIssuerClaimValue(array $data): VcIssuerClaimValue + { + $id = $data[ClaimsEnum::Id->value] ?? throw new VcDataModelException( + 'No ID claim value available.', + ); + + $id = $this->helpers->type()->enforceUri($id); + + return new VcIssuerClaimValue($id, $data); + } + + + /** + * @param mixed[] $data + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function buildVcProofClaimValue(array $data): VcProofClaimValue + { + $type = $data[ClaimsEnum::Type->value] ?? throw new VcDataModelException( + 'No Type claim value available.', + ); + + $typeClaimValue = $this->buildTypeClaimValue($type); + + return new VcProofClaimValue($typeClaimValue, $data); + } + + + /** + * @param mixed[] $data + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + */ + public function buildVcCredentialStatusClaimValue(array $data): VcCredentialStatusClaimValue + { + $id = $data[ClaimsEnum::Id->value] ?? throw new VcDataModelException( + 'No ID claim value available.', + ); + $id = $this->helpers->type()->enforceUri($id); + + $type = $data[ClaimsEnum::Type->value] ?? throw new VcDataModelException( + 'No Type claim value available.', + ); + $typeClaimValue = $this->buildTypeClaimValue($type); + + return new VcCredentialStatusClaimValue($id, $typeClaimValue, $data); + } + + + /** + * @param non-empty-array $data + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + */ + public function buildVcCredentialSchemaClaimValue(array $data): VcCredentialSchemaClaimValue + { + $id = $data[ClaimsEnum::Id->value] ?? throw new VcDataModelException( + 'No ID claim value available.', + ); + $id = $this->helpers->type()->enforceUri($id); + + $type = $data[ClaimsEnum::Type->value] ?? throw new VcDataModelException( + 'No Type claim value available.', + ); + $typeClaimValue = $this->buildTypeClaimValue($type); + + return new VcCredentialSchemaClaimValue($id, $typeClaimValue, $data); + } + + + /** + * @param mixed[] $data + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + */ + public function buildVcCredentialSchemaClaimBag(array $data): VcCredentialSchemaClaimBag + { + if ($this->helpers->arr()->isAssociative($data)) { + $data = [$data]; + } + + $data = $this->helpers->type()->enforceNonEmptyArrayOfNonEmptyArrays($data); + + $vcCredentialSchemaClaimValueData = array_shift($data); + + $vcCredentialSchemaClaimValue = $this->buildVcCredentialSchemaClaimValue($vcCredentialSchemaClaimValueData); + + $vcCredentialSchemaClaimValues = array_map( + $this->buildVcCredentialSchemaClaimValue(...), + $data, + ); + + return new VcCredentialSchemaClaimBag( + $vcCredentialSchemaClaimValue, + ...$vcCredentialSchemaClaimValues, + ); + } + + + /** + * @param non-empty-array $data + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + */ + public function buildVcRefreshServiceClaimValue(array $data): VcRefreshServiceClaimValue + { + $id = $data[ClaimsEnum::Id->value] ?? throw new VcDataModelException( + 'No ID claim value available.', + ); + $id = $this->helpers->type()->enforceUri($id); + + $type = $data[ClaimsEnum::Type->value] ?? throw new VcDataModelException( + 'No Type claim value available.', + ); + $typeClaimValue = $this->buildTypeClaimValue($type); + + return new VcRefreshServiceClaimValue($id, $typeClaimValue, $data); + } + + + /** + * @param mixed[] $data + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + */ + public function buildVcRefreshServiceClaimBag(array $data): VcRefreshServiceClaimBag + { + if ($this->helpers->arr()->isAssociative($data)) { + $data = [$data]; + } + + $data = $this->helpers->type()->enforceNonEmptyArrayOfNonEmptyArrays($data); + + $vcRefreshServiceClaimValueData = array_shift($data); + + $vcRefreshServiceClaimValue = $this->buildVcRefreshServiceClaimValue($vcRefreshServiceClaimValueData); + + $vcRefreshServiceClaimValues = array_map( + $this->buildVcRefreshServiceClaimValue(...), + $data, + ); + + return new VcRefreshServiceClaimBag( + $vcRefreshServiceClaimValue, + ...$vcRefreshServiceClaimValues, + ); + } + + + /** + * @param mixed[] $data + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function buildVcTermsOfUseClaimValue(array $data): VcTermsOfUseClaimValue + { + $type = $data[ClaimsEnum::Type->value] ?? throw new VcDataModelException( + 'No Type claim value available.', + ); + + $typeClaimValue = $this->buildTypeClaimValue($type); + + return new VcTermsOfUseClaimValue($typeClaimValue, $data); + } + + + /** + * @param mixed[] $data + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + */ + public function buildVcTermsOfUseClaimBag(array $data): VcTermsOfUseClaimBag + { + if ($this->helpers->arr()->isAssociative($data)) { + $data = [$data]; + } + + $data = $this->helpers->type()->enforceNonEmptyArrayOfNonEmptyArrays($data); + + $vcTermsOfUseClaimValueData = array_shift($data); + + $vcTermsOfUseClaimValue = $this->buildVcTermsOfUseClaimValue($vcTermsOfUseClaimValueData); + + $vcTermsOfUseClaimValues = array_map( + $this->buildVcTermsOfUseClaimValue(...), + $data, + ); + + return new VcTermsOfUseClaimBag( + $vcTermsOfUseClaimValue, + ...$vcTermsOfUseClaimValues, + ); + } + + + /** + * @param mixed[] $data + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function buildVcEvidenceClaimValue(array $data): VcEvidenceClaimValue + { + $type = $data[ClaimsEnum::Type->value] ?? throw new VcDataModelException( + 'No Type claim value available.', + ); + + $typeClaimValue = $this->buildTypeClaimValue($type); + + return new VcEvidenceClaimValue($typeClaimValue, $data); + } + + + /** + * @param mixed[] $data + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + */ + public function buildVcEvidenceClaimBag(array $data): VcEvidenceClaimBag + { + if ($this->helpers->arr()->isAssociative($data)) { + $data = [$data]; + } + + $data = $this->helpers->type()->enforceNonEmptyArrayOfNonEmptyArrays($data); + + $vcEvidenceClaimValueData = array_shift($data); + + $vcEvidenceClaimValue = $this->buildVcEvidenceClaimValue($vcEvidenceClaimValueData); + + $vcEvidenceClaimValues = array_map( + $this->buildVcEvidenceClaimValue(...), + $data, + ); + + return new VcEvidenceClaimBag( + $vcEvidenceClaimValue, + ...$vcEvidenceClaimValues, + ); + } +} diff --git a/src/VerifiableCredentials/VcDataModel/JwtVcJson.php b/src/VerifiableCredentials/VcDataModel/JwtVcJson.php new file mode 100644 index 0000000..95ec799 --- /dev/null +++ b/src/VerifiableCredentials/VcDataModel/JwtVcJson.php @@ -0,0 +1,547 @@ +vcClaimValue instanceof VcClaimValue) { + return $this->vcClaimValue; + } + + $claimKey = ClaimsEnum::Vc->value; + + $vc = $this->getPayloadClaim($claimKey) ?? throw new VcDataModelException('No VC claim found.'); + + if (!is_array($vc)) { + throw new VcDataModelException('Invalid VC claim.'); + } + + return $this->vcClaimValue = $this->claimFactory->forVcDataModel()->buildVcClaimValue( + $this->getVcAtContext(), + $this->getVcId(), + $this->getVcType(), + $this->getVcCredentialSubject(), + $this->getVcIssuer(), + $this->getVcIssuanceDate(), + $this->getVcProof(), + $this->getVcExpirationDate(), + $this->getVcCredentialStatus(), + $this->getVcCredentialSchema(), + $this->getVcRefreshService(), + $this->getVcTermsOfUse(), + $this->getVcEvidence(), + ); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + */ + public function getVcAtContext(): VcAtContextClaimValue + { + if ($this->vcAtContextClaimValue instanceof VcAtContextClaimValue) { + return $this->vcAtContextClaimValue; + } + + $vcContext = $this->getNestedPayloadClaim(ClaimsEnum::Vc->value, ClaimsEnum::AtContext->value); + + if (!is_array($vcContext)) { + throw new VcDataModelException('Invalid VC @context claim.'); + } + + if (!is_string($baseContext = array_shift($vcContext))) { + throw new VcDataModelException('Invalid VC @context claim.'); + } + + return $this->vcAtContextClaimValue = $this->claimFactory->forVcDataModel()->buildVcAtContextClaimValue( + $baseContext, + $vcContext, + ); + } + + + /** + * @return ?non-empty-string + * @throws \SimpleSAML\OpenID\Exceptions\ClientAssertionException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function getVcId(): ?string + { + if ($this->vcId === false) { + return null; + } + + $jti = $this->getJwtId(); + + if (is_string($jti)) { + return $this->vcId = $this->helpers->type()->enforceUri($jti); + } + + $vcId = $this->getNestedPayloadClaim(ClaimsEnum::Vc->value, ClaimsEnum::Id->value); + + if (is_null($vcId)) { + $this->vcId = false; + return null; + } + + return $this->vcId = $this->helpers->type()->enforceUri($vcId); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function getVcType(): TypeClaimValue + { + if ($this->vcTypeClaimValue instanceof TypeClaimValue) { + return $this->vcTypeClaimValue; + } + + $claimKeys = [ClaimsEnum::Vc->value, ClaimsEnum::Type->value]; + $claimKeys2 = [ClaimsEnum::Vc->value, ClaimsEnum::AtType->value]; + + $vcType = $this->getNestedPayloadClaim(...$claimKeys) ?? $this->getNestedPayloadClaim(...$claimKeys2); + + if (is_null($vcType)) { + throw new VcDataModelException('Invalid VC Type claim.'); + } + + return $this->vcTypeClaimValue = $this->claimFactory->forVcDataModel()->buildTypeClaimValue($vcType); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function getVcCredentialSubject(): VcCredentialSubjectClaimBag + { + if ($this->vcCredentialSubjectClaimBag instanceof VcCredentialSubjectClaimBag) { + return $this->vcCredentialSubjectClaimBag; + } + + $claimKeys = [ClaimsEnum::Vc->value, ClaimsEnum::Credential_Subject->value]; + + $vcCredentialSubject = $this->getNestedPayloadClaim(...$claimKeys); + + if ((!is_array($vcCredentialSubject)) || $vcCredentialSubject === []) { + throw new VcDataModelException('Invalid VC Credential Subject claim.'); + } + + return $this->vcCredentialSubjectClaimBag = $this->claimFactory->forVcDataModel() + ->buildVcCredentialSubjectClaimBag( + $vcCredentialSubject, + $this->getSubject(), + ); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + public function getVcIssuer(): VcIssuerClaimValue + { + if ($this->vcIssuerClaimValue instanceof VcIssuerClaimValue) { + return $this->vcIssuerClaimValue; + } + + $iss = $this->getIssuer(); + + if (is_string($iss)) { + return $this->vcIssuerClaimValue = $this->claimFactory->forVcDataModel()->buildVcIssuerClaimValue( + [ClaimsEnum::Id->value => $iss], + ); + } + + $vcIssuer = $this->getNestedPayloadClaim(ClaimsEnum::Vc->value, ClaimsEnum::Issuer->value); + + if (is_null($vcIssuer)) { + throw new VcDataModelException('Invalid VC Issuer claim.'); + } + + if (is_string($vcIssuer)) { + return $this->vcIssuerClaimValue = $this->claimFactory->forVcDataModel()->buildVcIssuerClaimValue( + [ClaimsEnum::Id->value => $vcIssuer], + ); + } + + if (is_array($vcIssuer)) { + return $this->vcIssuerClaimValue = $this->claimFactory->forVcDataModel()->buildVcIssuerClaimValue( + $vcIssuer, + ); + } + + throw new VcDataModelException('Invalid VC Issuer claim.'); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + */ + public function getVcIssuanceDate(): DateTimeImmutable + { + if ($this->vcIssuanceDate instanceof DateTimeImmutable) { + return $this->vcIssuanceDate; + } + + $nbf = $this->getNotBefore(); + + if (is_int($nbf)) { + try { + return $this->vcIssuanceDate = $this->helpers->dateTime()->fromTimestamp($nbf); + } catch (Exception $e) { + throw new VcDataModelException('Error parsing Not Before claim: ' . $e->getMessage()); + } + } + + $issuanceDate = $this->getNestedPayloadClaim(ClaimsEnum::Vc->value, ClaimsEnum::Issuance_Date->value); + + if (!is_string($issuanceDate)) { + throw new VcDataModelException('Invalid VC Issuance Date claim.'); + } + + try { + return $this->vcIssuanceDate = $this->helpers->dateTime()->fromXsDateTime($issuanceDate); + } catch (Exception $exception) { + throw new VcDataModelException('Error parsing VC Issuance Date claim: ' . $exception->getMessage()); + } + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + */ + public function getVcProof(): ?VcProofClaimValue + { + if ($this->vcProofClaimValue === false) { + return null; + } + + if ($this->vcProofClaimValue instanceof VcProofClaimValue) { + return $this->vcProofClaimValue; + } + + $vcProof = $this->getNestedPayloadClaim(ClaimsEnum::Vc->value, ClaimsEnum::Proof->value); + + if (is_null($vcProof)) { + $this->vcProofClaimValue = false; + return null; + } + + if (is_array($vcProof)) { + return $this->vcProofClaimValue = $this->claimFactory->forVcDataModel()->buildVcProofClaimValue( + $vcProof, + ); + } + + throw new VcDataModelException('Invalid VC Proof claim.'); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + */ + public function getVcExpirationDate(): ?DateTimeImmutable + { + if ($this->vcExpirationDate === false) { + return null; + } + + if ($this->vcExpirationDate instanceof DateTimeImmutable) { + return $this->vcExpirationDate; + } + + // Try to get it from the exp claim. + $exp = $this->getExpirationTime(); + + if (is_int($exp)) { + try { + return $this->vcExpirationDate = $this->helpers->dateTime()->fromTimestamp($exp); + } catch (Exception $e) { + throw new VcDataModelException('Error parsing Expiration Time date claim: ' . $e->getMessage()); + } + } + + // Try to get it from the vc claim. + $expirationDate = $this->getNestedPayloadClaim(ClaimsEnum::Vc->value, ClaimsEnum::Expiration_Date->value); + + if (is_null($expirationDate)) { + $this->vcExpirationDate = false; + return null; + } + + if (is_string($expirationDate)) { + try { + return $this->vcExpirationDate = $this->helpers->dateTime()->fromXsDateTime($expirationDate); + } catch (Exception $exception) { + throw new VcDataModelException('Error parsing VC Expiration Date claim: ' . $exception->getMessage()); + } + } + + throw new VcDataModelException('Invalid VC Expiration Date claim.'); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function getVcCredentialStatus(): ?VcCredentialStatusClaimValue + { + if ($this->vcCredentialStatusClaimValue === false) { + return null; + } + + if ($this->vcCredentialStatusClaimValue instanceof VcCredentialStatusClaimValue) { + return $this->vcCredentialStatusClaimValue; + } + + $credentialStatus = $this->getNestedPayloadClaim(ClaimsEnum::Vc->value, ClaimsEnum::Credential_Status->value); + + if (is_null($credentialStatus)) { + $this->vcCredentialStatusClaimValue = false; + return null; + } + + if (!is_array($credentialStatus)) { + throw new VcDataModelException('Invalid VC Credential Status Claim.'); + } + + return $this->vcCredentialStatusClaimValue = $this->claimFactory->forVcDataModel() + ->buildVcCredentialStatusClaimValue( + $credentialStatus, + ); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function getVcCredentialSchema(): ?VcCredentialSchemaClaimBag + { + if ($this->vcCredentialSchemaClaimBag === false) { + return null; + } + + if ($this->vcCredentialSchemaClaimBag instanceof VcCredentialSchemaClaimBag) { + return $this->vcCredentialSchemaClaimBag; + } + + $credentialSchema = $this->getNestedPayloadClaim(ClaimsEnum::Vc->value, ClaimsEnum::Credential_Schema->value); + + if (is_null($credentialSchema)) { + $this->vcCredentialSchemaClaimBag = false; + return null; + } + + if (!is_array($credentialSchema)) { + throw new VcDataModelException('Invalid VC Credential Schema claim.'); + } + + return $this->vcCredentialSchemaClaimBag = $this->claimFactory->forVcDataModel() + ->buildVcCredentialSchemaClaimBag( + $credentialSchema, + ); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function getVcRefreshService(): ?VcRefreshServiceClaimBag + { + if ($this->vcRefreshServiceClaimBag === false) { + return null; + } + + if ($this->vcRefreshServiceClaimBag instanceof VcRefreshServiceClaimBag) { + return $this->vcRefreshServiceClaimBag; + } + + $refreshService = $this->getNestedPayloadClaim(ClaimsEnum::Vc->value, ClaimsEnum::Refresh_Service->value); + + if (is_null($refreshService)) { + $this->vcRefreshServiceClaimBag = false; + return null; + } + + if (!is_array($refreshService)) { + throw new VcDataModelException('Invalid VC Refresh Service claim.'); + } + + return $this->vcRefreshServiceClaimBag = $this->claimFactory->forVcDataModel() + ->buildVcRefreshServiceClaimBag( + $refreshService, + ); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function getVcTermsOfUse(): ?VcTermsOfUseClaimBag + { + if ($this->vcTermsOfUseClaimBag === false) { + return null; + } + + if ($this->vcTermsOfUseClaimBag instanceof VcTermsOfUseClaimBag) { + return $this->vcTermsOfUseClaimBag; + } + + $termsOfUse = $this->getNestedPayloadClaim(ClaimsEnum::Vc->value, ClaimsEnum::Terms_Of_Use->value); + + if (is_null($termsOfUse)) { + $this->vcTermsOfUseClaimBag = false; + return null; + } + + if (!is_array($termsOfUse)) { + throw new VcDataModelException('Invalid VC Terms Of Use claim.'); + } + + return $this->vcTermsOfUseClaimBag = $this->claimFactory->forVcDataModel() + ->buildVcTermsOfUseClaimBag( + $termsOfUse, + ); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\VcDataModelException + * @throws \SimpleSAML\OpenID\Exceptions\InvalidValueException + */ + public function getVcEvidence(): ?VcEvidenceClaimBag + { + if ($this->vcEvidenceClaimBag === false) { + return null; + } + + if ($this->vcEvidenceClaimBag instanceof VcEvidenceClaimBag) { + return $this->vcEvidenceClaimBag; + } + + $evidence = $this->getNestedPayloadClaim(ClaimsEnum::Vc->value, ClaimsEnum::Evidence->value); + + if (is_null($evidence)) { + $this->vcEvidenceClaimBag = false; + return null; + } + + if (!is_array($evidence)) { + throw new VcDataModelException('Invalid VC Evidence claim.'); + } + + return $this->vcEvidenceClaimBag = $this->claimFactory->forVcDataModel() + ->buildVcEvidenceClaimBag( + $evidence, + ); + } + + + /** + * @throws \SimpleSAML\OpenID\Exceptions\JwsException + */ + protected function validate(): void + { + $this->validateByCallbacks( + $this->getVc(...), + $this->getVcAtContext(...), + $this->getVcId(...), + $this->getVcType(...), + $this->getVcCredentialSubject(...), + $this->getVcIssuer(...), + $this->getVcIssuanceDate(...), + $this->getVcProof(...), + $this->getVcExpirationDate(...), + $this->getVcCredentialStatus(...), + $this->getVcCredentialSchema(...), + $this->getVcRefreshService(...), + $this->getVcTermsOfUse(...), + $this->getVcEvidence(...), + $this->getExpirationTime(...), + $this->getIssuer(...), + $this->getNotBefore(...), + $this->getJwtId(...), + $this->getSubject(...), + $this->getAudience(...), + ); + } +} diff --git a/src/VerifiableCredentials/VerifiableCredentialInterface.php b/src/VerifiableCredentials/VerifiableCredentialInterface.php new file mode 100644 index 0000000..4eeab94 --- /dev/null +++ b/src/VerifiableCredentials/VerifiableCredentialInterface.php @@ -0,0 +1,9 @@ +instance(), ); } + + + public function testIsNone(): void + { + $this->assertTrue(SignatureAlgorithmEnum::none->isNone()); + $this->assertFalse(SignatureAlgorithmEnum::EdDSA->isNone()); + $this->assertFalse(SignatureAlgorithmEnum::ES256->isNone()); + $this->assertFalse(SignatureAlgorithmEnum::ES384->isNone()); + $this->assertFalse(SignatureAlgorithmEnum::ES512->isNone()); + $this->assertFalse(SignatureAlgorithmEnum::PS256->isNone()); + $this->assertFalse(SignatureAlgorithmEnum::PS384->isNone()); + $this->assertFalse(SignatureAlgorithmEnum::PS512->isNone()); + $this->assertFalse(SignatureAlgorithmEnum::RS256->isNone()); + $this->assertFalse(SignatureAlgorithmEnum::RS384->isNone()); + $this->assertFalse(SignatureAlgorithmEnum::RS512->isNone()); + } } diff --git a/tests/src/Codebooks/GrantTypesEnumTest.php b/tests/src/Codebooks/GrantTypesEnumTest.php new file mode 100644 index 0000000..a03bc56 --- /dev/null +++ b/tests/src/Codebooks/GrantTypesEnumTest.php @@ -0,0 +1,21 @@ +assertTrue(GrantTypesEnum::PreAuthorizedCode->canBeUsedForVerifiableCredentialIssuance()); + $this->assertTrue(GrantTypesEnum::AuthorizationCode->canBeUsedForVerifiableCredentialIssuance()); + $this->assertFalse(GrantTypesEnum::Implicit->canBeUsedForVerifiableCredentialIssuance()); + $this->assertFalse(GrantTypesEnum::RefreshToken->canBeUsedForVerifiableCredentialIssuance()); + } +} diff --git a/tests/src/Codebooks/HashAlgorithmsEnumTest.php b/tests/src/Codebooks/HashAlgorithmsEnumTest.php new file mode 100644 index 0000000..b91304d --- /dev/null +++ b/tests/src/Codebooks/HashAlgorithmsEnumTest.php @@ -0,0 +1,28 @@ +assertSame(HashAlgorithmsEnum::SHA3_256->ianaName(), HashAlgorithmsEnum::SHA3_256->value); + $this->assertSame(HashAlgorithmsEnum::SHA3_384->ianaName(), HashAlgorithmsEnum::SHA3_384->value); + $this->assertSame(HashAlgorithmsEnum::SHA3_512->ianaName(), HashAlgorithmsEnum::SHA3_512->value); + } + + + public function testPhpName(): void + { + $this->assertSame('sha3-256', HashAlgorithmsEnum::SHA3_256->phpName()); + $this->assertSame('sha3-384', HashAlgorithmsEnum::SHA3_384->phpName()); + $this->assertSame('sha3-512', HashAlgorithmsEnum::SHA3_512->phpName()); + } +} diff --git a/tests/src/Core/ClientAssertionTest.php b/tests/src/Core/ClientAssertionTest.php index f888313..ca5f6aa 100644 --- a/tests/src/Core/ClientAssertionTest.php +++ b/tests/src/Core/ClientAssertionTest.php @@ -14,7 +14,7 @@ use SimpleSAML\OpenID\Exceptions\JwsException; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; @@ -28,7 +28,7 @@ final class ClientAssertionTest extends TestCase protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -67,7 +67,7 @@ protected function setUp(): void $this->jwsDecoratorMock->method('jws')->willReturn($jwsMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -90,7 +90,7 @@ protected function setUp(): void protected function sut( ?JwsDecorator $jwsDecorator = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, @@ -98,7 +98,7 @@ protected function sut( ): ClientAssertion { $jwsDecorator ??= $this->jwsDecoratorMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; @@ -107,7 +107,7 @@ protected function sut( return new ClientAssertion( $jwsDecorator, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, diff --git a/tests/src/Core/Factories/ClientAssertionFactoryTest.php b/tests/src/Core/Factories/ClientAssertionFactoryTest.php index 9414b7a..7e63ed0 100644 --- a/tests/src/Core/Factories/ClientAssertionFactoryTest.php +++ b/tests/src/Core/Factories/ClientAssertionFactoryTest.php @@ -9,15 +9,17 @@ use PHPUnit\Framework\Attributes\UsesClass; use PHPUnit\Framework\MockObject\MockObject; use PHPUnit\Framework\TestCase; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; use SimpleSAML\OpenID\Core\ClientAssertion; use SimpleSAML\OpenID\Core\Factories\ClientAssertionFactory; use SimpleSAML\OpenID\Decorators\DateIntervalDecorator; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwk\JwkDecorator; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; @@ -28,11 +30,11 @@ #[UsesClass(ParsedJws::class)] final class ClientAssertionFactoryTest extends TestCase { - protected MockObject $jwsParserMock; + protected MockObject $jwsDecoratorBuilderMock; protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -60,6 +62,8 @@ final class ClientAssertionFactoryTest extends TestCase protected array $validPayload; + protected MockObject $jwkDecoratorMock; + protected function setUp(): void { @@ -70,11 +74,12 @@ protected function setUp(): void $jwsDecoratorMock = $this->createMock(JwsDecorator::class); $jwsDecoratorMock->method('jws')->willReturn($jwsMock); - $this->jwsParserMock = $this->createMock(JwsParser::class); - $this->jwsParserMock->method('parse')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); + $this->jwsDecoratorBuilderMock->method('fromToken')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock->method('fromData')->willReturn($jwsDecoratorMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -91,30 +96,32 @@ protected function setUp(): void $this->validPayload = $this->expiredPayload; $this->validPayload['exp'] = time() + 3600; + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); } protected function sut( - ?JwsParser $jwsParser = null, + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, ?ClaimFactory $claimFactory = null, ): ClientAssertionFactory { - $jwsParser ??= $this->jwsParserMock; + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; $claimFactory ??= $this->claimFactoryMock; return new ClientAssertionFactory( - $jwsParser, + $jwsDecoratorBuilder, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, @@ -138,4 +145,20 @@ public function testCanBuildFromToken(): void $this->sut()->fromToken('token'), ); } + + + public function testCanBuildFromData(): void + { + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $this->assertInstanceOf( + ClientAssertion::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::ES256, + $this->validPayload, + [], + ), + ); + } } diff --git a/tests/src/Core/Factories/RequestObjectFactoryTest.php b/tests/src/Core/Factories/RequestObjectFactoryTest.php index bebe500..a50eb5d 100644 --- a/tests/src/Core/Factories/RequestObjectFactoryTest.php +++ b/tests/src/Core/Factories/RequestObjectFactoryTest.php @@ -10,15 +10,17 @@ use PHPUnit\Framework\Attributes\UsesClass; use PHPUnit\Framework\MockObject\MockObject; use PHPUnit\Framework\TestCase; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; use SimpleSAML\OpenID\Core\Factories\RequestObjectFactory; use SimpleSAML\OpenID\Core\RequestObject; use SimpleSAML\OpenID\Decorators\DateIntervalDecorator; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwk\JwkDecorator; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; @@ -30,11 +32,11 @@ final class RequestObjectFactoryTest extends TestCase { protected MockObject $signatureMock; - protected MockObject $jwsParserMock; + protected MockObject $jwsDecoratorBuilderMock; protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -50,6 +52,8 @@ final class RequestObjectFactoryTest extends TestCase 'kid' => 'LfgZECDYkSTHmbllBD5_Tkwvy3CtOpNYQ7-DfQawTww', ]; + protected MockObject $jwkDecoratorMock; + protected function setUp(): void { @@ -61,11 +65,12 @@ protected function setUp(): void $jwsDecoratorMock = $this->createMock(JwsDecorator::class); $jwsDecoratorMock->method('jws')->willReturn($jwsMock); - $this->jwsParserMock = $this->createMock(JwsParser::class); - $this->jwsParserMock->method('parse')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); + $this->jwsDecoratorBuilderMock->method('fromToken')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock->method('fromData')->willReturn($jwsDecoratorMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -74,30 +79,32 @@ protected function setUp(): void $this->helpersMock->method('json')->willReturn($jsonHelperMock); $this->claimFactoryMock = $this->createMock(ClaimFactory::class); + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); } protected function sut( - ?JwsParser $jwsParser = null, + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, ?ClaimFactory $claimFactory = null, ): RequestObjectFactory { - $jwsParser ??= $this->jwsParserMock; + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; $claimFactory ??= $this->claimFactoryMock; return new RequestObjectFactory( - $jwsParser, + $jwsDecoratorBuilder, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, @@ -121,4 +128,20 @@ public function testCanBuildFromToken(): void $this->sut()->fromToken('token'), ); } + + + public function testCanBuildFromData(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + + $this->assertInstanceOf( + RequestObject::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::ES256, + [], + $this->sampleHeader, + ), + ); + } } diff --git a/tests/src/Core/RequestObjectTest.php b/tests/src/Core/RequestObjectTest.php index 5aeb718..13a045a 100644 --- a/tests/src/Core/RequestObjectTest.php +++ b/tests/src/Core/RequestObjectTest.php @@ -15,7 +15,7 @@ use SimpleSAML\OpenID\Exceptions\RequestObjectException; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; @@ -31,7 +31,7 @@ final class RequestObjectTest extends TestCase protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -59,7 +59,7 @@ protected function setUp(): void $this->jwsDecoratorMock->method('jws')->willReturn($jwsMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -78,7 +78,7 @@ protected function setUp(): void protected function sut( ?JwsDecorator $jwsDecorator = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, @@ -86,7 +86,7 @@ protected function sut( ): RequestObject { $jwsDecorator ??= $this->jwsDecoratorMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; @@ -95,7 +95,7 @@ protected function sut( return new RequestObject( $jwsDecorator, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, diff --git a/tests/src/CoreTest.php b/tests/src/CoreTest.php index b73a997..fadf588 100644 --- a/tests/src/CoreTest.php +++ b/tests/src/CoreTest.php @@ -19,10 +19,10 @@ use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Factories\DateIntervalDecoratorFactory; use SimpleSAML\OpenID\Factories\JwsSerializerManagerDecoratorFactory; -use SimpleSAML\OpenID\Jws\Factories\JwsParserFactory; +use SimpleSAML\OpenID\Jws\Factories\JwsDecoratorBuilderFactory; use SimpleSAML\OpenID\Jws\Factories\JwsVerifierDecoratorFactory; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; use SimpleSAML\OpenID\SupportedAlgorithms; @@ -36,9 +36,9 @@ #[UsesClass(DateIntervalDecoratorFactory::class)] #[UsesClass(AlgorithmManagerDecoratorFactory::class)] #[UsesClass(JwsSerializerManagerDecoratorFactory::class)] -#[UsesClass(JwsParserFactory::class)] +#[UsesClass(JwsDecoratorBuilderFactory::class)] #[UsesClass(JwsVerifierDecoratorFactory::class)] -#[UsesClass(JwsParser::class)] +#[UsesClass(JwsDecoratorBuilder::class)] #[UsesClass(AlgorithmManagerDecorator::class)] #[UsesClass(JwsVerifierDecorator::class)] #[UsesClass(JwsSerializerManagerDecorator::class)] diff --git a/tests/src/Did/DidKeyJwkResolverTest.php b/tests/src/Did/DidKeyJwkResolverTest.php new file mode 100644 index 0000000..4349b05 --- /dev/null +++ b/tests/src/Did/DidKeyJwkResolverTest.php @@ -0,0 +1,726 @@ +createMock(Base64Url::class); + + $base64UrlMock->method('encode') + ->willReturnCallback(base64_encode(...)); + + $this->helpersMock = $this->createMock(Helpers::class); + + $this->helpersMock->method('base64Url') + ->willReturn($base64UrlMock); + } + + + protected function sut( + ?Helpers $helpers = null, + ): DidKeyJwkResolver { + $helpers ??= $this->helpersMock; + + return new DidKeyJwkResolver($helpers); + } + + + /** + * Test that invalid did:key format throws an exception + */ + public function testInvalidDidKeyFormatThrowsException(): void + { + $this->expectException(DidException::class); + $this->expectExceptionMessage('Invalid did:key format. Must start with "did:key:"'); + + $this->sut()->extractJwkFromDidKey('invalid:key:value'); + } + + + /** + * Test that unsupported multibase encoding throws an exception + */ + public function testUnsupportedMultibaseEncodingThrowsException(): void + { + $this->expectException(DidException::class); + $this->expectExceptionMessage( + 'Unsupported multibase encoding. Only base58btc (z-prefixed) is currently supported.', + ); + + $this->sut()->extractJwkFromDidKey('did:key:a123'); // 'a' prefix is not supported + } + + + /** + * Test base58BtcDecode method with invalid character + */ + public function testBase58BtcDecodeWithInvalidCharacter(): void + { + $this->expectException(\InvalidArgumentException::class); + $this->expectExceptionMessage('Invalid character in base58 string'); + + $this->sut()->base58BtcDecode('invalid*string'); // '*' is not in the base58 alphabet + } + + + /** + * Test base58BtcDecode method with valid input + */ + public function testBase58BtcDecodeWithValidInput(): void + { + // Test with a known Base58 encoding + // Example: '111' in Base58 decodes to bytes representing 0 + $result = $this->sut()->base58BtcDecode('111'); + + $this->assertSame("\0\0\0", $result); + } + + + /** + * Test createEd25519Jwk method + */ + public function testCreateEd25519Jwk(): void + { + $rawKeyBytes = "test-key-data"; + $encodedKey = base64_encode($rawKeyBytes); + + $expectedJwk = [ + 'kty' => 'OKP', + 'crv' => 'Ed25519', + 'x' => $encodedKey, + 'use' => 'sig', + ]; + + $jwk = $this->sut()->createEd25519Jwk($rawKeyBytes); + + $this->assertSame($expectedJwk, $jwk); + } + + + /** + * Test createX25519Jwk method + */ + public function testCreateX25519Jwk(): void + { + $rawKeyBytes = "test-key-data"; + $encodedKey = base64_encode($rawKeyBytes); + + $expectedJwk = [ + 'kty' => 'OKP', + 'crv' => 'X25519', + 'x' => $encodedKey, + 'use' => 'enc', + ]; + + $jwk = $this->sut()->createX25519Jwk($rawKeyBytes); + + $this->assertSame($expectedJwk, $jwk); + } + + + /** + * Test createSecp256k1Jwk method with valid uncompressed point + */ + public function testCreateSecp256k1JwkWithValidUncompressedPoint(): void + { + // Create a mock uncompressed point format (0x04 || x || y) + // 0x04 byte followed by 32 bytes for x and 32 bytes for y + $x = str_repeat('x', 32); + $y = str_repeat('y', 32); + $rawKeyBytes = "\x04" . $x . $y; + + $expectedJwk = [ + 'kty' => 'EC', + 'crv' => 'secp256k1', + 'x' => base64_encode($x), + 'y' => base64_encode($y), + 'use' => 'sig', + ]; + + $jwk = $this->sut()->createSecp256k1Jwk($rawKeyBytes); + + $this->assertSame($expectedJwk, $jwk); + } + + + /** + * Test createSecp256k1Jwk method with invalid key format + */ + public function testCreateSecp256k1JwkWithInvalidKeyFormat(): void + { + $this->expectException(DidException::class); + $this->expectExceptionMessage('Invalid Secp256k1 public key format'); + + // Invalid key format - wrong length + $rawKeyBytes = "\x04" . str_repeat('x', 10); + + $this->sut()->createSecp256k1Jwk($rawKeyBytes); + } + + + /** + * Test createSecp256k1Jwk method with compressed point format + */ + public function testCreateSecp256k1JwkWithCompressedPoint(): void + { + $this->expectException(DidException::class); + $this->expectExceptionMessage('Compressed Secp256k1 keys are not currently supported'); + + // Compressed point format (0x02 or 0x03 followed by 32 bytes for x) + $rawKeyBytes = "\x02" . str_repeat('x', 32); + + $this->sut()->createSecp256k1Jwk($rawKeyBytes); + } + + + /** + * Test createP256Jwk method with valid uncompressed point + */ + public function testCreateP256JwkWithValidUncompressedPoint(): void + { + // Create a mock uncompressed point format (0x04 || x || y) + $x = str_repeat('x', 32); + $y = str_repeat('y', 32); + $rawKeyBytes = "\x04" . $x . $y; + + $expectedJwk = [ + 'kty' => 'EC', + 'crv' => 'P-256', + 'x' => base64_encode($x), + 'y' => base64_encode($y), + 'use' => 'sig', + ]; + + $jwk = $this->sut()->createP256Jwk($rawKeyBytes); + + $this->assertSame($expectedJwk, $jwk); + } + + + /** + * Test createP256Jwk method with invalid key format + */ + public function testCreateP256JwkWithInvalidKeyFormat(): void + { + $this->expectException(DidException::class); + $this->expectExceptionMessage('Invalid P-256 public key format'); + + // Invalid key format - wrong first byte + $rawKeyBytes = "\x02" . str_repeat('x', 64); + + $this->sut()->createP256Jwk($rawKeyBytes); + } + + + /** + * Test createP384Jwk method with valid uncompressed point + */ + public function testCreateP384JwkWithValidUncompressedPoint(): void + { + // Create a mock uncompressed point format (0x04 || x || y) + $x = str_repeat('x', 48); + $y = str_repeat('y', 48); + $rawKeyBytes = "\x04" . $x . $y; + + $expectedJwk = [ + 'kty' => 'EC', + 'crv' => 'P-384', + 'x' => base64_encode($x), + 'y' => base64_encode($y), + 'use' => 'sig', + ]; + + $jwk = $this->sut()->createP384Jwk($rawKeyBytes); + + $this->assertSame($expectedJwk, $jwk); + } + + + /** + * Test createP384Jwk method with invalid key format + */ + public function testCreateP384JwkWithInvalidKeyFormat(): void + { + $this->expectException(DidException::class); + $this->expectExceptionMessage('Invalid P-384 public key format'); + + // Invalid key format - wrong length + $rawKeyBytes = "\x04" . str_repeat('x', 50); + + $this->sut()->createP384Jwk($rawKeyBytes); + } + + + /** + * Test createP521Jwk method with valid uncompressed point + */ + public function testCreateP521JwkWithValidUncompressedPoint(): void + { + // Create a mock uncompressed point format (0x04 || x || y) + $x = str_repeat('x', 66); + $y = str_repeat('y', 66); + $rawKeyBytes = "\x04" . $x . $y; + + $expectedJwk = [ + 'kty' => 'EC', + 'crv' => 'P-521', + 'x' => base64_encode($x), + 'y' => base64_encode($y), + 'use' => 'sig', + ]; + + $jwk = $this->sut()->createP521Jwk($rawKeyBytes); + + $this->assertSame($expectedJwk, $jwk); + } + + + /** + * Test createP521Jwk method with invalid key format + */ + public function testCreateP521JwkWithInvalidKeyFormat(): void + { + $this->expectException(DidException::class); + $this->expectExceptionMessage('Invalid P-521 public key format'); + + // Invalid key format - wrong length + $rawKeyBytes = "\x04" . str_repeat('x', 70); + + $this->sut()->createP521Jwk($rawKeyBytes); + } + + + public function testExtractJwkFromDidKeyWithUnsupportedMulticodecIdentifier(): void + { + $resolverMock = $this->getMockBuilder(DidKeyJwkResolver::class) + ->setConstructorArgs([$this->helpersMock]) + ->onlyMethods(['base58BtcDecode']) + ->getMock(); + + $decodedKey = "\xFF\xFF" . str_repeat('x', 32); + $resolverMock->method('base58BtcDecode') + ->willReturn($decodedKey); + + $this->expectException(DidException::class); + $this->expectExceptionMessage('Unsupported'); + + $resolverMock->extractJwkFromDidKey('did:key:z123'); + } + + + /** + * Test extractJwkFromDidKey with an Ed25519 key + */ + public function testExtractJwkFromDidKeyWithEd25519Key(): void + { + // Create a partial mock of the resolver + $resolverMock = $this->getMockBuilder(DidKeyJwkResolver::class) + ->setConstructorArgs([$this->helpersMock]) + ->onlyMethods(['base58BtcDecode', 'createEd25519Jwk']) + ->getMock(); + + // Set up the mock to return a key with Ed25519 multicodec identifier (0xed01) + $keyBytes = str_repeat('x', 32); + $decodedKey = "\xED\x01" . $keyBytes; // 0xED01 is Ed25519 + $resolverMock->method('base58BtcDecode') + ->willReturn($decodedKey); + + // Set up the expected JWK + $expectedJwk = [ + 'kty' => 'OKP', + 'crv' => 'Ed25519', + 'x' => 'test-encoded-key', + 'use' => 'sig', + ]; + + // Set up the createEd25519Jwk mock + $resolverMock->method('createEd25519Jwk') + ->with($keyBytes) + ->willReturn($expectedJwk); + + // Call the method + $jwk = $resolverMock->extractJwkFromDidKey('did:key:z123'); + + // Assert + $this->assertEquals($expectedJwk, $jwk); + } + + + /** + * Test the integrated flow of extractJwkFromDidKey + */ + public function testExtractJwkFromDidKeyIntegrated(): void + { + // This test demonstrates how all the pieces fit together + // Create a mock with minimal stubbing - just enough to make the test predictable + $resolverMock = $this->getMockBuilder(DidKeyJwkResolver::class) + ->setConstructorArgs([$this->helpersMock]) + ->onlyMethods(['base58BtcDecode']) + ->getMock(); + + // For an Ed25519 key (multicodec 0xed01) + $keyBytes = str_repeat('x', 32); + $decodedKey = "\xED\x01" . $keyBytes; + $resolverMock->method('base58BtcDecode') + ->willReturn($decodedKey); + + $jwk = $resolverMock->extractJwkFromDidKey('did:key:z123'); + + $this->assertEquals('OKP', $jwk['kty']); + $this->assertEquals('Ed25519', $jwk['crv']); + $this->assertEquals('sig', $jwk['use']); + $this->assertArrayHasKey('x', $jwk); + } + + + /** + * Test that an exception in base58BtcDecode is properly wrapped + */ + public function testExtractJwkFromDidKeyWithDecodingException(): void + { + // Create a partial mock of the resolver + $resolverMock = $this->getMockBuilder(DidKeyJwkResolver::class) + ->setConstructorArgs([$this->helpersMock]) + ->onlyMethods(['base58BtcDecode']) + ->getMock(); + + // Set up the mock to throw an exception + $resolverMock->method('base58BtcDecode') + ->willThrowException(new \InvalidArgumentException('Test exception')); + + $this->expectException(DidException::class); + $this->expectExceptionMessage('Error processing did:key: Test exception'); + + $resolverMock->extractJwkFromDidKey('did:key:z123'); + } + + + /** + * Test extraction with real Ed25519 did:key value + */ + public function testExtractJwkFromRealEd25519DidKey(): void + { + // Create a real Helpers instance for this test instead of a mock + $helpers = new Helpers(); + $resolver = new DidKeyJwkResolver($helpers); + + // This is a real Ed25519 did:key + $didKey = 'did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK'; + + $jwk = $resolver->extractJwkFromDidKey($didKey); + + $this->assertEquals('OKP', $jwk['kty']); + $this->assertEquals('Ed25519', $jwk['crv']); + $this->assertEquals('sig', $jwk['use']); + $this->assertArrayHasKey('x', $jwk); + } + + + /** + * Test extraction with the provided sample did:key value + */ + public function testExtractJwkFromProvidedSample(): void + { + // Set up a real Helpers instance for this test + $helpers = new Helpers(); + $resolver = new DidKeyJwkResolver($helpers); + + // This is the provided sample did:key + // phpcs:ignore + $didKey = 'did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9Kbp7R1FUvzP1s9pLTKP21oYQNWMJFzgVGWYb5WmD3ngVmjMeTABs9MjYUaRfzTWg9dLdPw6o16UeakmtE7tHDMug3XgcJptPxRYuwFdVJXa6KAMUBhkmouMZisDJYMGbaGAp'; + + // This test might fail until the multicodec issue is fixed + // We'll use try/catch to provide more diagnostic information + try { + $jwk = $resolver->extractJwkFromDidKey($didKey); + + // If we get here, verify the JWK structure is correct + $this->assertArrayHasKey('kty', $jwk); + $this->assertArrayHasKey('crv', $jwk); + $this->assertArrayHasKey('use', $jwk); + } catch (DidException $didException) { + $this->markTestIncomplete('Failed to process the sample did:key: ' . $didException->getMessage()); + } + } + + /** + * Test multiple real did:key values for different key types + */ + #[DataProvider('provideRealDidKeys')] + public function testMultipleRealDidKeys(string $didKey, string $expectedCrv, string $expectedKty): void + { + // Create a real Helpers instance for this test + $helpers = new Helpers(); + $resolver = new DidKeyJwkResolver($helpers); + + try { + $jwk = $resolver->extractJwkFromDidKey($didKey); + + $this->assertEquals($expectedKty, $jwk['kty']); + $this->assertEquals($expectedCrv, $jwk['crv']); + $this->assertArrayHasKey('use', $jwk); + } catch (DidException $didException) { + $this->markTestSkipped('Failed to process did:key: ' . $didException->getMessage()); + } + } + + + /** + * Data provider for real did:key values + */ + public static function provideRealDidKeys(): \Iterator + { + yield 'Ed25519 key' => [ + 'did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK', + 'Ed25519', + 'OKP', + ]; + yield 'X25519 key' => [ + 'did:key:z6LSbysY2xFMRpGMhb7tFTLMpeuPRaqaWM1yECx2AtzE3KCc', + 'X25519', + 'OKP', + ]; + } + + + public function testRealDidKeys(): void + { + $sut = $this->sut(new Helpers()); + + // phpcs:ignore + $didKey = 'did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9Kbo1sB3YbioCwNzDxGk58kUKzV4gzuhvVPFSxRefivZgKeZnifmxtbkM91FGgofu6ivysQw4Um9baehyFHtbyqBNWNFvgrHXxLLA6MRqt3TvcqBcDHXiyQAGGk9mBFPEFt1J'; + + $jwk = $sut->extractJwkFromDidKey($didKey); + + $this->assertEquals('EC', $jwk['kty']); + $this->assertEquals('P-256', $jwk['crv']); + $this->assertEquals('8Yp_v1yn57IPjCDhS-xjQnIt8WR8UgJO_gNDwvlwwvI', $jwk['x']); + $this->assertEquals('bURU-YbrZLmNob1ecG4obRvs4RRQV4u0PWiR3j8qgoQ', $jwk['y']); + $this->assertEquals('sig', $jwk['use']); + } + + + public function testCreateJwkFromRawJson(): void + { + $sut = $this->sut(new Helpers()); + + // phpcs:ignore + $jsonData = '{"crv":"P-256","kty":"EC","x":"dDfIibQM-949qf4jj-8mBY4Azq34ygSGhzd8AT2mx6s","y":"VUyI8G-OYirMrrsCB9lvUbr6Wjq2ef73ne_paBqLPxw"}'; + + $jwk = $sut->createJwkFromRawJson($jsonData); + + $this->assertEquals('EC', $jwk['kty']); + $this->assertEquals('P-256', $jwk['crv']); + $this->assertEquals('dDfIibQM-949qf4jj-8mBY4Azq34ygSGhzd8AT2mx6s', $jwk['x']); + $this->assertEquals('VUyI8G-OYirMrrsCB9lvUbr6Wjq2ef73ne_paBqLPxw', $jwk['y']); + $this->assertEquals('sig', $jwk['use']); + } + + + public function testCreateJwkFromInvalidJsonThrows(): void + { + $sut = $this->sut(new Helpers()); + + $this->expectException(DidException::class); + $this->expectExceptionMessage('Failed to parse JWK JSON'); + + $invalidJson = '{"crv":"P-256","kty":"EC",'; + $sut->createJwkFromRawJson($invalidJson); + } + + + public function testCreateJwkFromInvalidJwkFormatThrows(): void + { + $sut = $this->sut(new Helpers()); + + $this->expectException(DidException::class); + $this->expectExceptionMessage('Invalid JWK format: missing required "kty" property'); + + $invalidJwk = '{"crv":"P-256"}'; + $sut->createJwkFromRawJson($invalidJwk); + } + + + public function testCreateJwkFromInvalidEcJwkFormatThrows(): void + { + $sut = $this->sut(new Helpers()); + + $this->expectException(DidException::class); + $this->expectExceptionMessage('Invalid EC JWK format: missing required properties'); + + $invalidEcJwk = '{"kty":"EC","crv":"P-256"}'; + $sut->createJwkFromRawJson($invalidEcJwk); + } + + + #[DataProvider('varintValidDataProvider')] + public function testVarintDecodeValid(string $bytes, int $expectedValue, int $expectedLength): void + { + [$value, $length] = $this->sut()->varintDecode($bytes); + $this->assertSame($expectedValue, $value, "Decoded value mismatch for input: " . bin2hex($bytes)); + $this->assertSame($expectedLength, $length, "Decoded length mismatch for input: " . bin2hex($bytes)); + } + + + public static function varintValidDataProvider(): \Iterator + { + // Single byte + yield 'zero' => ["\x00", 0, 1]; + yield 'one' => ["\x01", 1, 1]; + yield 'max single byte' => ["\x7F", 127, 1]; + // Multi-byte + yield '128' => ["\x80\x01", 128, 2]; + // Min two-byte + yield '150' => ["\x96\x01", 150, 2]; + // (150-128=22) -> 0x96 = 0x80 | 22 + yield '300' => ["\xAC\x02", 300, 2]; + // 300 = (2 * 128) + 44. 44=0x2C. \xAC = 0x80|0x2C. \x02 + yield 'multicodec Ed25519 (0xed)' => ["\xED\x01", 0xed, 2]; + yield 'multicodec secp256k1-pub (0xe7 from table, encoded as \xe7\x01 by some conventions)' => [ + "\xE7\x01", + 0xE7, + 2, + ]; + // Decodes to 231 + // Max 9-byte value (2^63 - 1, which is PHP_INT_MAX on 64-bit systems) + yield 'max 9-byte value (PHP_INT_MAX)' => [ + str_repeat("\xFF", 8) . "\x7F", + PHP_INT_MAX, // (2^63 - 1) + 9, + ]; + } + + + #[DataProvider('varintInvalidDataProvider')] + public function testVarintDecodeInvalid(string $bytes, string $expectedExceptionMessage): void + { + $this->expectException(DidException::class); + $this->expectExceptionMessage($expectedExceptionMessage); + $this->sut()->varintDecode($bytes); + } + + + public static function varintInvalidDataProvider(): \Iterator + { + yield 'empty string' => ['', 'Invalid varint: input is empty']; + yield 'unterminated sequence (single byte)' => [ + "\x80", + 'Invalid varint: incomplete sequence (unterminated).', + ]; + yield 'unterminated sequence (multi-byte)' => [ + "\xFF\xFF", + 'Invalid varint: incomplete sequence (unterminated).', + ]; + yield 'overlong encoding of 0' => [ + "\x80\x00", + 'Invalid varint: overlong encoding (minimality constraint violated).', + ]; + yield 'overlong encoding of 1' => [ + "\x81\x00", + 'Invalid varint: overlong encoding (minimality constraint violated).', + ]; + yield 'too many bytes (10th byte)' => [ + str_repeat("\x80", 9) . "\x01", + 'Invalid varint: too many bytes (max 9 for this implementation).', + ]; + yield 'unterminated, 9 bytes with MSB set' => [ + str_repeat("\xFF", 9), + 'Invalid varint: incomplete sequence (unterminated).', + ]; + } + + + #[DataProvider('base58DecodeValidDataProvider')] + public function testBase58BtcDecodeValidInputs(string $base58encoded, string $expectedDecoded): void + { + $actualDecoded = $this->sut()->base58BtcDecode($base58encoded); + +// if ($base58encoded === 'ABnLTmg5e1PhaB9S2qAvL9L3Q') { +// $expectedHex = bin2hex($expectedDecoded); +// $actualHex = bin2hex($actualDecoded); +// if ($expectedHex !== $actualHex) { +// error_log("Debug Info for: " . $base58encoded); +// error_log("Expected Hex: " . $expectedHex); +// error_log("Actual Hex: " . $actualHex); +// // You might also want to add logging inside base58BtcDecode +// // to see the intermediate GMP number ($num) +// } +// } + + $this->assertSame($expectedDecoded, $actualDecoded, "Failed for input: " . $base58encoded); + } + + + public static function base58DecodeValidDataProvider(): \Iterator + { + yield 'empty string' => ['', '']; + yield 'single char "z" (value 57)' => ['z', '9']; + // chr(57) + yield 'single char "6" (value 5)' => ['6', chr(5)]; + yield 'single char "L" (value 25)' => ['L', chr(19)]; + yield 'two chars "2g" (value 88)' => ['2g', 'a']; + // chr(97) + yield 'leading zero "1"' => ['1', "\0"]; + yield 'multiple leading zeros "111"' => ['111', "\0\0\0"]; + yield 'leading zero and char "1z"' => ['1z', '9']; + // 'z' is value 57, chr(57) is '9' + yield 'leading zero and char "16"' => ['16', "\0" . chr(5)]; + yield 'leading zero and char "1L"' => ['1L', "\0" . chr(19)]; + yield 'leading zero and two chars "12g"' => ['12g', "\0a"]; + // "\0" . chr(97) + yield 'value 256 ("5R")' => ['5R', "\x01\x00"]; + // Decodes to bytes representing 256 + yield 'string "Hello World"' => [ // "Hello World" as ASCII bytes + 'JxF12TrwUP45BMd', // Base58 of "Hello World" + "Hello World", // Equivalent to "\x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64" + ]; + yield 'three leading ones then value 1 ("1112")' => ['1112', "\0\0\0\x01"]; + // Test vector from cryptocoinjs/bs58 test suite + // hex "000000287fb4cd" -> bytes "\x00\x00\x00\x28\x7f\xb4\xcd" + yield 'bs58 lib vector 1' => ['111233QC4', "\x00\x00\x00\x28\x7f\xb4\xcd"]; + } + + + #[DataProvider('base58DecodeInvalidCharDataProvider')] + public function testBase58BtcDecodeThrowsOnInvalidCharacter(string $base58invalid): void + { + $this->expectException(\InvalidArgumentException::class); + // Check that the message starts with the expected prefix and mentions a character + $this->expectExceptionMessage('Invalid'); + $this->sut()->base58BtcDecode($base58invalid); + } + + + public static function base58DecodeInvalidCharDataProvider(): \Iterator + { + yield 'invalid char "0" (zero)' => ['0']; + yield 'invalid char "I" (capital i)' => ['I']; + yield 'invalid char "O" (capital o)' => ['O']; + yield 'invalid char "l" (lowercase L)' => ['l']; + yield 'valid prefix, invalid suffix "abc0def"' => ['abc0def']; + yield 'invalid char with space "ab c"' => ['ab c']; + yield 'invalid char with newline "ab\nc"' => ["ab\nc"]; + yield 'invalid char with tab "ab\tc"' => ["ab\tc"]; + } +} diff --git a/tests/src/DidTest.php b/tests/src/DidTest.php new file mode 100644 index 0000000..802fa97 --- /dev/null +++ b/tests/src/DidTest.php @@ -0,0 +1,41 @@ +assertInstanceOf(Did::class, $this->sut()); + } + + + public function testCanBuildTools(): void + { + $this->assertInstanceOf( + DidKeyJwkResolver::class, + $this->sut()->didKeyResolver(), + ); + + $this->assertInstanceOf( + Helpers::class, + $this->sut()->helpers(), + ); + } +} diff --git a/tests/src/Factories/ClaimFactoryTest.php b/tests/src/Factories/ClaimFactoryTest.php index abeebbd..05e86e9 100644 --- a/tests/src/Factories/ClaimFactoryTest.php +++ b/tests/src/Factories/ClaimFactoryTest.php @@ -13,6 +13,7 @@ use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Federation\Factories\FederationClaimFactory; use SimpleSAML\OpenID\Helpers; +use SimpleSAML\OpenID\VerifiableCredentials\VcDataModel\Factories\VcDataModelClaimFactory; #[CoversClass(ClaimFactory::class)] #[UsesClass(Helpers::class)] @@ -20,6 +21,7 @@ #[UsesClass(FederationClaimFactory::class)] #[UsesClass(GenericClaim::class)] #[UsesClass(JwksClaim::class)] +#[UsesClass(VcDataModelClaimFactory::class)] final class ClaimFactoryTest extends TestCase { protected Helpers $helpers; @@ -68,6 +70,12 @@ public function testCanGetForFederation(): void } + public function testCanGetForVcDataModel(): void + { + $this->assertInstanceOf(VcDataModelClaimFactory::class, $this->sut()->forVcDataModel()); + } + + public function testCanBuildGeneric(): void { $this->assertInstanceOf( diff --git a/tests/src/Federation/EntityStatementTest.php b/tests/src/Federation/EntityStatementTest.php index fb6d280..a5e9739 100644 --- a/tests/src/Federation/EntityStatementTest.php +++ b/tests/src/Federation/EntityStatementTest.php @@ -16,7 +16,7 @@ use SimpleSAML\OpenID\Federation\EntityStatement; use SimpleSAML\OpenID\Federation\Factories\FederationClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; @@ -32,7 +32,7 @@ final class EntityStatementTest extends TestCase protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -121,7 +121,7 @@ protected function setUp(): void $this->jwsDecoratorMock->method('jws')->willReturn($jwsMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -149,7 +149,7 @@ protected function setUp(): void protected function sut( ?JwsDecorator $jwsDecorator = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, @@ -157,7 +157,7 @@ protected function sut( ): EntityStatement { $jwsDecorator ??= $this->jwsDecoratorMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; @@ -166,7 +166,7 @@ protected function sut( return new EntityStatement( $jwsDecorator, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, diff --git a/tests/src/Federation/Factories/EntityStatementFactoryTest.php b/tests/src/Federation/Factories/EntityStatementFactoryTest.php index 9e77592..94a41a8 100644 --- a/tests/src/Federation/Factories/EntityStatementFactoryTest.php +++ b/tests/src/Federation/Factories/EntityStatementFactoryTest.php @@ -10,15 +10,17 @@ use PHPUnit\Framework\Attributes\UsesClass; use PHPUnit\Framework\MockObject\MockObject; use PHPUnit\Framework\TestCase; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; use SimpleSAML\OpenID\Decorators\DateIntervalDecorator; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Federation\EntityStatement; use SimpleSAML\OpenID\Federation\Factories\EntityStatementFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwk\JwkDecorator; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; @@ -31,11 +33,11 @@ final class EntityStatementFactoryTest extends TestCase { protected MockObject $signatureMock; - protected MockObject $jwsParserMock; + protected MockObject $jwsDecoratorBuilderMock; protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -99,6 +101,8 @@ final class EntityStatementFactoryTest extends TestCase protected array $validPayload; + protected MockObject $jwkDecoratorMock; + protected function setUp(): void { @@ -112,11 +116,12 @@ protected function setUp(): void $jwsDecoratorMock = $this->createMock(JwsDecorator::class); $jwsDecoratorMock->method('jws')->willReturn($jwsMock); - $this->jwsParserMock = $this->createMock(JwsParser::class); - $this->jwsParserMock->method('parse')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); + $this->jwsDecoratorBuilderMock->method('fromToken')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock->method('fromData')->willReturn($jwsDecoratorMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -133,30 +138,32 @@ protected function setUp(): void $this->validPayload = $this->expiredPayload; $this->validPayload['exp'] = time() + 3600; + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); } protected function sut( - ?JwsParser $jwsParser = null, + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, ?ClaimFactory $claimFactory = null, ): EntityStatementFactory { - $jwsParser ??= $this->jwsParserMock; + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; $claimFactory ??= $this->claimFactoryMock; return new EntityStatementFactory( - $jwsParser, + $jwsDecoratorBuilder, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, @@ -181,4 +188,21 @@ public function testCanBuildFromToken(): void $this->sut()->fromToken('token'), ); } + + + public function testCanBuildFromData(): void + { + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + + $this->assertInstanceOf( + EntityStatement::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::ES256, + $this->validPayload, + $this->sampleHeader, + ), + ); + } } diff --git a/tests/src/Federation/Factories/RequestObjectFactoryTest.php b/tests/src/Federation/Factories/RequestObjectFactoryTest.php index d826f87..d8f43ed 100644 --- a/tests/src/Federation/Factories/RequestObjectFactoryTest.php +++ b/tests/src/Federation/Factories/RequestObjectFactoryTest.php @@ -10,15 +10,17 @@ use PHPUnit\Framework\Attributes\UsesClass; use PHPUnit\Framework\MockObject\MockObject; use PHPUnit\Framework\TestCase; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; use SimpleSAML\OpenID\Decorators\DateIntervalDecorator; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Federation\Factories\RequestObjectFactory; use SimpleSAML\OpenID\Federation\RequestObject; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwk\JwkDecorator; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; @@ -31,11 +33,11 @@ final class RequestObjectFactoryTest extends TestCase { protected MockObject $signatureMock; - protected MockObject $jwsParserMock; + protected MockObject $jwsDecoratorBuilderMock; protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -67,6 +69,8 @@ final class RequestObjectFactoryTest extends TestCase protected array $validPayload; + protected MockObject $jwkDecoratorMock; + protected function setUp(): void { @@ -80,11 +84,12 @@ protected function setUp(): void $jwsDecoratorMock = $this->createMock(JwsDecorator::class); $jwsDecoratorMock->method('jws')->willReturn($jwsMock); - $this->jwsParserMock = $this->createMock(JwsParser::class); - $this->jwsParserMock->method('parse')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); + $this->jwsDecoratorBuilderMock->method('fromToken')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock->method('fromData')->willReturn($jwsDecoratorMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -100,30 +105,32 @@ protected function setUp(): void $this->validPayload = $this->expiredPayload; $this->validPayload['exp'] = time() + 3600; + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); } protected function sut( - ?JwsParser $jwsParser = null, + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, ?ClaimFactory $claimFactory = null, ): RequestObjectFactory { - $jwsParser ??= $this->jwsParserMock; + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; $claimFactory ??= $this->claimFactoryMock; return new RequestObjectFactory( - $jwsParser, + $jwsDecoratorBuilder, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, @@ -148,4 +155,21 @@ public function testCanBuildFromToken(): void $this->sut()->fromToken('token'), ); } + + + public function testCanBuildFromData(): void + { + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + + $this->assertInstanceOf( + RequestObject::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::ES256, + $this->validPayload, + $this->sampleHeader, + ), + ); + } } diff --git a/tests/src/Federation/Factories/TrustMarkDelegationFactoryTest.php b/tests/src/Federation/Factories/TrustMarkDelegationFactoryTest.php index 5dbd24d..5fb7480 100644 --- a/tests/src/Federation/Factories/TrustMarkDelegationFactoryTest.php +++ b/tests/src/Federation/Factories/TrustMarkDelegationFactoryTest.php @@ -10,14 +10,16 @@ use PHPUnit\Framework\Attributes\UsesClass; use PHPUnit\Framework\MockObject\MockObject; use PHPUnit\Framework\TestCase; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; use SimpleSAML\OpenID\Decorators\DateIntervalDecorator; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Federation\Factories\TrustMarkDelegationFactory; use SimpleSAML\OpenID\Federation\TrustMarkDelegation; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwk\JwkDecorator; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; @@ -27,11 +29,11 @@ final class TrustMarkDelegationFactoryTest extends TestCase { protected MockObject $signatureMock; - protected MockObject $jwsParserMock; + protected MockObject $jwsDecoratorBuilderMock; protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerMock; @@ -62,6 +64,8 @@ final class TrustMarkDelegationFactoryTest extends TestCase protected array $validPayload; + protected MockObject $jwkDecoratorMock; + protected function setUp(): void { @@ -75,11 +79,12 @@ protected function setUp(): void $jwsDecoratorMock = $this->createMock(JwsDecorator::class); $jwsDecoratorMock->method('jws')->willReturn($jwsMock); - $this->jwsParserMock = $this->createMock(JwsParser::class); - $this->jwsParserMock->method('parse')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); + $this->jwsDecoratorBuilderMock->method('fromToken')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock->method('fromData')->willReturn($jwsDecoratorMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -96,30 +101,32 @@ protected function setUp(): void $this->validPayload = $this->expiredPayload; $this->validPayload['exp'] = time() + 3600; + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); } protected function sut( - ?JwsParser $jwsParser = null, + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, ?ClaimFactory $claimFactory = null, ): TrustMarkDelegationFactory { - $jwsParser ??= $this->jwsParserMock; + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; $claimFactory ??= $this->claimFactoryMock; return new TrustMarkDelegationFactory( - $jwsParser, + $jwsDecoratorBuilder, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, @@ -144,4 +151,21 @@ public function testCanBuild(): void $this->sut()->fromToken('token'), ); } + + + public function testCanBuildFromData(): void + { + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + + $this->assertInstanceOf( + TrustMarkDelegation::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::ES256, + $this->validPayload, + $this->sampleHeader, + ), + ); + } } diff --git a/tests/src/Federation/Factories/TrustMarkFactoryTest.php b/tests/src/Federation/Factories/TrustMarkFactoryTest.php index a1b2d76..5b818f3 100644 --- a/tests/src/Federation/Factories/TrustMarkFactoryTest.php +++ b/tests/src/Federation/Factories/TrustMarkFactoryTest.php @@ -10,15 +10,17 @@ use PHPUnit\Framework\Attributes\UsesClass; use PHPUnit\Framework\MockObject\MockObject; use PHPUnit\Framework\TestCase; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; use SimpleSAML\OpenID\Decorators\DateIntervalDecorator; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Federation\Factories\TrustMarkFactory; use SimpleSAML\OpenID\Federation\TrustMark; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwk\JwkDecorator; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; @@ -31,11 +33,11 @@ final class TrustMarkFactoryTest extends TestCase { protected MockObject $signatureMock; - protected MockObject $jwsParserMock; + protected MockObject $jwsDecoratorBuilderMock; protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerMock; @@ -65,6 +67,8 @@ final class TrustMarkFactoryTest extends TestCase protected array $validPayload; + protected MockObject $jwkDecoratorMock; + protected function setUp(): void { @@ -78,11 +82,12 @@ protected function setUp(): void $jwsDecoratorMock = $this->createMock(JwsDecorator::class); $jwsDecoratorMock->method('jws')->willReturn($jwsMock); - $this->jwsParserMock = $this->createMock(JwsParser::class); - $this->jwsParserMock->method('parse')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); + $this->jwsDecoratorBuilderMock->method('fromToken')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock->method('fromData')->willReturn($jwsDecoratorMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -99,30 +104,32 @@ protected function setUp(): void $this->validPayload = $this->expiredPayload; $this->validPayload['exp'] = time() + 3600; + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); } protected function sut( - ?JwsParser $jwsParser = null, + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, ?ClaimFactory $claimFactory = null, ): TrustMarkFactory { - $jwsParser ??= $this->jwsParserMock; + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; $claimFactory ??= $this->claimFactoryMock; return new TrustMarkFactory( - $jwsParser, + $jwsDecoratorBuilder, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, @@ -137,7 +144,7 @@ public function testCanCreateInstance(): void } - public function testCanBuild(): void + public function testCanBuildFromToken(): void { $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); @@ -147,4 +154,21 @@ public function testCanBuild(): void $this->sut()->fromToken('token'), ); } + + + public function testCanBuildFromData(): void + { + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + + $this->assertInstanceOf( + TrustMark::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::ES256, + $this->validPayload, + $this->sampleHeader, + ), + ); + } } diff --git a/tests/src/Federation/Factories/TrustMarkStatusResponseFactoryTest.php b/tests/src/Federation/Factories/TrustMarkStatusResponseFactoryTest.php index e9d1cae..168f71b 100644 --- a/tests/src/Federation/Factories/TrustMarkStatusResponseFactoryTest.php +++ b/tests/src/Federation/Factories/TrustMarkStatusResponseFactoryTest.php @@ -15,10 +15,10 @@ use SimpleSAML\OpenID\Federation\Factories\TrustMarkStatusResponseFactory; use SimpleSAML\OpenID\Federation\TrustMarkStatusResponse; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; @@ -31,11 +31,11 @@ final class TrustMarkStatusResponseFactoryTest extends TestCase { protected MockObject $signatureMock; - protected MockObject $jwsParserMock; + protected MockObject $jwsDecoratorBuilderMock; protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerMock; @@ -73,11 +73,11 @@ protected function setUp(): void $jwsDecoratorMock = $this->createMock(JwsDecorator::class); $jwsDecoratorMock->method('jws')->willReturn($jwsMock); - $this->jwsParserMock = $this->createMock(JwsParser::class); - $this->jwsParserMock->method('parse')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); + $this->jwsDecoratorBuilderMock->method('fromToken')->willReturn($jwsDecoratorMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -95,26 +95,26 @@ protected function setUp(): void protected function sut( - ?JwsParser $jwsParser = null, + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, ?ClaimFactory $claimFactory = null, ): TrustMarkStatusResponseFactory { - $jwsParser ??= $this->jwsParserMock; + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; $claimFactory ??= $this->claimFactoryMock; return new TrustMarkStatusResponseFactory( - $jwsParser, + $jwsDecoratorBuilder, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, diff --git a/tests/src/Federation/MetadataPolicyApplicatorTest.php b/tests/src/Federation/MetadataPolicyApplicatorTest.php index 9c97bee..3b26a24 100644 --- a/tests/src/Federation/MetadataPolicyApplicatorTest.php +++ b/tests/src/Federation/MetadataPolicyApplicatorTest.php @@ -6,7 +6,6 @@ use PHPUnit\Framework\Attributes\CoversClass; use PHPUnit\Framework\Attributes\UsesClass; -use PHPUnit\Framework\MockObject\MockObject; use PHPUnit\Framework\TestCase; use SimpleSAML\OpenID\Codebooks\MetadataPolicyOperatorsEnum; use SimpleSAML\OpenID\Exceptions\MetadataPolicyException; @@ -15,9 +14,11 @@ #[CoversClass(MetadataPolicyApplicator::class)] #[UsesClass(MetadataPolicyOperatorsEnum::class)] +#[UsesClass(Helpers::class)] +#[UsesClass(Helpers\Arr::class)] final class MetadataPolicyApplicatorTest extends TestCase { - protected MockObject $helpersMock; + protected Helpers $helpers; protected array $metadataPolicySample = [ 'grant_types' => [ @@ -70,21 +71,21 @@ final class MetadataPolicyApplicatorTest extends TestCase ]; + protected function setUp(): void + { + $this->helpers = new Helpers(); + } + + protected function sut( ?Helpers $helpers = null, ): MetadataPolicyApplicator { - $helpers ??= $this->helpersMock; + $helpers ??= $this->helpers; return new MetadataPolicyApplicator($helpers); } - protected function setUp(): void - { - $this->helpersMock = $this->createMock(Helpers::class); - } - - public function testCanCreateInstance(): void { $this->assertInstanceOf(MetadataPolicyApplicator::class, $this->sut()); diff --git a/tests/src/Federation/MetadataPolicyResolverTest.php b/tests/src/Federation/MetadataPolicyResolverTest.php index c7afc8c..9b2a3ae 100644 --- a/tests/src/Federation/MetadataPolicyResolverTest.php +++ b/tests/src/Federation/MetadataPolicyResolverTest.php @@ -6,7 +6,6 @@ use PHPUnit\Framework\Attributes\CoversClass; use PHPUnit\Framework\Attributes\UsesClass; -use PHPUnit\Framework\MockObject\MockObject; use PHPUnit\Framework\TestCase; use SimpleSAML\OpenID\Codebooks\EntityTypesEnum; use SimpleSAML\OpenID\Codebooks\MetadataPolicyOperatorsEnum; @@ -16,9 +15,11 @@ #[CoversClass(MetadataPolicyResolver::class)] #[UsesClass(MetadataPolicyOperatorsEnum::class)] +#[UsesClass(Helpers::class)] +#[UsesClass(Helpers\Arr::class)] final class MetadataPolicyResolverTest extends TestCase { - protected MockObject $helpersMock; + protected Helpers $helpers; protected array $trustAnchorMetadataPolicySample = [ 'openid_relying_party' => [ @@ -63,14 +64,14 @@ final class MetadataPolicyResolverTest extends TestCase protected function setUp(): void { - $this->helpersMock = $this->createMock(Helpers::class); + $this->helpers = new Helpers(); } protected function sut( ?Helpers $helpers = null, ): MetadataPolicyResolver { - $helpers ??= $this->helpersMock; + $helpers ??= $this->helpers; return new MetadataPolicyResolver($helpers); } diff --git a/tests/src/Federation/RequestObjectTest.php b/tests/src/Federation/RequestObjectTest.php index a77d77f..c7d6747 100644 --- a/tests/src/Federation/RequestObjectTest.php +++ b/tests/src/Federation/RequestObjectTest.php @@ -15,7 +15,7 @@ use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Federation\RequestObject; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; @@ -29,7 +29,7 @@ final class RequestObjectTest extends TestCase protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -69,7 +69,7 @@ protected function setUp(): void $this->jwsDecoratorMock->method('jws')->willReturn($jwsMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -92,7 +92,7 @@ protected function setUp(): void protected function sut( ?JwsDecorator $jwsDecorator = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, @@ -100,7 +100,7 @@ protected function sut( ): RequestObject { $jwsDecorator ??= $this->jwsDecoratorMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; @@ -109,7 +109,7 @@ protected function sut( return new RequestObject( $jwsDecorator, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, diff --git a/tests/src/Federation/TrustMarkDelegationTest.php b/tests/src/Federation/TrustMarkDelegationTest.php index 894e527..9a21b8a 100644 --- a/tests/src/Federation/TrustMarkDelegationTest.php +++ b/tests/src/Federation/TrustMarkDelegationTest.php @@ -14,7 +14,7 @@ use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Federation\TrustMarkDelegation; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; @@ -30,7 +30,7 @@ final class TrustMarkDelegationTest extends TestCase protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -75,7 +75,7 @@ protected function setUp(): void $this->jwsDecoratorMock->method('jws')->willReturn($jwsMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -98,7 +98,7 @@ protected function setUp(): void protected function sut( ?JwsDecorator $jwsDecorator = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, @@ -106,7 +106,7 @@ protected function sut( ): TrustMarkDelegation { $jwsDecorator ??= $this->jwsDecoratorMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; @@ -115,7 +115,7 @@ protected function sut( return new TrustMarkDelegation( $jwsDecorator, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, diff --git a/tests/src/Federation/TrustMarkStatusResponseTest.php b/tests/src/Federation/TrustMarkStatusResponseTest.php index 7963055..2f73a6d 100644 --- a/tests/src/Federation/TrustMarkStatusResponseTest.php +++ b/tests/src/Federation/TrustMarkStatusResponseTest.php @@ -15,7 +15,7 @@ use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Federation\TrustMarkStatusResponse; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; @@ -31,7 +31,7 @@ final class TrustMarkStatusResponseTest extends TestCase protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -71,7 +71,7 @@ protected function setUp(): void $this->jwsDecoratorMock->method('jws')->willReturn($jwsMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -91,7 +91,7 @@ protected function setUp(): void protected function sut( ?JwsDecorator $jwsDecorator = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, @@ -99,7 +99,7 @@ protected function sut( ): TrustMarkStatusResponse { $jwsDecorator ??= $this->jwsDecoratorMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; @@ -108,7 +108,7 @@ protected function sut( return new TrustMarkStatusResponse( $jwsDecorator, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, diff --git a/tests/src/Federation/TrustMarkTest.php b/tests/src/Federation/TrustMarkTest.php index 948bde1..34968d4 100644 --- a/tests/src/Federation/TrustMarkTest.php +++ b/tests/src/Federation/TrustMarkTest.php @@ -16,7 +16,7 @@ use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Federation\TrustMark; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; @@ -32,7 +32,7 @@ final class TrustMarkTest extends TestCase protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -78,7 +78,7 @@ protected function setUp(): void $this->jwsDecoratorMock->method('jws')->willReturn($jwsMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -103,7 +103,7 @@ protected function setUp(): void protected function sut( ?JwsDecorator $jwsDecorator = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, @@ -112,7 +112,7 @@ protected function sut( ): TrustMark { $jwsDecorator ??= $this->jwsDecoratorMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; @@ -122,7 +122,7 @@ protected function sut( return new TrustMark( $jwsDecorator, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, diff --git a/tests/src/FederationTest.php b/tests/src/FederationTest.php index 1d09c68..5a895ea 100644 --- a/tests/src/FederationTest.php +++ b/tests/src/FederationTest.php @@ -36,11 +36,11 @@ use SimpleSAML\OpenID\Federation\TrustMarkStatusResponseFetcher; use SimpleSAML\OpenID\Federation\TrustMarkValidator; use SimpleSAML\OpenID\Jws\AbstractJwsFetcher; -use SimpleSAML\OpenID\Jws\Factories\JwsParserFactory; +use SimpleSAML\OpenID\Jws\Factories\JwsDecoratorBuilderFactory; use SimpleSAML\OpenID\Jws\Factories\JwsVerifierDecoratorFactory; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsFetcher; -use SimpleSAML\OpenID\Jws\JwsParser; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; use SimpleSAML\OpenID\SupportedAlgorithms; @@ -59,8 +59,8 @@ #[UsesClass(TrustMarkFactory::class)] #[UsesClass(AlgorithmManagerDecoratorFactory::class)] #[UsesClass(JwsSerializerManagerDecoratorFactory::class)] -#[UsesClass(JwsParserFactory::class)] -#[UsesClass(JwsParser::class)] +#[UsesClass(JwsDecoratorBuilderFactory::class)] +#[UsesClass(JwsDecoratorBuilder::class)] #[UsesClass(JwsVerifierDecoratorFactory::class)] #[UsesClass(DateIntervalDecorator::class)] #[UsesClass(DateIntervalDecoratorFactory::class)] diff --git a/tests/src/Helpers/ArrTest.php b/tests/src/Helpers/ArrTest.php index 6bd3c0f..9d29882 100644 --- a/tests/src/Helpers/ArrTest.php +++ b/tests/src/Helpers/ArrTest.php @@ -84,4 +84,81 @@ public function testGetNestedValueThrowsIfTooDeep(): void $arr = []; $this->sut()->getNestedValue($arr, ...range(0, 100)); } + + + public function testCanGetNestedValueReference(): void + { + $arr = []; + $this->sut()->getNestedValueReference($arr, 'a', 'b', 'c'); + $this->assertIsArray($arr['a']['b']); + $this->assertIsArray($arr['a']['b']['c']); + + $arr = ['a' => ['b' => 'c']]; + $reference = $this->sut()->getNestedValueReference($arr, 'a', 'b'); + $this->assertSame('c', $reference); + } + + + public function testGetNestedValueThrowsForNonArrayPathElements(): void + { + $this->expectException(OpenIDException::class); + $this->expectExceptionMessage('non-array'); + + $arr = ['a' => ['b' => 'c']]; + $this->sut()->getNestedValueReference($arr, 'a', 'b', 'c'); + } + + + public function testCanSetNestedValue(): void + { + $arr = []; + $this->sut()->setNestedValue($arr, 'b'); + $this->assertSame([], $arr); + + $arr = []; + $this->sut()->setNestedValue($arr, 'b', 'a'); + $this->assertSame(['a' => 'b'], $arr); + + $arr = []; + $this->sut()->setNestedValue($arr, 'c', 'a', 'b'); + $this->assertSame(['a' => ['b' => 'c']], $arr); + } + + + public function testCanAddNestedValue(): void + { + $arr = []; + $this->sut()->addNestedValue($arr, 'b'); + $this->assertSame(['b'], $arr); + + $arr = []; + $this->sut()->addNestedValue($arr, 'b', 'a'); + $this->assertSame(['a' => ['b']], $arr); + + $arr = ['a' => []]; + $this->sut()->addNestedValue($arr, 'b', 'a'); + $this->assertSame(['a' => ['b']], $arr); + + $arr = ['a' => ['b']]; + $this->sut()->addNestedValue($arr, 'c', 'a'); + $this->assertSame(['a' => ['b', 'c']], $arr); + + $arr = ['a' => ['b']]; + $this->sut()->addNestedValue($arr, 'c', 'a', 'b'); + $this->assertSame(['a' => ['b', 'b' => ['c']]], $arr); + + $arr = ['a' => ['b']]; + $this->sut()->addNestedValue($arr, ['c'], 'a', 'b'); + $this->assertSame(['a' => ['b', 'b' => [['c']]]], $arr); + } + + + public function testAddNestedValueThrowsForNonArrayPathElements(): void + { + $this->expectException(OpenIDException::class); + $this->expectExceptionMessage('non-array'); + + $arr = ['a' => 'b']; + $this->sut()->addNestedValue($arr, 'c', 'a'); + } } diff --git a/tests/src/Helpers/Base64UrlTest.php b/tests/src/Helpers/Base64UrlTest.php new file mode 100644 index 0000000..33bfc61 --- /dev/null +++ b/tests/src/Helpers/Base64UrlTest.php @@ -0,0 +1,82 @@ +assertSame('', $this->sut()->encode('')); + $this->assertSame('Zg', $this->sut()->encode('f')); // Zg== + $this->assertSame('Zm8', $this->sut()->encode('fo')); // Zm8= + $this->assertSame('Zm9v', $this->sut()->encode('foo')); // Zm9v + $this->assertSame('Zm9vYg', $this->sut()->encode('foob')); // Zm9vYg== -> trimmed + $this->assertSame('Zm9vYmE', $this->sut()->encode('fooba')); + $this->assertSame('Zm9vYmFy', $this->sut()->encode('foobar')); + + // Ensure + becomes - and / becomes _ + $this->assertSame('-w', $this->sut()->encode("\xFB")); // +w== -> -w + $this->assertSame('_w', $this->sut()->encode("\xFF")); // /w== -> _w + $this->assertSame('-_8', $this->sut()->encode("\xFB\xFF")); // +/8= -> -_8 + } + + + public function testDecodeReversesEncodeAndHandlesPadding(): void + { + // Simple known mappings + $this->assertSame('', $this->sut()->decode('')); + $this->assertSame('f', $this->sut()->decode('Zg')); + $this->assertSame('fo', $this->sut()->decode('Zm8')); + $this->assertSame('foo', $this->sut()->decode('Zm9v')); + $this->assertSame('foob', $this->sut()->decode('Zm9vYg')); + $this->assertSame('fooba', $this->sut()->decode('Zm9vYmE')); + $this->assertSame('foobar', $this->sut()->decode('Zm9vYmFy')); + + // Characters that require translation + $this->assertSame("\xFB", $this->sut()->decode('-w')); + $this->assertSame("\xFF", $this->sut()->decode('_w')); + $this->assertSame("\xFB\xFF", $this->sut()->decode('-_8')); + } + + + public function testRoundTripVariousInputs(): void + { + $inputs = [ + '', + 'a', 'ab', 'abc', 'abcd', 'abcde', + "\x00\x01\x02\x03", // binary + 'The quick brown fox jumps over the lazy dog', + '✓ àéîöū', // Latin-1/UTF-8 mix + 'Привет мир', // Cyrillic + '你好，世界', // Chinese + 'emoji: 🚀🔥', + ]; + + foreach ($inputs as $input) { + $encoded = $this->sut()->encode($input); + $decoded = $this->sut()->decode($encoded); + $this->assertSame($input, $decoded, 'Round-trip failed for input: ' . $input); + } + } + + + public function testDecodeThrowsOnInvalidInput(): void + { + $this->expectException(\InvalidArgumentException::class); + $this->expectExceptionMessage('Invalid Base64URL encoded data'); + $this->sut()->decode('abc*'); // '*' is not a valid Base64URL character + } +} diff --git a/tests/src/Helpers/DateTimeTest.php b/tests/src/Helpers/DateTimeTest.php new file mode 100644 index 0000000..c191752 --- /dev/null +++ b/tests/src/Helpers/DateTimeTest.php @@ -0,0 +1,93 @@ +fromXsDateTime($input, new DateTimeZone('UTC')); + $expected = new NativeDateTimeImmutable($input, new DateTimeZone('UTC')); + + $this->assertSame($expected->getTimestamp(), $result->getTimestamp()); + $this->assertSame($expected->format('u'), $result->format('u')); // microseconds + $this->assertSame($expected->format('P'), $result->format('P')); // timezone offset + } + + + public function testFromXsDateTimeFallsBackToAtomWithoutMicroseconds(): void + { + $helper = new DateTimeHelper(); + $input = '2024-03-01T12:34:56+02:00'; + + $result = $helper->fromXsDateTime($input, new DateTimeZone('UTC')); + $expected = new NativeDateTimeImmutable($input, new DateTimeZone('UTC')); + + $this->assertSame($expected->getTimestamp(), $result->getTimestamp()); + $this->assertSame($expected->format('P'), $result->format('P')); + } + + + public function testFromXsDateTimeFallsBackToConstructorIso8601Zulu(): void + { + $helper = new DateTimeHelper(); + $input = '2024-03-01T12:34:56Z'; + + $result = $helper->fromXsDateTime($input, new DateTimeZone('Europe/Prague')); + $expected = new NativeDateTimeImmutable($input, new DateTimeZone('Europe/Prague')); + + $this->assertSame($expected->getTimestamp(), $result->getTimestamp()); + $this->assertSame('+00:00', $result->format('P')); + } + + + public function testFromXsDateTimeUsesProvidedTimezoneWhenInputHasNoOffset(): void + { + $helper = new DateTimeHelper(); + $input = '2024-03-01T12:34:56'; // no timezone info in the string + $tz = new DateTimeZone('UTC'); + + $result = $helper->fromXsDateTime($input, $tz); + $expected = new NativeDateTimeImmutable($input, $tz); + + $this->assertSame($expected->getTimestamp(), $result->getTimestamp()); + $this->assertSame('+00:00', $result->format('P')); + } + + + public function testGetUtcReturnsDateInUtc(): void + { + $helper = new DateTimeHelper(); + $input = '2024-03-01 12:00:00'; + + $result = $helper->getUtc($input); + $expected = new NativeDateTimeImmutable($input, new DateTimeZone('UTC')); + + $this->assertSame($expected->getTimestamp(), $result->getTimestamp()); + $this->assertSame('+00:00', $result->format('P')); + } + + + public function testFromTimestampCreatesUtcDateTime(): void + { + $helper = new DateTimeHelper(); + $timestamp = 1_728_000; // 20 days after epoch + + $result = $helper->fromTimestamp($timestamp); + + $this->assertSame($timestamp, $result->getTimestamp()); + $this->assertSame('+00:00', $result->format('P')); + } +} diff --git a/tests/src/Helpers/HashTest.php b/tests/src/Helpers/HashTest.php new file mode 100644 index 0000000..7c4522a --- /dev/null +++ b/tests/src/Helpers/HashTest.php @@ -0,0 +1,27 @@ +for($algorithm, $data, $binary, $options); + + $this->assertSame($expected, $actual); + } +} diff --git a/tests/src/Helpers/RandomTest.php b/tests/src/Helpers/RandomTest.php new file mode 100644 index 0000000..9a48bc7 --- /dev/null +++ b/tests/src/Helpers/RandomTest.php @@ -0,0 +1,63 @@ +random = new Random(); + } + + + public function testLength(): void + { + $this->assertSame(80, strlen($this->random->string(40))); + } + + + public function testLengthWithPrefixAndSuffix(): void + { + $this->assertSame(92, strlen($this->random->string(40, null, 'prefix', 'suffix'))); + } + + + public function testInvalidLength(): void + { + $this->expectException(OpenIdException::class); + $this->random->string(0); + } + + + public function testBlacklist(): void + { + // This test is tricky because of the random nature. + // We can't guarantee a collision. + // We can try to mock random_bytes, but that's also complex. + // For now, we'll just test that it *can* return a value + // even with a blocklist. + $randomString = $this->random->string(40, ['some-blacklisted-string']); + $this->assertSame(80, strlen($randomString)); + } + + + public function testPrefixAndSuffix(): void + { + $randomString = $this->random->string(10, null, 'prefix-', '-suffix'); + $this->assertStringStartsWith('prefix-', $randomString); + $this->assertStringEndsWith('-suffix', $randomString); + // The random part is 10 bytes, which is 20 hex characters. + $this->assertSame(20 + 7 + 7, strlen($randomString)); + } +} diff --git a/tests/src/Helpers/TypeTest.php b/tests/src/Helpers/TypeTest.php index 4a88e15..2416ea0 100644 --- a/tests/src/Helpers/TypeTest.php +++ b/tests/src/Helpers/TypeTest.php @@ -147,7 +147,7 @@ public function testCanEnsureArrayWithKeysAsStrings(): void $this->sut()->ensureArrayWithKeysAsStrings([0, 1, 2]), ); - // Test call for nested array + // Test call for a nested array $this->assertSame( [['0' => 0, '1' => 1], ['0' => 2, '1' => 3]], array_map( @@ -173,7 +173,7 @@ public function testCanEnsureArrayWithKeysAsNonEmptyStrings(): void $this->sut()->ensureArrayWithKeysAsNonEmptyStrings([0, 1, 2]), ); - // Test call for nested array + // Test call for a nested array $this->assertSame( [['0' => 0, '1' => 1], ['0' => 2, '1' => 3]], array_map( @@ -218,7 +218,7 @@ public function testCanEnsureArrayWithKeysAndValuesAsNonEmptyStrings(): void $this->sut()->ensureArrayWithKeysAndValuesAsNonEmptyStrings([0, 1, 2]), ); - // Test call for nested array + // Test call for a nested array $this->assertSame( [['0' => '0', '1' => '1'], ['0' => '2', '1' => '3']], array_map( @@ -243,4 +243,93 @@ public function testEnsureIntThrowsForNonNull(): void $this->sut()->ensureInt(null); } + + + public function testCanEnforceRegex(): void + { + $this->assertSame('a', $this->sut()->enforceRegex('a', '/^a$/')); + } + + + public function testEnforceRegexThrowsForInvalidValue(): void + { + $this->expectException(InvalidValueException::class); + $this->expectExceptionMessage('Regex'); + + $this->sut()->enforceRegex('a', '/^b$/'); + } + + + public function testCanEnforceUri(): void + { + $this->assertSame('https://example.com', $this->sut()->enforceUri('https://example.com')); + } + + + public function testEnforceUriThrowsForInvalidValue(): void + { + $this->expectException(InvalidValueException::class); + $this->expectExceptionMessage('URI'); + + $this->sut()->enforceUri('a'); + } + + + public function testCanEnforceArrayOfArrays(): void + { + $a = ['a' => ['b' => 'c']]; + $this->assertSame($a, $this->sut()->enforceArrayOfArrays($a)); + } + + + public function testEnforceArrayOfArraysThrowsForInvalidValue(): void + { + $this->expectException(InvalidValueException::class); + $this->expectExceptionMessage('Non-array'); + $this->sut()->enforceArrayOfArrays(['a' => 'b']); + ; + } + + + public function testCanEnforceNonEmptyArray(): void + { + $this->assertSame(['a'], $this->sut()->enforceNonEmptyArray(['a'])); + } + + + public function testEnforceNonEmptyArrayThrowsForInvalidValue(): void + { + $this->expectException(InvalidValueException::class); + $this->expectExceptionMessage('Empty'); + $this->sut()->enforceNonEmptyArray([]); + } + + + public function testCanEnforceNonEmptyArrayWithValuesAsNonEmptyStrings(): void + { + $this->assertSame(['a'], $this->sut()->enforceNonEmptyArrayWithValuesAsNonEmptyStrings(['a'])); + } + + + public function testEnforceNonEmptyArrayWithValuesAsNonEmptyStringsThrowsForInvalidValue(): void + { + $this->expectException(InvalidValueException::class); + $this->expectExceptionMessage('Empty'); + $this->sut()->enforceNonEmptyArrayWithValuesAsNonEmptyStrings([]); + } + + + public function testCanEnforceNonEmptyArrayOfNonEmptyArrays(): void + { + $a = [['a' => 'b']]; + $this->assertSame($a, $this->sut()->enforceNonEmptyArrayOfNonEmptyArrays($a)); + } + + + public function testEnforceNonEmptyArrayOfNonEmptyArraysThrowsForInvalidValue(): void + { + $this->expectException(InvalidValueException::class); + $this->expectExceptionMessage('Non-array'); + $this->sut()->enforceNonEmptyArrayOfNonEmptyArrays(['a' => 'b']); + } } diff --git a/tests/src/HelpersTest.php b/tests/src/HelpersTest.php index 38cad5d..64bc9c1 100644 --- a/tests/src/HelpersTest.php +++ b/tests/src/HelpersTest.php @@ -9,7 +9,11 @@ use PHPUnit\Framework\TestCase; use SimpleSAML\OpenID\Helpers; use SimpleSAML\OpenID\Helpers\Arr; +use SimpleSAML\OpenID\Helpers\Base64Url; +use SimpleSAML\OpenID\Helpers\DateTime; +use SimpleSAML\OpenID\Helpers\Hash; use SimpleSAML\OpenID\Helpers\Json; +use SimpleSAML\OpenID\Helpers\Random; use SimpleSAML\OpenID\Helpers\Type; use SimpleSAML\OpenID\Helpers\Url; @@ -40,5 +44,9 @@ public function testCanBuildTools(): void $this->assertInstanceOf(Json::class, $sut->json()); $this->assertInstanceOf(Arr::class, $sut->arr()); $this->assertInstanceOf(Type::class, $sut->type()); + $this->assertInstanceOf(DateTime::class, $sut->dateTime()); + $this->assertInstanceOf(Base64Url::class, $sut->base64Url()); + $this->assertInstanceOf(Hash::class, $sut->hash()); + $this->assertInstanceOf(Random::class, $sut->random()); } } diff --git a/tests/src/Jwk/Factories/JwkDecoratorFactoryTest.php b/tests/src/Jwk/Factories/JwkDecoratorFactoryTest.php new file mode 100644 index 0000000..746285b --- /dev/null +++ b/tests/src/Jwk/Factories/JwkDecoratorFactoryTest.php @@ -0,0 +1,91 @@ +sut()->fromData(['kty' => 'oct', 'k' => 'abc']); + + $this->assertInstanceOf(JwkDecorator::class, $decorator); + $this->assertInstanceOf(JWK::class, $decorator->jwk()); + } + + + public function testFromDataPassesValuesToUnderlyingJwk(): void + { + $data = ['kty' => 'oct', 'k' => 'xyz', 'alg' => 'HS256']; + $decorator = $this->sut()->fromData($data); + + $this->assertSame($data, $decorator->jwk()->all()); + } + + + public function testFromDataThrowsWhenKtyIsMissing(): void + { + $this->expectException(InvalidArgumentException::class); + $this->sut()->fromData(['alg' => 'HS256']); + } + + + public function testFromPkcs1Or8KeyFileThrowsOnMissingFile(): void + { + $this->expectException(InvalidArgumentException::class); + // Non-existing file path should cause KeyConverter to fail reading the file + @$this->sut()->fromPkcs1Or8KeyFile(__DIR__ . DIRECTORY_SEPARATOR . 'no_such_key.pem'); + } + + + public function testFromPkcs12CertificateFileThrowsOnMissingFile(): void + { + // The vendor code wraps any error into a RuntimeException with a generic message + $this->expectException(RuntimeException::class); + @$this->sut()->fromPkcs12CertificateFile(__DIR__ . DIRECTORY_SEPARATOR . 'no_such_cert.p12', 'secret'); + } + + + public function testFromX509CertificateFileThrowsOnMissingFile(): void + { + $this->expectException(InvalidArgumentException::class); + @$this->sut()->fromX509CertificateFile(__DIR__ . DIRECTORY_SEPARATOR . 'no_such_cert.crt'); + } + + + public function testFromPkcs1Or8KeyThrowsOnInvalidKeyString(): void + { + // Depending on the environment (OpenSSL availability), the vendor may throw RuntimeException or + // InvalidArgumentException + $this->expectException(Throwable::class); + $this->sut()->fromPkcs1Or8Key('not a valid key'); + } + + + public function testFromX509CertificateThrowsOnInvalidCertificateString(): void + { + // Depending on the environment (OpenSSL availability), the vendor may throw RuntimeException or + // InvalidArgumentException + $this->expectException(Throwable::class); + $this->sut()->fromX509Certificate('not a valid certificate'); + } +} diff --git a/tests/src/Jwk/JwkDecoratorTest.php b/tests/src/Jwk/JwkDecoratorTest.php new file mode 100644 index 0000000..a4018bc --- /dev/null +++ b/tests/src/Jwk/JwkDecoratorTest.php @@ -0,0 +1,50 @@ +jwkMock = $this->createMock(JWK::class); + } + + + protected function sut( + ?JWK $jwk = null, + ): JwkDecorator { + $jwk ??= $this->jwkMock; + + return new JwkDecorator($jwk); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf( + JwkDecorator::class, + $this->sut(), + ); + } + + + public function testCanGetJwk(): void + { + $this->assertSame( + $this->jwkMock, + $this->sut()->jwk(), + ); + } +} diff --git a/tests/src/JwkTest.php b/tests/src/JwkTest.php new file mode 100644 index 0000000..82a2d1a --- /dev/null +++ b/tests/src/JwkTest.php @@ -0,0 +1,33 @@ +assertInstanceOf(Jwk::class, $this->sut()); + } + + + public function testCanBuildTools(): void + { + $this->assertInstanceOf( + JwkDecoratorFactory::class, + $this->sut()->jwkDecoratorFactory(), + ); + } +} diff --git a/tests/src/Jwks/Factories/JwksFactoryTest.php b/tests/src/Jwks/Factories/JwksDecoratorFactoryTest.php similarity index 75% rename from tests/src/Jwks/Factories/JwksFactoryTest.php rename to tests/src/Jwks/Factories/JwksDecoratorFactoryTest.php index 79ba0cc..8fc0e19 100644 --- a/tests/src/Jwks/Factories/JwksFactoryTest.php +++ b/tests/src/Jwks/Factories/JwksDecoratorFactoryTest.php @@ -8,13 +8,13 @@ use PHPUnit\Framework\Attributes\UsesClass; use PHPUnit\Framework\TestCase; use SimpleSAML\OpenID\Jwks; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jwks\JwksDecorator; -#[CoversClass(JwksFactory::class)] +#[CoversClass(JwksDecoratorFactory::class)] #[UsesClass(JwksDecorator::class)] -#[UsesClass(JwksFactory::class)] -final class JwksFactoryTest extends TestCase +#[UsesClass(JwksDecoratorFactory::class)] +final class JwksDecoratorFactoryTest extends TestCase { protected array $jwksArraySample = [ 'keys' => [ @@ -36,20 +36,20 @@ protected function setUp(): void } - protected function sut(): JwksFactory + protected function sut(): JwksDecoratorFactory { - return new JwksFactory(); + return new JwksDecoratorFactory(); } public function testCanCreateInstance(): void { - $this->assertInstanceOf(JwksFactory::class, $this->sut()); + $this->assertInstanceOf(JwksDecoratorFactory::class, $this->sut()); } public function testCanBuildFromKeyData(): void { - $this->assertInstanceOf(Jwks\JwksDecorator::class, $this->sut()->fromKeyData($this->jwksArraySample)); + $this->assertInstanceOf(Jwks\JwksDecorator::class, $this->sut()->fromKeySetData($this->jwksArraySample)); } } diff --git a/tests/src/Jwks/Factories/SignedJwksFactoryTest.php b/tests/src/Jwks/Factories/SignedJwksFactoryTest.php index f8b6a90..a41c6a5 100644 --- a/tests/src/Jwks/Factories/SignedJwksFactoryTest.php +++ b/tests/src/Jwks/Factories/SignedJwksFactoryTest.php @@ -10,15 +10,17 @@ use PHPUnit\Framework\Attributes\UsesClass; use PHPUnit\Framework\MockObject\MockObject; use PHPUnit\Framework\TestCase; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; use SimpleSAML\OpenID\Decorators\DateIntervalDecorator; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwk\JwkDecorator; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jwks\Factories\SignedJwksFactory; use SimpleSAML\OpenID\Jwks\SignedJwks; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; @@ -31,11 +33,11 @@ final class SignedJwksFactoryTest extends TestCase { protected MockObject $signatureMock; - protected MockObject $jwsParserMock; + protected MockObject $jwsDecoratorBuilderMock; protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -74,6 +76,8 @@ final class SignedJwksFactoryTest extends TestCase protected array $validPayload; + protected MockObject $jwkDecoratorMock; + protected function setUp(): void { @@ -87,11 +91,12 @@ protected function setUp(): void $jwsDecoratorMock = $this->createMock(JwsDecorator::class); $jwsDecoratorMock->method('jws')->willReturn($jwsMock); - $this->jwsParserMock = $this->createMock(JwsParser::class); - $this->jwsParserMock->method('parse')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); + $this->jwsDecoratorBuilderMock->method('fromToken')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock->method('fromData')->willReturn($jwsDecoratorMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); $this->helpersMock = $this->createMock(Helpers::class); @@ -108,30 +113,32 @@ protected function setUp(): void $this->validPayload = $this->expiredPayload; $this->validPayload['exp'] = time() + 3600; + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); } protected function sut( - ?JwsParser $jwsParser = null, + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, ?ClaimFactory $claimFactory = null, ): SignedJwksFactory { - $jwsParser ??= $this->jwsParserMock; + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; $claimFactory ??= $this->claimFactoryMock; return new SignedJwksFactory( - $jwsParser, + $jwsDecoratorBuilder, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, @@ -156,4 +163,21 @@ public function testCanBuildFromToken(): void $this->sut()->fromToken('token'), ); } + + + public function testCanBuildFromData(): void + { + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + + $this->assertInstanceOf( + SignedJwks::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::RS256, + $this->validPayload, + $this->sampleHeader, + ), + ); + } } diff --git a/tests/src/Jwks/JwksFetcherTest.php b/tests/src/Jwks/JwksFetcherTest.php index 0e57060..a2f3e76 100644 --- a/tests/src/Jwks/JwksFetcherTest.php +++ b/tests/src/Jwks/JwksFetcherTest.php @@ -19,7 +19,7 @@ use SimpleSAML\OpenID\Exceptions\HttpException; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jwks\Factories\SignedJwksFactory; use SimpleSAML\OpenID\Jwks\JwksDecorator; use SimpleSAML\OpenID\Jwks\JwksFetcher; @@ -30,7 +30,7 @@ final class JwksFetcherTest extends TestCase { protected MockObject $httpClientDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $signedJwksFactoryMock; @@ -72,7 +72,7 @@ final class JwksFetcherTest extends TestCase protected function setUp(): void { $this->httpClientDecoratorMock = $this->createMock(HttpClientDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->signedJwksFactoryMock = $this->createMock(SignedJwksFactory::class); $this->maxCacheDurationDecoratorMock = $this->createMock(DateIntervalDecorator::class); $this->helpersMock = $this->createMock(Helpers::class); @@ -98,7 +98,7 @@ protected function setUp(): void protected function sut( ?HttpClientDecorator $httpClientDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?SignedJwksFactory $signedJwksFactory = null, ?DateIntervalDecorator $maxCacheDurationDecorator = null, ?Helpers $helpers = null, @@ -107,7 +107,7 @@ protected function sut( ?LoggerInterface $logger = null, ): JwksFetcher { $httpClientDecorator ??= $this->httpClientDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $signedJwksFactory ??= $this->signedJwksFactoryMock; $maxCacheDurationDecorator ??= $this->maxCacheDurationDecoratorMock; $helpers ??= $this->helpersMock; @@ -117,7 +117,7 @@ protected function sut( return new JwksFetcher( $httpClientDecorator, - $jwksFactory, + $jwksDecoratorFactory, $signedJwksFactory, $maxCacheDurationDecorator, $helpers, @@ -152,7 +152,7 @@ public function testCanGetFromCache(): void ->method('getValue') ->willReturn($this->jwksArraySample); - $this->jwksFactoryMock->expects($this->once())->method('fromKeyData') + $this->jwksDecoratorFactoryMock->expects($this->once())->method('fromKeySetData') ->with($this->jwksArraySample); $this->assertInstanceOf(JwksDecorator::class, $this->sut()->fromCache('uri')); @@ -220,7 +220,7 @@ public function testCanGetFromJwksUri(): void ->method('getValue') ->willReturn($this->jwksArraySample); - $this->jwksFactoryMock->expects($this->once())->method('fromKeyData') + $this->jwksDecoratorFactoryMock->expects($this->once())->method('fromKeySetData') ->with($this->jwksArraySample); $this->cacheDecoratorMock->expects($this->once())->method('set') @@ -284,7 +284,7 @@ public function testJwksUriLogsErrorInCaseOfCacheSetError(): void ->method('getValue') ->willReturn($this->jwksArraySample); - $this->jwksFactoryMock->expects($this->once())->method('fromKeyData') + $this->jwksDecoratorFactoryMock->expects($this->once())->method('fromKeySetData') ->with($this->jwksArraySample); $this->cacheDecoratorMock->expects($this->once())->method('set') @@ -325,7 +325,7 @@ public function testCanGetFromCacheOrJwksUri(): void ->method('getValue') ->willReturn($this->jwksArraySample); - $this->jwksFactoryMock->expects($this->once())->method('fromKeyData') + $this->jwksDecoratorFactoryMock->expects($this->once())->method('fromKeySetData') ->with($this->jwksArraySample); $this->assertInstanceOf(JwksDecorator::class, $this->sut()->fromCacheOrJwksUri('uri')); @@ -352,7 +352,7 @@ public function testCanGetFromSignedJwksUri(): void ->with($this->jwksArraySample) ->willReturn('jwks-json'); - $this->jwksFactoryMock->expects($this->once())->method('fromKeyData') + $this->jwksDecoratorFactoryMock->expects($this->once())->method('fromKeySetData') ->with($this->jwksArraySample); $this->cacheDecoratorMock->expects($this->once())->method('set') @@ -385,7 +385,7 @@ public function testSignedJwksUriTakesExpClaimIntoAccountForCaching(): void ->with($this->jwksArraySample) ->willReturn('jwks-json'); - $this->jwksFactoryMock->expects($this->once())->method('fromKeyData') + $this->jwksDecoratorFactoryMock->expects($this->once())->method('fromKeySetData') ->with($this->jwksArraySample); $this->maxCacheDurationDecoratorMock->expects($this->once()) @@ -432,7 +432,7 @@ public function testSignedJwksUriLogsErrorOnCacheSetError(): void ->with($this->jwksArraySample) ->willReturn('jwks-json'); - $this->jwksFactoryMock->expects($this->once())->method('fromKeyData') + $this->jwksDecoratorFactoryMock->expects($this->once())->method('fromKeySetData') ->with($this->jwksArraySample); $this->cacheDecoratorMock->expects($this->once())->method('set') @@ -469,7 +469,7 @@ public function testCanGetFromCacheOrSignedJwksUri(): void ->with($this->jwksArraySample) ->willReturn('jwks-json'); - $this->jwksFactoryMock->expects($this->once())->method('fromKeyData') + $this->jwksDecoratorFactoryMock->expects($this->once())->method('fromKeySetData') ->with($this->jwksArraySample); $this->cacheDecoratorMock->expects($this->once())->method('set') diff --git a/tests/src/Jwks/SignedJwksTest.php b/tests/src/Jwks/SignedJwksTest.php index 94c0887..f4e0cd6 100644 --- a/tests/src/Jwks/SignedJwksTest.php +++ b/tests/src/Jwks/SignedJwksTest.php @@ -13,7 +13,7 @@ use SimpleSAML\OpenID\Decorators\DateIntervalDecorator; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jwks\SignedJwks; use SimpleSAML\OpenID\Jws\JwsDecorator; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; @@ -30,7 +30,7 @@ final class SignedJwksTest extends TestCase protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -83,7 +83,7 @@ protected function setUp(): void $this->jwsDecoratorMock->method('jws')->willReturn($jwsMock); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); @@ -106,7 +106,7 @@ protected function setUp(): void protected function sut( ?JwsDecorator $jwsDecorator = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, @@ -114,7 +114,7 @@ protected function sut( ): SignedJwks { $jwsDecorator ??= $this->jwsDecoratorMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; @@ -123,7 +123,7 @@ protected function sut( return new SignedJwks( $jwsDecorator, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, diff --git a/tests/src/JwksTest.php b/tests/src/JwksTest.php index 8362f67..5d5e01f 100644 --- a/tests/src/JwksTest.php +++ b/tests/src/JwksTest.php @@ -23,20 +23,20 @@ use SimpleSAML\OpenID\Factories\HttpClientDecoratorFactory; use SimpleSAML\OpenID\Factories\JwsSerializerManagerDecoratorFactory; use SimpleSAML\OpenID\Jwks; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jwks\Factories\SignedJwksFactory; use SimpleSAML\OpenID\Jwks\JwksFetcher; -use SimpleSAML\OpenID\Jws\Factories\JwsParserFactory; +use SimpleSAML\OpenID\Jws\Factories\JwsDecoratorBuilderFactory; use SimpleSAML\OpenID\Jws\Factories\JwsVerifierDecoratorFactory; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; use SimpleSAML\OpenID\SupportedAlgorithms; use SimpleSAML\OpenID\SupportedSerializers; #[CoversClass(Jwks::class)] -#[UsesClass(JwksFactory::class)] +#[UsesClass(JwksDecoratorFactory::class)] #[UsesClass(ParsedJwsFactory::class)] #[UsesClass(SignedJwksFactory::class)] #[UsesClass(JwksFetcher::class)] @@ -48,9 +48,9 @@ #[UsesClass(HttpClientDecoratorFactory::class)] #[UsesClass(AlgorithmManagerDecoratorFactory::class)] #[UsesClass(JwsSerializerManagerDecoratorFactory::class)] -#[UsesClass(JwsParserFactory::class)] +#[UsesClass(JwsDecoratorBuilderFactory::class)] #[UsesClass(JwsVerifierDecoratorFactory::class)] -#[UsesClass(JwsParser::class)] +#[UsesClass(JwsDecoratorBuilder::class)] #[UsesClass(AlgorithmManagerDecorator::class)] #[UsesClass(JwsVerifierDecorator::class)] #[UsesClass(JwsSerializerManagerDecorator::class)] @@ -123,7 +123,7 @@ public function testCanBuildTools(): void { $sut = $this->sut(); - $this->assertInstanceOf(JwksFactory::class, $sut->jwksFactory()); + $this->assertInstanceOf(JwksDecoratorFactory::class, $sut->jwksDecoratorFactory()); $this->assertInstanceOf(SignedJwksFactory::class, $sut->signedJwksFactory()); $this->assertInstanceOf(JwksFetcher::class, $sut->jwksFetcher()); } diff --git a/tests/src/Jws/Factories/JwsDecoratorBuilderFactoryTest.php b/tests/src/Jws/Factories/JwsDecoratorBuilderFactoryTest.php new file mode 100644 index 0000000..d6ad382 --- /dev/null +++ b/tests/src/Jws/Factories/JwsDecoratorBuilderFactoryTest.php @@ -0,0 +1,66 @@ +jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); + $this->algorithmManagerDecorator = new AlgorithmManagerDecorator( + new AlgorithmManager( // Final class, can't mock. + [new RS256()], + ), + ); + $this->helpersMock = $this->createMock(Helpers::class); + } + + + protected function sut(): JwsDecoratorBuilderFactory + { + return new JwsDecoratorBuilderFactory(); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(JwsDecoratorBuilderFactory::class, $this->sut()); + } + + + public function testCanBuild(): void + { + $this->assertInstanceOf( + JwsDecoratorBuilder::class, + $this->sut()->build( + $this->jwsSerializerManagerDecoratorMock, + $this->algorithmManagerDecorator, + $this->helpersMock, + ), + ); + } +} diff --git a/tests/src/Jws/Factories/JwsParserFactoryTest.php b/tests/src/Jws/Factories/JwsParserFactoryTest.php deleted file mode 100644 index 83ebd37..0000000 --- a/tests/src/Jws/Factories/JwsParserFactoryTest.php +++ /dev/null @@ -1,47 +0,0 @@ -jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); - } - - - protected function sut(): JwsParserFactory - { - return new JwsParserFactory(); - } - - - public function testCanCreateInstance(): void - { - $this->assertInstanceOf(JwsParserFactory::class, $this->sut()); - } - - - public function testCanBuild(): void - { - $this->assertInstanceOf( - JwsParser::class, - $this->sut()->build($this->jwsSerializerManagerDecoratorMock), - ); - } -} diff --git a/tests/src/Jws/Factories/ParsedJwsFactoryTest.php b/tests/src/Jws/Factories/ParsedJwsFactoryTest.php index c6bfbb2..79a0e6e 100644 --- a/tests/src/Jws/Factories/ParsedJwsFactoryTest.php +++ b/tests/src/Jws/Factories/ParsedJwsFactoryTest.php @@ -8,12 +8,14 @@ use PHPUnit\Framework\Attributes\UsesClass; use PHPUnit\Framework\MockObject\MockObject; use PHPUnit\Framework\TestCase; +use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum; use SimpleSAML\OpenID\Decorators\DateIntervalDecorator; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwk\JwkDecorator; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\Factories\ParsedJwsFactory; -use SimpleSAML\OpenID\Jws\JwsParser; +use SimpleSAML\OpenID\Jws\JwsDecoratorBuilder; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; use SimpleSAML\OpenID\Serializers\JwsSerializerManagerDecorator; @@ -22,11 +24,11 @@ #[UsesClass(ParsedJws::class)] final class ParsedJwsFactoryTest extends TestCase { - protected MockObject $jwsParserMock; + protected MockObject $jwsDecoratorBuilderMock; protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -36,40 +38,44 @@ final class ParsedJwsFactoryTest extends TestCase protected MockObject $claimFactoryMock; + protected MockObject $jwkDecoratorMock; + protected function setUp(): void { - $this->jwsParserMock = $this->createMock(JwsParser::class); + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); $this->helpersMock = $this->createMock(Helpers::class); $this->claimFactoryMock = $this->createMock(ClaimFactory::class); + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); } protected function sut( - ?JwsParser $jwsParser = null, + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $dateIntervalDecorator = null, ?Helpers $helpers = null, ?ClaimFactory $claimFactory = null, ): ParsedJwsFactory { - $jwsParser ??= $this->jwsParserMock; + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; $helpers ??= $this->helpersMock; $claimFactory ??= $this->claimFactoryMock; return new ParsedJwsFactory( - $jwsParser, + $jwsDecoratorBuilder, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $dateIntervalDecorator, $helpers, @@ -91,4 +97,18 @@ public function testCanBuildFromToken(): void $this->sut()->fromToken('token'), ); } + + + public function testCanBuildFromData(): void + { + $this->assertInstanceOf( + ParsedJws::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::RS256, + [], + [], + ), + ); + } } diff --git a/tests/src/Jws/JwsDecoratorBuilderTest.php b/tests/src/Jws/JwsDecoratorBuilderTest.php new file mode 100644 index 0000000..2fe13a2 --- /dev/null +++ b/tests/src/Jws/JwsDecoratorBuilderTest.php @@ -0,0 +1,119 @@ +jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); + $this->jwsBuilderMock = $this->createMock(JWSBuilder::class); + $this->helpersMock = $this->createMock(Helpers::class); + $this->jwsDecoratorMock = $this->createMock(JwsDecorator::class); + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); + } + + + protected function sut( + ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, + ?JwsBuilder $jwsBuilder = null, + ?Helpers $helpers = null, + ): JwsDecoratorBuilder { + $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; + $jwsBuilder ??= $this->jwsBuilderMock; + $helpers ??= $this->helpersMock; + + return new JwsDecoratorBuilder( + $jwsSerializerManagerDecorator, + $jwsBuilder, + $helpers, + ); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(JwsDecoratorBuilder::class, $this->sut()); + } + + + public function testCanParseToken(): void + { + $this->jwsSerializerManagerDecoratorMock->expects($this->once())->method('unserialize') + ->willReturn($this->jwsDecoratorMock); + + $this->assertInstanceOf(JwsDecorator::class, $this->sut()->fromToken('token')); + } + + + public function testThrowsOnTokenParseError(): void + { + $this->jwsSerializerManagerDecoratorMock->expects($this->once())->method('unserialize') + ->willThrowException(new \Exception('Error')); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('parse'); + + $this->sut()->fromToken('token'); + } + + + public function testCanBuildFromData(): void + { + $this->assertInstanceOf( + JwsDecorator::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::RS256, + [], + [], + ), + ); + } + + + public function testBuildFromDataThrowsJwsException(): void + { + $this->jwsBuilderMock->expects($this->once())->method('create') + ->willThrowException(new \Exception('Error')); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('build'); + + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::RS256, + [], + [], + ); + } +} diff --git a/tests/src/Jws/JwsParserTest.php b/tests/src/Jws/JwsParserTest.php deleted file mode 100644 index 8a50990..0000000 --- a/tests/src/Jws/JwsParserTest.php +++ /dev/null @@ -1,66 +0,0 @@ -jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); - $this->jwsDecoratorMock = $this->createMock(JwsDecorator::class); - } - - - protected function sut( - ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, - ): JwsParser { - $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; - - return new JwsParser($jwsSerializerManagerDecorator); - } - - - public function testCanCreateInstance(): void - { - $this->assertInstanceOf(JwsParser::class, $this->sut()); - } - - - public function testCanParseToken(): void - { - $this->jwsSerializerManagerDecoratorMock->expects($this->once())->method('unserialize') - ->willReturn($this->jwsDecoratorMock); - - $this->assertInstanceOf(JwsDecorator::class, $this->sut()->parse('token')); - } - - - public function testThrowsOnTokenParseError(): void - { - $this->jwsSerializerManagerDecoratorMock->expects($this->once())->method('unserialize') - ->willThrowException(new \Exception('Error')); - - $this->expectException(JwsException::class); - $this->expectExceptionMessage('parse'); - - $this->sut()->parse('token'); - } -} diff --git a/tests/src/Jws/ParsedJwsTest.php b/tests/src/Jws/ParsedJwsTest.php index d389e57..2895f47 100644 --- a/tests/src/Jws/ParsedJwsTest.php +++ b/tests/src/Jws/ParsedJwsTest.php @@ -13,7 +13,7 @@ use SimpleSAML\OpenID\Exceptions\JwsException; use SimpleSAML\OpenID\Factories\ClaimFactory; use SimpleSAML\OpenID\Helpers; -use SimpleSAML\OpenID\Jwks\Factories\JwksFactory; +use SimpleSAML\OpenID\Jwks\Factories\JwksDecoratorFactory; use SimpleSAML\OpenID\Jws\JwsDecorator; use SimpleSAML\OpenID\Jws\JwsVerifierDecorator; use SimpleSAML\OpenID\Jws\ParsedJws; @@ -26,7 +26,7 @@ final class ParsedJwsTest extends TestCase protected MockObject $jwsVerifierDecoratorMock; - protected MockObject $jwksFactoryMock; + protected MockObject $jwksDecoratorFactoryMock; protected MockObject $jwsSerializerManagerDecoratorMock; @@ -40,6 +40,8 @@ final class ParsedJwsTest extends TestCase protected MockObject $jsonHelperMock; + protected MockObject $arrHelperMock; + protected MockObject $claimFactoryMock; protected array $sampleHeader = [ @@ -106,7 +108,7 @@ protected function setUp(): void { $this->jwsDecoratorMock = $this->createMock(JwsDecorator::class); $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); - $this->jwksFactoryMock = $this->createMock(JwksFactory::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); $this->timestampValidationLeewayMock = $this->createMock(DateIntervalDecorator::class); $this->helpersMock = $this->createMock(Helpers::class); @@ -121,6 +123,8 @@ protected function setUp(): void $this->helpersMock->method('json')->willReturn($this->jsonHelperMock); $typeHelperMock = $this->createMock(Helpers\Type::class); $this->helpersMock->method('type')->willReturn($typeHelperMock); + $this->arrHelperMock = $this->createMock(Helpers\Arr::class); + $this->helpersMock->method('arr')->willReturn($this->arrHelperMock); $typeHelperMock->method('ensureNonEmptyString')->willReturnArgument(0); $typeHelperMock->method('ensureArrayWithValuesAsStrings')->willReturnArgument(0); @@ -136,7 +140,7 @@ protected function setUp(): void protected function sut( ?JwsDecorator $jwsDecorator = null, ?JwsVerifierDecorator $jwsVerifierDecorator = null, - ?JwksFactory $jwksFactory = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, ?DateIntervalDecorator $timestampValidationLeewayMock = null, ?Helpers $helpers = null, @@ -144,7 +148,7 @@ protected function sut( ): ParsedJws { $jwsDecorator ??= $this->jwsDecoratorMock; $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; - $jwksFactory ??= $this->jwksFactoryMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; $timestampValidationLeewayMock ??= $this->timestampValidationLeewayMock; $helpers ??= $this->helpersMock; @@ -153,7 +157,7 @@ protected function sut( return new ParsedJws( $jwsDecorator, $jwsVerifierDecorator, - $jwksFactory, + $jwksDecoratorFactory, $jwsSerializerManagerDecorator, $timestampValidationLeewayMock, $helpers, @@ -173,7 +177,7 @@ public function testCanValidateByCallbacks(): void $sut = new class ( $this->jwsDecoratorMock, $this->jwsVerifierDecoratorMock, - $this->jwksFactoryMock, + $this->jwksDecoratorFactoryMock, $this->jwsSerializerManagerDecoratorMock, $this->timestampValidationLeewayMock, $this->helpersMock, @@ -199,11 +203,10 @@ public function testThrowsOnValidateByCallbacksError(): void $this->expectException(JwsException::class); $this->expectExceptionMessage('not valid'); - /** @phpstan-ignore expr.resultUnused (Validation is invoked from constructor.) */ new class ( $this->jwsDecoratorMock, $this->jwsVerifierDecoratorMock, - $this->jwksFactoryMock, + $this->jwksDecoratorFactoryMock, $this->jwsSerializerManagerDecoratorMock, $this->timestampValidationLeewayMock, $this->helpersMock, @@ -238,6 +241,7 @@ public function testCanGetHeaderClaims(): void $this->assertSame($this->sampleHeader['kid'], $this->sut()->getHeaderClaim('kid')); $this->assertSame($this->sampleHeader['kid'], $this->sut()->getKeyId()); $this->assertSame($this->sampleHeader['typ'], $this->sut()->getType()); + $this->assertSame($this->sampleHeader['alg'], $this->sut()->getAlgorithm()); } @@ -299,6 +303,7 @@ public function testCanGetPayloadClaims(): void $this->assertSame($this->validPayload['sub'], $sut->getSubject()); $this->assertSame($this->validPayload['exp'], $sut->getExpirationTime()); $this->assertSame($this->validPayload['iat'], $sut->getIssuedAt()); + $this->assertSame($this->validPayload['nbf'], $sut->getNotBefore()); } @@ -315,6 +320,18 @@ public function testCanGetEmptyPayloadClaims(): void $this->assertNull($sut->getIssuedAt()); $this->assertNull($sut->getIdentifier()); $this->assertNull($sut->getIssuer()); + $this->assertNull($sut->getNotBefore()); + } + + + public function testCanGetNestedPayloadClaims(): void + { + $this->jwsMock->expects($this->once())->method('getPayload')->willReturn('payload-json'); + $this->jsonHelperMock->expects($this->once())->method('decode')->willReturn($this->validPayload); + + $this->arrHelperMock->expects($this->once())->method('getNestedValue'); + + $this->sut()->getNestedPayloadClaim('metadata'); } @@ -373,6 +390,15 @@ public function testCanVerifyWithKeySet(): void } + public function testCanVerifyWithKey(): void + { + $this->jwsVerifierDecoratorMock->expects($this->once())->method('verifyWithKeySet') + ->willReturn(true); + + $this->sut()->verifyWithKey(['key']); + } + + public function testThrowsOnVerifyWithKeySetError(): void { $this->jwsVerifierDecoratorMock->expects($this->once())->method('verifyWithKeySet') @@ -409,4 +435,18 @@ public function testThrowsIfIssuedAtInTheFuture(): void $this->sut()->getIssuedAt(); } + + + public function testThrowsIfNotBeforeInTheFuture(): void + { + $this->jwsMock->expects($this->once())->method('getPayload')->willReturn('payload-json'); + $payload = $this->validPayload; + $payload['nbf'] = time() + 60; + $this->jsonHelperMock->expects($this->once())->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('Not Before'); + + $this->sut()->getNotBefore(); + } } diff --git a/tests/src/SdJwt/DisclosureBagTest.php b/tests/src/SdJwt/DisclosureBagTest.php new file mode 100644 index 0000000..1227089 --- /dev/null +++ b/tests/src/SdJwt/DisclosureBagTest.php @@ -0,0 +1,70 @@ +disclosureMock = $this->createMock(Disclosure::class); + $this->disclosureMock->method('getSalt')->willReturn('salt'); + } + + + protected function sut( + Disclosure ...$disclosures, + ): DisclosureBag { + return new DisclosureBag(...$disclosures); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(DisclosureBag::class, $this->sut()); + } + + + public function testCanAddAndGet(): void + { + $sut = $this->sut($this->disclosureMock); + + $this->assertCount(1, $sut->all()); + + $disclosureMock2 = $this->createMock(Disclosure::class); + $disclosureMock2->method('getSalt')->willReturn('salt2'); + $sut->add($disclosureMock2); + + $this->assertCount(2, $sut->all()); + } + + + public function testCanGetSalts(): void + { + $sut = $this->sut($this->disclosureMock); + $this->assertSame( + ['salt'], + $sut->salts(), + ); + } + + + public function testAddThrowsForDuplicateSalt(): void + { + $sut = $this->sut($this->disclosureMock); + $this->expectException(SdJwtException::class); + $this->expectExceptionMessage('salt'); + $sut->add($this->disclosureMock); + } +} diff --git a/tests/src/SdJwt/DisclosureTest.php b/tests/src/SdJwt/DisclosureTest.php new file mode 100644 index 0000000..1e8eb46 --- /dev/null +++ b/tests/src/SdJwt/DisclosureTest.php @@ -0,0 +1,163 @@ +helpers = new Helpers(); + $this->salt = 'salt'; + $this->value = 'value'; + $this->name = 'name'; + $this->path = ['path']; + $this->selectiveDisclosureAlgorithm = HashAlgorithmsEnum::SHA_256; + } + + + protected function sut( + ?Helpers $helpers = null, + ?string $salt = null, + mixed $value = null, + false|null|string $name = null, + ?array $path = null, + ?HashAlgorithmsEnum $selectiveDisclosureAlgorithm = null, + ): Disclosure { + $helpers ??= $this->helpers; + $salt ??= $this->salt; + $value ??= $this->value; + $name = $name === false ? null : $name ?? $this->name; + $path ??= $this->path; + $selectiveDisclosureAlgorithm ??= $this->selectiveDisclosureAlgorithm; + + return new Disclosure( + $helpers, + $salt, + $value, + $name, + $path, + $selectiveDisclosureAlgorithm, + ); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(Disclosure::class, $this->sut()); + } + + + public function testThrowsForInvalidName(): void + { + $this->expectException(SdJwtException::class); + $this->expectExceptionMessage('forbidden name'); + + $this->sut( + name: ClaimsEnum::_Sd->value, + ); + } + + + public function testThrowsForEmptyNameAndPath(): void + { + $this->expectException(SdJwtException::class); + $this->expectExceptionMessage('name and path'); + + $this->sut( + name: false, + path: [], + ); + } + + + public function testCanGetCommonProperties(): void + { + $sut = $this->sut(); + + $this->assertSame($this->salt, $sut->getSalt()); + $this->assertSame($this->value, $sut->getValue()); + $this->assertSame($this->name, $sut->getName()); + $this->assertSame($this->path, $sut->getPath()); + } + + + public function testHasProperSerialization(): void + { + $this->assertSame( + [$this->salt, $this->name, $this->value], + $this->sut()->jsonSerialize(), + ); + + $this->assertSame( + [$this->salt, $this->value], + $this->sut(name: false)->jsonSerialize(), + ); + } + + + public function testHasProperType(): void + { + $this->assertSame( + SdJwtDisclosureType::ObjectProperty, + $this->sut()->getType(), + ); + + $this->assertSame( + SdJwtDisclosureType::ArrayElement, + $this->sut(name: false)->getType(), + ); + } + + + public function testCanGetEncoded(): void + { + $this->assertNotEmpty($this->sut()->getEncoded()); + } + + + public function testCanGetDigest(): void + { + $this->assertNotEmpty($this->sut()->getDigest()); + } + + + public function testCanGetDigestRepresentation(): void + { + $this->assertNotEmpty($this->sut( + name: false, + )->getDigestRepresentation()); + + $this->assertNotEmpty($this->sut()->getDigestRepresentation()); + } +} diff --git a/tests/src/SdJwt/Factories/DisclosureBagFactoryTest.php b/tests/src/SdJwt/Factories/DisclosureBagFactoryTest.php new file mode 100644 index 0000000..03a2236 --- /dev/null +++ b/tests/src/SdJwt/Factories/DisclosureBagFactoryTest.php @@ -0,0 +1,52 @@ +disclosureMock = $this->createMock(Disclosure::class); + } + + + protected function sut(): DisclosureBagFactory + { + return new DisclosureBagFactory(); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(DisclosureBagFactory::class, $this->sut()); + } + + + public function testCanBuild(): void + { + $this->assertInstanceOf( + DisclosureBag::class, + $this->sut()->build(), + ); + + $this->assertInstanceOf( + DisclosureBag::class, + $this->sut()->build($this->disclosureMock), + ); + } +} diff --git a/tests/src/SdJwt/Factories/DisclosureFactoryTest.php b/tests/src/SdJwt/Factories/DisclosureFactoryTest.php new file mode 100644 index 0000000..c31eba1 --- /dev/null +++ b/tests/src/SdJwt/Factories/DisclosureFactoryTest.php @@ -0,0 +1,56 @@ +helpersMock = $this->createMock(Helpers::class); + $radomHelperMock = $this->createMock(Helpers\Random::class); + $this->helpersMock->method('random')->willReturn($radomHelperMock); + } + + + protected function sut(): DisclosureFactory + { + return new DisclosureFactory($this->helpersMock); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(DisclosureFactory::class, $this->sut()); + } + + + public function testCanBuild(): void + { + $this->assertInstanceOf( + \SimpleSAML\OpenID\SdJwt\Disclosure::class, + $this->sut()->build('value', 'name'), + ); + } + + + public function testCanBuildDecoy(): void + { + $this->assertInstanceOf( + \SimpleSAML\OpenID\SdJwt\Disclosure::class, + $this->sut()->buildDecoy(SdJwtDisclosureType::ArrayElement, []), + ); + } +} diff --git a/tests/src/SdJwt/Factories/SdJwtFactoryTest.php b/tests/src/SdJwt/Factories/SdJwtFactoryTest.php new file mode 100644 index 0000000..f2cadea --- /dev/null +++ b/tests/src/SdJwt/Factories/SdJwtFactoryTest.php @@ -0,0 +1,212 @@ + 'ES256', + 'typ' => 'example+sd-jwt', + 'kid' => 'F4VFObNusj3PHmrHxpqh4GNiuFHlfh-2s6xMJ95fLYA', + ]; + + protected array $expiredPayload = [ + 'iat' => 1734009487, + 'nbf' => 1734009487, + 'exp' => 1734009487, + 'iss' => 'https://08-dap.localhost.markoivancic.from.hr/openid/entities/ALeaf/', + + ]; + + protected array $validPayload; + + + protected function setUp(): void + { + $signatureMock = $this->createMock(Signature::class); + + $jwsMock = $this->createMock(JWS::class); + $jwsMock->method('getPayload') + ->willReturn('json-payload-string'); // Just so we have non-empty value. + $jwsMock->method('getSignature')->willReturn($signatureMock); + + $jwsDecoratorMock = $this->createMock(JwsDecorator::class); + $jwsDecoratorMock->method('jws')->willReturn($jwsMock); + + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); + $this->jwsDecoratorBuilderMock->method('fromToken')->willReturn($jwsDecoratorMock); + + $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); + $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); + $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); + + $this->helpersMock = $this->createMock(Helpers::class); + $jsonHelperMock = $this->createMock(Helpers\Json::class); + $this->helpersMock->method('json')->willReturn($jsonHelperMock); + $typeHelperMock = $this->createMock(Helpers\Type::class); + $this->helpersMock->method('type')->willReturn($typeHelperMock); + + $typeHelperMock->method('ensureNonEmptyString')->willReturnArgument(0); + $typeHelperMock->method('ensureInt')->willReturnArgument(0); + + $this->claimFactoryMock = $this->createMock(ClaimFactory::class); + + $this->validPayload = $this->expiredPayload; + $this->validPayload['exp'] = time() + 3600; + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); + $this->disclosureBagMock = $this->createMock(DisclosureBag::class); + + $this->disclosureFactoryMock = $this->createMock(DisclosureFactory::class); + } + + + protected function sut( + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, + ?JwsVerifierDecorator $jwsVerifierDecorator = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, + ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, + ?DateIntervalDecorator $dateIntervalDecorator = null, + ?Helpers $helpers = null, + ?ClaimFactory $claimFactory = null, + ?DisclosureFactory $disclosureFactory = null, + ): SdJwtFactory { + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; + $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; + $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; + $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; + $helpers ??= $this->helpersMock; + $claimFactory ??= $this->claimFactoryMock; + $disclosureFactory ??= $this->disclosureFactoryMock; + + return new SdJwtFactory( + $jwsDecoratorBuilder, + $jwsVerifierDecorator, + $jwksDecoratorFactory, + $jwsSerializerManagerDecorator, + $dateIntervalDecorator, + $helpers, + $claimFactory, + $disclosureFactory, + ); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(SdJwtFactory::class, $this->sut()); + } + + + public function testCanBuildFromData(): void + { + $this->assertInstanceOf( + SdJwt::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::ES256, + $this->validPayload, + $this->sampleHeader, + $this->disclosureBagMock, + ), + ); + } + + + public function testCanUpdatePayloadWithDisclosures(): void + { + // ["_26bc4LT-ac6q2KI6cBW5es","family_name","Möbius"] + $helpers = new Helpers(); + $disclosureFactory = new DisclosureFactory($helpers); + + $disclosure = $disclosureFactory->build( + value: 'Möbius', + name: 'family_name', + salt: '_26bc4LT-ac6q2KI6cBW5es', + ); + + $disclosureBag = new DisclosureBag($disclosure); + + $sut = $this->sut(helpers: $helpers, disclosureFactory: $disclosureFactory); + + $payload = [ + 'given_name' => 'John', + ]; + + $payload = $sut->updatePayloadWithDisclosures( + $payload, + $disclosureBag, + HashAlgorithmsEnum::SHA_256, + ); + + $this->assertArrayHasKey(ClaimsEnum::_SdAlg->value, $payload); + $this->assertArrayHasKey(ClaimsEnum::_Sd->value, $payload); + $this->assertNotEmpty($payload[ClaimsEnum::_Sd->value]); + $this->assertContains('TZjouOTrBKEwUNjNDs9yeMzBoQn8FFLPaJjRRmAtwrM', $payload[ClaimsEnum::_Sd->value]); + } +} diff --git a/tests/src/SdJwt/SdJwtTest.php b/tests/src/SdJwt/SdJwtTest.php new file mode 100644 index 0000000..61889d0 --- /dev/null +++ b/tests/src/SdJwt/SdJwtTest.php @@ -0,0 +1,261 @@ + [ + "CrQe7S5kqBAHt-nMYXgc6bdt2SH5aTY1sU_M-PgkjPI", + "JzYjH4svliH0R3PyEMfeZu6Jt69u5qehZo7F7EPYlSE", + "PorFbpKuVu6xymJagvkFsFXAbRoc2JGlAUA2BA4o7cI", + "TGf4oLbgwd5JQaHyKVQZU9UdGE0w5rtDsrZzfUaomLo", + "XQ_3kPKt1XyX7KANkqVR6yZ2Va5NrPIvPYbyMvRKBMM", + "XzFrzwscM6Gn6CJDc6vVK8BkMnfG8vOSKfpPIZdAfdE", + "gbOsI4Edq2x2Kw-w5wPEzakob9hV1cRD0ATN3oQL9JM", + "jsu9yVulwQQlhFlM_3JlzMaSFzglhQG0DpfayQwLUK4", + ], + "iss" => "https://issuer.example.com", + "iat" => 1683000000, + "exp" => 1883000000, + "sub" => "user_42", + "nationalities" => [ + [ + "..." => "pFndjkZ_VCzmyTa6UjlZo3dh-ko8aIKQc9DlGzhaVYo", + ], + [ + "..." => "7Cf6JkPudry3lcbwHgeZ8khAv1U1OSlerP0VkBJrWZ0", + ], + ], + "_sd_alg" => "sha-256", + "cnf" => [ + "jwk" => [ + "kty" => "EC", + "crv" => "P-256", + "x" => "TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc", + "y" => "ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ", + ], + ], + ]; + + protected array $sampleHeader = [ + 'alg' => 'RS256', + 'typ' => 'example+sd-jwt', + 'kid' => 'fsQ45F0D916RdKEeTjta8DYWiodjthouHrVWgOXBrkk', + ]; + + protected array $validPayload; + + protected MockObject $disclosureBagMock; + + protected MockObject $kbJwtMock; + + + protected function setUp(): void + { + $this->signatureMock = $this->createMock(Signature::class); + + $jwsMock = $this->createMock(JWS::class); + $jwsMock->method('getPayload') + ->willReturn('json-payload-string'); // Just so we have non-empty value. + $jwsMock->method('getSignature')->willReturn($this->signatureMock); + + $this->jwsDecoratorMock = $this->createMock(JwsDecorator::class); + $this->jwsDecoratorMock->method('jws')->willReturn($jwsMock); + + $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); + $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); + $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); + + $this->helpersMock = $this->createMock(Helpers::class); + $this->jsonHelperMock = $this->createMock(Helpers\Json::class); + $this->helpersMock->method('json')->willReturn($this->jsonHelperMock); + $typeHelperMock = $this->createMock(Helpers\Type::class); + $this->helpersMock->method('type')->willReturn($typeHelperMock); + + $typeHelperMock->method('ensureNonEmptyString')->willReturnArgument(0); + $typeHelperMock->method('ensureInt')->willReturnArgument(0); + $typeHelperMock->method('ensureArray')->willReturnArgument(0); + + $this->claimFactoryMock = $this->createMock(ClaimFactory::class); + + $this->validPayload = $this->expiredPayload; + $this->validPayload['exp'] = time() + 3600; + + $this->disclosureBagMock = $this->createMock(DisclosureBag::class); + $this->kbJwtMock = $this->createMock(KbJwt::class); + } + + + protected function sut( + ?JwsDecorator $jwsDecorator = null, + ?JwsVerifierDecorator $jwsVerifierDecorator = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, + ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, + ?DateIntervalDecorator $dateIntervalDecorator = null, + ?Helpers $helpers = null, + ?ClaimFactory $claimFactory = null, + ?DisclosureBag $disclosureBag = null, + ?KbJwt $kbJwt = null, + ): SdJwt { + $jwsDecorator ??= $this->jwsDecoratorMock; + $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; + $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; + $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; + $helpers ??= $this->helpersMock; + $claimFactory ??= $this->claimFactoryMock; + $disclosureBag ??= $this->disclosureBagMock; + $kbJwt ??= $this->kbJwtMock; + + return new SdJwt( + $jwsDecorator, + $jwsVerifierDecorator, + $jwksDecoratorFactory, + $jwsSerializerManagerDecorator, + $dateIntervalDecorator, + $helpers, + $claimFactory, + $disclosureBag, + $kbJwt, + ); + } + + + public function testCanCreateInstance(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $this->assertInstanceOf( + SdJwt::class, + $this->sut(), + ); + } + + + public function testCanGetCommonProperties(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $sut = $this->sut(); + + $this->assertInstanceOf( + HashAlgorithmsEnum::class, + $sut->getSelectiveDisclosureAlgorithm(), + ); + $this->assertSame( + $this->validPayload['cnf'], + $sut->getConfirmation(), + ); + $this->assertInstanceOf( + DisclosureBag::class, + $sut->getDisclosureBag(), + ); + $this->assertInstanceOf( + KbJwt::class, + $sut->getKbJwt(), + ); + } + + + public function testCanGetNullableCommonProperties(): void + { + $payload = $this->validPayload; + unset($payload['_sd_alg']); + unset($payload['cnf']); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $sut = $this->sut(); + + $this->assertNotInstanceOf(HashAlgorithmsEnum::class, $sut->getSelectiveDisclosureAlgorithm()); + $this->assertNull($sut->getConfirmation()); + } + + + public function testCanGetToken(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $disclosureMock = $this->createMock(Disclosure::class); + $disclosureMock->method('getSalt')->willReturn('salt'); + $this->disclosureBagMock->method('all')->willReturn(['salt' => $disclosureMock]); + + // Since we don't do full token generation in tests, just make sure we have the expected number of tildes. + $this->assertSame("~~", $this->sut()->getToken()); + } + + + public function testCanGetTokenWithFilteredDisclosures(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $disclosureMock = $this->createMock(Disclosure::class); + $disclosureMock->method('getSalt')->willReturn('salt'); + $disclosureMock2 = $this->createMock(Disclosure::class); + $disclosureMock2->method('getSalt')->willReturn('salt2'); + $this->disclosureBagMock->method('all')->willReturn( + ['salt' => $disclosureMock, 'salt2' => $disclosureMock2], + ); + $disclosureBagMock2 = $this->createMock(DisclosureBag::class); + $disclosureBagMock2->method('all')->willReturn(['salt2' => $disclosureMock2]); + + // Since we don't do full token generation in tests, just make sure we have the expected number of tildes. + $this->assertSame("~~~", $this->sut()->getToken()); + $this->assertSame("~~", $this->sut()->getToken(disclosureBag: $disclosureBagMock2)); + } + + + public function testCanGetUndisclosedToken(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + // We don't do full token generation in tests, so we expect an empty string here. + $this->assertEmpty($this->sut()->getUndisclosedToken()); + } +} diff --git a/tests/src/VerifiableCredentials/ClaimsPathPointerResolverTest.php b/tests/src/VerifiableCredentials/ClaimsPathPointerResolverTest.php new file mode 100644 index 0000000..934b2f7 --- /dev/null +++ b/tests/src/VerifiableCredentials/ClaimsPathPointerResolverTest.php @@ -0,0 +1,145 @@ + 'Arthur Dent', + 'address' => [ + 'street_address' => '42 Market Street', + 'locality' => 'Milliways', + 'postal_code' => '12345', + ], + 'degrees' => [ + [ + 'type' => 'Bachelor of Science', + 'university' => 'University of Betelgeuse', + ], + [ + 'type' => 'Master of Science', + 'university' => 'University of Betelgeuse', + ], + ], + 'nationalities' => ['British', 'Betelgeusian'], + ]; + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(ClaimsPathPointerResolver::class, $this->sut()); + } + + + protected function sut( + ?Helpers $helpers = null, + ): ClaimsPathPointerResolver { + $helpers ??= $this->helpersMock; + + return new ClaimsPathPointerResolver($helpers); + } + + + protected function setUp(): void + { + $this->helpersMock = $this->createMock(Helpers::class); + $this->helpersMock->method('arr')->willReturn(new Helpers\Arr()); + } + + + public function testCanResolveForJsonBased(): void + { + $sut = $this->sut(); + + $this->assertSame( + ['Arthur Dent'], + $sut->forJsonBased($this->jsonDataSample, ['name']), + ); + + $this->assertSame( + [ + [ + 'street_address' => '42 Market Street', + 'locality' => 'Milliways', + 'postal_code' => '12345', + ], + ], + $sut->forJsonBased($this->jsonDataSample, ['address']), + ); + + $this->assertSame( + ['42 Market Street'], + $sut->forJsonBased($this->jsonDataSample, ['address', 'street_address']), + ); + + $this->assertSame( + ['Bachelor of Science', 'Master of Science'], + $sut->forJsonBased($this->jsonDataSample, ['degrees', null, 'type']), + ); + + $this->assertSame( + ['Betelgeusian'], + $sut->forJsonBased($this->jsonDataSample, ['nationalities', 1]), + ); + } + + + public function testThrowsForInvalidPathComponent(): void + { + $this->expectException(ClaimsPathPointerException::class); + $this->expectExceptionMessage('Path component'); + + $this->sut()->forJsonBased($this->jsonDataSample, [false]); + } + + + public function testThrowsForNonObjectInStringPathComponent(): void + { + $this->expectException(ClaimsPathPointerException::class); + $this->expectExceptionMessage('Expected object'); + + $this->sut()->forJsonBased($this->jsonDataSample, ['nationalities', 'invalid']); + } + + + public function testThrowsForNonArrayInNullPathComponent(): void + { + $this->expectException(ClaimsPathPointerException::class); + $this->expectExceptionMessage('Expected array'); + + $this->sut()->forJsonBased($this->jsonDataSample, ['address', null]); + } + + + public function testThrowsForNonArrayInIntegerPathComponent(): void + { + $this->expectException(ClaimsPathPointerException::class); + $this->expectExceptionMessage('Expected array'); + + $this->sut()->forJsonBased($this->jsonDataSample, ['address', 0]); + } + + + public function testThrowsForEmptySelection(): void + { + $this->expectException(ClaimsPathPointerException::class); + $this->expectExceptionMessage('No elements'); + + $this->sut()->forJsonBased($this->jsonDataSample, ['invalid']); + } +} diff --git a/tests/src/VerifiableCredentials/CredentialOffer/CredentialOfferGrantsBagTest.php b/tests/src/VerifiableCredentials/CredentialOffer/CredentialOfferGrantsBagTest.php new file mode 100644 index 0000000..864aacc --- /dev/null +++ b/tests/src/VerifiableCredentials/CredentialOffer/CredentialOfferGrantsBagTest.php @@ -0,0 +1,43 @@ +credentialOfferGrantsValue = $this->createMock(CredentialOfferGrantsValue::class); + } + + + protected function sut( + CredentialOfferGrantsValue ...$credentialOfferGrantsValues, + ): CredentialOfferGrantsBag { + return new CredentialOfferGrantsBag(...$credentialOfferGrantsValues); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(CredentialOfferGrantsBag::class, $this->sut($this->credentialOfferGrantsValue)); + } + + + public function testCanJsonSerialize(): void + { + $this->credentialOfferGrantsValue->expects($this->once())->method('jsonSerialize'); + + $this->sut($this->credentialOfferGrantsValue)->jsonSerialize(); + } +} diff --git a/tests/src/VerifiableCredentials/CredentialOffer/CredentialOfferGrantsValueTest.php b/tests/src/VerifiableCredentials/CredentialOffer/CredentialOfferGrantsValueTest.php new file mode 100644 index 0000000..00b957c --- /dev/null +++ b/tests/src/VerifiableCredentials/CredentialOffer/CredentialOfferGrantsValueTest.php @@ -0,0 +1,154 @@ + "oaKazRN8I0IbtZ0C7JuMn5", + "tx_code" => [ + "length" => 4, + "input_mode" => "numeric", + "description" => "Please provide the one-time code that was sent via e-mail", + ], + ]; + + protected array $sampleAuthCode = [ + "issuer_state" => "eyJhbGciOiJSU0Et...FYUaBy", + "authorization_server" => "https://example.com/oidc/auth", + ]; + + protected string $grantType; + + + protected function setUp(): void + { + $this->grantType = GrantTypesEnum::PreAuthorizedCode->value; + } + + + protected function sut( + ?string $grantType = null, + ?array $claims = null, + ): CredentialOfferGrantsValue { + $grantType ??= $this->grantType; + $claims ??= $this->samplePreAuthCode; + + return new CredentialOfferGrantsValue($grantType, $claims); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf( + CredentialOfferGrantsValue::class, + $this->sut(), + ); + } + + + public function testThrowsOnInvalidAuthCodeIssuerState(): void + { + $this->expectException(CredentialOfferException::class); + $this->expectExceptionMessage("Issuer State"); + + $claims = $this->sampleAuthCode; + $claims['issuer_state'] = 123; + $this->sut(GrantTypesEnum::AuthorizationCode->value, $claims); + } + + + public function testThrowsOnInvalidAuthCodeAuthorizationServer(): void + { + $this->expectException(CredentialOfferException::class); + $this->expectExceptionMessage("Authorization Server"); + + $claims = $this->sampleAuthCode; + $claims['authorization_server'] = 123; + $this->sut(GrantTypesEnum::AuthorizationCode->value, $claims); + } + + + public function testThrowsOnInvalidPreAuthCodeValue(): void + { + $this->expectException(CredentialOfferException::class); + $this->expectExceptionMessage("Pre-authorized Code"); + + $claims = $this->samplePreAuthCode; + $claims['pre-authorized_code'] = 123; + $this->sut(GrantTypesEnum::PreAuthorizedCode->value, $claims); + } + + + public function testThrowsOnInvalidPreAuthCodeTxCodeValue(): void + { + $this->expectException(CredentialOfferException::class); + $this->expectExceptionMessage("TxCode"); + + $claims = $this->samplePreAuthCode; + $claims['tx_code'] = 123; + $this->sut(GrantTypesEnum::PreAuthorizedCode->value, $claims); + } + + + public function testThrowsOnInvalidPreAuthCodeTxCodeInputModeValue(): void + { + $this->expectException(CredentialOfferException::class); + $this->expectExceptionMessage("Input Mode"); + + $claims = $this->samplePreAuthCode; + $claims['tx_code']['input_mode'] = 123; + $this->sut(GrantTypesEnum::PreAuthorizedCode->value, $claims); + } + + + public function testThrowsOnInvalidPreAuthCodeTxCodeLengthValue(): void + { + $this->expectException(CredentialOfferException::class); + $this->expectExceptionMessage("Length"); + + $claims = $this->samplePreAuthCode; + $claims['tx_code']['length'] = "123"; + $this->sut(GrantTypesEnum::PreAuthorizedCode->value, $claims); + } + + + public function testThrowsOnInvalidPreAuthCodeTxCodeDescriptionValue(): void + { + $this->expectException(CredentialOfferException::class); + $this->expectExceptionMessage("Description"); + + $claims = $this->samplePreAuthCode; + $claims['tx_code']['description'] = 123; + $this->sut(GrantTypesEnum::PreAuthorizedCode->value, $claims); + } + + + public function testThrowsOnInvalidPreAuthCodeAuthorizationServerValue(): void + { + $this->expectException(CredentialOfferException::class); + $this->expectExceptionMessage("Authorization Server"); + + $claims = $this->samplePreAuthCode; + $claims['authorization_server'] = 123; + $this->sut(GrantTypesEnum::PreAuthorizedCode->value, $claims); + } + + + public function testJsonSerialize(): void + { + $sut = $this->sut(GrantTypesEnum::PreAuthorizedCode->value, $this->samplePreAuthCode); + $this->assertSame( + [GrantTypesEnum::PreAuthorizedCode->value => $this->samplePreAuthCode], + $sut->jsonSerialize(), + ); + } +} diff --git a/tests/src/VerifiableCredentials/CredentialOffer/CredentialOfferParametersTest.php b/tests/src/VerifiableCredentials/CredentialOffer/CredentialOfferParametersTest.php new file mode 100644 index 0000000..bf89a98 --- /dev/null +++ b/tests/src/VerifiableCredentials/CredentialOffer/CredentialOfferParametersTest.php @@ -0,0 +1,59 @@ +credentialOfferGrantsBag = $this->createMock(CredentialOfferGrantsBag::class); + } + + + protected function sut( + ?string $credentialIssuer = null, + ?array $credentialConfigurationIds = null, + false|null|CredentialOfferGrantsBag $credentialOfferGrantsBag = null, + ): CredentialOfferParameters { + $credentialIssuer ??= $this->credentialIssuer; + $credentialConfigurationIds ??= $this->credentialConfigurationIds; + $credentialOfferGrantsBag = $credentialOfferGrantsBag === false ? + null : + $credentialOfferGrantsBag ?? $this->credentialOfferGrantsBag; + + return new CredentialOfferParameters( + $credentialIssuer, + $credentialConfigurationIds, + $credentialOfferGrantsBag, + ); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(CredentialOfferParameters::class, $this->sut()); + } + + + public function testCanJsonSerialize(): void + { + $this->credentialOfferGrantsBag->expects($this->once())->method('jsonSerialize'); + + $this->assertNotEmpty($this->sut()->jsonSerialize()); + } +} diff --git a/tests/src/VerifiableCredentials/CredentialOfferTest.php b/tests/src/VerifiableCredentials/CredentialOfferTest.php new file mode 100644 index 0000000..0612ea5 --- /dev/null +++ b/tests/src/VerifiableCredentials/CredentialOfferTest.php @@ -0,0 +1,63 @@ +credentialOfferParametersMock = $this->createMock(CredentialOfferParameters::class); + } + + + protected function sut( + CredentialOfferParameters|false|null $credentialOfferParameters = null, + string|false|null $uri = null, + ): CredentialOffer { + $credentialOfferParameters = $credentialOfferParameters === false ? + null : + $credentialOfferParameters ?? $this->credentialOfferParametersMock; + + $uri = $credentialOfferParameters === null ? + ($uri === false ? null : $uri ?? $this->uri) : + null; + + return new CredentialOffer($credentialOfferParameters, $uri); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(CredentialOffer::class, $this->sut()); + } + + + public function testCanJsonSerialize(): void + { + $this->assertIsArray($this->sut($this->credentialOfferParametersMock)->jsonSerialize()); + $this->assertIsString($this->sut(false, uri: $this->uri)->jsonSerialize()); + } + + + public function testThrowsIfNoParametersAndNoUri(): void + { + $this->expectException(CredentialOfferException::class); + $this->expectExceptionMessage('Invalid'); + + $this->sut(false, false)->jsonSerialize(); + } +} diff --git a/tests/src/VerifiableCredentials/Factories/CredentialOfferFactoryTest.php b/tests/src/VerifiableCredentials/Factories/CredentialOfferFactoryTest.php new file mode 100644 index 0000000..40ac4ba --- /dev/null +++ b/tests/src/VerifiableCredentials/Factories/CredentialOfferFactoryTest.php @@ -0,0 +1,99 @@ + 'https://example.com/issuer', + 'credential_configuration_ids' => ['credential-1', 'credential-2'], + 'grants' => [ + 'urn:ietf:params:oauth:grant-type:pre-authorized_code' => [ + "pre-authorized_code" => "oaKazRN8I0IbtZ0C7JuMn5", + "tx_code" => [ + "length" => 4, + "input_mode" => "numeric", + "description" => "Please provide the one-time code that was sent via e-mail", + ], + ], + ], + ]; + + + protected function setUp(): void + { + $this->helpersMock = $this->createMock(Helpers::class); + } + + + protected function sut( + ?Helpers $helpers = null, + ): CredentialOfferFactory { + $helpers ??= $this->helpersMock; + + return new CredentialOfferFactory($helpers); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(CredentialOfferFactory::class, $this->sut()); + } + + + public function testCanBuildFromParameters(): void + { + $this->assertInstanceOf( + CredentialOffer::class, + $this->sut()->from($this->sampleParameters), + ); + } + + + public function testFromThrowsForInvalidGrantData(): void + { + $this->expectException(CredentialOfferException::class); + $this->expectExceptionMessage('Grants'); + + $parameters = $this->sampleParameters; + $parameters['grants']['urn:ietf:params:oauth:grant-type:pre-authorized_code'] = 123; + $this->sut()->from($parameters); + } + + + public function testFromUri(): void + { + $this->assertInstanceOf( + CredentialOffer::class, + $this->sut()->from(uri: 'https://example.com/offer'), + ); + } + + + public function testFromThrowsIfBothParametersAndUriIsProvided(): void + { + $this->expectException(CredentialOfferException::class); + $this->expectExceptionMessage('Only one'); + + $this->sut()->from($this->sampleParameters, 'https://example.com/offer'); + } +} diff --git a/tests/src/VerifiableCredentials/Factories/OpenId4VciProofFactoryTest.php b/tests/src/VerifiableCredentials/Factories/OpenId4VciProofFactoryTest.php new file mode 100644 index 0000000..7c9b896 --- /dev/null +++ b/tests/src/VerifiableCredentials/Factories/OpenId4VciProofFactoryTest.php @@ -0,0 +1,175 @@ + "openid4vci-proof+jwt", + "alg" => "ES256", + "jwk" => [ + "kty" => "EC", + "crv" => "P-256", + "x" => "nUWAoAv3XZith8E7i19OdaxOLYFOwM-Z2EuM02TirT4", + "y" => "HskHU8BjUi1U9Xqi7Swmj8gwAK_0xkcDjEW_71SosEY", + ], + ]; + + protected array $expiredPayload = [ + 'iat' => 1734009487, + 'nbf' => 1734009487, + 'exp' => 1734009487, + "iss" => "s6BhdRkqt3", + "aud" => "https://server.example.com", + "nonce" => "tZignsnFbp", + ]; + + protected array $validPayload; + + protected MockObject $jwkDecoratorMock; + + + protected function setUp(): void + { + $this->signatureMock = $this->createMock(Signature::class); + + $jwsMock = $this->createMock(JWS::class); + $jwsMock->method('getPayload') + ->willReturn('json-payload-string'); // Just so we have non-empty value. + $jwsMock->method('getSignature')->willReturn($this->signatureMock); + + $jwsDecoratorMock = $this->createMock(JwsDecorator::class); + $jwsDecoratorMock->method('jws')->willReturn($jwsMock); + + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); + $this->jwsDecoratorBuilderMock->method('fromToken')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock->method('fromData')->willReturn($jwsDecoratorMock); + + $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); + $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); + $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); + + $this->helpersMock = $this->createMock(Helpers::class); + $this->jsonHelperMock = $this->createMock(Helpers\Json::class); + $this->helpersMock->method('json')->willReturn($this->jsonHelperMock); + $typeHelperMock = $this->createMock(Helpers\Type::class); + $this->helpersMock->method('type')->willReturn($typeHelperMock); + + $typeHelperMock->method('ensureNonEmptyString')->willReturnArgument(0); + $typeHelperMock->method('ensureInt')->willReturnArgument(0); + + $this->claimFactoryMock = $this->createMock(ClaimFactory::class); + + $this->validPayload = $this->expiredPayload; + $this->validPayload['exp'] = time() + 3600; + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); + } + + + protected function sut( + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, + ?JwsVerifierDecorator $jwsVerifierDecorator = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, + ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, + ?DateIntervalDecorator $dateIntervalDecorator = null, + ?Helpers $helpers = null, + ?ClaimFactory $claimFactory = null, + ): OpenId4VciProofFactory { + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; + $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; + $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; + $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; + $helpers ??= $this->helpersMock; + $claimFactory ??= $this->claimFactoryMock; + + return new OpenId4VciProofFactory( + $jwsDecoratorBuilder, + $jwsVerifierDecorator, + $jwksDecoratorFactory, + $jwsSerializerManagerDecorator, + $dateIntervalDecorator, + $helpers, + $claimFactory, + ); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(OpenId4VciProofFactory::class, $this->sut()); + } + + + public function testCanBuildFromToken(): void + { + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + + $this->assertInstanceOf( + OpenId4VciProof::class, + $this->sut()->fromToken('token'), + ); + } + + + public function testCanBuildFromData(): void + { + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + + $this->assertInstanceOf( + OpenId4VciProof::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::ES256, + $this->validPayload, + $this->sampleHeader, + ), + ); + } +} diff --git a/tests/src/VerifiableCredentials/Factories/TxCodeFactoryTest.php b/tests/src/VerifiableCredentials/Factories/TxCodeFactoryTest.php new file mode 100644 index 0000000..2a5aebd --- /dev/null +++ b/tests/src/VerifiableCredentials/Factories/TxCodeFactoryTest.php @@ -0,0 +1,33 @@ +assertInstanceOf( + TxCode::class, + $this->sut()->build($this->txCode, $this->description), + ); + } +} diff --git a/tests/src/VerifiableCredentials/OpenId4VciProofTest.php b/tests/src/VerifiableCredentials/OpenId4VciProofTest.php new file mode 100644 index 0000000..e6c3d55 --- /dev/null +++ b/tests/src/VerifiableCredentials/OpenId4VciProofTest.php @@ -0,0 +1,135 @@ + "s6BhdRkqt3", + "aud" => "https://credential-issuer.example.com", + "iat" => 1701960444, + "nonce" => "LarRGSbmUPYtRYO6BQ4yn8", + ]; + + protected array $sampleHeader = [ + 'alg' => 'ES256', + 'typ' => 'openid4vci-proof+jwt', + 'kid' => 'F4VFObNusj3PHmrHxpqh4GNiuFHlfh-2s6xMJ95fLYA', + ]; + + protected array $validPayload; + + + protected function setUp(): void + { + $this->signatureMock = $this->createMock(Signature::class); + + $jwsMock = $this->createMock(JWS::class); + $jwsMock->method('getPayload') + ->willReturn('json-payload-string'); // Just so we have non-empty value. + $jwsMock->method('getSignature')->willReturn($this->signatureMock); + + $this->jwsDecoratorMock = $this->createMock(JwsDecorator::class); + $this->jwsDecoratorMock->method('jws')->willReturn($jwsMock); + + $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); + $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); + $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); + + $this->helpersMock = $this->createMock(Helpers::class); + $this->jsonHelperMock = $this->createMock(Helpers\Json::class); + $this->helpersMock->method('json')->willReturn($this->jsonHelperMock); + $typeHelperMock = $this->createMock(Helpers\Type::class); + $this->helpersMock->method('type')->willReturn($typeHelperMock); + $arrHelperMock = $this->createMock(Helpers\Arr::class); + $this->helpersMock->method('arr')->willReturn($arrHelperMock); + + $typeHelperMock->method('ensureNonEmptyString')->willReturnArgument(0); + $typeHelperMock->method('ensureInt')->willReturnArgument(0); + $typeHelperMock->method('ensureArray')->willReturnArgument(0); + + $this->claimFactoryMock = $this->createMock(ClaimFactory::class); + + $this->validPayload = $this->expiredPayload; + $this->validPayload['exp'] = time() + 3600; + } + + + protected function sut( + ?JwsDecorator $jwsDecorator = null, + ?JwsVerifierDecorator $jwsVerifierDecorator = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, + ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, + ?DateIntervalDecorator $dateIntervalDecorator = null, + ?Helpers $helpers = null, + ?ClaimFactory $claimFactory = null, + ): OpenId4VciProof { + $jwsDecorator ??= $this->jwsDecoratorMock; + $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; + $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; + $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; + $helpers ??= $this->helpersMock; + $claimFactory ??= $this->claimFactoryMock; + + return new OpenId4VciProof( + $jwsDecorator, + $jwsVerifierDecorator, + $jwksDecoratorFactory, + $jwsSerializerManagerDecorator, + $dateIntervalDecorator, + $helpers, + $claimFactory, + ); + } + + + public function testCanCreateInstance(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $this->assertInstanceOf( + OpenId4VciProof::class, + $this->sut(), + ); + } +} diff --git a/tests/src/VerifiableCredentials/SdJwtVc/Factories/SdJwtVcFactoryTest.php b/tests/src/VerifiableCredentials/SdJwtVc/Factories/SdJwtVcFactoryTest.php new file mode 100644 index 0000000..e65c6ce --- /dev/null +++ b/tests/src/VerifiableCredentials/SdJwtVc/Factories/SdJwtVcFactoryTest.php @@ -0,0 +1,168 @@ + 'ES256', + 'typ' => 'dc+sd-jwt', + 'kid' => 'F4VFObNusj3PHmrHxpqh4GNiuFHlfh-2s6xMJ95fLYA', + ]; + + protected array $expiredPayload = [ + 'iat' => 1734009487, + 'nbf' => 1734009487, + 'exp' => 1734009487, + 'vct' => 'https://betelgeuse.example.com/education_credential', + 'iss' => 'https://08-dap.localhost.markoivancic.from.hr/openid/entities/ALeaf/', + ]; + + protected array $validPayload; + + + protected function setUp(): void + { + $this->signatureMock = $this->createMock(Signature::class); + + $jwsMock = $this->createMock(JWS::class); + $jwsMock->method('getPayload') + ->willReturn('json-payload-string'); // Just so we have non-empty value. + $jwsMock->method('getSignature')->willReturn($this->signatureMock); + + $jwsDecoratorMock = $this->createMock(JwsDecorator::class); + $jwsDecoratorMock->method('jws')->willReturn($jwsMock); + + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); + $this->jwsDecoratorBuilderMock->method('fromToken')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock->method('fromData')->willReturn($jwsDecoratorMock); + + $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); + $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); + $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); + + $this->helpersMock = $this->createMock(Helpers::class); + $this->jsonHelperMock = $this->createMock(Helpers\Json::class); + $this->helpersMock->method('json')->willReturn($this->jsonHelperMock); + $typeHelperMock = $this->createMock(Helpers\Type::class); + $this->helpersMock->method('type')->willReturn($typeHelperMock); + + $typeHelperMock->method('ensureNonEmptyString')->willReturnArgument(0); + $typeHelperMock->method('ensureInt')->willReturnArgument(0); + + $this->claimFactoryMock = $this->createMock(ClaimFactory::class); + + $this->validPayload = $this->expiredPayload; + $this->validPayload['exp'] = time() + 3600; + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); + $this->disclosureBagMock = $this->createMock(DisclosureBag::class); + + $this->disclosureFactoryMock = $this->createMock(DisclosureFactory::class); + } + + + protected function sut( + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, + ?JwsVerifierDecorator $jwsVerifierDecorator = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, + ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, + ?DateIntervalDecorator $dateIntervalDecorator = null, + ?Helpers $helpers = null, + ?ClaimFactory $claimFactory = null, + ?DisclosureFactory $disclosureFactory = null, + ): SdJwtVcFactory { + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; + $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; + $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; + $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; + $helpers ??= $this->helpersMock; + $claimFactory ??= $this->claimFactoryMock; + $disclosureFactory ??= $this->disclosureFactoryMock; + + return new SdJwtVcFactory( + $jwsDecoratorBuilder, + $jwsVerifierDecorator, + $jwksDecoratorFactory, + $jwsSerializerManagerDecorator, + $dateIntervalDecorator, + $helpers, + $claimFactory, + $disclosureFactory, + ); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(SdJwtFactory::class, $this->sut()); + } + + + public function testCanBuildFromData(): void + { + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + + $this->assertInstanceOf( + SdJwtVc::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::ES256, + $this->validPayload, + $this->sampleHeader, + $this->disclosureBagMock, + ), + ); + } +} diff --git a/tests/src/VerifiableCredentials/SdJwtVc/SdJwtVcTest.php b/tests/src/VerifiableCredentials/SdJwtVc/SdJwtVcTest.php new file mode 100644 index 0000000..3c291fc --- /dev/null +++ b/tests/src/VerifiableCredentials/SdJwtVc/SdJwtVcTest.php @@ -0,0 +1,225 @@ + [ + "09vKrJMOlyTWM0sjpu_pdOBVBQ2M1y3KhpH515nXkpY", + "2rsjGbaC0ky8mT0pJrPioWTq0_daw1sX76poUlgCwbI", + "EkO8dhW0dHEJbvUHlE_VCeuC9uRELOieLZhh7XbUTtA", + "IlDzIKeiZdDwpqpK6ZfbyphFvz5FgnWa-sN6wqQXCiw", + "JzYjH4svliH0R3PyEMfeZu6Jt69u5qehZo7F7EPYlSE", + "PorFbpKuVu6xymJagvkFsFXAbRoc2JGlAUA2BA4o7cI", + "TGf4oLbgwd5JQaHyKVQZU9UdGE0w5rtDsrZzfUaomLo", + "jdrTE8YcbY4EifugihiAe_BPekxJQZICeiUQwY9QqxI", + "jsu9yVulwQQlhFlM_3JlzMaSFzglhQG0DpfayQwLUK4", + ], + "iss" => "https://example.com/issuer", + "iat" => 1683000000, + "exp" => 1883000000, + "vct" => "https://credentials.example.com/identity_credential", + "_sd_alg" => "sha-256", + "cnf" => [ + "jwk" => [ + "kty" => "EC", + "crv" => "P-256", + "x" => "TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc", + "y" => "ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ", + ], + ], + ]; + + protected array $sampleHeader = [ + 'alg' => 'ES256', + 'typ' => 'dc+sd-jwt', + 'kid' => 'F4VFObNusj3PHmrHxpqh4GNiuFHlfh-2s6xMJ95fLYA', + ]; + + protected array $validPayload; + + protected MockObject $disclosureBagMock; + + protected MockObject $kbJwtMock; + + + protected function setUp(): void + { + $this->signatureMock = $this->createMock(Signature::class); + + $jwsMock = $this->createMock(JWS::class); + $jwsMock->method('getPayload') + ->willReturn('json-payload-string'); // Just so we have non-empty value. + $jwsMock->method('getSignature')->willReturn($this->signatureMock); + + $this->jwsDecoratorMock = $this->createMock(JwsDecorator::class); + $this->jwsDecoratorMock->method('jws')->willReturn($jwsMock); + + $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); + $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); + $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); + + $this->helpersMock = $this->createMock(Helpers::class); + $this->jsonHelperMock = $this->createMock(Helpers\Json::class); + $this->helpersMock->method('json')->willReturn($this->jsonHelperMock); + $typeHelperMock = $this->createMock(Helpers\Type::class); + $this->helpersMock->method('type')->willReturn($typeHelperMock); + $this->arrHelperMock = $this->createMock(Helpers\Arr::class); + $this->helpersMock->method('arr')->willReturn($this->arrHelperMock); + + $typeHelperMock->method('ensureNonEmptyString')->willReturnArgument(0); + $typeHelperMock->method('ensureInt')->willReturnArgument(0); + $typeHelperMock->method('ensureArray')->willReturnArgument(0); + + $this->claimFactoryMock = $this->createMock(ClaimFactory::class); + + $this->validPayload = $this->expiredPayload; + $this->validPayload['exp'] = time() + 3600; + + $this->disclosureBagMock = $this->createMock(DisclosureBag::class); + $this->kbJwtMock = $this->createMock(KbJwt::class); + } + + + protected function sut( + ?JwsDecorator $jwsDecorator = null, + ?JwsVerifierDecorator $jwsVerifierDecorator = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, + ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, + ?DateIntervalDecorator $dateIntervalDecorator = null, + ?Helpers $helpers = null, + ?ClaimFactory $claimFactory = null, + DisclosureBag|false|null $disclosureBag = null, + KbJwt|false|null $kbJwt = null, + ): SdJwtVc { + $jwsDecorator ??= $this->jwsDecoratorMock; + $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; + $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; + $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; + $helpers ??= $this->helpersMock; + $claimFactory ??= $this->claimFactoryMock; + $disclosureBag = $disclosureBag === false ? null : $disclosureBag ?? $this->disclosureBagMock; + $kbJwt = $kbJwt === false ? null : $kbJwt ?? $this->kbJwtMock; + + return new SdJwtVc( + $jwsDecorator, + $jwsVerifierDecorator, + $jwksDecoratorFactory, + $jwsSerializerManagerDecorator, + $dateIntervalDecorator, + $helpers, + $claimFactory, + $disclosureBag, + $kbJwt, + ); + } + + + public function testCanCreateInstance(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $this->assertInstanceOf( + SdJwtVc::class, + $this->sut(), + ); + } + + + public function testCanCreateInstanceWithoutDisclosureBag(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $this->assertInstanceOf( + SdJwtVc::class, + $this->sut(disclosureBag: false), + ); + } + + + public function testThrowsOnInvalidTypeHeader(): void + { + $this->sampleHeader['typ'] = 'invalid-type'; + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('Type'); + $this->sut(); + } + + + public function testThrowsOnNonDisclosableClaimCase(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $disclosureMock = $this->createMock(Disclosure::class); + $disclosureMock->method('getName')->willReturn('iss'); + $this->disclosureBagMock->method('all')->willReturn(['salt' => $disclosureMock]); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('not selectively disclosable'); + $this->expectExceptionMessage('iss'); + $this->sut(); + } + + + public function testThrowsOnSdClaimWhenNoDisclosures(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $this->arrHelperMock->method('containsKey')->willReturn(true); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('_Sd'); + $this->sut(); + } +} diff --git a/tests/src/VerifiableCredentials/TxCodeTest.php b/tests/src/VerifiableCredentials/TxCodeTest.php new file mode 100644 index 0000000..bc207df --- /dev/null +++ b/tests/src/VerifiableCredentials/TxCodeTest.php @@ -0,0 +1,53 @@ +txCode; + $description ??= $this->description; + + return new TxCode($txCode, $description); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(TxCode::class, $this->sut()); + } + + + public function testThrowsForNegativeCode(): void + { + $this->expectException(\InvalidArgumentException::class); + $this->sut(-1); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + $this->assertSame($this->txCode, $sut->getCode()); + $this->assertSame($this->txCode, $sut->getCodeAsString()); + $this->assertSame($this->description, $sut->getDescription()); + $this->assertSame(TxCodeInputModeEnum::Text, $sut->getInputMode()); + $this->assertSame(strlen((string) $this->txCode), $sut->getLength()); + $this->assertArrayHasKey('input_mode', $sut->jsonSerialize()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/AbstractIdentifiedTypedClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/AbstractIdentifiedTypedClaimValueTest.php new file mode 100644 index 0000000..6e095d1 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/AbstractIdentifiedTypedClaimValueTest.php @@ -0,0 +1,82 @@ +typeClaimValueMock = $this->createMock(TypeClaimValue::class); + } + + + protected function sut( + ?string $id = null, + ?TypeClaimValue $typeClaimValue = null, + ?array $otherClaims = null, + ?string $name = null, + ): AbstractIdentifiedTypedClaimValue { + $id ??= $this->id; + $typeClaimValue ??= $this->typeClaimValueMock; + $otherClaims ??= $this->otherClaims; + $name ??= $this->name; + + return new class ( + $id, + $typeClaimValue, + $otherClaims, + $name, + ) extends AbstractIdentifiedTypedClaimValue { + public function __construct( + string $id, + TypeClaimValue $typeClaimValue, + array $otherClaims, + protected readonly string $name, + ) { + parent::__construct($id, $typeClaimValue, $otherClaims); + } + + + public function getName(): string + { + return $this->name; + } + }; + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(AbstractIdentifiedTypedClaimValue::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + $this->assertSame($this->id, $sut->getId()); + $this->assertSame($this->typeClaimValueMock, $sut->getType()); + $this->assertSame($this->id, $sut->getKey('id')); + $this->assertSame($this->name, $sut->getName()); + $this->assertArrayHasKey('id', $sut->getValue()); + $this->assertArrayHasKey('id', $sut->jsonSerialize()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/AbstractTypedClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/AbstractTypedClaimValueTest.php new file mode 100644 index 0000000..d76fd16 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/AbstractTypedClaimValueTest.php @@ -0,0 +1,74 @@ +typeClaimValueMock = $this->createMock(TypeClaimValue::class); + } + + + protected function sut( + ?TypeClaimValue $typeClaimValue = null, + ?array $otherClaims = null, + ?string $name = null, + ): AbstractTypedClaimValue { + $typeClaimValue ??= $this->typeClaimValueMock; + $otherClaims ??= $this->otherClaims; + $name ??= $this->name; + + return new class ($typeClaimValue, $otherClaims, $name) extends AbstractTypedClaimValue { + public function __construct( + TypeClaimValue $typeClaimValue, + array $otherClaims, + protected readonly string $name, + ) { + parent::__construct($typeClaimValue, $otherClaims); + } + + + public function getName(): string + { + return $this->name; + } + }; + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(AbstractTypedClaimValue::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $this->typeClaimValueMock->expects($this->once()) + ->method('jsonSerialize') + ->willReturn('type'); + + $sut = $this->sut(); + $this->assertSame($this->typeClaimValueMock, $sut->getType()); + $this->assertSame('type', $sut->getKey('type')); + $this->assertSame($this->name, $sut->getName()); + $this->assertArrayHasKey('type', $sut->getValue()); + $this->assertArrayHasKey('type', $sut->jsonSerialize()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/TypeClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/TypeClaimValueTest.php new file mode 100644 index 0000000..2e61a0f --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/TypeClaimValueTest.php @@ -0,0 +1,49 @@ +types; + + return new TypeClaimValue($types); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(TypeClaimValue::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + $this->assertSame('type', $sut->getName()); + $this->assertSame($this->types, $sut->getValue()); + $this->assertSame($this->types, $sut->jsonSerialize()); + $this->assertTrue($sut->has('type')); + } + + + public function testJsonSerializeCanReturnStringOrArray(): void + { + $sut = $this->sut(); + $this->assertSame($this->types, $sut->jsonSerialize()); + + $sut = $this->sut(['type']); + $this->assertSame('type', $sut->jsonSerialize()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcAtContextClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcAtContextClaimValueTest.php new file mode 100644 index 0000000..640fe7c --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcAtContextClaimValueTest.php @@ -0,0 +1,55 @@ +value; + + protected array $otherContexts = []; + + + protected function sut( + ?string $baseContext = null, + ?array $otherContexts = null, + ): VcAtContextClaimValue { + $baseContext ??= $this->baseContext; + $otherContexts ??= $this->otherContexts; + + return new VcAtContextClaimValue($baseContext, $otherContexts); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcAtContextClaimValue::class, $this->sut()); + } + + + public function testThrowsOnInvalidBaseContext(): void + { + $this->expectException(VcDataModelException::class); + $this->expectExceptionMessage('context'); + + $this->sut('invalid'); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + $this->assertContains($this->baseContext, $sut->jsonSerialize()); + $this->assertSame($this->baseContext, $sut->getBaseContext()); + $this->assertSame($this->otherContexts, $sut->getOtherContexts()); + $this->assertSame('@context', $sut->getName()); + $this->assertContains($this->baseContext, $sut->getValue()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcClaimValueTest.php new file mode 100644 index 0000000..e3be149 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcClaimValueTest.php @@ -0,0 +1,142 @@ +vcAtContextClaimValueMock = $this->createMock(VcAtContextClaimValue::class); + $this->typeClaimValueMock = $this->createMock(TypeClaimValue::class); + $this->vcCredentialSubjectClaimBagMock = $this->createMock(VcCredentialSubjectClaimBag::class); + $this->issuerClaimValueMock = $this->createMock(VcIssuerClaimValue::class); + $this->issuanceDateMock = $this->createMock(\DateTimeImmutable::class); + $this->proofClaimValueMock = $this->createMock(VcProofClaimValue::class); + $this->expirationDateMock = $this->createMock(\DateTimeImmutable::class); + $this->credentialStatusClaimValueMock = $this->createMock(VcCredentialStatusClaimValue::class); + $this->credentialSchemaClaimBagMock = $this->createMock(VcCredentialSchemaClaimBag::class); + $this->refreshServiceClaimBagMock = $this->createMock(VcRefreshServiceClaimBag::class); + $this->termsOfUserClaimBagMock = $this->createMock(VcTermsOfUseClaimBag::class); + $this->evidenceClaimBagMock = $this->createMock(VcEvidenceClaimBag::class); + } + + + protected function sut( + ?VcAtContextClaimValue $vcAtContextClaimValue = null, + ?string $id = null, + ?TypeClaimValue $typeClaimValue = null, + ?VcCredentialSubjectClaimBag $vcCredentialSubjectClaimBag = null, + ?VcIssuerClaimValue $vcIssuerClaimValue = null, + ?\DateTimeImmutable $issuanceDate = null, + ?VcProofClaimValue $proofClaimValue = null, + ?\DateTimeImmutable $expirationDate = null, + ?VcCredentialStatusClaimValue $credentialStatusClaimValue = null, + ?VcCredentialSchemaClaimBag $credentialSchemaClaimBag = null, + ?VcRefreshServiceClaimBag $refreshServiceClaimBag = null, + ?VcTermsOfUseClaimBag $termsOfUserClaimBag = null, + ?VcEvidenceClaimBag $evidenceClaimBag = null, + ): VcClaimValue { + $vcAtContextClaimValue ??= $this->vcAtContextClaimValueMock; + $id ??= $this->id; + $typeClaimValue ??= $this->typeClaimValueMock; + $vcCredentialSubjectClaimBag ??= $this->vcCredentialSubjectClaimBagMock; + $vcIssuerClaimValue ??= $this->issuerClaimValueMock; + $issuanceDate ??= $this->issuanceDateMock; + $proofClaimValue ??= $this->proofClaimValueMock; + $expirationDate ??= $this->expirationDateMock; + $credentialStatusClaimValue ??= $this->credentialStatusClaimValueMock; + $credentialSchemaClaimBag ??= $this->credentialSchemaClaimBagMock; + $refreshServiceClaimBag ??= $this->refreshServiceClaimBagMock; + $termsOfUserClaimBag ??= $this->termsOfUserClaimBagMock; + $evidenceClaimBag ??= $this->evidenceClaimBagMock; + + return new VcClaimValue( + $vcAtContextClaimValue, + $id, + $typeClaimValue, + $vcCredentialSubjectClaimBag, + $vcIssuerClaimValue, + $issuanceDate, + $proofClaimValue, + $expirationDate, + $credentialStatusClaimValue, + $credentialSchemaClaimBag, + $refreshServiceClaimBag, + $termsOfUserClaimBag, + $evidenceClaimBag, + ); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcClaimValue::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + $this->assertSame($this->vcAtContextClaimValueMock, $sut->getAtContext()); + $this->assertSame($this->id, $sut->getId()); + $this->assertSame($this->typeClaimValueMock, $sut->getType()); + $this->assertSame($this->vcCredentialSubjectClaimBagMock, $sut->getCredentialSubject()); + $this->assertSame($this->issuerClaimValueMock, $sut->getIssuer()); + $this->assertSame($this->issuanceDateMock, $sut->getIssuanceDate()); + $this->assertSame($this->proofClaimValueMock, $sut->getProof()); + $this->assertSame($this->expirationDateMock, $sut->getExpirationDate()); + $this->assertSame($this->credentialStatusClaimValueMock, $sut->getCredentialStatus()); + $this->assertSame($this->credentialSchemaClaimBagMock, $sut->getCredentialSchema()); + $this->assertSame($this->refreshServiceClaimBagMock, $sut->getRefreshService()); + $this->assertSame($this->termsOfUserClaimBagMock, $sut->getTermsOfUse()); + $this->assertSame($this->evidenceClaimBagMock, $sut->getEvidence()); + $this->assertSame('vc', $sut->getName()); + + $this->assertArrayHasKey('id', $sut->getValue()); + $this->assertArrayHasKey('id', $sut->jsonSerialize()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSchemaClaimBagTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSchemaClaimBagTest.php new file mode 100644 index 0000000..ffb067c --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSchemaClaimBagTest.php @@ -0,0 +1,53 @@ +vcCredentialSchemaClaimValueMock = $this->createMock(VcCredentialSchemaClaimValue::class); + } + + + protected function sut( + ?VcCredentialSchemaClaimValue $vcCredentialStatusClaimValue = null, + VcCredentialStatusClaimValue ...$vcCredentialStatusClaimValues, + ): VcCredentialSchemaClaimBag { + $vcCredentialStatusClaimValue ??= $this->vcCredentialSchemaClaimValueMock; + + return new VcCredentialSchemaClaimBag($vcCredentialStatusClaimValue, ...$vcCredentialStatusClaimValues); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcCredentialSchemaClaimBag::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $this->vcCredentialSchemaClaimValueMock->expects($this->once()) + ->method('jsonSerialize') + ->willReturn(['schema']); + + $sut = $this->sut(); + $this->assertSame('credentialSchema', $sut->getName()); + $this->assertSame([$this->vcCredentialSchemaClaimValueMock], $sut->getValue()); + $this->assertSame([['schema']], $sut->jsonSerialize()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSchemaClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSchemaClaimValueTest.php new file mode 100644 index 0000000..029b104 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSchemaClaimValueTest.php @@ -0,0 +1,53 @@ +typeClaimValueMock = $this->createMock(TypeClaimValue::class); + } + + + protected function sut( + ?string $id = null, + ?TypeClaimValue $typeClaimValue = null, + ): VcCredentialSchemaClaimValue { + $id ??= $this->id; + $typeClaimValue ??= $this->typeClaimValueMock; + + return new VcCredentialSchemaClaimValue( + $id, + $typeClaimValue, + ); + } + + + public function testCanCrateInstance(): void + { + $this->assertInstanceOf(VcCredentialSchemaClaimValue::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + $this->assertSame($this->id, $sut->getId()); + $this->assertSame($this->typeClaimValueMock, $sut->getType()); + $this->assertSame('credentialSchema', $sut->getName()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialStatusClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialStatusClaimValueTest.php new file mode 100644 index 0000000..a5bc483 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialStatusClaimValueTest.php @@ -0,0 +1,50 @@ +typeClaimValueMock = $this->createMock(TypeClaimValue::class); + } + + + protected function sut( + ?string $id = null, + ?TypeClaimValue $typeClaimValue = null, + ): VcCredentialStatusClaimValue { + $id ??= $this->id; + $typeClaimValue ??= $this->typeClaimValueMock; + + return new VcCredentialStatusClaimValue($id, $typeClaimValue); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcCredentialStatusClaimValue::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + $this->assertSame($this->id, $sut->getId()); + $this->assertSame($this->typeClaimValueMock, $sut->getType()); + $this->assertSame('credentialStatus', $sut->getName()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSubjectClaimBagTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSubjectClaimBagTest.php new file mode 100644 index 0000000..173ee42 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSubjectClaimBagTest.php @@ -0,0 +1,53 @@ +vcCredentialSubjectClaimValueMock = $this->createMock(VcCredentialSubjectClaimValue::class); + } + + + protected function sut( + ?VcCredentialSubjectClaimValue $vcCredentialSubjectClaimValue = null, + VcCredentialSubjectClaimValue ...$vcCredentialSubjectClaimValues, + ): VcCredentialSubjectClaimBag { + $vcCredentialSubjectClaimValue ??= $this->vcCredentialSubjectClaimValueMock; + + return new VcCredentialSubjectClaimBag($vcCredentialSubjectClaimValue, ...$vcCredentialSubjectClaimValues); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcCredentialSubjectClaimBag::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $this->vcCredentialSubjectClaimValueMock->expects($this->once()) + ->method('jsonSerialize') + ->willReturn(['credentialSubject']); + + $sut = $this->sut(); + + + $this->assertSame('credentialSubject', $sut->getName()); + $this->assertSame([$this->vcCredentialSubjectClaimValueMock], $sut->getValue()); + $this->assertSame([['credentialSubject']], $sut->jsonSerialize()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSubjectClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSubjectClaimValueTest.php new file mode 100644 index 0000000..4571e16 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcCredentialSubjectClaimValueTest.php @@ -0,0 +1,39 @@ + 'subject']; + + + protected function sut( + ?array $data = null, + ): VcCredentialSubjectClaimValue { + $data ??= $this->data; + + return new VcCredentialSubjectClaimValue($data); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcCredentialSubjectClaimValue::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + $this->assertSame($this->data, $sut->jsonSerialize()); + $this->assertSame($this->data, $sut->getValue()); + $this->assertSame('subject', $sut->get('id')); + $this->assertSame('credentialSubject', $sut->getName()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcEvidenceClaimBagTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcEvidenceClaimBagTest.php new file mode 100644 index 0000000..d1e7208 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcEvidenceClaimBagTest.php @@ -0,0 +1,51 @@ +vcEvidenceClaimValueMock = $this->createMock(VcEvidenceClaimValue::class); + } + + + protected function sut( + ?VcEvidenceClaimValue $vcEvidenceClaimValue = null, + VcEvidenceClaimValue ...$vcEvidenceClaimValues, + ): VcEvidenceClaimBag { + $vcEvidenceClaimValue ??= $this->vcEvidenceClaimValueMock; + + return new VcEvidenceClaimBag($vcEvidenceClaimValue, ...$vcEvidenceClaimValues); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcEvidenceClaimBag::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $this->vcEvidenceClaimValueMock->expects($this->once()) + ->method('jsonSerialize') + ->willReturn(['evidence']); + + $sut = $this->sut(); + $this->assertSame('evidence', $sut->getName()); + $this->assertSame([$this->vcEvidenceClaimValueMock], $sut->getValue()); + $this->assertSame([['evidence']], $sut->jsonSerialize()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcEvidenceClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcEvidenceClaimValueTest.php new file mode 100644 index 0000000..a274add --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcEvidenceClaimValueTest.php @@ -0,0 +1,45 @@ +typeClaimValue = $this->createMock(TypeClaimValue::class); + } + + + protected function sut( + ?TypeClaimValue $typeClaimValue = null, + ): VcEvidenceClaimValue { + $typeClaimValue ??= $this->typeClaimValue; + + return new VcEvidenceClaimValue($typeClaimValue); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcEvidenceClaimValue::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + $this->assertSame($this->typeClaimValue, $sut->getType()); + $this->assertSame('evidence', $sut->getName()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcIssuerClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcIssuerClaimValueTest.php new file mode 100644 index 0000000..21a478d --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcIssuerClaimValueTest.php @@ -0,0 +1,45 @@ +id; + $otherClaims ??= $this->otherClaims; + + return new VcIssuerClaimValue($id, $otherClaims); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcIssuerClaimValue::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + + $this->assertSame($this->id, $sut->getId()); + $this->assertSame('id', $sut->getKey('id')); + $this->assertSame('issuer', $sut->getName()); + $this->assertSame(['id' => 'id'], $sut->getValue()); + $this->assertSame(['id' => 'id'], $sut->jsonSerialize()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcProofClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcProofClaimValueTest.php new file mode 100644 index 0000000..bf5da95 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcProofClaimValueTest.php @@ -0,0 +1,49 @@ +typeClaimValueMock = $this->createMock(TypeClaimValue::class); + } + + + protected function sut( + ?TypeClaimValue $typeClaimValue = null, + ?array $otherClaims = null, + ): VcProofClaimValue { + $typeClaimValue ??= $this->typeClaimValueMock; + $otherClaims ??= $this->otherClaims; + + return new VcProofClaimValue($typeClaimValue, $otherClaims); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcProofClaimValue::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + $this->assertSame($this->typeClaimValueMock, $sut->getType()); + $this->assertSame('proof', $sut->getName()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcRefreshServiceClaimBagTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcRefreshServiceClaimBagTest.php new file mode 100644 index 0000000..17e649f --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcRefreshServiceClaimBagTest.php @@ -0,0 +1,52 @@ +vcRefreshServiceClaimValueMock = $this->createMock(VcRefreshServiceClaimValue::class); + } + + + protected function sut( + ?VcRefreshServiceClaimValue $vcRefreshServiceClaimValue = null, + VcRefreshServiceClaimValue ...$vcRefreshServiceClaimValues, + ): \SimpleSAML\OpenID\VerifiableCredentials\VcDataModel\Claims\VcRefreshServiceClaimBag { + $vcRefreshServiceClaimValue ??= $this->vcRefreshServiceClaimValueMock; + + return new VcRefreshServiceClaimBag($vcRefreshServiceClaimValue, ...$vcRefreshServiceClaimValues); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcRefreshServiceClaimBag::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $this->vcRefreshServiceClaimValueMock->expects($this->once()) + ->method('jsonSerialize') + ->willReturn(['refreshService']); + + $sut = $this->sut(); + $this->assertSame([['refreshService']], $sut->jsonSerialize()); + $this->assertSame([$this->vcRefreshServiceClaimValueMock], $sut->getValue()); + $this->assertSame('refreshService', $sut->getName()); + ; + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcRefreshServiceClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcRefreshServiceClaimValueTest.php new file mode 100644 index 0000000..cf5c8ae --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcRefreshServiceClaimValueTest.php @@ -0,0 +1,54 @@ +typeClaimValue = $this->createMock(TypeClaimValue::class); + } + + + protected function sut( + ?string $id = null, + ?TypeClaimValue $typeClaimValue = null, + ?array $otherClaims = null, + ): VcRefreshServiceClaimValue { + $id ??= $this->id; + $typeClaimValue ??= $this->typeClaimValue; + $otherClaims ??= $this->otherClaims; + + return new VcRefreshServiceClaimValue($id, $typeClaimValue, $otherClaims); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcRefreshServiceClaimValue::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + $this->assertSame($this->id, $sut->getId()); + $this->assertSame($this->typeClaimValue, $sut->getType()); + $this->assertSame('refreshService', $sut->getName()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcTermsOfUseClaimBagTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcTermsOfUseClaimBagTest.php new file mode 100644 index 0000000..54d3062 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcTermsOfUseClaimBagTest.php @@ -0,0 +1,51 @@ +vcTermsOfUseClaimValueMock = $this->createMock(VcTermsOfUseClaimValue::class); + } + + + protected function sut( + ?VcTermsOfUseClaimValue $vcTermsOfUseClaimValue = null, + VcTermsOfUseClaimValue ...$vcTermsOfUseClaimValues, + ): VcTermsOfUseClaimBag { + $vcTermsOfUseClaimValue ??= $this->vcTermsOfUseClaimValueMock; + + return new VcTermsOfUseClaimBag($vcTermsOfUseClaimValue, ...$vcTermsOfUseClaimValues); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcTermsOfUseClaimBag::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $this->vcTermsOfUseClaimValueMock->expects($this->once()) + ->method('jsonSerialize') + ->willReturn(['termsOfUse']); + + $sut = $this->sut(); + $this->assertSame('termsOfUse', $sut->getName()); + $this->assertSame([$this->vcTermsOfUseClaimValueMock], $sut->getValue()); + $this->assertSame([['termsOfUse']], $sut->jsonSerialize()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Claims/VcTermsOfUseClaimValueTest.php b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcTermsOfUseClaimValueTest.php new file mode 100644 index 0000000..e794c09 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Claims/VcTermsOfUseClaimValueTest.php @@ -0,0 +1,49 @@ +typeClaimValueMock = $this->createMock(TypeClaimValue::class); + } + + + protected function sut( + ?TypeClaimValue $typeClaimValue = null, + ?array $otherClaims = null, + ): VcTermsOfUseClaimValue { + $typeClaimValue ??= $this->typeClaimValueMock; + $otherClaims ??= $this->otherClaims; + + return new VcTermsOfUseClaimValue($typeClaimValue, $otherClaims); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcTermsOfUseClaimValue::class, $this->sut()); + } + + + public function testCanGetProperties(): void + { + $sut = $this->sut(); + $this->assertSame($this->typeClaimValueMock, $sut->getType()); + $this->assertSame('termsOfUse', $sut->getName()); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Factories/JwtVcJsonFactoryTest.php b/tests/src/VerifiableCredentials/VcDataModel/Factories/JwtVcJsonFactoryTest.php new file mode 100644 index 0000000..3399a99 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Factories/JwtVcJsonFactoryTest.php @@ -0,0 +1,191 @@ + 'RS256', + 'typ' => 'JWT', + 'kid' => 'did:example:abfe13f712120431c276e12ecab#keys-1', + ]; + + // https://www.w3.org/TR/vc-data-model/#example-jwt-payload-of-a-jwt-based-verifiable-credential-using-jws-as-a-proof-non-normative + protected array $expiredPayload = [ + 'sub' => 'did:example:ebfeb1f712ebc6f1c276e12ec21', + 'jti' => 'http://example.edu/credentials/3732', + 'iss' => 'https://example.com/keys/foo.jwk', + 'nbf' => 1541493724, + 'iat' => 1541493724, + 'exp' => 1573029723, + 'nonce' => '660!6345FSer', + 'vc' => [ + '@context' => [ + 'https://www.w3.org/2018/credentials/v1', + 'https://www.w3.org/2018/credentials/examples/v1', + ], + 'type' => ['VerifiableCredential', 'UniversityDegreeCredential'], + 'credentialSubject' => [ + 'degree' => [ + 'type' => 'BachelorDegree', + 'name' => 'Bachelor of Science and Arts', + ], + ], + ], + ]; + + protected array $validPayload; + + protected MockObject $jwkDecoratorMock; + + + protected function setUp(): void + { + $this->signatureMock = $this->createMock(Signature::class); + + $jwsMock = $this->createMock(JWS::class); + $jwsMock->method('getPayload') + ->willReturn('json-payload-string'); // Just so we have non-empty value. + $jwsMock->method('getSignature')->willReturn($this->signatureMock); + + $jwsDecoratorMock = $this->createMock(JwsDecorator::class); + $jwsDecoratorMock->method('jws')->willReturn($jwsMock); + + $this->jwsDecoratorBuilderMock = $this->createMock(JwsDecoratorBuilder::class); + $this->jwsDecoratorBuilderMock->method('fromToken')->willReturn($jwsDecoratorMock); + $this->jwsDecoratorBuilderMock->method('fromData')->willReturn($jwsDecoratorMock); + + $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); + $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); + $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); + + $this->helpersMock = $this->createMock(Helpers::class); + $this->jsonHelperMock = $this->createMock(Helpers\Json::class); + $this->helpersMock->method('json')->willReturn($this->jsonHelperMock); + $typeHelperMock = $this->createMock(Helpers\Type::class); + $this->helpersMock->method('type')->willReturn($typeHelperMock); + + $this->helpersMock->method('arr')->willReturn(new Helpers\Arr()); + + $typeHelperMock->method('ensureNonEmptyString')->willReturnArgument(0); + $typeHelperMock->method('ensureInt')->willReturnArgument(0); + + $this->claimFactoryMock = $this->createMock(ClaimFactory::class); + + $this->validPayload = $this->expiredPayload; + $this->validPayload['exp'] = time() + 3600; + + $this->jwkDecoratorMock = $this->createMock(JwkDecorator::class); + } + + + protected function sut( + ?JwsDecoratorBuilder $jwsDecoratorBuilder = null, + ?JwsVerifierDecorator $jwsVerifierDecorator = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, + ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, + ?DateIntervalDecorator $dateIntervalDecorator = null, + ?Helpers $helpers = null, + ?ClaimFactory $claimFactory = null, + ): JwtVcJsonFactory { + $jwsDecoratorBuilder ??= $this->jwsDecoratorBuilderMock; + $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; + $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; + $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; + $helpers ??= $this->helpersMock; + $claimFactory ??= $this->claimFactoryMock; + + return new JwtVcJsonFactory( + $jwsDecoratorBuilder, + $jwsVerifierDecorator, + $jwksDecoratorFactory, + $jwsSerializerManagerDecorator, + $dateIntervalDecorator, + $helpers, + $claimFactory, + ); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(JwtVcJsonFactory::class, $this->sut()); + } + + + public function testCanBuildFromToken(): void + { + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + + $this->assertInstanceOf( + JwtVcJson::class, + $this->sut()->fromToken('token'), + ); + } + + + public function testCanBuildFromData(): void + { + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + + $this->assertInstanceOf( + JwtVcJson::class, + $this->sut()->fromData( + $this->jwkDecoratorMock, + SignatureAlgorithmEnum::ES256, + $this->validPayload, + $this->sampleHeader, + ), + ); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/Factories/VcDataModelClaimFactoryTest.php b/tests/src/VerifiableCredentials/VcDataModel/Factories/VcDataModelClaimFactoryTest.php new file mode 100644 index 0000000..2e1e436 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/Factories/VcDataModelClaimFactoryTest.php @@ -0,0 +1,265 @@ +helpers = new Helpers(); + $this->claimFactoryMock = $this->createMock(ClaimFactory::class); + } + + + public function sut( + ?Helpers $helpers = null, + ?VcDataModelClaimFactory $claimFactory = null, + ): VcDataModelClaimFactory { + $helpers ??= $this->helpers; + $claimFactory ??= $this->claimFactoryMock; + + return new VcDataModelClaimFactory($helpers, $claimFactory); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VcDataModelClaimFactory::class, $this->sut()); + } + + + public function testCanBuildVcClaimValue(): void + { + $this->assertInstanceOf( + VcClaimValue::class, + $this->sut()->buildVcClaimValue( + $this->createMock(VcAtContextClaimValue::class), + 'id', + $this->createMock(TypeClaimValue::class), + $this->createMock(VcCredentialSubjectClaimBag::class), + $this->createMock(VcIssuerClaimValue::class), + $this->createMock(DateTimeImmutable::class), + null, + null, + null, + null, + null, + null, + null, + ), + ); + } + + + public function testCanBuildVcAtContextClaimValue(): void + { + $this->assertInstanceOf( + VcAtContextClaimValue::class, + $this->sut()->buildVcAtContextClaimValue(AtContextsEnum::W3Org2018CredentialsV1->value, []), + ); + } + + + public function testCanBuildTypeClaimValue(): void + { + $this->assertInstanceOf(TypeClaimValue::class, $this->sut()->buildTypeClaimValue('type')); + } + + + public function testBuildTypeClaimValueThrowsIfDataNotArray(): void + { + $this->expectException(\SimpleSAML\OpenID\Exceptions\VcDataModelException::class); + $this->expectExceptionMessage('Type'); + + $this->sut()->buildTypeClaimValue(1); + } + + + public function testBuildVcCredentialSubjectClaimValue(): void + { + $this->assertInstanceOf( + VcCredentialSubjectClaimValue::class, + $this->sut()->buildVcCredentialSubjectClaimValue([]), + ); + } + + + public function testBuildVcCredentialSubjectClaimBag(): void + { + $this->assertInstanceOf( + VcCredentialSubjectClaimBag::class, + $this->sut()->buildVcCredentialSubjectClaimBag(['id' => 'subject']), + ); + } + + + public function testBuildVcCredentialSubjectClaimBagThrowsIfSubProvidedForMultipleSubjects(): void + { + $this->expectException(\SimpleSAML\OpenID\Exceptions\VcDataModelException::class); + $this->expectExceptionMessage('multiple subjects'); + + $this->sut()->buildVcCredentialSubjectClaimBag( + [['id' => 'subject'],['id' => 'subject2']], + 'sub', + ); + } + + + public function testBuildVcCredentialSubjectClaimBagSetsSubForSingleSubject(): void + { + $this->assertInstanceOf( + VcCredentialSubjectClaimBag::class, + $this->sut()->buildVcCredentialSubjectClaimBag(['id' => 'subject'], 'sub'), + ); + } + + + public function testBuildVcIssuerClaimValue(): void + { + $this->assertInstanceOf( + VcIssuerClaimValue::class, + $this->sut()->buildVcIssuerClaimValue(['id' => 'urn:example:issuer']), + ); + } + + + public function testBuildVcProofClaimValue(): void + { + $this->assertInstanceOf( + VcProofClaimValue::class, + $this->sut()->buildVcProofClaimValue(['type' => 'type']), + ); + } + + + public function testBuildVcCredentialStatusClaimValue(): void + { + $this->assertInstanceOf( + VcCredentialStatusClaimValue::class, + $this->sut()->buildVcCredentialStatusClaimValue(['id' => 'urn:example:status', 'type' => 'type']), + ); + } + + + public function testBuildVcCredentialSchemaClaimValue(): void + { + $this->assertInstanceOf( + VcCredentialSchemaClaimValue::class, + $this->sut()->buildVcCredentialSchemaClaimValue(['id' => 'urn:example:schema', 'type' => 'type']), + ); + } + + + public function testBuildVcCredentialSchemaClaimBag(): void + { + $this->assertInstanceOf( + VcCredentialSchemaClaimBag::class, + $this->sut()->buildVcCredentialSchemaClaimBag(['id' => 'urn:example:schema', 'type' => 'type']), + ); + } + + + public function testBuildVcRefreshServiceClaimValue(): void + { + $this->assertInstanceOf( + VcRefreshServiceClaimValue::class, + $this->sut()->buildVcRefreshServiceClaimValue(['id' => 'urn:example:refresh', 'type' => 'type']), + ); + } + + + public function testBuildVcRefreshServiceClaimBag(): void + { + $this->assertInstanceOf( + VcRefreshServiceClaimBag::class, + $this->sut()->buildVcRefreshServiceClaimBag(['id' => 'urn:example:refresh', 'type' => 'type']), + ); + } + + + public function testBuildVcTermsOfUseClaimValue(): void + { + $this->assertInstanceOf( + VcTermsOfUseClaimValue::class, + $this->sut()->buildVcTermsOfUseClaimValue(['type' => 'type']), + ); + } + + + public function testBuildVcTermsOfUseClaimBag(): void + { + $this->assertInstanceOf( + VcTermsOfUseClaimBag::class, + $this->sut()->buildVcTermsOfUseClaimBag(['type' => 'type']), + ); + } + + + public function testBuildVcEvidenceClaimValue(): void + { + $this->assertInstanceOf( + VcEvidenceClaimValue::class, + $this->sut()->buildVcEvidenceClaimValue(['type' => 'type']), + ); + } + + + public function testBuildVcEvidenceClaimBag(): void + { + $this->assertInstanceOf( + VcEvidenceClaimBag::class, + $this->sut()->buildVcEvidenceClaimBag(['type' => 'type']), + ); + } +} diff --git a/tests/src/VerifiableCredentials/VcDataModel/JwtVcJsonTest.php b/tests/src/VerifiableCredentials/VcDataModel/JwtVcJsonTest.php new file mode 100644 index 0000000..c9063b3 --- /dev/null +++ b/tests/src/VerifiableCredentials/VcDataModel/JwtVcJsonTest.php @@ -0,0 +1,604 @@ + [ + "@context" => [ + "https://www.w3.org/2018/credentials/v1", + "https://www.w3.org/2018/credentials/examples/v1", + ], + "id" => "https://credential-issuer.example.com/credentials/3732", + "type" => [ + "VerifiableCredential", + "UniversityDegreeCredential", + ], + "issuer" => "https://credential-issuer.example.com", + "issuanceDate" => "2025-01-01T00:00:00Z", + "expirationDate" => "2025-01-01T00:00:00Z", + "credentialSubject" => [ + // phpcs:ignore Generic.Files.LineLength.TooLong + "id" => "did:jwk:eyJraWQiOiJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6andrLXRodW1icHJpbnQ6c2hhLTI1NjpWYkpPU3ZqeFU2TDhDN0dVTzRkc2hJWVYzemJ2RndrWUI0M1lKNUt0dDhFIiwia3R5IjoiRUMiLCJjcnYiOiJQLTI1NiIsImFsZyI6IkVTMjU2IiwieCI6Ik1kQy1PS3E0QVFKZlZDWDV6cFFvTDhqNFZFZnZQWDk4dFU5aHhjTlhHcm8iLCJ5IjoibnNXbmZiNk5Xc0szOUJILWhBYVNrQ1NlNEJ5bWVOc2NKRV9zYUQzRDNiTSJ9", + "degree" => [ + "type" => "BachelorDegree", + "name" => "Bachelor of Science and Arts", + ], + ], + ], + "iss" => "https://credential-issuer.example.com", + "nbf" => 1735689600, + "jti" => "https://credential-issuer.example.com/credentials/3732", + // phpcs:ignore Generic.Files.LineLength.TooLong + "sub" => "did:jwk:eyJraWQiOiJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6andrLXRodW1icHJpbnQ6c2hhLTI1NjpWYkpPU3ZqeFU2TDhDN0dVTzRkc2hJWVYzemJ2RndrWUI0M1lKNUt0dDhFIiwia3R5IjoiRUMiLCJjcnYiOiJQLTI1NiIsImFsZyI6IkVTMjU2IiwieCI6Ik1kQy1PS3E0QVFKZlZDWDV6cFFvTDhqNFZFZnZQWDk4dFU5aHhjTlhHcm8iLCJ5IjoibnNXbmZiNk5Xc0szOUJILWhBYVNrQ1NlNEJ5bWVOc2NKRV9zYUQzRDNiTSJ9", + ]; + + protected array $sampleHeader = [ + 'alg' => 'ES256', + 'typ' => 'JWT', + 'kid' => 'F4VFObNusj3PHmrHxpqh4GNiuFHlfh-2s6xMJ95fLYA', + ]; + + protected array $validPayload; + + + protected function setUp(): void + { + $this->signatureMock = $this->createMock(Signature::class); + + $jwsMock = $this->createMock(JWS::class); + $jwsMock->method('getPayload') + ->willReturn('json-payload-string'); // Just so we have non-empty value. + $jwsMock->method('getSignature')->willReturn($this->signatureMock); + + $this->jwsDecoratorMock = $this->createMock(JwsDecorator::class); + $this->jwsDecoratorMock->method('jws')->willReturn($jwsMock); + + $this->jwsVerifierDecoratorMock = $this->createMock(JwsVerifierDecorator::class); + $this->jwksDecoratorFactoryMock = $this->createMock(JwksDecoratorFactory::class); + $this->jwsSerializerManagerDecoratorMock = $this->createMock(JwsSerializerManagerDecorator::class); + $this->dateIntervalDecoratorMock = $this->createMock(DateIntervalDecorator::class); + + $this->helpersMock = $this->createMock(Helpers::class); + $this->jsonHelperMock = $this->createMock(Helpers\Json::class); + $this->helpersMock->method('json')->willReturn($this->jsonHelperMock); + $typeHelperMock = $this->createMock(Helpers\Type::class); + $this->helpersMock->method('type')->willReturn($typeHelperMock); + $arrHelperMock = $this->createMock(Helpers\Arr::class); + $this->helpersMock->method('arr')->willReturn($arrHelperMock); + $this->dateTimeHelperMock = $this->createMock(Helpers\DateTime::class); + $this->helpersMock->method('dateTime')->willReturn($this->dateTimeHelperMock); + + $typeHelperMock->method('ensureNonEmptyString')->willReturnArgument(0); + $typeHelperMock->method('ensureInt')->willReturnArgument(0); + $typeHelperMock->method('ensureArray')->willReturnArgument(0); + + $arrHelperMock->method('getNestedValue') + ->willReturnCallback(fn( + array $array, + string $key, + string $key2, + ): mixed => $array[$key][$key2] ?? null); + + $this->claimFactoryMock = $this->createMock(ClaimFactory::class); + + $this->validPayload = $this->expiredPayload; + $this->validPayload['exp'] = time() + 3600; + $this->validPayload['vc']['expirationDate'] = (new DateTimeImmutable())->modify('+1 hour') + ->format(DateTimeInterface::ATOM); + } + + + protected function sut( + ?JwsDecorator $jwsDecorator = null, + ?JwsVerifierDecorator $jwsVerifierDecorator = null, + ?JwksDecoratorFactory $jwksDecoratorFactory = null, + ?JwsSerializerManagerDecorator $jwsSerializerManagerDecorator = null, + ?DateIntervalDecorator $dateIntervalDecorator = null, + ?Helpers $helpers = null, + ?ClaimFactory $claimFactory = null, + ): JwtVcJson { + $jwsDecorator ??= $this->jwsDecoratorMock; + $jwsVerifierDecorator ??= $this->jwsVerifierDecoratorMock; + $jwksDecoratorFactory ??= $this->jwksDecoratorFactoryMock; + $jwsSerializerManagerDecorator ??= $this->jwsSerializerManagerDecoratorMock; + $dateIntervalDecorator ??= $this->dateIntervalDecoratorMock; + $helpers ??= $this->helpersMock; + $claimFactory ??= $this->claimFactoryMock; + + return new JwtVcJson( + $jwsDecorator, + $jwsVerifierDecorator, + $jwksDecoratorFactory, + $jwsSerializerManagerDecorator, + $dateIntervalDecorator, + $helpers, + $claimFactory, + ); + } + + + public function testCanCreateInstance(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $this->assertInstanceOf( + JwtVcJson::class, + $this->sut(), + ); + } + + + public function testCanGetProperties(): void + { + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $sut = $this->sut(); + $this->assertSame(CredentialFormatIdentifiersEnum::JwtVcJson, $sut->getCredentialFormatIdentifier()); + $this->assertInstanceOf(VcClaimValue::class, $sut->getVc()); + $this->assertInstanceOf(VcAtContextClaimValue::class, $sut->getVcAtContext()); + $this->assertIsString($sut->getVcId()); + $this->assertInstanceOf(TypeClaimValue::class, $sut->getVcType()); + $this->assertInstanceOf(VcCredentialSubjectClaimBag::class, $sut->getVcCredentialSubject()); + $this->assertInstanceOf(VcIssuerClaimValue::class, $sut->getVcIssuer()); + $this->assertInstanceOf(\DateTimeImmutable::class, $sut->getVcIssuanceDate()); + $this->assertInstanceOf(\DateTimeImmutable::class, $sut->getVcExpirationDate()); + } + + + public function testThrowsIfNoVcClaimInPayload(): void + { + $this->expectException(JwsException::class); + $this->expectExceptionMessage('VC'); + + $payload = $this->validPayload; + unset($payload['vc']); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->sut(); + } + + + public function testThrowsForInvalidBaseContext(): void + { + $this->expectException(JwsException::class); + $this->expectExceptionMessage('context'); + + $payload = $this->validPayload; + $payload['vc']['@context'] = [123]; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->sut(); + } + + + public function testJwtIdCanBeNull(): void + { + $payload = $this->validPayload; + unset($payload['jti']); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $sut = $this->sut(); + $this->assertNull($sut->getJwtId()); + $this->assertIsString($sut->getVcId()); + } + + + public function testVcIdCanBeNull(): void + { + $payload = $this->validPayload; + unset($payload['jti']); + unset($payload['vc']['id']); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $sut = $this->sut(); + $this->assertNull($sut->getVcId()); + } + + + public function testIssCanBeNull(): void + { + $payload = $this->validPayload; + unset($payload['iss']); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $sut = $this->sut(); + $this->assertNull($sut->getIssuer()); + $this->assertInstanceOf(VcIssuerClaimValue::class, $sut->getVcIssuer()); + } + + + public function testThrowsOnMissingIssuer(): void + { + $payload = $this->validPayload; + unset($payload['iss']); + unset($payload['vc']['issuer']); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('Issuer'); + + $this->sut(); + } + + + public function testCanHaveMultipleIssuers(): void + { + $payload = $this->validPayload; + unset($payload['iss']); + $payload['vc']['issuer'] = ['https://issuer1.example.com', 'https://issuer2.example.com']; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->assertInstanceOf(VcIssuerClaimValue::class, $this->sut()->getVcIssuer()); + } + + + public function testThrowsOnMalformedIssuer(): void + { + $payload = $this->validPayload; + unset($payload['iss']); + $payload['vc']['issuer'] = 123; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('Issuer'); + + $this->sut(); + } + + + public function testNbfCanBeNull(): void + { + $payload = $this->validPayload; + unset($payload['nbf']); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->assertNull($this->sut()->getNotBefore()); + $this->assertInstanceOf(\DateTimeImmutable::class, $this->sut()->getVcIssuanceDate()); + } + + + public function testThrowsOnInvalidNbf(): void + { + $this->dateTimeHelperMock->method('fromTimestamp') + ->willThrowException(new \Exception('Error')); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($this->validPayload); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('Not Before'); + + $this->sut(); + } + + + public function testThrowsOnInvalidIssuanceDate(): void + { + $payload = $this->validPayload; + unset($payload['nbf']); + unset($payload['vc']['issuanceDate']); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('Issuance Date'); + + $this->sut(); + } + + + public function testThrowsOnParseIssuanceDateError(): void + { + $payload = $this->validPayload; + unset($payload['nbf']); + + $this->dateTimeHelperMock->method('fromXsDateTime') + ->willThrowException(new \Exception('Error')); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + + $this->sut()->getVcIssuanceDate(); + } + + + public function testCanGetProof(): void + { + $payload = $this->validPayload; + $payload['vc']['proof'] = ['type' => 'type']; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->assertInstanceOf( + VcProofClaimValue::class, + $this->sut()->getVcProof(), + ); + } + + + public function testThrowsOnMalformedProof(): void + { + $payload = $this->validPayload; + $payload['vc']['proof'] = 123; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('Proof'); + + $this->sut(); + } + + + public function testExpCanBeNull(): void + { + $payload = $this->validPayload; + unset($payload['exp']); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $sut = $this->sut(); + $this->assertNull($sut->getExpirationTime()); + $this->assertInstanceOf(\DateTimeImmutable::class, $sut->getVcExpirationDate()); + } + + + public function testExpirationDateCanBeNull(): void + { + $payload = $this->validPayload; + unset($payload['exp']); + unset($payload['vc']['expirationDate']); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->assertNotInstanceOf(\DateTimeImmutable::class, $this->sut()->getVcExpirationDate()); + } + + + public function testThrowsOnParseExpirationDateError(): void + { + $payload = $this->validPayload; + unset($payload['exp']); + + + $this->dateTimeHelperMock->method('fromXsDateTime') + ->willThrowException(new \Exception('Error')); + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + + $this->sut()->getVcExpirationDate(); + } + + + public function testThrowsOnMalformedExpirationDate(): void + { + $payload = $this->validPayload; + unset($payload['exp']); + $payload['vc']['expirationDate'] = 123; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + + $this->sut()->getVcExpirationDate(); + } + + + public function testCanGetCredentialStatus(): void + { + $payload = $this->validPayload; + $payload['vc']['credentialStatus'] = ['id' => 'id', 'type' => 'type']; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->assertInstanceOf(VcCredentialStatusClaimValue::class, $this->sut()->getVcCredentialStatus()); + } + + + public function testThrowsOnMalformedCredentialStatus(): void + { + $payload = $this->validPayload; + $payload['vc']['credentialStatus'] = 123; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('Credential Status'); + + $this->sut(); + } + + + public function testCanGetCredentialSchema(): void + { + $payload = $this->validPayload; + $payload['vc']['credentialSchema'] = ['id' => 'id', 'type' => 'type']; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->assertInstanceOf(VcCredentialSchemaClaimBag::class, $this->sut()->getVcCredentialSchema()); + } + + + public function testThrowsOnMalformedCredentialSchema(): void + { + $payload = $this->validPayload; + $payload['vc']['credentialSchema'] = 123; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('Credential Schema'); + + $this->sut(); + } + + + public function testCanGetRefreshService(): void + { + $payload = $this->validPayload; + $payload['vc']['refreshService'] = ['id' => 'id', 'type' => 'type']; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->assertInstanceOf(VcRefreshServiceClaimBag::class, $this->sut()->getVcRefreshService()); + } + + + public function testThrowsOnMalformedRefreshService(): void + { + $payload = $this->validPayload; + $payload['vc']['refreshService'] = 123; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('Refresh Service'); + + $this->sut(); + } + + + public function testCanGetTermsOfUse(): void + { + $payload = $this->validPayload; + $payload['vc']['termsOfUse'] = ['type' => 'type']; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->assertInstanceOf(VcTermsOfUseClaimBag::class, $this->sut()->getVcTermsOfUse()); + } + + + public function testThrowsOnMalformedTermsOfUse(): void + { + $payload = $this->validPayload; + $payload['vc']['termsOfUse'] = 123; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('Terms Of Use'); + + $this->sut(); + } + + + public function testCanGetEvidence(): void + { + $payload = $this->validPayload; + $payload['vc']['evidence'] = ['type' => 'type']; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->assertInstanceOf(VcEvidenceClaimBag::class, $this->sut()->getVcEvidence()); + } + + + public function testThrowsOnMalformedEvidence(): void + { + $payload = $this->validPayload; + $payload['vc']['evidence'] = 123; + + $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader); + $this->jsonHelperMock->method('decode')->willReturn($payload); + + $this->expectException(JwsException::class); + $this->expectExceptionMessage('Evidence'); + + $this->sut()->getVcEvidence(); + } +} diff --git a/tests/src/VerifiableCredentialsTest.php b/tests/src/VerifiableCredentialsTest.php new file mode 100644 index 0000000..157acec --- /dev/null +++ b/tests/src/VerifiableCredentialsTest.php @@ -0,0 +1,224 @@ +supportedSerializersMock = $this->createMock(SupportedSerializers::class); + $this->supportedAlgorithmsMock = $this->createMock(SupportedAlgorithms::class); + $this->loggerMock = $this->createMock(LoggerInterface::class); + $this->timestampValidationLeeway = new DateInterval('PT1M'); + } + + + protected function sut( + ?SupportedSerializers $supportedSerializers = null, + ?SupportedAlgorithms $supportedAlgorithms = null, + ?LoggerInterface $logger = null, + ?DateInterval $timestampValidationLeeway = null, + ): VerifiableCredentials { + $supportedSerializers ??= $this->supportedSerializersMock; + $supportedAlgorithms ??= $this->supportedAlgorithmsMock; + $logger ??= $this->loggerMock; + $timestampValidationLeeway ??= $this->timestampValidationLeeway; + + return new VerifiableCredentials( + $supportedSerializers, + $supportedAlgorithms, + $logger, + $timestampValidationLeeway, + ); + } + + + public function testCanCreateInstance(): void + { + $this->assertInstanceOf(VerifiableCredentials::class, $this->sut()); + } + + + public function testCanBuildTools(): void + { + $sut = $this->sut(); + + $this->assertInstanceOf( + DateIntervalDecoratorFactory::class, + $sut->dateIntervalDecoratorFactory(), + ); + + $this->assertInstanceOf( + Helpers::class, + $sut->helpers(), + ); + + $this->assertInstanceOf( + ClaimsPathPointerResolver::class, + $sut->claimsPathPointerResolver(), + ); + + $this->assertInstanceOf( + JwsDecoratorBuilderFactory::class, + $sut->jwsDecoratorBuilderFactory(), + ); + + $this->assertInstanceOf( + JwsSerializerManagerDecoratorFactory::class, + $sut->jwsSerializerManagerDecoratorFactory(), + ); + + $this->assertInstanceOf( + JwsDecoratorBuilderFactory::class, + $sut->jwsDecoratorBuilderFactory(), + ); + + $this->assertInstanceOf( + JwsSerializerManagerDecoratorFactory::class, + $sut->jwsSerializerManagerDecoratorFactory(), + ); + + $this->assertInstanceOf( + JwsSerializerManagerDecorator::class, + $sut->jwsSerializerManagerDecorator(), + ); + + $this->assertInstanceOf( + AlgorithmManagerDecoratorFactory::class, + $sut->algorithmManagerDecoratorFactory(), + ); + + $this->assertInstanceOf( + AlgorithmManagerDecorator::class, + $sut->algorithmManagerDecorator(), + ); + + $this->assertInstanceOf( + JwsDecoratorBuilder::class, + $sut->jwsDecoratorBuilder(), + ); + + $this->assertInstanceOf( + JwsVerifierDecoratorFactory::class, + $sut->jwsVerifierDecoratorFactory(), + ); + + $this->assertInstanceOf( + JwsVerifierDecorator::class, + $sut->jwsVerifierDecorator(), + ); + + $this->assertInstanceOf( + JwksDecoratorFactory::class, + $sut->jwksDecoratorFactory(), + ); + + $this->assertInstanceOf( + JwtVcJsonFactory::class, + $sut->jwtVcJsonFactory(), + ); + + $this->assertInstanceOf( + CredentialOfferFactory::class, + $sut->credentialOfferFactory(), + ); + + $this->assertInstanceOf( + OpenId4VciProofFactory::class, + $sut->openId4VciProofFactory(), + ); + + $this->assertInstanceOf( + DisclosureFactory::class, + $sut->disclosureFactory(), + ); + + $this->assertInstanceOf( + DisclosureBagFactory::class, + $sut->disclosureBagFactory(), + ); + + $this->assertInstanceOf( + DisclosureFactory::class, + $sut->disclosureFactory(), + ); + + $this->assertInstanceOf( + DisclosureBagFactory::class, + $sut->disclosureBagFactory(), + ); + + $this->assertInstanceOf( + SdJwtVcFactory::class, + $sut->sdJwtVcFactory(), + ); + + $this->assertInstanceOf( + TxCodeFactory::class, + $sut->txCodeFactory(), + ); + } +}