feat: Validate and check Waci profile creation that each scope has ou…

…tput descriptors configured.

closes trustbloc#581

Signed-off-by: talwinder50 <[email protected]>

pkg/profile/issuer/profile.go

@@ -125,6 +125,12 @@ func validateProfileRequest(pr *ProfileData) error {
 		return fmt.Errorf("supported vc contexts mandatory")
 	}
 
+	if pr.SupportsWACI {
+		if pr.IssuerID == "" {
+			return fmt.Errorf("issuer id mandatory for waci profiles")
+		}
+	}
+
 	if !adapterutil.ValidHTTPURL(pr.URL) {
 		return fmt.Errorf("issuer url is invalid")
 	}

pkg/profile/issuer/profile_test.go

@@ -91,6 +91,11 @@ func TestCredentialRecord_SaveProfile(t *testing.T) {
 		err = record.SaveProfile(value)
 		require.Error(t, err)
 		require.Contains(t, err.Error(), "issuer url is invalid")
+
+		value.SupportsWACI = true
+		err = record.SaveProfile(value)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "issuer id mandatory for waci profiles")
 	})
 
 	t.Run("test save profile - profile already exists", func(t *testing.T) {

pkg/restapi/issuer/operation/models.go

@@ -16,6 +16,8 @@ import (
 )
 
 // ProfileDataRequest req for profile creation.
+// Issuer ID identifies who is the issuer of the credential manifests being issued.
+// CMStyle represents an entity styles object as defined in credential manifest spec.
 type ProfileDataRequest struct {
 	ID                          string            `json:"id,omitempty"`
 	Name                        string            `json:"name"`
@@ -26,7 +28,7 @@ type ProfileDataRequest struct {
 	SupportsWACI                bool              `json:"supportsWACI"`
 	OIDCProviderURL             string            `json:"oidcProvider"`
 	OIDCClientParams            *OIDCClientParams `json:"oidcParams,omitempty"`
-	CredentialScopes            []string          `json:"scopes,omitempty"`
+	CredentialScopes            []string          `json:"credScopes,omitempty"`
 	LinkedWalletURL             string            `json:"linkedWallet,omitempty"`
 	IssuerID                    string            `json:"issuerID,omitempty"`
 	CMStyle                     cm.Styles         `json:"styles,omitempty"`
@@ -46,6 +48,7 @@ type WalletConnect struct {
 
 // txnData contains session data.
 type txnData struct {
+	// Todo rename this to profile ID
 	IssuerID          string                `json:"issuerID,omitempty"`
 	State             string                `json:"state,omitempty"`
 	DIDCommInvitation *outofband.Invitation `json:"didCommInvitation,omitempty"`

pkg/restapi/issuer/operation/operations.go

@@ -284,6 +284,7 @@ func New(config *Config) (*Operation, error) { // nolint:funlen,gocyclo,cyclop
 		refreshTokenStore:  refreshStore,
 		didDomain:          config.DidDomain,
 		jsonldDocLoader:    config.JSONLDDocumentLoader,
+		cmOutputDescriptor: config.CmOutputDescriptor,
 	}
 
 	op.createOIDCClientFunc = op.getOrCreateOIDCClient
@@ -383,6 +384,18 @@ func (o *Operation) createIssuerProfileHandler(rw http.ResponseWriter, req *http
 		return
 	}
 
+	if profileData.SupportsWACI {
+		for _, pCredScope := range profileData.CredentialScopes {
+			if _, ok := o.cmOutputDescriptor[pCredScope]; !ok {
+				commhttp.WriteErrorResponseWithLog(rw, http.StatusInternalServerError,
+					fmt.Sprintf("failed to get output descriptors configured for waci "+
+						"profile(s)"), profileEndpoint, logger)
+
+				return
+			}
+		}
+	}
+
 	if profileData.OIDCProviderURL != "" {
 		_, err = o.createOIDCClientFunc(profileData)
 		if err != nil {
@@ -1268,7 +1281,10 @@ func (o *Operation) handleProposeCredential(msg service.DIDCommAction) (issuecre
 	// read credential manifest
 	manifest := o.readCredentialManifest(profile, txn.CredScope)
 
-	// TODO #581 validate read credential manifest object
+	err = manifest.Validate()
+	if err != nil {
+		return nil, fmt.Errorf("failed to validate credential manifest object: %w", err)
+	}
 
 	// get unsigned credential
 	vc, err := o.createCredential(getUserDataURL(profile.URL), userInvMap.TxToken, oauthToken,

pkg/restapi/issuer/operation/operations_test.go

@@ -549,6 +549,46 @@ func TestCreateProfile(t *testing.T) {
 		require.Equal(t, vReq.URL, profileRes.URL)
 		require.Equal(t, vReq.SupportsAssuranceCredential, profileRes.SupportsAssuranceCredential)
 	})
+	t.Run("create waci profile with cm output descriptors - success", func(t *testing.T) {
+		t.Parallel()
+
+		vReq := createProfileData(uuid.New().String())
+		vReq.SupportsWACI = true
+		vReq.CredentialScopes = []string{mockCredScope}
+		vReq.OIDCClientParams = &issuer.OIDCClientParams{
+			ClientID:     "client id",
+			ClientSecret: "client secret",
+			SecretExpiry: 0,
+		}
+
+		vReqBytes, err := json.Marshal(vReq)
+		require.NoError(t, err)
+
+		op.cmOutputDescriptor = map[string][]*cm.OutputDescriptor{
+			mockCredScope: {
+				&cm.OutputDescriptor{
+					ID:     uuid.New().String(),
+					Schema: "https://www.w3.org/2018/credentials/examples/v1",
+				},
+			},
+		}
+
+		h := getHandler(t, op, endpoint)
+		rr := serveHTTP(t, h.Handle(), http.MethodPost, endpoint, vReqBytes)
+
+		require.Equal(t, http.StatusCreated, rr.Code)
+
+		profileRes := &issuer.ProfileData{}
+		err = json.Unmarshal(rr.Body.Bytes(), &profileRes)
+		require.NoError(t, err)
+		require.Equal(t, vReq.ID, profileRes.ID)
+		require.Equal(t, vReq.Name, profileRes.Name)
+		require.Equal(t, vReq.URL, profileRes.URL)
+		require.Equal(t, vReq.SupportsAssuranceCredential, profileRes.SupportsAssuranceCredential)
+		require.Equal(t, vReq.CredentialScopes, profileRes.CredentialScopes)
+		require.Equal(t, vReq.IssuerID, profileRes.IssuerID)
+		require.Equal(t, vReq.SupportsWACI, profileRes.SupportsWACI)
+	})
 
 	t.Run("create profile - invalid request", func(t *testing.T) {
 		t.Parallel()
@@ -646,6 +686,31 @@ func TestCreateProfile(t *testing.T) {
 
 		require.Contains(t, resErr.ErrMessage, "create oidc client")
 	})
+	t.Run("create profile - failed to output descriptors configured for waci profiles", func(t *testing.T) {
+		t.Parallel()
+
+		ops, err := New(config(t))
+		require.NoError(t, err)
+
+		vReq := createProfileData(uuid.New().String())
+		vReq.SupportsWACI = true
+		vReq.CredentialScopes = []string{mockCredScope}
+
+		vReqBytes, err := json.Marshal(vReq)
+		require.NoError(t, err)
+
+		rr := serveHTTP(t, getHandler(t, ops, endpoint).Handle(), http.MethodPost, endpoint, vReqBytes)
+
+		require.Equal(t, http.StatusInternalServerError, rr.Code)
+
+		resErr := struct {
+			ErrMessage string `json:"errMessage"`
+		}{}
+		err = json.Unmarshal(rr.Body.Bytes(), &resErr)
+		require.NoError(t, err)
+
+		require.Contains(t, resErr.ErrMessage, "failed to get output descriptors configured for waci profile")
+	})
 }
 
 func TestGetProfile(t *testing.T) {

test/bdd/features/issuer_e2e_waci.feature

@@ -14,13 +14,13 @@ Feature: Issuer Adapter e2e with WACI
 
   @issuer_adapter_waci
   Scenario Outline: Issuer adapter features
-    Given Issuer Profile with id "<profileID>", name "<profileName>", issuerURL "<issuerURL>", supportedVCContexts "<supportedVCContexts>", linked wallet "<linkedWallet>" and oidc provider "https://issuer-hydra.trustbloc.local:9044/" with WACI support
-    And   Retrieved profile with id "<profileID>" contains name "<profileName>", issuerURL "<issuerURL>", supportedVCContexts "<supportedVCContexts>", linked wallet "<linkedWallet>" and oidc provider "https://issuer-hydra.trustbloc.local:9044/" with WACI support
-    Then  Issuer adapter shows the wallet connect UI when the issuer "<profileID>" wants to connect to the wallet
+    Given Issuer Profile with id "<profileID>", name "<profileName>", issuerURL "<issuerURL>", supportedVCContexts "<supportedVCContexts>", credScopes "<credScopes>", issuer id "<issuerID>", linked wallet "<linkedWallet>" and oidc provider "https://issuer-hydra.trustbloc.local:9044/" with WACI support
+    And   Retrieved profile with id "<profileID>" contains name "<profileName>", issuerURL "<issuerURL>", supportedVCContexts "<supportedVCContexts>", credScopes "<credScopes>", issuer id "<issuerID>", linked wallet "<linkedWallet>" and oidc provider "https://issuer-hydra.trustbloc.local:9044/" with WACI support
+    Then  Issuer adapter shows the wallet connect UI when the issuer "<profileID>" with cred scope "<credScopes>" wants to connect to the wallet
     And   Issuer adapter ("<profileID>") creates DIDComm connection invitation for "<walletID>"
     And   "<walletID>" accepts invitation from issuer adapter "<profileID>" and performs WACI credential issuance interaction
     And   "<walletID>" received web redirect info from "<profileID>" after successful completion of WACI credential issuance interaction
     Examples:
-      | profileID  | profileName   | issuerURL                          | supportedVCContexts                                                   | linkedWallet                    | walletID  |
-      | prCardWACI | PRCard Issuer | http://mock-issuer.com:9080/prCard | https://trustbloc.github.io/context/vc/examples/citizenship-v1.jsonld | https://example.wallet.com/waci | WalletApp |
+      | profileID  | profileName   | issuerURL                          | supportedVCContexts                                                   | credScopes | issuerID                         | linkedWallet                    | walletID  |
+      | prCardWACI | PRCard Issuer | http://mock-issuer.com:9080/prCard | https://trustbloc.github.io/context/vc/examples/citizenship-v1.jsonld | prc        | did:example:123?linked-domains=3 | https://example.wallet.com/waci | WalletApp |
 

test/bdd/fixtures/adapter-rest/docker-compose.yml

@@ -27,7 +27,7 @@ services:
       - ADAPTER_REST_EXTERNAL_URL=https://issuer-adapter-rest.trustbloc.local:9070
       - ADAPTER_REST_DID_ANCHOR_ORIGIN=https://testnet.orb.local
       - ADAPTER_REST_CONTEXT_PROVIDER_URL=${CONTEXT_PROVIDER_URL}
-      - ADAPTER_REST_OUTPUT_DESCRIPTORS_FILE=/etc/manifest-config/outputdescriptors.json
+      - ADAPTER_REST_OUTPUT_DESCRIPTORS_FILE=/etc/testdata/manifest-config/outputdescriptors.json
       - ADAPTER_REST_KEY_TYPE=${AGENT_KEY_TYPE}
       - ADAPTER_REST_KEY_AGREEMENT_TYPE=${AGENT_KEY_AGREEMENT_TYPE}
       - ADAPTER_REST_MEDIA_TYPE_PROFILES=${AGENT_MEDIA_TYPE_PROFILES}
@@ -39,7 +39,7 @@ services:
     volumes:
       - ../keys/tls:/etc/tls
       - ../keys/issuer-stores:/etc/store-keys
-      - ./manifest-config:/etc/manifest-config
+      - ../testdata:/etc/testdata
     networks:
       - bdd_net
     depends_on:

test/bdd/pkg/issuer/issuer_steps.go

@@ -62,6 +62,8 @@ func (e *Steps) RegisterSteps(s *godog.Suite) {
 		e.retrieveProfileWithOIDC)
 	s.Step(`^Issuer adapter shows the wallet connect UI when the issuer "([^"]*)" wants to connect to the wallet$`,
 		e.walletConnect)
+	s.Step(`^Issuer adapter shows the wallet connect UI when the issuer "([^"]*)" with cred scope "([^"]*)" wants to connect to the wallet$`,
+		e.walletConnectOIDC)
 	s.Step(`^Issuer adapter gets oidc authorization for the issuer "([^"]*)"$`,
 		e.oidcLogin)
 	s.Step(`^Issuer adapter \("([^"]*)"\) creates DIDComm connection invitation for "([^"]*)"$`,
@@ -71,25 +73,25 @@ func (e *Steps) RegisterSteps(s *godog.Suite) {
 	s.Step(`^Issuer has a profile with name "([^"]*)", issuerURL "([^"]*)" and supportedVCContexts "([^"]*)"$`, e.createAndValidateProfile)
 	s.Step(`^Issuer has a profile with name "([^"]*)", issuerURL "([^"]*)", oidc provider "([^"]*)" and supportedVCContexts "([^"]*)"$`, e.createAndValidateProfileWithOIDC)
 
-	// waci steps
-	s.Step(`^Issuer Profile with id "([^"]*)", name "([^"]*)", issuerURL "([^"]*)", supportedVCContexts "([^"]*)", linked wallet "([^"]*)" and oidc provider "([^"]*)" with WACI support$`, e.createProfileWithWACI)
-	s.Step(`^Retrieved profile with id "([^"]*)" contains name "([^"]*)", issuerURL "([^"]*)", supportedVCContexts "([^"]*)", linked wallet "([^"]*)" and oidc provider "([^"]*)" with WACI support$`, e.retrieveProfileWithWACI)
+	// waci steps id, name, issuerURL, supportedVCContexts, credScope, issuerID, linkedWallet, oidcProvider string
+	s.Step(`^Issuer Profile with id "([^"]*)", name "([^"]*)", issuerURL "([^"]*)", supportedVCContexts "([^"]*)", credScopes "([^"]*)", issuer id "([^"]*)", linked wallet "([^"]*)" and oidc provider "([^"]*)" with WACI support$`, e.createProfileWithWACI)
+	s.Step(`^Retrieved profile with id "([^"]*)" contains name "([^"]*)", issuerURL "([^"]*)", supportedVCContexts "([^"]*)", credScopes "([^"]*)", issuer id "([^"]*)", linked wallet "([^"]*)" and oidc provider "([^"]*)" with WACI support$`, e.retrieveProfileWithWACI)
 }
 
 func (e *Steps) createBasicProfile(id, name, issuerURL, supportedVCContexts,
 	requiresBlindedRouteStr, supportsAssuranceCredStr string) error {
 	return e.createProfile(id, name, issuerURL, supportedVCContexts,
-		requiresBlindedRouteStr, supportsAssuranceCredStr, "", "", false)
+		requiresBlindedRouteStr, supportsAssuranceCredStr, "", "", "", "", false)
 }
 
 func (e *Steps) createProfileWithOIDC(id, name, issuerURL, supportedVCContexts,
 	requiresBlindedRouteStr, supportsAssuranceCredStr, oidcProvider string) error {
 	return e.createProfile(id, name, issuerURL, supportedVCContexts,
-		requiresBlindedRouteStr, supportsAssuranceCredStr, oidcProvider, "", false)
+		requiresBlindedRouteStr, supportsAssuranceCredStr, oidcProvider, "", "", "", false)
 }
-
+// id, name, issuerURL, supportedVCContexts, credScope, issuerID, linkedWallet, oidcProvider string
 func (e *Steps) createProfile(id, name, issuerURL, supportedVCContexts,
-	requiresBlindedRouteStr, supportsAssuranceCredStr, oidcProvider, linkedWallet string, supportsWACI bool) error {
+	requiresBlindedRouteStr, supportsAssuranceCredStr, oidcProvider, credScope, issuerID, linkedWallet string, supportsWACI bool) error {
 	supportsAssuranceCred, err := strconv.ParseBool(supportsAssuranceCredStr)
 	if err != nil {
 		return fmt.Errorf("parse failure: %w", err)
@@ -109,6 +111,8 @@ func (e *Steps) createProfile(id, name, issuerURL, supportedVCContexts,
 		RequiresBlindedRoute:        requiresBlindedRoute,
 		SupportsWACI:                supportsWACI,
 		OIDCProviderURL:             oidcProvider,
+		IssuerID:                    issuerID,
+		CredentialScopes:            strings.Split(credScope, ","),
 		LinkedWalletURL:             linkedWallet,
 	}
 
@@ -142,18 +146,18 @@ func (e *Steps) createProfile(id, name, issuerURL, supportedVCContexts,
 func (e *Steps) retrieveBasicProfile(id, name, issuerURL, supportedVCContexts,
 	requiresBlindedRouteStr, supportsAssuranceCredStr string) error {
 	return e.retrieveProfile(id, name, issuerURL, supportedVCContexts,
-		requiresBlindedRouteStr, supportsAssuranceCredStr, "", "", false)
+		requiresBlindedRouteStr, supportsAssuranceCredStr, "", "", "", "", false)
 }
 
 func (e *Steps) retrieveProfileWithOIDC(id, name, issuerURL, supportedVCContexts,
 	requiresBlindedRouteStr, supportsAssuranceCredStr, oidcProvider string) error {
 	return e.retrieveProfile(id, name, issuerURL, supportedVCContexts,
-		requiresBlindedRouteStr, supportsAssuranceCredStr, oidcProvider, "", false)
+		requiresBlindedRouteStr, supportsAssuranceCredStr, oidcProvider, "", "", "", false)
 }
 
 // nolint:funlen,gomnd,gocyclo,cyclop
 func (e *Steps) retrieveProfile(id, name, issuerURL, supportedVCContexts,
-	requiresBlindedRouteStr, supportsAssuranceCredStr, oidcProvider, linkedWallet string, supportsWACI bool) error {
+	requiresBlindedRouteStr, supportsAssuranceCredStr, oidcProvider, credScope, issuerID, linkedWallet string, supportsWACI bool) error {
 	resp, err := bddutil.HTTPDo(http.MethodGet, //nolint: bodyclose
 		fmt.Sprintf(AdapterURL+"/profile/%s", id), "", "", nil, e.bddContext.TLSConfig())
 	if err != nil {
@@ -193,6 +197,16 @@ func (e *Steps) retrieveProfile(id, name, issuerURL, supportedVCContexts,
 			oidcProvider, profileResponse.OIDCProviderURL)
 	}
 
+	if profileResponse.IssuerID != issuerID {
+		return fmt.Errorf("profile issuer id doesn't match : expected=%s actual=%s",
+			issuerID, profileResponse.IssuerID)
+	}
+
+	if len(profileResponse.CredentialScopes) != len(strings.Split(credScope, ",")) {
+		return fmt.Errorf("supported cred scope count doesnt match : expected=%d actual=%d",
+			len(strings.Split(credScope, ",")), len(profileResponse.CredentialScopes))
+	}
+
 	if len(profileResponse.SupportedVCContexts) != len(strings.Split(supportedVCContexts, ",")) {
 		return fmt.Errorf("supported vc count doesnt match : expected=%d actual=%d",
 			len(strings.Split(supportedVCContexts, ",")), len(profileResponse.SupportedVCContexts))
@@ -250,12 +264,34 @@ func (e *Steps) retrieveProfile(id, name, issuerURL, supportedVCContexts,
 	return nil
 }
 
-func (e *Steps) walletConnect(issuerID string) error {
+func (e *Steps) walletConnect(profileID string) error {
 	state := uuid.New().String()
-	e.states[issuerID] = state
+	e.states[profileID] = state
+
+	resp, err := bddutil.HTTPDo(http.MethodGet, //nolint: bodyclose
+		fmt.Sprintf(AdapterURL+"/%s/connect/wallet?state=%s", profileID, state), "", "", nil,
+		e.bddContext.TLSConfig())
+	if err != nil {
+		return fmt.Errorf("failed to execute wallet request: %w", err)
+	}
+
+	defer bddutil.CloseResponseBody(resp.Body)
+
+	// validating only status code as the vue page needs javascript support
+	if resp.StatusCode != http.StatusOK {
+		// nolint:wrapcheck // ignore
+		return bddutil.ExpectedStatusCodeError(http.StatusOK, resp.StatusCode, nil)
+	}
+
+	e.txnIDs[profileID] = resp.Request.URL.Query().Get("txnID")
+	e.userIDs[profileID] = resp.Request.URL.Query().Get("uID")
+
+	return nil
+}
 
+func (e *Steps) walletConnectOIDC(profileID, credScope string) error {
 	resp, err := bddutil.HTTPDo(http.MethodGet, //nolint: bodyclose
-		fmt.Sprintf(AdapterURL+"/%s/connect/wallet?state=%s", issuerID, state), "", "", nil,
+		fmt.Sprintf(AdapterURL+"/%s/connect/wallet?cred=%s", profileID, credScope), "", "", nil,
 		e.bddContext.TLSConfig())
 	if err != nil {
 		return fmt.Errorf("failed to execute wallet request: %w", err)
@@ -269,8 +305,8 @@ func (e *Steps) walletConnect(issuerID string) error {
 		return bddutil.ExpectedStatusCodeError(http.StatusOK, resp.StatusCode, nil)
 	}
 
-	e.txnIDs[issuerID] = resp.Request.URL.Query().Get("txnID")
-	e.userIDs[issuerID] = resp.Request.URL.Query().Get("uID")
+	e.txnIDs[profileID] = resp.Request.URL.Query().Get("txnID")
+	e.userIDs[profileID] = resp.Request.URL.Query().Get("uID")
 
 	return nil
 }
@@ -414,30 +450,30 @@ func (e *Steps) createAndValidateProfile(name, issuerURL, supportedVCContexts st
 func (e *Steps) createAndValidateProfileWithOIDC(name, issuerURL, oidcProvider, supportedVCContexts string) error {
 	id := uuid.New().String()
 
-	err := e.createProfile(id, name, issuerURL, supportedVCContexts, "false", "false", oidcProvider, "", false)
+	err := e.createProfile(id, name, issuerURL, supportedVCContexts, "false", "false", oidcProvider, "", "", "", false)
 	if err != nil {
 		return fmt.Errorf("failed to create profile for id='%s', err:%w", id, err)
 	}
 
-	err = e.retrieveProfile(id, name, issuerURL, supportedVCContexts, "false", "false", oidcProvider, "", false)
+	err = e.retrieveProfile(id, name, issuerURL, supportedVCContexts, "false", "false", oidcProvider, "", "", "", false)
 	if err != nil {
 		return fmt.Errorf("failed to retrieve profile for id='%s', err:%w", id, err)
 	}
 
 	return nil
 }
-
-func (e *Steps) createProfileWithWACI(id, name, issuerURL, supportedVCContexts, linkedWallet, oidcProvider string) error { //nolint:lll
-	err := e.createProfile(id, name, issuerURL, supportedVCContexts, "false", "false", oidcProvider, linkedWallet, true)
+// id, name, issuerURL, supportedVCContexts, credScope, issuerID, linkedWallet, oidcProvider string
+func (e *Steps) createProfileWithWACI(id, name, issuerURL, supportedVCContexts, credScopes, issuerID, linkedWallet, oidcProvider string) error { //nolint:lll
+	err := e.createProfile(id, name, issuerURL, supportedVCContexts, "false", "false", oidcProvider, credScopes, issuerID, linkedWallet, true)
 	if err != nil {
 		return fmt.Errorf("failed to create profile for id='%s', err:%w", id, err)
 	}
 
 	return nil
 }
 
-func (e *Steps) retrieveProfileWithWACI(id, name, issuerURL, supportedVCContexts, linkedWallet, oidcProvider string) error { //nolint:lll
-	err := e.retrieveProfile(id, name, issuerURL, supportedVCContexts, "false", "false", oidcProvider, linkedWallet, true)
+func (e *Steps) retrieveProfileWithWACI(id, name, issuerURL, supportedVCContexts, credScopes, issuerID, linkedWallet, oidcProvider string) error { //nolint:lll
+	err := e.retrieveProfile(id, name, issuerURL, supportedVCContexts, "false", "false", oidcProvider, credScopes, issuerID, linkedWallet, true)
 	if err != nil {
 		return fmt.Errorf("failed to retrieve profile for id='%s', err:%w", id, err)
 	}