Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add support for ocsp reason code suspended #306

Merged
merged 5 commits into from
Nov 27, 2024
Merged

feat: add support for ocsp reason code suspended #306

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7eea711
feat: add support for OCSP reason code suspended
chershentan Nov 25, 2024
86fa428
test: add test case for OCSP reason code suspended and a test case fo…
chershentan Nov 25, 2024
ebf0d2b
test: add test case "should throw an invalid ocsp response error when…
chershentan Nov 25, 2024
295e154
refactor: use values of OcspResponderRevocationReason for ValidOcspRe…
chershentan Nov 26, 2024
06134d2
Update src/verifiers/documentStatus/didSigned/didSignedDocumentStatus…
chershentan Nov 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
159 changes: 159 additions & 0 deletions src/verifiers/documentStatus/didSigned/didSignedDocumentStatus.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -595,6 +595,127 @@ describe("verify", () => {

server.close();
});

it("should fail when DID document is signed but is found by an OCSP with reasoncode for suspended", async () => {
whenPublicKeyResolvesSuccessfully();

const handlers = [
rest.get(
"https://ocsp.example.com/0x28b221f6287d8e4f8da09a835bcb750537cc8385e2535ff63591fdf0162be824",
(_, res, ctx) => {
return res(
ctx.json({
revoked: true,
documentHash: "0x28b221f6287d8e4f8da09a835bcb750537cc8385e2535ff63591fdf0162be824",
reasonCode: 1001,
})
);
}
),
rest.get(
"https://ocsp.example.com/0x56961854a82feafe9a56eb57acfe3b97f17eda5d497b622c9acc9f03c412618c",
(_, res, ctx) => {
return res(
ctx.json({
revoked: false,
documentHash: "0x56961854a82feafe9a56eb57acfe3b97f17eda5d497b622c9acc9f03c412618c",
})
);
}
),
];

const server: SetupServerApi = setupServer(...handlers);
server.listen();

const res = await openAttestationDidSignedDocumentStatus.verify(didSignedOcspResponderV2, options);
expect(res).toMatchInlineSnapshot(`
Object {
"data": Object {
"details": Object {
"issuance": Array [
Object {
"did": "did:ethr:0xB26B4941941C51a4885E5B7D3A1B861E54405f90",
"issued": true,
},
],
"revocation": Array [
Object {
"address": "https://ocsp.example.com",
"reason": Object {
"code": 1001,
"codeString": "SUSPENDED",
"message": "Document 0x56961854a82feafe9a56eb57acfe3b97f17eda5d497b622c9acc9f03c412618c has been revoked under OCSP Responder: https://ocsp.example.com",
},
"revoked": true,
},
],
},
"issuedOnAll": true,
"revokedOnAny": true,
},
"name": "OpenAttestationDidSignedDocumentStatus",
"reason": Object {
"code": 1001,
"codeString": "SUSPENDED",
"message": "Document 0x56961854a82feafe9a56eb57acfe3b97f17eda5d497b622c9acc9f03c412618c has been revoked under OCSP Responder: https://ocsp.example.com",
},
"status": "INVALID",
"type": "DOCUMENT_STATUS",
}
`);

server.close();
});
it("should thwow an invalid ocsp response error when DID document is signed but is found by an OCSP with an invalid reasoncode", async () => {
whenPublicKeyResolvesSuccessfully();

const handlers = [
rest.get(
"https://ocsp.example.com/0x28b221f6287d8e4f8da09a835bcb750537cc8385e2535ff63591fdf0162be824",
(_, res, ctx) => {
return res(
ctx.json({
revoked: true,
documentHash: "0x28b221f6287d8e4f8da09a835bcb750537cc8385e2535ff63591fdf0162be824",
reasonCode: 7,
})
);
}
),
rest.get(
"https://ocsp.example.com/0x56961854a82feafe9a56eb57acfe3b97f17eda5d497b622c9acc9f03c412618c",
(_, res, ctx) => {
return res(
ctx.json({
revoked: false,
documentHash: "0x56961854a82feafe9a56eb57acfe3b97f17eda5d497b622c9acc9f03c412618c",
})
);
}
),
];

const server: SetupServerApi = setupServer(...handlers);
server.listen();

const res = await openAttestationDidSignedDocumentStatus.verify(didSignedOcspResponderV2, options);
expect(res).toMatchInlineSnapshot(`
Object {
"data": [Error: Invalid or unexpected response from OCSP Responder],
"name": "OpenAttestationDidSignedDocumentStatus",
"reason": Object {
"code": 11,
"codeString": "OCSP_RESPONSE_INVALID",
"message": "Invalid or unexpected response from OCSP Responder",
},
"status": "ERROR",
"type": "DOCUMENT_STATUS",
}
`);

server.close();
});
});

describe("v3", () => {
Expand Down Expand Up @@ -990,6 +1111,44 @@ describe("verify", () => {
}
`);

server.close();
});
it("should throw an invalid ocsp response error when DID document is signed but is found by an OCSP with an invalid reasoncode", async () => {
whenPublicKeyResolvesSuccessfully("0x1245e5B64D785b25057f7438F715f4aA5D965733");

const handlers = [
rest.get(
"https://ocsp.example.com/0x69e1a174ea67e1c3119639f713f8a7348bbda54fdce60903621398cc2fea4d40",
(_, res, ctx) => {
return res(
ctx.json({
revoked: true,
documentHash: "0x69e1a174ea67e1c3119639f713f8a7348bbda54fdce60903621398cc2fea4d40",
reasonCode: 7,
})
);
}
),
];

const server: SetupServerApi = setupServer(...handlers);
server.listen();

const res = await openAttestationDidSignedDocumentStatus.verify(didSignedOcspResponderV3, options);
expect(res).toMatchInlineSnapshot(`
Object {
"data": [Error: Invalid or unexpected response from OCSP Responder],
"name": "OpenAttestationDidSignedDocumentStatus",
"reason": Object {
"code": 11,
"codeString": "OCSP_RESPONSE_INVALID",
"message": "Invalid or unexpected response from OCSP Responder",
},
"status": "ERROR",
"type": "DOCUMENT_STATUS",
}
`);

server.close();
});
});
Expand Down
2 changes: 1 addition & 1 deletion src/verifiers/documentStatus/didSigned/didSignedDocumentStatus.type.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ export type DidSignedIssuanceStatusArray = Static<typeof DidSignedIssuanceStatus
* OCSP response
*/

export const ValidOcspReasonCode = Number.withConstraint((n) => n >= 0 && n <= 10 && n != 7);
export const ValidOcspReasonCode = Number.withConstraint((n) => [1, 2, 3, 4, 5, 6, 8, 9, 10, 1001].includes(n));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was just thinking, would this be simpler and still work?

export const ValidOcspReasonCode = Number.withConstraint((n) => Object.values(OcspResponderRevocationReason).includes(n));

This will need to import OcspResponderRevocationReason from revocation.types.ts into this file though. But what you have works too!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another thing is, n >= 0 && n <= 10 && n != 7 includes 0 but [1, 2, 3, 4, 5, 6, 8, 9, 10, 1001] doesn't. So maybe need to add 0 if we prefer listing out the numbers.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch!
I will follow your suggestion as it is cleaner


export const ValidOcspResponse = Record({
revoked: Literal(false),
Expand Down
1 change: 1 addition & 0 deletions src/verifiers/documentStatus/revocation.types.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,4 +32,5 @@ export enum OcspResponderRevocationReason {
REMOVE_FROM_CRL = 8,
PRIVILEGE_WITHDRAWN = 9,
A_A_COMPROMISE = 10,
SUSPENDED = 1001,
}
Loading