fix: issuing_jurisdiction enforcement

this is only required if the stateOrProvinceName element is present in the DS certificate fixes #26
auth0-lab · Oct 29, 2024 · 822672a · 822672a
1 parent 87a39cb
commit 822672a
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/src/mdoc/IssuerSignedItem.ts b/src/mdoc/IssuerSignedItem.ts
@@ -85,7 +85,7 @@ export class IssuerSignedItem {
     if (this.elementIdentifier === 'issuing_country') {
       return countryName === this.elementValue;
     }
-    if (this.elementIdentifier === 'issuing_jurisdiction') {
+    if (this.elementIdentifier === 'issuing_jurisdiction' && stateOrProvince) {
       return stateOrProvince === this.elementValue;
     }
     return undefined;

diff --git a/src/mdoc/Verifier.ts b/src/mdoc/Verifier.ts
@@ -283,7 +283,7 @@ export class Verifier {
           });
 
           const invalidJurisdiction = verifications.filter((v) => v.ns === ns && v.ev.elementIdentifier === 'issuing_jurisdiction')
-            .find((v) => !v.isValid || !v.ev.matchCertificate(ns, issuerAuth));
+            .find((v) => !v.isValid || (issuerAuth.stateOrProvince && !v.ev.matchCertificate(ns, issuerAuth)));
 
           onCheck({
             status: invalidJurisdiction ? 'FAILED' : 'PASSED',