fix(vc): bind credential verification to the signed proof (#105, #108)

.changeset/bind-parsed-credential-to-proof.md

@@ -0,0 +1,8 @@
+---
+"@agentcommercekit/vc": patch
+"@agentcommercekit/ack-pay": patch
+---
+
+Bind credential verification to the signed proof. `verifyProof()` now returns the credential decoded from `proof.jwt`, and `verifyParsedCredential()` runs every downstream check (expiry, revocation, trusted issuer, and claim verifiers) against that verified credential rather than the caller-supplied object. It also now returns the verified credential, so consumers can read signed fields from the return value instead of the object they passed in. On the parsed-credential input path a caller could previously attach a valid `proof.jwt` while mutating the outer `credentialSubject`, `issuer`, etc.; those fields were trusted directly. Now they are ignored in favor of the signed payload. Fixes #105 and #108.
+
+`verifyPaymentReceipt()` now reads the receipt returned by `verifyParsedCredential()` before using signed receipt fields, so parsed receipt callers cannot swap the outer `paymentRequestToken` away from the token in `proof.jwt`.

demos/e2e/src/credential-verifier.ts

@@ -80,12 +80,16 @@ export class CredentialVerifier {
       throw new InvalidCredentialSubjectError()
     }
 
-    await verifyParsedCredential(parsedCredential, {
+    const verifiedCredential = await verifyParsedCredential(parsedCredential, {
       resolver: this.resolver,
       trustedIssuers: this.trustedIssuers,
       verifiers: [getControllerClaimVerifier()],
     })
 
-    return parsedCredential
+    if (!isControllerCredential(verifiedCredential)) {
+      throw new InvalidCredentialSubjectError()
+    }
+
+    return verifiedCredential as Verifiable<ControllerCredential>
   }
 }

examples/verifier/src/routes/verify.ts

@@ -41,7 +41,7 @@ app.post(
       credential = await parseJwtCredential(credential, resolver)
     }
 
-    await verifyParsedCredential(credential, {
+    credential = await verifyParsedCredential(credential, {
       trustedIssuers,
       resolver,
       verifiers: [getControllerClaimVerifier(), getReceiptClaimVerifier()],

packages/ack-pay/src/verify-payment-receipt.test.ts

@@ -102,6 +102,49 @@ describe("verifyPaymentReceipt()", () => {
     expect(result.paymentRequest).toBeDefined()
   })
 
+  it("uses the signed paymentRequestToken for parsed credentials", async () => {
+    const spoofedReceipt = {
+      ...signedReceipt,
+      credentialSubject: {
+        ...signedReceipt.credentialSubject,
+        paymentRequestToken: signedReceiptJwt,
+      },
+    }
+
+    const result = await verifyPaymentReceipt(spoofedReceipt, {
+      resolver,
+    })
+
+    expect(result.receipt).not.toBe(spoofedReceipt)
+    expect(result.receipt.credentialSubject.paymentRequestToken).toBe(
+      paymentRequestToken,
+    )
+    expect(result.paymentRequestToken).toBe(paymentRequestToken)
+    expect(result.paymentRequest).toBeDefined()
+  })
+
+  it("returns the signed paymentRequestToken when token verification is disabled", async () => {
+    const spoofedReceipt = {
+      ...signedReceipt,
+      credentialSubject: {
+        ...signedReceipt.credentialSubject,
+        paymentRequestToken: signedReceiptJwt,
+      },
+    }
+
+    const result = await verifyPaymentReceipt(spoofedReceipt, {
+      resolver,
+      verifyPaymentRequestTokenJwt: false,
+    })
+
+    expect(result.receipt).not.toBe(spoofedReceipt)
+    expect(result.receipt.credentialSubject.paymentRequestToken).toBe(
+      paymentRequestToken,
+    )
+    expect(result.paymentRequestToken).toBe(paymentRequestToken)
+    expect(result.paymentRequest).toBeNull()
+  })
+
   it("preserves receipt metadata through JWT verification", async () => {
     const evidenceMetadata = {
       policyRef: "policy://merchant-spend-v3",

packages/ack-pay/src/verify-payment-receipt.ts

@@ -9,12 +9,15 @@ import {
   type Verifiable,
   type W3CCredential,
 } from "@agentcommercekit/vc"
+import * as v from "valibot"
 
 import type { PaymentRequest } from "./payment-request"
 import {
   getReceiptClaimVerifier,
   isPaymentReceiptCredential,
+  type PaymentReceiptCredential,
 } from "./receipt-claim-verifier"
+import { paymentReceiptClaimSchema } from "./schemas/valibot"
 import { verifyPaymentRequestToken } from "./verify-payment-request-token"
 
 interface VerifyPaymentReceiptOptions {
@@ -36,6 +39,12 @@ interface VerifyPaymentReceiptOptions {
   paymentRequestIssuer?: string
 }
 
+function isVerifiedPaymentReceiptCredential(
+  credential: Verifiable<W3CCredential>,
+): credential is Verifiable<PaymentReceiptCredential> {
+  return v.is(paymentReceiptClaimSchema, credential.credentialSubject)
+}
+
 /**
  * Validates and verifies a PaymentReceipt, in either JWT or parsed format.
  *
@@ -79,19 +88,25 @@ export async function verifyPaymentReceipt(
     )
   }
 
-  await verifyParsedCredential(parsedCredential, {
+  const verifiedReceipt = await verifyParsedCredential(parsedCredential, {
     resolver,
     trustedIssuers: trustedReceiptIssuers,
     verifiers: [getReceiptClaimVerifier()],
   })
 
+  if (!isVerifiedPaymentReceiptCredential(verifiedReceipt)) {
+    throw new InvalidCredentialError(
+      "Credential is not a PaymentReceiptCredential",
+    )
+  }
+
   // Verify the paymentRequestToken is a valid JWT
   const paymentRequestToken =
-    parsedCredential.credentialSubject.paymentRequestToken
+    verifiedReceipt.credentialSubject.paymentRequestToken
 
   if (!verifyPaymentRequestTokenJwt) {
     return {
-      receipt: parsedCredential,
+      receipt: verifiedReceipt,
       paymentRequestToken,
       paymentRequest: null,
     }
@@ -117,7 +132,7 @@ export async function verifyPaymentReceipt(
   )
 
   return {
-    receipt: parsedCredential,
+    receipt: verifiedReceipt,
     paymentRequestToken,
     paymentRequest,
   }