Merge pull request #75 from FIWARE/fix/empty-scopes

Fix VC authentication

Author: wistefan

.github/workflows/release.yml

@@ -17,19 +17,19 @@ jobs:
       version: ${{ steps.out.outputs.version }}
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-java@v1
+      - uses: actions/setup-java@v5
         with:
+          distribution: 'temurin'
           java-version: '11'
-          java-package: jdk
 
       - id: pr
         uses: actions-ecosystem/action-get-merged-pull-request@v1.0.1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: zwaldowski/semver-release-action@v2
+      - uses: zwaldowski/semver-release-action@v6
         with:
           dry_run: true
           bump: ${{ steps.pr.outputs.labels }}
@@ -44,40 +44,45 @@ jobs:
   vcverifier:
     needs: [ "generate-version" ]
     runs-on: ubuntu-latest
-  
+
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
-      - name: Build Image
-        id: build-image
-        uses: redhat-actions/buildah-build@v2
-        with:
-          image: vcverifier
-          tags: latest ${{ github.sha }} ${{needs.generate-version.outputs.version}}
-          dockerfiles: |
-            ./Dockerfile
-          context: ./
-
-      - name: Push To quay.io
-        id: push-to-quay
-        uses: redhat-actions/push-to-registry@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Quay.io
+        uses: docker/login-action@v3
         with:
-          image: ${{ steps.build-image.outputs.image }}
-          tags: ${{ steps.build-image.outputs.tags }}
-          registry: ${{ env.REGISTRY }}/${{ env.REPOSITORY }}
+          registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_PASSWORD }}
 
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            quay.io/${{ env.REPOSITORY }}/vcverifier:latest
+            quay.io/${{ env.REPOSITORY }}/vcverifier:${{ github.sha }}
+            quay.io/${{ env.REPOSITORY }}/vcverifier:${{ needs.generate-version.outputs.version }}
+
   git-release:
     needs:
       - generate-version
       - vcverifier
-    
+
     runs-on: ubuntu-latest
 
     steps:
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
       - uses: "marvinpinto/action-automatic-releases@latest"
         with:

Dockerfile

@@ -1,21 +1,25 @@
-FROM golang:1.24-alpine AS build
+FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS build
+
+ARG TARGETOS
+ARG TARGETARCH
 
 WORKDIR /go/src/app
 COPY ./ ./
 
-RUN apk add build-base
+RUN apk add --no-cache build-base
+
+RUN go mod download
 
-RUN go get -d -v ./...
-RUN go build -v .
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-s -w" -o VCVerifier .
 
-FROM golang:1.24-alpine
+FROM alpine:3.23
 
 LABEL org.opencontainers.image.source="https://github.com/FIWARE/VCVerifier"
 
-WORKDIR /go/src/app
+WORKDIR /app
 
-COPY --from=build /go/src/app/views /go/src/app/views
-COPY --from=build /go/src/app/VCVerifier /go/src/app/VCVerifier
-COPY --from=build /go/src/app/server.yaml /go/src/app/server.yaml
+COPY --from=build /go/src/app/views ./views
+COPY --from=build /go/src/app/VCVerifier ./VCVerifier
+COPY --from=build /go/src/app/server.yaml ./server.yaml
 
 CMD ["./VCVerifier"]

config/configClient.go

@@ -12,8 +12,6 @@ import (
 
 const SERVICES_PATH = "service"
 
-const SERVICE_DEFAULT_SCOPE = ""
-
 var ErrorCcsNoResponse = errors.New("no_response_from_ccs")
 var ErrorCcsErrorResponse = errors.New("error_response_from_ccs")
 var ErrorCcsEmptyResponse = errors.New("empty_response_from_ccs")

verifier/verifier.go

@@ -227,6 +227,8 @@ type loginSession struct {
 	requestObject string
 	// inidicates if the cross device session is v1 or v2
 	version int
+	// scope requested for the session
+	scope string
 }
 
 // struct to represent a token, accessible through the token endpoint
@@ -435,7 +437,7 @@ func (v *CredentialVerifier) StartSameDeviceFlow(host string, protocol string, s
 		nonce = v.nonceGenerator.GenerateNonce()
 	}
 
-	loginSession := loginSession{callback: fmt.Sprintf("%s://%s%s", protocol, host, redirectPath), sessionId: state, nonce: nonce, clientId: clientId, version: SAME_DEVICE}
+	loginSession := loginSession{callback: fmt.Sprintf("%s://%s%s", protocol, host, redirectPath), sessionId: state, nonce: nonce, clientId: clientId, version: SAME_DEVICE, scope: scope}
 	err = v.sessionCache.Add(state, loginSession, cache.DefaultExpiration)
 	if err != nil {
 		logging.Log().Warnf("Was not able to store the login session %s in cache. Err: %v", logging.PrettyPrintObject(loginSession), err)
@@ -797,7 +799,7 @@ func (v *CredentialVerifier) AuthenticationResponse(state string, verifiablePres
 
 	for _, credential := range verifiablePresentation.Credentials() {
 
-		verificationContext, err := v.getTrustRegistriesValidationContext(loginSession.clientId, credential.Contents().Types)
+		verificationContext, err := v.getTrustRegistriesValidationContext(loginSession.clientId, credential.Contents().Types, loginSession.scope)
 		if err != nil {
 			logging.Log().Warnf("Was not able to create a valid verification context. Credential will be rejected. Err: %v", err)
 			return sameDevice, ErrorVerficationContextSetup
@@ -837,7 +839,7 @@ func (v *CredentialVerifier) AuthenticationResponse(state string, verifiablePres
 		toBeIncluded = append(toBeIncluded, credential.ToRawJSON())
 	}
 
-	flatClaims, _ := v.credentialsConfig.GetFlatClaims(loginSession.clientId, configModel.SERVICE_DEFAULT_SCOPE)
+	flatClaims, _ := v.credentialsConfig.GetFlatClaims(loginSession.clientId, loginSession.scope)
 	token, err := v.generateJWT(toBeIncluded, verifiablePresentation.Holder, hostname, flatClaims)
 	if err != nil {
 		logging.Log().Warnf("Was not able to create a jwt for %s. Err: %v", state, err)
@@ -949,17 +951,18 @@ func (v *CredentialVerifier) getHolderValidationContext(clientId string, scope s
 	return validationContexts, err
 }
 
-func (v *CredentialVerifier) getTrustRegistriesValidationContext(clientId string, credentialTypes []string) (verificationContext TrustRegistriesValidationContext, err error) {
+func (v *CredentialVerifier) getTrustRegistriesValidationContext(clientId string, credentialTypes []string, scope string) (verificationContext TrustRegistriesValidationContext, err error) {
+	logging.Log().Debugf("Create trust registry validation context for client '%s', scope '%s' and credential types %s", clientId, scope, credentialTypes)
 	trustedIssuersLists := map[string][]string{}
 	trustedParticipantsRegistries := map[string][]configModel.TrustedParticipantsList{}
 
 	for _, credentialType := range credentialTypes {
-		issuersLists, err := v.credentialsConfig.GetTrustedIssuersLists(clientId, configModel.SERVICE_DEFAULT_SCOPE, credentialType)
+		issuersLists, err := v.credentialsConfig.GetTrustedIssuersLists(clientId, scope, credentialType)
 		if err != nil {
 			logging.Log().Warnf("Was not able to get valid trusted-issuers-lists for client %s and type %s. Err: %v", clientId, credentialType, err)
 			return verificationContext, err
 		}
-		participantsLists, err := v.credentialsConfig.GetTrustedParticipantLists(clientId, configModel.SERVICE_DEFAULT_SCOPE, credentialType)
+		participantsLists, err := v.credentialsConfig.GetTrustedParticipantLists(clientId, scope, credentialType)
 		if err != nil {
 			logging.Log().Warnf("Was not able to get valid trusted-pariticpants-registries for client %s and type %s. Err: %v", clientId, credentialType, err)
 			return verificationContext, err
@@ -1047,7 +1050,7 @@ func verifyChain(vcs []*verifiable.Credential) (bool, error) {
 // intialize the OID4VP cross device flow
 func (v *CredentialVerifier) initOid4VPCrossDevice(host string, protocol string, redirectUri string, state string, clientId string, scope string, nonce string, requestMode string) (authenticationRequest string, err error) {
 
-	loginSession := loginSession{redirectUri, state, nonce, clientId, "", CROSS_DEVICE_V2}
+	loginSession := loginSession{redirectUri, state, nonce, clientId, "", CROSS_DEVICE_V2, scope}
 	err = v.sessionCache.Add(state, loginSession, cache.DefaultExpiration)
 
 	if err != nil {
@@ -1066,7 +1069,7 @@ func (v *CredentialVerifier) initSiopFlow(host string, protocol string, callback
 		logging.Log().Debugf("No nonce provided, generate one.")
 		nonce = v.nonceGenerator.GenerateNonce()
 	}
-	loginSession := loginSession{callback, state, nonce, clientId, "", CROSS_DEVICE_V1}
+	loginSession := loginSession{callback, state, nonce, clientId, "", CROSS_DEVICE_V1, ""}
 	err = v.sessionCache.Add(state, loginSession, cache.DefaultExpiration)
 
 	if err != nil {

verifier/verifier_test.go

@@ -376,10 +376,10 @@ func verifyInitTest(t *testing.T, tc siopInitTest, authRequest string, err error
 		expectedNonce = "randomNonce"
 	}
 	if tc.requestMode == REQUEST_MODE_BY_REFERENCE {
-		expectedSession = loginSession{version: flowVersion, callback: tc.expectedCallback, nonce: expectedNonce, sessionId: tc.testState, clientId: tc.testClientId, requestObject: tc.testRequestObjectJwt}
+		expectedSession = loginSession{version: flowVersion, callback: tc.expectedCallback, nonce: expectedNonce, sessionId: tc.testState, clientId: tc.testClientId, requestObject: tc.testRequestObjectJwt, scope: tc.testScope}
 		cachedSession.requestObject = removeSignature(cachedSession.requestObject)
 	} else {
-		expectedSession = loginSession{version: flowVersion, callback: tc.expectedCallback, nonce: expectedNonce, sessionId: tc.testState, clientId: tc.testClientId, requestObject: tc.testRequestObjectJwt}
+		expectedSession = loginSession{version: flowVersion, callback: tc.expectedCallback, nonce: expectedNonce, sessionId: tc.testState, clientId: tc.testClientId, requestObject: tc.testRequestObjectJwt, scope: tc.testScope}
 	}
 	if cachedSession != expectedSession {
 		t.Errorf("%s - The login session was expected to be %v but was %v.", tc.testName, expectedSession, cachedSession)