fix:resolved sd-jwt issuance related issues #341

shitrerohit · 2026-01-27T07:48:17Z

What?

Return key id when import x5c certificate
Attach keyId when we store the sd-jwt credential with P-256 signer option

Summary by CodeRabbit

Bug Fixes
- Enhanced certificate handling for credential issuance flows to properly track and return key identifiers alongside certificate data.
Refactor
- Streamlined certificate parsing logic to consolidate certificate usage and improve key identification in credential flows.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

coderabbitai · 2026-01-27T07:48:26Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🔍 Trigger a full review

📝 Walkthrough

Walkthrough

The changes refactor X.509 certificate import and processing logic to extract and return key identifiers alongside certificates. Type imports are optimized, and certificate/key handling flows now track and return keyId metadata from imported certificates.

Changes

Cohort / File(s)	Summary
Import Statement Optimization `src/controllers/x509/crypto-util.ts`	Converted `KeyObject` to type-only import and added separate value import for `createPrivateKey` to clarify runtime vs. type-only dependencies.
Certificate and Key Identifier Handling `src/controllers/x509/x509.service.ts`, `src/utils/oid4vc-agent.ts`	Modified `ImportX509Certificates` and related flows to declare key variables outside try blocks, extract keyId during certificate import, and update return signatures to include `keyId` alongside `issuerCertificate`. Introduced conditional certificate parsing in SdJwtDc and MsoMdoc flows with single parsed certificate usage instead of mapping multiple entries. Removed legacy holder default logic.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 Certificates now carry their IDs with pride,
KeyIds extracted and bundled inside,
Type imports refined, the logic runs clean,
X.509 dancing between layers unseen! 🔐

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title describes fixing SD-JWT issuance issues, which aligns with the main changes: returning keyId when importing certificates and attaching keyId to SD-JWT credentials.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/oid4vc-issuance-changes

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

shitrerohit · 2026-01-27T07:54:26Z

@coderabbitai review

coderabbitai · 2026-01-27T07:54:33Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@src/utils/oid4vc-agent.ts`:
- Around line 189-197: The code indexes issuerx509certificate[0] without
checking for an empty array which can pass undefined to
X509Service.parseCertificate; update the branch where
issuerDidVerificationMethod is falsy to first verify issuerx509certificate is an
array with length > 0, otherwise throw a clear Error mentioning
credentialConfigurationId, and only then call X509Service.parseCertificate and
set parsedCertificate.publicJwk.keyId (same change should be applied to the
similar block around the other occurrence referenced at line ~219); reference
symbols: issuerx509certificate, issuerDidVerificationMethod,
X509Service.parseCertificate, parsedCertificate, credential.signerOptions.keyId,
credentialConfigurationId.

src/utils/oid4vc-agent.ts

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

* fix: controller for oob, connection and QnA Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com> * fix: update to version 0.6.1 Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com> * fix: remove unwanted var Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com> * fix: static types Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com> * fix: remove legacy connection invitation Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com> --------- Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

* fix: x509 controller Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com> * fix: x509 import fix Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com> * fix/added dynamic implementation for keyType of x509 Signed-off-by: sujitaw <sujit.sutar@ayanworks.com> * fix/sonarqube issue Signed-off-by: sujitaw <sujit.sutar@ayanworks.com> * fix/sonarqube issue Signed-off-by: sujitaw <sujit.sutar@ayanworks.com> * fix/sonar cube issue Signed-off-by: sujitaw <sujit.sutar@ayanworks.com> * fix/code rabbit comments Signed-off-by: sujitaw <sujit.sutar@ayanworks.com> * fix/pr comments Signed-off-by: sujitaw <sujit.sutar@ayanworks.com> --------- Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com> Signed-off-by: sujitaw <sujit.sutar@ayanworks.com> Co-authored-by: sujitaw <sujit.sutar@ayanworks.com>

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

sonarqubecloud · 2026-01-31T15:07:41Z

Quality Gate passed

Issues
93 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

GHkrishna · 2026-02-02T06:42:47Z

package.json

+    "@credo-ts/core": "0.6.1",
+    "@credo-ts/askar": "0.6.1"


I think we can remove this

src/cliAgent.ts

GHkrishna · 2026-02-02T06:46:03Z

src/cliAgent.ts

-      cNonceExpiresInSeconds: Number(process.env.OID4VCI_CNONCE_EXPIRY) || 3600,
-      dpopRequired: false,
-      credentialRequestToCredentialMapper: (...args) => getMixedCredentialRequestToCredentialMapper()(...args),
+    // openid4vc: new OpenId4VcModule({}),


Maybe we can add a TODO here, for the code to be un-commented in the future

src/cliAgent.ts

GHkrishna · 2026-02-02T06:48:08Z

src/utils/oid4vc-agent.ts

@@ -1,4 +1,7 @@
+// FIXME: We've made many changes in this file for building agent with OIDC modules, please check the types and proper implementation of the changes


Can we remove this comment if it's purpose is served?

GHkrishna · 2026-02-02T07:03:56Z

src/controllers/openid4vc/issuers/issuer.service.ts

+  // public async deleteIssuer(agentReq: Req, issuerId: string) {
+  //   const result = (agentReq.agent as Agent<RestAgentModules>).openid4vc.config.issuer.
+  //   return result
+  // }


Not sure, why we have commented this??

GHkrishna · 2026-02-02T07:04:37Z

src/controllers/openid4vc/issuers/issuer.Controller.ts

-      throw ErrorHandlingService.handle(error)
-    }
-  }
+  // @Delete('{id}')


Is it not necessary for us to delete issuer??

GHkrishna · 2026-02-02T07:07:06Z

src/controllers/openid4vc/issuance-sessions/issuance-sessions.Controller.ts

   * Delete issuance session by session ID
   */
-  @Delete('/:issuanceSessionId')
+  @Delete('{issuanceSessionId}')


Why have we changed this?

GHkrishna · 2026-02-02T07:07:42Z

src/controllers/openid4vc/holder/holder.service.ts

+        // if (credential instanceof W3cJwtVerifiableCredential || credential instanceof W3cJsonLdVerifiableCredential) {
+        //   return await agentReq.agent.w3cCredentials.storeCredential({ credential })
+        // }


Do we not need this code for now?

GHkrishna · 2026-02-02T07:08:17Z

src/controllers/openid4vc/holder/credentialBindingResolver.ts

+        kms
+          .createKeyForSignatureAlgorithm({
+            algorithm: signatureAlgorithm!,
+            // FIXME: what should happen with already existing keys created in the secure environment?


Can we remove if it has been tested??

shitrerohit requested review from GHkrishna and RinkalBhojani and removed request for GHkrishna January 27, 2026 07:48

coderabbitai bot reviewed Jan 27, 2026

View reviewed changes

src/utils/oid4vc-agent.ts Show resolved Hide resolved

GHkrishna and others added 22 commits January 31, 2026 15:30

fix: changes for types

303c9cf

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

fix: version update and types update

534d7ea

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

fix: for now we'll delete all the patch and apply as required

d36b26a

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

fix: agent initialization

18c8ad1

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

fix: remove unwanted agent backup config

148aa9c

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

fix: oob invitation

a6d2181

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

fix: some package version update

78f6065

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

fix: some type changes

925a147

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

fix: comment controller for agent to start

ee543c9

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

fix: oidc4vc agent changes for building agent

32e1ab0

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

fix: auto generated file changes

b47de32

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

fix: cliagent issues

6a53e4b

Signed-off-by: Krishna Waske <krishna.waske@ayanworks.com>

WIP: bug fixing from issuer and verifier session

b6e3043

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix:changes on cli agent file

9573fca

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

WIP:changes in create issuer work flow

232943b

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

WIP:Resolving the issues from issue credential workflow.

0816425

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix:sd-jwt store credential

768ba54

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

WIP: store mDoc credential

bbf02c6

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix:sonar cloud issue

6c572c8

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix:completed flow changes for mdoc

21f66e0

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

shitrerohit added 12 commits January 31, 2026 15:51

fix:resolved code rabit related issues

57f71c5

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix:removed commented code

586ba2c

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix: resolved PR comments

5851bd6

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

feat/oidv4vc issuance and verification changes

44b1c6a

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix: resolved code rabbit ai issues

368bf50

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix: resolved code rabbit issues

20ca52e

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix: added comment for image check in verification session

fe5cfa2

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix/removed commented code

ea7f3b2

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix:resolved sd-jwt issuance related issues

34cab32

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix:Removed commented code

9e0c531

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

fix:changes in create proof request

1786598

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

feat:API for delete credential

f194bb3

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

shitrerohit force-pushed the fix/oid4vc-issuance-changes branch from 80236e4 to f194bb3 Compare January 31, 2026 12:56

shitrerohit changed the base branch from fix/agent-setup-and-controllers to feat/oidc-main-sync January 31, 2026 12:59

shitrerohit added 3 commits January 31, 2026 19:20

node verison changes

34d8586

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

update node version

00b8680

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

sample x5c certificate added

ca9a16b

Signed-off-by: shitrerohit <rohit.shitre@ayanworks.com>

GHkrishna requested changes Feb 2, 2026

View reviewed changes

		@@ -1,4 +1,7 @@
		// FIXME: We've made many changes in this file for building agent with OIDC modules, please check the types and proper implementation of the changes

fix:resolved sd-jwt issuance related issues #341

Are you sure you want to change the base?

fix:resolved sd-jwt issuance related issues #341

Uh oh!

Conversation

shitrerohit commented Jan 27, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What?

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

shitrerohit commented Jan 27, 2026

Uh oh!

coderabbitai bot commented Jan 27, 2026

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud bot commented Jan 31, 2026

Quality Gate passed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

shitrerohit commented Jan 27, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Jan 27, 2026 •

edited

Loading