Merge branch 'main' into dependabot/github_actions/all-actions-55dbf210d1

Author: swcurran

acapy_agent/wallet/keys/manager.py

@@ -1,7 +1,9 @@
 """Multikey class."""
 
 import logging
+from typing import Mapping
 
+from aries_askar import Key
 from pydid import VerificationMethod
 
 from ...core.profile import ProfileSession
@@ -42,6 +44,13 @@
     },
 }
 
+# JWK kty/crv pairs supported for Multikey conversion (aligned with JWT algs).
+JWK_TO_ALG = {
+    ("OKP", "Ed25519"): "ed25519",
+    ("OKP", "X25519"): "x25519",
+    ("EC", "P-256"): "p256",
+}
+
 
 def multikey_to_verkey(multikey: str):
     """Transform multikey to verkey."""
@@ -60,6 +69,36 @@ def verkey_to_multikey(verkey: str, alg: str):
     return multibase.encode(bytes.fromhex(prefixed_key_hex), "base58btc")
 
 
+def jwk_to_multikey(jwk: Mapping) -> str:
+    """Transform a public JWK to multikey.
+
+    Supports OKP/Ed25519, OKP/X25519, and EC/P-256 — the curves used by
+    ACA-Py JWT signing (EdDSA / ES256) and MultikeyManager.
+
+    Private key material (``d``) is ignored so this helper always treats the
+    input as a public key.
+    """
+    if not isinstance(jwk, Mapping):
+        raise MultikeyManagerError("JWK must be a mapping.")
+
+    alg = JWK_TO_ALG.get((jwk.get("kty"), jwk.get("crv")))
+    if not alg:
+        raise MultikeyManagerError(
+            "Unsupported JWK for multikey conversion: "
+            f"kty={jwk.get('kty')}, crv={jwk.get('crv')}."
+        )
+
+    # Only pass public members to Askar.
+    public_jwk = {key: value for key, value in jwk.items() if key != "d"}
+
+    try:
+        public_bytes = Key.from_jwk(public_jwk).get_public_bytes()
+    except Exception as err:
+        raise MultikeyManagerError(f"Unable to parse JWK: {err}") from err
+
+    return verkey_to_multikey(bytes_to_b58(public_bytes), alg=alg)
+
+
 def key_type_from_multikey(multikey: str) -> KeyType:
     """Derive key_type class from multikey prefix."""
     for mapping in ALG_MAPPINGS:
@@ -90,7 +129,14 @@ def multikey_from_verification_method(verification_method: VerificationMethod) -
         multikey = verkey_to_multikey(
             verification_method.public_key_base58, alg="bls12381g2"
         )
-    # TODO address JsonWebKey based verification methods
+
+    elif verification_method.type in ("JsonWebKey2020", "JsonWebKey"):
+        jwk = verification_method.public_key_jwk
+        if not jwk:
+            raise MultikeyManagerError(
+                f"{verification_method.type} verification method missing publicKeyJwk."
+            )
+        multikey = jwk_to_multikey(jwk)
 
     else:
         raise MultikeyManagerError("Unknown verification method type.")

acapy_agent/wallet/keys/tests/test_key_operations.py

@@ -1,11 +1,19 @@
 """Test MultikeypManager."""
 
-from unittest import IsolatedAsyncioTestCase
+import json
+from unittest import IsolatedAsyncioTestCase, mock
+
+import base58
+from aries_askar import Key, KeyAlg
+from pydid.verification_method import JsonWebKey2020, VerificationMethod
 
 from acapy_agent.utils.testing import create_test_profile
 from acapy_agent.wallet.key_type import KeyTypes
 from acapy_agent.wallet.keys.manager import (
     MultikeyManager,
+    MultikeyManagerError,
+    jwk_to_multikey,
+    multikey_from_verification_method,
     multikey_to_verkey,
     verkey_to_multikey,
 )
@@ -89,3 +97,69 @@ async def test_key_transformations(self):
         ]:
             assert multikey_to_verkey(multikey) == verkey
             assert verkey_to_multikey(verkey, alg=alg) == multikey
+
+    async def test_jwk_to_multikey_ed25519_and_p256(self):
+        for alg, key_alg, expected_multikey in [
+            (self.ed25519_alg, KeyAlg.ED25519, self.ed25519_multikey),
+            (self.p256_alg, KeyAlg.P256, self.p256_multikey),
+        ]:
+            async with self.profile.session() as session:
+                created = await MultikeyManager(session=session).create(
+                    seed=self.seed, alg=alg
+                )
+
+            askar_key = Key.from_public_bytes(
+                key_alg, base58.b58decode(multikey_to_verkey(created["multikey"]))
+            )
+            jwk = json.loads(askar_key.get_jwk_public())
+            assert jwk_to_multikey(jwk) == expected_multikey
+
+            # Private material must be ignored for public conversion.
+            jwk_with_d = {**jwk, "d": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
+            assert jwk_to_multikey(jwk_with_d) == expected_multikey
+
+    async def test_jwk_to_multikey_unsupported(self):
+        with self.assertRaises(MultikeyManagerError):
+            jwk_to_multikey({"kty": "EC", "crv": "secp256k1", "x": "x", "y": "y"})
+        with self.assertRaises(MultikeyManagerError):
+            jwk_to_multikey("not-a-jwk")
+
+    async def test_multikey_from_json_web_key_verification_method(self):
+        async with self.profile.session() as session:
+            created = await MultikeyManager(session=session).create(
+                seed=self.seed, alg=self.ed25519_alg
+            )
+
+        askar_key = Key.from_public_bytes(
+            KeyAlg.ED25519,
+            base58.b58decode(multikey_to_verkey(created["multikey"])),
+        )
+        jwk = json.loads(askar_key.get_jwk_public())
+
+        for vm_type in ("JsonWebKey2020", "JsonWebKey"):
+            if vm_type == "JsonWebKey2020":
+                vm = JsonWebKey2020.deserialize(
+                    {
+                        "id": "did:web:example.com#key-01-jwk",
+                        "type": vm_type,
+                        "controller": "did:web:example.com",
+                        "publicKeyJwk": jwk,
+                    }
+                )
+            else:
+                vm = VerificationMethod.deserialize(
+                    {
+                        "id": "did:web:example.com#key-01-jwk",
+                        "type": vm_type,
+                        "controller": "did:web:example.com",
+                        "publicKeyJwk": jwk,
+                    }
+                )
+            assert multikey_from_verification_method(vm) == created["multikey"]
+
+    async def test_multikey_from_json_web_key_missing_jwk(self):
+        vm = mock.MagicMock(spec=VerificationMethod)
+        vm.type = "JsonWebKey2020"
+        vm.public_key_jwk = None
+        with self.assertRaises(MultikeyManagerError):
+            multikey_from_verification_method(vm)

acapy_agent/wallet/tests/test_jwt.py

@@ -1,7 +1,10 @@
+import json
 from typing import Tuple
 from unittest import IsolatedAsyncioTestCase
 
+import base58
 import pytest
+from aries_askar import Key, KeyAlg
 
 from acapy_agent.resolver.default.key import KeyDIDResolver
 
@@ -10,6 +13,7 @@
 from ...utils.testing import create_test_profile
 from ...wallet.did_method import KEY, DIDMethods
 from ...wallet.key_type import ED25519, P256, KeyType, KeyTypes
+from ...wallet.keys.manager import MultikeyManager, multikey_to_verkey
 from ..base import BaseWallet
 from ..default_verification_key_strategy import (
     BaseVerificationKeyStrategy,
@@ -187,3 +191,57 @@ async def test_verify_x_invalid_signed(self):
 
             with pytest.raises(Exception):
                 await jwt_verify(self.profile, signed)
+
+    async def test_sign_and_verify_with_json_web_key_verification_method(self):
+        """JWT verify must accept JsonWebKey2020 publicKeyJwk VMs (e.g. #key-01-jwk)."""
+        for alg, key_alg in [
+            ("ed25519", KeyAlg.ED25519),
+            ("p256", KeyAlg.P256),
+        ]:
+            with self.subTest(alg=alg):
+                vm_id = f"did:web:example.com#key-01-{alg}-jwk"
+                async with self.profile.session() as session:
+                    created = await MultikeyManager(session=session).create(
+                        seed=self.seed, alg=alg
+                    )
+                    multikey = created["multikey"]
+                    await MultikeyManager(session=session).update(multikey, vm_id)
+
+                askar_key = Key.from_public_bytes(
+                    key_alg, base58.b58decode(multikey_to_verkey(multikey))
+                )
+                jwk = json.loads(askar_key.get_jwk_public())
+                did_doc = {
+                    "@context": [
+                        "https://www.w3.org/ns/did/v1",
+                        "https://w3id.org/security/suites/jws-2020/v1",
+                    ],
+                    "id": "did:web:example.com",
+                    "verificationMethod": [
+                        {
+                            "id": vm_id,
+                            "type": "JsonWebKey2020",
+                            "controller": "did:web:example.com",
+                            "publicKeyJwk": jwk,
+                        }
+                    ],
+                    "assertionMethod": [vm_id],
+                    "authentication": [vm_id],
+                }
+                resolver = DIDResolver()
+                resolver.register_resolver(
+                    MockResolver(
+                        ["web"],
+                        resolved=did_doc,
+                        native=True,
+                    )
+                )
+                self.profile.context.injector.bind_instance(DIDResolver, resolver)
+
+                signed = await jwt_sign(
+                    self.profile, {}, {"hello": "world", "alg": alg}, None, vm_id
+                )
+                result = await jwt_verify(self.profile, signed)
+                assert result.valid
+                assert result.kid == vm_id
+                assert result.payload == {"hello": "world", "alg": alg}

docker/Dockerfile

@@ -18,8 +18,8 @@ RUN apt-get update && \
 WORKDIR /src
 
 COPY ./pyproject.toml ./poetry.lock ./
-# need to install pysqlcipher3 first to ensure build dependencies are available
-RUN pip install --no-cache-dir sqlcipher3-wheels==0.5.5 && \
+# need to install sqlcipher3-wheels first (binary-only) before poetry install
+RUN pip install --no-cache-dir --only-binary=:all: sqlcipher3-wheels==0.5.5 && \
     poetry install --no-root
 
 COPY ./acapy_agent ./acapy_agent

poetry.lock

@@ -160,11 +160,11 @@ async def main():
         pause_for_input()
 
         with section("Present example ED25519 credential"):
-            alice_pres_ex, bob_pres_ex = await jsonld_present_proof_v2(
-                alice,
+            bob_pres_ex, alice_pres_ex = await jsonld_present_proof_v2(
                 bob,
-                alice_conn.connection_id,
+                alice,
                 bob_conn.connection_id,
+                alice_conn.connection_id,
                 presentation_definition={
                     "input_descriptors": [
                         {
@@ -242,11 +242,11 @@ async def main():
         pause_for_input()
 
         with section("Present example P256 credential"):
-            alice_pres_ex, bob_pres_ex = await jsonld_present_proof_v2(
-                alice,
+            bob_pres_ex, alice_pres_ex = await jsonld_present_proof_v2(
                 bob,
-                alice_conn.connection_id,
+                alice,
                 bob_conn.connection_id,
+                alice_conn.connection_id,
                 presentation_definition={
                     "input_descriptors": [
                         {
@@ -328,11 +328,11 @@ async def main():
         pause_for_input()
 
         with section("Present ED25519 quick context credential"):
-            alice_pres_ex, bob_pres_ex = await jsonld_present_proof_v2(
-                alice,
+            bob_pres_ex, alice_pres_ex = await jsonld_present_proof_v2(
                 bob,
-                alice_conn.connection_id,
+                alice,
                 bob_conn.connection_id,
+                alice_conn.connection_id,
                 presentation_definition={
                     "input_descriptors": [
                         {
@@ -410,11 +410,11 @@ async def main():
         pause_for_input()
 
         with section("Present BBS+ Credential with SD"):
-            alice_pres_ex, bob_pres_ex = await jsonld_present_proof_v2(
-                alice,
+            bob_pres_ex, alice_pres_ex = await jsonld_present_proof_v2(
                 bob,
-                alice_conn.connection_id,
+                alice,
                 bob_conn.connection_id,
+                alice_conn.connection_id,
                 presentation_definition={
                     "input_descriptors": [
                         {

scenarios/examples/json_ld/example.py

@@ -13,9 +13,13 @@ docker = "7.2.0"
 pytest = "^8.4.2"
 pytest-asyncio = "^0.26.0"
 pydantic = "^2.13.0"
+pytest-rerunfailures = "^16.6"
 
 [tool.pytest.ini_options]
 markers = "examples: test the examples"
+# Retry only on transient failures talking to the shared public test ledger
+# (test.bcovrin.vonx.io), not on genuine scenario/assertion failures.
+addopts = '--reruns 1 --reruns-delay 10 --only-rerun "(?i)(pool timeout|ledger request error)"'
 
 [build-system]
 requires = ["poetry-core"]