fix(core): back-date DI proof created for clock skew; doc mediator CORS (0.1.1) - #51
Merged
Merged
Conversation
…CORS
Two fixes from a live provision-integration debugging session:
1. **Clock-skew on the BootstrapRequest VP proof.** The VTA's
eddsa-jcs-2022 spec-conformance check rejects any proof whose
`created` is in the verifier's future, with no skew tolerance. A
wallet clock running slightly ahead produced "Created date is in the
future". `signTrustTask` now back-dates `created` by a configurable
`clockSkewMs` (default 60s, still UTC) — covering normal NTP skew and
sitting inside the ±5min window the VTA already allows on validUntil.
All wallet Data-Integrity proofs flow through this signer.
2. **Mediator CORS docs.** A CORS-blocked cross-origin WebSocket upgrade
fails as an opaque 1006 ("WebSocket failed to open") even when REST
auth works. Documented the requirement (allow the wallet origin or
`*`) and the symptom in the README.
Audited every timestamp: all wire/proof/credential timestamps already
use `toISOString()` (UTC); the only `toLocaleDateString()` is UI display.
Bumps @openvtc/pnm-core (and the private app packages that ship it) to
0.1.1. Adds a regression test asserting `created` is UTC and back-dated.
Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two fixes surfaced while debugging the provision-integration flow against a live VTA + mediator.
1. Clock-skew on the BootstrapRequest VP proof
The VTA's
eddsa-jcs-2022spec-conformance check rejects any proof whosecreatedis in the verifier's future, with no skew tolerance. A wallet clock running slightly ahead of the VTA produced:signTrustTasknow back-datescreatedby a configurableclockSkewMs(default 60s, still UTC viatoISOString()) — covering normal NTP skew and sitting comfortably inside the ±5min window the VTA already allows onvalidUntil. Every wallet Data-Integrity proof (including the BootstrapRequest VP) flows through this signer.2. Mediator CORS docs
A CORS-blocked cross-origin WebSocket upgrade fails as an opaque 1006 (
WebSocket failed to open) even when REST auth works — a browser rejects the upgrade before the socket opens. Documented in the README: the mediator must allow the wallet's origin (or*), the symptom, and how to set it onaffinidi-messaging-mediator.Timestamp audit (the "are timestamps always UTC?" question)
Audited every timestamp site: all wire/proof/credential timestamps already use
new Date().toISOString()(UTCZ). The onlytoLocaleDateString()ispopup.tsxUI display (correctly localized). So this was never a conversion bug — purely missing skew tolerance.Versions
Bumps
@openvtc/pnm-core0.1.0 → 0.1.1 (the published package with the fix) and the private app packages that ship it (pwa, extension, root). Dependents keep their^0.1.0(major.minor) pin, which accepts 0.1.1.Tests
createdis UTC (…Z) and back-dated below call time, within a sane skew window.Follow-up (separate)
The companion library PR OpenVTC/vti-didcomm-js#2 adds the WS close-code diagnostics (which is how the CORS/1006 cause was pinned down) and inbound poison-frame resilience. Once that's published as 0.4.2, bump this package's
@openvtc/vti-didcomm-jsdep to pick it up. Kept on the published^0.4.1here so this PR is independently mergeable.🤖 Generated with Claude Code