assemblee-virtuelle / assemblee-virtuelle/semapps

VC issuing fails if credentialSubject is the same as the issuer

Open
#1,426 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
103
Forks
14
Avg merge
1m
Merged PRs (30d)
2

Description

Now that we have one named graph per resource, the `credentialSubject` property of VCs can be stored without needing to use special properties.

However if the `credentialSubject` ID is the same as the issuer, like on the "Non-linked chain is invalid" test (verifiable-credentials.test.ts) then we have a problem.

This is what we want to create in this test:

```
{
'@context': [
'https://www.w3.org/ns/credentials/v2',
{
as: 'https://www.w3.org/ns/activitystreams#',
apods: 'http://activitypods.org/ns/core#',
acl: 'http://www.w3.org/ns/auth/acl#',
dc: 'http://purl.org/dc/terms/',
sec: 'https://w3id.org/security#'
}
],
type: [ 'VerifiableCredential' ],
issuer: 'http://localhost:3000/craig/webid',
name: 'Second capability',
credentialSubject: {
id: 'http://localhost:3000/craig/webid',
name: 'This is an additional field',
description: 'A transferable capability.'
}
}
```

This is stored like this on Fuseki, in the `http://localhost:3000/craig/7221ae4a-1ac8-4019-a31f-d7323824a47a` named graph:

```ttl

a ;

"2025-11-12T08:35:58.418Z"^^;

;

"2025-11-12T08:35:58.418Z"^^;
"Second capability";

;

.


"A transferable capability.";
"This is an additional field" .
```

When we retrieve the VC, it looks like this:

```
{
'@context': [
'https://www.w3.org/ns/credentials/v2',
{
as: 'https://www.w3.org/ns/activitystreams#',
apods: 'http://activitypods.org/ns/core#',
acl: 'http://www.w3.org/ns/auth/acl#',
dc: 'http://purl.org/dc/terms/',
sec: 'https://w3id.org/security#'
}
],
id: 'http://localhost:3000/craig/7221ae4a-1ac8-4019-a31f-d7323824a47a',
type: 'VerifiableCredential',
'dc:created': {
type: 'http://www.w3.org/2001/XMLSchema#dateTime',
'@value': '2025-11-12T08:35:58.418Z'
},
'dc:creator': {
id: 'http://localhost:3000/craig/webid',
description: 'A transferable capability.',
name: 'This is an additional field'
},
'dc:modified': {
type: 'http://www.w3.org/2001/XMLSchema#dateTime',
'@value': '2025-11-12T08:35:58.418Z'
},
name: 'Second capability',
credentialSubject: 'http://localhost:3000/craig/webid',
issuer: 'http://localhost:3000/craig/webid'
}
```

The `credentialSubject` is not embedded because we decided not to do embedding when there are more than one corresponding property. If we did embedding above, the issuer would also include the `name` and `description` properties, which would be wrong.

Note: The embedding works fine if the issuer is not the same as the credentialSubject.

Any idea @Laurin-W ? I'm going to leave it like this on my branch `uuids-for-containers-and-collections` even if tests fails.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the “Non-linked chain is invalid” test in verifiable-credentials.test.ts and reproduce the failing VC issuance and retrieval case against Fuseki. Trace how issuer and credentialSubject are serialized and embedded when they share an ID; done means the test passes, credentialSubject remains represented correctly, and issuer properties are not incorrectly included.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
backend, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.