Cara Membangun Issuer Kredensial Digital (Panduan Developer)

npx create-next-app@latest . --ts --eslint --tailwind --app --src-dir --import-alias "@/*" --use-npm

npm install jose mysql2 uuid @types/uuid

services:
    mysql:
        image: mysql:8.0
        restart: always
        environment:
            MYSQL_ROOT_PASSWORD: rootpassword
            MYSQL_DATABASE: digital_credentials
            MYSQL_USER: app_user
            MYSQL_PASSWORD: app_password
        ports:
            - "3306:3306"
        volumes:
            - mysql_data:/var/lib/mysql
            - ./sql/init.sql:/docker-entrypoint-initdb.d/init.sql
        healthcheck:
            test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
            timeout: 20s
            retries: 10
 
volumes:
    mysql_data:

-- Create database if not exists
CREATE DATABASE IF NOT EXISTS digital_credentials;
USE digital_credentials;
 
-- Table for storing challenges
CREATE TABLE IF NOT EXISTS challenges (
    id VARCHAR(36) PRIMARY KEY,
    challenge VARCHAR(255) NOT NULL UNIQUE,
    expires_at TIMESTAMP NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    used BOOLEAN DEFAULT FALSE,
    INDEX idx_challenge (challenge),
    INDEX idx_expires_at (expires_at)
);
 
-- Table for storing verification sessions
CREATE TABLE IF NOT EXISTS verification_sessions (
    id VARCHAR(36) PRIMARY KEY,
    challenge_id VARCHAR(36),
    status ENUM('pending', 'verified', 'failed', 'expired') DEFAULT 'pending',
    presentation_data JSON,
    verified_at TIMESTAMP NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    FOREIGN KEY (challenge_id) REFERENCES challenges(id) ON DELETE CASCADE,
    INDEX idx_challenge_id (challenge_id),
    INDEX idx_status (status)
);
 
-- Table for storing verified credentials data (optional)
CREATE TABLE IF NOT EXISTS verified_credentials (
    id VARCHAR(36) PRIMARY KEY,
    session_id VARCHAR(36),
    credential_type VARCHAR(255),
    issuer VARCHAR(255),
    subject VARCHAR(255),
    claims JSON,
    verified_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (session_id) REFERENCES verification_sessions(id) ON DELETE CASCADE,
    INDEX idx_session_id (session_id),
    INDEX idx_credential_type (credential_type)
);
 
-- ISSUER TABLES
 
-- Table for storing authorization codes in OpenID4VCI flow
CREATE TABLE IF NOT EXISTS authorization_codes (
    id VARCHAR(36) PRIMARY KEY,
    code VARCHAR(255) NOT NULL UNIQUE,
    client_id VARCHAR(255),
    scope VARCHAR(255),
    code_challenge VARCHAR(255),
    code_challenge_method VARCHAR(50),
    redirect_uri TEXT,
    user_pin VARCHAR(10),
    expires_at TIMESTAMP NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    used BOOLEAN DEFAULT FALSE,
    INDEX idx_code (code),
    INDEX idx_expires_at (expires_at)
);
 
-- Table for storing issuance sessions
CREATE TABLE IF NOT EXISTS issuance_sessions (
    id VARCHAR(36) PRIMARY KEY,
    authorization_code_id VARCHAR(36),
    access_token VARCHAR(255),
    token_type VARCHAR(50) DEFAULT 'Bearer',
    expires_in INT DEFAULT 3600,
    c_nonce VARCHAR(255),
    c_nonce_expires_at TIMESTAMP,
    status ENUM('pending', 'authorized', 'credential_issued', 'expired', 'failed') DEFAULT 'pending',
    user_data JSON,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    FOREIGN KEY (authorization_code_id) REFERENCES authorization_codes(id) ON DELETE CASCADE,
    INDEX idx_access_token (access_token),
    INDEX idx_c_nonce (c_nonce),
    INDEX idx_status (status)
);
 
-- Table for storing issued credentials
CREATE TABLE IF NOT EXISTS issued_credentials (
    id VARCHAR(36) PRIMARY KEY,
    session_id VARCHAR(36),
    credential_id VARCHAR(255),
    credential_type VARCHAR(255) DEFAULT 'jwt_vc',
    doctype VARCHAR(255) DEFAULT 'eu.europa.ec.eudi.pid.1',
    credential_data LONGTEXT, -- Base64 encoded mDoc
    credential_claims JSON,
    issuer_did VARCHAR(255),
    subject_id VARCHAR(255),
    issued_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    expires_at TIMESTAMP,
    revoked BOOLEAN DEFAULT FALSE,
    revoked_at TIMESTAMP NULL,
    FOREIGN KEY (session_id) REFERENCES issuance_sessions(id) ON DELETE CASCADE,
    INDEX idx_credential_id (credential_id),
    INDEX idx_session_id (session_id),
    INDEX idx_doctype (doctype),
    INDEX idx_subject_id (subject_id),
    INDEX idx_issued_at (issued_at)
);
 
-- Table for storing issuer keys (simplified for demo)
CREATE TABLE IF NOT EXISTS issuer_keys (
    id VARCHAR(36) PRIMARY KEY,
    key_id VARCHAR(255) NOT NULL UNIQUE,
    key_type VARCHAR(50) NOT NULL, -- 'EC', 'RSA'
    algorithm VARCHAR(50) NOT NULL, -- 'ES256', 'RS256', etc.
    public_key TEXT NOT NULL, -- JWK format
    private_key TEXT NOT NULL, -- JWK format (encrypted in production)
    is_active BOOLEAN DEFAULT TRUE,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    INDEX idx_key_id (key_id),
    INDEX idx_is_active (is_active)
);

docker-compose up -d

// src/lib/database.ts
import mysql from "mysql2/promise";
 
// Konfigurasi koneksi database
const dbConfig = {
    host: process.env.DATABASE_HOST || "localhost",
    port: parseInt(process.env.DATABASE_PORT || "3306"),
    user: process.env.DATABASE_USER || "app_user",
    password: process.env.DATABASE_PASSWORD || "app_password",
    database: process.env.DATABASE_NAME || "digital_credentials",
    timezone: "+00:00",
};
 
let connection: mysql.Connection | null = null;
 
export async function getConnection(): Promise<mysql.Connection> {
    if (!connection) {
        connection = await mysql.createConnection(dbConfig);
    }
    return connection;
}
 
// Fungsi Data-Access-Object (DAO) untuk setiap tabel
// ... (misalnya, createChallenge, getChallenge, createAuthorizationCode, dll.)

// src/lib/crypto.ts
import { generateKeyPair, exportJWK, SignJWT } from "jose";
 
export async function generateIssuerKeyPair(keyId: string, issuerDid: string) {
    const { publicKey, privateKey } = await generateKeyPair("ES256", {
        crv: "P-256",
        extractable: true,
    });
 
    const publicKeyJWK = await exportJWK(publicKey);
    publicKeyJWK.kid = keyId; // Menetapkan ID kunci yang unik
 
    // ... (ekspor kunci privat dan pengaturan lainnya)
 
    return { publicKey, privateKey, publicKeyJWK /* ... */ };
}

// src/lib/crypto.ts
 
export async function createJWTVerifiableCredential(
    claims: MDocClaims,
    issuerKeyPair: IssuerKeyPair,
    subjectId: string,
    audience: string,
): Promise<string> {
    const now = Math.floor(Date.now() / 1000);
    const oneYear = 365 * 24 * 60 * 60;
 
    const vcPayload = {
        // DID issuer
        iss: issuerKeyPair.issuerDid,
        // DID subjek (pemegang)
        sub: subjectId,
        // Waktu kredensial diterbitkan (iat) dan kapan kedaluwarsa (exp)
        iat: now,
        exp: now + oneYear,
        // Model data Verifiable Credential
        vc: {
            "@context": [
                "https://www.w3.org/2018/credentials/v1",
                "https://europa.eu/eudi/pid/v1",
            ],
            type: ["VerifiableCredential", "eu.europa.ec.eudi.pid.1"],
            issuer: issuerKeyPair.issuerDid,
            issuanceDate: new Date(now * 1000).toISOString(),
            credentialSubject: {
                id: subjectId,
                ...claims,
            },
        },
    };
 
    // Menandatangani payload dengan kunci privat issuer
    return await new SignJWT(vcPayload)
        .setProtectedHeader({
            alg: issuerKeyPair.algorithm,
            kid: issuerKeyPair.keyId,
            typ: "JWT",
        })
        .sign(issuerKeyPair.privateKey);
}

// src/app/issue/page.tsx
 
const handleSubmit = async (e: React.FormEvent) => {
    e.preventDefault();
    setLoading(true);
    setError(null);
    setCredentialOffer(null);
 
    try {
        // 1. Validasi bidang yang diperlukan
        if (!userData.given_name || !userData.family_name || !userData.birth_date) {
            throw new Error("Harap isi semua bidang yang diperlukan");
        }
 
        // 2. Minta penawaran kredensial dari backend
        const response = await fetch("/api/issue/authorize", {
            method: "POST",
            headers: {
                "Content-Type": "application/json",
            },
            body: JSON.stringify({
                user_data: userData,
            }),
        });
 
        if (!response.ok) {
            const errorData = await response.json();
            throw new Error(
                errorData.error_description || "Gagal membuat penawaran kredensial",
            );
        }
 
        // 3. Atur penawaran kredensial di state untuk menampilkan kode QR
        const result = await response.json();
        setCredentialOffer(result);
    } catch (err) {
        const errorMessage =
            (err as Error).message || "Terjadi kesalahan yang tidak diketahui";
        setError(errorMessage);
    } finally {
        setLoading(false);
    }
};

// src/app/.well-known/openid-credential-issuer/route.ts
import { NextResponse } from "next/server";
 
export async function GET() {
    const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || "http://localhost:3000";
 
    const issuerMetadata = {
        // Pengidentifikasi unik issuer.
        issuer: baseUrl,
        // URL server otorisasi. Untuk kesederhanaan, issuer kami adalah server otorisasi itu sendiri.
        authorization_servers: [baseUrl],
        // URL dari credential issuer.
        credential_issuer: baseUrl,
        // Endpoint tempat wallet akan melakukan POST untuk menerima kredensial yang sebenarnya.
        credential_endpoint: `${baseUrl}/api/issue/credential`,
        // Endpoint tempat wallet menukar kode otorisasi dengan token akses.
        token_endpoint: `${baseUrl}/api/issue/token`,
        // Endpoint untuk alur otorisasi (tidak digunakan dalam alur pra-otorisasi kami, tetapi praktik yang baik untuk disertakan).
        authorization_endpoint: `${baseUrl}/api/issue/authorize`,
        // Menunjukkan dukungan untuk alur kode pra-otorisasi tanpa memerlukan otentikasi klien.
        pre_authorized_grant_anonymous_access_supported: true,
        // Informasi yang dapat dibaca manusia tentang issuer.
        display: [
            {
                name: "Corbado Credentials Issuer",
                locale: "en-US",
            },
        ],
        // Daftar jenis kredensial yang dapat diterbitkan oleh issuer ini.
        credential_configurations_supported: {
            "eu.europa.ec.eudi.pid.1": {
                // Format kredensial (misalnya, jwt_vc, mso_mdoc).
                format: "jwt_vc",
                // Jenis dokumen spesifik, sesuai dengan standar ISO mDoc.
                doctype: "eu.europa.ec.eudi.pid.1",
                // Cakupan OAuth 2.0 yang terkait dengan jenis kredensial ini.
                scope: "eu.europa.ec.eudi.pid.1",
                // Metode yang dapat digunakan wallet untuk membuktikan kepemilikan kuncinya.
                cryptographic_binding_methods_supported: ["jwk"],
                // Algoritma penandatanganan yang didukung issuer untuk kredensial ini.
                credential_signing_alg_values_supported: ["ES256"],
                // Jenis proof-of-possession yang dapat digunakan wallet.
                proof_types_supported: {
                    jwt: {
                        proof_signing_alg_values_supported: ["ES256", "ES384", "ES512"],
                    },
                },
                // Properti tampilan untuk kredensial.
                display: [
                    {
                        name: "Corbado Credential Issuer",
                        locale: "en-US",
                        logo: {
                            uri: `${baseUrl}/logo.png`,
                            alt_text: "EU Digital Identity",
                        },
                        background_color: "#003399",
                        text_color: "#FFFFFF",
                    },
                ],
                // Daftar klaim (atribut) dalam kredensial.
                claims: {
                    "eu.europa.ec.eudi.pid.1": {
                        given_name: {
                            mandatory: true,
                            display: [{ name: "Given Name", locale: "en-US" }],
                        },
                        family_name: {
                            mandatory: true,
                            display: [{ name: "Family Name", locale: "en-US" }],
                        },
                        birth_date: {
                            mandatory: true,
                            display: [{ name: "Date of Birth", locale: "en-US" }],
                        },
                    },
                },
            },
        },
        // Metode otentikasi yang didukung oleh endpoint token. 'none' berarti klien publik.
        token_endpoint_auth_methods_supported: ["none"],
        // Metode tantangan kode PKCE yang didukung.
        code_challenge_methods_supported: ["S256"],
        // Jenis grant OAuth 2.0 yang didukung issuer.
        grant_types_supported: [
            "authorization_code",
            "urn:ietf:params:oauth:grant-type:pre-authorized_code",
        ],
    };
 
    return NextResponse.json(issuerMetadata, {
        headers: {
            "Content-Type": "application/json",
            "Cache-Control": "no-cache, no-store, must-revalidate",
            Pragma: "no-cache",
            Expires: "0",
        },
    });
}

// src/app/.well-known/openid-configuration/route.ts
import { NextResponse } from "next/server";
 
export async function GET() {
    const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || "http://localhost:3000";
 
    const openidConfiguration = {
        // Pengidentifikasi unik issuer.
        credential_issuer: baseUrl,
        // Endpoint tempat wallet akan melakukan POST untuk menerima kredensial yang sebenarnya.
        credential_endpoint: `${baseUrl}/api/issue/credential`,
        // Endpoint untuk alur otorisasi.
        authorization_endpoint: `${baseUrl}/api/issue/authorize`,
        // Endpoint tempat wallet menukar kode otorisasi dengan token akses.
        token_endpoint: `${baseUrl}/api/issue/token`,
        // Daftar jenis kredensial yang dapat diterbitkan oleh issuer ini.
        credential_configurations_supported: {
            "eu.europa.ec.eudi.pid.1": {
                format: "jwt_vc",
                scope: "eu.europa.ec.eudi.pid.1",
                cryptographic_binding_methods_supported: ["jwk"],
                credential_signing_alg_values_supported: ["ES256", "ES384", "ES512"],
                proof_types_supported: {
                    jwt: {
                        proof_signing_alg_values_supported: ["ES256", "ES384", "ES512"],
                    },
                },
            },
        },
        // Jenis grant OAuth 2.0 yang didukung issuer.
        grant_types_supported: [
            "authorization_code",
            "urn:ietf:params:oauth:grant-type:pre-authorized_code",
        ],
        // Menunjukkan dukungan untuk alur kode pra-otorisasi.
        pre_authorized_grant_anonymous_access_supported: true,
        // Metode tantangan kode PKCE yang didukung.
        code_challenge_methods_supported: ["S256"],
        // Metode otentikasi yang didukung oleh endpoint token.
        token_endpoint_auth_methods_supported: ["none"],
        // Cakupan OAuth 2.0 yang didukung issuer.
        scopes_supported: ["eu.europa.ec.eudi.pid.1"],
    };
 
    return NextResponse.json(openidConfiguration, {
        headers: {
            "Content-Type": "application/json",
            "Cache-Control": "no-cache, no-store, must-revalidate",
            Pragma: "no-cache",
            Expires: "0",
        },
    });
}

// src/app/.well-known/did.json/route.ts
import { NextResponse } from "next/server";
import { getActiveIssuerKey } from "../../../lib/database";
import { generateIssuerDid } from "../../../lib/crypto";
 
export async function GET() {
    const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || "http://localhost:3000";
    const issuerKey = await getActiveIssuerKey();
 
    if (!issuerKey) {
        return NextResponse.json(
            { error: "No active issuer key found" },
            { status: 404 },
        );
    }
 
    const publicKeyJWK = JSON.parse(issuerKey.public_key);
    const didId = generateIssuerDid();
    const didDocument = {
        // Konteks mendefinisikan kosakata yang digunakan dalam dokumen.
        "@context": [
            "https://www.w3.org/ns/did/v1",
            "https://w3id.org/security/suites/jws-2020/v1",
        ],
        // URI DID, yang merupakan pengidentifikasi unik untuk issuer.
        id: didId,
        // Pengontrol DID, yang merupakan entitas yang mengontrol DID. Di sini, itu adalah issuer itu sendiri.
        controller: didId,
        // Daftar kunci publik yang dapat digunakan untuk memverifikasi tanda tangan dari issuer.
        verificationMethod: [
            {
                // Pengidentifikasi unik untuk kunci, yang terlingkup ke DID.
                id: `${didId}#${issuerKey.key_id}`,
                // Jenis kunci.
                type: "JsonWebKey2020",
                // DID dari pengontrol kunci.
                controller: didId,
                // Kunci publik dalam format JWK.
                publicKeyJwk: publicKeyJWK,
            },
        ],
        // Menentukan kunci mana yang dapat digunakan untuk otentikasi (membuktikan kontrol atas DID).
        authentication: [`${didId}#${issuerKey.key_id}`],
        // Menentukan kunci mana yang dapat digunakan untuk membuat kredensial yang dapat diverifikasi.
        assertionMethod: [`${didId}#${issuerKey.key_id}`],
        // Daftar layanan yang disediakan oleh subjek DID, seperti endpoint issuer.
        service: [
            {
                id: `${didId}#openid-credential-issuer`,
                type: "OpenIDCredentialIssuer",
                serviceEndpoint: `${baseUrl}/.well-known/openid-credential-issuer`,
            },
        ],
    };
 
    return NextResponse.json(didDocument, {
        headers: {
            "Content-Type": "application/did+json",
            "Cache-Control": "no-cache, no-store, must-revalidate",
            Pragma: "no-cache",
            Expires: "0",
        },
    });
}

// src/app/api/schemas/pid/route.ts
import { NextResponse } from "next/server";
 
export async function GET() {
    const schema = {
        $schema: "https://json-schema.org/draft/2020-12/schema",
        $id: "https://example.com/schemas/pid", // Ganti dengan domain Anda yang sebenarnya
        title: "PID Credential",
        description:
            "Skema untuk Verifiable Credential yang mewakili Dokumen Identifikasi Pribadi (PID).",
        type: "object",
        properties: {
            credentialSubject: {
                type: "object",
                properties: {
                    given_name: { type: "string" },
                    family_name: { type: "string" },
                    birth_date: { type: "string", format: "date" },
                    // ... properti lain dari subjek kredensial
                },
                required: ["given_name", "family_name", "birth_date"],
            },
            // ... properti tingkat atas lainnya dari Verifiable Credential
        },
    };
 
    return NextResponse.json(schema, {
        headers: {
            "Content-Type": "application/schema+json",
            "Access-Control-Allow-Origin": "*", // Izinkan permintaan lintas-asal
        },
    });
}

// src/app/api/issue/authorize/route.ts
import { NextRequest, NextResponse } from "next/server";
import { v4 as uuidv4 } from "uuid";
import { createAuthorizationCode } from "@/lib/database";
 
export async function POST(request: NextRequest) {
    try {
        const body = await request.json();
        const { user_data } = body;
 
        // 1. Validasi data pengguna
        if (
            !user_data ||
            !user_data.given_name ||
            !user_data.family_name ||
            !user_data.birth_date
        ) {
            return NextResponse.json({ error: "missing_user_data" }, { status: 400 });
        }
 
        // 2. Buat kode pra-otorisasi dan PIN
        const code = uuidv4();
        const expiresAt = new Date(Date.now() + 10 * 60 * 1000); // 10 menit
        const txCode = Math.floor(1000 + Math.random() * 9000).toString(); // PIN 4 digit
 
        // 3. Simpan kode dan data pengguna
        await createAuthorizationCode(uuidv4(), code, expiresAt);
        // Catatan: Ini menggunakan penyimpanan dalam memori hanya untuk tujuan demo.
        // Di produksi, simpan data dengan aman di database dengan kedaluwarsa yang tepat.
        if (!(global as any).userDataStore) (global as any).userDataStore = new Map();
        (global as any).userDataStore.set(code, user_data);
        if (!(global as any).txCodeStore) (global as any).txCodeStore = new Map();
        (global as any).txCodeStore.set(code, txCode);
 
        // 4. Buat objek penawaran kredensial
        const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || "http://localhost:3000";
        const credentialOffer = {
            // Pengidentifikasi issuer, yang merupakan URL dasarnya.
            credential_issuer: baseUrl,
            // Array jenis kredensial yang ditawarkan oleh issuer.
            credential_configuration_ids: ["eu.europa.ec.eudi.pid.1"],
            // Menentukan jenis grant yang dapat digunakan oleh wallet.
            grants: {
                // Kita menggunakan alur kode pra-otorisasi.
                "urn:ietf:params:oauth:grant-type:pre-authorized_code": {
                    // Kode sekali pakai yang akan ditukar oleh wallet dengan token.
                    "pre-authorized_code": code,
                    // Menunjukkan bahwa pengguna harus memasukkan PIN (tx_code) untuk menukarkan kode.
                    user_pin_required: true,
                },
            },
        };
 
        // 5. Buat URI penawaran kredensial lengkap (deep link untuk wallet)
        const credentialOfferUri = `openid-credential-offer://?credential_offer=${encodeURIComponent(
            JSON.stringify(credentialOffer),
        )}`;
 
        // Respons akhir ke frontend.
        return NextResponse.json({
            // Deep link untuk kode QR.
            credential_offer_uri: credentialOfferUri,
            // Kode pra-otorisasi mentah, untuk ditampilkan atau entri manual.
            pre_authorized_code: code,
            // PIN 4 digit yang harus dimasukkan pengguna di wallet mereka.
            tx_code: txCode,
        });
    } catch (error) {
        console.error("Authorization error:", error);
        return NextResponse.json({ error: "server_error" }, { status: 500 });
    }
}

// src/app/api/issue/token/route.ts
import { NextRequest, NextResponse } from "next/server";
import { v4 as uuidv4 } from "uuid";
import {
    getAuthorizationCode,
    markAuthorizationCodeAsUsed,
    createIssuanceSession,
} from "@/lib/database";
 
export async function POST(request: NextRequest) {
    try {
        const formData = await request.formData();
        const grant_type = formData.get("grant_type") as string;
        const code = formData.get("pre-authorized_code") as string;
        const user_pin = formData.get("user_pin") as string;
 
        // 1. Validasi jenis grant
        if (grant_type !== "urn:ietf:params:oauth:grant-type:pre-authorized_code") {
            return NextResponse.json(
                { error: "unsupported_grant_type" },
                { status: 400 },
            );
        }
 
        // 2. Validasi kode pra-otorisasi
        const authCode = await getAuthorizationCode(code);
        if (!authCode) {
            return NextResponse.json(
                {
                    error: "invalid_grant",
                    error_description: "Kode tidak valid atau kedaluwarsa",
                },
                { status: 400 },
            );
        }
 
        // 3. Validasi PIN (tx_code)
        const expectedTxCode = (global as any).txCodeStore?.get(code);
        if (expectedTxCode !== user_pin) {
            return NextResponse.json(
                { error: "invalid_grant", error_description: "PIN tidak valid" },
                { status: 400 },
            );
        }
 
        // 4. Buat token akses dan c_nonce
        const accessToken = uuidv4();
        const cNonce = uuidv4();
        const cNonceExpiresAt = new Date(Date.now() + 5 * 60 * 1000); // 5 menit
 
        // 5. Buat sesi penerbitan baru
        const userData = (global as any).userDataStore?.get(code);
        await createIssuanceSession(
            uuidv4(),
            authCode.id,
            accessToken,
            cNonce,
            cNonceExpiresAt,
            userData,
        );
 
        // 6. Tandai kode sebagai sudah digunakan dan bersihkan data sementara
        await markAuthorizationCodeAsUsed(code);
        (global as any).txCodeStore?.delete(code);
        (global as any).userDataStore?.delete(code);
 
        // 7. Kembalikan respons token akses
        return NextResponse.json({
            access_token: accessToken,
            token_type: "Bearer",
            expires_in: 3600, // 1 jam
            c_nonce: cNonce,
            c_nonce_expires_in: 300, // 5 menit
        });
    } catch (error) {
        console.error("Token endpoint error:", error);
        return NextResponse.json({ error: "server_error" }, { status: 500 });
    }
}

// src/app/api/issue/credential/route.ts
import { NextRequest, NextResponse } from "next/server";
import { v4 as uuidv4 } from "uuid";
import {
    getIssuanceSessionByToken,
    updateIssuanceSession,
    createIssuedCredential,
    getActiveIssuerKey,
} from "@/lib/database";
import {
    createJWTVerifiableCredential,
    importIssuerKeyPair,
    generateIssuerDid,
} from "@/lib/crypto";
 
export async function POST(request: NextRequest) {
    try {
        // 1. Validasi token Bearer
        const authHeader = request.headers.get("authorization");
        const accessToken = authHeader?.substring(7);
        const session = await getIssuanceSessionByToken(accessToken);
 
        if (!session) {
            return NextResponse.json({ error: "invalid_token" }, { status: 401 });
        }
 
        // 2. Dapatkan data pengguna dari sesi
        const userData = session.user_data;
        if (!userData) {
            return NextResponse.json({ error: "missing_user_data" }, { status: 400 });
        }
 
        // 3. Dapatkan kunci issuer yang aktif
        const issuerKey = await getActiveIssuerKey();
        if (!issuerKey) {
            // Dalam aplikasi nyata, Anda akan memiliki sistem manajemen kunci yang lebih kuat.
            // Untuk demo ini, kita dapat membuat kunci secara on-the-fly jika tidak ada.
            // Bagian ini dihilangkan untuk keringkasan tetapi ada di repositori.
            return NextResponse.json(
                {
                    error: "server_error",
                    error_description: "Gagal mendapatkan kunci issuer",
                },
                { status: 500 },
            );
        }
 
        // 4. Buat JWT-VC
        const issuerDid = generateIssuerDid();
        const keyPair = await importIssuerKeyPair(
            issuerKey.key_id,
            issuerKey.public_key,
            issuerKey.private_key,
            issuerDid,
        );
        const subjectId = `did:example:${uuidv4()}`;
        const credentialData = await createJWTVerifiableCredential(
            userData,
            keyPair,
            subjectId,
            process.env.NEXT_PUBLIC_BASE_URL || "http://localhost:3000",
        );
 
        // 5. Simpan kredensial yang diterbitkan di database
        await createIssuedCredential(/* ... detail kredensial ... */);
        await updateIssuanceSession(session.id, "credential_issued");
 
        // 6. Kembalikan kredensial yang ditandatangani
        return NextResponse.json({
            format: "jwt_vc",
            credential: credentialData,
            c_nonce: uuidv4(), // Nonce baru untuk permintaan berikutnya
            c_nonce_expires_in: 300,
        });
    } catch (error) {
        console.error("Credential endpoint error:", error);
        return NextResponse.json({ error: "server_error" }, { status: 500 });
    }
}