如何构建数字凭证签发者（开发者指南）

npx create-next-app@latest . --ts --eslint --tailwind --app --src-dir --import-alias "@/*" --use-npm

npm install jose mysql2 uuid @types/uuid

services:
    mysql:
        image: mysql:8.0
        restart: always
        environment:
            MYSQL_ROOT_PASSWORD: rootpassword
            MYSQL_DATABASE: digital_credentials
            MYSQL_USER: app_user
            MYSQL_PASSWORD: app_password
        ports:
            - "3306:3306"
        volumes:
            - mysql_data:/var/lib/mysql
            - ./sql/init.sql:/docker-entrypoint-initdb.d/init.sql
        healthcheck:
            test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
            timeout: 20s
            retries: 10
 
volumes:
    mysql_data:

-- Create database if not exists
CREATE DATABASE IF NOT EXISTS digital_credentials;
USE digital_credentials;
 
-- Table for storing challenges
CREATE TABLE IF NOT EXISTS challenges (
    id VARCHAR(36) PRIMARY KEY,
    challenge VARCHAR(255) NOT NULL UNIQUE,
    expires_at TIMESTAMP NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    used BOOLEAN DEFAULT FALSE,
    INDEX idx_challenge (challenge),
    INDEX idx_expires_at (expires_at)
);
 
-- Table for storing verification sessions
CREATE TABLE IF NOT EXISTS verification_sessions (
    id VARCHAR(36) PRIMARY KEY,
    challenge_id VARCHAR(36),
    status ENUM('pending', 'verified', 'failed', 'expired') DEFAULT 'pending',
    presentation_data JSON,
    verified_at TIMESTAMP NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    FOREIGN KEY (challenge_id) REFERENCES challenges(id) ON DELETE CASCADE,
    INDEX idx_challenge_id (challenge_id),
    INDEX idx_status (status)
);
 
-- Table for storing verified credentials data (optional)
CREATE TABLE IF NOT EXISTS verified_credentials (
    id VARCHAR(36) PRIMARY KEY,
    session_id VARCHAR(36),
    credential_type VARCHAR(255),
    issuer VARCHAR(255),
    subject VARCHAR(255),
    claims JSON,
    verified_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (session_id) REFERENCES verification_sessions(id) ON DELETE CASCADE,
    INDEX idx_session_id (session_id),
    INDEX idx_credential_type (credential_type)
);
 
-- ISSUER TABLES
 
-- Table for storing authorization codes in OpenID4VCI flow
CREATE TABLE IF NOT EXISTS authorization_codes (
    id VARCHAR(36) PRIMARY KEY,
    code VARCHAR(255) NOT NULL UNIQUE,
    client_id VARCHAR(255),
    scope VARCHAR(255),
    code_challenge VARCHAR(255),
    code_challenge_method VARCHAR(50),
    redirect_uri TEXT,
    user_pin VARCHAR(10),
    expires_at TIMESTAMP NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    used BOOLEAN DEFAULT FALSE,
    INDEX idx_code (code),
    INDEX idx_expires_at (expires_at)
);
 
-- Table for storing issuance sessions
CREATE TABLE IF NOT EXISTS issuance_sessions (
    id VARCHAR(36) PRIMARY KEY,
    authorization_code_id VARCHAR(36),
    access_token VARCHAR(255),
    token_type VARCHAR(50) DEFAULT 'Bearer',
    expires_in INT DEFAULT 3600,
    c_nonce VARCHAR(255),
    c_nonce_expires_at TIMESTAMP,
    status ENUM('pending', 'authorized', 'credential_issued', 'expired', 'failed') DEFAULT 'pending',
    user_data JSON,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    FOREIGN KEY (authorization_code_id) REFERENCES authorization_codes(id) ON DELETE CASCADE,
    INDEX idx_access_token (access_token),
    INDEX idx_c_nonce (c_nonce),
    INDEX idx_status (status)
);
 
-- Table for storing issued credentials
CREATE TABLE IF NOT EXISTS issued_credentials (
    id VARCHAR(36) PRIMARY KEY,
    session_id VARCHAR(36),
    credential_id VARCHAR(255),
    credential_type VARCHAR(255) DEFAULT 'jwt_vc',
    doctype VARCHAR(255) DEFAULT 'eu.europa.ec.eudi.pid.1',
    credential_data LONGTEXT, -- Base64 encoded mDoc
    credential_claims JSON,
    issuer_did VARCHAR(255),
    subject_id VARCHAR(255),
    issued_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    expires_at TIMESTAMP,
    revoked BOOLEAN DEFAULT FALSE,
    revoked_at TIMESTAMP NULL,
    FOREIGN KEY (session_id) REFERENCES issuance_sessions(id) ON DELETE CASCADE,
    INDEX idx_credential_id (credential_id),
    INDEX idx_session_id (session_id),
    INDEX idx_doctype (doctype),
    INDEX idx_subject_id (subject_id),
    INDEX idx_issued_at (issued_at)
);
 
-- Table for storing issuer keys (simplified for demo)
CREATE TABLE IF NOT EXISTS issuer_keys (
    id VARCHAR(36) PRIMARY KEY,
    key_id VARCHAR(255) NOT NULL UNIQUE,
    key_type VARCHAR(50) NOT NULL, -- 'EC', 'RSA'
    algorithm VARCHAR(50) NOT NULL, -- 'ES256', 'RS256', etc.
    public_key TEXT NOT NULL, -- JWK format
    private_key TEXT NOT NULL, -- JWK format (encrypted in production)
    is_active BOOLEAN DEFAULT TRUE,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    INDEX idx_key_id (key_id),
    INDEX idx_is_active (is_active)
);

docker-compose up -d

// src/lib/database.ts
import mysql from "mysql2/promise";
 
// 数据库连接配置
const dbConfig = {
    host: process.env.DATABASE_HOST || "localhost",
    port: parseInt(process.env.DATABASE_PORT || "3306"),
    user: process.env.DATABASE_USER || "app_user",
    password: process.env.DATABASE_PASSWORD || "app_password",
    database: process.env.DATABASE_NAME || "digital_credentials",
    timezone: "+00:00",
};
 
let connection: mysql.Connection | null = null;
 
export async function getConnection(): Promise<mysql.Connection> {
    if (!connection) {
        connection = await mysql.createConnection(dbConfig);
    }
    return connection;
}
 
// 每个表的数据访问对象 (DAO) 函数
// ... (例如, createChallenge, getChallenge, createAuthorizationCode, 等)

// src/lib/crypto.ts
import { generateKeyPair, exportJWK, SignJWT } from "jose";
 
export async function generateIssuerKeyPair(keyId: string, issuerDid: string) {
    const { publicKey, privateKey } = await generateKeyPair("ES256", {
        crv: "P-256",
        extractable: true,
    });
 
    const publicKeyJWK = await exportJWK(publicKey);
    publicKeyJWK.kid = keyId; // 分配一个唯一的密钥 ID
 
    // ... (私钥导出和其他设置)
 
    return { publicKey, privateKey, publicKeyJWK /* ... */ };
}

// src/lib/crypto.ts
 
export async function createJWTVerifiableCredential(
    claims: MDocClaims,
    issuerKeyPair: IssuerKeyPair,
    subjectId: string,
    audience: string,
): Promise<string> {
    const now = Math.floor(Date.now() / 1000);
    const oneYear = 365 * 24 * 60 * 60;
 
    const vcPayload = {
        // 签发者的 DID
        iss: issuerKeyPair.issuerDid,
        // 主体 (持有者) 的 DID
        sub: subjectId,
        // 凭证签发时间 (iat) 和过期时间 (exp)
        iat: now,
        exp: now + oneYear,
        // 可验证凭证数据模型
        vc: {
            "@context": [
                "https://www.w3.org/2018/credentials/v1",
                "https://europa.eu/eudi/pid/v1",
            ],
            type: ["VerifiableCredential", "eu.europa.ec.eudi.pid.1"],
            issuer: issuerKeyPair.issuerDid,
            issuanceDate: new Date(now * 1000).toISOString(),
            credentialSubject: {
                id: subjectId,
                ...claims,
            },
        },
    };
 
    // 使用签发者的私钥对 payload 进行签名
    return await new SignJWT(vcPayload)
        .setProtectedHeader({
            alg: issuerKeyPair.algorithm,
            kid: issuerKeyPair.keyId,
            typ: "JWT",
        })
        .sign(issuerKeyPair.privateKey);
}

// src/app/issue/page.tsx
 
const handleSubmit = async (e: React.FormEvent) => {
    e.preventDefault();
    setLoading(true);
    setError(null);
    setCredentialOffer(null);
 
    try {
        // 1. 验证必填字段
        if (!userData.given_name || !userData.family_name || !userData.birth_date) {
            throw new Error("请填写所有必填字段");
        }
 
        // 2. 从后端请求凭证邀约
        const response = await fetch("/api/issue/authorize", {
            method: "POST",
            headers: {
                "Content-Type": "application/json",
            },
            body: JSON.stringify({
                user_data: userData,
            }),
        });
 
        if (!response.ok) {
            const errorData = await response.json();
            throw new Error(errorData.error_description || "创建凭证邀约失败");
        }
 
        // 3. 在 state 中设置凭证邀约以显示二维码
        const result = await response.json();
        setCredentialOffer(result);
    } catch (err) {
        const errorMessage = (err as Error).message || "发生未知错误";
        setError(errorMessage);
    } finally {
        setLoading(false);
    }
};

// src/app/.well-known/openid-credential-issuer/route.ts
import { NextResponse } from "next/server";
 
export async function GET() {
    const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || "http://localhost:3000";
 
    const issuerMetadata = {
        // 签发者的唯一标识符。
        issuer: baseUrl,
        // 授权服务器的 URL。为简单起见，我们的签发者本身就是其授权服务器。
        authorization_servers: [baseUrl],
        // 凭证签发者的 URL。
        credential_issuer: baseUrl,
        // 钱包将 POST 请求以接收实际凭证的端点。
        credential_endpoint: `${baseUrl}/api/issue/credential`,
        // 钱包用于交换授权码以获取访问令牌的端点。
        token_endpoint: `${baseUrl}/api/issue/token`,
        // 授权流程的端点 (在我们的预授权流程中未使用，但最好包含)。
        authorization_endpoint: `${baseUrl}/api/issue/authorize`,
        // 表明支持无需客户端身份验证的预授权码流程。
        pre_authorized_grant_anonymous_access_supported: true,
        // 关于签发者的人类可读信息。
        display: [
            {
                name: "Corbado Credentials Issuer",
                locale: "en-US",
            },
        ],
        // 此签发者可以签发的凭证类型列表。
        credential_configurations_supported: {
            "eu.europa.ec.eudi.pid.1": {
                // 凭证的格式 (例如, jwt_vc, mso_mdoc)。
                format: "jwt_vc",
                // 符合 ISO mDoc 标准的特定文档类型。
                doctype: "eu.europa.ec.eudi.pid.1",
                // 与此凭证类型关联的 OAuth 2.0 作用域。
                scope: "eu.europa.ec.eudi.pid.1",
                // 钱包可以用来证明其密钥所有权的方法。
                cryptographic_binding_methods_supported: ["jwk"],
                // 签发者为此凭证支持的签名算法。
                credential_signing_alg_values_supported: ["ES256"],
                // 钱包可以使用的所有权证明类型。
                proof_types_supported: {
                    jwt: {
                        proof_signing_alg_values_supported: ["ES256", "ES384", "ES512"],
                    },
                },
                // 凭证的显示属性。
                display: [
                    {
                        name: "Corbado Credential Issuer",
                        locale: "en-US",
                        logo: {
                            uri: `${baseUrl}/logo.png`,
                            alt_text: "EU Digital Identity",
                        },
                        background_color: "#003399",
                        text_color: "#FFFFFF",
                    },
                ],
                // 凭证中的声明 (属性) 列表。
                claims: {
                    "eu.europa.ec.eudi.pid.1": {
                        given_name: {
                            mandatory: true,
                            display: [{ name: "Given Name", locale: "en-US" }],
                        },
                        family_name: {
                            mandatory: true,
                            display: [{ name: "Family Name", locale: "en-US" }],
                        },
                        birth_date: {
                            mandatory: true,
                            display: [{ name: "Date of Birth", locale: "en-US" }],
                        },
                    },
                },
            },
        },
        // 令牌端点支持的身份验证方法。'none' 表示公共客户端。
        token_endpoint_auth_methods_supported: ["none"],
        // 支持的 PKCE 代码挑战方法。
        code_challenge_methods_supported: ["S256"],
        // 签发者支持的 OAuth 2.0 授权类型。
        grant_types_supported: [
            "authorization_code",
            "urn:ietf:params:oauth:grant-type:pre-authorized_code",
        ],
    };
 
    return NextResponse.json(issuerMetadata, {
        headers: {
            "Content-Type": "application/json",
            "Cache-Control": "no-cache, no-store, must-revalidate",
            Pragma: "no-cache",
            Expires: "0",
        },
    });
}

// src/app/.well-known/openid-configuration/route.ts
import { NextResponse } from "next/server";
 
export async function GET() {
    const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || "http://localhost:3000";
 
    const openidConfiguration = {
        // 签发者的唯一标识符。
        credential_issuer: baseUrl,
        // 钱包将 POST 请求以接收实际凭证的端点。
        credential_endpoint: `${baseUrl}/api/issue/credential`,
        // 授权流程的端点。
        authorization_endpoint: `${baseUrl}/api/issue/authorize`,
        // 钱包用于交换授权码以获取访问令牌的端点。
        token_endpoint: `${baseUrl}/api/issue/token`,
        // 此签发者可以签发的凭证类型列表。
        credential_configurations_supported: {
            "eu.europa.ec.eudi.pid.1": {
                format: "jwt_vc",
                scope: "eu.europa.ec.eudi.pid.1",
                cryptographic_binding_methods_supported: ["jwk"],
                credential_signing_alg_values_supported: ["ES256", "ES384", "ES512"],
                proof_types_supported: {
                    jwt: {
                        proof_signing_alg_values_supported: ["ES256", "ES384", "ES512"],
                    },
                },
            },
        },
        // 签发者支持的 OAuth 2.0 授权类型。
        grant_types_supported: [
            "authorization_code",
            "urn:ietf:params:oauth:grant-type:pre-authorized_code",
        ],
        // 表明支持预授权码流程。
        pre_authorized_grant_anonymous_access_supported: true,
        // 支持的 PKCE 代码挑战方法。
        code_challenge_methods_supported: ["S256"],
        // 令牌端点支持的身份验证方法。
        token_endpoint_auth_methods_supported: ["none"],
        // 签发者支持的 OAuth 2.0 作用域。
        scopes_supported: ["eu.europa.ec.eudi.pid.1"],
    };
 
    return NextResponse.json(openidConfiguration, {
        headers: {
            "Content-Type": "application/json",
            "Cache-Control": "no-cache, no-store, must-revalidate",
            Pragma: "no-cache",
            Expires: "0",
        },
    });
}

// src/app/.well-known/did.json/route.ts
import { NextResponse } from "next/server";
import { getActiveIssuerKey } from "../../../lib/database";
import { generateIssuerDid } from "../../../lib/crypto";
 
export async function GET() {
    const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || "http://localhost:3000";
    const issuerKey = await getActiveIssuerKey();
 
    if (!issuerKey) {
        return NextResponse.json(
            { error: "No active issuer key found" },
            { status: 404 },
        );
    }
 
    const publicKeyJWK = JSON.parse(issuerKey.public_key);
    const didId = generateIssuerDid();
    const didDocument = {
        // context 定义了文档中使用的词汇。
        "@context": [
            "https://www.w3.org/ns/did/v1",
            "https://w3id.org/security/suites/jws-2020/v1",
        ],
        // DID URI，是签发者的唯一标识符。
        id: didId,
        // DID 控制者，即控制该 DID 的实体。这里是签发者本身。
        controller: didId,
        // 可用于验证签发者签名的公钥列表。
        verificationMethod: [
            {
                // 密钥的唯一标识符，作用域为该 DID。
                id: `${didId}#${issuerKey.key_id}`,
                // 密钥的类型。
                type: "JsonWebKey2020",
                // 密钥控制者的 DID。
                controller: didId,
                // JWK 格式的公钥。
                publicKeyJwk: publicKeyJWK,
            },
        ],
        // 指定哪些密钥可用于身份验证 (证明对 DID 的控制权)。
        authentication: [`${didId}#${issuerKey.key_id}`],
        // 指定哪些密钥可用于创建可验证凭证。
        assertionMethod: [`${didId}#${issuerKey.key_id}`],
        // DID 主体提供的服务列表，例如签发者端点。
        service: [
            {
                id: `${didId}#openid-credential-issuer`,
                type: "OpenIDCredentialIssuer",
                serviceEndpoint: `${baseUrl}/.well-known/openid-credential-issuer`,
            },
        ],
    };
 
    return NextResponse.json(didDocument, {
        headers: {
            "Content-Type": "application/did+json",
            "Cache-Control": "no-cache, no-store, must-revalidate",
            Pragma: "no-cache",
            Expires: "0",
        },
    });
}

// src/app/api/schemas/pid/route.ts
import { NextResponse } from "next/server";
 
export async function GET() {
    const schema = {
        $schema: "https://json-schema.org/draft/2020-12/schema",
        $id: "https://example.com/schemas/pid", // 替换为你的实际域
        title: "PID Credential",
        description:
            "A schema for a Verifiable Credential representing a Personal Identification Document (PID).",
        type: "object",
        properties: {
            credentialSubject: {
                type: "object",
                properties: {
                    given_name: { type: "string" },
                    family_name: { type: "string" },
                    birth_date: { type: "string", format: "date" },
                    // ... 凭证主体的其他属性
                },
                required: ["given_name", "family_name", "birth_date"],
            },
            // ... 可验证凭证的其他顶层属性
        },
    };
 
    return NextResponse.json(schema, {
        headers: {
            "Content-Type": "application/schema+json",
            "Access-Control-Allow-Origin": "*", // 允许跨域请求
        },
    });
}

// src/app/api/issue/authorize/route.ts
import { NextRequest, NextResponse } from "next/server";
import { v4 as uuidv4 } from "uuid";
import { createAuthorizationCode } from "@/lib/database";
 
export async function POST(request: NextRequest) {
    try {
        const body = await request.json();
        const { user_data } = body;
 
        // 1. 验证用户数据
        if (
            !user_data ||
            !user_data.given_name ||
            !user_data.family_name ||
            !user_data.birth_date
        ) {
            return NextResponse.json({ error: "missing_user_data" }, { status: 400 });
        }
 
        // 2. 生成一个预授权码和一个 PIN
        const code = uuidv4();
        const expiresAt = new Date(Date.now() + 10 * 60 * 1000); // 10 分钟
        const txCode = Math.floor(1000 + Math.random() * 9000).toString(); // 4 位 PIN
 
        // 3. 存储代码和用户数据
        await createAuthorizationCode(uuidv4(), code, expiresAt);
        // 注意：这仅为演示目的使用内存存储。
        // 在生产环境中，应将数据安全地持久化到数据库中，并设置适当的过期时间。
        if (!(global as any).userDataStore) (global as any).userDataStore = new Map();
        (global as any).userDataStore.set(code, user_data);
        if (!(global as any).txCodeStore) (global as any).txCodeStore = new Map();
        (global as any).txCodeStore.set(code, txCode);
 
        // 4. 创建凭证邀约对象
        const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || "http://localhost:3000";
        const credentialOffer = {
            // 签发者的标识符，即其基础 URL。
            credential_issuer: baseUrl,
            // 签发者提供的凭证类型数组。
            credential_configuration_ids: ["eu.europa.ec.eudi.pid.1"],
            // 指定钱包可以使用的授权类型。
            grants: {
                // 我们正在使用预授权码流程。
                "urn:ietf:params:oauth:grant-type:pre-authorized_code": {
                    // 钱包将用于交换令牌的一次性代码。
                    "pre-authorized_code": code,
                    // 表明用户必须输入 PIN (tx_code) 来兑换代码。
                    user_pin_required: true,
                },
            },
        };
 
        // 5. 创建完整的凭证邀约 URI (钱包的深层链接)
        const credentialOfferUri = `openid-credential-offer://?credential_offer=${encodeURIComponent(
            JSON.stringify(credentialOffer),
        )}`;
 
        // 对前端的最终响应。
        return NextResponse.json({
            // 用于二维码的深层链接。
            credential_offer_uri: credentialOfferUri,
            // 原始的预授权码，用于显示或手动输入。
            pre_authorized_code: code,
            // 用户必须在其钱包中输入的 4 位 PIN。
            tx_code: txCode,
        });
    } catch (error) {
        console.error("Authorization error:", error);
        return NextResponse.json({ error: "server_error" }, { status: 500 });
    }
}

// src/app/api/issue/token/route.ts
import { NextRequest, NextResponse } from "next/server";
import { v4 as uuidv4 } from "uuid";
import {
    getAuthorizationCode,
    markAuthorizationCodeAsUsed,
    createIssuanceSession,
} from "@/lib/database";
 
export async function POST(request: NextRequest) {
    try {
        const formData = await request.formData();
        const grant_type = formData.get("grant_type") as string;
        const code = formData.get("pre-authorized_code") as string;
        const user_pin = formData.get("user_pin") as string;
 
        // 1. 验证授权类型
        if (grant_type !== "urn:ietf:params:oauth:grant-type:pre-authorized_code") {
            return NextResponse.json(
                { error: "unsupported_grant_type" },
                { status: 400 },
            );
        }
 
        // 2. 验证预授权码
        const authCode = await getAuthorizationCode(code);
        if (!authCode) {
            return NextResponse.json(
                {
                    error: "invalid_grant",
                    error_description: "Invalid or expired code",
                },
                { status: 400 },
            );
        }
 
        // 3. 验证 PIN (tx_code)
        const expectedTxCode = (global as any).txCodeStore?.get(code);
        if (expectedTxCode !== user_pin) {
            return NextResponse.json(
                { error: "invalid_grant", error_description: "Invalid PIN" },
                { status: 400 },
            );
        }
 
        // 4. 生成访问令牌和 c_nonce
        const accessToken = uuidv4();
        const cNonce = uuidv4();
        const cNonceExpiresAt = new Date(Date.now() + 5 * 60 * 1000); // 5 分钟
 
        // 5. 创建一个新的签发会话
        const userData = (global as any).userDataStore?.get(code);
        await createIssuanceSession(
            uuidv4(),
            authCode.id,
            accessToken,
            cNonce,
            cNonceExpiresAt,
            userData,
        );
 
        // 6. 将代码标记为已使用并清理临时数据
        await markAuthorizationCodeAsUsed(code);
        (global as any).txCodeStore?.delete(code);
        (global as any).userDataStore?.delete(code);
 
        // 7. 返回访问令牌响应
        return NextResponse.json({
            access_token: accessToken,
            token_type: "Bearer",
            expires_in: 3600, // 1 小时
            c_nonce: cNonce,
            c_nonce_expires_in: 300, // 5 分钟
        });
    } catch (error) {
        console.error("Token endpoint error:", error);
        return NextResponse.json({ error: "server_error" }, { status: 500 });
    }
}

// src/app/api/issue/credential/route.ts
import { NextRequest, NextResponse } from "next/server";
import { v4 as uuidv4 } from "uuid";
import {
    getIssuanceSessionByToken,
    updateIssuanceSession,
    createIssuedCredential,
    getActiveIssuerKey,
} from "@/lib/database";
import {
    createJWTVerifiableCredential,
    importIssuerKeyPair,
    generateIssuerDid,
} from "@/lib/crypto";
 
export async function POST(request: NextRequest) {
    try {
        // 1. 验证 Bearer 令牌
        const authHeader = request.headers.get("authorization");
        const accessToken = authHeader?.substring(7);
        const session = await getIssuanceSessionByToken(accessToken);
 
        if (!session) {
            return NextResponse.json({ error: "invalid_token" }, { status: 401 });
        }
 
        // 2. 从会话中获取用户数据
        const userData = session.user_data;
        if (!userData) {
            return NextResponse.json({ error: "missing_user_data" }, { status: 400 });
        }
 
        // 3. 获取活动的签发者密钥
        const issuerKey = await getActiveIssuerKey();
        if (!issuerKey) {
            // 在实际应用中，你会有更强大的密钥管理系统。
            // 对于此演示，如果密钥不存在，我们可以即时生成一个。
            // 此部分为简洁起见省略，但在仓库中有。
            return NextResponse.json(
                {
                    error: "server_error",
                    error_description: "Failed to get issuer key",
                },
                { status: 500 },
            );
        }
 
        // 4. 创建 JWT-VC
        const issuerDid = generateIssuerDid();
        const keyPair = await importIssuerKeyPair(
            issuerKey.key_id,
            issuerKey.public_key,
            issuerKey.private_key,
            issuerDid,
        );
        const subjectId = `did:example:${uuidv4()}`;
        const credentialData = await createJWTVerifiableCredential(
            userData,
            keyPair,
            subjectId,
            process.env.NEXT_PUBLIC_BASE_URL || "http://localhost:3000",
        );
 
        // 5. 在数据库中存储已签发的凭证
        await createIssuedCredential(/* ... credential details ... */);
        await updateIssuanceSession(session.id, "credential_issued");
 
        // 6. 返回已签名的凭证
        return NextResponse.json({
            format: "jwt_vc",
            credential: credentialData,
            c_nonce: uuidv4(), // 用于后续请求的新 nonce
            c_nonce_expires_in: 300,
        });
    } catch (error) {
        console.error("Credential endpoint error:", error);
        return NextResponse.json({ error: "server_error" }, { status: 500 });
    }
}