@learncard/http-bridge

LearnCard Bridge - HTTP is a suite of tools with a simple CLI for deploying a serverless execution environment for LearnCard Core exposed over an HTTP API.

Documentation

All LearnCard documentation can be found at: https://docs.learncard.com

Install

• Clone this repo
• Set up AWS CLI
• Add a .env file exporting a wallet seed (e.g. WALLET_SEED=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa)
• Run bun run serverless-deploy

Local VC-API conformance testing

The bridge uses a source-controlled DIDKit WASM copied from the current plugin build. Every build and start command verifies the canonical plugin artifact's SHA-256 before refreshing the bridge copy, so local, CLI, and serverless execution cannot silently use different binaries.

cd lib/didkit/lib/web
wasm-pack build --target=web && cd pkg && wasm-opt -Oz -o tmp.wasm didkit_wasm_bg.wasm && mv tmp.wasm didkit_wasm_bg.wasm && cp didkit* ../../../../../packages/plugins/didkit/src/didkit/pkg/ && cd ..
bun --cwd ../../../../packages/plugins/didkit run build

Stop and restart any running bridge after rebuilding; it loads the DIDKit WASM during initialization. When intentionally rebuilding DIDKit, review the new binary and run bun scripts/sync-didkit.ts --update-integrity from this package. Commit the updated EXPECTED_DIDKIT_SHA256 guard together with the plugin artifact. The repository's build-wasm-from-submodules.sh helper does this explicitly after generation, and the WASM update automation includes the guard and artifacts in its PR. Ordinary builds only verify the pin; they never update it. To test an unreviewed local artifact without changing that pin, set LOCAL_DIDKIT_PATH as described below.

Start the LearnCard HTTP bridge in the first terminal:

cd packages/learn-card-bridge-http
WALLET_SEED=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
bun run start:local

Set LOCAL_DIDKIT_PATH=/absolute/path/to/didkit_wasm_bg.wasm only to override the package-provided WASM. The test seed must match the issuer DID in w3c-localConfig.cjs.

Run the current W3C EdDSA Data Integrity suite in a second terminal:

git clone --depth 1 https://github.com/w3c/vc-di-eddsa-test-suite.git
cd vc-di-eddsa-test-suite
npm install
cp "$LEARN_CARD_REPO/packages/learn-card-bridge-http/w3c-localConfig.cjs" localConfig.cjs
npx mocha tests/05-di-rdfc-create.js --timeout 30000
npx mocha tests/15-di-rdfc-verify.js --timeout 30000

Set LEARN_CARD_REPO to the absolute path of this monorepo. Set BASE_URL when the bridge is not listening at http://127.0.0.1:3100.

URL issuer verification policy

When a credential names an HTTPS issuer but its proof uses a DID verification method, a successful proof check establishes signature integrity only. DIDKit cannot establish that the named URL issuer authorized that DID key because there is no issuer DID document to supply the assertion-method relationship. The raw verification result therefore includes this security-relevant warning:

Issuer authorization was not checked because the credential issuer is not a DID

Consumers must surface or enforce this warning according to their trust policy; they must not interpret checks: ["proof"] by itself as issuer authorization.

Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

Please make sure to update tests as appropriate.

Who is Learning Economy Foundation?

Learning Economy Foundation (LEF) is a 501(c)(3) non-profit organization leveraging global standards and web3 protocols to bring quality skills and equal opportunity to every human on earth, and address the persistent inequities that exist around the globe in education and employment. We help you build the future of education and work with:

License

MIT © Learning Economy Foundation