wallet provider APIs / remote signature

[ThierryThevenet]

IN PROGRESS

This ticket allows user to sign with a key stored in a remote HSM (for business wallet or individual wallet).

Wallet request remote signing

Check the flow https://swimlanes.io/u/Rt5vg-FWI

0) issuance or presentation of VC requests a remote signature 1) Wallet calls nonce endpoint see https://github.com/TalaoDAO/AltMe/issues/2704 2) Wallet authenticates to the wallet provider back end see https://github.com/TalaoDAO/AltMe/issues/2704 3) Wallet calls the sign endpoint

Use DPoP built and signed as previously (see API update-configuration). DPoP must integrate the specific attributes as hash of the token, url of the request endpoint,...

In the body of the POST : message is the message to sign in base64url safe format (usually a hash) kid is the identifier of the key to be used to sign

POST /signHash HTTP/1.1
Host: wallet-provider.talao.co 
Authorization: Bearer <token>
DPoP: eyljhlkjghlkjgh56....
Content-Type: 'application/x-www-form-urlencoded'

message=<base64 url safe (message)>
&kid=LKJGFFFJ567875VJKHG

Wallet provider portal responds with signed message or 401

HTTP/1.1 200 OK
Content-Type: application/json

{
  "signed_message": "d2JhY2NhbG91cmVqdWFuZGFt"
}