┌─────────────────────────────────────────────────────┐
│  应用层：智能会议客户端 / 会控中台 / 业务系统集成     │
├─────────────────────────────────────────────────────┤
│  协议适配层：DIDComm Messaging / OIDC4VP / CHAPI    │
├─────────────────────────────────────────────────────┤
│  信任层：通用解析器 / 信任注册表 / 吊销注册表         │
├─────────────────────────────────────────────────────┤
│  存储层：用户端钱包 / 组织端凭证服务 / 分布式账本(可选)│
└─────────────────────────────────────────────────────┘

sequenceDiagram
    participant Alice as 参会方钱包
    participant Meeting as 会控系统
    participant OrgCA as 组织CA
    participant TrustReg as 信任注册表

    Alice->>OrgCA: 申请员工VC (DID Auth)
    OrgCA-->>Alice: 签发 EmployeeVC
    Meeting->>TrustReg: 注册会议信任锚 (DID Document)
    Alice->>Meeting: 入会请求 + VP (含 EmployeeVC + InvitationVC)
    Meeting->>Meeting: 离线验证 VP 签名 + 吊销状态 + 信任链
    alt 验证通过
        Meeting-->>Alice: 会议媒体流 Token (短时效 JWT)
    else 验证失败
        Meeting-->>Alice: 拒绝入会 + 原因码
    end

graph LR
    subgraph 会控系统
        VPRequester[VP Requester Service]
    end
    subgraph 参会方环境
        direction TB
        MobileWallet[移动端钱包 AppnDIDComm v2 + Push]
        DesktopWallet[桌面端钱包nDIDComm v2 + CHAPI]
        WebWallet[Web 端钱包 / 无钱包降级nOIDC4VP + QR Code]
    end

    VPRequester -->|策略路由| ProtocolRouter{协议路由网关}
    ProtocolRouter -->|优先| MobileWallet
    ProtocolRouter -->|次选| DesktopWallet
    ProtocolRouter -->|兜底| WebWallet

// package.json 关键依赖片段（版本号为示例，生产环境需锁定至具体 Patch 版本）
{
  "dependencies": {
    "@didtools/sdk": "^0.12.0",           // DID 解析、签名、VC/VP 验证统一入口
    "@didtools/cacao": "^1.0.0",          // CACAO (Chain Agnostic CApability Object) 会话授权
    "did-resolver": "^4.1.0",
    "key-did-resolver": "^2.0.0",         // did:key 支持
    "web-did-resolver": "^2.0.0",         // did:web 支持
    "ion-did-resolver": "^1.0.0",         // did:ion 支持 (可选)
    "@digitalbazaar/vc": "^4.0.0",        // VC/VP 签发验证核心 (支持 BBS+, ECDSA, Ed25519)
    "@digitalbazaar/vc-status-rl-2021": "^1.0.0", // StatusList2021 吊销
    "didcomm": "^1.0.0",                  // DIDComm v2 编解码、路由、加密
    "oidc4vp": "^0.5.0",                  // OIDC4VP Request/Response 构建验证
    "jsonld": "^8.0.0",                   // JSON-LD 扩展/压缩 (VC 语义处理)
    "rdf-canonize": "^4.0.0"              // RDF 规范化 (签名必需)
  },
  "resolutions": {
    // 强制统一 jsonld 版本，避免多版本导致上下文加载冲突
    "jsonld": "^8.0.0"
  }
}

// middleware/verifyVpMiddleware.ts
import { Request, Response, NextFunction } from 'express';
import { verifyPresentation, VerifiablePresentation } from '@digitalbazaar/vc';
import { documentLoader } from '../config/jsonldContext'; // 离线上下文加载器，关键性能优化
import { checkRevocationStatus } from '../services/revocationService';
import { evaluatePolicy } from '../services/policyEngine'; // OPA/Rego 引擎封装

export const verifyVpMiddleware = async (req: Request, res: Response, next: NextFunction) => {
  const vpToken = req.headers['vp-token'] as string || req.body.vp_token;
  const meetingId = req.params.meetingId;
  const nonce = req.body.nonce; // 必须与会控下发的 Challenge 一致

  if (!vpToken) return res.status(400).json({ code: 'VP_MISSING', msg: 'VP Token 缺失' });

  let vp: VerifiablePresentation;
  try {
    // 1. 解析 VP (支持 JWT VP 或 JSON-LD VP)
    vp = typeof vpToken === 'string' && vpToken.startsWith('eyJ') 
      ? await verifyJwtVp(vpToken) 
      : JSON.parse(vpToken);
  } catch (e) {
    return res.status(400).json({ code: 'VP_PARSE_FAILED', msg: 'VP 格式非法' });
  }

  try {
    // 2. 核心验证：签名 + 上下文 + 持有者绑定 + Nonce 防重放
    const verificationResult = await verifyPresentation({
      presentation: vp,
      challenge: nonce,
      domain: `meeting:${meetingId}`, // 绑定会议域，防跨会议重放
      documentLoader, // 离线加载器，避免网络抖动
      suite: await getVerificationSuite(vp.proof.type) // 动态选择签名套件 (含国密)
    });

    if (!verificationResult.verified) {
      throw new Error('签名验证失败');
    }

    // 3. 吊销状态检查 (并发检查所有嵌套 VC)
    const revocationChecks = vp.verifiableCredential.map(vc => 
      checkRevocationStatus(vc.credentialStatus)
    );
    const revocationResults = await Promise.all(revocationChecks);
    if (revocationResults.some(r => r.revoked)) {
      return res.status(403).json({ code: 'VC_REVOKED', msg: '凭证已吊销' });
    }

    // 4. 策略引擎决策 (输入: VP 中的所有 Claim 集合)
    const claims = extractClaims(vp); // 扁平化提取所有 VC 的 credentialSubject
    const policyDecision = await evaluatePolicy(`meeting_access_${meetingId}`, {
      subject: vp.holder,
      claims,
      resource: `meeting:${meetingId}`,
      action: 'join',
      context: { deviceTrustLevel: req.headers['x-device-trust'] }
    });

    if (!policyDecision.allow) {
      return res.status(403).json({ 
        code: 'POLICY_DENY', 
        msg: policyDecision.reason || '权限不足',
        requiredClaims: policyDecision.missingClaims // 引导用户补全凭证
      });
    }

    // 5. 挂载验证结果供下游使用
    req.vpContext = { vp, claims, policyDecision, holderDid: vp.holder };
    next();

  } catch (err) {
    // 统一错误码映射，避免泄露堆栈信息
    const mappedError = mapVerificationError(err);
    res.status(mappedError.httpCode).json({ code: mappedError.code, msg: mappedError.msg });
  }
};

// services/didResolverCache.ts
import { Resolver } from 'did-resolver';
import { LRUCache } from 'lru-cache';
import { getLogger } from '../utils/logger';

const logger = getLogger('DIDResolverCache');

// 缓存配置：最大 10万 条，TTL 24h，过期后异步刷新
const didDocumentCache = new LRUCache<string, any>({
  max: 100_000,
  ttl: 1000 * 60 * 60 * 24,
  allowStale: true, // 允许返回过期数据，后台异步更新
  updateAgeOnGet: true,
  fetchMethod: async (did: string, staleValue) => {
    // 后台刷新逻辑
    if (staleValue) {
      // 触发异步刷新，不阻塞当前请求
      setImmediate(() => refreshDidDocument(did));
      return staleValue; // 直接返回旧值
    }
    // 首次获取，同步解析
    return resolveFresh(did);
  }
});

const baseResolver = new Resolver(getDidResolverConfig()); // 注册 did:web, did:key, did:ion 等

export async function resolveDidDocument(did: string): Promise<any> {
  // 1. 尝试缓存 (含 stale-while-revalidate)
  const cached = await didDocumentCache.fetch(did);
  if (cached) return cached;

  // 2. 缓存未命中 (极少见)，同步解析并入缓存
  return resolveFresh(did);
}

async function resolveFresh(did: string): Promise<any> {
  const start = Date.now();
  try {
    const result = await baseResolver.resolve(did);
    if (!result.didDocument) throw new Error('DID Document 不存在');
    logger.debug({ did, latency: Date.now() - start }, 'DID 解析成功');
    return result.didDocument;
  } catch (err) {
    logger.warn({ did, err }, 'DID 解析失败');
    throw err; // 向上抛出，由中间件统一处理 404/500
  }
}

async function refreshDidDocument(did: string) {
  try {
    const doc = await resolveFresh(did);
    didDocumentCache.set(did, doc); // 更新缓存，重置 TTL
  } catch (e) {
    logger.error({ did }, '后台刷新 DID Document 失败');
  }
}

┌─────────────┐     SAML/OIDC      ┌──────────────────┐     DID/VC      ┌──────────────┐
│ 遗留业务系统 │ ◄─────────────────► │ Identity Bridge  │ ◄─────────────► │ 智能会议系统  │
│ (只认 SAML)  │   联邦认证/SCIM    │ Service (IBS)    │   原生互信      │ (原生 DID)   │
└─────────────┘                    └────────┬─────────┘                 └──────────────┘
                                             │
                    ┌────────────────────────┼────────────────────────┐
                    ▼                        ▼                        ▼
             ┌─────────────┐          ┌─────────────┐          ┌─────────────┐
             │ 组织 A AD   │          │ 组织 B Okta │          │ 组织 C 自研 │
             │ (IdP)       │          │ (IdP)       │          │ (IdP)       │
             └─────────────┘          └─────────────┘          └─────────────┘

// controller/jitIssuanceController.ts
import { issueCredential } from '../services/vcIssuanceService';
import { getDidKeyPair } from '../services/keyManagement'; // 组织 CA 密钥管理 (HSM/KMS)
import { mapSamlAssertionToClaims } from '../mappers/samlMapper';

export async function handleJitIssuance(req: Request, res: Response) {
  const { samlAssertion, targetDid, walletEndpoint } = req.body; // 网关透传 SAML Assertion
  
  // 1. 校验 SAML Assertion 签名、时效、受众
  const samlClaims = await validateSamlAssertion(samlAssertion);
  
  // 2. 映射为标准 VC Claim (含 schema.org + 扩展词表)
  const vcClaims = mapSamlAssertionToClaims(samlClaims);
  
  // 3. 构造 VC Payload
  const credential = {
    '@context': ['https://www.w3.org/2018/credentials/v1', 'https://schema.org', 'https://meeting.example/contexts/v1'],
    type: ['VerifiableCredential', 'EmployeeCredential'],
    issuer: process.env.ORG_DID, // 组织 DID
    issuanceDate: new Date().toISOString(),
    credentialSubject: {
      id: targetDid, // 用户 DID
      ...vcClaims
    },
    credentialStatus: {
      id: `${process.env.REVOCATION_REGISTRY_URL}/status/employee#${vcClaims.employeeId}`,
      type: 'StatusList2021Entry',
      statusPurpose: 'revocation',
      statusListIndex: vcClaims.employeeId // 映射为吊销列表索引
    }
  };

  // 4. 签发 (使用组织 CA 私钥，支持多算法并行签名)
  const verificationMethod = `${process.env.ORG_DID}#keys-1`;
  const signedVc = await issueCredential({
    credential,
    verificationMethod,
    privateKey: await getDidKeyPair(verificationMethod), // 从 HSM/KMS 获取签名器
    suites: ['EcdsaSecp256r1Signature2019', 'Sm2Signature2023'] // 双算法签名
  });

  // 5. 投递至钱包 (DIDComm Credential Issuance v1.0)
  if (walletEndpoint) {
    await sendDidCommMessage(walletEndpoint, {
      type: 'https://didcomm.org/issue-credential/3.0/credential',
      body: { credential: signedVc }
    });
  }

  res.json({ 
    success: true, 
    credential: signedVc, // 同步返回备选
    didcommMessageId: '...' 
  });
}

# 会议录制转码阶段注入 C2PA Manifest (JSON) 与不可见水印 (DID + Timestamp)
# 假设 manifest.c2pa 已由会控系统生成，包含: meetingId, participantDids, startTime, policyHash
ffmpeg -i input_raw.mp4 
  -vf "movie=watermark.png [wm]; [in][wm] overlay=W-w-10:H-h-10 [out]"  # 可见水印 (可选)
  -c:v libx264 -preset fast -crf 23 
  -c:a aac -b:a 128k 
  -movflags +faststart 
  -metadata "c2pa_manifest=$(base64 -w0 manifest.c2pa)"  # 写入 moov atom
  -f mp4 output_meeting_c2pa.mp4

{
  "@context": "https://c2pa.org/manifests/context/v1",
  "claim_generator": "SmartMeeting/2.0",
  "title": "Q3 战略规划跨部门会议",
  "assertions": [
    {
      "label": "c2pa.actions",
      "data": {
        "actions": [
          { "action": "c2pa.created", "when": "2024-10-25T09:00:00Z", "softwareAgent": "MeetingServer/3.1", "instanceId": "xmp:iid:..." },
          { "action": "c2pa.recorded", "when": "2024-10-25T09:00:05Z", "participants": ["did:web:org-a.com:user:alice", "did:web:org-b.com:user:bob"] },
          { "action": "c2pa.watermarked", "when": "2024-10-25T10:30:00Z", "algorithm": "DWT-DCT-SVD", "payload": "did:web:org-a.com:user:alice|20241025T090000Z" }
        ]
      }
    },
    {
      "label": "stds.schema-org.CreativeWork",
      "data": {
        "@type": "Meeting",
        "name": "Q3 战略规划",
        "organizer": { "@type": "Organization", "identifier": "did:web:org-a.com" },
        "attendee": [
          { "@type": "Person", "identifier": "did:web:org-a.com:user:alice", "name": "Alice (隐名)" },
          { "@type": "Person", "identifier": "did:web:org-b.com:user:bob", "name": "Bob (隐名)" }
        ],
        "startTime": "2024-10-25T09:00:00Z",
        "endTime": "2024-10-25T10:30:00Z"
      }
    }
  ],
  "signature": { ... } // 会控系统 DID 签名
}

// services/forensicEvidenceService.ts
export async function submitEvidenceToCourt(evidencePackage: EvidencePackage): Promise<ForensicReceipt> {
  // 1. 打包证据链：Merkle Proof + 原始日志切片 + C2PA 文件 + VC 链
  const packageHash = await buildEvidencePackage(evidencePackage);
  
  // 2. 调用司法存证接口 (示例：杭州互联网法院/北京互联网法院/区块链存证平台 API)
  const response = await httpClient.post('/api/v1/evidence/deposit', {
    evidenceHash: packageHash,
    evidenceType: 'VIDEO_CONFERENCE_RECORD',
    businessId: evidencePackage.meetingId,
    applicantDid: evidencePackage.initiatorDid, // 申请人 DID
    metadata: {
      c2paManifestHash: evidencePackage.c2paManifestHash,
      vcChainRootHash: evidencePackage.vcChainRootHash,
      timestamp: new Date().toISOString()
    }
  }, {
    headers: {
      'Authorization': `Bearer ${await getJudicialApiToken()}`, // 机构级 API Key
      'X-Request-DID': process.env.PLATFORM_DID // 平台 DID 标识
    }
  });

  // 3. 回执落库，关联会议记录
  await prisma.forensicReceipt.create({
    data: {
      meetingId: evidencePackage.meetingId,
      depositId: response.data.depositId,
      txHash: response.data.txHash, // 区块链交易哈希
      timestamp: response.data.timestamp,
      status: 'DEPOSITED'
    }
  });

  return response.data;
}

# features/vc_interoperability.feature
Feature: 跨组织 VC 互操作性验证

  Background:
    Given 组织 A 部署 did:web DID "did:web:org-a.com"
    And 组织 A CA 持有密钥 "did:web:org-a.com#keys-1" (P-256) 和 "did:web:org-a.com#keys-2" (SM2)
    And 组织 B 钱包支持 DIDComm v2 和 OIDC4VP

  @smoke @did-web @p256
  Scenario: 组织 B 验证组织 A 签发的 P-256 签名 EmployeeVC
    Given 组织 A 为用户 "alice" 签发 EmployeeVC (算法: EcdsaSecp256r1Signature2019)
    When 组织 B 会控系统收到包含该 VC 的 VP (协议: DIDComm v2)
    Then VP 签名验证通过
    And VC 吊销状态为 "valid"
    And 提取的 Claim 包含 "employeeId", "department", "role"

  @smoke @did-web @sm2
  Scenario: 组织 B 验证组织 A 签发的 SM2 签名 EmployeeVC (国密合规)
    Given 组织 A 为用户 "bob" 签发 EmployeeVC (算法: Sm2Signature2023)
    When 组织 B 会控系统收到包含该 VC 的 VP (协议: OIDC4VP)
    Then VP 签名验证通过 (调用国密 SDK/硬件加密卡)
    And 验证耗时 < 50ms (P99)

  @regression @selective-disclosure @bbs
  Scenario: 参会者使用 BBS+ 选择性披露仅展示 "department=R&D" 隐藏 "employeeId"
    Given 组织 A 为用户 "charlie" 签发 BBS+ 签名 EmployeeVC
    When 用户生成 VP 仅披露 "department" 属性 (PresentationDefinition 限制)
    Then 会控系统验证 VP 通过
    And 会控系统无法获取 "employeeId" 值
    And 策略引擎基于 "department=R&D" 计算权限通过

  @performance @load
  Scenario Outline: 高并发入会 VP 验证压力测试
    When 并发 <concurrency> 个 VP 请求在 <duration> 秒内发送
    Then 所有请求验证通过率 = 100%
    And P99 验证延迟 < 100ms
    And CPU 使用率 < 70%
    Examples:
      | concurrency | duration |
      | 1000        | 60       |
      | 5000        | 120      |

# HTTP Header 示例
traceparent: 00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01
tracestate: did=web:org-a.com,meeting=meet_20241025_001,vp_flow=didcomm