humanseal-verify

Check a Human Seal approval without calling anyone. One file, humanseal_verify.py. It needs Python 3.10 or newer and the cryptography package. It shares no code with FLOCORE.

What you give it:
  1. the credential (a long string, SD-JWT VC or the VC 2.0 JWS form)
  2. the issuer's published public key (a JWK, a JWKS, a DID document, or the raw key)
  3. optionally the original action, to prove this is the action that was approved

Command line:
  python humanseal_verify.py credential.txt --key jwks.json --action action.json
  Exit code 0 means valid, 1 means refused. The reason is printed.

From Python:
  from humanseal_verify import verify
  result = verify(token, jwks, action=action, issuer="did:web:your-company")
  result["valid"], result["reason"], result["content_bound"]

If you leave out the action, the result says content_bound is false: the signature is good but nobody checked which action it covers.

It refuses: a bad signature, any algorithm but EdDSA (including none), a wrong credential type, an expired or not-yet-valid credential, a disclosure the issuer did not sign, a swapped action, and any token carrying a key binding signature.

What it does not do:
  it does not fetch the key for you (the issuer publishes it, for FLOCORE at https://fo.flocore.tech/.well-known/jwks.json)
  it does not check the revocation list (for FLOCORE: https://fo.flocore.tech/agent/human-seal/revocations)
  it does not implement key binding, so a credential is a bearer token: whoever holds it can show it
  the SD-JWT VC format is an IETF draft (draft 19 here), not a final standard, so it may change

Your own company can issue credentials in this format under its own key. A worked example, with a VAT return, is in examples/invoice-vat-approval/example.py.

The tests are apps/api/tests/test_humanseal_verify_standalone.py. They check this file gives the same verdict as FLOCORE's own verifier on good and tampered tokens.