VCDM 1.1 compatible schema doesn't seem to be compatible

[jchartrand]

I'm trying to set up schema validation for OBv3 credentials in our Verifiable Credentials verifier.

The schema section in the OB spec:

https://www.imsglobal.org/spec/ob/v3p0#json-schema-0

says that this schema:

https://purl.imsglobal.org/spec/ob/v3p0/schema/json/ob_v3p0_anyachievementcredential_schema.json

is compatible with VCDM 1.1

But when I look at that schema, it seems to require stuff that is VCDM 2.0 only, like the context definition for example:

"properties": {
        "@context": {
          "oneOf": [
            {
              "$ref": "#/$defs/Context"
            },
            {
              "type": "array",
              "minItems": 2,
              "items": [
                {
                  "enum": ["https://www.w3.org/ns/credentials/v2"]
                },
                {
                  "type": "string",
                  "pattern": "^https:\\/\\/purl\\.imsglobal\\.org\\/spec\\/ob\\/v3p0\\/context(-3\\.\\d\\.\\d)*\\.json$"
                }
              ],
              "additionalItems": {
                "$ref": "#/$defs/Context"
              }
            }
          ]
        },

and indeed when I try to validate a V1 VC using that schema it returns quite a few errors, including the context error:

{
"instancePath": "/@context/0",
"schemaPath": "#/anyOf/0/properties/%40context/oneOf/1/items/0/enum",
"keyword": "enum",
"params": {
"allowedValues": [
"https://www.w3.org/ns/credentials/v2"
]
},
"message": "must be equal to one of the allowed values"
},

or, as another example, it seems to requite the validFrom property even though that is also a VC2 property:

{
"instancePath": "",
"schemaPath": "#/anyOf/0/required",
"keyword": "required",
"params": {
"missingProperty": "validFrom"
},
"message": "must have required property 'validFrom'"
},

Have I got the wrong schema definition, or am I not properly understanding something about it?

[xaviaracil]

The JSON schema at https://purl.imsglobal.org/spec/ob/v3p0/schema/json/ob_v3p0_anyachievementcredential_schema.json is a oneOf of two subschemes (one for VCDM 2.0 and the other for VCDM 1.1).

VCDM 2.0 except (first lines):

    "type" : "object",
    "properties" : {
      "@context" : {
        "type" : "array",
        "minItems" : 2,
        "items" : [ {
          "enum" : [ "https://www.w3.org/ns/credentials/v2" ]
        }, {
          "type" : "string",
          "pattern" : "^https:\\/\\/purl\\.imsglobal\\.org\\/spec\\/ob\\/v3p0\\/context(-3\\.\\d\\.\\d)*\\.json$"
        } ],
        "additionalItems" : {
          "$ref" : "#/$defs/Context"
        }
      },

VCDM 1.1 except (first lines):

    "type" : "object",
    "properties" : {
      "@context" : {
        "type" : "array",
        "minItems" : 2,
        "items" : [ {
          "enum" : [ "https://www.w3.org/2018/credentials/v1" ]
        }, {
          "type" : "string",
          "pattern" : "^https:\\/\\/purl\\.imsglobal\\.org\\/spec\\/ob\\/v3p0\\/context(-3\\.\\d\\.\\d)*\\.json$"
        } ],
        "additionalItems" : {
          "$ref" : "#/$defs/Context"
        }
      },

When trying to validate a JSON paylod, it tries to check which element of this oneOf applies to, raising weird errors when it couldn't fit in any of the two. Long story short, there should be an error in the payload that prevents the validation to be in any of the two elements inside the root oneOf.

Do you have the complete list of JSON schema validation errors you have?

[jchartrand]

@xaviaracil

Here is a running example that shows the errors (when you run it):

https://onecompiler.com/nodejs/43ztz6dd3

The problem seems to be this line in the issuer section of the sample VC used in that example:

"image": "https://user-images.githubusercontent.com/752326/230469660-8f80d264-eccf-4edd-8e50-ea634d407778.png"

Take that out and it validates fine. Put it back in and it doesn't.

NOTE: the signatures on that VC aren't valid because I've fiddled with the contents of the VC. If you want valid signatures for whatever reason just let me know.

[jchartrand]

And I get that the image should be an object (I think?), but the problem here seems to be that, for whatever reason, that image property seems to cause the OBv3 schema to think we are validating a VCDM version 2 VC, when it is in fact a VCDM version 1. So we get back results from validation that aren't correct.

[xaviaracil]

Yeah, image in Open Badges is an object rather than a string. The schema validator thinks it's a VC DM 2 because it can't match with either of the two options within the oneOf, so it chooses one by default.

[jchartrand]

Thanks @xaviaracil

I'm not sure I understand. Why can it correctly match the VCDM 1 when there is no error? What is it about that image property - even if it is an error - that makes it so it can't properly match?

Isn't an error like that exactly what we want the schema validation to point out? i.e., that the image has to be an object in VCDM1 versions of OBv3? If it can't point out that error as the problem then it kind of isn't doing what it's supposed to do?

[xaviaracil]

Maybe I didn't explain well. The JSON has a schema error regarding the image property because the schema expects an object, but you have a string.

That error prevents the OB 3.0 JSON Schema validator from fitting the JSON payload in any of the two main subschemas - VC DM 1.1 and VC DM 2.0 - that build up the JSON Schema file because the error is in both subschemas (both VC DM 1.1 and VC DM 2.0 require image to be an object). So, it raises additional errors complaining about that. It doesn't mean that the validator only checks for a particular version of VC DM. The root error is included among those errors, but I agree that it is hard to identify with all those additional ones. I'll take it as an action item for me.

If you provide a valid VC DM 1.1 credential, i.e., replacing

"image": "https://user-images.githubusercontent.com/752326/230469660-8f80d264-eccf-4edd-8e50-ea634d407778.png"

with

"image": {
  "type": ["Image"],
  "id": "https://user-images.githubusercontent.com/752326/230469660-8f80d264-eccf-4edd-8e50-ea634d407778.png"
}

The validator will succeed.

[jchartrand]

Yes, I do understand that if the VC is valid (in this case by making the image an object) then the validation will succeed, but the validator is almost more important when validation doesn't succeed, because it then tells us what the problem is, so we can fix it.

And, exactly as you say - it is hard to know which specific error (or errors) are the real problem because there are so many other errors returned. If we show all these errors in our UI, the end user won't be able to easily see what the underlying problem is.

Thank you for all your help with this!