Merge pull request #1538 from ianco/issue/1536

Fix validation for range checks
openwallet-foundation · Dec 10, 2021 · 7422b3c · 7422b3c
2 parents e59b377 + 4046e68
commit 7422b3c
Show file tree

Hide file tree

Showing 2 changed files with 78 additions and 6 deletions.
diff --git a/aries_cloudagent/indy/tests/test_verifier.py b/aries_cloudagent/indy/tests/test_verifier.py
@@ -824,3 +824,71 @@ async def test_pre_verify(self):
                 ],
             },
         )
+        await self.verifier.pre_verify(
+            {
+                "nonce": "15606741555044336341559",
+                "name": "proof_req",
+                "version": "0.0",
+                "requested_attributes": {},
+                "requested_predicates": {
+                    "18_id_GE_uuid": {
+                        "name": "id",
+                        "p_type": ">=",
+                        "p_value": 4,
+                        "restrictions": [
+                            {"cred_def_id": "LjgpST2rjsoxYegQDRm7EL:3:CL:19:tag"}
+                        ],
+                    },
+                    "18_id_LE_uuid": {
+                        "name": "id",
+                        "p_type": "<=",
+                        "p_value": 11198760,
+                        "restrictions": [
+                            {"cred_def_id": "LjgpST2rjsoxYegQDRm7EL:3:CL:19:tag"}
+                        ],
+                    },
+                },
+            },
+            {
+                "proof": {
+                    "proofs": [
+                        {
+                            "primary_proof": {
+                                "eq_proof": {},
+                                "ge_proofs": [
+                                    {
+                                        "predicate": {
+                                            "attr_name": "id",
+                                            "value": 11198760,
+                                        }
+                                    },
+                                    {
+                                        "predicate": {
+                                            "attr_name": "id",
+                                            "value": 4,
+                                        }
+                                    },
+                                ],
+                            }
+                        }
+                    ],
+                },
+                "requested_proof": {
+                    "revealed_attrs": {},
+                    "self_attested_attrs": {},
+                    "unrevealed_attrs": {},
+                    "predicates": {
+                        "18_id_LE_uuid": {"sub_proof_index": 0},
+                        "18_id_GE_uuid": {"sub_proof_index": 0},
+                    },
+                },
+                "identifiers": [
+                    {
+                        "schema_id": "LjgpST2rjsoxYegQDRm7EL:2:non-revo:1579888926.0",
+                        "cred_def_id": "LjgpST2rjsoxYegQDRm7EL:3:CL:19:tag",
+                        "rev_reg_id": "LjgpST2rjsoxYegQDRm7EL:4:LjgpST2rjsoxYegQDRm7EL:3:CL:18:tag:CL_ACCUM:0",
+                        "timestamp": 1579892963,
+                    }
+                ],
+            },
+        )
diff --git a/aries_cloudagent/indy/verifier.py b/aries_cloudagent/indy/verifier.py
@@ -255,17 +255,21 @@ async def pre_verify(self, pres_req: dict, pres: dict):
         for (uuid, req_pred) in pres_req["requested_predicates"].items():
             try:
                 canon_attr = canon(req_pred["name"])
+                matched = False
+                found = False
                 for ge_proof in pres["proof"]["proofs"][
                     pres["requested_proof"]["predicates"][uuid]["sub_proof_index"]
                 ]["primary_proof"]["ge_proofs"]:
                     pred = ge_proof["predicate"]
                     if pred["attr_name"] == canon_attr:
-                        if pred["value"] != req_pred["p_value"]:
-                            raise ValueError(
-                                f"Predicate value != p_value: {pred['attr_name']}"
-                            )
-                        break
-                else:
+                        found = True
+                        if pred["value"] == req_pred["p_value"]:
+                            matched = True
+                            break
+                if not matched:
+                    raise ValueError(f"Predicate value != p_value: {pred['attr_name']}")
+                    break
+                elif not found:
                     raise ValueError(f"Missing requested predicate '{uuid}'")
             except (KeyError, TypeError):
                 raise ValueError(f"Missing requested predicate '{uuid}'")