fix(mercury,castor): replace unsafe JWK as any casts with runtime type validation

packages/lib/sdk/src/castor/methods/prism/index.ts

@@ -305,12 +305,15 @@
   }
 
 
   private getPrismDIDKeyFromVerificationMethod(verificationMethod: DIDDocument.VerificationMethod) {
     const { usage, index } = this.getUsageFromId(verificationMethod.id);
 
     if (verificationMethod.publicKeyJwk) {
-      // TODO need to properly parse JWK into key / raw
-      const raw = base64.base64url.baseDecode(verificationMethod.publicKeyJwk.x as any);
+      const xValue = verificationMethod.publicKeyJwk.x;
+      if (typeof xValue !== 'string') {
+        throw new Domain.CastorError.InvalidKeyError('Invalid JWK: x coordinate is missing or not a string');
+      }
+      const raw = base64.base64url.baseDecode(xValue);
 
       if (verificationMethod.publicKeyJwk.crv === Domain.Curve.SECP256K1) {
         return this.createProtos(new Secp256k1PublicKey(raw), usage, index);

packages/lib/sdk/src/mercury/DIDCommDIDResolver.ts

@@ -41,8 +41,8 @@ export class DIDCommDIDResolver implements DIDComm.DIDResolver {
               keyAgreements.push(method.id);
               break;
           }
-          const publicKeyBase64 = method.publicKeyJwk?.x as any;
-          const publicKeyKid = (method.publicKeyJwk as any).kid;
+          const publicKeyBase64 = expect(method.publicKeyJwk?.x, CastorError.InvalidKeyError);
+          const publicKeyKid = method.publicKeyJwk?.kid;
           const kty = (curve === Curve.ED25519 || curve === Curve.X25519) ? "OKP" : "EC";
           verificationMethods.push({
             controller: method.controller,

packages/lib/sdk/tests/mercury/didcomm/DIDResolver.test.ts

@@ -97,4 +97,28 @@ describe("Mercury DIDComm DIDResolver", () => {
       });
     });
   });
+
+  describe("JWK validation", () => {
+    it("should throw InvalidKeyError when JWK x coordinate is missing", async () => {
+      const idDid = Domain.DID.fromString("did:test:id");
+      const vm = new Domain.DIDDocument.VerificationMethod(
+        "vm-ED25519",
+        "1",
+        "Ed25519VerificationKey2018",
+        { crv: Domain.Curve.ED25519, kid: "kid" } as any
+      );
+
+      const castor: Pick<Castor, "resolveDID"> = {
+        resolveDID: async (): Promise<Domain.DIDDocument> =>
+          new Domain.DIDDocument(idDid, [
+            new Domain.DIDDocument.Authentication([], [vm]),
+          ]),
+      };
+
+      const sut = new DIDCommDIDResolver(castor as any);
+      await expect(sut.resolve(idDid.toString())).rejects.toThrow(
+        Domain.CastorError.InvalidKeyError
+      );
+    });
+  });
 });