From 359c20ca1d1105d4184df1578f44f9434c0ec5db Mon Sep 17 00:00:00 2001
From: orhoj <jo@concordium.com>
Date: Wed, 30 Aug 2023 13:38:32 +0200
Subject: [PATCH] Verify id statements when checking for valid proofs

---
 packages/browser-wallet/CHANGELOG.md             | 1 +
 packages/browser-wallet/src/background/web3Id.ts | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/packages/browser-wallet/CHANGELOG.md b/packages/browser-wallet/CHANGELOG.md
index b72c5700..48caa062 100644
--- a/packages/browser-wallet/CHANGELOG.md
+++ b/packages/browser-wallet/CHANGELOG.md
@@ -5,6 +5,7 @@
 ### Fixed
 
 -   An issue where changing the credential metadata URL to an invalid URL, or a URL that does not contain a credential metadata file, would result in an empty screen.
+-   Enabled ID statement checks for Web3 ID proof requests containing account credential statements.
 
 ## 1.1.3
 
diff --git a/packages/browser-wallet/src/background/web3Id.ts b/packages/browser-wallet/src/background/web3Id.ts
index a3dcbd3a..2713743b 100644
--- a/packages/browser-wallet/src/background/web3Id.ts
+++ b/packages/browser-wallet/src/background/web3Id.ts
@@ -8,6 +8,8 @@ import {
     verifyAtomicStatements,
     isAccountCredentialStatement,
     IDENTITY_SUBJECT_SCHEMA,
+    verifyIdstatement,
+    IdStatement,
 } from '@concordium/web-sdk';
 import {
     sessionVerifiableCredentials,
@@ -178,7 +180,8 @@ export const runIfValidWeb3IdProof: RunCondition<MessageStatusWrapper<undefined>
         // If a statement does not verify, an error is thrown.
         statements.every((credStatement) =>
             isAccountCredentialStatement(credStatement)
-                ? verifyAtomicStatements(credStatement.statement, IDENTITY_SUBJECT_SCHEMA)
+                ? verifyAtomicStatements(credStatement.statement, IDENTITY_SUBJECT_SCHEMA) &&
+                  verifyIdstatement(credStatement.statement as IdStatement)
                 : verifyAtomicStatements(credStatement.statement)
         );