VC issuing fails if credentialSubject is the same as the issuer

[srosset81]

Now that we have one named graph per resource, the credentialSubject property of VCs can be stored without needing to use special properties.

However if the credentialSubject ID is the same as the issuer, like on the "Non-linked chain is invalid" test (verifiable-credentials.test.ts) then we have a problem.

This is what we want to create in this test:

{
      '@context': [
        'https://www.w3.org/ns/credentials/v2',
        {
          as: 'https://www.w3.org/ns/activitystreams#',
          apods: 'http://activitypods.org/ns/core#',
          acl: 'http://www.w3.org/ns/auth/acl#',
          dc: 'http://purl.org/dc/terms/',
          sec: 'https://w3id.org/security#'
        }
      ],
      type: [ 'VerifiableCredential' ],
      issuer: 'http://localhost:3000/craig/webid',
      name: 'Second capability',
      credentialSubject: {
        id: 'http://localhost:3000/craig/webid',
        name: 'This is an additional field',
        description: 'A transferable capability.'
      }
    }

This is stored like this on Fuseki, in the http://localhost:3000/craig/7221ae4a-1ac8-4019-a31f-d7323824a47a named graph:

<http://localhost:3000/craig/7221ae4a-1ac8-4019-a31f-d7323824a47a>
        a                          <https://www.w3.org/2018/credentials#VerifiableCredential>;
        <http://purl.org/dc/terms/created>
                "2025-11-12T08:35:58.418Z"^^<http://www.w3.org/2001/XMLSchema#dateTime>;
        <http://purl.org/dc/terms/creator>
                <http://localhost:3000/craig/webid>;
        <http://purl.org/dc/terms/modified>
                "2025-11-12T08:35:58.418Z"^^<http://www.w3.org/2001/XMLSchema#dateTime>;
        <https://schema.org/name>  "Second capability";
        <https://www.w3.org/2018/credentials#credentialSubject>
                <http://localhost:3000/craig/webid>;
        <https://www.w3.org/2018/credentials#issuer>
                <http://localhost:3000/craig/webid> .

<http://localhost:3000/craig/webid>
        <https://schema.org/description>
                "A transferable capability.";
        <https://schema.org/name>  "This is an additional field" .

When we retrieve the VC, it looks like this:

{
      '@context': [
        'https://www.w3.org/ns/credentials/v2',
        {
          as: 'https://www.w3.org/ns/activitystreams#',
          apods: 'http://activitypods.org/ns/core#',
          acl: 'http://www.w3.org/ns/auth/acl#',
          dc: 'http://purl.org/dc/terms/',
          sec: 'https://w3id.org/security#'
        }
      ],
      id: 'http://localhost:3000/craig/7221ae4a-1ac8-4019-a31f-d7323824a47a',
      type: 'VerifiableCredential',
      'dc:created': {
        type: 'http://www.w3.org/2001/XMLSchema#dateTime',
        '@value': '2025-11-12T08:35:58.418Z'
      },
      'dc:creator': {
        id: 'http://localhost:3000/craig/webid',
        description: 'A transferable capability.',
        name: 'This is an additional field'
      },
      'dc:modified': {
        type: 'http://www.w3.org/2001/XMLSchema#dateTime',
        '@value': '2025-11-12T08:35:58.418Z'
      },
      name: 'Second capability',
      credentialSubject: 'http://localhost:3000/craig/webid',
      issuer: 'http://localhost:3000/craig/webid'
    }

The credentialSubject is not embedded because we decided not to do embedding when there are more than one corresponding property. If we did embedding above, the issuer would also include the name and description properties, which would be wrong.

Note: The embedding works fine if the issuer is not the same as the credentialSubject.

Any idea @Laurin-W ? I'm going to leave it like this on my branch uuids-for-containers-and-collections even if tests fails.

[srosset81]

This is the failing test:

semapps/src/middleware/tests/crypto/verifiable-credentials.test.ts

Line 456 in c66412f

expect(secondCapability).not.toMatchObject({ name: 'Error' });