openid4vp 0.1.0

data/lib/openid4vp/request_object.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require_relative "jose/jws"
+require_relative "authorization_request"
+require_relative "x509"
+require_relative "errors"
+
+module OpenID4VP
+  # OpenID4VP §5 / RFC 9101 (JAR): the signed JWT form of an
+  # AuthorizationRequest, sent by value (`request=`) or by reference
+  # (`request_uri`). Wraps `OpenID4VP::JOSE::JWS` with the `typ` enforcement,
+  # payload shaping and Appendix A.3.2.2 JSON-serialization header-merging
+  # rules specific to Request Objects.
+  module RequestObject
+    TYP = "oauth-authz-req+jwt"
+    DEFAULT_AUD = "https://self-issued.me/v2"
+
+    # Header-only parameters that, in JWS JSON Serialization, MUST live in
+    # each signature's protected header rather than the shared payload
+    # (Appendix A.3.2.2).
+    HEADER_ONLY_PARAMS = %w[client_id verifier_info trust_chain].freeze
+
+    # A parsed (not necessarily verified) Request Object: either from compact
+    # serialization (`compact` set, `json`/`signature_index` nil) or from one
+    # signature of a JSON-serialized object (`json`/`signature_index` set,
+    # `compact` nil).
+    # rubocop:disable-next Lint/StructNewOverride -- :compact is the interface name, not Array's method.
+    Parsed = Struct.new(:header, :payload, :compact, :request, :json, :signature_index, keyword_init: true) do
+      def x5c_certs
+        x5c = header["x5c"]
+        x5c ? OpenID4VP::X509.certs_from_x5c(x5c) : []
+      end
+
+      def attestation_jwt
+        header["jwt"]
+      end
+
+      def kid
+        header["kid"]
+      end
+
+      def alg
+        header["alg"]
+      end
+
+      def wallet_nonce
+        payload["wallet_nonce"]
+      end
+
+      def aud
+        payload["aud"]
+      end
+    end
+
+    module_function
+
+    # Signs `request` (an AuthorizationRequest) as a Request Object,
+    # returning the JWS compact serialization.
+    def sign(request, key:, alg: nil, x5c: nil, kid: nil, attestation_jwt: nil, wallet_nonce: nil,
+             aud: DEFAULT_AUD, extra_header: {})
+      payload = request.to_h.merge("aud" => aud)
+      payload["wallet_nonce"] = wallet_nonce if wallet_nonce
+      header = build_header(x5c: x5c, kid: kid, attestation_jwt: attestation_jwt, extra_header: extra_header)
+      OpenID4VP::JOSE::JWS.sign(payload, key: key, alg: alg, header: header)
+    end
+
+    # Parses `compact` into header/payload WITHOUT verifying the signature.
+    # Raises InvalidRequest unless the `typ` header is exactly TYP, or the
+    # payload is not a JSON object. `iss`, if present, is left in the payload
+    # but MUST be ignored by callers (OpenID4VP §5).
+    def parse(compact)
+      verified = OpenID4VP::JOSE::JWS.peek(compact)
+      check_typ!(verified.header)
+      payload = check_payload!(verified.payload)
+      Parsed.new(header: verified.header, payload: payload, compact: compact,
+                 request: OpenID4VP::AuthorizationRequest.new(payload))
+    end
+
+    # Verifies `parsed` (from #parse) against `key`, returning it unchanged.
+    # Raises VerificationError on signature failure.
+    def verify(parsed, key:, algorithms: OpenID4VP::JOSE::Algorithms::SIGNING)
+      OpenID4VP::JOSE::JWS.verify(parsed.compact, key: key, algorithms: algorithms)
+      parsed
+    end
+
+    # Parses a JWS in JSON Serialization (a Hash or JSON String) into one
+    # `Parsed` per signature, per Appendix A.3.2.2: the header-only params
+    # (client_id, verifier_info, trust_chain) of each signature's protected
+    # header are merged into that signature's request params.
+    def parse_json(hash_or_string)
+      json = OpenID4VP::JOSE::JWS.parse_json(hash_or_string)
+      payload = check_payload!(json.payload)
+      json.signatures.each_with_index.map { |entry, index| parsed_from_json_entry(json, payload, entry, index) }
+    end
+
+    # Verifies the signature of `parsed` (from #parse_json) against `key`,
+    # returning it unchanged. Raises VerificationError on signature failure.
+    def verify_json(parsed, key:, algorithms: OpenID4VP::JOSE::Algorithms::SIGNING)
+      OpenID4VP::JOSE::JWS.verify_json_signature(parsed.json, parsed.signature_index, key: key, algorithms: algorithms)
+      parsed
+    end
+
+    def build_header(x5c:, kid:, attestation_jwt:, extra_header:)
+      header = { "typ" => TYP }
+      header["x5c"] = normalize_x5c(x5c) if x5c
+      header["kid"] = kid if kid
+      header["jwt"] = attestation_jwt if attestation_jwt
+      header.merge(extra_header)
+    end
+    private_class_method :build_header
+
+    # Accepts an Array of OpenSSL::X509::Certificate, DER strings, PEM
+    # strings, or already-encoded standard-base64 x5c entries. Certificate
+    # objects and DER/PEM strings are normalized via X509.x5c_from; a String
+    # that does not parse as a certificate is assumed to already be a
+    # standard-base64 x5c entry and is passed through unchanged.
+    def normalize_x5c(x5c)
+      x5c.map { |entry| entry.is_a?(::String) ? normalize_x5c_string(entry) : OpenID4VP::X509.x5c_from([entry]).first }
+    end
+    private_class_method :normalize_x5c
+
+    def normalize_x5c_string(str)
+      OpenID4VP::X509.x5c_from([str]).first
+    rescue OpenID4VP::InvalidRequest
+      str
+    end
+    private_class_method :normalize_x5c_string
+
+    def check_typ!(header)
+      return if header["typ"] == TYP
+
+      raise OpenID4VP::InvalidRequest, "Request Object typ must be #{TYP}"
+    end
+    private_class_method :check_typ!
+
+    def check_payload!(payload)
+      raise OpenID4VP::InvalidRequest, "Request Object payload must be an object" unless payload.is_a?(::Hash)
+
+      payload
+    end
+    private_class_method :check_payload!
+
+    def parsed_from_json_entry(json, payload, entry, index)
+      check_typ!(entry.protected_header)
+      header_only = entry.protected_header.slice(*HEADER_ONLY_PARAMS)
+      request_params = payload.merge(header_only)
+      Parsed.new(header: entry.protected_header, payload: payload, compact: nil,
+                 request: OpenID4VP::AuthorizationRequest.new(request_params), json: json, signature_index: index)
+    end
+    private_class_method :parsed_from_json_entry
+  end
+end

data/lib/openid4vp/request_verification/base.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require_relative "../request_object"
+
+module OpenID4VP
+  module RequestVerification
+    # Base class for per-Client-Identifier-Prefix wallet-side verification
+    # strategies (OpenID4VP §5.9.3). Subclasses implement
+    # `#verify!(client_id, request, parsed, dc_api:)`, returning a
+    # `VerifiedRequest`.
+    class Base
+      attr_reader :config
+
+      def initialize(config)
+        @config = config
+      end
+
+      # client_id: OpenID4VP::ClientId. request: the effective
+      # OpenID4VP::AuthorizationRequest (parsed.request when signed).
+      # parsed: OpenID4VP::RequestObject::Parsed, or nil when unsigned.
+      def verify!(client_id, request, parsed, dc_api: false)
+        raise NotImplementedError, "#{self.class} must implement #verify!"
+      end
+
+      private
+
+      # Verifies the Request Object's signature against `key`, handling both
+      # compact (single-signature) and JSON-serialized (multisigned)
+      # serializations.
+      def verify_signature!(parsed, key)
+        if parsed.compact
+          OpenID4VP::RequestObject.verify(parsed, key: key, algorithms: config.request_object_signing_algs)
+        else
+          OpenID4VP::RequestObject.verify_json(parsed, key: key, algorithms: config.request_object_signing_algs)
+        end
+      end
+
+      # `keys` ordered so any key whose `kid` matches `kid` is tried first
+      # (when both are present); the rest follow, so a kid mismatch still
+      # falls back to trying every candidate key.
+      def order_by_kid(keys, kid)
+        return keys if kid.nil?
+
+        matching, rest = keys.partition { |k| k.kid == kid }
+        matching + rest
+      end
+
+      # Verifies `parsed`'s signature, trying each of `keys` in turn (see
+      # #order_by_kid) until one succeeds. Returns the key that verified the
+      # signature. Raises the last VerificationError when none match.
+      def verify_with_keys!(parsed, keys)
+        last_error = nil
+        keys.each do |key|
+          verify_signature!(parsed, key)
+          return key
+        rescue OpenID4VP::VerificationError => e
+          last_error = e
+        end
+        raise last_error || OpenID4VP::VerificationError, "no matching signing key"
+      end
+    end
+  end
+end

data/lib/openid4vp/request_verification/config.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module OpenID4VP
+  module RequestVerification
+    # Wallet-side configuration for `OpenID4VP::RequestVerification::Resolver`.
+    # Immutable; keyword-initialized. `pre_registered_clients` entries are
+    # normalized on construction to Hashes with Symbol keys
+    # `{ metadata:, jwks:, redirect_uris: }`.
+    class Config
+      DEFAULT_REQUEST_OBJECT_SIGNING_ALGS = %w[ES256 ES384 ES512 RS256 PS256 EdDSA].freeze
+      DEFAULT_LEEWAY = 60
+
+      attr_reader :x509_trust_anchors, :trusted_client_ids, :attestation_issuers, :did_resolver,
+                  :federation_resolver, :pre_registered_clients, :request_object_signing_algs,
+                  :allow_unknown_prefix_as_pre_registered, :now, :leeway
+
+      def initialize(x509_trust_anchors: [], trusted_client_ids: [], attestation_issuers: {},
+                     did_resolver: nil, federation_resolver: nil, pre_registered_clients: {},
+                     request_object_signing_algs: DEFAULT_REQUEST_OBJECT_SIGNING_ALGS,
+                     allow_unknown_prefix_as_pre_registered: false, now: -> { ::Time.now }, leeway: DEFAULT_LEEWAY)
+        @x509_trust_anchors = x509_trust_anchors.dup.freeze
+        @trusted_client_ids = trusted_client_ids.map(&:to_s).freeze
+        @attestation_issuers = attestation_issuers
+        @did_resolver = did_resolver
+        @federation_resolver = federation_resolver
+        @pre_registered_clients = normalize_pre_registered_clients(pre_registered_clients)
+        @request_object_signing_algs = request_object_signing_algs.dup.freeze
+        @allow_unknown_prefix_as_pre_registered = allow_unknown_prefix_as_pre_registered
+        @now = now
+        @leeway = leeway
+        freeze
+      end
+
+      def current_time
+        @now.call
+      end
+
+      private
+
+      def normalize_pre_registered_clients(clients)
+        clients.to_h { |client_id, entry| [client_id.to_s, normalize_client_entry(entry)] }.freeze
+      end
+
+      def normalize_client_entry(entry)
+        {
+          metadata: normalize_metadata(entry[:metadata]),
+          jwks: normalize_jwks(entry[:jwks]),
+          redirect_uris: entry[:redirect_uris]&.dup&.freeze
+        }.freeze
+      end
+
+      def normalize_metadata(metadata)
+        return nil if metadata.nil?
+
+        metadata.is_a?(::Hash) ? OpenID4VP::Metadata::VerifierMetadata.new(metadata) : metadata
+      end
+
+      def normalize_jwks(jwks)
+        return nil if jwks.nil?
+
+        jwks.is_a?(::Hash) ? OpenID4VP::JOSE::JWKSet.from_h(jwks) : jwks
+      end
+    end
+  end
+end

data/lib/openid4vp/request_verification/decentralized_identifier.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "verified_request"
+require_relative "../errors"
+require_relative "../jose/jwk"
+
+module OpenID4VP
+  module RequestVerification
+    # `decentralized_identifier` Client Identifier Prefix (OpenID4VP
+    # §5.9.3): the original Client Identifier is a DID. The request MUST be
+    # signed with a key from the DID Document's `verificationMethod`,
+    # identified by the JOSE `kid` header (`<did>#<fragment>`).
+    class DecentralizedIdentifier < Base
+      def verify!(client_id, request, parsed, dc_api: false) # rubocop:disable Lint/UnusedMethodArgument
+        raise OpenID4VP::InvalidRequest, "signed request required" if parsed.nil?
+
+        did = client_id.original
+        kid = parsed.kid
+        unless kid.is_a?(::String) && kid.start_with?("#{did}#")
+          raise OpenID4VP::InvalidRequest, "kid must be #{did}#<fragment>"
+        end
+
+        resolver = config.did_resolver
+        raise OpenID4VP::InvalidRequest, "DID resolution unavailable" if resolver.nil?
+
+        doc = resolver.call(did)
+        signing_key = OpenID4VP::JOSE::JWK.new(public_key_jwk!(find_verification_method(doc, kid)))
+        verify_signature!(parsed, signing_key)
+
+        VerifiedRequest.new(
+          request: request, client_id: client_id, verifier_metadata: request.client_metadata,
+          signed: true, signing_key: signing_key, parsed: parsed, attestation: nil
+        )
+      end
+
+      private
+
+      def find_verification_method(doc, kid)
+        fragment = kid.split("#", 2).last
+        methods = doc.is_a?(::Hash) ? doc["verificationMethod"] : nil
+        vm = methods.is_a?(::Array) ? methods.find { |m| [kid, "##{fragment}"].include?(m["id"]) } : nil
+        raise OpenID4VP::VerificationError, "verification method not found" if vm.nil?
+
+        vm
+      end
+
+      def public_key_jwk!(verification_method)
+        jwk = verification_method["publicKeyJwk"]
+        raise OpenID4VP::VerificationError, "verification method has no publicKeyJwk" unless jwk.is_a?(::Hash)
+
+        jwk
+      end
+    end
+  end
+end

data/lib/openid4vp/request_verification/openid_federation.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "verified_request"
+require_relative "../errors"
+require_relative "../jose/jwk_set"
+require_relative "../metadata/verifier_metadata"
+
+module OpenID4VP
+  module RequestVerification
+    # `openid_federation` Client Identifier Prefix (OpenID4VP §5.9.3): the
+    # original Client Identifier is an OpenID Federation Entity Identifier.
+    # Verifier metadata comes exclusively from the resolved Trust Chain; a
+    # `client_metadata` request parameter, if present, is ignored.
+    class OpenidFederation < Base
+      def verify!(client_id, request, parsed, dc_api: false) # rubocop:disable Lint/UnusedMethodArgument
+        raise OpenID4VP::InvalidRequest, "signed request required" if parsed.nil?
+
+        resolver = config.federation_resolver
+        raise OpenID4VP::InvalidRequest, "federation resolution unavailable" if resolver.nil?
+
+        res = resolver.call(client_id.original, request.trust_chain)
+        raise OpenID4VP::VerificationError, "federation entity not resolvable" unless res.is_a?(::Hash)
+
+        signing_key = verify_with_keys!(parsed, order_by_kid(jwks_from(res).keys, parsed.kid))
+
+        VerifiedRequest.new(
+          request: request, client_id: client_id, verifier_metadata: metadata_from(res),
+          signed: true, signing_key: signing_key, parsed: parsed, attestation: nil
+        )
+      end
+
+      private
+
+      def fetch(res, key)
+        res[key] || res[key.to_s]
+      end
+
+      def jwks_from(res)
+        raw = fetch(res, :jwks)
+        raise OpenID4VP::InvalidRequest, "no signing keys in federation metadata" if raw.nil?
+
+        raw.is_a?(::Hash) ? OpenID4VP::JOSE::JWKSet.from_h(raw) : raw
+      end
+
+      def metadata_from(res)
+        raw = fetch(res, :metadata) || {}
+        raw.is_a?(::Hash) ? OpenID4VP::Metadata::VerifierMetadata.new(raw) : raw
+      end
+    end
+  end
+end

data/lib/openid4vp/request_verification/pre_registered.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "verified_request"
+require_relative "../errors"
+
+module OpenID4VP
+  module RequestVerification
+    # Pre-registered Client Identifier fallback (OpenID4VP §5.9.2): the
+    # Client Identifier is looked up in `config.pre_registered_clients`
+    # (registered out-of-band, e.g. via RFC 7591 dynamic registration).
+    class PreRegistered < Base
+      def verify!(client_id, request, parsed, dc_api: false)
+        entry = config.pre_registered_clients[client_id.to_s]
+        raise OpenID4VP::InvalidRequest, "unknown client" if entry.nil?
+
+        if request.client_metadata
+          raise OpenID4VP::InvalidClient, "client_metadata parameter must not be used with a pre-registered client_id"
+        end
+
+        signing_key = verify_registered_signature!(parsed, entry)
+        check_redirect_uri!(request, entry, dc_api)
+
+        VerifiedRequest.new(
+          request: request, client_id: client_id, verifier_metadata: entry[:metadata],
+          signed: !parsed.nil?, signing_key: signing_key, parsed: parsed, attestation: nil
+        )
+      end
+
+      private
+
+      def verify_registered_signature!(parsed, entry)
+        return nil if parsed.nil?
+
+        jwks = entry[:jwks]
+        raise OpenID4VP::InvalidRequest, "no registered signing keys" if jwks.nil? || jwks.keys.empty?
+
+        verify_with_keys!(parsed, order_by_kid(jwks.keys, parsed.kid))
+      end
+
+      def check_redirect_uri!(request, entry, dc_api)
+        redirect_uris = entry[:redirect_uris]
+        return if redirect_uris.nil? || redirect_uris.empty? || dc_api
+
+        return_uri = request.return_uri
+        return if return_uri.nil?
+
+        return if redirect_uris.include?(return_uri)
+
+        raise OpenID4VP::VerificationError, "return URI is not registered for this client"
+      end
+    end
+  end
+end

data/lib/openid4vp/request_verification/redirect_uri.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "verified_request"
+require_relative "../errors"
+
+module OpenID4VP
+  module RequestVerification
+    # `redirect_uri` Client Identifier Prefix (OpenID4VP §5.9.3): the
+    # original Client Identifier is the Verifier's redirect/response URI.
+    # Requests using this prefix MUST NOT be signed; all Verifier metadata
+    # comes from the `client_metadata` request parameter.
+    class RedirectUri < Base
+      def verify!(client_id, request, parsed, dc_api: false) # rubocop:disable Lint/UnusedMethodArgument
+        raise OpenID4VP::InvalidRequest, "redirect_uri prefix requests must not be signed" if parsed
+
+        return_uri = request.return_uri
+        if return_uri && return_uri != client_id.original
+          raise OpenID4VP::InvalidRequest, "redirect_uri client_id must match the return URI"
+        end
+
+        VerifiedRequest.new(
+          request: request, client_id: client_id, verifier_metadata: request.client_metadata,
+          signed: false, signing_key: nil, parsed: nil, attestation: nil
+        )
+      end
+    end
+  end
+end

data/lib/openid4vp/request_verification/resolver.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require_relative "config"
+require_relative "verified_request"
+require_relative "redirect_uri"
+require_relative "pre_registered"
+require_relative "x509_san_dns"
+require_relative "x509_hash"
+require_relative "verifier_attestation"
+require_relative "decentralized_identifier"
+require_relative "openid_federation"
+require_relative "../errors"
+
+module OpenID4VP
+  module RequestVerification
+    # Dispatches wallet-side request verification (OpenID4VP §5.9) to the
+    # strategy matching `client_id`'s Client Identifier Prefix, after the
+    # checks common to every signed Request Object (§5.10.1): alg allow-list,
+    # client_id agreement between the Authorization Request and the Request
+    # Object, and wallet_nonce echo.
+    class Resolver
+      STRATEGIES = {
+        "openid_federation" => OpenidFederation,
+        "decentralized_identifier" => DecentralizedIdentifier,
+        "verifier_attestation" => OpenID4VP::RequestVerification::VerifierAttestation,
+        "x509_san_dns" => X509SanDns,
+        "x509_hash" => X509Hash
+      }.freeze
+
+      def initialize(config)
+        @config = config
+      end
+
+      # client_id: OpenID4VP::ClientId. request: the AuthorizationRequest
+      # built from query/form parameters (used only when `parsed` is nil).
+      # parsed: OpenID4VP::RequestObject::Parsed, or nil for an unsigned
+      # request.
+      def verify(client_id:, request:, parsed: nil, dc_api: false, wallet_nonce: nil)
+        effective_request = parsed ? check_parsed!(client_id, parsed, wallet_nonce) : request
+        strategy_for(client_id).verify!(client_id, effective_request, parsed, dc_api: dc_api)
+      end
+
+      private
+
+      attr_reader :config
+
+      def check_parsed!(client_id, parsed, wallet_nonce)
+        unless config.request_object_signing_algs.include?(parsed.alg)
+          raise OpenID4VP::InvalidRequest, "unsupported request object alg"
+        end
+
+        raise OpenID4VP::InvalidRequest, "client_id mismatch" if parsed.request.client_id&.to_s != client_id.to_s
+        raise OpenID4VP::InvalidRequest, "wallet_nonce mismatch" if wallet_nonce && parsed.wallet_nonce != wallet_nonce
+
+        parsed.request
+      end
+
+      def strategy_for(client_id)
+        prefix = client_id.prefix
+        raise OpenID4VP::InvalidRequest, "origin prefix not allowed in requests" if prefix == "origin"
+        return RedirectUri.new(config) if prefix == "redirect_uri"
+        return PreRegistered.new(config) if pre_registered_strategy?(client_id)
+
+        strategy_class = STRATEGIES.fetch(prefix) { raise OpenID4VP::InvalidRequest, "unsupported client_id prefix" }
+        strategy_class.new(config)
+      end
+
+      def pre_registered_strategy?(client_id)
+        return false unless client_id.pre_registered?
+        return true unless client_id.unknown_prefix?
+
+        config.allow_unknown_prefix_as_pre_registered
+      end
+    end
+  end
+end

data/lib/openid4vp/request_verification/verified_request.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module OpenID4VP
+  module RequestVerification
+    # The result of `OpenID4VP::RequestVerification::Resolver#verify`: the
+    # effective AuthorizationRequest together with the Client Identifier
+    # Prefix verification outcome (OpenID4VP §5.9).
+    VerifiedRequest = Struct.new(
+      :request, :client_id, :verifier_metadata, :signed, :signing_key, :parsed, :attestation, keyword_init: true
+    )
+  end
+end

data/lib/openid4vp/request_verification/verifier_attestation.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "verified_request"
+require_relative "../errors"
+require_relative "../verifier_attestation"
+
+module OpenID4VP
+  module RequestVerification
+    # `verifier_attestation` Client Identifier Prefix (OpenID4VP §5.9.3/§12):
+    # the Verifier authenticates with a Verifier Attestation JWT (carried in
+    # the `jwt` JOSE header) binding its `sub` claim to the Client Identifier
+    # and a confirmation key the request MUST be signed with.
+    #
+    # NOTE: this class name intentionally shadows the top-level
+    # `OpenID4VP::VerifierAttestation` module; always reference the module
+    # fully qualified (`OpenID4VP::VerifierAttestation`) from inside it.
+    class VerifierAttestation < Base
+      def verify!(client_id, request, parsed, dc_api: false)
+        raise OpenID4VP::InvalidRequest, "signed request required" if parsed.nil?
+
+        jwt = parsed.attestation_jwt
+        raise OpenID4VP::InvalidRequest, "verifier attestation required" if jwt.nil?
+
+        attestation = OpenID4VP::VerifierAttestation.verify(
+          jwt, trusted_issuers: config.attestation_issuers, now: config.current_time, leeway: config.leeway
+        )
+
+        if attestation.sub != client_id.original
+          raise OpenID4VP::VerificationError, "verifier attestation sub does not match client_id"
+        end
+
+        verify_signature!(parsed, attestation.cnf_jwk)
+        check_redirect_uris!(request, attestation, dc_api)
+
+        VerifiedRequest.new(
+          request: request, client_id: client_id, verifier_metadata: request.client_metadata,
+          signed: true, signing_key: attestation.cnf_jwk, parsed: parsed, attestation: attestation
+        )
+      end
+
+      private
+
+      def check_redirect_uris!(request, attestation, dc_api)
+        redirect_uris = attestation.redirect_uris
+        return if redirect_uris.nil? || dc_api
+
+        return if redirect_uris.include?(request.return_uri)
+
+        raise OpenID4VP::VerificationError, "return URI does not match a verifier attestation redirect_uris entry"
+      end
+    end
+  end
+end

data/lib/openid4vp/request_verification/x509_hash.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "verified_request"
+require_relative "../errors"
+require_relative "../x509"
+require_relative "../x509/chain_validator"
+require_relative "../jose/jwk"
+
+module OpenID4VP
+  module RequestVerification
+    # `x509_hash` Client Identifier Prefix (OpenID4VP §5.9.3): the original
+    # Client Identifier is base64url(SHA-256(DER)) of the leaf certificate
+    # carried in the request's `x5c` JOSE header.
+    class X509Hash < Base
+      def verify!(client_id, request, parsed, dc_api: false) # rubocop:disable Lint/UnusedMethodArgument
+        raise OpenID4VP::InvalidRequest, "signed request required" if parsed.nil?
+
+        certs = parsed.x5c_certs
+        raise OpenID4VP::InvalidRequest, "x5c required" if certs.empty?
+
+        leaf = OpenID4VP::X509::ChainValidator.new(
+          trust_anchors: config.x509_trust_anchors, time: config.current_time
+        ).validate!(certs)
+
+        unless OpenID4VP::X509.leaf_hash_b64(leaf) == client_id.original
+          raise OpenID4VP::VerificationError, "certificate hash mismatch"
+        end
+
+        signing_key = OpenID4VP::JOSE::JWK.from_openssl(leaf.public_key)
+        verify_signature!(parsed, signing_key)
+
+        VerifiedRequest.new(
+          request: request, client_id: client_id, verifier_metadata: request.client_metadata,
+          signed: true, signing_key: signing_key, parsed: parsed, attestation: nil
+        )
+      end
+    end
+  end
+end