@bedrock/vc-delivery 5.3.4 → 5.4.0

package/lib/oid4/http.js

@@ -62,8 +62,17 @@ export async function createRoutes({
     authorizationResponse: `${openIdRoute}/client/authorization/response`
   };
 
-  // urlencoded body parser (extended=true for rich JSON-like representation)
-  const urlencoded = bodyParser.urlencoded({extended: true});
+  // urlencoded body parser
+  const urlencodedSmall = bodyParser.urlencoded({
+    // (extended=true for rich JSON-like representation)
+    extended: true
+  });
+  const urlencodedLarge = bodyParser.urlencoded({
+    // (extended=true for rich JSON-like representation)
+    extended: true,
+    // allow larger payloads
+    limit: '10MB'
+  });
 
   /* Note: The well-known metadata paths for the OID4VCI spec have been
   specified in at least two different ways over time, including
@@ -142,7 +151,7 @@ export async function createRoutes({
   app.post(
     routes.token,
     cors(),
-    urlencoded,
+    urlencodedSmall,
     validate({bodySchema: openIdTokenBody}),
     getConfigMiddleware,
     getExchange,
@@ -194,28 +203,33 @@ export async function createRoutes({
         return;
       }
 
-      /* Note: The `/credential` route only supports sending a single VC;
-      assume here that this workflow is configured for a single VC and an
-      error code would have been sent to the client to use the batch
-      endpoint if there was more than one VC to deliver. */
-      const {response, format} = result;
-      const {verifiablePresentation: {verifiableCredential: [vc]}} = response;
+      // send VC(s)
+      const {
+        response: {verifiablePresentation: {verifiableCredential}},
+        format
+      } = result;
+      // FIXME: "format" doesn't seem to be in the spec anymore (draft 14+)...
+      const credentials = verifiableCredential.map(vc => {
+        // parse any enveloped VC
+        let credential;
+        if(vc.type === 'EnvelopedVerifiableCredential' &&
+          vc.id?.startsWith('data:application/jwt,')) {
+          credential = vc.id.slice('data:application/jwt,'.length);
+        } else {
+          credential = vc;
+        }
+        return credential;
+      });
 
-      // parse any enveloped VC
-      let credential;
-      if(vc.type === 'EnvelopedVerifiableCredential' &&
-        vc.id?.startsWith('data:application/jwt,')) {
-        credential = vc.id.slice('data:application/jwt,'.length);
-      } else {
-        credential = vc;
-      }
+      /* Note: The `/credential` route only supports sending VCs of the same
+      type, but there can be more than one of them. The above `isBatchRequest`
+      check will ensure that the workflow used here only allows a single
+      credential request, indicating a single type. */
 
       // send OID4VCI response
-      res.json({
-        // FIXME: this doesn't seem to be in the spec anymore (draft 14+)...
-        format,
-        credential
-      });
+      const response = credentials.length === 1 ?
+        {format, credential: credentials[0]} : {format, credentials};
+      res.json(response);
     }));
 
   // a credential delivery server endpoint
@@ -316,7 +330,7 @@ export async function createRoutes({
   app.post(
     routes.authorizationResponse,
     cors(),
-    urlencoded,
+    urlencodedLarge,
     validate({bodySchema: openIdAuthorizationResponseBody()}),
     getConfigMiddleware,
     getExchange,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/vc-delivery",
-  "version": "5.3.4",
+  "version": "5.4.0",
   "type": "module",
   "description": "Bedrock Verifiable Credential Delivery",
   "main": "./lib/index.js",