@bedrock/vc-delivery 6.5.0 → 6.6.0

package/lib/helpers.js

@@ -1,5 +1,5 @@
 /*!
- * Copyright (c) 2022-2024 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2022-2025 Digital Bazaar, Inc. All rights reserved.
  */
 import * as bedrock from '@bedrock/core';
 import * as vcjwt from './vcjwt.js';
@@ -18,6 +18,16 @@ const ALLOWED_ERROR_KEYS = [
   'status'
 ];
 
+const JWT_FORMAT_ALIASES = new Set([
+  'application/jwt',
+  'application/vc+jwt',
+  'application/vp+jwt',
+  'jwt_vp',
+  'jwt_vp_json',
+  'jwt_vc_json-ld',
+  'jwt_vc_json'
+]);
+
 export async function evaluateTemplate({
   workflow, exchange, typedTemplate, variables
 } = {}) {
@@ -243,7 +253,7 @@ function _getEnvelope({envelope, format}) {
   const isString = typeof envelope === 'string';
   if(isString) {
     // supported formats
-    if(format === 'application/jwt' || format === 'jwt_vc_json-ld') {
+    if(JWT_FORMAT_ALIASES.has(format)) {
       format = 'application/jwt';
     }
   } else {

package/lib/oid4/oid4vp.js

@@ -289,9 +289,20 @@ function _createClientMetaData() {
   // return default supported `vp_formats`
   return {
     vp_formats: {
+      // support both aliases `jwt_vp` and `jwt_vp_json`
       jwt_vp: {
         alg: ['EdDSA', 'Ed25519', 'ES256', 'ES384']
       },
+      jwt_vp_json: {
+        alg: ['EdDSA', 'Ed25519', 'ES256', 'ES384']
+      },
+      di_vp: {
+        proof_type: [
+          'ecdsa-rdfc-2019',
+          'eddsa-rdfc-2022',
+          'Ed25519Signature2020'
+        ]
+      },
       ldp_vp: {
         proof_type: [
           'ecdsa-rdfc-2019',
@@ -308,7 +319,7 @@ async function _parseAuthorizationResponse({req}) {
   const {vp_token, presentation_submission} = req.body;
 
   // JSON parse and validate `vp_token` and `presentation_submission`
-  let presentation = _jsonParse(vp_token, 'vp_token');
+  let presentation = _jsonParse(vp_token, 'vp_token', true);
   const presentationSubmission = _jsonParse(
     presentation_submission, 'presentation_submission');
   _validate(VALIDATORS.presentationSubmission, presentationSubmission);
@@ -319,8 +330,8 @@ async function _parseAuthorizationResponse({req}) {
       envelope: raw, presentation: contents, format
     } = await unenvelopePresentation({
       envelopedPresentation: presentation,
-      // FIXME: check presentationSubmission for VP format
-      format: 'jwt_vc_json-ld'
+      // FIXME: check `presentationSubmission` for VP format
+      format: 'application/jwt'
     });
     _validate(VALIDATORS.presentation, contents);
     presentation = {
@@ -336,10 +347,15 @@ async function _parseAuthorizationResponse({req}) {
   return {presentation, envelope, presentationSubmission};
 }
 
-function _jsonParse(x, name) {
+function _jsonParse(x, name, allowJWT = false) {
   try {
     return JSON.parse(x);
   } catch(cause) {
+    // presume the string is a non-JSON encoded JWT and let subsequent
+    // checking handle it (`ey` is base64url-encoded `{`)
+    if(allowJWT && x?.startsWith('ey')) {
+      return x;
+    }
     throw new BedrockError(`Could not parse "${name}".`, {
       name: 'DataError',
       details: {httpStatusCode: 400, public: true},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/vc-delivery",
-  "version": "6.5.0",
+  "version": "6.6.0",
   "type": "module",
   "description": "Bedrock Verifiable Credential Delivery",
   "main": "./lib/index.js",

package/schemas/bedrock-vc-workflow.js

@@ -181,7 +181,7 @@ const expectedCredentialRequest = {
     credential_definition: credentialDefinition,
     format: {
       type: 'string',
-      enum: ['ldp_vc', 'jwt_vc_json-ld']
+      enum: ['di_vc', 'ldp_vc', 'jwt_vc_json-ld', 'jwt_vc_json']
     }
   }
 };
@@ -509,7 +509,7 @@ const openIdCredentialRequest = {
     credential_definition: credentialDefinition,
     format: {
       type: 'string',
-      enum: ['ldp_vc', 'jwt_vc_json-ld']
+      enum: ['di_vc', 'ldp_vc', 'jwt_vc_json-ld', 'jwt_vc_json']
     },
     did: {
       type: 'string'
@@ -631,7 +631,21 @@ export function openIdAuthorizationResponseBody() {
       presentation_submission: {
         type: 'string'
       },
-      // is a JSON string in the x-www-form-urlencoded body
+      // is a JSON-encoded string or object in the x-www-form-urlencoded body
+      /* Note: This can also be a simple base64url string for
+      backwards/forwards compatibility. While submitting VPs directly as
+      JSON objects has never changed in the OID4* specs, submitting VPs that
+      are wrapped in some envelope that is expressed as a string (e.g., a JWT)
+      has changed back and forth throughout the draft history. Sometimes these
+      vp_tokens are required to be JSON-encoded strings other times non-JSON
+      strings, i.e., no "extra/JSON quotes" around the string value inside the
+      x-www-form-urlencoded field value delimiting quotes. For example,
+      both of these:
+
+      `...&vp_token="non-string JSON"`
+      `...&vp_token="\"JSON string\""`
+
+      are accepted for these reasons. */
       vp_token: {
         type: 'string'
       },