@bedrock/vc-delivery 7.18.1 → 7.18.2

package/lib/oid4/authorizationResponse.js

@@ -1,5 +1,5 @@
 /*!
- * Copyright (c) 2022-2026 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2022-2026 Digital Bazaar, Inc.
  */
 import * as bedrock from '@bedrock/core';
 import {
@@ -16,8 +16,6 @@ const VALIDATORS = {
   presentationSubmission: null
 };
 
-const VC_CONTEXT_2 = 'https://www.w3.org/ns/credentials/v2';
-
 bedrock.events.on('bedrock.init', () => {
   VALIDATORS.presentation = compile({schema: verifiablePresentationSchema()});
   VALIDATORS.presentationSubmission = compile({
@@ -33,11 +31,14 @@ export async function parse({
     const {
       responseMode, parsed, protectedHeader,
       recipientPublicJwk, recipientPublicJwkThumbprint,
-      vpTokenMediaType
+      vpTokenMediaType,
+      envelope, presentation, mdocOptions
     } = await oid4vp.verifier.parseAuthorizationResponse({
       body,
-      getDecryptParameters() {
-        return _getDecryptParameters({exchange, clientProfileId});
+      getDecryptParameters({mdocOptions} = {}) {
+        return _getDecryptParameters({
+          exchange, clientProfileId, authorizationRequest, mdocOptions
+        });
       },
       authorizationRequest
     });
@@ -48,22 +49,8 @@ export async function parse({
       _validate(VALIDATORS.presentationSubmission, presentationSubmission);
     }
 
-    // obtain `presentation` and optional `envelope` from parsed `vpToken`
-    const {vpToken} = parsed;
-    let presentation;
-    let envelope;
-
-    if(vpTokenMediaType !== 'application/vp') {
-      // `vp_token` contains some enveloped format
-      presentation = {
-        '@context': VC_CONTEXT_2,
-        id: `data:${vpTokenMediaType},${vpToken}`,
-        type: 'EnvelopedVerifiablePresentation'
-      };
-      envelope = {mediaType: vpTokenMediaType};
-    } else {
-      // simplest case: `vpToken` is a VP; validate it against basic schema
-      presentation = vpToken;
+    // validate `presentation` against basic schema
+    if(vpTokenMediaType === 'application/vp') {
       _validate(VALIDATORS.presentation, presentation);
     }
 
@@ -74,7 +61,8 @@ export async function parse({
       envelope,
       protectedHeader,
       recipientPublicJwk,
-      recipientPublicJwkThumbprint
+      recipientPublicJwkThumbprint,
+      mdocOptions
     };
   } catch(cause) {
     throw new BedrockError(
@@ -89,12 +77,28 @@ export async function parse({
   }
 }
 
-function _getDecryptParameters({exchange, clientProfileId}) {
+function _getDecryptParameters({
+  exchange, clientProfileId, authorizationRequest, mdocOptions
+}) {
   // get private key agreement keys in JWT format
   const {keyAgreementKeyPairs} = exchange.secrets?.oid4vp?.clientProfiles
     ?.[clientProfileId ?? 'default'] ?? {};
   const keys = keyAgreementKeyPairs.map(({privateKeyJwk}) => privateKeyJwk);
-  return {keys};
+
+  // include decryption AAD info if `response_mode` calls for it
+  let getInfo;
+  if(authorizationRequest.response_mode === 'dc_api') {
+    // include `recipientPublicJwk` in expected mdoc handover
+    getInfo = ({recipientPublicJwk}) => {
+      const handover = {
+        ...mdocOptions?.expectedHandover,
+        recipientPublicJwk
+      };
+      return oid4vp.mdl.encodeSessionTranscript({handover});
+    };
+  }
+
+  return {keys, getInfo};
 }
 
 function _validate(validator, data) {

package/lib/oid4/oid4vp.js

@@ -1,5 +1,5 @@
 /*!
- * Copyright (c) 2022-2026 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2022-2026 Digital Bazaar, Inc.
  */
 import * as bedrock from '@bedrock/core';
 import {
@@ -199,52 +199,9 @@ export async function processAuthorizationResponse({req, clientProfileId}) {
       expectedDomain = verifyPresentationOptions.domain;
 
       const {envelope} = parseResponseResult;
-      if(envelope?.mediaType === 'application/mdoc-vp-token' ||
-        // deprecated
-        envelope?.mediaType === 'application/mdl-vp-token') {
-        // generate `handover` for mdoc verification
-        let handover;
-
-        // common `handover` parameters:
-        const origin = authorizationRequest?.expected_origins?.[0] ??
-          new URL(authorizationRequest.response_uri).origin;
-        const nonce = authorizationRequest.nonce;
-
-        // `direct_post.jwt` => ISO18013-7 Annex B
-        // FIXME: same response mode is also used for OID4VP 1.0 with
-        // `OpenID4VPHandover` for non-Annex-B; this is not yet supported
-        // https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-invocation-via-redirects
-        const {responseMode} = parseResponseResult;
-        if(responseMode === 'direct_post.jwt') {
-          handover = {
-            type: 'AnnexBHandover',
-            // per ISO 18013-7 B the `mdocGeneratedNonce` is base64url-encoded
-            // and put into the `apu` protected header parameter, so parse that
-            // here and convert it to a UTF-8 string instead
-            mdocGeneratedNonce: Buffer
-              .from(parseResponseResult.protectedHeader?.apu ?? '', 'base64url')
-              .toString('utf8'),
-            clientId: authorizationRequest.client_id,
-            responseUri: authorizationRequest.response_uri,
-            verifierGeneratedNonce: nonce
-          };
-        } else if(responseMode === 'dc_api') {
-          // `dc_api` => ISO18013-7 Annex C
-          handover = {
-            type: 'dcapi',
-            origin,
-            nonce,
-            recipientPublicJwk: parseResponseResult.recipientPublicJwk
-          };
-        } else if(responseMode === 'dc_api.jwt') {
-          // `dc_api.jwt` => ISO18013-7 Annex D
-          handover = {
-            type: 'OpenID4VPDCAPIHandover',
-            origin,
-            nonce,
-            jwkThumbprint: parseResponseResult.recipientPublicJwkThumbprint
-          };
-        }
+      if(parseResponseResult?.mdocOptions) {
+        // get expected `handover` for mdoc verification
+        const {expectedHandover: handover} = parseResponseResult.mdocOptions;
 
         // handle deprecated `mdl` option; `mdoc` is preferred
         const mdocKey = envelope.mediaType === 'application/mdoc-vp-token' ?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/vc-delivery",
-  "version": "7.18.1",
+  "version": "7.18.2",
   "type": "module",
   "description": "Bedrock Verifiable Credential Delivery",
   "main": "./lib/index.js",
@@ -40,7 +40,7 @@
     "@digitalbazaar/ed25519-signature-2020": "^5.4.0",
     "@digitalbazaar/ezcap": "^4.1.0",
     "@digitalbazaar/http-client": "^4.4.0",
-    "@digitalbazaar/oid4-client": "^5.14.0",
+    "@digitalbazaar/oid4-client": "^5.15.0",
     "@digitalbazaar/vc": "^7.2.0",
     "@digitalbazaar/webkms-client": "^14.2.0",
     "assert-plus": "^1.0.0",

package/schemas/bedrock-vc-workflow.js

@@ -547,6 +547,8 @@ const oid4vpClientProfile = {
       required: ['x5c'],
       additionalProperties: false,
       properties: {
+        // FIXME: consider adding `privateKeyJwk` as an alternative to using
+        // a zcap for a WebKMS key
         x5c: {
           type: 'array',
           minItems: 1,
@@ -999,6 +1001,13 @@ export function openIdAuthorizationResponseBody() {
       not: {
         required: ['presentation_submission', 'vp_token', 'state']
       }
+    }, {
+      // for response_mode == 'dc_api'
+      required: ['Response'],
+      // cannot also use any other params
+      not: {
+        required: ['presentation_submission', 'vp_token', 'state']
+      }
     }],
     properties: {
       // is a JSON string in the x-www-form-urlencoded body
@@ -1027,6 +1036,10 @@ export function openIdAuthorizationResponseBody() {
         // must be an encrypted JWT
         type: 'string'
       },
+      Response: {
+        // must be an HPKE encrypted mdoc device response (ISO 18013-7 Annex C)
+        type: 'string'
+      },
       state: {
         type: 'string'
       }