@bedrock/vc-delivery 7.18.1 → 7.19.0

package/lib/helpers.js

@@ -175,6 +175,27 @@ export async function generateRandom() {
   });
 }
 
+export function getAlgFromJwk({jwk} = {}) {
+  if(jwk.alg) {
+    return jwk.alg;
+  }
+  if(jwk.kty === 'EC' && jwk.crv) {
+    if(jwk.crv.startsWith('P-')) {
+      return `ES${jwk.crv.slice(2)}`;
+    }
+    if(jwk.crv === 'secp256k1') {
+      return 'ES256K';
+    }
+  }
+  if(jwk.kty === 'OKP' && jwk.crv?.startsWith('Ed')) {
+    return 'EdDSA';
+  }
+  if(jwk.kty === 'RSA') {
+    return 'PS256';
+  }
+  return 'invalid';
+}
+
 export function getWorkflowIssuerInstances({workflow} = {}) {
   let {issuerInstances} = workflow;
   if(!issuerInstances && workflow.zcaps.issue) {

package/lib/oid4/authorizationRequest.js

@@ -3,7 +3,7 @@
  */
 import * as bedrock from '@bedrock/core';
 import {AsymmetricKey, KmsClient} from '@digitalbazaar/webkms-client';
-import {exportJWK, generateKeyPair} from 'jose';
+import {exportJWK, generateKeyPair, importJWK} from 'jose';
 import {oid4vp, signJWT} from '@digitalbazaar/oid4-client';
 import {getClientBaseUrl} from './clientProfiles.js';
 import {getZcapClient} from '../helpers.js';
@@ -237,42 +237,65 @@ async function _createJwt({workflow, clientProfile, authorizationRequest}) {
     // create zcap client
     const {zcapClient, zcaps} = await getZcapClient({workflow});
 
-    // get any `x5c` and the zcap to use to sign the authz request via
-    // the client profile
+    // get any `x5c` and either `privateKeyJwk` or the zcap to use to sign the
+    // authz request via the client profile
     const {
-      authorizationRequestSigningParameters: {x5c} = {},
+      authorizationRequestSigningParameters: {privateKeyJwk, x5c} = {},
       zcapReferenceIds: {signAuthorizationRequest: refId} = {}
     } = clientProfile;
-    if(refId === undefined) {
+    if(privateKeyJwk === undefined && refId === undefined) {
       throw new BedrockError(
-        'The OID4VP client profile does not specify which capability in the ' +
-        'workflow configuration to use to sign authorization requests.', {
-          name: 'DataError',
-          details: {httpStatusCode: 500, public: true}
-        });
-    }
-    const capability = zcaps[refId];
-    if(capability === undefined) {
-      throw new BedrockError(
-        'The capability specified by the OID4VP client profile for signing ' +
-        'authorization requests was not found in the workflow configuration.', {
+        'The OID4VP client profile does not specify the private key or ' +
+        'capability in the  workflow configuration to use to sign ' +
+        'authorization requests.', {
           name: 'DataError',
           details: {httpStatusCode: 500, public: true}
         });
     }
 
-    // create a WebKMS `signer` interface
-    const {invocationSigner} = zcapClient;
-    const kmsClient = new KmsClient({httpsAgent});
-    const signer = await AsymmetricKey.fromCapability({
-      capability, invocationSigner, kmsClient
-    });
-    const keyDescription = await signer.getKeyDescription();
-    const kid = keyDescription.id;
+    // code assumed ES256 (ECDSA P-256 + SHA-256) support only
+    const alg = 'ES256';
+    let kid;
+    let signer;
+    if(privateKeyJwk) {
+      kid = privateKeyJwk.kid;
+
+      // import `privateKeyJwk`
+      const privateKey = await importJWK(privateKeyJwk, alg);
+
+      // create signer API
+      const algorithm = {name: 'ECDSA', hash: {name: 'SHA-256'}};
+      signer = {
+        async sign({data}) {
+          return new Uint8Array(
+            await crypto.subtle.sign(algorithm, privateKey, data));
+        }
+      };
+    } else {
+      const capability = zcaps[refId];
+      if(capability === undefined) {
+        throw new BedrockError(
+          'The capability specified by the OID4VP client profile for signing ' +
+          'authorization requests was not found in the workflow ' +
+          'configuration.', {
+            name: 'DataError',
+            details: {httpStatusCode: 500, public: true}
+          });
+      }
+
+      // create a WebKMS `signer` interface
+      const {invocationSigner} = zcapClient;
+      const kmsClient = new KmsClient({httpsAgent});
+      signer = await AsymmetricKey.fromCapability({
+        capability, invocationSigner, kmsClient
+      });
+      const keyDescription = await signer.getKeyDescription();
+      kid = keyDescription.id;
+    }
 
     // create the JWT payload and header to be signed
     const payload = {...authorizationRequest};
-    const protectedHeader = {typ: OID4VP_JWT_TYP, alg: 'ES256', kid, x5c};
+    const protectedHeader = {typ: OID4VP_JWT_TYP, alg, kid, x5c};
 
     // create the JWT
     return signJWT({payload, protectedHeader, signer});

package/lib/oid4/authorizationResponse.js

@@ -1,5 +1,5 @@
 /*!
- * Copyright (c) 2022-2026 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2022-2026 Digital Bazaar, Inc.
  */
 import * as bedrock from '@bedrock/core';
 import {
@@ -16,8 +16,6 @@ const VALIDATORS = {
   presentationSubmission: null
 };
 
-const VC_CONTEXT_2 = 'https://www.w3.org/ns/credentials/v2';
-
 bedrock.events.on('bedrock.init', () => {
   VALIDATORS.presentation = compile({schema: verifiablePresentationSchema()});
   VALIDATORS.presentationSubmission = compile({
@@ -33,11 +31,14 @@ export async function parse({
     const {
       responseMode, parsed, protectedHeader,
       recipientPublicJwk, recipientPublicJwkThumbprint,
-      vpTokenMediaType
+      vpTokenMediaType,
+      envelope, presentation, mdocOptions
     } = await oid4vp.verifier.parseAuthorizationResponse({
       body,
-      getDecryptParameters() {
-        return _getDecryptParameters({exchange, clientProfileId});
+      getDecryptParameters({mdocOptions} = {}) {
+        return _getDecryptParameters({
+          exchange, clientProfileId, authorizationRequest, mdocOptions
+        });
       },
       authorizationRequest
     });
@@ -48,22 +49,8 @@ export async function parse({
       _validate(VALIDATORS.presentationSubmission, presentationSubmission);
     }
 
-    // obtain `presentation` and optional `envelope` from parsed `vpToken`
-    const {vpToken} = parsed;
-    let presentation;
-    let envelope;
-
-    if(vpTokenMediaType !== 'application/vp') {
-      // `vp_token` contains some enveloped format
-      presentation = {
-        '@context': VC_CONTEXT_2,
-        id: `data:${vpTokenMediaType},${vpToken}`,
-        type: 'EnvelopedVerifiablePresentation'
-      };
-      envelope = {mediaType: vpTokenMediaType};
-    } else {
-      // simplest case: `vpToken` is a VP; validate it against basic schema
-      presentation = vpToken;
+    // validate `presentation` against basic schema
+    if(vpTokenMediaType === 'application/vp') {
       _validate(VALIDATORS.presentation, presentation);
     }
 
@@ -74,7 +61,8 @@ export async function parse({
       envelope,
       protectedHeader,
       recipientPublicJwk,
-      recipientPublicJwkThumbprint
+      recipientPublicJwkThumbprint,
+      mdocOptions
     };
   } catch(cause) {
     throw new BedrockError(
@@ -89,12 +77,28 @@ export async function parse({
   }
 }
 
-function _getDecryptParameters({exchange, clientProfileId}) {
+function _getDecryptParameters({
+  exchange, clientProfileId, authorizationRequest, mdocOptions
+}) {
   // get private key agreement keys in JWT format
   const {keyAgreementKeyPairs} = exchange.secrets?.oid4vp?.clientProfiles
     ?.[clientProfileId ?? 'default'] ?? {};
   const keys = keyAgreementKeyPairs.map(({privateKeyJwk}) => privateKeyJwk);
-  return {keys};
+
+  // include decryption AAD info if `response_mode` calls for it
+  let getInfo;
+  if(authorizationRequest.response_mode === 'dc_api') {
+    // include `recipientPublicJwk` in expected mdoc handover
+    getInfo = ({recipientPublicJwk}) => {
+      const handover = {
+        ...mdocOptions?.expectedHandover,
+        recipientPublicJwk
+      };
+      return oid4vp.mdl.encodeSessionTranscript({handover});
+    };
+  }
+
+  return {keys, getInfo};
 }
 
 function _validate(validator, data) {

package/lib/oid4/oid4vci.js

@@ -4,7 +4,9 @@
 import * as bedrock from '@bedrock/core';
 import * as draft13 from './oid4vciDraft13.js';
 import {issue as defaultIssue, getIssueRequestsParams} from '../issue.js';
-import {getWorkflowIssuerInstances, setVariable} from '../helpers.js';
+import {
+  getAlgFromJwk, getWorkflowIssuerInstances, setVariable
+} from '../helpers.js';
 import {importJWK, SignJWT} from 'jose';
 import {timingSafeEqual, randomUUID as uuid} from 'node:crypto';
 import {
@@ -648,7 +650,7 @@ function _createSupportedCredentialRequests({
 async function _createOAuth2AccessToken({
   privateKeyJwk, audience, action, target, exp, iss, nbf, typ = 'at+jwt'
 }) {
-  const alg = _getAlgFromPrivateKey({privateKeyJwk});
+  const alg = getAlgFromJwk({jwk: privateKeyJwk});
   const scope = `${action}:${target}`;
   const builder = new SignJWT({scope})
     .setProtectedHeader({alg, typ})
@@ -671,27 +673,6 @@ async function _createOAuth2AccessToken({
   return {accessToken, ttl};
 }
 
-function _getAlgFromPrivateKey({privateKeyJwk}) {
-  if(privateKeyJwk.alg) {
-    return privateKeyJwk.alg;
-  }
-  if(privateKeyJwk.kty === 'EC' && privateKeyJwk.crv) {
-    if(privateKeyJwk.crv.startsWith('P-')) {
-      return `ES${privateKeyJwk.crv.slice(2)}`;
-    }
-    if(privateKeyJwk.crv === 'secp256k1') {
-      return 'ES256K';
-    }
-  }
-  if(privateKeyJwk.kty === 'OKP' && privateKeyJwk.crv?.startsWith('Ed')) {
-    return 'EdDSA';
-  }
-  if(privateKeyJwk.kty === 'RSA') {
-    return 'PS256';
-  }
-  return 'invalid';
-}
-
 function _getSupportedCredentialConfigurations({workflow, exchange, step}) {
   // get all OID4VCI credential configuration IDs from issue requests in step
   const issueRequestsParams = getIssueRequestsParams({

package/lib/oid4/oid4vp.js

@@ -1,5 +1,5 @@
 /*!
- * Copyright (c) 2022-2026 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2022-2026 Digital Bazaar, Inc.
  */
 import * as bedrock from '@bedrock/core';
 import {
@@ -199,52 +199,9 @@ export async function processAuthorizationResponse({req, clientProfileId}) {
       expectedDomain = verifyPresentationOptions.domain;
 
       const {envelope} = parseResponseResult;
-      if(envelope?.mediaType === 'application/mdoc-vp-token' ||
-        // deprecated
-        envelope?.mediaType === 'application/mdl-vp-token') {
-        // generate `handover` for mdoc verification
-        let handover;
-
-        // common `handover` parameters:
-        const origin = authorizationRequest?.expected_origins?.[0] ??
-          new URL(authorizationRequest.response_uri).origin;
-        const nonce = authorizationRequest.nonce;
-
-        // `direct_post.jwt` => ISO18013-7 Annex B
-        // FIXME: same response mode is also used for OID4VP 1.0 with
-        // `OpenID4VPHandover` for non-Annex-B; this is not yet supported
-        // https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-invocation-via-redirects
-        const {responseMode} = parseResponseResult;
-        if(responseMode === 'direct_post.jwt') {
-          handover = {
-            type: 'AnnexBHandover',
-            // per ISO 18013-7 B the `mdocGeneratedNonce` is base64url-encoded
-            // and put into the `apu` protected header parameter, so parse that
-            // here and convert it to a UTF-8 string instead
-            mdocGeneratedNonce: Buffer
-              .from(parseResponseResult.protectedHeader?.apu ?? '', 'base64url')
-              .toString('utf8'),
-            clientId: authorizationRequest.client_id,
-            responseUri: authorizationRequest.response_uri,
-            verifierGeneratedNonce: nonce
-          };
-        } else if(responseMode === 'dc_api') {
-          // `dc_api` => ISO18013-7 Annex C
-          handover = {
-            type: 'dcapi',
-            origin,
-            nonce,
-            recipientPublicJwk: parseResponseResult.recipientPublicJwk
-          };
-        } else if(responseMode === 'dc_api.jwt') {
-          // `dc_api.jwt` => ISO18013-7 Annex D
-          handover = {
-            type: 'OpenID4VPDCAPIHandover',
-            origin,
-            nonce,
-            jwkThumbprint: parseResponseResult.recipientPublicJwkThumbprint
-          };
-        }
+      if(parseResponseResult?.mdocOptions) {
+        // get expected `handover` for mdoc verification
+        const {expectedHandover: handover} = parseResponseResult.mdocOptions;
 
         // handle deprecated `mdl` option; `mdoc` is preferred
         const mdocKey = envelope.mediaType === 'application/mdoc-vp-token' ?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/vc-delivery",
-  "version": "7.18.1",
+  "version": "7.19.0",
   "type": "module",
   "description": "Bedrock Verifiable Credential Delivery",
   "main": "./lib/index.js",
@@ -40,7 +40,7 @@
     "@digitalbazaar/ed25519-signature-2020": "^5.4.0",
     "@digitalbazaar/ezcap": "^4.1.0",
     "@digitalbazaar/http-client": "^4.4.0",
-    "@digitalbazaar/oid4-client": "^5.14.0",
+    "@digitalbazaar/oid4-client": "^5.15.0",
     "@digitalbazaar/vc": "^7.2.0",
     "@digitalbazaar/webkms-client": "^14.2.0",
     "assert-plus": "^1.0.0",

package/schemas/bedrock-vc-workflow.js

@@ -547,6 +547,22 @@ const oid4vpClientProfile = {
       required: ['x5c'],
       additionalProperties: false,
       properties: {
+        privateKeyJwk: {
+          type: 'object',
+          required: ['kid', 'kty', 'crv', 'x', 'y', 'd'],
+          properties: {
+            // only ES256 supported at this time
+            alg: {enum: ['ES256']},
+            kid: {type: 'string'},
+            kty: {enum: ['EC']},
+            crv: {enum: ['P-256']},
+            x: {type: 'string'},
+            y: {type: 'string'},
+            d: {type: 'string'},
+            use: {const: 'sig'},
+            key_ops: {const: ['sign']}
+          }
+        },
         x5c: {
           type: 'array',
           minItems: 1,
@@ -999,6 +1015,13 @@ export function openIdAuthorizationResponseBody() {
       not: {
         required: ['presentation_submission', 'vp_token', 'state']
       }
+    }, {
+      // for response_mode == 'dc_api'
+      required: ['Response'],
+      // cannot also use any other params
+      not: {
+        required: ['presentation_submission', 'vp_token', 'state']
+      }
     }],
     properties: {
       // is a JSON string in the x-www-form-urlencoded body
@@ -1027,6 +1050,10 @@ export function openIdAuthorizationResponseBody() {
         // must be an encrypted JWT
         type: 'string'
       },
+      Response: {
+        // must be an HPKE encrypted mdoc device response (ISO 18013-7 Annex C)
+        type: 'string'
+      },
       state: {
         type: 'string'
       }