@bedrock/vc-delivery 7.19.1 → 7.19.3

package/lib/oid4/authorizationRequest.js

@@ -2,12 +2,11 @@
  * Copyright (c) 2022-2026 Digital Bazaar, Inc. All rights reserved.
  */
 import * as bedrock from '@bedrock/core';
-import {AsymmetricKey, KmsClient} from '@digitalbazaar/webkms-client';
-import {exportJWK, generateKeyPair, importJWK} from 'jose';
+import {exportJWK, generateKeyPair} from 'jose';
 import {oid4vp, signJWT} from '@digitalbazaar/oid4-client';
+import {createDcApiRequest} from './mdoc.js';
 import {getClientBaseUrl} from './clientProfiles.js';
-import {getZcapClient} from '../helpers.js';
-import {httpsAgent} from '@bedrock/https-agent';
+import {getRequestSigningParameters} from './requestSigning.js';
 import {randomUUID} from 'node:crypto';
 
 const {util: {BedrockError}} = bedrock;
@@ -112,6 +111,13 @@ export async function create({
 export async function encode({
   workflow, clientProfile, authorizationRequest
 } = {}) {
+  if(authorizationRequest.response_mode === 'dc_api') {
+    // create mdoc device request for DC API Annex C
+    return createDcApiRequest({
+      workflow, clientProfile, authorizationRequest
+    });
+  }
+
   // if required, construct authz request as signed JWT
   if(authorizationRequest.client_metadata.require_signed_request_object) {
     return _createJwt({workflow, clientProfile, authorizationRequest});
@@ -234,64 +240,15 @@ async function _createClientMetaData({
 
 async function _createJwt({workflow, clientProfile, authorizationRequest}) {
   try {
-    // create zcap client
-    const {zcapClient, zcaps} = await getZcapClient({workflow});
+    // get signing params
+    const {signer, kid, alg} = await getRequestSigningParameters({
+      workflow, clientProfile
+    });
 
-    // get any `x5c` and either `privateKeyJwk` or the zcap to use to sign the
-    // authz request via the client profile
+    // get any `x5c` to include
     const {
-      authorizationRequestSigningParameters: {privateKeyJwk, x5c} = {},
-      zcapReferenceIds: {signAuthorizationRequest: refId} = {}
+      authorizationRequestSigningParameters: {x5c} = {},
     } = clientProfile;
-    if(privateKeyJwk === undefined && refId === undefined) {
-      throw new BedrockError(
-        'The OID4VP client profile does not specify the private key or ' +
-        'capability in the  workflow configuration to use to sign ' +
-        'authorization requests.', {
-          name: 'DataError',
-          details: {httpStatusCode: 500, public: true}
-        });
-    }
-
-    // code assumed ES256 (ECDSA P-256 + SHA-256) support only
-    const alg = 'ES256';
-    let kid;
-    let signer;
-    if(privateKeyJwk) {
-      kid = privateKeyJwk.kid;
-
-      // import `privateKeyJwk`
-      const privateKey = await importJWK(privateKeyJwk, alg);
-
-      // create signer API
-      const algorithm = {name: 'ECDSA', hash: {name: 'SHA-256'}};
-      signer = {
-        async sign({data}) {
-          return new Uint8Array(
-            await crypto.subtle.sign(algorithm, privateKey, data));
-        }
-      };
-    } else {
-      const capability = zcaps[refId];
-      if(capability === undefined) {
-        throw new BedrockError(
-          'The capability specified by the OID4VP client profile for signing ' +
-          'authorization requests was not found in the workflow ' +
-          'configuration.', {
-            name: 'DataError',
-            details: {httpStatusCode: 500, public: true}
-          });
-      }
-
-      // create a WebKMS `signer` interface
-      const {invocationSigner} = zcapClient;
-      const kmsClient = new KmsClient({httpsAgent});
-      signer = await AsymmetricKey.fromCapability({
-        capability, invocationSigner, kmsClient
-      });
-      const keyDescription = await signer.getKeyDescription();
-      kid = keyDescription.id;
-    }
 
     // create the JWT payload and header to be signed
     const payload = {...authorizationRequest};

package/lib/oid4/authorizationResponse.js

@@ -80,7 +80,7 @@ export async function parse({
 function _getDecryptParameters({
   exchange, clientProfileId, authorizationRequest, mdocOptions
 }) {
-  // get private key agreement keys in JWT format
+  // get private key agreement keys in JWK format
   const {keyAgreementKeyPairs} = exchange.secrets?.oid4vp?.clientProfiles
     ?.[clientProfileId ?? 'default'] ?? {};
   const keys = keyAgreementKeyPairs.map(({privateKeyJwk}) => privateKeyJwk);
@@ -94,7 +94,10 @@ function _getDecryptParameters({
         ...mdocOptions?.expectedHandover,
         recipientPublicJwk
       };
-      return oid4vp.mdl.encodeSessionTranscript({handover});
+      // set encoded `SessionTranscript` as `info`
+      // note: this must be the raw value w/o CBOR tag 24, i.e., this is NOT
+      // `SessionTranscriptBytes`
+      return oid4vp.mdoc.encodeSessionTranscript({handover, raw: true});
     };
   }
 

package/lib/oid4/http.js

@@ -405,18 +405,24 @@ async function _handleOid4vpAuthzRequest(req, res) {
     // returned in response; presently any wallet metadata is ignored
     const {
       authorizationRequest,
-      clientProfile
+      clientProfile,
+      exchange
     } = await oid4vp.getAuthorizationRequest({req, clientProfileId});
     const {config: workflow} = req.serviceObject;
     result = await oid4vp.encodeAuthorizationRequest({
-      workflow, clientProfile, authorizationRequest,
+      workflow, exchange,
+      clientProfileId, clientProfile, authorizationRequest,
       requestMethod: req.method.toLowerCase()
     });
-    res.set('content-type', 'application/oauth-authz-req+jwt');
+    if(authorizationRequest.response_mode === 'dc_api') {
+      res.json(result);
+    } else {
+      res.set('content-type', 'application/oauth-authz-req+jwt');
+      res.send(result);
+    }
   } catch(error) {
     return _sendOID4Error({res, error});
   }
-  res.send(result);
 }
 
 async function _handleOid4vpAuthzResponse(req, res) {

package/lib/oid4/mdoc.js

@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) 2025-2026 Digital Bazaar, Inc.
+ */
+import {CoseKey, IsoMdocDcApi} from '@owf/mdoc';
+import {getRequestSigningParameters} from './requestSigning.js';
+import {selectJwk} from '@digitalbazaar/oid4-client';
+
+const TEXT_ENCODER = new TextEncoder();
+
+export async function createDcApiRequest({
+  workflow, clientProfile, authorizationRequest
+} = {}) {
+  return _createAnnexCDcApiRequest({
+    workflow, clientProfile, authorizationRequest
+  });
+}
+
+async function _createAnnexCDcApiRequest({
+  workflow, clientProfile, authorizationRequest
+}) {
+  // get recipient public key from authz request
+  const keys = authorizationRequest.client_metadata.jwks?.keys ?? [];
+  // these parameters are only ones supported Annex C for encryption key pair
+  const recipientPublicJwk = selectJwk({
+    keys, alg: 'ECDH-ES', kty: 'EC', crv: 'P-256'
+  });
+  const recipientPublicKey = CoseKey.fromJwk(recipientPublicJwk);
+
+  // get signing params
+  const {signer} = await getRequestSigningParameters({
+    workflow, clientProfile
+  });
+
+  // get `x5c` to include in certificate chain
+  const {
+    authorizationRequestSigningParameters: {x5c} = {},
+  } = clientProfile;
+  const certificateChain = x5c.map(b64 => Buffer.from(b64, 'base64'));
+
+  // create Annex C DC API mdoc device request
+  const {dcql_query: dcqlQuery} = authorizationRequest;
+  const {request} = await IsoMdocDcApi.createRequest({
+    version: '1.1',
+    nonce: TEXT_ENCODER.encode(authorizationRequest.nonce),
+    docRequests: _createDocRequests({dcqlQuery}),
+    recipientPublicKey,
+    readerAuth: {
+      signingKey: CoseKey.fromJwk({
+        kid: signer.id,
+        alg: 'ES256',
+        kty: 'EC',
+        crv: 'P-256'
+      }),
+      certificateChain,
+      origin: authorizationRequest.expected_origins[0]
+    }
+  }, _createMdocContext({signer}));
+
+  return {
+    meta: {authorizationRequest},
+    request: {
+      protocol: 'org-iso-mdoc',
+      data: request
+    }
+  };
+}
+
+function _createDocRequests({dcqlQuery} = {}) {
+  // process all `mso_mdoc` queries as a separate doc request
+  const credentials = dcqlQuery?.credentials
+    ?.filter(c => c?.format === 'mso_mdoc') ?? [];
+  return credentials.map(c => {
+    const docType = c.meta?.doctype_value;
+    const namespaces = new Map();
+    const claims = c.claims ?? [];
+    for(const claim of claims) {
+      const path = claim.path;
+      if(!(Array.isArray(path) && path.length >= 2)) {
+        continue;
+      }
+      const [namespace, field] = path;
+      let fields = namespaces.get(namespace);
+      if(!fields) {
+        namespaces.set(namespace, fields = new Map());
+      }
+      fields.set(field, true);
+    }
+    return {docType, namespaces};
+  });
+}
+
+function _createMdocContext({signer}) {
+  const crypto = globalThis.crypto;
+  return {
+    crypto: {
+      async digest({digestAlgorithm, bytes}) {
+        const digest = await crypto.subtle.digest(digestAlgorithm, bytes);
+        return new Uint8Array(digest);
+      },
+      random(length) {
+        return crypto.getRandomValues(new Uint8Array(length));
+      }
+    },
+    cose: {
+      sign1: {
+        async sign({toBeSigned}) {
+          return signer.sign({data: toBeSigned});
+        }
+      }
+    }
+  };
+}

package/lib/oid4/oid4vp.js

@@ -107,15 +107,21 @@ export async function getOID4VPProtocols({workflow, exchange, step}) {
     } = await _getOrCreateStepAuthorizationRequest({
       workflow, exchange, clientProfileId, clientProfile, step
     });
-    const {client_id, request_uri_method} = authorizationRequest;
-    const searchParams = new URLSearchParams({
-      client_id,
-      request_uri: `${clientBaseUrl}/authorization/request`
-    });
-    if(request_uri_method && version !== 'OID4VP-draft18') {
-      searchParams.set('request_uri_method', request_uri_method);
+    if(authorizationRequest.response_mode === 'dc_api') {
+      // use `request_uri` only
+      protocols[name] = `${clientBaseUrl}/authorization/request`;
+    } else {
+      // build OID4VP-style URL
+      const {client_id, request_uri_method} = authorizationRequest;
+      const searchParams = new URLSearchParams({
+        client_id,
+        request_uri: `${clientBaseUrl}/authorization/request`
+      });
+      if(request_uri_method && version !== 'OID4VP-draft18') {
+        searchParams.set('request_uri_method', request_uri_method);
+      }
+      protocols[name] = `${scheme}://?${searchParams}`;
     }
-    protocols[name] = `${scheme}://?${searchParams}`;
   }
   return protocols;
 }

package/lib/oid4/requestSigning.js

@@ -0,0 +1,84 @@
+/*!
+ * Copyright (c) 2022-2026 Digital Bazaar, Inc. All rights reserved.
+ */
+import * as bedrock from '@bedrock/core';
+import {AsymmetricKey, KmsClient} from '@digitalbazaar/webkms-client';
+import {getZcapClient} from '../helpers.js';
+import {httpsAgent} from '@bedrock/https-agent';
+import {importJWK} from 'jose';
+
+const {util: {BedrockError}} = bedrock;
+
+export async function getRequestSigningParameters({
+  workflow, clientProfile
+} = {}) {
+  try {
+    // create zcap client
+    const {zcapClient, zcaps} = await getZcapClient({workflow});
+
+    // get any `x5c` and either `privateKeyJwk` or the zcap to use to sign the
+    // authz request via the client profile
+    const {
+      authorizationRequestSigningParameters: {privateKeyJwk} = {},
+      zcapReferenceIds: {signAuthorizationRequest: refId} = {}
+    } = clientProfile;
+    if(privateKeyJwk === undefined && refId === undefined) {
+      throw new BedrockError(
+        'The OID4VP client profile does not specify the private key or ' +
+        'capability in the  workflow configuration to use to sign ' +
+        'authorization requests.', {
+          name: 'DataError',
+          details: {httpStatusCode: 500, public: true}
+        });
+    }
+
+    // code assumed ES256 (ECDSA P-256 + SHA-256) support only
+    const alg = 'ES256';
+    let kid;
+    let signer;
+    if(privateKeyJwk) {
+      kid = privateKeyJwk.kid;
+
+      // import `privateKeyJwk`
+      const privateKey = await importJWK(privateKeyJwk, alg);
+
+      // create signer API
+      const algorithm = {name: 'ECDSA', hash: {name: 'SHA-256'}};
+      signer = {
+        async sign({data}) {
+          return new Uint8Array(
+            await crypto.subtle.sign(algorithm, privateKey, data));
+        }
+      };
+    } else {
+      const capability = zcaps[refId];
+      if(capability === undefined) {
+        throw new BedrockError(
+          'The capability specified by the OID4VP client profile for signing ' +
+          'authorization requests was not found in the workflow ' +
+          'configuration.', {
+            name: 'DataError',
+            details: {httpStatusCode: 500, public: true}
+          });
+      }
+
+      // create a WebKMS `signer` interface
+      const {invocationSigner} = zcapClient;
+      const kmsClient = new KmsClient({httpsAgent});
+      signer = await AsymmetricKey.fromCapability({
+        capability, invocationSigner, kmsClient
+      });
+      const keyDescription = await signer.getKeyDescription();
+      kid = keyDescription.id;
+    }
+
+    return {signer, privateKeyJwk, kid, alg};
+  } catch(cause) {
+    throw new BedrockError(
+      `Could not get request signing parameters: ${cause.message}`, {
+        name: cause instanceof BedrockError ? cause.name : 'OperationError',
+        cause,
+        details: {httpStatusCode: 500, public: true}
+      });
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/vc-delivery",
-  "version": "7.19.1",
+  "version": "7.19.3",
   "type": "module",
   "description": "Bedrock Verifiable Credential Delivery",
   "main": "./lib/index.js",
@@ -40,7 +40,7 @@
     "@digitalbazaar/ed25519-signature-2020": "^5.4.0",
     "@digitalbazaar/ezcap": "^4.1.0",
     "@digitalbazaar/http-client": "^4.4.0",
-    "@digitalbazaar/oid4-client": "^5.15.1",
+    "@digitalbazaar/oid4-client": "^5.15.2",
     "@digitalbazaar/vc": "^7.2.0",
     "@digitalbazaar/webkms-client": "^14.2.0",
     "assert-plus": "^1.0.0",