@bedrock/vc-delivery 7.3.0 → 7.5.0

package/lib/oid4/http.js

@@ -1,5 +1,5 @@
 /*!
- * Copyright (c) 2022-2024 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2022-2025 Digital Bazaar, Inc. All rights reserved.
  */
 import * as oid4vci from './oid4vci.js';
 import * as oid4vp from './oid4vp.js';
@@ -13,13 +13,8 @@ import {asyncHandler} from '@bedrock/express';
 import bodyParser from 'body-parser';
 import cors from 'cors';
 import {logger} from '../logger.js';
-import {UnsecuredJWT} from 'jose';
 import {createValidateMiddleware as validate} from '@bedrock/validation';
 
-// re-export support detection helpers
-export {supportsOID4VCI} from './oid4vci.js';
-export {supportsOID4VP} from './oid4vp.js';
-
 /* NOTE: Parts of the OID4VCI design imply tight integration between the
 authorization server and the credential issuance / delivery server. This
 file provides the routes for both and treats them as integrated; supporting
@@ -51,6 +46,7 @@ export async function createRoutes({
   app, exchangeRoute, getConfigMiddleware, getExchange
 } = {}) {
   const openIdRoute = `${exchangeRoute}/openid`;
+  const oid4vpClientUrl = `${openIdRoute}/clients/:clientProfileId`;
   const routes = {
     // OID4VCI routes
     asMetadata1: `/.well-known/oauth-authorization-server${exchangeRoute}`,
@@ -63,9 +59,13 @@ export async function createRoutes({
     nonce: `${openIdRoute}/nonce`,
     token: `${openIdRoute}/token`,
     jwks: `${openIdRoute}/jwks`,
-    // OID4VP routes
+    // OID4VP routes:
+    // legacy routes do not include a client profile ID
     authorizationRequest: `${openIdRoute}/client/authorization/request`,
-    authorizationResponse: `${openIdRoute}/client/authorization/response`
+    authorizationResponse: `${openIdRoute}/client/authorization/response`,
+    // modern routes include a "clientProfileId" in the URL
+    profiledAuthorizationRequest: `${oid4vpClientUrl}/authorization/request`,
+    profiledAuthorizationResponse: `${oid4vpClientUrl}/authorization/response`
   };
 
   // urlencoded body parser
@@ -216,23 +216,11 @@ export async function createRoutes({
           return;
         }
 
-        // send VC(s)
+        // format VC(s)
         const {
-          response: {verifiablePresentation: {verifiableCredential}},
-          format
+          response: {verifiablePresentation}, format
         } = result;
-        // FIXME: "format" doesn't seem to be in the spec anymore (draft 14+)...
-        const credentials = verifiableCredential.map(vc => {
-          // parse any enveloped VC
-          let credential;
-          if(vc.type === 'EnvelopedVerifiableCredential' &&
-            vc.id?.startsWith('data:application/jwt,')) {
-            credential = vc.id.slice('data:application/jwt,'.length);
-          } else {
-            credential = vc;
-          }
-          return credential;
-        });
+        const credentials = _normalizeCredentials({verifiablePresentation});
 
         /* Note: The `/credential` route only supports sending VCs of the same
         type, but there can be more than one of them. The above `isBatchRequest`
@@ -326,23 +314,13 @@ export async function createRoutes({
           return;
         }
 
-        // send VCs
+        // format VC(s)
         const {
-          response: {verifiablePresentation: {verifiableCredential}},
+          response: {verifiablePresentation},
           format
         } = result;
-        // FIXME: "format" doesn't seem to be in the spec anymore (draft 14+)...
-        result = verifiableCredential.map(vc => {
-          // parse any enveloped VC
-          let credential;
-          if(vc.type === 'EnvelopedVerifiableCredential' &&
-            vc.id?.startsWith('data:application/jwt,')) {
-            credential = vc.id.slice('data:application/jwt,'.length);
-          } else {
-            credential = vc;
-          }
-          return {format, credential};
-        });
+        result = _normalizeCredentials({verifiablePresentation})
+          .map(credential => ({format, credential}));
       } catch(error) {
         return _sendOID4Error({res, error});
       }
@@ -357,20 +335,14 @@ export async function createRoutes({
     cors(),
     getConfigMiddleware,
     getExchange,
-    asyncHandler(async (req, res) => {
-      let result;
-      try {
-        const {
-          authorizationRequest
-        } = await oid4vp.getAuthorizationRequest({req});
-        // construct and send authz request as unsecured JWT
-        result = new UnsecuredJWT(authorizationRequest).encode();
-        res.set('content-type', 'application/oauth-authz-req+jwt');
-      } catch(error) {
-        return _sendOID4Error({res, error});
-      }
-      res.send(result);
-    }));
+    asyncHandler(_handleOid4vpAuthzRequest));
+  // same as above but handling is based on specific client profile
+  app.get(
+    routes.profiledAuthorizationRequest,
+    cors(),
+    getConfigMiddleware,
+    getExchange,
+    asyncHandler(_handleOid4vpAuthzRequest));
 
   // an OID4VP verifier endpoint
   // receives an authorization response with vp_token
@@ -382,15 +354,64 @@ export async function createRoutes({
     validate({bodySchema: openIdAuthorizationResponseBody()}),
     getConfigMiddleware,
     getExchange,
-    asyncHandler(async (req, res) => {
-      let result;
-      try {
-        result = await oid4vp.processAuthorizationResponse({req});
-      } catch(error) {
-        return _sendOID4Error({res, error});
-      }
-      res.json(result);
-    }));
+    asyncHandler(_handleOid4vpAuthzResponse));
+  // same as above but handling is based on specific client profile
+  app.options(routes.profiledAuthorizationResponse, cors());
+  app.post(
+    routes.profiledAuthorizationResponse,
+    cors(),
+    urlencodedLarge,
+    validate({bodySchema: openIdAuthorizationResponseBody()}),
+    getConfigMiddleware,
+    getExchange,
+    asyncHandler(_handleOid4vpAuthzResponse));
+}
+
+function _camelToSnakeCase(s) {
+  return s.replace(/[A-Z]/g, (c, i) => (i === 0 ? '' : '_') + c.toLowerCase());
+}
+
+async function _handleOid4vpAuthzRequest(req, res) {
+  const {clientProfileId} = req.params;
+  let result;
+  try {
+    const {
+      authorizationRequest,
+      clientProfile
+    } = await oid4vp.getAuthorizationRequest({req, clientProfileId});
+    const {config: workflow} = req.serviceObject;
+    result = await oid4vp.encodeAuthorizationRequest({
+      workflow, clientProfile, authorizationRequest
+    });
+    res.set('content-type', 'application/oauth-authz-req+jwt');
+  } catch(error) {
+    return _sendOID4Error({res, error});
+  }
+  res.send(result);
+}
+
+async function _handleOid4vpAuthzResponse(req, res) {
+  const {clientProfileId} = req.params;
+  let result;
+  try {
+    result = await oid4vp.processAuthorizationResponse({req, clientProfileId});
+  } catch(error) {
+    return _sendOID4Error({res, error});
+  }
+  res.json(result);
+}
+
+function _normalizeCredentials({verifiablePresentation}) {
+  // use raw format for each credential
+  const {verifiableCredential} = verifiablePresentation;
+  return verifiableCredential.map(vc => {
+    // parse any enveloped VC into its non-VC format
+    if(vc.type === 'EnvelopedVerifiableCredential' &&
+      vc.id?.startsWith('data:application/jwt,')) {
+      return vc.id.slice('data:application/jwt,'.length);
+    }
+    return vc;
+  });
 }
 
 function _sendOID4Error({res, error}) {
@@ -412,7 +433,3 @@ function _sendOID4Error({res, error}) {
   }
   res.status(status).json(oid4Error);
 }
-
-function _camelToSnakeCase(s) {
-  return s.replace(/[A-Z]/g, (c, i) => (i === 0 ? '' : '_') + c.toLowerCase());
-}

package/lib/oid4/oid4vci.js

@@ -5,7 +5,7 @@ import * as bedrock from '@bedrock/core';
 import * as exchanges from '../exchanges.js';
 import {
   deepEqual, emitExchangeUpdated,
-  evaluateTemplate, getWorkflowIssuerInstances, validateStep
+  evaluateExchangeStep, getWorkflowIssuerInstances
 } from '../helpers.js';
 import {importJWK, SignJWT} from 'jose';
 import {checkAccessToken} from '@bedrock/oauth2-verifier';
@@ -84,6 +84,36 @@ export async function getJwks({req}) {
   return [exchange.openId.oauth2.keyPair.publicKeyJwk];
 }
 
+export function getOID4VCIProtocols({workflow, exchange}) {
+  if(!supportsOID4VCI({exchange})) {
+    return {};
+  }
+  // OID4VCI supported; add credential offer URL
+  const exchangeId = `${workflow.id}/exchanges/${exchange.id}`;
+  const searchParams = new URLSearchParams();
+  const uri = `${exchangeId}/openid/credential-offer`;
+  searchParams.set('credential_offer_uri', uri);
+  return {OID4VCI: `openid-credential-offer://?${searchParams}`};
+}
+
+export async function initExchange({workflow, exchange} = {}) {
+  if(!supportsOID4VCI({exchange})) {
+    return;
+  }
+
+  // either issuer instances or a single issuer zcap be given if
+  // any expected credential requests are given
+  const {expectedCredentialRequests} = exchange.openId;
+  if(expectedCredentialRequests &&
+    !(workflow.issuerInstances || workflow.zcaps.issue)) {
+    throw new BedrockError(
+      'Credential requests are not supported by this workflow.', {
+        name: 'DataError',
+        details: {httpStatusCode: 400, public: true}
+      });
+  }
+}
+
 export async function processAccessTokenRequest({req}) {
   const exchangeRecord = await req.getExchange();
   const {exchange} = exchangeRecord;
@@ -432,14 +462,7 @@ async function _processExchange({
     // process exchange step if present
     const currentStep = exchange.step;
     if(currentStep) {
-      step = workflow.steps[exchange.step];
-      if(step.stepTemplate) {
-        // generate step from the template; assume the template type is
-        // `jsonata` per the JSON schema
-        step = await evaluateTemplate(
-          {workflow, exchange, typedTemplate: step.stepTemplate});
-      }
-      await validateStep({step});
+      step = await evaluateExchangeStep({workflow, exchange});
       const {jwtDidProofRequest} = step;
 
       // check to see if step supports OID4VP during OID4VCI
@@ -449,9 +472,14 @@ async function _processExchange({
         if(!results?.[exchange.step]?.openId?.presentationSubmission) {
           // FIXME: optimize away double step-template processing that
           // currently occurs when calling `_getAuthorizationRequest`
+          // note: only the "default" `clientProfileId` is supported at this
+          // time because there isn't presently a defined way to specify
+          // alternatives
+          const clientProfileId = step.openId.clientProfiles ?
+            'default' : undefined;
           const {
             authorizationRequest
-          } = await getAuthorizationRequest({req});
+          } = await getAuthorizationRequest({req, clientProfileId});
           return _requestOID4VP({authorizationRequest, res});
         }
         // otherwise drop down below to complete exchange...