@credo-ts/openid4vc 0.6.0-pr-2088-20241109180557 → 0.6.0-pr-2088-20241116152443

package/build/openid4vc-issuer/OpenId4VcIssuerServiceOptions.d.ts

@@ -1,5 +1,5 @@
 import type { OpenId4VcIssuanceSessionRecord, OpenId4VcIssuerRecordProps } from './repository';
-import type { OpenId4VcSiopCreateAuthorizationRequestReturn, OpenId4VcSiopVerifiedAuthorizationResponse, OpenId4VcVerificationSessionRecord } from '../openid4vc-verifier';
+import type { OpenId4VcSiopCreateAuthorizationRequestReturn, OpenId4VcSiopVerifiedAuthorizationResponsePresentationExchange, OpenId4VcVerificationSessionRecord } from '../openid4vc-verifier';
 import type { OpenId4VcCredentialHolderBindingWithKey, OpenId4VciCredentialConfigurationsSupportedWithFormats, OpenId4VciCredentialOfferPayload, OpenId4VciCredentialRequest, OpenId4VciCredentialRequestFormatSpecific, OpenId4VciCredentialIssuerMetadataDisplay, OpenId4VciTxCode } from '../shared';
 import type { OpenId4VciAuthorizationServerConfig } from '../shared/models/OpenId4VciAuthorizationServerConfig';
 import type { AccessTokenProfileJwtPayload, TokenIntrospectionResponse } from '@animo-id/oauth2';
@@ -51,13 +51,29 @@ export interface OpenId4VciAuthorizationCodeFlowConfig {
      */
     requirePresentationDuringIssuance?: boolean;
 }
-export interface OpenId4VciCreateCredentialOfferOptions {
+interface OpenId4VciCreateCredentialOfferOptionsBase {
     offeredCredentials: string[];
     /**
      * baseUri for the credential offer uri. By default `openid-credential-offer://` will be used
      * if no value is provided. If a value is provided, make sure it contains the scheme as well as `://`.
      */
     baseUri?: string;
+    /**
+     * @default v1.draft11-13
+     */
+    version?: 'v1.draft11-13' | 'v1.draft13';
+}
+export interface OpenId4VciCreateStatelessCredentialOfferOptions extends OpenId4VciCreateCredentialOfferOptionsBase {
+    authorizationCodeFlowConfig: Required<Pick<OpenId4VciAuthorizationCodeFlowConfig, 'authorizationServerUrl'>>;
+    /**
+     * For stateless credential offers we need an external authorization server, which also means we need to
+     * support `authorization_servers`, therefore only draft 13 offers are supported
+     *
+     * @default v1.draft13
+     */
+    version?: 'v1.draft13';
+}
+export interface OpenId4VciCreateCredentialOfferOptions extends OpenId4VciCreateCredentialOfferOptionsBase {
     preAuthorizedCodeFlowConfig?: OpenId4VciPreAuthorizedCodeFlowConfig;
     authorizationCodeFlowConfig?: OpenId4VciAuthorizationCodeFlowConfig;
     /**
@@ -67,10 +83,6 @@ export interface OpenId4VciCreateCredentialOfferOptions {
      * data.
      */
     issuanceMetadata?: Record<string, unknown>;
-    /**
-     * @default v1.draft11-13
-     */
-    version?: 'v1.draft11-13' | 'v1.draft13';
 }
 export interface OpenId4VciCreateCredentialResponseOptions {
     credentialRequest: OpenId4VciCredentialRequest;
@@ -104,8 +116,17 @@ export type OpenId4VciGetVerificationSessionForIssuanceSessionAuthorization = (o
      * parameter
      */
     scopes: string[];
-}) => Promise<OpenId4VcSiopCreateAuthorizationRequestReturn>;
-export type OpenId4VciCredentialRequestToCredentialMapper = (options: {
+}) => Promise<OpenId4VcSiopCreateAuthorizationRequestReturn & {
+    /**
+     * The scopes which will be granted by successfully completing the verification
+     * session.
+     *
+     * @todo do we need more granular support? I.e. every input descriptor can satisfy a
+     * different scope?
+     */
+    scopes: string[];
+}>;
+export interface OpenId4VciCredentialRequestToCredentialMapperOptions {
     agentContext: AgentContext;
     /**
      * Authorization associated with the credential request
@@ -118,7 +139,7 @@ export type OpenId4VciCredentialRequestToCredentialMapper = (options: {
      */
     verification?: {
         session: OpenId4VcVerificationSessionRecord;
-        response: OpenId4VcSiopVerifiedAuthorizationResponse;
+        presentationExchange: OpenId4VcSiopVerifiedAuthorizationResponsePresentationExchange;
     };
     /**
      * The issuance session associated with the credential request. You can extract the
@@ -157,7 +178,8 @@ export type OpenId4VciCredentialRequestToCredentialMapper = (options: {
      * NOTE: This will probably become a single entry, as it will be matched on id
      */
     credentialConfigurationIds: [string, ...string[]];
-}) => Promise<OpenId4VciSignCredentials> | OpenId4VciSignCredentials;
+}
+export type OpenId4VciCredentialRequestToCredentialMapper = (options: OpenId4VciCredentialRequestToCredentialMapperOptions) => Promise<OpenId4VciSignCredentials> | OpenId4VciSignCredentials;
 export type OpenId4VciSignCredentials = OpenId4VciSignSdJwtCredentials | OpenId4VciSignW3cCredentials | OpenId4VciSignMdocCredentials;
 export interface OpenId4VciSignSdJwtCredentials {
     credentialConfigurationId: string;
@@ -177,6 +199,12 @@ export interface OpenId4VciSignW3cCredentials {
         credential: W3cCredential;
     }>;
 }
+export interface OpenId4VciBatchCredentialIssuanceOptions {
+    /**
+     * The maximum batch size
+     */
+    batchSize: number;
+}
 export type OpenId4VciCreateIssuerOptions = {
     /**
      * Id of the issuer, not the id of the issuer record. Will be exposed publicly
@@ -192,5 +220,10 @@ export type OpenId4VciCreateIssuerOptions = {
     authorizationServerConfigs?: OpenId4VciAuthorizationServerConfig[];
     dpopSigningAlgValuesSupported?: [JwaSignatureAlgorithm, ...JwaSignatureAlgorithm[]];
     credentialConfigurationsSupported: OpenId4VciCredentialConfigurationsSupportedWithFormats;
+    /**
+     * Indicate support for batch issuane of credentials
+     */
+    batchCredentialIssuance?: OpenId4VciBatchCredentialIssuanceOptions;
 };
-export type OpenId4VcUpdateIssuerRecordOptions = Pick<OpenId4VcIssuerRecordProps, 'issuerId' | 'display' | 'dpopSigningAlgValuesSupported' | 'credentialConfigurationsSupported'>;
+export type OpenId4VcUpdateIssuerRecordOptions = Pick<OpenId4VcIssuerRecordProps, 'issuerId' | 'display' | 'dpopSigningAlgValuesSupported' | 'credentialConfigurationsSupported' | 'batchCredentialIssuance'>;
+export {};

package/build/openid4vc-issuer/repository/OpenId4VcIssuanceSessionRecord.d.ts

@@ -17,6 +17,16 @@ export interface OpenId4VcIssuanceSessionAuthorization {
      * is used to bind the subsequent Authorization Request with the Credential Issuer to a context set up during previous steps.
      */
     issuerState?: string;
+    /**
+     * Scopes that are granted when the authorization is complete.
+     */
+    scopes?: string[];
+    /**
+     * Subject the issuance session is bound to. For internal authorization this will be defined
+     * from the moment the token is issued. For external authorization this will be defined after
+     * the first time the credential endpoint has been called.
+     */
+    subject?: string;
 }
 export interface OpenId4VcIssuanceSessionPresentation {
     /**
@@ -25,7 +35,6 @@ export interface OpenId4VcIssuanceSessionPresentation {
     required: true;
     /**
      * Auth session for the presentation during issuance flow
-     * @todo can't we use some other param for this, or maybe a JWT so it's stateless?
      */
     authSession?: string;
     /**
@@ -41,6 +50,8 @@ export type DefaultOpenId4VcIssuanceSessionRecordTags = {
     preAuthorizedCode?: string;
     authorizationCode?: string;
     issuerState?: string;
+    authorizationSubject?: string;
+    presentationAuthSession?: string;
 };
 export interface OpenId4VcIssuanceSessionRecordProps {
     id?: string;
@@ -48,7 +59,6 @@ export interface OpenId4VcIssuanceSessionRecordProps {
     tags?: TagsBase;
     state: OpenId4VcIssuanceSessionState;
     issuerId: string;
-    dpopRequired?: boolean;
     /**
      * Client id will mostly be used when doing auth flow
      */
@@ -108,7 +118,6 @@ export declare class OpenId4VcIssuanceSessionRecord extends BaseRecord<DefaultOp
         codeChallengeMethod: PkceCodeChallengeMethod;
         codeChallenge: string;
     };
-    dpopRequired?: boolean;
     /**
      * Authorization code flow specific metadata values
      */
@@ -145,5 +154,7 @@ export declare class OpenId4VcIssuanceSessionRecord extends BaseRecord<DefaultOp
         preAuthorizedCode: string | undefined;
         issuerState: string | undefined;
         authorizationCode: string | undefined;
+        authorizationSubject: string | undefined;
+        presentationAuthSession: string | undefined;
     };
 }

package/build/openid4vc-issuer/repository/OpenId4VcIssuanceSessionRecord.js

@@ -31,7 +31,6 @@ class OpenId4VcIssuanceSessionRecord extends core_1.BaseRecord {
             this.userPin = props.userPin;
             this.preAuthorizedCode = props.preAuthorizedCode;
             this.pkce = props.pkce;
-            this.dpopRequired = props.dpopRequired;
             this.authorization = props.authorization;
             this.credentialOfferUri = props.credentialOfferUri;
             this.credentialOfferPayload = props.credentialOfferPayload;
@@ -49,12 +48,14 @@ class OpenId4VcIssuanceSessionRecord extends core_1.BaseRecord {
         }
     }
     getTags() {
-        var _a, _b;
+        var _a, _b, _c, _d;
         return Object.assign(Object.assign({}, this._tags), { issuerId: this.issuerId, credentialOfferUri: this.credentialOfferUri, state: this.state, 
             // Pre-auth flow
             preAuthorizedCode: this.preAuthorizedCode, 
             // Auth flow
-            issuerState: (_a = this.authorization) === null || _a === void 0 ? void 0 : _a.issuerState, authorizationCode: (_b = this.authorization) === null || _b === void 0 ? void 0 : _b.code });
+            issuerState: (_a = this.authorization) === null || _a === void 0 ? void 0 : _a.issuerState, authorizationCode: (_b = this.authorization) === null || _b === void 0 ? void 0 : _b.code, authorizationSubject: (_c = this.authorization) === null || _c === void 0 ? void 0 : _c.subject, 
+            // Presentation during issuance
+            presentationAuthSession: (_d = this.presentation) === null || _d === void 0 ? void 0 : _d.authSession });
     }
 }
 exports.OpenId4VcIssuanceSessionRecord = OpenId4VcIssuanceSessionRecord;
@@ -69,4 +70,19 @@ __decorate([
     }),
     __metadata("design:type", String)
 ], OpenId4VcIssuanceSessionRecord.prototype, "state", void 0);
+__decorate([
+    (0, class_transformer_1.Transform)(({ type, value }) => {
+        if (type === class_transformer_1.TransformationType.PLAIN_TO_CLASS && (0, core_1.isJsonObject)(value) && typeof value.codeExpiresAt === 'string') {
+            return Object.assign(Object.assign({}, value), { codeExpiresAt: new Date(value.codeExpiresAt) });
+        }
+        if (type === class_transformer_1.TransformationType.CLASS_TO_CLASS && (0, core_1.isJsonObject)(value) && value.codeExpiresAt instanceof Date) {
+            return Object.assign(Object.assign({}, value), { codeExpiresAt: new Date(value.codeExpiresAt.getTime()) });
+        }
+        if (type === class_transformer_1.TransformationType.CLASS_TO_PLAIN && (0, core_1.isJsonObject)(value) && value.codeExpiresAt instanceof Date) {
+            return Object.assign(Object.assign({}, value), { codeExpiresAt: value.codeExpiresAt.toISOString() });
+        }
+        return value;
+    }),
+    __metadata("design:type", Object)
+], OpenId4VcIssuanceSessionRecord.prototype, "authorization", void 0);
 //# sourceMappingURL=OpenId4VcIssuanceSessionRecord.js.map

package/build/openid4vc-issuer/repository/OpenId4VcIssuanceSessionRecord.js.map

@@ -1 +1 @@
-{"version":3,"file":"OpenId4VcIssuanceSessionRecord.js","sourceRoot":"","sources":["../../../src/openid4vc-issuer/repository/OpenId4VcIssuanceSessionRecord.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,yCAA8D;AAC9D,yDAA6C;AAE7C,oFAAgF;AAiGhF,MAAa,8BAA+B,SAAQ,iBAAqD;IAsFvG,YAAmB,KAA0C;;QAC3D,KAAK,EAAE,CAAA;QArFO,SAAI,GAAG,8BAA8B,CAAC,IAAI,CAAA;QAoB1D;;WAEG;QACI,sBAAiB,GAAa,EAAE,CAAA;QAgErC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,EAAE,GAAG,MAAA,KAAK,CAAC,EAAE,mCAAI,YAAK,CAAC,IAAI,EAAE,CAAA;YAClC,IAAI,CAAC,SAAS,GAAG,MAAA,KAAK,CAAC,SAAS,mCAAI,IAAI,IAAI,EAAE,CAAA;YAC9C,IAAI,CAAC,KAAK,GAAG,MAAA,KAAK,CAAC,IAAI,mCAAI,EAAE,CAAA;YAE7B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;YAC9B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;YAC9B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;YAC5B,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAA;YAChD,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;YACtB,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;YACtC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAA;YACxC,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAA;YAClD,IAAI,CAAC,sBAAsB,GAAG,KAAK,CAAC,sBAAsB,CAAA;YAC1D,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAA;YAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;YACxB,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;QACxC,CAAC;IACH,CAAC;IAEM,WAAW,CAAC,cAA+E;QAChG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,cAAc,GAAG,CAAC,cAAc,CAAC,CAAA;QACnC,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,iBAAU,CAClB,sDAAsD,IAAI,CAAC,KAAK,uBAAuB,cAAc,CAAC,IAAI,CACxG,IAAI,CACL,GAAG,CACL,CAAA;QACH,CAAC;IACH,CAAC;IAEM,OAAO;;QACZ,uCACK,IAAI,CAAC,KAAK,KACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,EACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAC3C,KAAK,EAAE,IAAI,CAAC,KAAK;YAEjB,gBAAgB;YAChB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YAEzC,YAAY;YACZ,WAAW,EAAE,MAAA,IAAI,CAAC,aAAa,0CAAE,WAAW,EAC5C,iBAAiB,EAAE,MAAA,IAAI,CAAC,aAAa,0CAAE,IAAI,IAC5C;IACH,CAAC;;AAzIH,wEA0IC;AAzIwB,mCAAI,GAAG,gCAAgC,AAAnC,CAAmC;AAmBvD;IARN,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,yFAAyF;QACzF,IAAI,KAAK,KAAK,kBAAkB,EAAE,CAAC;YACjC,OAAO,6DAA6B,CAAC,KAAK,CAAA;QAC5C,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC;;6DAC0C"}
+{"version":3,"file":"OpenId4VcIssuanceSessionRecord.js","sourceRoot":"","sources":["../../../src/openid4vc-issuer/repository/OpenId4VcIssuanceSessionRecord.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,yCAA4E;AAC5E,yDAAiE;AAEjE,oFAAgF;AA+GhF,MAAa,8BAA+B,SAAQ,iBAAqD;IA0GvG,YAAmB,KAA0C;;QAC3D,KAAK,EAAE,CAAA;QAzGO,SAAI,GAAG,8BAA8B,CAAC,IAAI,CAAA;QAoB1D;;WAEG;QACI,sBAAiB,GAAa,EAAE,CAAA;QAoFrC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,EAAE,GAAG,MAAA,KAAK,CAAC,EAAE,mCAAI,YAAK,CAAC,IAAI,EAAE,CAAA;YAClC,IAAI,CAAC,SAAS,GAAG,MAAA,KAAK,CAAC,SAAS,mCAAI,IAAI,IAAI,EAAE,CAAA;YAC9C,IAAI,CAAC,KAAK,GAAG,MAAA,KAAK,CAAC,IAAI,mCAAI,EAAE,CAAA;YAE7B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;YAC9B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;YAC9B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;YAC5B,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAA;YAChD,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;YACtB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAA;YACxC,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAA;YAClD,IAAI,CAAC,sBAAsB,GAAG,KAAK,CAAC,sBAAsB,CAAA;YAC1D,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAA;YAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;YACxB,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;QACxC,CAAC;IACH,CAAC;IAEM,WAAW,CAAC,cAA+E;QAChG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,cAAc,GAAG,CAAC,cAAc,CAAC,CAAA;QACnC,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,iBAAU,CAClB,sDAAsD,IAAI,CAAC,KAAK,uBAAuB,cAAc,CAAC,IAAI,CACxG,IAAI,CACL,GAAG,CACL,CAAA;QACH,CAAC;IACH,CAAC;IAEM,OAAO;;QACZ,uCACK,IAAI,CAAC,KAAK,KACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,EACvB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAC3C,KAAK,EAAE,IAAI,CAAC,KAAK;YAEjB,gBAAgB;YAChB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YAEzC,YAAY;YACZ,WAAW,EAAE,MAAA,IAAI,CAAC,aAAa,0CAAE,WAAW,EAC5C,iBAAiB,EAAE,MAAA,IAAI,CAAC,aAAa,0CAAE,IAAI,EAE3C,oBAAoB,EAAE,MAAA,IAAI,CAAC,aAAa,0CAAE,OAAO;YAEjD,+BAA+B;YAC/B,uBAAuB,EAAE,MAAA,IAAI,CAAC,YAAY,0CAAE,WAAW,IACxD;IACH,CAAC;;AAjKH,wEAkKC;AAjKwB,mCAAI,GAAG,gCAAgC,AAAnC,CAAmC;AAmBvD;IARN,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,yFAAyF;QACzF,IAAI,KAAK,KAAK,kBAAkB,EAAE,CAAC;YACjC,OAAO,6DAA6B,CAAC,KAAK,CAAA;QAC5C,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC;;6DAC0C;AAwDrC;IAtBN,IAAA,6BAAS,EAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QAC7B,IAAI,IAAI,KAAK,sCAAkB,CAAC,cAAc,IAAI,IAAA,mBAAY,EAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YACjH,uCACK,KAAK,KACR,aAAa,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAC7C;QACH,CAAC;QACD,IAAI,IAAI,KAAK,sCAAkB,CAAC,cAAc,IAAI,IAAA,mBAAY,EAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,YAAY,IAAI,EAAE,CAAC;YAC7G,uCACK,KAAK,KACR,aAAa,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,IACvD;QACH,CAAC;QACD,IAAI,IAAI,KAAK,sCAAkB,CAAC,cAAc,IAAI,IAAA,mBAAY,EAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,YAAY,IAAI,EAAE,CAAC;YAC7G,uCACK,KAAK,KACR,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,IACjD;QACH,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC;;qEAC0D"}

package/build/openid4vc-issuer/repository/OpenId4VcIssuerRecord.d.ts

@@ -1,4 +1,5 @@
 import type { OpenId4VciAuthorizationServerConfig, OpenId4VciCredentialConfigurationsSupportedWithFormats, OpenId4VciCredentialIssuerMetadataDisplay } from '../../shared';
+import type { OpenId4VciBatchCredentialIssuanceOptions } from '../OpenId4VcIssuerServiceOptions';
 import type { JwaSignatureAlgorithm, RecordTags, TagsBase } from '@credo-ts/core';
 import { BaseRecord } from '@credo-ts/core';
 export type OpenId4VcIssuerRecordTags = RecordTags<OpenId4VcIssuerRecord>;
@@ -23,9 +24,13 @@ export type OpenId4VcIssuerRecordProps = {
     display?: OpenId4VciCredentialIssuerMetadataDisplay[];
     authorizationServerConfigs?: OpenId4VciAuthorizationServerConfig[];
     credentialConfigurationsSupported: OpenId4VciCredentialConfigurationsSupportedWithFormats;
+    /**
+     * Indicate support for batch issuane of credentials
+     */
+    batchCredentialIssuance?: OpenId4VciBatchCredentialIssuanceOptions;
 };
 /**
- * For OID4VC you need to expos metadata files. Each issuer needs to host this metadata. This is not the case for DIDComm where we can just have one /didcomm endpoint.
+ * For OID4VC you need to expose metadata files. Each issuer needs to host this metadata. This is not the case for DIDComm where we can just have one /didcomm endpoint.
  * So we create a record per openid issuer/verifier that you want, and each tenant can create multiple issuers/verifiers which have different endpoints
  * and metadata files
  * */
@@ -34,11 +39,16 @@ export declare class OpenId4VcIssuerRecord extends BaseRecord<DefaultOpenId4VcIs
     readonly type = "OpenId4VcIssuerRecord";
     issuerId: string;
     accessTokenPublicKeyFingerprint: string;
-    credentialsSupported?: Array<unknown>;
-    credentialConfigurationsSupported?: OpenId4VciCredentialConfigurationsSupportedWithFormats;
+    /**
+     * Only here for class transformation. If credentialsSupported is set we transform
+     * it to the new credentialConfigurationsSupported format
+     */
+    private set credentialsSupported(value);
+    credentialConfigurationsSupported: OpenId4VciCredentialConfigurationsSupportedWithFormats;
     display?: OpenId4VciCredentialIssuerMetadataDisplay[];
     authorizationServerConfigs?: OpenId4VciAuthorizationServerConfig[];
     dpopSigningAlgValuesSupported?: [JwaSignatureAlgorithm, ...JwaSignatureAlgorithm[]];
+    batchCredentialIssuance?: OpenId4VciBatchCredentialIssuanceOptions;
     constructor(props: OpenId4VcIssuerRecordProps);
     getTags(): {
         issuerId: string;

package/build/openid4vc-issuer/repository/OpenId4VcIssuerRecord.js

@@ -1,13 +1,46 @@
 "use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OpenId4VcIssuerRecord = void 0;
+const oid4vci_1 = require("@animo-id/oid4vci");
 const core_1 = require("@credo-ts/core");
+const class_transformer_1 = require("class-transformer");
 /**
- * For OID4VC you need to expos metadata files. Each issuer needs to host this metadata. This is not the case for DIDComm where we can just have one /didcomm endpoint.
+ * For OID4VC you need to expose metadata files. Each issuer needs to host this metadata. This is not the case for DIDComm where we can just have one /didcomm endpoint.
  * So we create a record per openid issuer/verifier that you want, and each tenant can create multiple issuers/verifiers which have different endpoints
  * and metadata files
  * */
 class OpenId4VcIssuerRecord extends core_1.BaseRecord {
+    /**
+     * Only here for class transformation. If credentialsSupported is set we transform
+     * it to the new credentialConfigurationsSupported format
+     */
+    set credentialsSupported(credentialsSupported) {
+        if (this.credentialConfigurationsSupported)
+            return;
+        this.credentialConfigurationsSupported =
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (0, oid4vci_1.credentialsSupportedToCredentialConfigurationsSupported)(credentialsSupported);
+    }
     constructor(props) {
         var _a, _b, _c;
         super();
@@ -22,6 +55,7 @@ class OpenId4VcIssuerRecord extends core_1.BaseRecord {
             this.dpopSigningAlgValuesSupported = props.dpopSigningAlgValuesSupported;
             this.display = props.display;
             this.authorizationServerConfigs = props.authorizationServerConfigs;
+            this.batchCredentialIssuance = props.batchCredentialIssuance;
         }
     }
     getTags() {
@@ -30,4 +64,20 @@ class OpenId4VcIssuerRecord extends core_1.BaseRecord {
 }
 exports.OpenId4VcIssuerRecord = OpenId4VcIssuerRecord;
 OpenId4VcIssuerRecord.type = 'OpenId4VcIssuerRecord';
+__decorate([
+    (0, class_transformer_1.Transform)(({ type, value }) => {
+        if (type === class_transformer_1.TransformationType.PLAIN_TO_CLASS && Array.isArray(value)) {
+            return value.map((display) => {
+                var _a, _b;
+                if ((_a = display.logo) === null || _a === void 0 ? void 0 : _a.uri)
+                    return display;
+                const _c = (_b = display.logo) !== null && _b !== void 0 ? _b : {}, { url } = _c, logoRest = __rest(_c, ["url"]);
+                return Object.assign(Object.assign({}, display), { logo: url
+                        ? Object.assign(Object.assign({}, logoRest), { uri: url }) : undefined });
+            });
+        }
+        return value;
+    }),
+    __metadata("design:type", Array)
+], OpenId4VcIssuerRecord.prototype, "display", void 0);
 //# sourceMappingURL=OpenId4VcIssuerRecord.js.map

package/build/openid4vc-issuer/repository/OpenId4VcIssuerRecord.js.map

@@ -1 +1 @@
-{"version":3,"file":"OpenId4VcIssuerRecord.js","sourceRoot":"","sources":["../../../src/openid4vc-issuer/repository/OpenId4VcIssuerRecord.ts"],"names":[],"mappings":";;;AAOA,yCAAkD;AAmClD;;;;KAIK;AACL,MAAa,qBAAsB,SAAQ,iBAA4C;IAcrF,YAAmB,KAAiC;;QAClD,KAAK,EAAE,CAAA;QAbO,SAAI,GAAG,qBAAqB,CAAC,IAAI,CAAA;QAe/C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,EAAE,GAAG,MAAA,KAAK,CAAC,EAAE,mCAAI,YAAK,CAAC,IAAI,EAAE,CAAA;YAClC,IAAI,CAAC,SAAS,GAAG,MAAA,KAAK,CAAC,SAAS,mCAAI,IAAI,IAAI,EAAE,CAAA;YAC9C,IAAI,CAAC,KAAK,GAAG,MAAA,KAAK,CAAC,IAAI,mCAAI,EAAE,CAAA;YAE7B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;YAC9B,IAAI,CAAC,+BAA+B,GAAG,KAAK,CAAC,+BAA+B,CAAA;YAC5E,IAAI,CAAC,iCAAiC,GAAG,KAAK,CAAC,iCAAiC,CAAA;YAChF,IAAI,CAAC,6BAA6B,GAAG,KAAK,CAAC,6BAA6B,CAAA;YACxE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;YAC5B,IAAI,CAAC,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAA;QACpE,CAAC;IACH,CAAC;IAEM,OAAO;QACZ,uCACK,IAAI,CAAC,KAAK,KACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,IACxB;IACH,CAAC;;AApCH,sDAqCC;AApCwB,0BAAI,GAAG,uBAAuB,AAA1B,CAA0B"}
+{"version":3,"file":"OpenId4VcIssuerRecord.js","sourceRoot":"","sources":["../../../src/openid4vc-issuer/repository/OpenId4VcIssuerRecord.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAQA,+CAA2F;AAC3F,yCAAkD;AAClD,yDAAiE;AAsCjE;;;;KAIK;AACL,MAAa,qBAAsB,SAAQ,iBAA4C;IAOrF;;;OAGG;IACH,IAAY,oBAAoB,CAAC,oBAAoC;QACnE,IAAI,IAAI,CAAC,iCAAiC;YAAE,OAAM;QAElD,IAAI,CAAC,iCAAiC;YACpC,8DAA8D;YAC9D,IAAA,iEAAuD,EAAC,oBAA2B,CAAQ,CAAA;IAC/F,CAAC;IA8BD,YAAmB,KAAiC;;QAClD,KAAK,EAAE,CAAA;QA9CO,SAAI,GAAG,qBAAqB,CAAC,IAAI,CAAA;QAgD/C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,EAAE,GAAG,MAAA,KAAK,CAAC,EAAE,mCAAI,YAAK,CAAC,IAAI,EAAE,CAAA;YAClC,IAAI,CAAC,SAAS,GAAG,MAAA,KAAK,CAAC,SAAS,mCAAI,IAAI,IAAI,EAAE,CAAA;YAC9C,IAAI,CAAC,KAAK,GAAG,MAAA,KAAK,CAAC,IAAI,mCAAI,EAAE,CAAA;YAE7B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;YAC9B,IAAI,CAAC,+BAA+B,GAAG,KAAK,CAAC,+BAA+B,CAAA;YAC5E,IAAI,CAAC,iCAAiC,GAAG,KAAK,CAAC,iCAAiC,CAAA;YAChF,IAAI,CAAC,6BAA6B,GAAG,KAAK,CAAC,6BAA6B,CAAA;YACxE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;YAC5B,IAAI,CAAC,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAA;YAClE,IAAI,CAAC,uBAAuB,GAAG,KAAK,CAAC,uBAAuB,CAAA;QAC9D,CAAC;IACH,CAAC;IAEM,OAAO;QACZ,uCACK,IAAI,CAAC,KAAK,KACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,IACxB;IACH,CAAC;;AAtEH,sDAuEC;AAtEwB,0BAAI,GAAG,uBAAuB,AAA1B,CAA0B;AAyC9C;IApBN,IAAA,6BAAS,EAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QAC7B,IAAI,IAAI,KAAK,sCAAkB,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;;gBAC3B,IAAI,MAAA,OAAO,CAAC,IAAI,0CAAE,GAAG;oBAAE,OAAO,OAAO,CAAA;gBAErC,MAAM,KAAuB,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,EAAzC,EAAE,GAAG,OAAoC,EAA/B,QAAQ,cAAlB,OAAoB,CAAqB,CAAA;gBAC/C,uCACK,OAAO,KACV,IAAI,EAAE,GAAG;wBACP,CAAC,iCACM,QAAQ,KACX,GAAG,EAAE,GAAG,IAEZ,CAAC,CAAC,SAAS,IACd;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC;;sDAC0D"}

package/build/openid4vc-issuer/router/accessTokenEndpoint.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.configureAccessTokenEndpoint = configureAccessTokenEndpoint;
 exports.handleTokenRequest = handleTokenRequest;
 const oauth2_1 = require("@animo-id/oauth2");
-const oid4vci_1 = require("@animo-id/oid4vci");
 const core_1 = require("@credo-ts/core");
 const router_1 = require("../../shared/router");
 const utils_1 = require("../../shared/utils");
@@ -15,7 +14,7 @@ function configureAccessTokenEndpoint(router, config) {
 }
 function handleTokenRequest(config) {
     return async (request, response, next) => {
-        var _a, _b, _c;
+        var _a, _b, _c, _d;
         response.set({ 'Cache-Control': 'no-store', Pragma: 'no-cache' });
         const requestContext = (0, router_1.getRequestContext)(request);
         const { agentContext, issuer } = requestContext;
@@ -32,7 +31,6 @@ function handleTokenRequest(config) {
             method: request.method,
             url: fullRequestUrl,
         };
-        // What error does this throw?
         const { accessTokenRequest, grant, dpopJwt, pkceCodeVerifier } = oauth2AuthorizationServer.parseAccessTokenRequest({
             accessTokenRequest: request.body,
             request: requestLike,
@@ -50,6 +48,16 @@ function handleTokenRequest(config) {
                 error_description: 'Invalid authorization code',
             });
         }
+        if (Date.now() >
+            (0, utils_1.addSecondsToDate)(issuanceSession.createdAt, config.statefullCredentialOfferExpirationInSeconds).getTime()) {
+            issuanceSession.errorMessage = 'Credential offer has expired';
+            await openId4VcIssuerService.updateState(agentContext, issuanceSession, OpenId4VcIssuanceSessionState_1.OpenId4VcIssuanceSessionState.Error);
+            throw new oauth2_1.Oauth2ServerErrorResponseError({
+                // What is the best error here?
+                error: oauth2_1.Oauth2ErrorCodes.InvalidGrant,
+                error_description: 'Session expired',
+            });
+        }
         let verificationResult;
         try {
             if (grant.grantType === oauth2_1.preAuthorizedCodeGrantIdentifier) {
@@ -68,10 +76,12 @@ function handleTokenRequest(config) {
                     request: requestLike,
                     dpop: {
                         jwt: dpopJwt,
-                        required: issuanceSession.dpopRequired,
+                        // This will only have effect when DPoP is not present.
+                        // If it is present it will always be verified
+                        required: config.dpopRequired,
                     },
                     expectedTxCode: issuanceSession.userPin,
-                    preAuthorizedCodeExpiresAt: (0, utils_1.addSecondsToDate)(issuanceSession.createdAt, config.preAuthorizedCodeExpirationInSeconds),
+                    preAuthorizedCodeExpiresAt: (0, utils_1.addSecondsToDate)(issuanceSession.createdAt, config.statefullCredentialOfferExpirationInSeconds),
                 });
             }
             else if (grant.grantType === oauth2_1.authorizationCodeGrantIdentifier) {
@@ -91,7 +101,9 @@ function handleTokenRequest(config) {
                     request: requestLike,
                     dpop: {
                         jwt: dpopJwt,
-                        required: issuanceSession.dpopRequired,
+                        // This will only have effect when DPoP is not present.
+                        // If it is present it will always be verified
+                        required: config.dpopRequired,
                     },
                     pkce: issuanceSession.pkce
                         ? {
@@ -110,35 +122,34 @@ function handleTokenRequest(config) {
             }
             await openId4VcIssuerService.updateState(agentContext, issuanceSession, OpenId4VcIssuanceSessionState_1.OpenId4VcIssuanceSessionState.AccessTokenRequested);
             const { cNonce, cNonceExpiresInSeconds } = await openId4VcIssuerService.createNonce(agentContext, issuer);
-            // Extract scopes
-            const scopes = (0, oid4vci_1.extractScopesForCredentialConfigurationIds)({
-                credentialConfigurationIds: issuanceSession.credentialOfferPayload.credential_configuration_ids,
-                issuerMetadata,
-            });
+            // for authorization code flow we take the authorization scopes. For pre-auth we don't use scopes (we just
+            // use the offered credential configuration ids so a scope is not required)
+            const scopes = grant.grantType === oauth2_1.authorizationCodeGrantIdentifier ? (_c = issuanceSession.authorization) === null || _c === void 0 ? void 0 : _c.scopes : undefined;
+            const subject = `credo:${core_1.utils.uuid()}`;
             const signerJwk = (0, core_1.getJwkFromKey)(accessTokenSigningKey);
             const accessTokenResponse = await oauth2AuthorizationServer.createAccessTokenResponse({
                 audience: issuerMetadata.credentialIssuer.credential_issuer,
                 authorizationServer: issuerMetadata.credentialIssuer.credential_issuer,
                 expiresInSeconds: config.accessTokenExpiresInSeconds,
-                // TODO: we need to include kid and also host the jwks?
-                // Or we should somehow bypass the jwks_uri resolving if we verify our own token (only we will verify the token)
                 signer: {
                     method: 'jwk',
                     alg: signerJwk.supportedSignatureAlgorithms[0],
                     publicJwk: signerJwk.toJson(),
                 },
                 dpopJwk: verificationResult.dpopJwk,
-                scope: scopes === null || scopes === void 0 ? void 0 : scopes.join(','),
+                scope: scopes === null || scopes === void 0 ? void 0 : scopes.join(' '),
                 clientId: issuanceSession.clientId,
                 additionalAccessTokenPayload: {
                     'pre-authorized_code': grant.grantType === oauth2_1.preAuthorizedCodeGrantIdentifier ? grant.preAuthorizedCode : undefined,
-                    issuer_state: (_c = issuanceSession.authorization) === null || _c === void 0 ? void 0 : _c.issuerState,
+                    issuer_state: (_d = issuanceSession.authorization) === null || _d === void 0 ? void 0 : _d.issuerState,
                 },
-                subject: grant.grantType === oauth2_1.preAuthorizedCodeGrantIdentifier ? grant.preAuthorizedCode : grant.code,
+                // We generate a random subject for each access token and bind the issuance session to this.
+                subject,
                 // NOTE: these have been removed in newer drafts. Keeping them in for now
                 cNonce,
                 cNonceExpiresIn: cNonceExpiresInSeconds,
             });
+            issuanceSession.authorization = Object.assign(Object.assign({}, issuanceSession.authorization), { subject });
             await openId4VcIssuerService.updateState(agentContext, issuanceSession, OpenId4VcIssuanceSessionState_1.OpenId4VcIssuanceSessionState.AccessTokenCreated);
             return (0, router_1.sendJsonResponse)(response, next, accessTokenResponse);
         }

package/build/openid4vc-issuer/router/accessTokenEndpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessTokenEndpoint.js","sourceRoot":"","sources":["../../../src/openid4vc-issuer/router/accessTokenEndpoint.ts"],"names":[],"mappings":";;AAyBA,oEAEC;AAED,gDAuKC;AA/LD,6CAKyB;AACzB,+CAA8E;AAC9E,yCAAiE;AAEjE,gDAK4B;AAC5B,8CAAqD;AACrD,oFAAgF;AAChF,sEAAkE;AAClE,8CAAkE;AAElE,SAAgB,4BAA4B,CAAC,MAAc,EAAE,MAAmC;IAC9F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,SAAgB,kBAAkB,CAAC,MAAmC;IACpE,OAAO,KAAK,EAAE,OAAiC,EAAE,QAAkB,EAAE,IAAkB,EAAE,EAAE;;QACzF,QAAQ,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;QACjE,MAAM,cAAc,GAAG,IAAA,0BAAiB,EAAC,OAAO,CAAC,CAAA;QACjD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,cAAc,CAAA;QAE/C,MAAM,sBAAsB,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,+CAAsB,CAAC,CAAA;QAC7F,MAAM,yBAAyB,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,+CAAkC,CAAC,CAAA;QAC5G,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,iBAAiB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;QAC3F,MAAM,qBAAqB,GAAG,UAAG,CAAC,eAAe,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAA;QACzF,MAAM,yBAAyB,GAAG,sBAAsB,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAA;QAEnG,MAAM,cAAc,GAAG,IAAA,mBAAY,EAAC,cAAc,CAAC,gBAAgB,CAAC,iBAAiB,EAAE;YACrF,MAAM,CAAC,uBAAuB;SAC/B,CAAC,CAAA;QACF,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,OAAiC,CAAC;YAC/D,MAAM,EAAE,OAAO,CAAC,MAAoB;YACpC,GAAG,EAAE,cAAc;SACX,CAAA;QAEV,8BAA8B;QAC9B,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,yBAAyB,CAAC,uBAAuB,CAAC;YACjH,kBAAkB,EAAE,OAAO,CAAC,IAAI;YAChC,OAAO,EAAE,WAAW;SACrB,CAAC,CAAA;QAEF,MAAM,eAAe,GAAG,MAAM,yBAAyB,CAAC,iBAAiB,CAAC,YAAY,EAAE;YACtF,iBAAiB,EAAE,KAAK,CAAC,SAAS,KAAK,yCAAgC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;YAC7G,iBAAiB,EAAE,KAAK,CAAC,SAAS,KAAK,yCAAgC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SACjG,CAAC,CAAA;QACF,MAAM,aAAa,GACjB,KAAK,CAAC,SAAS,KAAK,yCAAgC;YAClD,CAAC,CAAC,CAAC,6DAA6B,CAAC,YAAY,EAAE,6DAA6B,CAAC,iBAAiB,CAAC;YAC/F,CAAC,CAAC,CAAC,6DAA6B,CAAC,oBAAoB,CAAC,CAAA;QAC1D,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,uCAA8B,CAAC;gBACvC,KAAK,EAAE,yBAAgB,CAAC,YAAY;gBACpC,iBAAiB,EAAE,4BAA4B;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,kBAAkD,CAAA;QACtD,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,SAAS,KAAK,yCAAgC,EAAE,CAAC;gBACzD,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC;oBACvC,MAAM,IAAI,uCAA8B,CACtC;wBACE,KAAK,EAAE,yBAAgB,CAAC,YAAY;wBACpC,iBAAiB,EAAE,4BAA4B;qBAChD,EACD;wBACE,eAAe,EACb,8IAA8I;qBACjJ,CACF,CAAA;gBACH,CAAC;gBAED,kBAAkB,GAAG,MAAM,yBAAyB,CAAC,yCAAyC,CAAC;oBAC7F,kBAAkB;oBAClB,yBAAyB,EAAE,eAAe,CAAC,iBAAiB;oBAC5D,KAAK;oBACL,OAAO,EAAE,WAAW;oBACpB,IAAI,EAAE;wBACJ,GAAG,EAAE,OAAO;wBACZ,QAAQ,EAAE,eAAe,CAAC,YAAY;qBACvC;oBACD,cAAc,EAAE,eAAe,CAAC,OAAO;oBACvC,0BAA0B,EAAE,IAAA,wBAAgB,EAC1C,eAAe,CAAC,SAAS,EACzB,MAAM,CAAC,oCAAoC,CAC5C;iBACF,CAAC,CAAA;YACJ,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,KAAK,yCAAgC,EAAE,CAAC;gBAChE,IAAI,CAAC,CAAA,MAAA,eAAe,CAAC,aAAa,0CAAE,IAAI,CAAA,IAAI,CAAC,CAAA,MAAA,eAAe,CAAC,aAAa,0CAAE,aAAa,CAAA,EAAE,CAAC;oBAC1F,MAAM,IAAI,uCAA8B,CACtC;wBACE,KAAK,EAAE,yBAAgB,CAAC,YAAY;wBACpC,iBAAiB,EAAE,4BAA4B;qBAChD,EACD;wBACE,eAAe,EACb,6KAA6K;qBAChL,CACF,CAAA;gBACH,CAAC;gBACD,kBAAkB,GAAG,MAAM,yBAAyB,CAAC,yCAAyC,CAAC;oBAC7F,kBAAkB;oBAClB,YAAY,EAAE,eAAe,CAAC,aAAa,CAAC,IAAI;oBAChD,aAAa,EAAE,eAAe,CAAC,aAAa,CAAC,aAAa;oBAC1D,KAAK;oBACL,OAAO,EAAE,WAAW;oBACpB,IAAI,EAAE;wBACJ,GAAG,EAAE,OAAO;wBACZ,QAAQ,EAAE,eAAe,CAAC,YAAY;qBACvC;oBACD,IAAI,EAAE,eAAe,CAAC,IAAI;wBACxB,CAAC,CAAC;4BACE,aAAa,EAAE,eAAe,CAAC,IAAI,CAAC,aAAa;4BACjD,mBAAmB,EAAE,eAAe,CAAC,IAAI,CAAC,mBAAmB;4BAC7D,YAAY,EAAE,gBAAgB;yBAC/B;wBACH,CAAC,CAAC,SAAS;iBACd,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,uCAA8B,CAAC;oBACvC,KAAK,EAAE,yBAAgB,CAAC,oBAAoB;oBAC5C,iBAAiB,EAAE,wBAAwB;iBAC5C,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,sBAAsB,CAAC,WAAW,CACtC,YAAY,EACZ,eAAe,EACf,6DAA6B,CAAC,oBAAoB,CACnD,CAAA;YACD,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;YAEzG,iBAAiB;YACjB,MAAM,MAAM,GAAG,IAAA,oDAA0C,EAAC;gBACxD,0BAA0B,EAAE,eAAe,CAAC,sBAAsB,CAAC,4BAA4B;gBAC/F,cAAc;aACf,CAAC,CAAA;YAEF,MAAM,SAAS,GAAG,IAAA,oBAAa,EAAC,qBAAqB,CAAC,CAAA;YACtD,MAAM,mBAAmB,GAAG,MAAM,yBAAyB,CAAC,yBAAyB,CAAC;gBACpF,QAAQ,EAAE,cAAc,CAAC,gBAAgB,CAAC,iBAAiB;gBAC3D,mBAAmB,EAAE,cAAc,CAAC,gBAAgB,CAAC,iBAAiB;gBACtE,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;gBACpD,uDAAuD;gBACvD,gHAAgH;gBAChH,MAAM,EAAE;oBACN,MAAM,EAAE,KAAK;oBACb,GAAG,EAAE,SAAS,CAAC,4BAA4B,CAAC,CAAC,CAAC;oBAC9C,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE;iBAC9B;gBACD,OAAO,EAAE,kBAAkB,CAAC,OAAO;gBACnC,KAAK,EAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,CAAC,GAAG,CAAC;gBACxB,QAAQ,EAAE,eAAe,CAAC,QAAQ;gBAElC,4BAA4B,EAAE;oBAC5B,qBAAqB,EACnB,KAAK,CAAC,SAAS,KAAK,yCAAgC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;oBAC5F,YAAY,EAAE,MAAA,eAAe,CAAC,aAAa,0CAAE,WAAW;iBACzD;gBACD,OAAO,EAAE,KAAK,CAAC,SAAS,KAAK,yCAAgC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;gBAEpG,yEAAyE;gBACzE,MAAM;gBACN,eAAe,EAAE,sBAAsB;aACxC,CAAC,CAAA;YAEF,MAAM,sBAAsB,CAAC,WAAW,CACtC,YAAY,EACZ,eAAe,EACf,6DAA6B,CAAC,kBAAkB,CACjD,CAAA;YAED,OAAO,IAAA,yBAAgB,EAAC,QAAQ,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAA;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uCAA8B,EAAE,CAAC;gBACpD,OAAO,IAAA,gCAAuB,EAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACnF,CAAC;YAED,OAAO,IAAA,uCAA8B,EAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"accessTokenEndpoint.js","sourceRoot":"","sources":["../../../src/openid4vc-issuer/router/accessTokenEndpoint.ts"],"names":[],"mappings":";;AAwBA,oEAEC;AAED,gDA0LC;AAjND,6CAKyB;AACzB,yCAAwE;AAExE,gDAK4B;AAC5B,8CAAqD;AACrD,oFAAgF;AAChF,sEAAkE;AAClE,8CAAkE;AAElE,SAAgB,4BAA4B,CAAC,MAAc,EAAE,MAAmC;IAC9F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,SAAgB,kBAAkB,CAAC,MAAmC;IACpE,OAAO,KAAK,EAAE,OAAiC,EAAE,QAAkB,EAAE,IAAkB,EAAE,EAAE;;QACzF,QAAQ,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;QACjE,MAAM,cAAc,GAAG,IAAA,0BAAiB,EAAC,OAAO,CAAC,CAAA;QACjD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,cAAc,CAAA;QAE/C,MAAM,sBAAsB,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,+CAAsB,CAAC,CAAA;QAC7F,MAAM,yBAAyB,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,+CAAkC,CAAC,CAAA;QAC5G,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,iBAAiB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;QAC3F,MAAM,qBAAqB,GAAG,UAAG,CAAC,eAAe,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAA;QACzF,MAAM,yBAAyB,GAAG,sBAAsB,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAA;QAEnG,MAAM,cAAc,GAAG,IAAA,mBAAY,EAAC,cAAc,CAAC,gBAAgB,CAAC,iBAAiB,EAAE;YACrF,MAAM,CAAC,uBAAuB;SAC/B,CAAC,CAAA;QACF,MAAM,WAAW,GAAG;YAClB,OAAO,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,OAAiC,CAAC;YAC/D,MAAM,EAAE,OAAO,CAAC,MAAoB;YACpC,GAAG,EAAE,cAAc;SACX,CAAA;QAEV,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,yBAAyB,CAAC,uBAAuB,CAAC;YACjH,kBAAkB,EAAE,OAAO,CAAC,IAAI;YAChC,OAAO,EAAE,WAAW;SACrB,CAAC,CAAA;QAEF,MAAM,eAAe,GAAG,MAAM,yBAAyB,CAAC,iBAAiB,CAAC,YAAY,EAAE;YACtF,iBAAiB,EAAE,KAAK,CAAC,SAAS,KAAK,yCAAgC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;YAC7G,iBAAiB,EAAE,KAAK,CAAC,SAAS,KAAK,yCAAgC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SACjG,CAAC,CAAA;QACF,MAAM,aAAa,GACjB,KAAK,CAAC,SAAS,KAAK,yCAAgC;YAClD,CAAC,CAAC,CAAC,6DAA6B,CAAC,YAAY,EAAE,6DAA6B,CAAC,iBAAiB,CAAC;YAC/F,CAAC,CAAC,CAAC,6DAA6B,CAAC,oBAAoB,CAAC,CAAA;QAC1D,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,uCAA8B,CAAC;gBACvC,KAAK,EAAE,yBAAgB,CAAC,YAAY;gBACpC,iBAAiB,EAAE,4BAA4B;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,IACE,IAAI,CAAC,GAAG,EAAE;YACV,IAAA,wBAAgB,EAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,2CAA2C,CAAC,CAAC,OAAO,EAAE,EACzG,CAAC;YACD,eAAe,CAAC,YAAY,GAAG,8BAA8B,CAAA;YAC7D,MAAM,sBAAsB,CAAC,WAAW,CAAC,YAAY,EAAE,eAAe,EAAE,6DAA6B,CAAC,KAAK,CAAC,CAAA;YAC5G,MAAM,IAAI,uCAA8B,CAAC;gBACvC,+BAA+B;gBAC/B,KAAK,EAAE,yBAAgB,CAAC,YAAY;gBACpC,iBAAiB,EAAE,iBAAiB;aACrC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,kBAAkD,CAAA;QACtD,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,SAAS,KAAK,yCAAgC,EAAE,CAAC;gBACzD,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC;oBACvC,MAAM,IAAI,uCAA8B,CACtC;wBACE,KAAK,EAAE,yBAAgB,CAAC,YAAY;wBACpC,iBAAiB,EAAE,4BAA4B;qBAChD,EACD;wBACE,eAAe,EACb,8IAA8I;qBACjJ,CACF,CAAA;gBACH,CAAC;gBAED,kBAAkB,GAAG,MAAM,yBAAyB,CAAC,yCAAyC,CAAC;oBAC7F,kBAAkB;oBAClB,yBAAyB,EAAE,eAAe,CAAC,iBAAiB;oBAC5D,KAAK;oBACL,OAAO,EAAE,WAAW;oBACpB,IAAI,EAAE;wBACJ,GAAG,EAAE,OAAO;wBACZ,uDAAuD;wBACvD,8CAA8C;wBAC9C,QAAQ,EAAE,MAAM,CAAC,YAAY;qBAC9B;oBACD,cAAc,EAAE,eAAe,CAAC,OAAO;oBACvC,0BAA0B,EAAE,IAAA,wBAAgB,EAC1C,eAAe,CAAC,SAAS,EACzB,MAAM,CAAC,2CAA2C,CACnD;iBACF,CAAC,CAAA;YACJ,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,KAAK,yCAAgC,EAAE,CAAC;gBAChE,IAAI,CAAC,CAAA,MAAA,eAAe,CAAC,aAAa,0CAAE,IAAI,CAAA,IAAI,CAAC,CAAA,MAAA,eAAe,CAAC,aAAa,0CAAE,aAAa,CAAA,EAAE,CAAC;oBAC1F,MAAM,IAAI,uCAA8B,CACtC;wBACE,KAAK,EAAE,yBAAgB,CAAC,YAAY;wBACpC,iBAAiB,EAAE,4BAA4B;qBAChD,EACD;wBACE,eAAe,EACb,6KAA6K;qBAChL,CACF,CAAA;gBACH,CAAC;gBACD,kBAAkB,GAAG,MAAM,yBAAyB,CAAC,yCAAyC,CAAC;oBAC7F,kBAAkB;oBAClB,YAAY,EAAE,eAAe,CAAC,aAAa,CAAC,IAAI;oBAChD,aAAa,EAAE,eAAe,CAAC,aAAa,CAAC,aAAa;oBAC1D,KAAK;oBACL,OAAO,EAAE,WAAW;oBACpB,IAAI,EAAE;wBACJ,GAAG,EAAE,OAAO;wBACZ,uDAAuD;wBACvD,8CAA8C;wBAC9C,QAAQ,EAAE,MAAM,CAAC,YAAY;qBAC9B;oBACD,IAAI,EAAE,eAAe,CAAC,IAAI;wBACxB,CAAC,CAAC;4BACE,aAAa,EAAE,eAAe,CAAC,IAAI,CAAC,aAAa;4BACjD,mBAAmB,EAAE,eAAe,CAAC,IAAI,CAAC,mBAAmB;4BAC7D,YAAY,EAAE,gBAAgB;yBAC/B;wBACH,CAAC,CAAC,SAAS;iBACd,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,uCAA8B,CAAC;oBACvC,KAAK,EAAE,yBAAgB,CAAC,oBAAoB;oBAC5C,iBAAiB,EAAE,wBAAwB;iBAC5C,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,sBAAsB,CAAC,WAAW,CACtC,YAAY,EACZ,eAAe,EACf,6DAA6B,CAAC,oBAAoB,CACnD,CAAA;YACD,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;YAEzG,0GAA0G;YAC1G,2EAA2E;YAC3E,MAAM,MAAM,GACV,KAAK,CAAC,SAAS,KAAK,yCAAgC,CAAC,CAAC,CAAC,MAAA,eAAe,CAAC,aAAa,0CAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;YAC1G,MAAM,OAAO,GAAG,SAAS,YAAK,CAAC,IAAI,EAAE,EAAE,CAAA;YAEvC,MAAM,SAAS,GAAG,IAAA,oBAAa,EAAC,qBAAqB,CAAC,CAAA;YACtD,MAAM,mBAAmB,GAAG,MAAM,yBAAyB,CAAC,yBAAyB,CAAC;gBACpF,QAAQ,EAAE,cAAc,CAAC,gBAAgB,CAAC,iBAAiB;gBAC3D,mBAAmB,EAAE,cAAc,CAAC,gBAAgB,CAAC,iBAAiB;gBACtE,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;gBACpD,MAAM,EAAE;oBACN,MAAM,EAAE,KAAK;oBACb,GAAG,EAAE,SAAS,CAAC,4BAA4B,CAAC,CAAC,CAAC;oBAC9C,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE;iBAC9B;gBACD,OAAO,EAAE,kBAAkB,CAAC,OAAO;gBACnC,KAAK,EAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,CAAC,GAAG,CAAC;gBACxB,QAAQ,EAAE,eAAe,CAAC,QAAQ;gBAElC,4BAA4B,EAAE;oBAC5B,qBAAqB,EACnB,KAAK,CAAC,SAAS,KAAK,yCAAgC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;oBAC5F,YAAY,EAAE,MAAA,eAAe,CAAC,aAAa,0CAAE,WAAW;iBACzD;gBACD,4FAA4F;gBAC5F,OAAO;gBAEP,yEAAyE;gBACzE,MAAM;gBACN,eAAe,EAAE,sBAAsB;aACxC,CAAC,CAAA;YAEF,eAAe,CAAC,aAAa,mCACxB,eAAe,CAAC,aAAa,KAChC,OAAO,GACR,CAAA;YACD,MAAM,sBAAsB,CAAC,WAAW,CACtC,YAAY,EACZ,eAAe,EACf,6DAA6B,CAAC,kBAAkB,CACjD,CAAA;YAED,OAAO,IAAA,yBAAgB,EAAC,QAAQ,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAA;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uCAA8B,EAAE,CAAC;gBACpD,OAAO,IAAA,gCAAuB,EAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACnF,CAAC;YAED,OAAO,IAAA,uCAA8B,EAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/build/openid4vc-issuer/router/authorizationChallengeEndpoint.js

@@ -72,6 +72,16 @@ async function handleAuthorizationChallengeNoAuthSession(options) {
             error_description: `Missing required 'issuer_state' parameter. Only requests initiated by a credential offer are supported for authorization challenge.`,
         });
     }
+    // FIXME: we need to authenticate the client. Could be either using client_id/client_secret
+    // but that doesn't make sense for wallets. So for now we just allow any client_id and we will
+    // need OAuth2 Attestation Based Client Auth and dynamically allow client_ids based on wallet providers
+    // we trust. Will add this in a follow up PR (basically we do no client authentication at the moment)
+    // if (!authorizationChallengeRequest.client_id) {
+    //   throw new Oauth2ServerErrorResponseError({
+    //     error: Oauth2ErrorCodes.InvalidRequest,
+    //     error_description: `Missing required 'client_id' parameter..`,
+    //   })
+    // }
     const issuanceSession = await openId4VcIssuerService.findSingleIssuancSessionByQuery(agentContext, {
         issuerId: issuer.issuerId,
         issuerState: authorizationChallengeRequest.issuer_state,
@@ -88,8 +98,6 @@ async function handleAuthorizationChallengeNoAuthSession(options) {
         });
     }
     const offeredCredentialConfigurations = (0, shared_1.getOfferedCredentials)(issuanceSession.credentialOfferPayload.credential_configuration_ids, issuerMetadata.credentialIssuer.credential_configurations_supported);
-    // NOTE: for now we assume all credential configurations that were offered have a scope (should
-    // be checked when creating offer that requires presentation)
     const allowedScopes = (0, shared_1.getScopesFromCredentialConfigurationsSupported)(offeredCredentialConfigurations);
     const requestedScopes = (0, shared_1.getAllowedAndRequestedScopeValues)({
         allowedScopes,
@@ -102,18 +110,26 @@ async function handleAuthorizationChallengeNoAuthSession(options) {
             error_description: `No requested 'scope' values match with offered credential configurations.`,
         });
     }
-    const { authorizationRequest, verificationSession } = await config.getVerificationSessionForIssuanceSessionAuthorization({
+    const { authorizationRequest, verificationSession, scopes: presentationScopes, } = await config.getVerificationSessionForIssuanceSessionAuthorization({
         agentContext,
         issuanceSession,
         requestedCredentialConfigurations,
         scopes: requestedScopes,
     });
+    // Store presentation during issuance session on the record
+    verificationSession.presentationDuringIssuanceSession = core_1.TypedArrayEncoder.toBase64URL(agentContext.wallet.getRandomValues(32));
+    await agentContext.dependencyManager
+        .resolve(openid4vc_verifier_1.OpenId4VcVerificationSessionRepository)
+        .update(agentContext, verificationSession);
     const authSession = core_1.TypedArrayEncoder.toBase64URL(agentContext.wallet.getRandomValues(32));
+    issuanceSession.authorization = Object.assign(Object.assign({}, issuanceSession.authorization), { scopes: presentationScopes });
     issuanceSession.presentation = {
         required: true,
         authSession,
         openId4VcVerificationSessionId: verificationSession.id,
     };
+    // NOTE: should only allow authenticated clients in the future.
+    issuanceSession.clientId = authorizationChallengeRequest.client_id;
     await openId4VcIssuerService.updateState(agentContext, issuanceSession, OpenId4VcIssuanceSessionState_1.OpenId4VcIssuanceSessionState.AuthorizationInitiated);
     const authorizationChallengeErrorResponse = authorizationServer.createAuthorizationChallengePresentationErrorResponse({
         authSession,
@@ -132,14 +148,13 @@ async function handleAuthorizationChallengeWithAuthSession(options) {
     // should we validate that these are not in the request? I'm not sure what best practive would be here
     const issuanceSession = await openId4VcIssuerService.findSingleIssuancSessionByQuery(agentContext, {
         issuerId: issuer.issuerId,
-        issuerState: authorizationChallengeRequest.auth_session,
+        presentationAuthSession: authorizationChallengeRequest.auth_session,
     });
     const allowedStates = [OpenId4VcIssuanceSessionState_1.OpenId4VcIssuanceSessionState.AuthorizationInitiated];
-    if (!issuanceSession ||
-        !issuanceSession.presentation ||
+    if (!(issuanceSession === null || issuanceSession === void 0 ? void 0 : issuanceSession.presentation) ||
         !issuanceSession.presentation.openId4VcVerificationSessionId ||
         !issuanceSession.presentation.authSession ||
-        allowedStates.includes(issuanceSession.state)) {
+        !allowedStates.includes(issuanceSession.state)) {
         throw new oauth2_1.Oauth2ServerErrorResponseError({
             error: oauth2_1.Oauth2ErrorCodes.InvalidSession,
             error_description: `Invalid 'auth_session'`,
@@ -168,16 +183,19 @@ async function handleAuthorizationChallengeWithAuthSession(options) {
         .then(async (verificationSession) => {
         // Issuance session cannot be used anymore
         if (verificationSession.state === openid4vc_verifier_1.OpenId4VcVerificationSessionState.Error) {
-            issuanceSession.errorMessage = `Associated openId4VcVeificationSessionRecord with id '${openId4VcVerificationSessionId}' has error state`;
+            issuanceSession.errorMessage = `Associated openId4VcVerificationSessionRecord with id '${openId4VcVerificationSessionId}' has error state`;
             await openId4VcIssuerService.updateState(agentContext, issuanceSession, OpenId4VcIssuanceSessionState_1.OpenId4VcIssuanceSessionState.Error);
         }
-        if (verificationSession.state !== openid4vc_verifier_1.OpenId4VcVerificationSessionState.ResponseVerified) {
+        if (verificationSession.state !== openid4vc_verifier_1.OpenId4VcVerificationSessionState.ResponseVerified ||
+            authorizationChallengeRequest.presentation_during_issuance_session !==
+                verificationSession.presentationDuringIssuanceSession) {
             throw new oauth2_1.Oauth2ServerErrorResponseError({
-                // InsufficentAuthorization?
                 error: oauth2_1.Oauth2ErrorCodes.InvalidSession,
-                error_description: `Invalid 'auth_session'`,
+                error_description: `Invalid presentation for 'auth_session'`,
             }, {
-                internalMessage: `Openid4vc session with id '${openId4VcVerificationSessionId}' has state '${verificationSession.state}', while '${openid4vc_verifier_1.OpenId4VcVerificationSessionState.ResponseVerified}' was expected.`,
+                internalMessage: verificationSession.state !== openid4vc_verifier_1.OpenId4VcVerificationSessionState.ResponseVerified
+                    ? `Openid4vc verification session with id '${openId4VcVerificationSessionId}' has state '${verificationSession.state}', while '${openid4vc_verifier_1.OpenId4VcVerificationSessionState.ResponseVerified}' was expected.`
+                    : `Openid4vc verification session with id '${openId4VcVerificationSessionId}' has 'presentation_during_issuance_session' '${verificationSession.presentationDuringIssuanceSession}', but authorization challenge request provided value '${authorizationChallengeRequest.presentation_during_issuance_session}'.`,
             });
         }
     });
@@ -187,7 +205,7 @@ async function handleAuthorizationChallengeWithAuthSession(options) {
     issuanceSession.authorization = Object.assign(Object.assign({}, issuanceSession.authorization), { code: authorizationCode, codeExpiresAt: authorizationCodeExpiresAt });
     // TODO: we need to start using locks so we can't get corrupted state
     await openId4VcIssuerService.updateState(agentContext, issuanceSession, OpenId4VcIssuanceSessionState_1.OpenId4VcIssuanceSessionState.AuthorizationGranted);
-    const authorizationChallengeResponse = authorizationServer.createAuthorizationChallengeResponse({
+    const { authorizationChallengeResponse } = authorizationServer.createAuthorizationChallengeResponse({
         authorizationCode,
     });
     return (0, router_1.sendJsonResponse)(response, next, authorizationChallengeResponse);