@credo-ts/openid4vc 0.6.0-pr-2209-20250321171013 → 0.6.0-pr-2195-20250321182650

package/build/openid4vc-verifier/router/authorizationEndpoint.js

@@ -1,127 +1,116 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.configureAuthorizationEndpoint = configureAuthorizationEndpoint;
-const oauth2_1 = require("@animo-id/oauth2");
+const oauth2_1 = require("@openid4vc/oauth2");
 const core_1 = require("@credo-ts/core");
-const did_auth_siop_1 = require("@sphereon/did-auth-siop");
+// FIXME: export parseOpenid4VpAuthorizationResponsePayload from openid4vp
+const openid4vp_1 = require("@openid4vc/openid4vp");
 const router_1 = require("../../shared/router");
-const OpenId4VcSiopVerifierService_1 = require("../OpenId4VcSiopVerifierService");
-async function getVerificationSession(agentContext, options) {
-    const { verifierId, state, nonce } = options;
-    const openId4VcVerifierService = agentContext.dependencyManager.resolve(OpenId4VcSiopVerifierService_1.OpenId4VcSiopVerifierService);
-    const session = await openId4VcVerifierService.findVerificationSessionForAuthorizationResponse(agentContext, {
-        authorizationResponseParams: { state, nonce },
-        verifierId,
-    });
-    if (!session) {
-        agentContext.config.logger.warn(`No verification session found for incoming authorization response for verifier ${verifierId}`);
-        throw new core_1.CredoError(`No state or nonce provided in authorization response for verifier ${verifierId}`);
-    }
-    return session;
-}
-const decryptJarmResponse = (agentContext) => {
-    return async (input) => {
-        const { jwe: compactJwe, jwk: jwkJson } = input;
-        const key = core_1.Key.fromFingerprint(jwkJson.kid);
-        if (!agentContext.wallet.directDecryptCompactJweEcdhEs) {
-            throw new core_1.CredoError('Cannot decrypt Jarm Response, wallet does not support directDecryptCompactJweEcdhEs');
-        }
-        const { data, header } = await agentContext.wallet.directDecryptCompactJweEcdhEs({ compactJwe, recipientKey: key });
-        const decryptedPayload = core_1.TypedArrayEncoder.toUtf8String(data);
-        return {
-            plaintext: decryptedPayload,
-            protectedHeader: header,
-        };
-    };
-};
+const OpenId4VpVerifierService_1 = require("../OpenId4VpVerifierService");
+const repository_1 = require("../repository");
+const utils_1 = require("@openid4vc/utils");
 function configureAuthorizationEndpoint(router, config) {
-    router.post(config.endpointPath, async (request, response, next) => {
+    router.post(config.authorizationEndpoint, async (request, response, next) => {
         const { agentContext, verifier } = (0, router_1.getRequestContext)(request);
-        let jarmResponseType;
+        const openId4VcVerifierService = agentContext.dependencyManager.resolve(OpenId4VpVerifierService_1.OpenId4VpVerifierService);
         try {
-            const openId4VcVerifierService = agentContext.dependencyManager.resolve(OpenId4VcSiopVerifierService_1.OpenId4VcSiopVerifierService);
-            let verificationSession;
-            let authorizationResponsePayload;
-            let jarmHeader = undefined;
-            if (request.body.response) {
-                const res = await did_auth_siop_1.RP.processJarmAuthorizationResponse(request.body.response, {
-                    getAuthRequestPayload: async (input) => {
-                        verificationSession = await getVerificationSession(agentContext, {
-                            verifierId: verifier.verifierId,
-                            state: input.state,
-                            nonce: input.nonce,
-                        });
-                        const req = await did_auth_siop_1.AuthorizationRequest.fromUriOrJwt(verificationSession.authorizationRequestJwt);
-                        const requestObjectPayload = await req.requestObject?.getPayload();
-                        if (!requestObjectPayload) {
-                            throw new core_1.CredoError('No request object payload found.');
-                        }
-                        return { authRequestParams: requestObjectPayload };
-                    },
-                    decryptCompact: decryptJarmResponse(agentContext),
-                    hasher: core_1.Hasher.hash,
-                });
-                jarmResponseType = res.type;
-                const [header] = request.body.response.split('.');
-                jarmHeader = core_1.JsonEncoder.fromBase64(header);
-                // FIXME: verify the apv matches the nonce of the authorization reuqest
-                authorizationResponsePayload = res.authResponseParams;
-            }
-            else {
-                authorizationResponsePayload = request.body;
-                verificationSession = await getVerificationSession(agentContext, {
-                    verifierId: verifier.verifierId,
-                    state: authorizationResponsePayload.state,
-                    nonce: authorizationResponsePayload.nonce,
-                });
-            }
-            if (typeof authorizationResponsePayload.presentation_submission === 'string') {
-                authorizationResponsePayload.presentation_submission = JSON.parse(request.body.presentation_submission);
-            }
-            // This feels hacky, and should probably be moved to OID4VP lib. However the OID4VP spec allows either object, string, or array...
-            if (typeof authorizationResponsePayload.vp_token === 'string' &&
-                (authorizationResponsePayload.vp_token.startsWith('{') || authorizationResponsePayload.vp_token.startsWith('['))) {
-                authorizationResponsePayload.vp_token = JSON.parse(authorizationResponsePayload.vp_token);
-            }
-            if (!verificationSession) {
-                throw new core_1.CredoError('Missing verification session, cannot verify authorization response.');
-            }
-            const authorizationRequest = await did_auth_siop_1.AuthorizationRequest.fromUriOrJwt(verificationSession.authorizationRequestJwt);
-            const response_mode = await authorizationRequest.getMergedProperty('response_mode');
-            if (response_mode?.includes('jwt') && !jarmResponseType) {
-                throw new oauth2_1.Oauth2ServerErrorResponseError({
-                    error: oauth2_1.Oauth2ErrorCodes.InvalidRequest,
-                    error_description: `JARM response is required for JWT response mode '${response_mode}'.`,
-                });
-            }
-            if (!response_mode?.includes('jwt') && jarmResponseType) {
-                throw new oauth2_1.Oauth2ServerErrorResponseError({
-                    error: oauth2_1.Oauth2ErrorCodes.InvalidRequest,
-                    error_description: `Recieved JARM response which is incompatible with response mode '${response_mode}'.`,
-                });
-            }
-            if (jarmResponseType && jarmResponseType !== 'encrypted') {
-                throw new oauth2_1.Oauth2ServerErrorResponseError({
-                    error: oauth2_1.Oauth2ErrorCodes.InvalidRequest,
-                    error_description: `Only encrypted JARM responses are supported, received '${jarmResponseType}'.`,
-                });
-            }
-            await openId4VcVerifierService.verifyAuthorizationResponse(agentContext, {
-                authorizationResponse: authorizationResponsePayload,
-                verificationSession,
-                jarmHeader,
+            const result = await getVerificationSession(agentContext, request, response, next, verifier);
+            // Response already handled in the method
+            if (!result.success)
+                return;
+            const { verificationSession } = await openId4VcVerifierService.verifyAuthorizationResponse(agentContext, {
+                authorizationResponse: request.body,
+                verificationSession: result.verificationSession,
             });
             return (0, router_1.sendJsonResponse)(response, next, {
                 // Used only for presentation during issuance flow, to prevent session fixation.
                 presentation_during_issuance_session: verificationSession.presentationDuringIssuanceSession,
+                // TODO: add callback for the user of Credo, where also a redirect_uri can be returned
+                // callback should also be called in case of failed verification
+                // redirect_uri
             });
         }
         catch (error) {
             if (error instanceof oauth2_1.Oauth2ServerErrorResponseError) {
                 return (0, router_1.sendOauth2ErrorResponse)(response, next, agentContext.config.logger, error);
             }
-            return (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 500, 'invalid_request', error);
+            // FIXME: should throw a Oauth2ServerErrorResponseError in the oid4vp library
+            if (error instanceof utils_1.ValidationError) {
+                return (0, router_1.sendOauth2ErrorResponse)(response, next, agentContext.config.logger, new oauth2_1.Oauth2ServerErrorResponseError({
+                    error: oauth2_1.Oauth2ErrorCodes.InvalidRequest,
+                    error_description: error.message,
+                }, { cause: error }));
+            }
+            // FIXME: Many CredoError will result in 500. We should either throw Oauth2ServerErrorResponseError as well
+            // Or have a special OpenID4VP verifier error that is similar to Oauth2ServerErrorResponseError
+            return (0, router_1.sendUnknownServerErrorResponse)(response, next, agentContext.config.logger, error);
         }
     });
 }
+async function getVerificationSession(agentContext, request, response, next, verifier) {
+    const openId4VcVerificationSessionRepository = agentContext.dependencyManager.resolve(repository_1.OpenId4VcVerificationSessionRepository);
+    try {
+        if (request.query.session) {
+            if (typeof request.query.session !== 'string') {
+                (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 400, oauth2_1.Oauth2ErrorCodes.InvalidRequest, `Unexpected value for 'session' query param`);
+                return { success: false };
+            }
+            const verificationSession = await openId4VcVerificationSessionRepository.findSingleByQuery(agentContext, {
+                verifierId: verifier.verifierId,
+                authorizationRequestId: request.query.session,
+            });
+            if (!verificationSession) {
+                (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 400, oauth2_1.Oauth2ErrorCodes.InvalidRequest, `Invalid 'session' parameter`);
+                return { success: false };
+            }
+            return { success: true, verificationSession };
+        }
+        const parsedResponse = openid4vp_1.zOpenid4vpAuthorizationResponse.safeParse(request.body);
+        if (parsedResponse.success) {
+            if (!parsedResponse.data.state) {
+                (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 400, oauth2_1.Oauth2ErrorCodes.InvalidRequest, `Missing required 'state' parameter in response without response encryption`);
+                return { success: false };
+            }
+            const verificationSession = await openId4VcVerificationSessionRepository.findSingleByQuery(agentContext, {
+                payloadState: parsedResponse.data.state,
+                verifierId: verifier.verifierId,
+            });
+            if (!verificationSession) {
+                (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 400, oauth2_1.Oauth2ErrorCodes.InvalidRequest, `Invalid 'state' parameter`);
+                return { success: false };
+            }
+            return { success: true, verificationSession };
+        }
+        // Try extracting apv (request nonce), which is used in encrypted responses (for ISO 18013-7/before draft 24)
+        if (typeof request.body === 'object' && 'response' in request.body) {
+            const { header } = (0, oauth2_1.decodeJwtHeader)({
+                jwt: request.body.response,
+            });
+            if (!header.apv) {
+                (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 400, oauth2_1.Oauth2ErrorCodes.InvalidRequest, `Missing 'session' query param or 'apv' value in header of encrypted JARM response.`);
+                return { success: false };
+            }
+            if (typeof header.apv !== 'string') {
+                (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 400, oauth2_1.Oauth2ErrorCodes.InvalidRequest, `'apv' value in header of encrypted JARM response is not of type string.`);
+                return { success: false };
+            }
+            const nonce = core_1.TypedArrayEncoder.toUtf8String(core_1.TypedArrayEncoder.fromBase64(header.apv));
+            const verificationSession = await openId4VcVerificationSessionRepository.findSingleByQuery(agentContext, {
+                nonce,
+                verifierId: verifier.verifierId,
+            });
+            if (!verificationSession) {
+                (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 400, oauth2_1.Oauth2ErrorCodes.InvalidRequest, `Invalid 'apv' parameter`);
+                return { success: false };
+            }
+            return { success: true, verificationSession };
+        }
+        (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 400, oauth2_1.Oauth2ErrorCodes.InvalidRequest, 'Invalid response');
+        return { success: false };
+    }
+    catch (error) {
+        (0, router_1.sendUnknownServerErrorResponse)(response, next, agentContext.config.logger, error);
+        return { success: false };
+    }
+}
 //# sourceMappingURL=authorizationEndpoint.js.map

package/build/openid4vc-verifier/router/authorizationEndpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorizationEndpoint.js","sourceRoot":"","sources":["../../../src/openid4vc-verifier/router/authorizationEndpoint.ts"],"names":[],"mappings":";;AAmEA,wEAuGC;AApKD,6CAAmF;AACnF,yCAAwF;AACxF,2DAAkE;AAElE,gDAAqH;AACrH,kFAA8E;AAY9E,KAAK,UAAU,sBAAsB,CACnC,YAA0B,EAC1B,OAIC;IAED,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IAE5C,MAAM,wBAAwB,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,2DAA4B,CAAC,CAAA;IACrG,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,+CAA+C,CAAC,YAAY,EAAE;QAC3G,2BAA2B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QAC7C,UAAU;KACX,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAC7B,kFAAkF,UAAU,EAAE,CAC/F,CAAA;QACD,MAAM,IAAI,iBAAU,CAAC,qEAAqE,UAAU,EAAE,CAAC,CAAA;IACzG,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,YAA0B,EAAkB,EAAE;IACzE,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;QAC/C,MAAM,GAAG,GAAG,UAAG,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,6BAA6B,EAAE,CAAC;YACvD,MAAM,IAAI,iBAAU,CAAC,qFAAqF,CAAC,CAAA;QAC7G,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,6BAA6B,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAA;QACnH,MAAM,gBAAgB,GAAG,wBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAE7D,OAAO;YACL,SAAS,EAAE,gBAAgB;YAC3B,eAAe,EAAE,MAAgE;SAClF,CAAA;IACH,CAAC,CAAA;AACH,CAAC,CAAA;AAED,SAAgB,8BAA8B,CAAC,MAAc,EAAE,MAAgD;IAC7G,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,OAAqC,EAAE,QAAkB,EAAE,IAAI,EAAE,EAAE;QACzG,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAiB,EAAC,OAAO,CAAC,CAAA;QAE7D,IAAI,gBAAoC,CAAA;QAExC,IAAI,CAAC;YACH,MAAM,wBAAwB,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,2DAA4B,CAAC,CAAA;YAErG,IAAI,mBAAmE,CAAA;YACvE,IAAI,4BAA0D,CAAA;YAC9D,IAAI,UAAU,GAA+C,SAAS,CAAA;YAEtE,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,MAAM,kBAAE,CAAC,gCAAgC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;oBAC3E,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;wBACrC,mBAAmB,GAAG,MAAM,sBAAsB,CAAC,YAAY,EAAE;4BAC/D,UAAU,EAAE,QAAQ,CAAC,UAAU;4BAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;4BAClB,KAAK,EAAE,KAAK,CAAC,KAAe;yBAC7B,CAAC,CAAA;wBAEF,MAAM,GAAG,GAAG,MAAM,oCAAoB,CAAC,YAAY,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,CAAA;wBAChG,MAAM,oBAAoB,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,CAAA;wBAClE,IAAI,CAAC,oBAAoB,EAAE,CAAC;4BAC1B,MAAM,IAAI,iBAAU,CAAC,kCAAkC,CAAC,CAAA;wBAC1D,CAAC;wBACD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAA;oBACpD,CAAC;oBACD,cAAc,EAAE,mBAAmB,CAAC,YAAY,CAAC;oBACjD,MAAM,EAAE,aAAM,CAAC,IAAI;iBACpB,CAAC,CAAA;gBAEF,gBAAgB,GAAG,GAAG,CAAC,IAAI,CAAA;gBAE3B,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBACjD,UAAU,GAAG,kBAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;gBAC3C,uEAAuE;gBACvE,4BAA4B,GAAG,GAAG,CAAC,kBAAkD,CAAA;YACvF,CAAC;iBAAM,CAAC;gBACN,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAA;gBAC3C,mBAAmB,GAAG,MAAM,sBAAsB,CAAC,YAAY,EAAE;oBAC/D,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,KAAK,EAAE,4BAA4B,CAAC,KAAK;oBACzC,KAAK,EAAE,4BAA4B,CAAC,KAAK;iBAC1C,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,OAAO,4BAA4B,CAAC,uBAAuB,KAAK,QAAQ,EAAE,CAAC;gBAC7E,4BAA4B,CAAC,uBAAuB,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;YACzG,CAAC;YAED,kIAAkI;YAClI,IACE,OAAO,4BAA4B,CAAC,QAAQ,KAAK,QAAQ;gBACzD,CAAC,4BAA4B,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,4BAA4B,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAChH,CAAC;gBACD,4BAA4B,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAA;YAC3F,CAAC;YAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,iBAAU,CAAC,qEAAqE,CAAC,CAAA;YAC7F,CAAC;YAED,MAAM,oBAAoB,GAAG,MAAM,oCAAoB,CAAC,YAAY,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,CAAA;YACjH,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,iBAAiB,CAAS,eAAe,CAAC,CAAA;YAC3F,IAAI,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACxD,MAAM,IAAI,uCAA8B,CAAC;oBACvC,KAAK,EAAE,yBAAgB,CAAC,cAAc;oBACtC,iBAAiB,EAAE,oDAAoD,aAAa,IAAI;iBACzF,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC;gBACxD,MAAM,IAAI,uCAA8B,CAAC;oBACvC,KAAK,EAAE,yBAAgB,CAAC,cAAc;oBACtC,iBAAiB,EAAE,oEAAoE,aAAa,IAAI;iBACzG,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,gBAAgB,IAAI,gBAAgB,KAAK,WAAW,EAAE,CAAC;gBACzD,MAAM,IAAI,uCAA8B,CAAC;oBACvC,KAAK,EAAE,yBAAgB,CAAC,cAAc;oBACtC,iBAAiB,EAAE,0DAA0D,gBAAgB,IAAI;iBAClG,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,wBAAwB,CAAC,2BAA2B,CAAC,YAAY,EAAE;gBACvE,qBAAqB,EAAE,4BAA4B;gBACnD,mBAAmB;gBACnB,UAAU;aACX,CAAC,CAAA;YACF,OAAO,IAAA,yBAAgB,EAAC,QAAQ,EAAE,IAAI,EAAE;gBACtC,gFAAgF;gBAChF,oCAAoC,EAAE,mBAAmB,CAAC,iCAAiC;aAC5F,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uCAA8B,EAAE,CAAC;gBACpD,OAAO,IAAA,gCAAuB,EAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACnF,CAAC;YAED,OAAO,IAAA,0BAAiB,EAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAA;QACrG,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"authorizationEndpoint.js","sourceRoot":"","sources":["../../../src/openid4vc-verifier/router/authorizationEndpoint.ts"],"names":[],"mappings":";;AAyBA,wEAiDC;AAvED,8CAAqG;AAErG,yCAAgE;AAChE,0EAA0E;AAC1E,oDAAsE;AACtE,gDAM4B;AAC5B,0EAAsE;AACtE,8CAIsB;AAEtB,4CAAkD;AAGlD,SAAgB,8BAA8B,CAAC,MAAc,EAAE,MAAqC;IAClG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAqC,EAAE,QAAkB,EAAE,IAAI,EAAE,EAAE;QAClH,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAiB,EAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,wBAAwB,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,mDAAwB,CAAC,CAAA;QAEjG,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;YAC5F,yCAAyC;YACzC,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAM;YAE3B,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,wBAAwB,CAAC,2BAA2B,CAAC,YAAY,EAAE;gBACvG,qBAAqB,EAAE,OAAO,CAAC,IAAI;gBACnC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;aAChD,CAAC,CAAA;YAEF,OAAO,IAAA,yBAAgB,EAAC,QAAQ,EAAE,IAAI,EAAE;gBACtC,gFAAgF;gBAChF,oCAAoC,EAAE,mBAAmB,CAAC,iCAAiC;gBAE3F,sFAAsF;gBACtF,gEAAgE;gBAChE,eAAe;aAChB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uCAA8B,EAAE,CAAC;gBACpD,OAAO,IAAA,gCAAuB,EAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACnF,CAAC;YAED,6EAA6E;YAC7E,IAAI,KAAK,YAAY,uBAAe,EAAE,CAAC;gBACrC,OAAO,IAAA,gCAAuB,EAC5B,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,IAAI,uCAA8B,CAChC;oBACE,KAAK,EAAE,yBAAgB,CAAC,cAAc;oBACtC,iBAAiB,EAAE,KAAK,CAAC,OAAO;iBACjC,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CACF,CAAA;YACH,CAAC;YAED,2GAA2G;YAC3G,+FAA+F;YAC/F,OAAO,IAAA,uCAA8B,EAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,YAA0B,EAC1B,OAAgB,EAChB,QAAkB,EAClB,IAAkB,EAClB,QAAiC;IAEjC,MAAM,sCAAsC,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CACnF,mDAAsC,CACvC,CAAA;IAED,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC9C,IAAA,0BAAiB,EACf,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,yBAAgB,CAAC,cAAc,EAC/B,4CAA4C,CAC7C,CAAA;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;YAC3B,CAAC;YAED,MAAM,mBAAmB,GAAG,MAAM,sCAAsC,CAAC,iBAAiB,CAAC,YAAY,EAAE;gBACvG,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,sBAAsB,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;aAC9C,CAAC,CAAA;YAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,IAAA,0BAAiB,EACf,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,yBAAgB,CAAC,cAAc,EAC/B,6BAA6B,CAC9B,CAAA;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;YAC3B,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QAC/C,CAAC;QAED,MAAM,cAAc,GAAG,2CAA+B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9E,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC/B,IAAA,0BAAiB,EACf,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,yBAAgB,CAAC,cAAc,EAC/B,4EAA4E,CAC7E,CAAA;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;YAC3B,CAAC;YAED,MAAM,mBAAmB,GAAG,MAAM,sCAAsC,CAAC,iBAAiB,CAAC,YAAY,EAAE;gBACvG,YAAY,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK;gBACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAA;YAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,IAAA,0BAAiB,EACf,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,yBAAgB,CAAC,cAAc,EAC/B,2BAA2B,CAC5B,CAAA;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;YAC3B,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QAC/C,CAAC;QAED,6GAA6G;QAC7G,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,UAAU,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACnE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,wBAAe,EAAC;gBACjC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;aAC3B,CAAC,CAAA;YAEF,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,IAAA,0BAAiB,EACf,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,yBAAgB,CAAC,cAAc,EAC/B,oFAAoF,CACrF,CAAA;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;YAC3B,CAAC;YAED,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnC,IAAA,0BAAiB,EACf,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,yBAAgB,CAAC,cAAc,EAC/B,yEAAyE,CAC1E,CAAA;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;YAC3B,CAAC;YAED,MAAM,KAAK,GAAG,wBAAiB,CAAC,YAAY,CAAC,wBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;YACtF,MAAM,mBAAmB,GAAG,MAAM,sCAAsC,CAAC,iBAAiB,CAAC,YAAY,EAAE;gBACvG,KAAK;gBACL,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAA;YAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,IAAA,0BAAiB,EACf,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,yBAAgB,CAAC,cAAc,EAC/B,yBAAyB,CAC1B,CAAA;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;YAC3B,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QAC/C,CAAC;QAED,IAAA,0BAAiB,EACf,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,yBAAgB,CAAC,cAAc,EAC/B,kBAAkB,CACnB,CAAA;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,uCAA8B,EAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC3B,CAAC;AACH,CAAC"}

package/build/openid4vc-verifier/router/authorizationRequestEndpoint.d.ts

@@ -1,11 +1,3 @@
 import type { Router } from 'express';
-export interface OpenId4VcSiopAuthorizationRequestEndpointConfig {
-    /**
-     * The path at which the authorization request should be made available. Note that it will be
-     * hosted at a subpath to take into account multiple tenants and verifiers.
-     *
-     * @default /authorization-requests
-     */
-    endpointPath: string;
-}
-export declare function configureAuthorizationRequestEndpoint(router: Router, config: OpenId4VcSiopAuthorizationRequestEndpointConfig): void;
+import { OpenId4VcVerifierModuleConfig } from '../OpenId4VcVerifierModuleConfig';
+export declare function configureAuthorizationRequestEndpoint(router: Router, config: OpenId4VcVerifierModuleConfig): void;

package/build/openid4vc-verifier/router/authorizationRequestEndpoint.js

@@ -3,32 +3,39 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.configureAuthorizationRequestEndpoint = configureAuthorizationRequestEndpoint;
 const core_1 = require("@credo-ts/core");
 const router_1 = require("../../shared/router");
-const OpenId4VcSiopVerifierService_1 = require("../OpenId4VcSiopVerifierService");
 const OpenId4VcVerificationSessionState_1 = require("../OpenId4VcVerificationSessionState");
-const OpenId4VcVerifierEvents_1 = require("../OpenId4VcVerifierEvents");
 const OpenId4VcVerifierModuleConfig_1 = require("../OpenId4VcVerifierModuleConfig");
-const repository_1 = require("../repository");
+const OpenId4VpVerifierService_1 = require("../OpenId4VpVerifierService");
 function configureAuthorizationRequestEndpoint(router, config) {
-    router.get((0, core_1.joinUriParts)(config.endpointPath, [':authorizationRequestId']), async (request, response, next) => {
+    router.get((0, core_1.joinUriParts)(config.authorizationRequestEndpoint, [':authorizationRequestId']), async (request, response, next) => {
         const { agentContext, verifier } = (0, router_1.getRequestContext)(request);
         if (!request.params.authorizationRequestId || typeof request.params.authorizationRequestId !== 'string') {
             return (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 400, 'invalid_request', 'Invalid authorization request url');
         }
         try {
-            const verifierService = agentContext.dependencyManager.resolve(OpenId4VcSiopVerifierService_1.OpenId4VcSiopVerifierService);
-            const verificationSessionRepository = agentContext.dependencyManager.resolve(repository_1.OpenId4VcVerificationSessionRepository);
+            const verifierService = agentContext.dependencyManager.resolve(OpenId4VpVerifierService_1.OpenId4VpVerifierService);
             const verifierConfig = agentContext.dependencyManager.resolve(OpenId4VcVerifierModuleConfig_1.OpenId4VcVerifierModuleConfig);
             // We always use shortened URIs currently
             const fullAuthorizationRequestUri = (0, core_1.joinUriParts)(verifierConfig.baseUrl, [
                 verifier.verifierId,
-                verifierConfig.authorizationRequestEndpoint.endpointPath,
+                verifierConfig.authorizationRequestEndpoint,
                 request.params.authorizationRequestId,
             ]);
             const [verificationSession] = await verifierService.findVerificationSessionsByQuery(agentContext, {
                 verifierId: verifier.verifierId,
-                authorizationRequestUri: fullAuthorizationRequestUri,
+                $or: [
+                    {
+                        authorizationRequestId: request.params.authorizationRequestId,
+                    },
+                    // NOTE: this can soon be removed, authorization request id is cleaner,
+                    // but only introduced since 0.6
+                    {
+                        authorizationRequestUri: fullAuthorizationRequestUri,
+                    },
+                ],
             });
-            if (!verificationSession) {
+            // Not all requets are signed, and those are not fetcheable
+            if (!verificationSession || !verificationSession.authorizationRequestJwt) {
                 return (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 404, 'not_found', 'Authorization request not found');
             }
             if (![
@@ -37,26 +44,18 @@ function configureAuthorizationRequestEndpoint(router, config) {
             ].includes(verificationSession.state)) {
                 return (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 400, 'invalid_request', 'Invalid state for authorization request');
             }
+            if (verificationSession.expiresAt && Date.now() > verificationSession.expiresAt.getTime()) {
+                return (0, router_1.sendNotFoundResponse)(response, next, agentContext.config.logger, 'Session expired');
+            }
             // It's okay to retrieve the offer multiple times. So we only update the state if it's not already retrieved
             if (verificationSession.state !== OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.RequestUriRetrieved) {
-                const previousState = verificationSession.state;
-                verificationSession.state = OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.RequestUriRetrieved;
-                await verificationSessionRepository.update(agentContext, verificationSession);
-                agentContext.dependencyManager
-                    .resolve(core_1.EventEmitter)
-                    .emit(agentContext, {
-                    type: OpenId4VcVerifierEvents_1.OpenId4VcVerifierEvents.VerificationSessionStateChanged,
-                    payload: {
-                        verificationSession: verificationSession.clone(),
-                        previousState,
-                    },
-                });
+                await verifierService.updateState(agentContext, verificationSession, OpenId4VcVerificationSessionState_1.OpenId4VcVerificationSessionState.RequestUriRetrieved);
             }
             response.type('application/oauth-authz-req+jwt').status(200).send(verificationSession.authorizationRequestJwt);
             next();
         }
         catch (error) {
-            return (0, router_1.sendErrorResponse)(response, next, agentContext.config.logger, 500, 'invalid_request', error);
+            return (0, router_1.sendUnknownServerErrorResponse)(response, next, agentContext.config.logger, error);
         }
     });
 }

package/build/openid4vc-verifier/router/authorizationRequestEndpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorizationRequestEndpoint.js","sourceRoot":"","sources":["../../../src/openid4vc-verifier/router/authorizationRequestEndpoint.ts"],"names":[],"mappings":";;AAuBA,sFA2FC;AA9GD,yCAA2D;AAE3D,gDAA0E;AAC1E,kFAA8E;AAC9E,4FAAwF;AACxF,wEAAoE;AACpE,oFAAgF;AAChF,8CAAsE;AAYtE,SAAgB,qCAAqC,CACnD,MAAc,EACd,MAAuD;IAEvD,MAAM,CAAC,GAAG,CACR,IAAA,mBAAY,EAAC,MAAM,CAAC,YAAY,EAAE,CAAC,yBAAyB,CAAC,CAAC,EAC9D,KAAK,EAAE,OAAqC,EAAE,QAAkB,EAAE,IAAI,EAAE,EAAE;QACxE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAiB,EAAC,OAAO,CAAC,CAAA;QAE7D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;YACxG,OAAO,IAAA,0BAAiB,EACtB,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,iBAAiB,EACjB,mCAAmC,CACpC,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,2DAA4B,CAAC,CAAA;YAC5F,MAAM,6BAA6B,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAC1E,mDAAsC,CACvC,CAAA;YACD,MAAM,cAAc,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,6DAA6B,CAAC,CAAA;YAE5F,yCAAyC;YACzC,MAAM,2BAA2B,GAAG,IAAA,mBAAY,EAAC,cAAc,CAAC,OAAO,EAAE;gBACvE,QAAQ,CAAC,UAAU;gBACnB,cAAc,CAAC,4BAA4B,CAAC,YAAY;gBACxD,OAAO,CAAC,MAAM,CAAC,sBAAsB;aACtC,CAAC,CAAA;YAEF,MAAM,CAAC,mBAAmB,CAAC,GAAG,MAAM,eAAe,CAAC,+BAA+B,CAAC,YAAY,EAAE;gBAChG,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,uBAAuB,EAAE,2BAA2B;aACrD,CAAC,CAAA;YAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,OAAO,IAAA,0BAAiB,EACtB,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,WAAW,EACX,iCAAiC,CAClC,CAAA;YACH,CAAC;YAED,IACE,CAAC;gBACC,qEAAiC,CAAC,cAAc;gBAChD,qEAAiC,CAAC,mBAAmB;aACtD,CAAC,QAAQ,CAAC,mBAAmB,CAAC,KAAK,CAAC,EACrC,CAAC;gBACD,OAAO,IAAA,0BAAiB,EACtB,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,iBAAiB,EACjB,yCAAyC,CAC1C,CAAA;YACH,CAAC;YAED,4GAA4G;YAC5G,IAAI,mBAAmB,CAAC,KAAK,KAAK,qEAAiC,CAAC,mBAAmB,EAAE,CAAC;gBACxF,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAA;gBAE/C,mBAAmB,CAAC,KAAK,GAAG,qEAAiC,CAAC,mBAAmB,CAAA;gBACjF,MAAM,6BAA6B,CAAC,MAAM,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAA;gBAE7E,YAAY,CAAC,iBAAiB;qBAC3B,OAAO,CAAC,mBAAY,CAAC;qBACrB,IAAI,CAAgD,YAAY,EAAE;oBACjE,IAAI,EAAE,iDAAuB,CAAC,+BAA+B;oBAC7D,OAAO,EAAE;wBACP,mBAAmB,EAAE,mBAAmB,CAAC,KAAK,EAAE;wBAChD,aAAa;qBACd;iBACF,CAAC,CAAA;YACN,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,CAAA;YAC9G,IAAI,EAAE,CAAA;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAA,0BAAiB,EAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAA;QACrG,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"authorizationRequestEndpoint.js","sourceRoot":"","sources":["../../../src/openid4vc-verifier/router/authorizationRequestEndpoint.ts"],"names":[],"mappings":";;AAeA,sFA0FC;AAtGD,yCAA6C;AAE7C,gDAK4B;AAC5B,4FAAwF;AACxF,oFAAgF;AAChF,0EAAsE;AAEtE,SAAgB,qCAAqC,CAAC,MAAc,EAAE,MAAqC;IACzG,MAAM,CAAC,GAAG,CACR,IAAA,mBAAY,EAAC,MAAM,CAAC,4BAA4B,EAAE,CAAC,yBAAyB,CAAC,CAAC,EAC9E,KAAK,EAAE,OAAqC,EAAE,QAAkB,EAAE,IAAI,EAAE,EAAE;QACxE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,IAAA,0BAAiB,EAAC,OAAO,CAAC,CAAA;QAE7D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;YACxG,OAAO,IAAA,0BAAiB,EACtB,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,iBAAiB,EACjB,mCAAmC,CACpC,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,mDAAwB,CAAC,CAAA;YACxF,MAAM,cAAc,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,6DAA6B,CAAC,CAAA;YAE5F,yCAAyC;YACzC,MAAM,2BAA2B,GAAG,IAAA,mBAAY,EAAC,cAAc,CAAC,OAAO,EAAE;gBACvE,QAAQ,CAAC,UAAU;gBACnB,cAAc,CAAC,4BAA4B;gBAC3C,OAAO,CAAC,MAAM,CAAC,sBAAsB;aACtC,CAAC,CAAA;YAEF,MAAM,CAAC,mBAAmB,CAAC,GAAG,MAAM,eAAe,CAAC,+BAA+B,CAAC,YAAY,EAAE;gBAChG,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,GAAG,EAAE;oBACH;wBACE,sBAAsB,EAAE,OAAO,CAAC,MAAM,CAAC,sBAAsB;qBAC9D;oBACD,uEAAuE;oBACvE,gCAAgC;oBAChC;wBACE,uBAAuB,EAAE,2BAA2B;qBACrD;iBACF;aACF,CAAC,CAAA;YAEF,2DAA2D;YAC3D,IAAI,CAAC,mBAAmB,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,EAAE,CAAC;gBACzE,OAAO,IAAA,0BAAiB,EACtB,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,WAAW,EACX,iCAAiC,CAClC,CAAA;YACH,CAAC;YAED,IACE,CAAC;gBACC,qEAAiC,CAAC,cAAc;gBAChD,qEAAiC,CAAC,mBAAmB;aACtD,CAAC,QAAQ,CAAC,mBAAmB,CAAC,KAAK,CAAC,EACrC,CAAC;gBACD,OAAO,IAAA,0BAAiB,EACtB,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,MAAM,CAAC,MAAM,EAC1B,GAAG,EACH,iBAAiB,EACjB,yCAAyC,CAC1C,CAAA;YACH,CAAC;YAED,IAAI,mBAAmB,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC1F,OAAO,IAAA,6BAAoB,EAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;YAC5F,CAAC;YAED,4GAA4G;YAC5G,IAAI,mBAAmB,CAAC,KAAK,KAAK,qEAAiC,CAAC,mBAAmB,EAAE,CAAC;gBACxF,MAAM,eAAe,CAAC,WAAW,CAC/B,YAAY,EACZ,mBAAmB,EACnB,qEAAiC,CAAC,mBAAmB,CACtD,CAAA;YACH,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,CAAA;YAC9G,IAAI,EAAE,CAAA;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAA,uCAA8B,EAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/build/shared/callbacks.d.ts

@@ -1,15 +1,23 @@
-import type { ClientAuthenticationCallback, SignJwtCallback, VerifyJwtCallback } from '@animo-id/oauth2';
 import type { AgentContext } from '@credo-ts/core';
+import type { ClientAuthenticationCallback, DecryptJweCallback, EncryptJweCallback, SignJwtCallback, VerifyJwtCallback } from '@openid4vc/oauth2';
 import type { OpenId4VcIssuerRecord } from '../openid4vc-issuer/repository';
-export declare function getOid4vciJwtVerifyCallback(agentContext: AgentContext): VerifyJwtCallback;
-export declare function getOid4vciJwtSignCallback(agentContext: AgentContext): SignJwtCallback;
-export declare function getOid4vciCallbacks(agentContext: AgentContext): {
-    hash: (data: Uint8Array, alg: import("@animo-id/oauth2").HashAlgorithm) => Uint8Array;
+export declare function getOid4vcJwtVerifyCallback(agentContext: AgentContext, trustedCertificates?: string[]): VerifyJwtCallback;
+export declare function getOid4vcEncryptJweCallback(agentContext: AgentContext): EncryptJweCallback;
+export declare function getOid4vcDecryptJweCallback(agentContext: AgentContext): DecryptJweCallback;
+export declare function getOid4vcJwtSignCallback(agentContext: AgentContext): SignJwtCallback;
+export declare function getOid4vcCallbacks(agentContext: AgentContext, trustedCertificates?: string[]): {
+    hash: (data: Uint8Array, alg: import("@openid4vc/oauth2").HashAlgorithm) => Uint8Array;
     generateRandom: (length: number) => Uint8Array;
     signJwt: SignJwtCallback;
     clientAuthentication: () => void;
     verifyJwt: VerifyJwtCallback;
     fetch: typeof fetch;
+    encryptJwe: EncryptJweCallback;
+    decryptJwe: DecryptJweCallback;
+    getX509CertificateMetadata: (certificate: string) => {
+        sanDnsNames: string[];
+        sanUriNames: string[];
+    };
 };
 /**
  * Allows us to authenticate when making requests to an external

package/build/shared/callbacks.js

@@ -1,17 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getOid4vciJwtVerifyCallback = getOid4vciJwtVerifyCallback;
-exports.getOid4vciJwtSignCallback = getOid4vciJwtSignCallback;
-exports.getOid4vciCallbacks = getOid4vciCallbacks;
+exports.getOid4vcJwtVerifyCallback = getOid4vcJwtVerifyCallback;
+exports.getOid4vcEncryptJweCallback = getOid4vcEncryptJweCallback;
+exports.getOid4vcDecryptJweCallback = getOid4vcDecryptJweCallback;
+exports.getOid4vcJwtSignCallback = getOid4vcJwtSignCallback;
+exports.getOid4vcCallbacks = getOid4vcCallbacks;
 exports.dynamicOid4vciClientAuthentication = dynamicOid4vciClientAuthentication;
-const oauth2_1 = require("@animo-id/oauth2");
 const core_1 = require("@credo-ts/core");
+const oauth2_1 = require("@openid4vc/oauth2");
 const utils_1 = require("./utils");
-function getOid4vciJwtVerifyCallback(agentContext) {
+function getOid4vcJwtVerifyCallback(agentContext, trustedCertificates) {
     const jwsService = agentContext.dependencyManager.resolve(core_1.JwsService);
     return async (signer, { compact }) => {
-        const { isValid } = await jwsService.verifyJws(agentContext, {
+        const { isValid, signerKeys } = await jwsService.verifyJws(agentContext, {
             jws: compact,
+            trustedCertificates,
             // Only handles kid as did resolution. JWK is handled by jws service
             jwkResolver: async () => {
                 if (signer.method === 'jwk') {
@@ -24,15 +27,94 @@ function getOid4vciJwtVerifyCallback(agentContext) {
                 throw new core_1.CredoError(`Unexpected call to jwk resolver for signer method ${signer.method}`);
             },
         });
-        return isValid;
+        if (!isValid) {
+            return { verified: false, signerJwk: undefined };
+        }
+        const signerKey = signerKeys[0];
+        const signerJwk = (0, core_1.getJwkFromKey)(signerKey).toJson();
+        if (signer.method === 'did') {
+            signerJwk.kid = signer.didUrl;
+        }
+        return { verified: true, signerJwk };
     };
 }
-function getOid4vciJwtSignCallback(agentContext) {
+function getOid4vcEncryptJweCallback(agentContext) {
+    return async (jweEncryptor, compact) => {
+        if (jweEncryptor.method !== 'jwk') {
+            throw new core_1.CredoError(`Jwt encryption method '${jweEncryptor.method}' is not supported for jwt signer. Only 'jwk' is supported.`);
+        }
+        const jwk = (0, core_1.getJwkFromJson)(jweEncryptor.publicJwk);
+        const key = jwk.key;
+        if (jweEncryptor.alg !== 'ECDH-ES') {
+            throw new core_1.CredoError("Only 'ECDH-ES' is supported as 'alg' value for JARM response encryption");
+        }
+        if (jweEncryptor.enc !== 'A256GCM' && jweEncryptor.enc !== 'A128GCM' && jweEncryptor.enc !== 'A128CBC-HS256') {
+            throw new core_1.CredoError("Only 'A256GCM', 'A128GCM', and 'A128CBC-HS256' is supported as 'enc' value for JARM response encryption");
+        }
+        if (key.keyType !== core_1.KeyType.P256) {
+            throw new core_1.CredoError(`Only '${core_1.KeyType.P256}' key type is supported for JARM response encryption`);
+        }
+        if (!agentContext.wallet.directEncryptCompactJweEcdhEs) {
+            throw new core_1.CredoError('Cannot decrypt Jarm Response, wallet does not support directEncryptCompactJweEcdhEs. You need to upgrade your wallet implementation.');
+        }
+        const jwe = await agentContext.wallet.directEncryptCompactJweEcdhEs({
+            data: core_1.Buffer.from(compact),
+            recipientKey: key,
+            header: { kid: jweEncryptor.publicJwk.kid },
+            encryptionAlgorithm: jweEncryptor.enc,
+            apu: jweEncryptor.apu ? core_1.TypedArrayEncoder.toBase64URL(core_1.TypedArrayEncoder.fromString(jweEncryptor.apu)) : undefined,
+            apv: jweEncryptor.apv ? core_1.TypedArrayEncoder.toBase64URL(core_1.TypedArrayEncoder.fromString(jweEncryptor.apv)) : undefined,
+        });
+        return { encryptionJwk: jweEncryptor.publicJwk, jwe };
+    };
+}
+function getOid4vcDecryptJweCallback(agentContext) {
+    return async (jwe, options) => {
+        const { header } = (0, oauth2_1.decodeJwtHeader)({ jwt: jwe });
+        const kid = options?.jwk?.kid ?? header.kid;
+        if (!kid) {
+            throw new core_1.CredoError('Uanbel to decrypt jwe. No kid or jwk found');
+        }
+        const key = core_1.Key.fromFingerprint(kid);
+        if (!agentContext.wallet.directDecryptCompactJweEcdhEs) {
+            throw new core_1.CredoError('Cannot decrypt Jarm Response, wallet does not support directDecryptCompactJweEcdhEs');
+        }
+        let decryptedPayload;
+        try {
+            const decrypted = await agentContext.wallet.directDecryptCompactJweEcdhEs({ compactJwe: jwe, recipientKey: key });
+            decryptedPayload = core_1.TypedArrayEncoder.toUtf8String(decrypted.data);
+        }
+        catch (_error) {
+            return {
+                decrypted: false,
+                encryptionJwk: options?.jwk,
+                payload: undefined,
+                header,
+            };
+        }
+        return {
+            decrypted: true,
+            decryptionJwk: (0, core_1.getJwkFromKey)(key).toJson(),
+            payload: decryptedPayload,
+            header,
+        };
+    };
+}
+function getOid4vcJwtSignCallback(agentContext) {
     const jwsService = agentContext.dependencyManager.resolve(core_1.JwsService);
     return async (signer, { payload, header }) => {
-        if (signer.method === 'custom' || signer.method === 'x5c') {
+        if (signer.method === 'custom' || signer.method === 'trustChain') {
             throw new core_1.CredoError(`Jwt signer method 'custom' and 'x5c' are not supported for jwt signer.`);
         }
+        if (signer.method === 'x5c') {
+            const leafCertificate = core_1.X509Service.getLeafCertificate(agentContext, { certificateChain: signer.x5c });
+            const jws = await jwsService.createJwsCompact(agentContext, {
+                protectedHeaderOptions: { ...header, alg: signer.alg, jwk: undefined },
+                payload: core_1.JwtPayload.fromJson(payload),
+                key: leafCertificate.publicKey,
+            });
+            return { jwt: jws, signerJwk: (0, core_1.getJwkFromKey)(leafCertificate.publicKey).toJson() };
+        }
         const key = signer.method === 'did' ? await (0, utils_1.getKeyFromDid)(agentContext, signer.didUrl) : (0, core_1.getJwkFromJson)(signer.publicJwk).key;
         const jwk = (0, core_1.getJwkFromKey)(key);
         if (!jwk.supportsSignatureAlgorithm(signer.alg)) {
@@ -46,17 +128,26 @@ function getOid4vciJwtSignCallback(agentContext) {
             payload: core_1.JsonEncoder.toBuffer(payload),
             key,
         });
-        return jwt;
+        return { jwt, signerJwk: (0, core_1.getJwkFromKey)(key).toJson() };
     };
 }
-function getOid4vciCallbacks(agentContext) {
+function getOid4vcCallbacks(agentContext, trustedCertificates) {
     return {
         hash: (data, alg) => core_1.Hasher.hash(data, alg.toLowerCase()),
         generateRandom: (length) => agentContext.wallet.getRandomValues(length),
-        signJwt: getOid4vciJwtSignCallback(agentContext),
+        signJwt: getOid4vcJwtSignCallback(agentContext),
         clientAuthentication: (0, oauth2_1.clientAuthenticationNone)(),
-        verifyJwt: getOid4vciJwtVerifyCallback(agentContext),
+        verifyJwt: getOid4vcJwtVerifyCallback(agentContext, trustedCertificates),
         fetch: agentContext.config.agentDependencies.fetch,
+        encryptJwe: getOid4vcEncryptJweCallback(agentContext),
+        decryptJwe: getOid4vcDecryptJweCallback(agentContext),
+        getX509CertificateMetadata: (certificate) => {
+            const leafCertificate = core_1.X509Service.getLeafCertificate(agentContext, { certificateChain: [certificate] });
+            return {
+                sanDnsNames: leafCertificate.sanDnsNames,
+                sanUriNames: leafCertificate.sanUriNames,
+            };
+        },
     };
 }
 /**

package/build/shared/callbacks.js.map

@@ -1 +1 @@
-{"version":3,"file":"callbacks.js","sourceRoot":"","sources":["../../src/shared/callbacks.ts"],"names":[],"mappings":";;AAcA,kEAsBC;AAED,8DA2BC;AAED,kDASC;AAMD,gFA4BC;AArGD,6CAAwF;AACxF,yCAA2G;AAE3G,mCAAuC;AAEvC,SAAgB,2BAA2B,CAAC,YAA0B;IACpE,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,iBAAU,CAAC,CAAA;IAErE,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,EAAE;YAC3D,GAAG,EAAE,OAAO;YACZ,oEAAoE;YACpE,WAAW,EAAE,KAAK,IAAI,EAAE;gBACtB,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC5B,OAAO,IAAA,qBAAc,EAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBACzC,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,MAAM,IAAA,qBAAa,EAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;oBAC5D,OAAO,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAA;gBAC3B,CAAC;gBAED,MAAM,IAAI,iBAAU,CAAC,qDAAqD,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;YAC5F,CAAC;SACF,CAAC,CAAA;QAEF,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;AACH,CAAC;AAED,SAAgB,yBAAyB,CAAC,YAA0B;IAClE,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,iBAAU,CAAC,CAAA;IAErE,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1D,MAAM,IAAI,iBAAU,CAAC,wEAAwE,CAAC,CAAA;QAChG,CAAC;QAED,MAAM,GAAG,GACP,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,qBAAc,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAA;QACnH,MAAM,GAAG,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAA;QAE9B,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,iBAAU,CAAC,aAAa,GAAG,CAAC,OAAO,8CAA8C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAA;QAC3G,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,YAAY,EAAE;YAC1D,sBAAsB,EAAE;gBACtB,GAAG,MAAM;gBACT,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,qBAAc,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aACzD;YACD,OAAO,EAAE,kBAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtC,GAAG;SACJ,CAAC,CAAA;QAEF,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;AACH,CAAC;AAED,SAAgB,mBAAmB,CAAC,YAA0B;IAC5D,OAAO;QACL,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,aAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QACzD,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC;QACvE,OAAO,EAAE,yBAAyB,CAAC,YAAY,CAAC;QAChD,oBAAoB,EAAE,IAAA,iCAAwB,GAAE;QAChD,SAAS,EAAE,2BAA2B,CAAC,YAAY,CAAC;QACpD,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK;KAChB,CAAA;AACtC,CAAC;AAED;;;GAGG;AACH,SAAgB,kCAAkC,CAChD,YAA0B,EAC1B,YAAmC;IAEnC,OAAO,CAAC,eAAe,EAAE,EAAE;QACzB,MAAM,mBAAmB,GAAG,YAAY,CAAC,0BAA0B,EAAE,IAAI,CACvE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,yBAAyB,CAAC,MAAM,CACrE,CAAA;QAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,qEAAqE;YACrE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAC9B,iCAAiC,eAAe,CAAC,yBAAyB,CAAC,MAAM,iBAAiB,YAAY,CAAC,QAAQ,qBAAqB,eAAe,CAAC,GAAG,GAAG,CACnK,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAU,CAClB,mDAAmD,mBAAmB,CAAC,MAAM,iBAAiB,YAAY,CAAC,QAAQ,qBAAqB,eAAe,CAAC,GAAG,8GAA8G,CAC1Q,CAAA;QACH,CAAC;QAED,OAAO,IAAA,oCAA2B,EAAC;YACjC,QAAQ,EAAE,mBAAmB,CAAC,oBAAoB,CAAC,QAAQ;YAC3D,YAAY,EAAE,mBAAmB,CAAC,oBAAoB,CAAC,YAAY;SACpE,CAAC,CAAC,eAAe,CAAC,CAAA;IACrB,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"callbacks.js","sourceRoot":"","sources":["../../src/shared/callbacks.ts"],"names":[],"mappings":";;AA6BA,gEAoCC;AAED,kEA0CC;AAED,kEAmCC;AAED,4DAuCC;AAED,gDAkBC;AAMD,gFA4BC;AAtOD,yCAauB;AACvB,8CAA0G;AAE1G,mCAAuC;AAEvC,SAAgB,0BAA0B,CACxC,YAA0B,EAC1B,mBAA8B;IAE9B,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,iBAAU,CAAC,CAAA;IAErE,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACnC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,EAAE;YACvE,GAAG,EAAE,OAAO;YACZ,mBAAmB;YACnB,oEAAoE;YACpE,WAAW,EAAE,KAAK,IAAI,EAAE;gBACtB,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC5B,OAAO,IAAA,qBAAc,EAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBACzC,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,MAAM,IAAA,qBAAa,EAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;oBAC5D,OAAO,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAA;gBAC3B,CAAC;gBAED,MAAM,IAAI,iBAAU,CAAC,qDAAqD,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;YAC5F,CAAC;SACF,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;QAClD,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,SAAS,GAAG,IAAA,oBAAa,EAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAA;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC5B,SAAS,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAA;QAC/B,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACtC,CAAC,CAAA;AACH,CAAC;AAED,SAAgB,2BAA2B,CAAC,YAA0B;IACpE,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE;QACrC,IAAI,YAAY,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,iBAAU,CAClB,0BAA0B,YAAY,CAAC,MAAM,6DAA6D,CAC3G,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAA,qBAAc,EAAC,YAAY,CAAC,SAAS,CAAC,CAAA;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAA;QAEnB,IAAI,YAAY,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAU,CAAC,yEAAyE,CAAC,CAAA;QACjG,CAAC;QAED,IAAI,YAAY,CAAC,GAAG,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,KAAK,eAAe,EAAE,CAAC;YAC7G,MAAM,IAAI,iBAAU,CAClB,yGAAyG,CAC1G,CAAA;QACH,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,KAAK,cAAO,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,iBAAU,CAAC,SAAS,cAAO,CAAC,IAAI,sDAAsD,CAAC,CAAA;QACnG,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,6BAA6B,EAAE,CAAC;YACvD,MAAM,IAAI,iBAAU,CAClB,sIAAsI,CACvI,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,6BAA6B,CAAC;YAClE,IAAI,EAAE,aAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1B,YAAY,EAAE,GAAG;YACjB,MAAM,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE;YAC3C,mBAAmB,EAAE,YAAY,CAAC,GAAG;YACrC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,wBAAiB,CAAC,WAAW,CAAC,wBAAiB,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YACjH,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,wBAAiB,CAAC,WAAW,CAAC,wBAAiB,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;SAClH,CAAC,CAAA;QAEF,OAAO,EAAE,aAAa,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,CAAA;IACvD,CAAC,CAAA;AACH,CAAC;AAED,SAAgB,2BAA2B,CAAC,YAA0B;IACpE,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,wBAAe,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QAEhD,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAA;QAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,iBAAU,CAAC,4CAA4C,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,GAAG,GAAG,UAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,6BAA6B,EAAE,CAAC;YACvD,MAAM,IAAI,iBAAU,CAAC,qFAAqF,CAAC,CAAA;QAC7G,CAAC;QAED,IAAI,gBAAwB,CAAA;QAE5B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,6BAA6B,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAA;YACjH,gBAAgB,GAAG,wBAAiB,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACnE,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,aAAa,EAAE,OAAO,EAAE,GAAG;gBAC3B,OAAO,EAAE,SAAS;gBAClB,MAAM;aACP,CAAA;QACH,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC,MAAM,EAAE;YAC1C,OAAO,EAAE,gBAAgB;YACzB,MAAM;SACP,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED,SAAgB,wBAAwB,CAAC,YAA0B;IACjE,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,iBAAU,CAAC,CAAA;IAErE,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACjE,MAAM,IAAI,iBAAU,CAAC,wEAAwE,CAAC,CAAA;QAChG,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,eAAe,GAAG,kBAAW,CAAC,kBAAkB,CAAC,YAAY,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;YAEtG,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,YAAY,EAAE;gBAC1D,sBAAsB,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE;gBACtE,OAAO,EAAE,iBAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACrC,GAAG,EAAE,eAAe,CAAC,SAAS;aAC/B,CAAC,CAAA;YAEF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,IAAA,oBAAa,EAAC,eAAe,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAA;QACnF,CAAC;QAED,MAAM,GAAG,GACP,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,qBAAc,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAA;QACnH,MAAM,GAAG,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAA;QAE9B,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,iBAAU,CAAC,aAAa,GAAG,CAAC,OAAO,8CAA8C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAA;QAC3G,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,YAAY,EAAE;YAC1D,sBAAsB,EAAE;gBACtB,GAAG,MAAM;gBACT,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,qBAAc,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aACzD;YACD,OAAO,EAAE,kBAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtC,GAAG;SACJ,CAAC,CAAA;QAEF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAA;IACxD,CAAC,CAAA;AACH,CAAC;AAED,SAAgB,kBAAkB,CAAC,YAA0B,EAAE,mBAA8B;IAC3F,OAAO;QACL,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,aAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QACzD,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC;QACvE,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC;QAC/C,oBAAoB,EAAE,IAAA,iCAAwB,GAAE;QAChD,SAAS,EAAE,0BAA0B,CAAC,YAAY,EAAE,mBAAmB,CAAC;QACxE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK;QAClD,UAAU,EAAE,2BAA2B,CAAC,YAAY,CAAC;QACrD,UAAU,EAAE,2BAA2B,CAAC,YAAY,CAAC;QACrD,0BAA0B,EAAE,CAAC,WAAmB,EAAE,EAAE;YAClD,MAAM,eAAe,GAAG,kBAAW,CAAC,kBAAkB,CAAC,YAAY,EAAE,EAAE,gBAAgB,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YACzG,OAAO;gBACL,WAAW,EAAE,eAAe,CAAC,WAAW;gBACxC,WAAW,EAAE,eAAe,CAAC,WAAW;aACzC,CAAA;QACH,CAAC;KACiC,CAAA;AACtC,CAAC;AAED;;;GAGG;AACH,SAAgB,kCAAkC,CAChD,YAA0B,EAC1B,YAAmC;IAEnC,OAAO,CAAC,eAAe,EAAE,EAAE;QACzB,MAAM,mBAAmB,GAAG,YAAY,CAAC,0BAA0B,EAAE,IAAI,CACvE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,yBAAyB,CAAC,MAAM,CACrE,CAAA;QAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,qEAAqE;YACrE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAC9B,iCAAiC,eAAe,CAAC,yBAAyB,CAAC,MAAM,iBAAiB,YAAY,CAAC,QAAQ,qBAAqB,eAAe,CAAC,GAAG,GAAG,CACnK,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAU,CAClB,mDAAmD,mBAAmB,CAAC,MAAM,iBAAiB,YAAY,CAAC,QAAQ,qBAAqB,eAAe,CAAC,GAAG,8GAA8G,CAC1Q,CAAA;QACH,CAAC;QAED,OAAO,IAAA,oCAA2B,EAAC;YACjC,QAAQ,EAAE,mBAAmB,CAAC,oBAAoB,CAAC,QAAQ;YAC3D,YAAY,EAAE,mBAAmB,CAAC,oBAAoB,CAAC,YAAY;SACpE,CAAC,CAAC,eAAe,CAAC,CAAA;IACrB,CAAC,CAAA;AACH,CAAC"}