@credo-ts/openid4vc 0.6.1-pr-2091-20241119140918 → 0.6.1

package/build/openid4vc-issuer/router/redirectEndpoint.mjs

@@ -0,0 +1,124 @@
+import "../OpenId4VcIssuerModuleConfig.mjs";
+import { getRequestContext, sendOauth2ErrorResponse, sendUnknownServerErrorResponse } from "../../shared/router/context.mjs";
+import "../../shared/router/index.mjs";
+import { getOid4vcCallbacks } from "../../shared/callbacks.mjs";
+import "../../shared/index.mjs";
+import { OpenId4VcIssuanceSessionState } from "../OpenId4VcIssuanceSessionState.mjs";
+import { OpenId4VcIssuerService } from "../OpenId4VcIssuerService.mjs";
+import { Kms, TypedArrayEncoder, joinUriParts } from "@credo-ts/core";
+import { Oauth2ClientErrorResponseError, Oauth2ErrorCodes, Oauth2ServerErrorResponseError, parseAuthorizationResponseRedirectUrl, verifyIdTokenJwt } from "@openid4vc/oauth2";
+import { addSecondsToDate } from "@openid4vc/utils";
+
+//#region src/openid4vc-issuer/router/redirectEndpoint.ts
+function configureRedirectEndpoint(router, config) {
+	router.get(config.redirectEndpoint, async (request, response, next) => {
+		const { agentContext, issuer } = getRequestContext(request);
+		const openId4VcIssuerService = agentContext.dependencyManager.resolve(OpenId4VcIssuerService);
+		const issuerMetadata = await openId4VcIssuerService.getIssuerMetadata(agentContext, issuer);
+		let issuanceSession = null;
+		try {
+			const authorizationResponse = parseAuthorizationResponseRedirectUrl({ url: joinUriParts(issuerMetadata.credentialIssuer.credential_issuer, [request.originalUrl]) });
+			if (!authorizationResponse.state) throw new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.ServerError,
+				error_description: `Missing required 'state' parameter`
+			});
+			issuanceSession = await openId4VcIssuerService.findSingleIssuanceSessionByQuery(agentContext, {
+				issuerId: issuer.issuerId,
+				chainedIdentityState: authorizationResponse.state
+			});
+			if (!issuanceSession || issuanceSession.state !== OpenId4VcIssuanceSessionState.AuthorizationInitiated) throw new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.InvalidRequest,
+				error_description: `Invalid 'state' parameter`
+			}, { internalMessage: !issuanceSession ? `Issuance session not found for identity chaining 'state' parameter '${authorizationResponse.state}'` : `Issuance session '${issuanceSession.id}' has state '${issuanceSession.state}' but expected ${OpenId4VcIssuanceSessionState.AuthorizationInitiated}` });
+			if (!issuanceSession.chainedIdentity?.externalAuthorizationServerUrl || !issuanceSession.chainedIdentity.redirectUri) throw new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.InvalidRequest,
+				error_description: "The session is invalid or has expired."
+			}, { internalMessage: `Issuance session '${issuanceSession.id}' does not have identity chaining configured, so it's not compatible with the redirect endpoint.` });
+			if (authorizationResponse.error) throw new Oauth2ServerErrorResponseError(authorizationResponse);
+			if (!authorizationResponse.code) throw new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.ServerError,
+				error_description: `Missing required 'error' or 'code' parameter`
+			});
+			const oauth2Client = openId4VcIssuerService.getOauth2Client(agentContext, issuer);
+			const authorizationServerUrl = issuanceSession.chainedIdentity.externalAuthorizationServerUrl;
+			const authorizationServerConfig = issuer.chainedAuthorizationServerConfigs?.find((config$1) => config$1.issuer === authorizationServerUrl);
+			if (!authorizationServerConfig) throw new Oauth2ServerErrorResponseError({ error: Oauth2ErrorCodes.ServerError }, { internalMessage: `Issuer '${issuer.issuerId}' does not have a chained authorization server config for issuer '${authorizationServerUrl}'` });
+			const authorizationServerMetadata = await oauth2Client.fetchAuthorizationServerMetadata(authorizationServerConfig.issuer);
+			if (!authorizationServerMetadata) throw new Oauth2ServerErrorResponseError({
+				error: Oauth2ErrorCodes.ServerError,
+				error_description: `Unable to retrieve authorization server metadata from external identity provider.`
+			}, { internalMessage: `Unable to retrieve authorization server metadata from '${authorizationServerConfig.issuer}'` });
+			const { accessTokenResponse } = await oauth2Client.retrieveAuthorizationCodeAccessToken({
+				authorizationCode: authorizationResponse.code,
+				authorizationServerMetadata,
+				pkceCodeVerifier: issuanceSession.chainedIdentity.pkceCodeVerifier,
+				redirectUri: joinUriParts(config.baseUrl, [issuer.issuerId, "redirect"])
+			}).catch((error) => {
+				if (error instanceof Oauth2ClientErrorResponseError) switch (error.errorResponse.error) {
+					case Oauth2ErrorCodes.InvalidGrant: throw new Oauth2ServerErrorResponseError({ error: Oauth2ErrorCodes.InvalidGrant }, {
+						internalMessage: `Invalid authorization code received from '${authorizationServerMetadata.issuer}'.`,
+						cause: error
+					});
+					case Oauth2ErrorCodes.AccessDenied: throw new Oauth2ServerErrorResponseError({ error: Oauth2ErrorCodes.AccessDenied }, {
+						internalMessage: `The request has been denied by the user at '${authorizationServerMetadata.issuer}'.`,
+						cause: error
+					});
+				}
+				throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.ServerError,
+					error_description: "Error processing authorization code"
+				}, {
+					internalMessage: `Error occurred during retrieval of access token from ${authorizationServerMetadata.issuer}.`,
+					cause: error
+				});
+			});
+			if (accessTokenResponse.scope?.split(" ").includes("openid")) {
+				const idToken = accessTokenResponse.id_token;
+				if (typeof idToken !== "string") throw new Oauth2ServerErrorResponseError({
+					error: Oauth2ErrorCodes.ServerError,
+					error_description: `Missing 'id_token' in access token response`
+				}, { internalMessage: `id_token is missing from access token response from ${authorizationServerMetadata.issuer} even though 'openid' scope was requested.` });
+				await verifyIdTokenJwt({
+					idToken,
+					authorizationServer: authorizationServerMetadata,
+					clientId: authorizationServerConfig.clientAuthentication.clientId,
+					callbacks: getOid4vcCallbacks(agentContext)
+				});
+			}
+			const kms = agentContext.resolve(Kms.KeyManagementApi);
+			const authorizationCode = TypedArrayEncoder.toBase64URL(kms.randomBytes({ length: 32 }));
+			const authorizationCodeExpiresAt = addSecondsToDate(/* @__PURE__ */ new Date(), config.authorizationCodeExpiresInSeconds);
+			const redirectUri = new URL(issuanceSession.chainedIdentity.redirectUri);
+			redirectUri.searchParams.set("code", authorizationCode);
+			if (issuanceSession.chainedIdentity.state) redirectUri.searchParams.set("state", issuanceSession.chainedIdentity.state);
+			issuanceSession.authorization = {
+				...issuanceSession.authorization,
+				code: authorizationCode,
+				codeExpiresAt: authorizationCodeExpiresAt
+			};
+			issuanceSession.chainedIdentity = {
+				...issuanceSession.chainedIdentity,
+				externalAccessTokenResponse: accessTokenResponse
+			};
+			await openId4VcIssuerService.updateState(agentContext, issuanceSession, OpenId4VcIssuanceSessionState.AuthorizationGranted);
+			return response.redirect(redirectUri.toString());
+		} catch (error) {
+			if (error instanceof Oauth2ServerErrorResponseError) {
+				if (issuanceSession?.chainedIdentity?.redirectUri) {
+					const redirectUri = new URL(issuanceSession.chainedIdentity.redirectUri);
+					redirectUri.searchParams.set("error", error.errorResponse.error);
+					if (error.errorResponse.error_description) redirectUri.searchParams.set("error_description", error.errorResponse.error_description);
+					if (issuanceSession.chainedIdentity.state) redirectUri.searchParams.set("state", issuanceSession.chainedIdentity.state);
+					agentContext.config.logger.warn(`[OID4VC] Sending oauth2 error response: ${JSON.stringify(error.message)}`, { error });
+					return response.redirect(redirectUri.toString());
+				}
+				return sendOauth2ErrorResponse(response, next, agentContext.config.logger, error);
+			}
+			return sendUnknownServerErrorResponse(response, next, agentContext.config.logger, error);
+		}
+	});
+}
+
+//#endregion
+export { configureRedirectEndpoint };
+//# sourceMappingURL=redirectEndpoint.mjs.map

package/build/openid4vc-issuer/router/redirectEndpoint.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirectEndpoint.mjs","names":["issuanceSession: OpenId4VcIssuanceSessionRecord | null","config"],"sources":["../../../src/openid4vc-issuer/router/redirectEndpoint.ts"],"sourcesContent":["import { joinUriParts, Kms, TypedArrayEncoder } from '@credo-ts/core'\nimport {\n  Oauth2ClientErrorResponseError,\n  Oauth2ErrorCodes,\n  Oauth2ServerErrorResponseError,\n  parseAuthorizationResponseRedirectUrl,\n  verifyIdTokenJwt,\n} from '@openid4vc/oauth2'\nimport { addSecondsToDate } from '@openid4vc/utils'\nimport type { NextFunction, Response, Router } from 'express'\nimport { getOid4vcCallbacks } from '../../shared'\nimport { getRequestContext, sendOauth2ErrorResponse, sendUnknownServerErrorResponse } from '../../shared/router'\nimport { OpenId4VcIssuanceSessionState } from '../OpenId4VcIssuanceSessionState'\nimport { OpenId4VcIssuerModuleConfig } from '../OpenId4VcIssuerModuleConfig'\nimport { OpenId4VcIssuerService } from '../OpenId4VcIssuerService'\nimport type { OpenId4VcIssuanceSessionRecord } from '../repository'\nimport type { OpenId4VcIssuanceRequest } from './requestContext'\n\nexport function configureRedirectEndpoint(router: Router, config: OpenId4VcIssuerModuleConfig) {\n  router.get(\n    config.redirectEndpoint,\n    async (request: OpenId4VcIssuanceRequest, response: Response, next: NextFunction) => {\n      const requestContext = getRequestContext(request)\n      const { agentContext, issuer } = requestContext\n      const openId4VcIssuerService = agentContext.dependencyManager.resolve(OpenId4VcIssuerService)\n      const issuerMetadata = await openId4VcIssuerService.getIssuerMetadata(agentContext, issuer)\n\n      let issuanceSession: OpenId4VcIssuanceSessionRecord | null = null\n      try {\n        const fullRequestUrl = joinUriParts(issuerMetadata.credentialIssuer.credential_issuer, [request.originalUrl])\n        const authorizationResponse = parseAuthorizationResponseRedirectUrl({\n          url: fullRequestUrl,\n        })\n\n        if (!authorizationResponse.state) {\n          throw new Oauth2ServerErrorResponseError({\n            // Server error because it's an error of the external IDP\n            error: Oauth2ErrorCodes.ServerError,\n            error_description: `Missing required 'state' parameter`,\n          })\n        }\n\n        issuanceSession = await openId4VcIssuerService.findSingleIssuanceSessionByQuery(agentContext, {\n          issuerId: issuer.issuerId,\n          chainedIdentityState: authorizationResponse.state,\n        })\n\n        if (!issuanceSession || issuanceSession.state !== OpenId4VcIssuanceSessionState.AuthorizationInitiated) {\n          throw new Oauth2ServerErrorResponseError(\n            {\n              error: Oauth2ErrorCodes.InvalidRequest,\n              error_description: `Invalid 'state' parameter`,\n            },\n            {\n              internalMessage: !issuanceSession\n                ? `Issuance session not found for identity chaining 'state' parameter '${authorizationResponse.state}'`\n                : `Issuance session '${issuanceSession.id}' has state '${\n                    issuanceSession.state\n                  }' but expected ${OpenId4VcIssuanceSessionState.AuthorizationInitiated}`,\n            }\n          )\n        }\n\n        if (\n          !issuanceSession.chainedIdentity?.externalAuthorizationServerUrl ||\n          !issuanceSession.chainedIdentity.redirectUri\n        ) {\n          throw new Oauth2ServerErrorResponseError(\n            {\n              error: Oauth2ErrorCodes.InvalidRequest,\n              error_description: 'The session is invalid or has expired.',\n            },\n            {\n              internalMessage: `Issuance session '${issuanceSession.id}' does not have identity chaining configured, so it's not compatible with the redirect endpoint.`,\n            }\n          )\n        }\n\n        // Throw the error. This will be caught and processed below.\n        if (authorizationResponse.error) {\n          throw new Oauth2ServerErrorResponseError(authorizationResponse)\n        }\n\n        if (!authorizationResponse.code) {\n          throw new Oauth2ServerErrorResponseError({\n            error: Oauth2ErrorCodes.ServerError,\n            error_description: `Missing required 'error' or 'code' parameter`,\n          })\n        }\n\n        const oauth2Client = openId4VcIssuerService.getOauth2Client(agentContext, issuer)\n        const authorizationServerUrl = issuanceSession.chainedIdentity.externalAuthorizationServerUrl\n        const authorizationServerConfig = issuer.chainedAuthorizationServerConfigs?.find(\n          (config) => config.issuer === authorizationServerUrl\n        )\n        if (!authorizationServerConfig) {\n          throw new Oauth2ServerErrorResponseError(\n            {\n              error: Oauth2ErrorCodes.ServerError,\n            },\n            {\n              internalMessage: `Issuer '${issuer.issuerId}' does not have a chained authorization server config for issuer '${authorizationServerUrl}'`,\n            }\n          )\n        }\n\n        const authorizationServerMetadata = await oauth2Client.fetchAuthorizationServerMetadata(\n          authorizationServerConfig.issuer\n        )\n        if (!authorizationServerMetadata) {\n          throw new Oauth2ServerErrorResponseError(\n            {\n              error: Oauth2ErrorCodes.ServerError,\n              error_description: `Unable to retrieve authorization server metadata from external identity provider.`,\n            },\n            {\n              internalMessage: `Unable to retrieve authorization server metadata from '${authorizationServerConfig.issuer}'`,\n            }\n          )\n        }\n\n        // Retrieve access token\n        // TODO: add support for DPoP\n        const { accessTokenResponse } = await oauth2Client\n          .retrieveAuthorizationCodeAccessToken({\n            authorizationCode: authorizationResponse.code,\n            authorizationServerMetadata,\n            pkceCodeVerifier: issuanceSession.chainedIdentity.pkceCodeVerifier,\n            redirectUri: joinUriParts(config.baseUrl, [issuer.issuerId, 'redirect']),\n          })\n          .catch((error) => {\n            if (error instanceof Oauth2ClientErrorResponseError) {\n              switch (error.errorResponse.error) {\n                case Oauth2ErrorCodes.InvalidGrant:\n                  throw new Oauth2ServerErrorResponseError(\n                    {\n                      error: Oauth2ErrorCodes.InvalidGrant,\n                    },\n                    {\n                      internalMessage: `Invalid authorization code received from '${authorizationServerMetadata.issuer}'.`,\n                      cause: error,\n                    }\n                  )\n                case Oauth2ErrorCodes.AccessDenied:\n                  throw new Oauth2ServerErrorResponseError(\n                    {\n                      error: Oauth2ErrorCodes.AccessDenied,\n                    },\n                    {\n                      internalMessage: `The request has been denied by the user at '${authorizationServerMetadata.issuer}'.`,\n                      cause: error,\n                    }\n                  )\n              }\n            }\n\n            throw new Oauth2ServerErrorResponseError(\n              {\n                error: Oauth2ErrorCodes.ServerError,\n                error_description: 'Error processing authorization code',\n              },\n              {\n                internalMessage: `Error occurred during retrieval of access token from ${authorizationServerMetadata.issuer}.`,\n                cause: error,\n              }\n            )\n          })\n\n        // Verify the ID Token if 'openid' scope was requested\n        if (accessTokenResponse.scope?.split(' ').includes('openid')) {\n          const idToken = accessTokenResponse.id_token\n          if (typeof idToken !== 'string') {\n            throw new Oauth2ServerErrorResponseError(\n              {\n                error: Oauth2ErrorCodes.ServerError,\n                error_description: `Missing 'id_token' in access token response`,\n              },\n              {\n                internalMessage: `id_token is missing from access token response from ${authorizationServerMetadata.issuer} even though 'openid' scope was requested.`,\n              }\n            )\n          }\n\n          await verifyIdTokenJwt({\n            idToken,\n            authorizationServer: authorizationServerMetadata,\n            clientId: authorizationServerConfig.clientAuthentication.clientId,\n            callbacks: getOid4vcCallbacks(agentContext),\n          })\n        }\n\n        // Grant authorization\n        const kms = agentContext.resolve(Kms.KeyManagementApi)\n        const authorizationCode = TypedArrayEncoder.toBase64URL(kms.randomBytes({ length: 32 }))\n        const authorizationCodeExpiresAt = addSecondsToDate(new Date(), config.authorizationCodeExpiresInSeconds)\n\n        const redirectUri = new URL(issuanceSession.chainedIdentity.redirectUri)\n        redirectUri.searchParams.set('code', authorizationCode)\n\n        if (issuanceSession.chainedIdentity.state) {\n          redirectUri.searchParams.set('state', issuanceSession.chainedIdentity.state)\n        }\n\n        // Update authorization information\n        issuanceSession.authorization = {\n          ...issuanceSession.authorization,\n          code: authorizationCode,\n          codeExpiresAt: authorizationCodeExpiresAt,\n        }\n\n        // Store access token response\n        issuanceSession.chainedIdentity = {\n          ...issuanceSession.chainedIdentity,\n          externalAccessTokenResponse: accessTokenResponse,\n        }\n\n        // TODO: we need to start using locks so we can't get corrupted state\n        await openId4VcIssuerService.updateState(\n          agentContext,\n          issuanceSession,\n          OpenId4VcIssuanceSessionState.AuthorizationGranted\n        )\n\n        return response.redirect(redirectUri.toString())\n      } catch (error) {\n        if (error instanceof Oauth2ServerErrorResponseError) {\n          // Redirect to the redirect URI if available.\n          if (issuanceSession?.chainedIdentity?.redirectUri) {\n            const redirectUri = new URL(issuanceSession.chainedIdentity.redirectUri)\n            redirectUri.searchParams.set('error', error.errorResponse.error)\n            if (error.errorResponse.error_description) {\n              redirectUri.searchParams.set('error_description', error.errorResponse.error_description)\n            }\n            if (issuanceSession.chainedIdentity.state) {\n              redirectUri.searchParams.set('state', issuanceSession.chainedIdentity.state)\n            }\n\n            agentContext.config.logger.warn(\n              `[OID4VC] Sending oauth2 error response: ${JSON.stringify(error.message)}`,\n              {\n                error,\n              }\n            )\n\n            return response.redirect(redirectUri.toString())\n          }\n\n          return sendOauth2ErrorResponse(response, next, agentContext.config.logger, error)\n        }\n\n        return sendUnknownServerErrorResponse(response, next, agentContext.config.logger, error)\n      }\n    }\n  )\n}\n"],"mappings":";;;;;;;;;;;;AAkBA,SAAgB,0BAA0B,QAAgB,QAAqC;AAC7F,QAAO,IACL,OAAO,kBACP,OAAO,SAAmC,UAAoB,SAAuB;EAEnF,MAAM,EAAE,cAAc,WADC,kBAAkB,QAAQ;EAEjD,MAAM,yBAAyB,aAAa,kBAAkB,QAAQ,uBAAuB;EAC7F,MAAM,iBAAiB,MAAM,uBAAuB,kBAAkB,cAAc,OAAO;EAE3F,IAAIA,kBAAyD;AAC7D,MAAI;GAEF,MAAM,wBAAwB,sCAAsC,EAClE,KAFqB,aAAa,eAAe,iBAAiB,mBAAmB,CAAC,QAAQ,YAAY,CAAC,EAG5G,CAAC;AAEF,OAAI,CAAC,sBAAsB,MACzB,OAAM,IAAI,+BAA+B;IAEvC,OAAO,iBAAiB;IACxB,mBAAmB;IACpB,CAAC;AAGJ,qBAAkB,MAAM,uBAAuB,iCAAiC,cAAc;IAC5F,UAAU,OAAO;IACjB,sBAAsB,sBAAsB;IAC7C,CAAC;AAEF,OAAI,CAAC,mBAAmB,gBAAgB,UAAU,8BAA8B,uBAC9E,OAAM,IAAI,+BACR;IACE,OAAO,iBAAiB;IACxB,mBAAmB;IACpB,EACD,EACE,iBAAiB,CAAC,kBACd,uEAAuE,sBAAsB,MAAM,KACnG,qBAAqB,gBAAgB,GAAG,eACtC,gBAAgB,MACjB,iBAAiB,8BAA8B,0BACrD,CACF;AAGH,OACE,CAAC,gBAAgB,iBAAiB,kCAClC,CAAC,gBAAgB,gBAAgB,YAEjC,OAAM,IAAI,+BACR;IACE,OAAO,iBAAiB;IACxB,mBAAmB;IACpB,EACD,EACE,iBAAiB,qBAAqB,gBAAgB,GAAG,mGAC1D,CACF;AAIH,OAAI,sBAAsB,MACxB,OAAM,IAAI,+BAA+B,sBAAsB;AAGjE,OAAI,CAAC,sBAAsB,KACzB,OAAM,IAAI,+BAA+B;IACvC,OAAO,iBAAiB;IACxB,mBAAmB;IACpB,CAAC;GAGJ,MAAM,eAAe,uBAAuB,gBAAgB,cAAc,OAAO;GACjF,MAAM,yBAAyB,gBAAgB,gBAAgB;GAC/D,MAAM,4BAA4B,OAAO,mCAAmC,MACzE,aAAWC,SAAO,WAAW,uBAC/B;AACD,OAAI,CAAC,0BACH,OAAM,IAAI,+BACR,EACE,OAAO,iBAAiB,aACzB,EACD,EACE,iBAAiB,WAAW,OAAO,SAAS,oEAAoE,uBAAuB,IACxI,CACF;GAGH,MAAM,8BAA8B,MAAM,aAAa,iCACrD,0BAA0B,OAC3B;AACD,OAAI,CAAC,4BACH,OAAM,IAAI,+BACR;IACE,OAAO,iBAAiB;IACxB,mBAAmB;IACpB,EACD,EACE,iBAAiB,0DAA0D,0BAA0B,OAAO,IAC7G,CACF;GAKH,MAAM,EAAE,wBAAwB,MAAM,aACnC,qCAAqC;IACpC,mBAAmB,sBAAsB;IACzC;IACA,kBAAkB,gBAAgB,gBAAgB;IAClD,aAAa,aAAa,OAAO,SAAS,CAAC,OAAO,UAAU,WAAW,CAAC;IACzE,CAAC,CACD,OAAO,UAAU;AAChB,QAAI,iBAAiB,+BACnB,SAAQ,MAAM,cAAc,OAA5B;KACE,KAAK,iBAAiB,aACpB,OAAM,IAAI,+BACR,EACE,OAAO,iBAAiB,cACzB,EACD;MACE,iBAAiB,6CAA6C,4BAA4B,OAAO;MACjG,OAAO;MACR,CACF;KACH,KAAK,iBAAiB,aACpB,OAAM,IAAI,+BACR,EACE,OAAO,iBAAiB,cACzB,EACD;MACE,iBAAiB,+CAA+C,4BAA4B,OAAO;MACnG,OAAO;MACR,CACF;;AAIP,UAAM,IAAI,+BACR;KACE,OAAO,iBAAiB;KACxB,mBAAmB;KACpB,EACD;KACE,iBAAiB,wDAAwD,4BAA4B,OAAO;KAC5G,OAAO;KACR,CACF;KACD;AAGJ,OAAI,oBAAoB,OAAO,MAAM,IAAI,CAAC,SAAS,SAAS,EAAE;IAC5D,MAAM,UAAU,oBAAoB;AACpC,QAAI,OAAO,YAAY,SACrB,OAAM,IAAI,+BACR;KACE,OAAO,iBAAiB;KACxB,mBAAmB;KACpB,EACD,EACE,iBAAiB,uDAAuD,4BAA4B,OAAO,6CAC5G,CACF;AAGH,UAAM,iBAAiB;KACrB;KACA,qBAAqB;KACrB,UAAU,0BAA0B,qBAAqB;KACzD,WAAW,mBAAmB,aAAa;KAC5C,CAAC;;GAIJ,MAAM,MAAM,aAAa,QAAQ,IAAI,iBAAiB;GACtD,MAAM,oBAAoB,kBAAkB,YAAY,IAAI,YAAY,EAAE,QAAQ,IAAI,CAAC,CAAC;GACxF,MAAM,6BAA6B,iCAAiB,IAAI,MAAM,EAAE,OAAO,kCAAkC;GAEzG,MAAM,cAAc,IAAI,IAAI,gBAAgB,gBAAgB,YAAY;AACxE,eAAY,aAAa,IAAI,QAAQ,kBAAkB;AAEvD,OAAI,gBAAgB,gBAAgB,MAClC,aAAY,aAAa,IAAI,SAAS,gBAAgB,gBAAgB,MAAM;AAI9E,mBAAgB,gBAAgB;IAC9B,GAAG,gBAAgB;IACnB,MAAM;IACN,eAAe;IAChB;AAGD,mBAAgB,kBAAkB;IAChC,GAAG,gBAAgB;IACnB,6BAA6B;IAC9B;AAGD,SAAM,uBAAuB,YAC3B,cACA,iBACA,8BAA8B,qBAC/B;AAED,UAAO,SAAS,SAAS,YAAY,UAAU,CAAC;WACzC,OAAO;AACd,OAAI,iBAAiB,gCAAgC;AAEnD,QAAI,iBAAiB,iBAAiB,aAAa;KACjD,MAAM,cAAc,IAAI,IAAI,gBAAgB,gBAAgB,YAAY;AACxE,iBAAY,aAAa,IAAI,SAAS,MAAM,cAAc,MAAM;AAChE,SAAI,MAAM,cAAc,kBACtB,aAAY,aAAa,IAAI,qBAAqB,MAAM,cAAc,kBAAkB;AAE1F,SAAI,gBAAgB,gBAAgB,MAClC,aAAY,aAAa,IAAI,SAAS,gBAAgB,gBAAgB,MAAM;AAG9E,kBAAa,OAAO,OAAO,KACzB,2CAA2C,KAAK,UAAU,MAAM,QAAQ,IACxE,EACE,OACD,CACF;AAED,YAAO,SAAS,SAAS,YAAY,UAAU,CAAC;;AAGlD,WAAO,wBAAwB,UAAU,MAAM,aAAa,OAAO,QAAQ,MAAM;;AAGnF,UAAO,+BAA+B,UAAU,MAAM,aAAa,OAAO,QAAQ,MAAM;;GAG7F"}

package/build/openid4vc-issuer/util/txCode.mjs

@@ -0,0 +1,18 @@
+import { Kms } from "@credo-ts/core";
+
+//#region src/openid4vc-issuer/util/txCode.ts
+function generateTxCode(agentContext, txCode) {
+	const kms = agentContext.resolve(Kms.KeyManagementApi);
+	const length = txCode.length ?? 4;
+	const inputMode = txCode.input_mode ?? "numeric";
+	const numbers = "0123456789";
+	const characters = inputMode === "numeric" ? numbers : numbers + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+	const random = kms.randomBytes({ length });
+	let result = "";
+	for (let i = 0; i < length; i++) result += characters[random[i] % characters.length];
+	return result;
+}
+
+//#endregion
+export { generateTxCode };
+//# sourceMappingURL=txCode.mjs.map

package/build/openid4vc-issuer/util/txCode.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"txCode.mjs","names":[],"sources":["../../../src/openid4vc-issuer/util/txCode.ts"],"sourcesContent":["import { type AgentContext, Kms } from '@credo-ts/core'\nimport type { OpenId4VciTxCode } from '../../shared'\n\nexport function generateTxCode(agentContext: AgentContext, txCode: OpenId4VciTxCode) {\n  const kms = agentContext.resolve(Kms.KeyManagementApi)\n\n  const length = txCode.length ?? 4\n  const inputMode = txCode.input_mode ?? 'numeric'\n\n  const numbers = '0123456789'\n  const letters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'\n  const characters = inputMode === 'numeric' ? numbers : numbers + letters\n  const random = kms.randomBytes({ length })\n\n  let result = ''\n  for (let i = 0; i < length; i++) {\n    result += characters[random[i] % characters.length]\n  }\n\n  return result\n}\n"],"mappings":";;;AAGA,SAAgB,eAAe,cAA4B,QAA0B;CACnF,MAAM,MAAM,aAAa,QAAQ,IAAI,iBAAiB;CAEtD,MAAM,SAAS,OAAO,UAAU;CAChC,MAAM,YAAY,OAAO,cAAc;CAEvC,MAAM,UAAU;CAEhB,MAAM,aAAa,cAAc,YAAY,UAAU,UADvC;CAEhB,MAAM,SAAS,IAAI,YAAY,EAAE,QAAQ,CAAC;CAE1C,IAAI,SAAS;AACb,MAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,IAC1B,WAAU,WAAW,OAAO,KAAK,WAAW;AAG9C,QAAO"}

package/build/openid4vc-verifier/OpenId4VcVerificationSessionState.d.mts

@@ -0,0 +1,10 @@
+//#region src/openid4vc-verifier/OpenId4VcVerificationSessionState.d.ts
+declare enum OpenId4VcVerificationSessionState {
+  RequestCreated = "RequestCreated",
+  RequestUriRetrieved = "RequestUriRetrieved",
+  ResponseVerified = "ResponseVerified",
+  Error = "Error",
+}
+//#endregion
+export { OpenId4VcVerificationSessionState };
+//# sourceMappingURL=OpenId4VcVerificationSessionState.d.mts.map

package/build/openid4vc-verifier/OpenId4VcVerificationSessionState.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerificationSessionState.d.mts","names":[],"sources":["../../src/openid4vc-verifier/OpenId4VcVerificationSessionState.ts"],"sourcesContent":[],"mappings":";aAAY,iCAAA;EAAA,cAAA,GAAA,gBAAA"}

package/build/openid4vc-verifier/OpenId4VcVerificationSessionState.mjs

@@ -0,0 +1,12 @@
+//#region src/openid4vc-verifier/OpenId4VcVerificationSessionState.ts
+let OpenId4VcVerificationSessionState = /* @__PURE__ */ function(OpenId4VcVerificationSessionState$1) {
+	OpenId4VcVerificationSessionState$1["RequestCreated"] = "RequestCreated";
+	OpenId4VcVerificationSessionState$1["RequestUriRetrieved"] = "RequestUriRetrieved";
+	OpenId4VcVerificationSessionState$1["ResponseVerified"] = "ResponseVerified";
+	OpenId4VcVerificationSessionState$1["Error"] = "Error";
+	return OpenId4VcVerificationSessionState$1;
+}({});
+
+//#endregion
+export { OpenId4VcVerificationSessionState };
+//# sourceMappingURL=OpenId4VcVerificationSessionState.mjs.map

package/build/openid4vc-verifier/OpenId4VcVerificationSessionState.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerificationSessionState.mjs","names":[],"sources":["../../src/openid4vc-verifier/OpenId4VcVerificationSessionState.ts"],"sourcesContent":["export enum OpenId4VcVerificationSessionState {\n  RequestCreated = 'RequestCreated',\n  RequestUriRetrieved = 'RequestUriRetrieved',\n  ResponseVerified = 'ResponseVerified',\n  Error = 'Error',\n}\n"],"mappings":";AAAA,IAAY,kGAAL;AACL;AACA;AACA;AACA"}

package/build/openid4vc-verifier/OpenId4VcVerifierApi.d.mts

@@ -0,0 +1,60 @@
+import { OpenId4VcUpdateVerifierRecordOptions, OpenId4VpCreateAuthorizationRequestOptions, OpenId4VpCreateAuthorizationRequestReturn, OpenId4VpCreateVerifierOptions, OpenId4VpVerifiedAuthorizationResponse, OpenId4VpVerifyAuthorizationResponseOptions } from "./OpenId4VpVerifierServiceOptions.mjs";
+import { OpenId4VcVerificationSessionRecord } from "./repository/OpenId4VcVerificationSessionRecord.mjs";
+import { OpenId4VcVerifierRecord } from "./repository/OpenId4VcVerifierRecord.mjs";
+import "./repository/index.mjs";
+import { OpenId4VcVerifierModuleConfig } from "./OpenId4VcVerifierModuleConfig.mjs";
+import { OpenId4VpVerifierService } from "./OpenId4VpVerifierService.mjs";
+import { AgentContext, Query, QueryOptions } from "@credo-ts/core";
+
+//#region src/openid4vc-verifier/OpenId4VcVerifierApi.d.ts
+/**
+ * @public
+ */
+declare class OpenId4VcVerifierApi {
+  readonly config: OpenId4VcVerifierModuleConfig;
+  private agentContext;
+  private openId4VpVerifierService;
+  constructor(config: OpenId4VcVerifierModuleConfig, agentContext: AgentContext, openId4VpVerifierService: OpenId4VpVerifierService);
+  /**
+   * Retrieve all verifier records from storage
+   */
+  getAllVerifiers(): Promise<OpenId4VcVerifierRecord[]>;
+  /**
+   * Retrieve a verifier record from storage by its verified id
+   */
+  getVerifierByVerifierId(verifierId: string): Promise<OpenId4VcVerifierRecord>;
+  /**
+   * Create a new verifier and store the new verifier record.
+   */
+  createVerifier(options?: OpenId4VpCreateVerifierOptions): Promise<OpenId4VcVerifierRecord>;
+  updateVerifierMetadata(options: OpenId4VcUpdateVerifierRecordOptions): Promise<void>;
+  findVerificationSessionsByQuery(query: Query<OpenId4VcVerificationSessionRecord>, queryOptions?: QueryOptions): Promise<OpenId4VcVerificationSessionRecord[]>;
+  getVerificationSessionById(verificationSessionId: string): Promise<OpenId4VcVerificationSessionRecord>;
+  /**
+   * Create an OpenID4VP authorization request, acting as a Relying Party (RP).
+   *
+   * See {@link OpenId4VpCreateAuthorizationRequestOptions} for detailed documentation on the options.
+   */
+  createAuthorizationRequest({
+    verifierId,
+    ...otherOptions
+  }: OpenId4VpCreateAuthorizationRequestOptions & {
+    verifierId: string;
+  }): Promise<OpenId4VpCreateAuthorizationRequestReturn>;
+  /**
+   * Verifies an authorization response, acting as a Relying Party (RP).
+   *
+   * It validates the ID Token, VP Token and the signature(s) of the received Verifiable Presentation(s)
+   * as well as that the structure of the Verifiable Presentation matches the provided presentation definition.
+   */
+  verifyAuthorizationResponse({
+    verificationSessionId,
+    ...otherOptions
+  }: OpenId4VpVerifyAuthorizationResponseOptions & {
+    verificationSessionId: string;
+  }): Promise<OpenId4VpVerifiedAuthorizationResponse>;
+  getVerifiedAuthorizationResponse(verificationSessionId: string): Promise<OpenId4VpVerifiedAuthorizationResponse>;
+}
+//#endregion
+export { OpenId4VcVerifierApi };
+//# sourceMappingURL=OpenId4VcVerifierApi.d.mts.map

package/build/openid4vc-verifier/OpenId4VcVerifierApi.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerifierApi.d.mts","names":[],"sources":["../../src/openid4vc-verifier/OpenId4VcVerifierApi.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;AAiBa,cAAA,oBAAA,CAAoB;EAEL,SAAA,MAAA,EAAA,6BAAA;EAAA,QAAA,YAAA;EACF,QAAA,wBAAA;EACY,WAAA,CAAA,MAAA,EAFV,6BAEU,EAAA,YAAA,EADZ,YACY,EAAA,wBAAA,EAAA,wBAAA;EAAwB;;;EAaL,eAAA,CAAA,CAAA,EAP3B,OAO2B,CAbK,uBAAA,EAaL,CAAA;EAOjB;;;EAIO,uBAAA,CAAA,UAAA,EAAA,MAAA,CAAA,EAXU,OAWV,CAlBjB,uBAAA,CAkBiB;EAAoC;;;EAYhE,cAAA,CAAA,OAAA,CAAA,EAhBqB,8BAgBrB,CAAA,EAhBmD,OAgBnD,CAhBmD,uBAAA,CAgBnD;EAAY,sBAAA,CAAA,OAAA,EAZgB,oCAYhB,CAAA,EAZoD,OAYpD,CAAA,IAAA,CAAA;EAAA,+BAAA,CAAA,KAAA,EADpB,KACoB,CADd,kCACc,CAAA,EAAA,YAAA,CAAA,EAAZ,YAAY,CAAA,EAAA,OAAA,CAAA,kCAAA,EAAA,CAAA;EAKwC,0BAAA,CAAA,qBAAA,EAAA,MAAA,CAAA,EAAA,OAAA,CAAA,kCAAA,CAAA;EAAA;;;;;EA6BnE,0BAAA,CAAA;IAAA,UAAA;IAAA,GAAA;EAE4C,CAF5C,EAjBC,0CAiBD,GAAA;IAEC,UAAA,EAAA,MAAA;EAA2C,CAAA,CAAA,EAjB1C,OAiB0C,CAjBlC,yCAiBkC,CAAA;EAE7C;;;;;;;;;KAFE;;MAEF,QAF6C,sCAAA;mEAU6B,QAR1E,sCAAA"}

package/build/openid4vc-verifier/OpenId4VcVerifierApi.mjs

@@ -0,0 +1,83 @@
+import { OpenId4VcVerifierModuleConfig } from "./OpenId4VcVerifierModuleConfig.mjs";
+import { __decorateMetadata } from "../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorateMetadata.mjs";
+import { __decorate } from "../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorate.mjs";
+import { OpenId4VpVerifierService } from "./OpenId4VpVerifierService.mjs";
+import { AgentContext, injectable } from "@credo-ts/core";
+
+//#region src/openid4vc-verifier/OpenId4VcVerifierApi.ts
+var _ref, _ref2, _ref3;
+let OpenId4VcVerifierApi = class OpenId4VcVerifierApi$1 {
+	constructor(config, agentContext, openId4VpVerifierService) {
+		this.config = config;
+		this.agentContext = agentContext;
+		this.openId4VpVerifierService = openId4VpVerifierService;
+	}
+	/**
+	* Retrieve all verifier records from storage
+	*/
+	async getAllVerifiers() {
+		return this.openId4VpVerifierService.getAllVerifiers(this.agentContext);
+	}
+	/**
+	* Retrieve a verifier record from storage by its verified id
+	*/
+	async getVerifierByVerifierId(verifierId) {
+		return this.openId4VpVerifierService.getVerifierByVerifierId(this.agentContext, verifierId);
+	}
+	/**
+	* Create a new verifier and store the new verifier record.
+	*/
+	async createVerifier(options) {
+		return this.openId4VpVerifierService.createVerifier(this.agentContext, options);
+	}
+	async updateVerifierMetadata(options) {
+		const { verifierId, clientMetadata } = options;
+		const verifier = await this.openId4VpVerifierService.getVerifierByVerifierId(this.agentContext, verifierId);
+		verifier.clientMetadata = clientMetadata;
+		return this.openId4VpVerifierService.updateVerifier(this.agentContext, verifier);
+	}
+	async findVerificationSessionsByQuery(query, queryOptions) {
+		return this.openId4VpVerifierService.findVerificationSessionsByQuery(this.agentContext, query, queryOptions);
+	}
+	async getVerificationSessionById(verificationSessionId) {
+		return this.openId4VpVerifierService.getVerificationSessionById(this.agentContext, verificationSessionId);
+	}
+	/**
+	* Create an OpenID4VP authorization request, acting as a Relying Party (RP).
+	*
+	* See {@link OpenId4VpCreateAuthorizationRequestOptions} for detailed documentation on the options.
+	*/
+	async createAuthorizationRequest({ verifierId, ...otherOptions }) {
+		const verifier = await this.getVerifierByVerifierId(verifierId);
+		return await this.openId4VpVerifierService.createAuthorizationRequest(this.agentContext, {
+			...otherOptions,
+			verifier
+		});
+	}
+	/**
+	* Verifies an authorization response, acting as a Relying Party (RP).
+	*
+	* It validates the ID Token, VP Token and the signature(s) of the received Verifiable Presentation(s)
+	* as well as that the structure of the Verifiable Presentation matches the provided presentation definition.
+	*/
+	async verifyAuthorizationResponse({ verificationSessionId, ...otherOptions }) {
+		const verificationSession = await this.getVerificationSessionById(verificationSessionId);
+		return await this.openId4VpVerifierService.verifyAuthorizationResponse(this.agentContext, {
+			...otherOptions,
+			verificationSession
+		});
+	}
+	async getVerifiedAuthorizationResponse(verificationSessionId) {
+		const verificationSession = await this.getVerificationSessionById(verificationSessionId);
+		return this.openId4VpVerifierService.getVerifiedAuthorizationResponse(this.agentContext, verificationSession);
+	}
+};
+OpenId4VcVerifierApi = __decorate([injectable(), __decorateMetadata("design:paramtypes", [
+	typeof (_ref = typeof OpenId4VcVerifierModuleConfig !== "undefined" && OpenId4VcVerifierModuleConfig) === "function" ? _ref : Object,
+	typeof (_ref2 = typeof AgentContext !== "undefined" && AgentContext) === "function" ? _ref2 : Object,
+	typeof (_ref3 = typeof OpenId4VpVerifierService !== "undefined" && OpenId4VpVerifierService) === "function" ? _ref3 : Object
+])], OpenId4VcVerifierApi);
+
+//#endregion
+export { OpenId4VcVerifierApi };
+//# sourceMappingURL=OpenId4VcVerifierApi.mjs.map

package/build/openid4vc-verifier/OpenId4VcVerifierApi.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerifierApi.mjs","names":["OpenId4VcVerifierApi","config: OpenId4VcVerifierModuleConfig","agentContext: AgentContext","openId4VpVerifierService: OpenId4VpVerifierService"],"sources":["../../src/openid4vc-verifier/OpenId4VcVerifierApi.ts"],"sourcesContent":["import type { Query, QueryOptions } from '@credo-ts/core'\nimport { AgentContext, injectable } from '@credo-ts/core'\nimport { OpenId4VcVerifierModuleConfig } from './OpenId4VcVerifierModuleConfig'\nimport { OpenId4VpVerifierService } from './OpenId4VpVerifierService'\nimport type {\n  OpenId4VcUpdateVerifierRecordOptions,\n  OpenId4VpCreateAuthorizationRequestOptions,\n  OpenId4VpCreateAuthorizationRequestReturn,\n  OpenId4VpCreateVerifierOptions,\n  OpenId4VpVerifyAuthorizationResponseOptions,\n} from './OpenId4VpVerifierServiceOptions'\nimport type { OpenId4VcVerificationSessionRecord } from './repository'\n\n/**\n * @public\n */\n@injectable()\nexport class OpenId4VcVerifierApi {\n  public constructor(\n    public readonly config: OpenId4VcVerifierModuleConfig,\n    private agentContext: AgentContext,\n    private openId4VpVerifierService: OpenId4VpVerifierService\n  ) {}\n\n  /**\n   * Retrieve all verifier records from storage\n   */\n  public async getAllVerifiers() {\n    return this.openId4VpVerifierService.getAllVerifiers(this.agentContext)\n  }\n\n  /**\n   * Retrieve a verifier record from storage by its verified id\n   */\n  public async getVerifierByVerifierId(verifierId: string) {\n    return this.openId4VpVerifierService.getVerifierByVerifierId(this.agentContext, verifierId)\n  }\n\n  /**\n   * Create a new verifier and store the new verifier record.\n   */\n  public async createVerifier(options?: OpenId4VpCreateVerifierOptions) {\n    return this.openId4VpVerifierService.createVerifier(this.agentContext, options)\n  }\n\n  public async updateVerifierMetadata(options: OpenId4VcUpdateVerifierRecordOptions) {\n    const { verifierId, clientMetadata } = options\n\n    const verifier = await this.openId4VpVerifierService.getVerifierByVerifierId(this.agentContext, verifierId)\n\n    verifier.clientMetadata = clientMetadata\n\n    return this.openId4VpVerifierService.updateVerifier(this.agentContext, verifier)\n  }\n\n  public async findVerificationSessionsByQuery(\n    query: Query<OpenId4VcVerificationSessionRecord>,\n    queryOptions?: QueryOptions\n  ) {\n    return this.openId4VpVerifierService.findVerificationSessionsByQuery(this.agentContext, query, queryOptions)\n  }\n\n  public async getVerificationSessionById(verificationSessionId: string) {\n    return this.openId4VpVerifierService.getVerificationSessionById(this.agentContext, verificationSessionId)\n  }\n\n  /**\n   * Create an OpenID4VP authorization request, acting as a Relying Party (RP).\n   *\n   * See {@link OpenId4VpCreateAuthorizationRequestOptions} for detailed documentation on the options.\n   */\n  public async createAuthorizationRequest({\n    verifierId,\n    ...otherOptions\n  }: OpenId4VpCreateAuthorizationRequestOptions & {\n    verifierId: string\n  }): Promise<OpenId4VpCreateAuthorizationRequestReturn> {\n    const verifier = await this.getVerifierByVerifierId(verifierId)\n    return await this.openId4VpVerifierService.createAuthorizationRequest(this.agentContext, {\n      ...otherOptions,\n      verifier,\n    })\n  }\n\n  /**\n   * Verifies an authorization response, acting as a Relying Party (RP).\n   *\n   * It validates the ID Token, VP Token and the signature(s) of the received Verifiable Presentation(s)\n   * as well as that the structure of the Verifiable Presentation matches the provided presentation definition.\n   */\n  public async verifyAuthorizationResponse({\n    verificationSessionId,\n    ...otherOptions\n  }: OpenId4VpVerifyAuthorizationResponseOptions & {\n    verificationSessionId: string\n  }) {\n    const verificationSession = await this.getVerificationSessionById(verificationSessionId)\n    return await this.openId4VpVerifierService.verifyAuthorizationResponse(this.agentContext, {\n      ...otherOptions,\n      verificationSession,\n    })\n  }\n\n  public async getVerifiedAuthorizationResponse(verificationSessionId: string) {\n    const verificationSession = await this.getVerificationSessionById(verificationSessionId)\n    return this.openId4VpVerifierService.getVerifiedAuthorizationResponse(this.agentContext, verificationSession)\n  }\n}\n"],"mappings":";;;;;;;;AAiBO,iCAAMA,uBAAqB;CAChC,AAAO,YACL,AAAgBC,QAChB,AAAQC,cACR,AAAQC,0BACR;EAHgB;EACR;EACA;;;;;CAMV,MAAa,kBAAkB;AAC7B,SAAO,KAAK,yBAAyB,gBAAgB,KAAK,aAAa;;;;;CAMzE,MAAa,wBAAwB,YAAoB;AACvD,SAAO,KAAK,yBAAyB,wBAAwB,KAAK,cAAc,WAAW;;;;;CAM7F,MAAa,eAAe,SAA0C;AACpE,SAAO,KAAK,yBAAyB,eAAe,KAAK,cAAc,QAAQ;;CAGjF,MAAa,uBAAuB,SAA+C;EACjF,MAAM,EAAE,YAAY,mBAAmB;EAEvC,MAAM,WAAW,MAAM,KAAK,yBAAyB,wBAAwB,KAAK,cAAc,WAAW;AAE3G,WAAS,iBAAiB;AAE1B,SAAO,KAAK,yBAAyB,eAAe,KAAK,cAAc,SAAS;;CAGlF,MAAa,gCACX,OACA,cACA;AACA,SAAO,KAAK,yBAAyB,gCAAgC,KAAK,cAAc,OAAO,aAAa;;CAG9G,MAAa,2BAA2B,uBAA+B;AACrE,SAAO,KAAK,yBAAyB,2BAA2B,KAAK,cAAc,sBAAsB;;;;;;;CAQ3G,MAAa,2BAA2B,EACtC,YACA,GAAG,gBAGkD;EACrD,MAAM,WAAW,MAAM,KAAK,wBAAwB,WAAW;AAC/D,SAAO,MAAM,KAAK,yBAAyB,2BAA2B,KAAK,cAAc;GACvF,GAAG;GACH;GACD,CAAC;;;;;;;;CASJ,MAAa,4BAA4B,EACvC,uBACA,GAAG,gBAGF;EACD,MAAM,sBAAsB,MAAM,KAAK,2BAA2B,sBAAsB;AACxF,SAAO,MAAM,KAAK,yBAAyB,4BAA4B,KAAK,cAAc;GACxF,GAAG;GACH;GACD,CAAC;;CAGJ,MAAa,iCAAiC,uBAA+B;EAC3E,MAAM,sBAAsB,MAAM,KAAK,2BAA2B,sBAAsB;AACxF,SAAO,KAAK,yBAAyB,iCAAiC,KAAK,cAAc,oBAAoB;;;mCAzFhH,YAAY"}

package/build/openid4vc-verifier/OpenId4VcVerifierEvents.d.mts

@@ -0,0 +1,19 @@
+import { OpenId4VcVerificationSessionState } from "./OpenId4VcVerificationSessionState.mjs";
+import { OpenId4VcVerificationSessionRecord } from "./repository/OpenId4VcVerificationSessionRecord.mjs";
+import "./repository/index.mjs";
+import { BaseEvent } from "@credo-ts/core";
+
+//#region src/openid4vc-verifier/OpenId4VcVerifierEvents.d.ts
+declare enum OpenId4VcVerifierEvents {
+  VerificationSessionStateChanged = "OpenId4VcVerifier.VerificationSessionStateChanged",
+}
+interface OpenId4VcVerificationSessionStateChangedEvent extends BaseEvent {
+  type: typeof OpenId4VcVerifierEvents.VerificationSessionStateChanged;
+  payload: {
+    verificationSession: OpenId4VcVerificationSessionRecord;
+    previousState: OpenId4VcVerificationSessionState | null;
+  };
+}
+//#endregion
+export { OpenId4VcVerificationSessionStateChangedEvent, OpenId4VcVerifierEvents };
+//# sourceMappingURL=OpenId4VcVerifierEvents.d.mts.map

package/build/openid4vc-verifier/OpenId4VcVerifierEvents.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerifierEvents.d.mts","names":[],"sources":["../../src/openid4vc-verifier/OpenId4VcVerifierEvents.ts"],"sourcesContent":[],"mappings":";;;;;;aAIY,uBAAA;;;AAAA,UAIK,6CAAA,SAAsD,SAJpC,CAAA;EAIlB,IAAA,EAAA,OACF,uBAAA,CAAwB,+BADwB;EAChD,OAAA,EAAA;IAEU,mBAAA,EAAA,kCAAA;IACN,aAAA,EAAA,iCAAA,GAAA,IAAA;EAJoD,CAAA"}

package/build/openid4vc-verifier/OpenId4VcVerifierEvents.mjs

@@ -0,0 +1,9 @@
+//#region src/openid4vc-verifier/OpenId4VcVerifierEvents.ts
+let OpenId4VcVerifierEvents = /* @__PURE__ */ function(OpenId4VcVerifierEvents$1) {
+	OpenId4VcVerifierEvents$1["VerificationSessionStateChanged"] = "OpenId4VcVerifier.VerificationSessionStateChanged";
+	return OpenId4VcVerifierEvents$1;
+}({});
+
+//#endregion
+export { OpenId4VcVerifierEvents };
+//# sourceMappingURL=OpenId4VcVerifierEvents.mjs.map

package/build/openid4vc-verifier/OpenId4VcVerifierEvents.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerifierEvents.mjs","names":[],"sources":["../../src/openid4vc-verifier/OpenId4VcVerifierEvents.ts"],"sourcesContent":["import type { BaseEvent } from '@credo-ts/core'\nimport type { OpenId4VcVerificationSessionState } from './OpenId4VcVerificationSessionState'\nimport type { OpenId4VcVerificationSessionRecord } from './repository'\n\nexport enum OpenId4VcVerifierEvents {\n  VerificationSessionStateChanged = 'OpenId4VcVerifier.VerificationSessionStateChanged',\n}\n\nexport interface OpenId4VcVerificationSessionStateChangedEvent extends BaseEvent {\n  type: typeof OpenId4VcVerifierEvents.VerificationSessionStateChanged\n  payload: {\n    verificationSession: OpenId4VcVerificationSessionRecord\n    previousState: OpenId4VcVerificationSessionState | null\n  }\n}\n"],"mappings":";AAIA,IAAY,8EAAL;AACL"}

package/build/openid4vc-verifier/OpenId4VcVerifierModule.d.mts

@@ -0,0 +1,25 @@
+import { InternalOpenId4VcVerifierModuleConfigOptions, OpenId4VcVerifierModuleConfig } from "./OpenId4VcVerifierModuleConfig.mjs";
+import { AgentContext, DependencyManager, Module } from "@credo-ts/core";
+
+//#region src/openid4vc-verifier/OpenId4VcVerifierModule.d.ts
+
+/**
+ * @public
+ */
+declare class OpenId4VcVerifierModule implements Module {
+  readonly config: OpenId4VcVerifierModuleConfig;
+  constructor(options: InternalOpenId4VcVerifierModuleConfigOptions | OpenId4VcVerifierModuleConfig);
+  /**
+   * Registers the dependencies of the openid4vc verifier module on the dependency manager.
+   */
+  register(dependencyManager: DependencyManager): void;
+  initialize(rootAgentContext: AgentContext): Promise<void>;
+  /**
+   * Registers the endpoints on the router passed to this module.
+   */
+  private configureRouter;
+  private getVerifierIdParamHandler;
+}
+//#endregion
+export { OpenId4VcVerifierModule };
+//# sourceMappingURL=OpenId4VcVerifierModule.d.mts.map

package/build/openid4vc-verifier/OpenId4VcVerifierModule.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerifierModule.d.mts","names":[],"sources":["../../src/openid4vc-verifier/OpenId4VcVerifierModule.ts"],"sourcesContent":[],"mappings":";;;;;;AAeA;;AAG8B,cAHjB,uBAAA,YAAmC,MAGlB,CAAA;EAA+C,SAAA,MAAA,EAFnD,6BAEmD;EAQxC,WAAA,CAAA,OAAA,EARP,4CAQO,GARwC,6BAQxC;EAeO;;;EA1BU,QAAA,CAAA,iBAAA,EAWjB,iBAXiB,CAAA,EAAA,IAAA;+BA0BV,eAAe"}

package/build/openid4vc-verifier/OpenId4VcVerifierModule.mjs

@@ -0,0 +1,91 @@
+import { OpenId4VcVerifierModuleConfig } from "./OpenId4VcVerifierModuleConfig.mjs";
+import { getRequestContext } from "../shared/router/context.mjs";
+import { importExpress } from "../shared/router/express.mjs";
+import { getAgentContextForActorId } from "../shared/router/tenants.mjs";
+import "../shared/router/index.mjs";
+import { OpenId4VcVerifierRepository } from "./repository/OpenId4VcVerifierRepository.mjs";
+import "./repository/index.mjs";
+import { OpenId4VpVerifierService } from "./OpenId4VpVerifierService.mjs";
+import { OpenId4VcVerifierApi } from "./OpenId4VcVerifierApi.mjs";
+import { configureAuthorizationEndpoint } from "./router/authorizationEndpoint.mjs";
+import "./router/index.mjs";
+import { configureAuthorizationRequestEndpoint } from "./router/authorizationRequestEndpoint.mjs";
+
+//#region src/openid4vc-verifier/OpenId4VcVerifierModule.ts
+/**
+* @public
+*/
+var OpenId4VcVerifierModule = class {
+	constructor(options) {
+		this.getVerifierIdParamHandler = (rootAgentContext) => async (req, res, next, verifierId) => {
+			if (!verifierId) {
+				rootAgentContext.config.logger.debug("No verifierId provided for incoming authorization response, returning 404");
+				return res.status(404).send("Not found");
+			}
+			let agentContext;
+			try {
+				agentContext = await getAgentContextForActorId(rootAgentContext, verifierId);
+				const verifier = await agentContext.dependencyManager.resolve(OpenId4VcVerifierApi).getVerifierByVerifierId(verifierId);
+				req.requestContext = {
+					agentContext,
+					verifier
+				};
+			} catch (error) {
+				agentContext?.config.logger.error("Failed to correlate incoming openid request to existing tenant and verifier", { error });
+				await agentContext?.endSession();
+				return res.status(404).send("Not found");
+			}
+			next();
+		};
+		this.config = options instanceof OpenId4VcVerifierModuleConfig ? options : new OpenId4VcVerifierModuleConfig(options);
+	}
+	/**
+	* Registers the dependencies of the openid4vc verifier module on the dependency manager.
+	*/
+	register(dependencyManager) {
+		dependencyManager.registerContextScoped(OpenId4VcVerifierApi);
+		dependencyManager.registerInstance(OpenId4VcVerifierModuleConfig, this.config);
+		dependencyManager.registerSingleton(OpenId4VpVerifierService);
+		dependencyManager.registerSingleton(OpenId4VcVerifierRepository);
+	}
+	async initialize(rootAgentContext) {
+		this.configureRouter(rootAgentContext);
+	}
+	/**
+	* Registers the endpoints on the router passed to this module.
+	*/
+	configureRouter(rootAgentContext) {
+		const { Router, json, urlencoded } = importExpress();
+		const basePath = new URL(this.config.baseUrl).pathname;
+		const verifierEndpointRouter = Router();
+		const verifierContextRouter = Router();
+		verifierContextRouter.use(urlencoded({ extended: false }));
+		verifierContextRouter.use(json());
+		verifierContextRouter.param("verifierId", this.getVerifierIdParamHandler(rootAgentContext));
+		verifierContextRouter.use("/:verifierId", verifierEndpointRouter);
+		configureAuthorizationEndpoint(verifierEndpointRouter, this.config);
+		configureAuthorizationRequestEndpoint(verifierEndpointRouter, this.config);
+		verifierContextRouter.use(async (req, _res, next) => {
+			const { agentContext } = getRequestContext(req);
+			await agentContext.endSession();
+			next();
+		});
+		verifierContextRouter.use(async (_error, req, res, next) => {
+			const { agentContext } = getRequestContext(req);
+			if (!res.headersSent) {
+				agentContext.config.logger.warn("Error was thrown but openid4vci endpoint did not send a response. Sending generic server_error.");
+				res.status(500).json({
+					error: "server_error",
+					error_description: "An unexpected error occurred on the server."
+				});
+			}
+			await agentContext.endSession();
+			next();
+		});
+		this.config.app.use(basePath, verifierContextRouter);
+	}
+};
+
+//#endregion
+export { OpenId4VcVerifierModule };
+//# sourceMappingURL=OpenId4VcVerifierModule.mjs.map

package/build/openid4vc-verifier/OpenId4VcVerifierModule.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerifierModule.mjs","names":["agentContext: AgentContext | undefined"],"sources":["../../src/openid4vc-verifier/OpenId4VcVerifierModule.ts"],"sourcesContent":["import type { AgentContext, DependencyManager, Module } from '@credo-ts/core'\nimport type { NextFunction, Response } from 'express'\nimport { getAgentContextForActorId, getRequestContext, importExpress } from '../shared/router'\nimport { OpenId4VcVerifierApi } from './OpenId4VcVerifierApi'\nimport type { InternalOpenId4VcVerifierModuleConfigOptions } from './OpenId4VcVerifierModuleConfig'\nimport { OpenId4VcVerifierModuleConfig } from './OpenId4VcVerifierModuleConfig'\nimport { OpenId4VpVerifierService } from './OpenId4VpVerifierService'\nimport { OpenId4VcVerifierRepository } from './repository'\nimport type { OpenId4VcVerificationRequest } from './router'\nimport { configureAuthorizationEndpoint } from './router'\nimport { configureAuthorizationRequestEndpoint } from './router/authorizationRequestEndpoint'\n\n/**\n * @public\n */\nexport class OpenId4VcVerifierModule implements Module {\n  public readonly config: OpenId4VcVerifierModuleConfig\n\n  public constructor(options: InternalOpenId4VcVerifierModuleConfigOptions | OpenId4VcVerifierModuleConfig) {\n    this.config =\n      options instanceof OpenId4VcVerifierModuleConfig ? options : new OpenId4VcVerifierModuleConfig(options)\n  }\n\n  /**\n   * Registers the dependencies of the openid4vc verifier module on the dependency manager.\n   */\n  public register(dependencyManager: DependencyManager) {\n    // Since the OpenID4VC module is a nested module (a module consisting of three modules) we register the API\n    // manually. In the future we may disallow resolving the sub-api, but for now it allows for a cleaner migration path\n    dependencyManager.registerContextScoped(OpenId4VcVerifierApi)\n\n    // Register config\n    dependencyManager.registerInstance(OpenId4VcVerifierModuleConfig, this.config)\n\n    // Services\n    dependencyManager.registerSingleton(OpenId4VpVerifierService)\n\n    // Repository\n    dependencyManager.registerSingleton(OpenId4VcVerifierRepository)\n  }\n\n  public async initialize(rootAgentContext: AgentContext): Promise<void> {\n    this.configureRouter(rootAgentContext)\n  }\n\n  /**\n   * Registers the endpoints on the router passed to this module.\n   */\n  private configureRouter(rootAgentContext: AgentContext) {\n    const { Router, json, urlencoded } = importExpress()\n\n    // FIXME: it is currently not possible to initialize an agent\n    // shut it down, and then start it again, as the\n    // express router is configured with a specific `AgentContext` instance\n    // and dependency manager. One option is to always create a new router\n    // but then users cannot pass their own router implementation.\n    // We need to find a proper way to fix this.\n\n    const basePath = new URL(this.config.baseUrl).pathname\n\n    // We use separate context router and endpoint router. Context router handles the linking of the request\n    // to a specific agent context. Endpoint router only knows about a single context\n    const verifierEndpointRouter = Router()\n    const verifierContextRouter = Router()\n\n    // parse application/x-www-form-urlencoded\n    verifierContextRouter.use(urlencoded({ extended: false }))\n    // parse application/json\n    verifierContextRouter.use(json())\n\n    verifierContextRouter.param('verifierId', this.getVerifierIdParamHandler(rootAgentContext))\n    verifierContextRouter.use('/:verifierId', verifierEndpointRouter)\n\n    // Configure endpoints\n    configureAuthorizationEndpoint(verifierEndpointRouter, this.config)\n    configureAuthorizationRequestEndpoint(verifierEndpointRouter, this.config)\n\n    // First one will be called for all requests (when next is called)\n    verifierContextRouter.use(async (req: OpenId4VcVerificationRequest, _res: unknown, next) => {\n      const { agentContext } = getRequestContext(req)\n      await agentContext.endSession()\n      next()\n    })\n\n    // This one will be called for all errors that are thrown\n    verifierContextRouter.use(\n      async (_error: unknown, req: OpenId4VcVerificationRequest, res: Response, next: NextFunction) => {\n        const { agentContext } = getRequestContext(req)\n\n        if (!res.headersSent) {\n          agentContext.config.logger.warn(\n            'Error was thrown but openid4vci endpoint did not send a response. Sending generic server_error.'\n          )\n\n          res.status(500).json({\n            error: 'server_error',\n            error_description: 'An unexpected error occurred on the server.',\n          })\n        }\n\n        await agentContext.endSession()\n        next()\n      }\n    )\n\n    this.config.app.use(basePath, verifierContextRouter)\n  }\n\n  private getVerifierIdParamHandler =\n    (rootAgentContext: AgentContext) =>\n    async (req: OpenId4VcVerificationRequest, res: Response, next: NextFunction, verifierId: string) => {\n      if (!verifierId) {\n        rootAgentContext.config.logger.debug(\n          'No verifierId provided for incoming authorization response, returning 404'\n        )\n        return res.status(404).send('Not found')\n      }\n\n      let agentContext: AgentContext | undefined\n\n      try {\n        agentContext = await getAgentContextForActorId(rootAgentContext, verifierId)\n        const verifierApi = agentContext.dependencyManager.resolve(OpenId4VcVerifierApi)\n        const verifier = await verifierApi.getVerifierByVerifierId(verifierId)\n\n        req.requestContext = {\n          agentContext,\n          verifier,\n        }\n      } catch (error) {\n        agentContext?.config.logger.error(\n          'Failed to correlate incoming openid request to existing tenant and verifier',\n          {\n            error,\n          }\n        )\n        // If the opening failed\n        await agentContext?.endSession()\n        return res.status(404).send('Not found')\n      }\n\n      next()\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,IAAa,0BAAb,MAAuD;CAGrD,AAAO,YAAY,SAAuF;OA0FlG,6BACL,qBACD,OAAO,KAAmC,KAAe,MAAoB,eAAuB;AAClG,OAAI,CAAC,YAAY;AACf,qBAAiB,OAAO,OAAO,MAC7B,4EACD;AACD,WAAO,IAAI,OAAO,IAAI,CAAC,KAAK,YAAY;;GAG1C,IAAIA;AAEJ,OAAI;AACF,mBAAe,MAAM,0BAA0B,kBAAkB,WAAW;IAE5E,MAAM,WAAW,MADG,aAAa,kBAAkB,QAAQ,qBAAqB,CAC7C,wBAAwB,WAAW;AAEtE,QAAI,iBAAiB;KACnB;KACA;KACD;YACM,OAAO;AACd,kBAAc,OAAO,OAAO,MAC1B,+EACA,EACE,OACD,CACF;AAED,UAAM,cAAc,YAAY;AAChC,WAAO,IAAI,OAAO,IAAI,CAAC,KAAK,YAAY;;AAG1C,SAAM;;AA1HR,OAAK,SACH,mBAAmB,gCAAgC,UAAU,IAAI,8BAA8B,QAAQ;;;;;CAM3G,AAAO,SAAS,mBAAsC;AAGpD,oBAAkB,sBAAsB,qBAAqB;AAG7D,oBAAkB,iBAAiB,+BAA+B,KAAK,OAAO;AAG9E,oBAAkB,kBAAkB,yBAAyB;AAG7D,oBAAkB,kBAAkB,4BAA4B;;CAGlE,MAAa,WAAW,kBAA+C;AACrE,OAAK,gBAAgB,iBAAiB;;;;;CAMxC,AAAQ,gBAAgB,kBAAgC;EACtD,MAAM,EAAE,QAAQ,MAAM,eAAe,eAAe;EASpD,MAAM,WAAW,IAAI,IAAI,KAAK,OAAO,QAAQ,CAAC;EAI9C,MAAM,yBAAyB,QAAQ;EACvC,MAAM,wBAAwB,QAAQ;AAGtC,wBAAsB,IAAI,WAAW,EAAE,UAAU,OAAO,CAAC,CAAC;AAE1D,wBAAsB,IAAI,MAAM,CAAC;AAEjC,wBAAsB,MAAM,cAAc,KAAK,0BAA0B,iBAAiB,CAAC;AAC3F,wBAAsB,IAAI,gBAAgB,uBAAuB;AAGjE,iCAA+B,wBAAwB,KAAK,OAAO;AACnE,wCAAsC,wBAAwB,KAAK,OAAO;AAG1E,wBAAsB,IAAI,OAAO,KAAmC,MAAe,SAAS;GAC1F,MAAM,EAAE,iBAAiB,kBAAkB,IAAI;AAC/C,SAAM,aAAa,YAAY;AAC/B,SAAM;IACN;AAGF,wBAAsB,IACpB,OAAO,QAAiB,KAAmC,KAAe,SAAuB;GAC/F,MAAM,EAAE,iBAAiB,kBAAkB,IAAI;AAE/C,OAAI,CAAC,IAAI,aAAa;AACpB,iBAAa,OAAO,OAAO,KACzB,kGACD;AAED,QAAI,OAAO,IAAI,CAAC,KAAK;KACnB,OAAO;KACP,mBAAmB;KACpB,CAAC;;AAGJ,SAAM,aAAa,YAAY;AAC/B,SAAM;IAET;AAED,OAAK,OAAO,IAAI,IAAI,UAAU,sBAAsB"}

package/build/openid4vc-verifier/OpenId4VcVerifierModuleConfig.d.mts

@@ -0,0 +1,55 @@
+import { Express } from "express";
+
+//#region src/openid4vc-verifier/OpenId4VcVerifierModuleConfig.d.ts
+interface InternalOpenId4VcVerifierModuleConfigOptions {
+  /**
+   * Base url at which the verifier endpoints will be hosted. All endpoints will be exposed with
+   * this path as prefix.
+   */
+  baseUrl: string;
+  /**
+   * Express app on which the openid4vp endpoints will be registered.
+   */
+  app: Express;
+  /**
+   * The number of seconds after which a created authorization request will expire.
+   *
+   * This is used for the `exp` field of a signed authorization request.
+   *
+   * @default 300
+   */
+  authorizationRequestExpirationInSeconds?: number;
+  endpoints?: {
+    /**
+     * @default /authorize
+     */
+    authorization?: string;
+    /**
+     * @default /authorization-requests
+     */
+    authorizationRequest?: string;
+  };
+}
+declare class OpenId4VcVerifierModuleConfig {
+  private options;
+  constructor(options: InternalOpenId4VcVerifierModuleConfigOptions);
+  get baseUrl(): string;
+  get app(): Express;
+  /**
+   * @default /authorize
+   */
+  get authorizationRequestEndpoint(): string;
+  /**
+   * @default /authorize
+   */
+  get authorizationEndpoint(): string;
+  /**
+   * Time in seconds after which an authorization request will expire
+   *
+   * @default 300
+   */
+  get authorizationRequestExpiresInSeconds(): number;
+}
+//#endregion
+export { InternalOpenId4VcVerifierModuleConfigOptions, OpenId4VcVerifierModuleConfig };
+//# sourceMappingURL=OpenId4VcVerifierModuleConfig.d.mts.map

package/build/openid4vc-verifier/OpenId4VcVerifierModuleConfig.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenId4VcVerifierModuleConfig.d.mts","names":[],"sources":["../../src/openid4vc-verifier/OpenId4VcVerifierModuleConfig.ts"],"sourcesContent":[],"mappings":";;;UAEiB,4CAAA;;AAAjB;AAkCA;;;;;;OAxBO;;;;;;;;;;;;;;;;;;;;cAwBM,6BAAA;;uBAGiB;;aAQd"}