@credo-ts/openid4vc 0.6.1-pr-2091-20241119140918 → 0.6.2-alpha-20251210145840

package/build/openid4vc-issuer/OpenId4VcIssuerModuleConfig.d.ts

@@ -1,190 +0,0 @@
-import type { OpenId4VciCredentialRequestToCredentialMapper, OpenId4VciGetVerificationSessionForIssuanceSessionAuthorization } from './OpenId4VcIssuerServiceOptions';
-import type { Router } from 'express';
-export interface OpenId4VcIssuerModuleConfigOptions {
-    /**
-     * Base url at which the issuer endpoints will be hosted. All endpoints will be exposed with
-     * this path as prefix.
-     */
-    baseUrl: string;
-    /**
-     * Express router on which the openid4vci endpoints will be registered. If
-     * no router is provided, a new one will be created.
-     *
-     * NOTE: you must manually register the router on your express app and
-     * expose this on a public url that is reachable when `baseUrl` is called.
-     */
-    router?: Router;
-    /**
-     * The time after which a cNonce will expire.
-     *
-     * @default 60 (1 minute)
-     */
-    cNonceExpiresInSeconds?: number;
-    /**
-     * The time after which a statefull credential offer not bound to a subject expires. Once the offer has been bound
-     * to a subject the access token expiration takes effect. This is to prevent long-lived `pre-authorized_code` and
-     * `issuer_state` values.
-     *
-     * @default 180 (3 minutes)
-     */
-    statefullCredentialOfferExpirationInSeconds?: number;
-    /**
-     * The time after which an authorization code will expire.
-     *
-     * @default 60 (1 minute)
-     */
-    authorizationCodeExpiresInSeconds?: number;
-    /**
-     * The time after which an access token will expire.
-     *
-     * @default 180 (3 minutes)
-     */
-    accessTokenExpiresInSeconds?: number;
-    /**
-     * Whether DPoP is required for all issuance sessions. This value can be overridden when creating
-     * a credential offer. If dpop is not required, but used by a client in the first request to credo,
-     * DPoP will be required going forward.
-     *
-     * @default false
-     */
-    dpopRequired?: boolean;
-    /**
-     * Whether to allow dynamic issuance sessions based on a credential request.
-     *
-     * This requires an external authorization server which issues access tokens without
-     * a `pre-authorized_code` or `issuer_state` parameter.
-     *
-     * Credo only support statefull crednetial offer sessions (pre-auth or presentation during issuance)
-     *
-     * @default false
-     */
-    allowDynamicIssuanceSessions?: boolean;
-    /**
-     * A function mapping a credential request to the credential to be issued.
-     */
-    credentialRequestToCredentialMapper: OpenId4VciCredentialRequestToCredentialMapper;
-    /**
-     * Callback to get a verification session that needs to be fulfilled for the authorization of
-     * of a credential issuance session. Once the verification session has been completed the user can
-     * retrieve an authorization code and access token and retrieve the credential(s).
-     *
-     * Required if presentation during issuance flow is used
-     */
-    getVerificationSessionForIssuanceSessionAuthorization?: OpenId4VciGetVerificationSessionForIssuanceSessionAuthorization;
-    /**
-     * Custom the paths used for endpoints
-     */
-    endpoints?: {
-        /**
-         * @default /nonce
-         */
-        nonce?: string;
-        /**
-         * @default /challenge
-         */
-        authorizationChallenge?: string;
-        /**
-         * @default /offers
-         */
-        credentialOffer?: string;
-        /**
-         * @default /credential
-         */
-        credential?: string;
-        /**
-         * @default /token
-         */
-        accessToken?: string;
-        /**
-         * @default /jwks
-         */
-        jwks: string;
-    };
-}
-export declare class OpenId4VcIssuerModuleConfig {
-    private options;
-    readonly router: Router;
-    constructor(options: OpenId4VcIssuerModuleConfigOptions);
-    get baseUrl(): string;
-    /**
-     * A function mapping a credential request to the credential to be issued.
-     */
-    get credentialRequestToCredentialMapper(): OpenId4VciCredentialRequestToCredentialMapper;
-    /**
-     * Callback to get a verification session that needs to be fulfilled for the authorization of
-     * of a credential issuance session. Once the verification session has been completed the user can
-     * retrieve an authorization code and access token and retrieve the credential(s).
-     *
-     * Required if presentation during issuance flow is used
-     */
-    get getVerificationSessionForIssuanceSessionAuthorization(): OpenId4VciGetVerificationSessionForIssuanceSessionAuthorization | undefined;
-    /**
-     * The time after which a cNone will expire.
-     *
-     * @default 60 (1 minute)
-     */
-    get cNonceExpiresInSeconds(): number;
-    /**
-     * The time after which a statefull credential offer not bound to a subject expires. Once the offer has been bound
-     * to a subject the access token expiration takes effect. This is to prevent long-lived `pre-authorized_code` and
-     * `issuer_state` values.
-     *
-     * @default 360 (5 minutes)
-     */
-    get statefullCredentialOfferExpirationInSeconds(): number;
-    /**
-     * The time after which a cNonce will expire.
-     *
-     * @default 60 (1 minute)
-     */
-    get authorizationCodeExpiresInSeconds(): number;
-    /**
-     * The time after which an access token will expire.
-     *
-     * @default 360 (5 minutes)
-     */
-    get accessTokenExpiresInSeconds(): number;
-    /**
-     * Whether DPoP is required for all issuance sessions. This value can be overridden when creating
-     * a credential offer. If dpop is not required, but used by a client in the first request to credo,
-     * DPoP will be required going forward.
-     *
-     * @default false
-     */
-    get dpopRequired(): boolean;
-    /**
-     * Whether to allow dynamic issuance sessions based on a credential request.
-     *
-     * This requires an external authorization server which issues access tokens without
-     * a `pre-authorized_code` or `issuer_state` parameter.
-     *
-     * Credo only supports statefull crednetial offer sessions (pre-auth or presentation during issuance)
-     *
-     * @default false
-     */
-    get allowDynamicIssuanceSessions(): boolean;
-    /**
-     * @default /nonce
-     */
-    get nonceEndpointPath(): string;
-    /**
-     * @default /challenge
-     */
-    get authorizationChallengeEndpointPath(): string;
-    /**
-     * @default /offers
-     */
-    get credentialOfferEndpointPath(): string;
-    /**
-     * @default /credential
-     */
-    get credentialEndpointPath(): string;
-    /**
-     * @default /token
-     */
-    get accessTokenEndpointPath(): string;
-    /**
-     * @default /jwks
-     */
-    get jwksEndpointPath(): string;
-}

package/build/openid4vc-issuer/OpenId4VcIssuerModuleConfig.js

@@ -1,141 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OpenId4VcIssuerModuleConfig = void 0;
-const router_1 = require("../shared/router");
-const DEFAULT_C_NONCE_EXPIRES_IN = 1 * 60; // 1 minute
-const DEFAULT_AUTHORIZATION_CODE_EXPIRES_IN = 1 * 60; // 1 minute
-const DEFAULT_TOKEN_EXPIRES_IN = 3 * 60; // 3 minutes
-const DEFAULT_STATEFULL_CREDENTIAL_OFFER_EXPIRES_IN = 3 * 60; // 3 minutes
-class OpenId4VcIssuerModuleConfig {
-    constructor(options) {
-        var _a;
-        this.options = options;
-        this.router = (_a = options.router) !== null && _a !== void 0 ? _a : (0, router_1.importExpress)().Router();
-    }
-    get baseUrl() {
-        return this.options.baseUrl;
-    }
-    /**
-     * A function mapping a credential request to the credential to be issued.
-     */
-    get credentialRequestToCredentialMapper() {
-        return this.options.credentialRequestToCredentialMapper;
-    }
-    /**
-     * Callback to get a verification session that needs to be fulfilled for the authorization of
-     * of a credential issuance session. Once the verification session has been completed the user can
-     * retrieve an authorization code and access token and retrieve the credential(s).
-     *
-     * Required if presentation during issuance flow is used
-     */
-    get getVerificationSessionForIssuanceSessionAuthorization() {
-        return this.options.getVerificationSessionForIssuanceSessionAuthorization;
-    }
-    /**
-     * The time after which a cNone will expire.
-     *
-     * @default 60 (1 minute)
-     */
-    get cNonceExpiresInSeconds() {
-        var _a;
-        return (_a = this.options.cNonceExpiresInSeconds) !== null && _a !== void 0 ? _a : DEFAULT_C_NONCE_EXPIRES_IN;
-    }
-    /**
-     * The time after which a statefull credential offer not bound to a subject expires. Once the offer has been bound
-     * to a subject the access token expiration takes effect. This is to prevent long-lived `pre-authorized_code` and
-     * `issuer_state` values.
-     *
-     * @default 360 (5 minutes)
-     */
-    get statefullCredentialOfferExpirationInSeconds() {
-        var _a;
-        return (_a = this.options.statefullCredentialOfferExpirationInSeconds) !== null && _a !== void 0 ? _a : DEFAULT_STATEFULL_CREDENTIAL_OFFER_EXPIRES_IN;
-    }
-    /**
-     * The time after which a cNonce will expire.
-     *
-     * @default 60 (1 minute)
-     */
-    get authorizationCodeExpiresInSeconds() {
-        var _a;
-        return (_a = this.options.authorizationCodeExpiresInSeconds) !== null && _a !== void 0 ? _a : DEFAULT_AUTHORIZATION_CODE_EXPIRES_IN;
-    }
-    /**
-     * The time after which an access token will expire.
-     *
-     * @default 360 (5 minutes)
-     */
-    get accessTokenExpiresInSeconds() {
-        var _a;
-        return (_a = this.options.accessTokenExpiresInSeconds) !== null && _a !== void 0 ? _a : DEFAULT_TOKEN_EXPIRES_IN;
-    }
-    /**
-     * Whether DPoP is required for all issuance sessions. This value can be overridden when creating
-     * a credential offer. If dpop is not required, but used by a client in the first request to credo,
-     * DPoP will be required going forward.
-     *
-     * @default false
-     */
-    get dpopRequired() {
-        var _a;
-        return (_a = this.options.dpopRequired) !== null && _a !== void 0 ? _a : false;
-    }
-    /**
-     * Whether to allow dynamic issuance sessions based on a credential request.
-     *
-     * This requires an external authorization server which issues access tokens without
-     * a `pre-authorized_code` or `issuer_state` parameter.
-     *
-     * Credo only supports statefull crednetial offer sessions (pre-auth or presentation during issuance)
-     *
-     * @default false
-     */
-    get allowDynamicIssuanceSessions() {
-        var _a;
-        return (_a = this.options.allowDynamicIssuanceSessions) !== null && _a !== void 0 ? _a : false;
-    }
-    /**
-     * @default /nonce
-     */
-    get nonceEndpointPath() {
-        var _a, _b;
-        return (_b = (_a = this.options.endpoints) === null || _a === void 0 ? void 0 : _a.nonce) !== null && _b !== void 0 ? _b : '/nonce';
-    }
-    /**
-     * @default /challenge
-     */
-    get authorizationChallengeEndpointPath() {
-        var _a, _b;
-        return (_b = (_a = this.options.endpoints) === null || _a === void 0 ? void 0 : _a.authorizationChallenge) !== null && _b !== void 0 ? _b : '/challenge';
-    }
-    /**
-     * @default /offers
-     */
-    get credentialOfferEndpointPath() {
-        var _a, _b;
-        return (_b = (_a = this.options.endpoints) === null || _a === void 0 ? void 0 : _a.credentialOffer) !== null && _b !== void 0 ? _b : '/offers';
-    }
-    /**
-     * @default /credential
-     */
-    get credentialEndpointPath() {
-        var _a, _b;
-        return (_b = (_a = this.options.endpoints) === null || _a === void 0 ? void 0 : _a.credential) !== null && _b !== void 0 ? _b : '/credential';
-    }
-    /**
-     * @default /token
-     */
-    get accessTokenEndpointPath() {
-        var _a, _b;
-        return (_b = (_a = this.options.endpoints) === null || _a === void 0 ? void 0 : _a.accessToken) !== null && _b !== void 0 ? _b : '/token';
-    }
-    /**
-     * @default /jwks
-     */
-    get jwksEndpointPath() {
-        var _a, _b;
-        return (_b = (_a = this.options.endpoints) === null || _a === void 0 ? void 0 : _a.jwks) !== null && _b !== void 0 ? _b : '/jwks';
-    }
-}
-exports.OpenId4VcIssuerModuleConfig = OpenId4VcIssuerModuleConfig;
-//# sourceMappingURL=OpenId4VcIssuerModuleConfig.js.map

package/build/openid4vc-issuer/OpenId4VcIssuerModuleConfig.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"OpenId4VcIssuerModuleConfig.js","sourceRoot":"","sources":["../../src/openid4vc-issuer/OpenId4VcIssuerModuleConfig.ts"],"names":[],"mappings":";;;AAMA,6CAAgD;AAEhD,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE,CAAA,CAAC,WAAW;AACrD,MAAM,qCAAqC,GAAG,CAAC,GAAG,EAAE,CAAA,CAAC,WAAW;AAChE,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,CAAA,CAAC,YAAY;AACpD,MAAM,6CAA6C,GAAG,CAAC,GAAG,EAAE,CAAA,CAAC,YAAY;AAuHzE,MAAa,2BAA2B;IAItC,YAAmB,OAA2C;;QAC5D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QAEtB,IAAI,CAAC,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,mCAAI,IAAA,sBAAa,GAAE,CAAC,MAAM,EAAE,CAAA;IAC1D,CAAC;IAED,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAA;IAC7B,CAAC;IAED;;OAEG;IACH,IAAW,mCAAmC;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,mCAAmC,CAAA;IACzD,CAAC;IAED;;;;;;OAMG;IACH,IAAW,qDAAqD;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,qDAAqD,CAAA;IAC3E,CAAC;IAED;;;;OAIG;IACH,IAAW,sBAAsB;;QAC/B,OAAO,MAAA,IAAI,CAAC,OAAO,CAAC,sBAAsB,mCAAI,0BAA0B,CAAA;IAC1E,CAAC;IAED;;;;;;OAMG;IACH,IAAW,2CAA2C;;QACpD,OAAO,MAAA,IAAI,CAAC,OAAO,CAAC,2CAA2C,mCAAI,6CAA6C,CAAA;IAClH,CAAC;IAED;;;;OAIG;IACH,IAAW,iCAAiC;;QAC1C,OAAO,MAAA,IAAI,CAAC,OAAO,CAAC,iCAAiC,mCAAI,qCAAqC,CAAA;IAChG,CAAC;IAED;;;;OAIG;IACH,IAAW,2BAA2B;;QACpC,OAAO,MAAA,IAAI,CAAC,OAAO,CAAC,2BAA2B,mCAAI,wBAAwB,CAAA;IAC7E,CAAC;IAED;;;;;;OAMG;IACH,IAAW,YAAY;;QACrB,OAAO,MAAA,IAAI,CAAC,OAAO,CAAC,YAAY,mCAAI,KAAK,CAAA;IAC3C,CAAC;IAED;;;;;;;;;OASG;IACH,IAAW,4BAA4B;;QACrC,OAAO,MAAA,IAAI,CAAC,OAAO,CAAC,4BAA4B,mCAAI,KAAK,CAAA;IAC3D,CAAC;IAED;;OAEG;IACH,IAAW,iBAAiB;;QAC1B,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,SAAS,0CAAE,KAAK,mCAAI,QAAQ,CAAA;IAClD,CAAC;IAED;;OAEG;IACH,IAAW,kCAAkC;;QAC3C,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,SAAS,0CAAE,sBAAsB,mCAAI,YAAY,CAAA;IACvE,CAAC;IAED;;OAEG;IACH,IAAW,2BAA2B;;QACpC,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,SAAS,0CAAE,eAAe,mCAAI,SAAS,CAAA;IAC7D,CAAC;IAED;;OAEG;IACH,IAAW,sBAAsB;;QAC/B,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,SAAS,0CAAE,UAAU,mCAAI,aAAa,CAAA;IAC5D,CAAC;IAED;;OAEG;IACH,IAAW,uBAAuB;;QAChC,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,SAAS,0CAAE,WAAW,mCAAI,QAAQ,CAAA;IACxD,CAAC;IAED;;OAEG;IACH,IAAW,gBAAgB;;QACzB,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,CAAC,SAAS,0CAAE,IAAI,mCAAI,OAAO,CAAA;IAChD,CAAC;CACF;AAxID,kEAwIC"}

package/build/openid4vc-issuer/OpenId4VcIssuerService.d.ts

@@ -1,116 +0,0 @@
-import type { OpenId4VciCreateCredentialResponseOptions, OpenId4VciCreateCredentialOfferOptions, OpenId4VciCreateIssuerOptions, OpenId4VciCreateStatelessCredentialOfferOptions } from './OpenId4VcIssuerServiceOptions';
-import type { OpenId4VciMetadata } from '../shared';
-import type { AgentContext, Query, QueryOptions } from '@credo-ts/core';
-import { Oauth2AuthorizationServer, Oauth2Client, Oauth2ResourceServer } from '@animo-id/oauth2';
-import { Oid4vciIssuer } from '@animo-id/oid4vci';
-import { W3cCredentialService } from '@credo-ts/core';
-import { OpenId4VcIssuanceSessionState } from './OpenId4VcIssuanceSessionState';
-import { OpenId4VcIssuerModuleConfig } from './OpenId4VcIssuerModuleConfig';
-import { OpenId4VcIssuerRepository, OpenId4VcIssuerRecord, OpenId4VcIssuanceSessionRepository, OpenId4VcIssuanceSessionRecord } from './repository';
-/**
- * @internal
- */
-export declare class OpenId4VcIssuerService {
-    private w3cCredentialService;
-    private openId4VcIssuerConfig;
-    private openId4VcIssuerRepository;
-    private openId4VcIssuanceSessionRepository;
-    constructor(w3cCredentialService: W3cCredentialService, openId4VcIssuerConfig: OpenId4VcIssuerModuleConfig, openId4VcIssuerRepository: OpenId4VcIssuerRepository, openId4VcIssuanceSessionRepository: OpenId4VcIssuanceSessionRepository);
-    createStatelessCredentialOffer(agentContext: AgentContext, options: OpenId4VciCreateStatelessCredentialOfferOptions & {
-        issuer: OpenId4VcIssuerRecord;
-    }): Promise<{
-        credentialOffer: string;
-        credentialOfferObject: {
-            credential_issuer: string;
-            credential_configuration_ids: string[];
-            grants?: ({
-                authorization_code?: ({
-                    issuer_state?: string | undefined;
-                    authorization_server?: string | undefined;
-                } & {
-                    [key: string]: unknown;
-                }) | undefined;
-                "urn:ietf:params:oauth:grant-type:pre-authorized_code"?: ({
-                    'pre-authorized_code': string;
-                    authorization_server?: string | undefined;
-                    tx_code?: ({
-                        length?: number | undefined;
-                        description?: string | undefined;
-                        input_mode?: "text" | "numeric" | undefined;
-                    } & {
-                        [key: string]: unknown;
-                    }) | undefined;
-                } & {
-                    [key: string]: unknown;
-                }) | undefined;
-            } & {
-                [key: string]: unknown;
-            }) | undefined;
-        } & {
-            [key: string]: unknown;
-        };
-    }>;
-    createCredentialOffer(agentContext: AgentContext, options: OpenId4VciCreateCredentialOfferOptions & {
-        issuer: OpenId4VcIssuerRecord;
-    }): Promise<{
-        issuanceSession: OpenId4VcIssuanceSessionRecord;
-        credentialOffer: string;
-    }>;
-    createCredentialResponse(agentContext: AgentContext, options: OpenId4VciCreateCredentialResponseOptions & {
-        issuanceSession: OpenId4VcIssuanceSessionRecord;
-    }): Promise<{
-        credentialResponse: {
-            c_nonce?: string | undefined;
-            c_nonce_expires_in?: number | undefined;
-            credentials?: (string | {
-                [x: string]: any;
-            })[] | undefined;
-            credential?: string | {
-                [x: string]: any;
-            } | undefined;
-            transaction_id?: string | undefined;
-            notification_id?: string | undefined;
-        } & {
-            [key: string]: unknown;
-        };
-        issuanceSession: OpenId4VcIssuanceSessionRecord;
-    }>;
-    findIssuanceSessionsByQuery(agentContext: AgentContext, query: Query<OpenId4VcIssuanceSessionRecord>, queryOptions?: QueryOptions): Promise<OpenId4VcIssuanceSessionRecord[]>;
-    findSingleIssuancSessionByQuery(agentContext: AgentContext, query: Query<OpenId4VcIssuanceSessionRecord>): Promise<OpenId4VcIssuanceSessionRecord | null>;
-    getIssuanceSessionById(agentContext: AgentContext, issuanceSessionId: string): Promise<OpenId4VcIssuanceSessionRecord>;
-    getAllIssuers(agentContext: AgentContext): Promise<OpenId4VcIssuerRecord[]>;
-    getIssuerByIssuerId(agentContext: AgentContext, issuerId: string): Promise<OpenId4VcIssuerRecord>;
-    updateIssuer(agentContext: AgentContext, issuer: OpenId4VcIssuerRecord): Promise<void>;
-    createIssuer(agentContext: AgentContext, options: OpenId4VciCreateIssuerOptions): Promise<OpenId4VcIssuerRecord>;
-    rotateAccessTokenSigningKey(agentContext: AgentContext, issuer: OpenId4VcIssuerRecord, options?: Pick<OpenId4VciCreateIssuerOptions, 'accessTokenSignerKeyType'>): Promise<void>;
-    /**
-     * @param fetchExternalAuthorizationServerMetadata defaults to false
-     */
-    getIssuerMetadata(agentContext: AgentContext, issuerRecord: OpenId4VcIssuerRecord, fetchExternalAuthorizationServerMetadata?: boolean): Promise<OpenId4VciMetadata>;
-    createNonce(agentContext: AgentContext, issuer: OpenId4VcIssuerRecord): Promise<{
-        cNonce: string;
-        cNonceExpiresAt: Date;
-        cNonceExpiresInSeconds: number;
-    }>;
-    /**
-     * @todo nonces are very short lived (1 min), but it might be nice to also cache the nonces
-     * in the cache if we have 'seen' them. They will only be in the cache for a short time
-     * and it will prevent replay
-     */
-    private verifyNonce;
-    getIssuer(agentContext: AgentContext): Oid4vciIssuer;
-    getOauth2Client(agentContext: AgentContext): Oauth2Client;
-    getOauth2AuthorizationServer(agentContext: AgentContext): Oauth2AuthorizationServer;
-    getResourceServer(agentContext: AgentContext, issuerRecord: OpenId4VcIssuerRecord): Oauth2ResourceServer;
-    /**
-     * Update the record to a new state and emit an state changed event. Also updates the record
-     * in storage.
-     */
-    updateState(agentContext: AgentContext, issuanceSession: OpenId4VcIssuanceSessionRecord, newState: OpenId4VcIssuanceSessionState): Promise<void>;
-    emitStateChangedEvent(agentContext: AgentContext, issuanceSession: OpenId4VcIssuanceSessionRecord, previousState: OpenId4VcIssuanceSessionState | null): void;
-    private getGrantsFromConfig;
-    private getHolderBindingFromRequestProofs;
-    private getCredentialConfigurationsForRequest;
-    private getSignedCredentials;
-    private signW3cCredential;
-}