@digitalbazaar/oid4-client 5.0.0 → 5.1.0

package/lib/authorizationResponse.js

@@ -9,60 +9,101 @@ import {pathsToVerifiableCredentialPointers} from './convert.js';
 
 const TEXT_ENCODER = new TextEncoder();
 
-export async function send({
+// creates an authorization response without sending it; use `send()` to create
+// and send one at once
+export async function create({
   verifiablePresentation,
   presentationSubmission,
   authorizationRequest,
   vpToken,
-  encryptionOptions = {},
-  agent
+  encryptionOptions = {}
 } = {}) {
-  try {
-    if(!(verifiablePresentation || vpToken)) {
+  if(!(verifiablePresentation || vpToken)) {
+    throw createNamedError({
+      message: 'One of "verifiablePresentation" or "vpToken" must be given.',
+      name: 'DataError'
+    });
+  }
+  // if no `vpToken` given, use VP
+  vpToken = vpToken ?? JSON.stringify(verifiablePresentation);
+
+  // if no `presentationSubmission` provided, auto-generate one
+  let generatedPresentationSubmission = false;
+  if(!presentationSubmission) {
+    ({presentationSubmission} = createPresentationSubmission({
+      presentationDefinition: authorizationRequest.presentation_definition,
+      verifiablePresentation
+    }));
+    generatedPresentationSubmission = true;
+  }
+
+  // prepare response body
+  const body = {};
+
+  // if `authorizationRequest.response_mode` is `direct.jwt` generate a JWT
+  if(authorizationRequest.response_mode === 'direct_post.jwt') {
+    if(submitsFormat({presentationSubmission, format: 'mso_mdoc'}) &&
+      !encryptionOptions?.mdl?.sessionTranscript) {
       throw createNamedError({
-        message: 'One of "verifiablePresentation" or "vpToken" must be given.',
+        message: '"encryptionOptions.mdl.sessionTranscript" is required ' +
+          'when submitting an mDL presentation.',
         name: 'DataError'
       });
     }
-    // if no `vpToken` given, use VP
-    vpToken = vpToken ?? JSON.stringify(verifiablePresentation);
-
-    // if no `presentationSubmission` provided, auto-generate one
-    let generatedPresentationSubmission = false;
-    if(!presentationSubmission) {
-      ({presentationSubmission} = createPresentationSubmission({
-        presentationDefinition: authorizationRequest.presentation_definition,
-        verifiablePresentation
-      }));
-      generatedPresentationSubmission = true;
-    }
 
-    // prepare response body
-    const body = new URLSearchParams();
+    const jwt = await _encrypt({
+      vpToken, presentationSubmission, authorizationRequest,
+      encryptionOptions
+    });
+    body.response = jwt;
+  } else {
+    // include vp token and presentation submittion directly in body
+    body.vp_token = vpToken;
+    body.presentation_submission = JSON.stringify(presentationSubmission);
+  }
 
-    // if `authorizationRequest.response_mode` is `direct.jwt` generate a JWT
-    if(authorizationRequest.response_mode === 'direct_post.jwt') {
-      if(submitsFormat({presentationSubmission, format: 'mso_mdoc'}) &&
-        !encryptionOptions?.mdl?.sessionTranscript) {
-        throw createNamedError({
-          message: '"encryptionOptions.mdl.sessionTranscript" is required ' +
-            'when submitting an mDL presentation.',
-          name: 'DataError'
-        });
-      }
+  const authorizationResponse = body;
+  if(generatedPresentationSubmission) {
+    // return any generated presentation submission
+    return {authorizationResponse, presentationSubmission};
+  }
+  return {authorizationResponse};
+}
 
-      const jwt = await _encrypt({
-        vpToken, presentationSubmission, authorizationRequest,
+export async function send({
+  verifiablePresentation,
+  presentationSubmission,
+  authorizationRequest,
+  vpToken,
+  encryptionOptions = {},
+  authorizationResponse,
+  agent
+} = {}) {
+  try {
+    // create `authorizationResponse` if not passed
+    let generatedPresentationSubmission;
+    if(!authorizationResponse) {
+      ({
+        authorizationResponse,
+        presentationSubmission: generatedPresentationSubmission
+      } = await create({
+        verifiablePresentation,
+        presentationSubmission,
+        authorizationRequest,
+        vpToken,
         encryptionOptions
-      });
-      body.set('response', jwt);
-    } else {
-      // include vp token and presentation submittion directly in body
-      body.set('vp_token', vpToken);
-      body.set(
-        'presentation_submission', JSON.stringify(presentationSubmission));
+      }));
+    } else if(verifiablePresentation || presentationSubmission || vpToken ||
+      encryptionOptions) {
+      throw new TypeError(
+        'Only "authorizationResponse" or its components ( ' +
+        '"verifiablePresentation", "presentationSubmission", "vpToken", ' +
+        '"encryptionOptions") can be passed, but not both.');
     }
 
+    // prepare response body
+    const body = new URLSearchParams(authorizationResponse);
+
     // send response
     const response = await httpClient.post(authorizationRequest.response_uri, {
       agent, body, headers: {accept: 'application/json'},
@@ -75,7 +116,7 @@ export async function send({
     const result = response.data || {};
     if(generatedPresentationSubmission) {
       // return any generated presentation submission
-      return {result, presentationSubmission};
+      return {result, presentationSubmission: generatedPresentationSubmission};
     }
     return {result};
   } catch(cause) {

package/lib/oid4vp.js

@@ -4,6 +4,7 @@
 export * as authzRequest from './authorizationRequest.js';
 export * as authzResponse from './authorizationResponse.js';
 export * as convert from './convert.js';
+export * as verifier from './verifier.js';
 
 // backwards compatibility APIs
 export {

package/lib/util.js

@@ -34,12 +34,15 @@ export function base64Encode(data) {
     return data.toBase64();
   }
   // note: this is base64-no-pad; will only work with specific data lengths
-  base64url.encode(data).replace(/-/g, '+').replace(/_/g, '/');
+  return base64url.encode(data).replace(/-/g, '+').replace(/_/g, '/');
 }
 
-export function createNamedError({message, name, cause} = {}) {
+export function createNamedError({message, name, details, cause} = {}) {
   const error = new Error(message, {cause});
   error.name = name;
+  if(details) {
+    error.details = details;
+  }
   return error;
 }
 

package/lib/verifier.js

@@ -0,0 +1,115 @@
+/*!
+ * Copyright (c) 2023-2025 Digital Bazaar, Inc. All rights reserved.
+ */
+import {createNamedError, selectJwk} from './util.js';
+import {importJWK, jwtDecrypt} from 'jose';
+
+// parses (and decrypts) an authz response from a response body object
+export async function parseAuthorizationResponse({
+  body = {},
+  supportedResponseModes = ['direct_post.jwt', 'direct_post'],
+  getDecryptParameters
+}) {
+  let responseMode;
+  const parsed = {};
+  let payload;
+  let protectedHeader;
+
+  supportedResponseModes = new Set(supportedResponseModes);
+
+  if(body.response) {
+    // `body.response` is present which must contain an encrypted JWT
+    responseMode = 'direct_post.jwt';
+    _assertSupportedResponseMode({responseMode, supportedResponseModes});
+    const jwt = body.response;
+    ({
+      payload,
+      protectedHeader
+    } = await _decrypt({jwt, getDecryptParameters}));
+    parsed.presentationSubmission = payload.presentation_submission;
+  } else {
+    responseMode = 'direct_post';
+    _assertSupportedResponseMode({responseMode, supportedResponseModes});
+    payload = body;
+    parsed.presentationSubmission = _jsonParse(
+      payload.presentation_submission, 'presentation_submission');
+  }
+
+  // `vp_token` is either:
+  // 1. a JSON object (a VP)
+  // 2. a JSON array (of something)
+  // 3. a JSON string (a quoted JWT: "<JWT>")
+  // 4. a JWT
+  // 5. a base64url-encoded mDL device response
+  // 6. unknown
+  const {vp_token} = payload;
+  if(typeof vp_token === 'string' &&
+    (vp_token.startsWith('{') || vp_token.startsWith('[') ||
+    vp_token.startsWith('"'))) {
+    parsed.vpToken = _jsonParse(vp_token, 'vp_token');
+  } else {
+    parsed.vpToken = vp_token;
+  }
+
+  return {responseMode, parsed, payload, protectedHeader};
+}
+
+function _assertSupportedResponseMode({
+  responseMode, supportedResponseModes
+}) {
+  if(!supportedResponseModes.has(responseMode)) {
+    throw createNamedError({
+      message: `Unsupported response mode "${responseMode}".`,
+      name: 'NotSupportedError'
+    });
+  }
+}
+
+async function _decrypt({jwt, getDecryptParameters}) {
+  if(typeof getDecryptParameters !== 'function') {
+    throw new TypeError(
+      '"getDecryptParameters" is required for "direct_post.jwt" ' +
+      'response mode.');
+  }
+
+  const params = await getDecryptParameters({jwt});
+  const {keys} = params;
+  let {getKey} = params;
+  if(!getKey) {
+    // note: `jose` lib's JWK key set feature cannot be used and passed to
+    // `jwtDecrypt()` as the second parameter because the expected `alg`
+    // "ECDH-ES" is not a unsupported algorithm for selecting a key from a set
+    getKey = protectedHeader => {
+      if(protectedHeader.alg !== 'ECDH-ES') {
+        const error = createNamedError({
+          message: `Unsupported algorithm "${protectedHeader.alg}"; ` +
+            'algorithm must be "ECDH-ES".',
+          name: 'NotSupportedError',
+          details: {httpStatusCode: 400, public: true}
+        });
+        throw error;
+      }
+      const jwk = selectJwk({keys, kid: protectedHeader.kid});
+      return importJWK(jwk, 'ECDH-ES');
+    };
+  }
+
+  return jwtDecrypt(jwt, getKey, {
+    // only supported algorithms at this time:
+    contentEncryptionAlgorithms: ['A256GCM'],
+    keyManagementAlgorithms: ['ECDH-ES']
+  });
+}
+
+function _jsonParse(x, name) {
+  try {
+    return JSON.parse(x);
+  } catch(cause) {
+    throw createNamedError({
+      message: `Could not parse "${name}".`,
+      name: 'DataError',
+      details: {httpStatusCode: 400, public: true},
+      cause
+    });
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digitalbazaar/oid4-client",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "An OID4 (VC + VP) client",
   "homepage": "https://github.com/digitalbazaar/oid4-client",
   "author": {
@@ -25,12 +25,14 @@
   "dependencies": {
     "@digitalbazaar/http-client": "^4.0.0",
     "base64url-universal": "^2.0.0",
-    "jose": "^6.0.13",
+    "jose": "^6.1.0",
     "jsonpath-plus": "^10.3.0",
     "jsonpointer": "^5.0.1",
     "pkijs": "^3.2.5"
   },
   "devDependencies": {
+    "@auth0/mdl": "^3.0.0",
+    "asn1js": "^3.0.6",
     "c8": "^10.1.3",
     "chai": "^4.3.6",
     "cross-env": "^10.0.0",