@openeudi/openid4vp 0.10.0 → 0.11.0

package/dist/index.d.cts

@@ -18,6 +18,15 @@ interface AuthorizationRequest {
 interface SignedAuthorizationRequestInput {
     clientIdPrefix?: 'x509_san_dns' | 'x509_hash';
     hostname?: string;
+    /**
+     * Permit a self-signed leaf certificate for the verifier's own identity.
+     *
+     * Defaults to `false`. HAIP 1.0 Final requires the verifier certificate to
+     * chain to a trust anchor the wallet recognises; a self-signed leaf asserts
+     * an identity nothing vouches for, so wallets enforcing the profile will
+     * reject the request object. Set this only for local development or tests.
+     */
+    allowSelfSignedCertificate?: boolean;
     requestUri: string;
     responseUri: string;
     nonce: string;
@@ -615,7 +624,7 @@ declare class LotlFetchError extends OpenID4VPError {
 declare class LotlSignatureError extends OpenID4VPError {
     readonly code: "lotl_signature_invalid";
 }
-type SignedRequestBuildErrorCode = 'empty_cert_chain' | 'hostname_cert_mismatch' | 'signing_key_cert_mismatch' | 'missing_encryption_jwk' | 'missing_encryption_alg' | 'missing_vp_formats' | 'unsupported_signing_alg' | 'empty_supported_enc_values' | 'missing_hostname';
+type SignedRequestBuildErrorCode = 'empty_cert_chain' | 'hostname_cert_mismatch' | 'signing_key_cert_mismatch' | 'missing_encryption_jwk' | 'missing_encryption_alg' | 'missing_vp_formats' | 'unsupported_signing_alg' | 'empty_supported_enc_values' | 'missing_hostname' | 'self_signed_leaf';
 declare class SignedRequestBuildError extends OpenID4VPError {
     readonly code: SignedRequestBuildErrorCode;
     constructor(code: SignedRequestBuildErrorCode, message: string);
@@ -684,6 +693,6 @@ declare class LotlTrustStore implements TrustStore {
     private refresh;
 }
 
-declare const VERSION = "0.10.0";
+declare const VERSION = "0.11.0";
 
 export { type AuthorizationRequest, type AuthorizationRequestInput, type AuthorizationResponse, type Cache, CertificateChainError, type ChainErrorReason, CompositeTrustStore, type CredentialClaims, type CredentialFormat, DecryptionFailedError, type EncryptedResponse, ExpiredCredentialError, type Fetcher, HAIP_DOCTYPE_NAMESPACES, type HaipQueryInput, type HaipValidationCode, HaipValidationError, type ICredentialParser, InMemoryCache, InvalidSignatureError, type IssuerInfo, type LotlAnchorMetadata, LotlFetchError, LotlSignatureError, LotlTrustStore, type LotlTrustStoreOptions, MalformedCredentialError, MdocParser, MissingDecryptionKeyError, MissingVerifierEncryptionKeyError, MultipleCredentialsNotSupportedError, NonceValidationError, OpenID4VPError, type ParseOptions, type PresentationResult, RevocationCheckFailedError, RevokedCertificateError, SdJwtParser, type SignedAuthorizationRequest, type SignedAuthorizationRequestInput, SignedRequestBuildError, type SignedRequestBuildErrorCode, StaticTrustStore, type TrustAnchor, TrustAnchorNotFoundError, type TrustStore, type TrustStoreHint, type TrustStoreInput, UnsupportedFormatError, UnsupportedJweError, VERSION, type VerifyAuthorizationResponseOptions, type VerifyOptions, type VerifyResult, buildHaipQuery, buildOid4vpSessionTranscript, buildOpenID4VPHandoverSessionTranscript, createAuthorizationRequest, createSignedAuthorizationRequest, decryptAuthorizationResponse, isHaipQuery, parsePresentation, validateHaipQuery, verifyAuthorizationResponse, verifyPresentation };

package/dist/index.d.ts

@@ -18,6 +18,15 @@ interface AuthorizationRequest {
 interface SignedAuthorizationRequestInput {
     clientIdPrefix?: 'x509_san_dns' | 'x509_hash';
     hostname?: string;
+    /**
+     * Permit a self-signed leaf certificate for the verifier's own identity.
+     *
+     * Defaults to `false`. HAIP 1.0 Final requires the verifier certificate to
+     * chain to a trust anchor the wallet recognises; a self-signed leaf asserts
+     * an identity nothing vouches for, so wallets enforcing the profile will
+     * reject the request object. Set this only for local development or tests.
+     */
+    allowSelfSignedCertificate?: boolean;
     requestUri: string;
     responseUri: string;
     nonce: string;
@@ -615,7 +624,7 @@ declare class LotlFetchError extends OpenID4VPError {
 declare class LotlSignatureError extends OpenID4VPError {
     readonly code: "lotl_signature_invalid";
 }
-type SignedRequestBuildErrorCode = 'empty_cert_chain' | 'hostname_cert_mismatch' | 'signing_key_cert_mismatch' | 'missing_encryption_jwk' | 'missing_encryption_alg' | 'missing_vp_formats' | 'unsupported_signing_alg' | 'empty_supported_enc_values' | 'missing_hostname';
+type SignedRequestBuildErrorCode = 'empty_cert_chain' | 'hostname_cert_mismatch' | 'signing_key_cert_mismatch' | 'missing_encryption_jwk' | 'missing_encryption_alg' | 'missing_vp_formats' | 'unsupported_signing_alg' | 'empty_supported_enc_values' | 'missing_hostname' | 'self_signed_leaf';
 declare class SignedRequestBuildError extends OpenID4VPError {
     readonly code: SignedRequestBuildErrorCode;
     constructor(code: SignedRequestBuildErrorCode, message: string);
@@ -684,6 +693,6 @@ declare class LotlTrustStore implements TrustStore {
     private refresh;
 }
 
-declare const VERSION = "0.10.0";
+declare const VERSION = "0.11.0";
 
 export { type AuthorizationRequest, type AuthorizationRequestInput, type AuthorizationResponse, type Cache, CertificateChainError, type ChainErrorReason, CompositeTrustStore, type CredentialClaims, type CredentialFormat, DecryptionFailedError, type EncryptedResponse, ExpiredCredentialError, type Fetcher, HAIP_DOCTYPE_NAMESPACES, type HaipQueryInput, type HaipValidationCode, HaipValidationError, type ICredentialParser, InMemoryCache, InvalidSignatureError, type IssuerInfo, type LotlAnchorMetadata, LotlFetchError, LotlSignatureError, LotlTrustStore, type LotlTrustStoreOptions, MalformedCredentialError, MdocParser, MissingDecryptionKeyError, MissingVerifierEncryptionKeyError, MultipleCredentialsNotSupportedError, NonceValidationError, OpenID4VPError, type ParseOptions, type PresentationResult, RevocationCheckFailedError, RevokedCertificateError, SdJwtParser, type SignedAuthorizationRequest, type SignedAuthorizationRequestInput, SignedRequestBuildError, type SignedRequestBuildErrorCode, StaticTrustStore, type TrustAnchor, TrustAnchorNotFoundError, type TrustStore, type TrustStoreHint, type TrustStoreInput, UnsupportedFormatError, UnsupportedJweError, VERSION, type VerifyAuthorizationResponseOptions, type VerifyOptions, type VerifyResult, buildHaipQuery, buildOid4vpSessionTranscript, buildOpenID4VPHandoverSessionTranscript, createAuthorizationRequest, createSignedAuthorizationRequest, decryptAuthorizationResponse, isHaipQuery, parsePresentation, validateHaipQuery, verifyAuthorizationResponse, verifyPresentation };

package/dist/index.js

@@ -8274,6 +8274,12 @@ async function createSignedAuthorizationRequest(input, query) {
       "signer.publicKey SPKI does not match leaf certificate SPKI"
     );
   }
+  if (input.allowSelfSignedCertificate !== true && await leafCert.isSelfSigned()) {
+    throw new SignedRequestBuildError(
+      "self_signed_leaf",
+      "leaf certificate is self-signed; HAIP 1.0 Final requires a certificate chaining to a trust anchor. Pass allowSelfSignedCertificate: true to override for local development or tests."
+    );
+  }
   const responseMode = input.responseMode ?? "direct_post.jwt";
   if (responseMode === "direct_post.jwt") {
     if (!input.encryptionKey?.publicJwk) {
@@ -9674,8 +9680,9 @@ async function verifyPresentation(vpToken, query, options) {
   const parsed = await parsePresentation(vpToken, options);
   const dcqlFormat = INTERNAL_TO_DCQL_FORMAT[parsed.format] ?? parsed.format;
   const decodedClaims = parsed.format === "mdoc" && parsed.namespacedClaims !== void 0 ? parsed.namespacedClaims : parsed.claims;
+  const presentedCredentialQuery = query.credentials.find((c) => c.format === dcqlFormat) ?? query.credentials[0];
   const decoded = {
-    id: query.credentials[0]?.id ?? "presented",
+    id: presentedCredentialQuery?.id ?? "presented",
     format: dcqlFormat,
     claims: decodedClaims
   };
@@ -9796,8 +9803,12 @@ async function verifyAuthorizationResponse(envelope, query, options) {
   if (queryIds.length > 1 || presentationCount > 1) {
     throw new MultipleCredentialsNotSupportedError(queryIds.length, presentationCount);
   }
-  const presentation = vpToken[queryIds[0]][0];
-  const decodedPresentation = query.credentials[0]?.format === "mso_mdoc" && typeof presentation === "string" ? base64UrlToBytes(presentation) : presentation;
+  const presentedQueryId = queryIds[0];
+  const presentation = vpToken[presentedQueryId][0];
+  const presentedCredentialQuery = query.credentials.find(
+    (c) => c.id === presentedQueryId
+  );
+  const decodedPresentation = presentedCredentialQuery?.format === "mso_mdoc" && typeof presentation === "string" ? base64UrlToBytes(presentation) : presentation;
   return verifyPresentation(decodedPresentation, query, options);
 }
 
@@ -10430,7 +10441,7 @@ function equalBytes(a, b) {
 
 // src/index.ts
 init_errors();
-var VERSION = "0.10.0";
+var VERSION = "0.11.0";
 /*! Bundled license information:
 
 pvtsutils/build/index.es.js: