@openeudi/openid4vp 0.10.1 → 0.11.1-rc.0

package/README.md

@@ -8,6 +8,27 @@ OpenID4VP credential parsing and validation for EUDI Wallets. Supports SD-JWT VC
 npm install @openeudi/openid4vp
 ```
 
+## Security and maturity
+
+This library verifies credentials for identity and age-assurance flows, so its posture is stated here rather than left to be inferred from the feature list.
+
+**No independent third-party security audit has been carried out.** The code has not been reviewed by an external security firm.
+
+**Two high-severity vulnerabilities have been found and fixed, both reported by outside researchers:**
+
+| Advisory | Issue | Fixed in |
+| -------- | ----- | -------- |
+| [GHSA-4c2f-96cf-f5fc](https://github.com/openeudi/openid4vp/security/advisories/GHSA-4c2f-96cf-f5fc) (CVE-2026-75522) | X.509 chain building terminated on Subject DN string equality rather than cryptographic closure, so a forged certificate reusing a trusted anchor's DN was accepted without signature verification | 0.8.1 |
+| [GHSA-h548-cr7v-4v97](https://github.com/openeudi/openid4vp/security/advisories/GHSA-h548-cr7v-4v97) (CVE-2026-77456) | Holder binding was not enforced: an SD-JWT VC's KB-JWT was optional, and mDOC device authentication was never verified, so a captured presentation could be replayed | 0.9.0 |
+
+Both are fixed. Both were found externally rather than by this project's own testing — weigh that accordingly when deciding how much to rely on the library, and **always run the latest release**.
+
+**Pre-1.0.** While the version is below 1.0, minor bumps may contain breaking changes; see the [migration list](#migration). Full EUDI ARF 1.4+ profile compliance is a 1.0 goal, not a current claim.
+
+**What is independently exercised.** The OpenID Foundation conformance suite runs against this library in CI on every pull request, covering the 1.0-Final verifier happy flow for both `sd_jwt_vc` and `iso_mdl` plus the holder-binding negatives. Separately, a downstream deployment built on this library — [eudi-verify](https://github.com/eudi-verify/eudi-verify) 1.4.0 — is [OpenID Certified](https://openid.net/certification/certified-oid4vp-haip-final/) for the `OID4VP-1.0+HAIP-1.0 Verifier iso_mdl direct_post.jwt` profile (14 Aug 2026). That certification is the deployment's, not the library's, but it exercised this code.
+
+Known functional gaps that bear on what you can rely on are listed under [Scope and limitations](#scope-and-limitations). To report a vulnerability, use private reporting as described in [SECURITY.md](./SECURITY.md) — please do not open a public issue.
+
 ## Quick start
 
 Parse a Verifiable Presentation token and extract identity claims:
@@ -156,6 +177,20 @@ const req = await createSignedAuthorizationRequest({
 
 The caller hosts `req.requestObject` at `requestUri` (the library does not host HTTP). The library verifies that the signing key's public SPKI matches the leaf certificate's public key — an attempt to sign with a mismatched key fails with `SignedRequestBuildError: signing_key_cert_mismatch`.
 
+### Self-signed verifier certificates are rejected
+
+HAIP 1.0 Final requires the verifier certificate to chain to a trust anchor the wallet recognises. A self-signed leaf asserts an identity nothing vouches for, so a wallet enforcing the profile will reject the request object. `createSignedAuthorizationRequest` therefore **rejects a self-signed leaf by default** with `SignedRequestBuildError: self_signed_leaf`, failing at build time rather than emitting a request no conforming wallet will honour.
+
+```ts
+// Local development or tests only — not valid under HAIP 1.0 Final.
+await createSignedAuthorizationRequest({
+  ...input,
+  allowSelfSignedCertificate: true,
+}, dcqlQuery);
+```
+
+The check verifies the leaf's signature against its own public key rather than comparing Subject and Issuer DN strings. That distinction is deliberate: [GHSA-4c2f-96cf-f5fc](https://github.com/openeudi/openid4vp/security/advisories/GHSA-4c2f-96cf-f5fc) was a DN-string-equality bug, and a DN comparison here would both miss a re-signed certificate and wrongly reject a legitimate cross-signed one.
+
 The emitted `client_metadata` carries the 1.0 Final shape: `encrypted_response_enc_values_supported: ["A128GCM", ...]`.
 
 ## Authorization responses (direct_post and direct_post.jwt)
@@ -393,7 +428,7 @@ This library implements the **verifier side** of OpenID4VP for SD-JWT VC and mDO
 - **mDOC / ISO 18013-5** `mso_mdoc` format — CBOR decoding, claim extraction, COSE_Sign1 signature verification, MobileSecurityObject validity enforcement, IssuerSignedItem digest verification. Device authentication (ISO 18013-5 §9.1.3) is **mandatory and fails closed**: the `DeviceSignature` (COSE_Sign1) over `DeviceAuthentication`/`SessionTranscript` is verified against the MSO-committed device key. `DeviceMac` (COSE_Mac0) is **not supported and is rejected**.
 - **DCQL** — authorization request builder with DCQL query, matching via [@openeudi/dcql](https://www.npmjs.com/package/@openeudi/dcql), `verifyPresentation` for combined crypto + match.
 - **HAIP** — `buildHaipQuery` / `validateHaipQuery` helpers for the High Assurance Interoperability Profile.
-- **Signed authorization requests (JAR)** — `createSignedAuthorizationRequest` per RFC 9101 / OpenID4VP 1.0 §5.10 with `x509_san_dns` or `x509_hash` client-id binding. Emits the OpenID4VP 1.0 Final `client_metadata` shape.
+- **Signed authorization requests (JAR)** — `createSignedAuthorizationRequest` per RFC 9101 / OpenID4VP 1.0 §5.10 with `x509_san_dns` or `x509_hash` client-id binding. Emits the OpenID4VP 1.0 Final `client_metadata` shape. Self-signed verifier leaf certificates are rejected by default per HAIP 1.0 Final.
 - **Encrypted responses** — `decryptAuthorizationResponse` for `direct_post.jwt` (ECDH-ES + A128GCM/A256GCM), `verifyAuthorizationResponse` for the 1.0 §8.1 object-keyed `vp_token` envelope.
 - **X.509 chain validation** — RFC 5280 chain building including `nameConstraints`, `StaticTrustStore`, `CompositeTrustStore`.
 - **Revocation checking** — OCSP-first with CRL fallback (`revocationPolicy: 'skip' | 'prefer' | 'require'`).
@@ -404,7 +439,6 @@ This library implements the **verifier side** of OpenID4VP for SD-JWT VC and mDO
 **What is NOT yet implemented** (planned for follow-up releases):
 
 - Multi-credential DCQL queries (multiple query ids) and multi-presentation arrays per query id — currently rejected with `MultipleCredentialsNotSupportedError`.
-- Self-signed-leaf rejection per HAIP 1.0 final's strict constraint (current behaviour accepts self-signed leaves for the verifier's own identity).
 - SIOPv2 (Self-Issued OpenID Provider) identity flows.
 
 EUDI Architecture Reference Framework (ARF) alignment: tracks OpenID4VP 1.0 final. Full ARF 1.4+ profile compliance will be added before a stable 1.0.
@@ -437,6 +471,7 @@ See [CHANGELOG.md](./CHANGELOG.md) for per-release changes. Key migration moment
 - **0.7.0** — `createSignedAuthorizationRequest`, `decryptAuthorizationResponse`, `verifyAuthorizationResponse` for HAIP / 1.0 §8.1 envelopes.
 - **0.8.0** — additive: ID3 `client_metadata` bridge, `trustedIssuerJwks` opt-in, transitive SD-JWT disclosure check.
 - **0.9.3** — `reflect-metadata` is loaded by the package itself in both ESM and CJS builds. If you added a manual `import "reflect-metadata"` before importing this library to work around the 0.9.2 bug, you can drop it.
+- **0.11.0** — **BREAKING:** `createSignedAuthorizationRequest` now rejects a self-signed leaf certificate with `SignedRequestBuildError: self_signed_leaf`, per HAIP 1.0 Final. Verifiers using a self-signed certificate for their own identity must either move to a CA-issued certificate (the correct fix) or pass `allowSelfSignedCertificate: true` to keep the previous behaviour. Verification of wallet presentations is unaffected — this concerns only the verifier's own request-signing certificate.
 - **0.10.0** — `createSignedAuthorizationRequest` gains `clientIdPrefix` (`x509_san_dns` default, or `x509_hash`), and `hostname` becomes optional — required only for `x509_san_dns`, but still validated against the leaf SAN whenever supplied. **Wire change for existing callers:** the emitted `client_metadata` no longer carries the singular ID3 `authorization_encrypted_response_alg` / `authorization_encrypted_response_enc` fields added in 0.8.0. Verifiers that read the 1.0 Final `encrypted_response_enc_values_supported` array (and `alg` from `client_metadata.jwks`) are unaffected; anything still reading the singular fields needs updating.
 
 ## License

package/dist/index.cjs

@@ -8295,6 +8295,12 @@ async function createSignedAuthorizationRequest(input, query) {
       "signer.publicKey SPKI does not match leaf certificate SPKI"
     );
   }
+  if (input.allowSelfSignedCertificate !== true && await leafCert.isSelfSigned()) {
+    throw new exports.SignedRequestBuildError(
+      "self_signed_leaf",
+      "leaf certificate is self-signed; HAIP 1.0 Final requires a certificate chaining to a trust anchor. Pass allowSelfSignedCertificate: true to override for local development or tests."
+    );
+  }
   const responseMode = input.responseMode ?? "direct_post.jwt";
   if (responseMode === "direct_post.jwt") {
     if (!input.encryptionKey?.publicJwk) {
@@ -9695,7 +9701,8 @@ async function verifyPresentation(vpToken, query, options) {
   const parsed = await parsePresentation(vpToken, options);
   const dcqlFormat = INTERNAL_TO_DCQL_FORMAT[parsed.format] ?? parsed.format;
   const decodedClaims = parsed.format === "mdoc" && parsed.namespacedClaims !== void 0 ? parsed.namespacedClaims : parsed.claims;
-  const presentedCredentialQuery = query.credentials.find((c) => c.format === dcqlFormat) ?? query.credentials[0];
+  const sameFormat = query.credentials.filter((c) => c.format === dcqlFormat);
+  const presentedCredentialQuery = sameFormat.find((c) => matchesCredentialType(c, parsed)) ?? sameFormat[0] ?? query.credentials[0];
   const decoded = {
     id: presentedCredentialQuery?.id ?? "presented",
     format: dcqlFormat,
@@ -9719,6 +9726,17 @@ async function verifyPresentation(vpToken, query, options) {
     valid: parsed.valid && match.satisfied
   };
 }
+function matchesCredentialType(credentialQuery, parsed) {
+  if (parsed.format === "sd-jwt-vc") {
+    const vctValues = credentialQuery.meta?.vct_values;
+    return typeof parsed.vct === "string" && Array.isArray(vctValues) && vctValues.includes(parsed.vct);
+  }
+  if (parsed.format === "mdoc") {
+    const doctype = credentialQuery.meta?.doctype_value;
+    return typeof parsed.docType === "string" && doctype === parsed.docType;
+  }
+  return false;
+}
 function isEncryptedResponse(x) {
   return typeof x === "object" && x !== null && "response" in x && typeof x.response === "string" && Object.keys(x).length === 1;
 }
@@ -10456,7 +10474,7 @@ function equalBytes(a, b) {
 
 // src/index.ts
 init_errors();
-var VERSION = "0.10.1";
+var VERSION = "0.11.1-rc.0";
 /*! Bundled license information:
 
 pvtsutils/build/index.es.js: