@openeudi/openid4vp 0.6.0 → 0.7.0

package/README.md

@@ -124,6 +124,96 @@ Mismatches return `valid: false` — they do not throw. Only crypto/structural f
 
 > **Privacy — diagnostics are verifier-internal.** `match.unmatched[].reason` and `detail` (including `value_mismatch`) are intended for verifier-side logging, debugging, and admin UIs. OpenID4VP §11 warns that per-claim verification outcomes can reveal wallet contents to observers. Do NOT echo these diagnostics into the OpenID4VP wire response sent back to the wallet, into end-user-visible error messages that another party could correlate, or into public analytics/third-party logs. The protocol's own error codes are the public interface; these fields are your internal instrumentation.
 
+## Signed authorization requests (x509_san_dns)
+
+For flows that require a signed request object (JAR) per OpenID4VP 1.0 §5.10, use `createSignedAuthorizationRequest`:
+
+```ts
+import { createSignedAuthorizationRequest } from "@openeudi/openid4vp";
+
+const req = await createSignedAuthorizationRequest({
+  hostname: "verifier.example.com",
+  requestUri: "https://verifier.example.com/request.jwt",
+  responseUri: "https://verifier.example.com/response",
+  nonce,
+  signer: verifierKeyPair,          // CryptoKeyPair with public+private
+  certificateChain: [leafCertDer],  // DER-encoded, leaf SAN DNSName must equal hostname
+  encryptionKey: {
+    publicJwk: encryptionPublicJwk, // must include alg, e.g. "ECDH-ES"
+  },
+  vpFormatsSupported: {
+    "dc+sd-jwt": { "sd-jwt_alg_values": ["ES256"] },
+  },
+}, dcqlQuery);
+
+// req.uri — the short URI to hand to the wallet
+// req.requestObject — the JWS the verifier must host at requestUri
+//                     (Content-Type: application/oauth-authz-req+jwt)
+```
+
+The caller hosts `req.requestObject` at `requestUri` (the library does not host HTTP). The library verifies that the signing key's public SPKI matches the leaf certificate's public key — an attempt to sign with a mismatched key fails with `SignedRequestBuildError: signing_key_cert_mismatch`.
+
+## Authorization responses (direct_post and direct_post.jwt)
+
+Wallets POST the Authorization Response to your `responseUri`. The library is stateless — you MUST compare the envelope's `state` against the value you issued before treating the response as trustworthy. The recommended pattern differs slightly between the unencrypted and encrypted modes.
+
+### Unencrypted (`direct_post`)
+
+The envelope arrives as form-encoded JSON; parse it, check `state`, then verify:
+
+```ts
+import { verifyAuthorizationResponse } from "@openeudi/openid4vp";
+
+const envelope = parsedVpTokenObject; // { vp_token, state, ... }
+
+if (envelope.state !== submittedState) {
+  throw new Error("state mismatch — possible CSRF / replay");
+}
+
+const result = await verifyAuthorizationResponse(envelope, dcqlQuery, {
+  trustedCertificates: [issuerCertDer],
+  nonce,
+});
+```
+
+### Encrypted (`direct_post.jwt`)
+
+The wallet wraps the envelope in a JWE. Decrypt explicitly so you can check `state` against the decrypted envelope **before** verification runs:
+
+```ts
+import {
+  decryptAuthorizationResponse,
+  verifyAuthorizationResponse,
+} from "@openeudi/openid4vp";
+
+const decrypted = await decryptAuthorizationResponse(
+  form.get("response"), // the JWE string
+  verifierEncryptionPrivateKey,
+);
+
+if (decrypted.state !== submittedState) {
+  throw new Error("state mismatch — possible CSRF / replay");
+}
+
+const result = await verifyAuthorizationResponse(decrypted, dcqlQuery, {
+  trustedCertificates: [issuerCertDer],
+  nonce,
+});
+```
+
+`verifyAuthorizationResponse` also accepts the JWE directly via `{ response: jwe }` together with `options.decryptionKey` — but that path makes the `state` check easy to skip, since the caller never holds the decrypted envelope. Prefer the explicit two-step pattern above.
+
+`verifyAuthorizationResponse` accepts the OpenID4VP 1.0 §8.1 envelope shape: `vp_token` is always an object keyed by DCQL credential query id, with arrays of presentations. This release supports **single-credential single-presentation only** — multi-credential queries or multi-presentation arrays throw `MultipleCredentialsNotSupportedError`.
+
+### Supported JWE algorithms
+
+`direct_post.jwt` decryption supports:
+
+- `alg`: `ECDH-ES` (driven by the encryption JWK's `alg` parameter)
+- `enc`: `A128GCM`, `A256GCM` (HAIP requires both)
+
+Other algorithms throw `UnsupportedJweError`.
+
 ### ParseOptions / VerifyOptions
 
 Both `parsePresentation` and `verifyPresentation` accept:

package/dist/index.cjs

@@ -2,8 +2,8 @@
 
 var x509 = require('@peculiar/x509');
 var uuid = require('uuid');
-var cborX = require('cbor-x');
 var jose = require('jose');
+var cborX = require('cbor-x');
 var decode = require('@sd-jwt/decode');
 var dcql = require('@openeudi/dcql');
 var xmldom = require('@xmldom/xmldom');
@@ -40,7 +40,7 @@ var __export = (target, all) => {
 };
 
 // src/errors.ts
-exports.InvalidSignatureError = void 0; exports.ExpiredCredentialError = void 0; exports.UnsupportedFormatError = void 0; exports.MalformedCredentialError = void 0; exports.NonceValidationError = void 0; exports.HaipValidationError = void 0; exports.OpenID4VPError = void 0; exports.TrustAnchorNotFoundError = void 0; exports.CertificateChainError = void 0; exports.RevokedCertificateError = void 0; exports.RevocationCheckFailedError = void 0; exports.LotlFetchError = void 0; exports.LotlSignatureError = void 0;
+exports.InvalidSignatureError = void 0; exports.ExpiredCredentialError = void 0; exports.UnsupportedFormatError = void 0; exports.MalformedCredentialError = void 0; exports.NonceValidationError = void 0; exports.HaipValidationError = void 0; exports.OpenID4VPError = void 0; exports.TrustAnchorNotFoundError = void 0; exports.CertificateChainError = void 0; exports.RevokedCertificateError = void 0; exports.RevocationCheckFailedError = void 0; exports.LotlFetchError = void 0; exports.LotlSignatureError = void 0; exports.SignedRequestBuildError = void 0; exports.UnsupportedJweError = void 0; exports.DecryptionFailedError = void 0; exports.MissingDecryptionKeyError = void 0; exports.MultipleCredentialsNotSupportedError = void 0;
 var init_errors = __esm({
   "src/errors.ts"() {
     exports.InvalidSignatureError = class extends Error {
@@ -136,6 +136,47 @@ var init_errors = __esm({
     exports.LotlSignatureError = class extends exports.OpenID4VPError {
       code = "lotl_signature_invalid";
     };
+    exports.SignedRequestBuildError = class extends exports.OpenID4VPError {
+      code;
+      constructor(code, message) {
+        super(message);
+        this.code = code;
+      }
+    };
+    exports.UnsupportedJweError = class extends exports.OpenID4VPError {
+      code = "unsupported_jwe";
+      alg;
+      enc;
+      constructor(alg, enc) {
+        super(`Unsupported JWE algorithms: alg=${alg}, enc=${enc}`);
+        this.alg = alg;
+        this.enc = enc;
+      }
+    };
+    exports.DecryptionFailedError = class extends exports.OpenID4VPError {
+      code = "decryption_failed";
+      constructor(message = "Failed to decrypt authorization response", options) {
+        super(message, options);
+      }
+    };
+    exports.MissingDecryptionKeyError = class extends exports.OpenID4VPError {
+      code = "missing_decryption_key";
+      constructor(message = "decryptionKey is required to verify a direct_post.jwt response") {
+        super(message);
+      }
+    };
+    exports.MultipleCredentialsNotSupportedError = class extends exports.OpenID4VPError {
+      code = "multi_credential_unsupported";
+      entryCount;
+      presentationCount;
+      constructor(entryCount, presentationCount) {
+        super(
+          `Multi-credential presentations are not yet supported: ${entryCount} queryId entries, ${presentationCount} presentations`
+        );
+        this.entryCount = entryCount;
+        this.presentationCount = presentationCount;
+      }
+    };
   }
 });
 
@@ -8045,6 +8086,135 @@ function createAuthorizationRequest(input, query) {
   };
 }
 
+// src/signed-authorization.ts
+init_errors();
+var DEFAULT_SUPPORTED_ENC_VALUES = ["A128GCM", "A256GCM"];
+var SUPPORTED_SIGNING_ALGS = /* @__PURE__ */ new Set(["ES256", "ES384", "RS256"]);
+async function createSignedAuthorizationRequest(input, query) {
+  if (input.certificateChain.length === 0) {
+    throw new exports.SignedRequestBuildError(
+      "empty_cert_chain",
+      "certificateChain must contain at least the leaf certificate"
+    );
+  }
+  const signingAlg = input.signingAlgorithm ?? "ES256";
+  if (!SUPPORTED_SIGNING_ALGS.has(signingAlg)) {
+    throw new exports.SignedRequestBuildError(
+      "unsupported_signing_alg",
+      `signingAlgorithm ${signingAlg} is not supported (expected ES256/ES384/RS256)`
+    );
+  }
+  if (!input.vpFormatsSupported || Object.keys(input.vpFormatsSupported).length === 0) {
+    throw new exports.SignedRequestBuildError(
+      "missing_vp_formats",
+      "vpFormatsSupported is required and must be non-empty"
+    );
+  }
+  const leafCert = new x509.X509Certificate(toArrayBuffer(input.certificateChain[0]));
+  const sanDnsNames = extractDnsNames(leafCert);
+  if (!sanDnsNames.includes(input.hostname)) {
+    throw new exports.SignedRequestBuildError(
+      "hostname_cert_mismatch",
+      `leaf cert SAN DNSName values [${sanDnsNames.join(", ")}] do not include hostname "${input.hostname}"`
+    );
+  }
+  const signerPublicSpki = new Uint8Array(
+    await crypto.subtle.exportKey("spki", input.signer.publicKey)
+  );
+  const leafSpki = new Uint8Array(leafCert.publicKey.rawData);
+  if (!bytesEqual(signerPublicSpki, leafSpki)) {
+    throw new exports.SignedRequestBuildError(
+      "signing_key_cert_mismatch",
+      "signer.publicKey SPKI does not match leaf certificate SPKI"
+    );
+  }
+  const responseMode = input.responseMode ?? "direct_post.jwt";
+  if (responseMode === "direct_post.jwt") {
+    if (!input.encryptionKey?.publicJwk) {
+      throw new exports.SignedRequestBuildError(
+        "missing_encryption_jwk",
+        "direct_post.jwt response mode requires encryptionKey.publicJwk"
+      );
+    }
+    if (!input.encryptionKey.publicJwk.alg) {
+      throw new exports.SignedRequestBuildError(
+        "missing_encryption_alg",
+        "encryptionKey.publicJwk must carry alg (OpenID4VP 1.0 \xA78.3)"
+      );
+    }
+  }
+  const state = input.state ?? uuid.v4();
+  const clientId = `x509_san_dns:${input.hostname}`;
+  const now = Math.floor(Date.now() / 1e3);
+  const clientMetadata = {
+    vp_formats_supported: input.vpFormatsSupported
+  };
+  if (responseMode === "direct_post.jwt" && input.encryptionKey) {
+    const enc = input.encryptionKey.supportedEncValues;
+    if (enc !== void 0 && enc.length === 0) {
+      throw new exports.SignedRequestBuildError(
+        "empty_supported_enc_values",
+        "encryptionKey.supportedEncValues must not be empty (omit to use defaults [A128GCM, A256GCM])"
+      );
+    }
+    const jwk = { ...input.encryptionKey.publicJwk, use: "enc" };
+    clientMetadata.jwks = { keys: [jwk] };
+    clientMetadata.encrypted_response_enc_values_supported = enc ?? [...DEFAULT_SUPPORTED_ENC_VALUES];
+  }
+  const payload = {
+    iss: clientId,
+    aud: "https://self-issued.me/v2",
+    response_type: "vp_token",
+    response_mode: responseMode,
+    client_id: clientId,
+    response_uri: input.responseUri,
+    nonce: input.nonce,
+    state,
+    dcql_query: query,
+    client_metadata: clientMetadata,
+    iat: now,
+    exp: now + 120
+  };
+  const x5c = input.certificateChain.map((der) => bytesToBase64(der));
+  const jws = await new jose.SignJWT(payload).setProtectedHeader({ typ: "oauth-authz-req+jwt", alg: signingAlg, x5c }).sign(input.signer.privateKey);
+  const uriParams = new URLSearchParams({
+    client_id: clientId,
+    request_uri: input.requestUri
+  });
+  return {
+    uri: `openid4vp://authorize?${uriParams.toString()}`,
+    requestObject: jws,
+    dcqlQuery: query,
+    nonce: input.nonce,
+    state
+  };
+}
+function extractDnsNames(cert) {
+  const SAN_OID = "2.5.29.17";
+  const ext = cert.extensions.find((e) => e.type === SAN_OID);
+  if (!ext) return [];
+  const names = ext.names;
+  const items = names?.items ?? [];
+  return items.filter((e) => e.type === "dns").map((e) => e.value);
+}
+function bytesEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}
+function bytesToBase64(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+  return btoa(s);
+}
+function toArrayBuffer(bytes) {
+  const out = new ArrayBuffer(bytes.byteLength);
+  new Uint8Array(out).set(bytes);
+  return out;
+}
+
 // src/haip.ts
 init_errors();
 var HAIP_DOCTYPE_NAMESPACES = {
@@ -8271,7 +8441,7 @@ async function computeItemDigest(itemBytes, digestAlgorithm) {
   const buf = await crypto.subtle.digest(digestAlgorithm, new Uint8Array(itemBytes));
   return new Uint8Array(buf);
 }
-function bytesEqual(a, b) {
+function bytesEqual2(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
     if (a[i] !== b[i]) return false;
@@ -8317,7 +8487,7 @@ async function verifyAllDigests(nameSpaces, mso) {
       if (!expectedDigest) {
         throw new exports.MalformedCredentialError(`digestID ${digestID} missing from MSO valueDigests[${ns}]`);
       }
-      if (!bytesEqual(hash, expectedDigest)) {
+      if (!bytesEqual2(hash, expectedDigest)) {
         throw new exports.MalformedCredentialError(`digest mismatch for ns=${ns} digestID=${digestID}`);
       }
     }
@@ -8436,7 +8606,7 @@ init_errors();
 var decoder4 = new cborX.Encoder({ mapsAsObjects: false, useRecords: false });
 var encoder = new cborX.Encoder({ mapsAsObjects: false, useRecords: false });
 var DEFAULT_ALLOWED_ALGORITHMS = ["ES256", "ES384", "ES512"];
-function bytesEqual2(a, b) {
+function bytesEqual3(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
     if (a[i] !== b[i]) return false;
@@ -8572,8 +8742,8 @@ var MdocParser = class {
         cache: options.cache,
         clockSkewTolerance: options.clockSkewTolerance
       });
-      const { X509Certificate: X509Certificate8 } = await import('@peculiar/x509');
-      const leaf = new X509Certificate8(issuerCertBytes);
+      const { X509Certificate: X509Certificate9 } = await import('@peculiar/x509');
+      const leaf = new X509Certificate9(issuerCertBytes);
       trustResult = await evaluator.evaluate(leaf);
     } else {
       if (options.trustedCertificates.length === 0) {
@@ -8583,7 +8753,7 @@ var MdocParser = class {
           );
         }
       } else {
-        const trusted = options.trustedCertificates.some((t) => bytesEqual2(t, issuerCertBytes));
+        const trusted = options.trustedCertificates.some((t) => bytesEqual3(t, issuerCertBytes));
         if (!trusted) {
           return {
             valid: false,
@@ -8698,7 +8868,7 @@ function base64ToBytes(base64) {
   }
   return bytes;
 }
-function bytesEqual3(a, b) {
+function bytesEqual4(a, b) {
   if (a.length !== b.length) return false;
   for (let i = 0; i < a.length; i++) {
     if (a[i] !== b[i]) return false;
@@ -8821,8 +8991,8 @@ var SdJwtParser = class {
         cache: options.cache,
         clockSkewTolerance: options.clockSkewTolerance
       });
-      const { X509Certificate: X509Certificate8 } = await import('@peculiar/x509');
-      const leaf = new X509Certificate8(issuerCertBytes);
+      const { X509Certificate: X509Certificate9 } = await import('@peculiar/x509');
+      const leaf = new X509Certificate9(issuerCertBytes);
       trustResult = await evaluator.evaluate(leaf);
     } else {
       if (options.trustedCertificates.length === 0) {
@@ -8832,7 +9002,7 @@ var SdJwtParser = class {
           );
         }
       } else {
-        const isTrusted = options.trustedCertificates.some((trusted) => bytesEqual3(trusted, issuerCertBytes));
+        const isTrusted = options.trustedCertificates.some((trusted) => bytesEqual4(trusted, issuerCertBytes));
         if (!isTrusted) {
           return invalidResult("Issuer certificate is not trusted");
         }
@@ -8929,6 +9099,44 @@ async function parsePresentation(vpToken, options) {
     error: "Unsupported credential format"
   };
 }
+
+// src/decrypt-response.ts
+init_errors();
+var SUPPORTED_ALG = "ECDH-ES";
+var SUPPORTED_ENC = /* @__PURE__ */ new Set(["A128GCM", "A256GCM"]);
+async function decryptAuthorizationResponse(jwe, privateKey) {
+  let header;
+  try {
+    header = jose.decodeProtectedHeader(jwe);
+  } catch (err) {
+    throw new exports.DecryptionFailedError("Malformed JWE header", {
+      cause: err
+    });
+  }
+  const alg = typeof header.alg === "string" ? header.alg : "";
+  const enc = typeof header.enc === "string" ? header.enc : "";
+  if (alg !== SUPPORTED_ALG || !SUPPORTED_ENC.has(enc)) {
+    throw new exports.UnsupportedJweError(alg, enc);
+  }
+  let plaintext;
+  try {
+    const result = await jose.compactDecrypt(jwe, privateKey);
+    plaintext = result.plaintext;
+  } catch (err) {
+    throw new exports.DecryptionFailedError(void 0, { cause: err });
+  }
+  try {
+    const text = new TextDecoder().decode(plaintext);
+    return JSON.parse(text);
+  } catch (err) {
+    throw new exports.DecryptionFailedError("Decrypted plaintext is not valid JSON", {
+      cause: err
+    });
+  }
+}
+
+// src/verify.ts
+init_errors();
 var INTERNAL_TO_DCQL_FORMAT = {
   "sd-jwt-vc": "dc+sd-jwt",
   mdoc: "mso_mdoc"
@@ -8960,6 +9168,48 @@ async function verifyPresentation(vpToken, query, options) {
     valid: parsed.valid && match.satisfied
   };
 }
+function isEncryptedResponse(x) {
+  return typeof x === "object" && x !== null && "response" in x && typeof x.response === "string" && Object.keys(x).length === 1;
+}
+function isAuthorizationResponse(x) {
+  return typeof x === "object" && x !== null && "vp_token" in x && typeof x.vp_token === "object" && x.vp_token !== null;
+}
+async function verifyAuthorizationResponse(envelope, query, options) {
+  if (isEncryptedResponse(envelope)) {
+    if (!options.decryptionKey) {
+      throw new exports.MissingDecryptionKeyError();
+    }
+    const decrypted = await decryptAuthorizationResponse(
+      envelope.response,
+      options.decryptionKey
+    );
+    return verifyAuthorizationResponse(decrypted, query, options);
+  }
+  if (!isAuthorizationResponse(envelope)) {
+    throw new TypeError("envelope must contain vp_token as a JSON object per OpenID4VP 1.0 \xA78.1");
+  }
+  const vpToken = envelope.vp_token;
+  const queryIds = Object.keys(vpToken);
+  if (queryIds.length === 0) {
+    throw new TypeError("vp_token cannot be empty per OpenID4VP 1.0 \xA78.1");
+  }
+  for (const id of queryIds) {
+    if (!Array.isArray(vpToken[id])) {
+      throw new TypeError(
+        `vp_token entry "${id}" must be an array of presentations per OpenID4VP 1.0 \xA78.1`
+      );
+    }
+  }
+  const presentationCount = queryIds.reduce(
+    (sum, id) => sum + vpToken[id].length,
+    0
+  );
+  if (queryIds.length > 1 || presentationCount > 1) {
+    throw new exports.MultipleCredentialsNotSupportedError(queryIds.length, presentationCount);
+  }
+  const presentation = vpToken[queryIds[0]][0];
+  return verifyPresentation(presentation, query, options);
+}
 
 // src/index.ts
 init_errors();
@@ -9571,7 +9821,7 @@ function equalBytes(a, b) {
 
 // src/index.ts
 init_errors();
-var VERSION = "0.5.0";
+var VERSION = "0.7.0";
 /*! Bundled license information:
 
 pvtsutils/build/index.es.js:
@@ -9659,9 +9909,12 @@ exports.StaticTrustStore = StaticTrustStore;
 exports.VERSION = VERSION;
 exports.buildHaipQuery = buildHaipQuery;
 exports.createAuthorizationRequest = createAuthorizationRequest;
+exports.createSignedAuthorizationRequest = createSignedAuthorizationRequest;
+exports.decryptAuthorizationResponse = decryptAuthorizationResponse;
 exports.isHaipQuery = isHaipQuery;
 exports.parsePresentation = parsePresentation;
 exports.validateHaipQuery = validateHaipQuery;
+exports.verifyAuthorizationResponse = verifyAuthorizationResponse;
 exports.verifyPresentation = verifyPresentation;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map