@openeudi/openid4vp 0.8.0 → 0.8.1

package/dist/index.cjs

@@ -6382,6 +6382,33 @@ var init_es20152 = __esm({
     init_validity();
   }
 });
+function getSkiHex(cert) {
+  const ext = cert.getExtension(x509.SubjectKeyIdentifierExtension);
+  return ext ? ext.keyId.toLowerCase() : null;
+}
+function certificatesEqual(a, b) {
+  const ab = new Uint8Array(a.rawData);
+  const bb = new Uint8Array(b.rawData);
+  if (ab.length !== bb.length) return false;
+  for (let i = 0; i < ab.length; i++) {
+    if (ab[i] !== bb[i]) return false;
+  }
+  return true;
+}
+function getSkiBytes(cert) {
+  const ext = cert.getExtension(x509.SubjectKeyIdentifierExtension);
+  if (!ext) return null;
+  const hex = ext.keyId;
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+var init_x509_utils = __esm({
+  "src/trust/x509-utils.ts"() {
+  }
+});
 function mapX509AlgoToJwaName(cert) {
   const alg = cert.signatureAlgorithm;
   const name = alg?.name ?? "";
@@ -6391,8 +6418,11 @@ function mapX509AlgoToJwaName(cert) {
   if (name === "ECDSA" && hash === "SHA-512") return "ES512";
   if (name === "Ed25519" || name === "EdDSA") return "EdDSA";
   if (name === "RSASSA-PKCS1-v1_5" && hash === "SHA-256") return "RS256";
+  if (name === "RSASSA-PKCS1-v1_5" && hash === "SHA-384") return "RS384";
+  if (name === "RSASSA-PKCS1-v1_5" && hash === "SHA-512") return "RS512";
   if (name === "RSA-PSS" && hash === "SHA-256") return "PS256";
   if (name === "RSA-PSS" && hash === "SHA-384") return "PS384";
+  if (name === "RSA-PSS" && hash === "SHA-512") return "PS512";
   return `${name}-${hash}`;
 }
 function collectLeafNames(leaf) {
@@ -6485,8 +6515,20 @@ var init_ChainBuilder = __esm({
     init_es2015();
     init_es20152();
     init_errors();
+    init_x509_utils();
     NAME_CONSTRAINTS_OID = "2.5.29.30";
-    DEFAULT_ALGORITHMS = ["ES256", "ES384", "EdDSA", "RS256", "PS256"];
+    DEFAULT_ALGORITHMS = [
+      "ES256",
+      "ES384",
+      "ES512",
+      "EdDSA",
+      "RS256",
+      "RS384",
+      "RS512",
+      "PS256",
+      "PS384",
+      "PS512"
+    ];
     ChainBuilder = class {
       constructor(opts = {}) {
         this.opts = opts;
@@ -6545,6 +6587,12 @@ var init_ChainBuilder = __esm({
           current = issuer;
           nonLeafDepth += 1;
         }
+        if (!certificatesEqual(current, anchor)) {
+          throw new exports.CertificateChainError(
+            `certificate ${current.subject} shares the trust anchor's Subject DN but is not the anchor (no signature closure)`,
+            { reason: "signature" }
+          );
+        }
         this.checkNameConstraints(leaf, chain.slice(1));
         return chain;
       }
@@ -7785,7 +7833,10 @@ var init_RevocationChecker = __esm({
         if (hints.ocspUrl) {
           try {
             return await this.ocsp.checkCached(subjectCert, issuerCert, hints.ocspUrl, now);
-          } catch {
+          } catch (err) {
+            console.warn(
+              `[openid4vp] OCSP check failed for ${subjectCert.subject} via ${hints.ocspUrl}, falling back to CRL: ${err.message}`
+            );
           }
         }
         for (const url of hints.crlUrls) {
@@ -7813,6 +7864,9 @@ var init_RevocationChecker = __esm({
             return { status: "good", source: "crl", checkedAt: now };
           } catch (err) {
             if (err instanceof exports.RevocationCheckFailedError) throw err;
+            console.warn(
+              `[openid4vp] CRL check failed for ${subjectCert.subject} via ${url}: ${err.message}`
+            );
             continue;
           }
         }
@@ -7831,24 +7885,6 @@ var init_RevocationChecker = __esm({
     };
   }
 });
-function getSkiHex(cert) {
-  const ext = cert.getExtension(x509.SubjectKeyIdentifierExtension);
-  return ext ? ext.keyId.toLowerCase() : null;
-}
-function getSkiBytes(cert) {
-  const ext = cert.getExtension(x509.SubjectKeyIdentifierExtension);
-  if (!ext) return null;
-  const hex = ext.keyId;
-  const out = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < out.length; i++) {
-    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-  }
-  return out;
-}
-var init_x509_utils = __esm({
-  "src/trust/x509-utils.ts"() {
-  }
-});
 
 // src/trust/lotl-loa-mapping.ts
 function mapLoA(uris) {
@@ -8030,8 +8066,13 @@ var init_TrustEvaluator = __esm({
         );
         const terminusCert = chain[chain.length - 1];
         const anchor = anchors.find(
-          (a) => a.certificate.serialNumber === terminusCert.serialNumber
-        ) ?? anchors[0];
+          (a) => certificatesEqual(a.certificate, terminusCert)
+        );
+        if (!anchor) {
+          throw new exports.TrustAnchorNotFoundError(
+            `chain terminus ${terminusCert.subject} does not match any trust anchor certificate`
+          );
+        }
         const issuerForRevocation = chain.length > 1 ? chain[1] : terminusCert;
         const revocation = await this.revocationChecker.check(
           leaf,
@@ -8335,7 +8376,7 @@ function isHaipQuery(query) {
 
 // src/crypto/cose-sign1.ts
 init_errors();
-var decoder = new cborX.Encoder({ mapsAsObjects: false, useRecords: false });
+var decoder = new cborX.Encoder({ mapsAsObjects: false, useRecords: false, tagUint8Array: false });
 var HEADER_ALG = 1;
 var HEADER_X5CHAIN = 33;
 var COSE_ALG_TO_NAME = {