@openeudi/openid4vp 0.9.3 → 0.10.1

package/dist/index.d.cts

@@ -16,7 +16,8 @@ interface AuthorizationRequest {
     state: string;
 }
 interface SignedAuthorizationRequestInput {
-    hostname: string;
+    clientIdPrefix?: 'x509_san_dns' | 'x509_hash';
+    hostname?: string;
     requestUri: string;
     responseUri: string;
     nonce: string;
@@ -54,7 +55,10 @@ declare function createAuthorizationRequest(input: AuthorizationRequestInput, qu
  * carrying only `client_id` + `request_uri`, plus the JWS string the caller
  * must host at `requestUri` with Content-Type `application/oauth-authz-req+jwt`.
  *
- * Client Identifier Prefix is always `x509_san_dns` — other prefixes deferred.
+ * Client Identifier Prefix defaults to `x509_san_dns`; pass
+ * `clientIdPrefix: 'x509_hash'` to use the leaf certificate's SHA-256 hash
+ * instead (OpenID4VP 1.0 §5.9.3). `hostname` is required only for
+ * `x509_san_dns`.
  */
 declare function createSignedAuthorizationRequest(input: SignedAuthorizationRequestInput, query: DcqlQuery): Promise<SignedAuthorizationRequest>;
 
@@ -611,7 +615,7 @@ declare class LotlFetchError extends OpenID4VPError {
 declare class LotlSignatureError extends OpenID4VPError {
     readonly code: "lotl_signature_invalid";
 }
-type SignedRequestBuildErrorCode = 'empty_cert_chain' | 'hostname_cert_mismatch' | 'signing_key_cert_mismatch' | 'missing_encryption_jwk' | 'missing_encryption_alg' | 'missing_vp_formats' | 'unsupported_signing_alg' | 'empty_supported_enc_values';
+type SignedRequestBuildErrorCode = 'empty_cert_chain' | 'hostname_cert_mismatch' | 'signing_key_cert_mismatch' | 'missing_encryption_jwk' | 'missing_encryption_alg' | 'missing_vp_formats' | 'unsupported_signing_alg' | 'empty_supported_enc_values' | 'missing_hostname';
 declare class SignedRequestBuildError extends OpenID4VPError {
     readonly code: SignedRequestBuildErrorCode;
     constructor(code: SignedRequestBuildErrorCode, message: string);
@@ -680,6 +684,6 @@ declare class LotlTrustStore implements TrustStore {
     private refresh;
 }
 
-declare const VERSION = "0.9.3";
+declare const VERSION = "0.10.1";
 
 export { type AuthorizationRequest, type AuthorizationRequestInput, type AuthorizationResponse, type Cache, CertificateChainError, type ChainErrorReason, CompositeTrustStore, type CredentialClaims, type CredentialFormat, DecryptionFailedError, type EncryptedResponse, ExpiredCredentialError, type Fetcher, HAIP_DOCTYPE_NAMESPACES, type HaipQueryInput, type HaipValidationCode, HaipValidationError, type ICredentialParser, InMemoryCache, InvalidSignatureError, type IssuerInfo, type LotlAnchorMetadata, LotlFetchError, LotlSignatureError, LotlTrustStore, type LotlTrustStoreOptions, MalformedCredentialError, MdocParser, MissingDecryptionKeyError, MissingVerifierEncryptionKeyError, MultipleCredentialsNotSupportedError, NonceValidationError, OpenID4VPError, type ParseOptions, type PresentationResult, RevocationCheckFailedError, RevokedCertificateError, SdJwtParser, type SignedAuthorizationRequest, type SignedAuthorizationRequestInput, SignedRequestBuildError, type SignedRequestBuildErrorCode, StaticTrustStore, type TrustAnchor, TrustAnchorNotFoundError, type TrustStore, type TrustStoreHint, type TrustStoreInput, UnsupportedFormatError, UnsupportedJweError, VERSION, type VerifyAuthorizationResponseOptions, type VerifyOptions, type VerifyResult, buildHaipQuery, buildOid4vpSessionTranscript, buildOpenID4VPHandoverSessionTranscript, createAuthorizationRequest, createSignedAuthorizationRequest, decryptAuthorizationResponse, isHaipQuery, parsePresentation, validateHaipQuery, verifyAuthorizationResponse, verifyPresentation };

package/dist/index.d.ts

@@ -16,7 +16,8 @@ interface AuthorizationRequest {
     state: string;
 }
 interface SignedAuthorizationRequestInput {
-    hostname: string;
+    clientIdPrefix?: 'x509_san_dns' | 'x509_hash';
+    hostname?: string;
     requestUri: string;
     responseUri: string;
     nonce: string;
@@ -54,7 +55,10 @@ declare function createAuthorizationRequest(input: AuthorizationRequestInput, qu
  * carrying only `client_id` + `request_uri`, plus the JWS string the caller
  * must host at `requestUri` with Content-Type `application/oauth-authz-req+jwt`.
  *
- * Client Identifier Prefix is always `x509_san_dns` — other prefixes deferred.
+ * Client Identifier Prefix defaults to `x509_san_dns`; pass
+ * `clientIdPrefix: 'x509_hash'` to use the leaf certificate's SHA-256 hash
+ * instead (OpenID4VP 1.0 §5.9.3). `hostname` is required only for
+ * `x509_san_dns`.
  */
 declare function createSignedAuthorizationRequest(input: SignedAuthorizationRequestInput, query: DcqlQuery): Promise<SignedAuthorizationRequest>;
 
@@ -611,7 +615,7 @@ declare class LotlFetchError extends OpenID4VPError {
 declare class LotlSignatureError extends OpenID4VPError {
     readonly code: "lotl_signature_invalid";
 }
-type SignedRequestBuildErrorCode = 'empty_cert_chain' | 'hostname_cert_mismatch' | 'signing_key_cert_mismatch' | 'missing_encryption_jwk' | 'missing_encryption_alg' | 'missing_vp_formats' | 'unsupported_signing_alg' | 'empty_supported_enc_values';
+type SignedRequestBuildErrorCode = 'empty_cert_chain' | 'hostname_cert_mismatch' | 'signing_key_cert_mismatch' | 'missing_encryption_jwk' | 'missing_encryption_alg' | 'missing_vp_formats' | 'unsupported_signing_alg' | 'empty_supported_enc_values' | 'missing_hostname';
 declare class SignedRequestBuildError extends OpenID4VPError {
     readonly code: SignedRequestBuildErrorCode;
     constructor(code: SignedRequestBuildErrorCode, message: string);
@@ -680,6 +684,6 @@ declare class LotlTrustStore implements TrustStore {
     private refresh;
 }
 
-declare const VERSION = "0.9.3";
+declare const VERSION = "0.10.1";
 
 export { type AuthorizationRequest, type AuthorizationRequestInput, type AuthorizationResponse, type Cache, CertificateChainError, type ChainErrorReason, CompositeTrustStore, type CredentialClaims, type CredentialFormat, DecryptionFailedError, type EncryptedResponse, ExpiredCredentialError, type Fetcher, HAIP_DOCTYPE_NAMESPACES, type HaipQueryInput, type HaipValidationCode, HaipValidationError, type ICredentialParser, InMemoryCache, InvalidSignatureError, type IssuerInfo, type LotlAnchorMetadata, LotlFetchError, LotlSignatureError, LotlTrustStore, type LotlTrustStoreOptions, MalformedCredentialError, MdocParser, MissingDecryptionKeyError, MissingVerifierEncryptionKeyError, MultipleCredentialsNotSupportedError, NonceValidationError, OpenID4VPError, type ParseOptions, type PresentationResult, RevocationCheckFailedError, RevokedCertificateError, SdJwtParser, type SignedAuthorizationRequest, type SignedAuthorizationRequestInput, SignedRequestBuildError, type SignedRequestBuildErrorCode, StaticTrustStore, type TrustAnchor, TrustAnchorNotFoundError, type TrustStore, type TrustStoreHint, type TrustStoreInput, UnsupportedFormatError, UnsupportedJweError, VERSION, type VerifyAuthorizationResponseOptions, type VerifyOptions, type VerifyResult, buildHaipQuery, buildOid4vpSessionTranscript, buildOpenID4VPHandoverSessionTranscript, createAuthorizationRequest, createSignedAuthorizationRequest, decryptAuthorizationResponse, isHaipQuery, parsePresentation, validateHaipQuery, verifyAuthorizationResponse, verifyPresentation };

package/dist/index.js

@@ -8247,14 +8247,23 @@ async function createSignedAuthorizationRequest(input, query) {
       "vpFormatsSupported is required and must be non-empty"
     );
   }
+  const clientIdPrefix = input.clientIdPrefix ?? "x509_san_dns";
   const leafCert = new X509Certificate(toArrayBuffer(input.certificateChain[0]));
-  const sanDnsNames = extractDnsNames(leafCert);
-  if (!sanDnsNames.includes(input.hostname)) {
+  if (clientIdPrefix === "x509_san_dns" && !input.hostname) {
     throw new SignedRequestBuildError(
-      "hostname_cert_mismatch",
-      `leaf cert SAN DNSName values [${sanDnsNames.join(", ")}] do not include hostname "${input.hostname}"`
+      "missing_hostname",
+      'hostname is required for clientIdPrefix "x509_san_dns"'
     );
   }
+  if (input.hostname) {
+    const sanDnsNames = extractDnsNames(leafCert);
+    if (!sanDnsNames.includes(input.hostname)) {
+      throw new SignedRequestBuildError(
+        "hostname_cert_mismatch",
+        `leaf cert SAN DNSName values [${sanDnsNames.join(", ")}] do not include hostname "${input.hostname}"`
+      );
+    }
+  }
   const signerPublicSpki = new Uint8Array(
     await crypto.subtle.exportKey("spki", input.signer.publicKey)
   );
@@ -8281,7 +8290,7 @@ async function createSignedAuthorizationRequest(input, query) {
     }
   }
   const state = input.state ?? v4();
-  const clientId = `x509_san_dns:${input.hostname}`;
+  const clientId = clientIdPrefix === "x509_hash" ? `x509_hash:${await sha256Base64Url(input.certificateChain[0])}` : `x509_san_dns:${input.hostname}`;
   const now = Math.floor(Date.now() / 1e3);
   const clientMetadata = {
     vp_formats_supported: input.vpFormatsSupported
@@ -8298,8 +8307,6 @@ async function createSignedAuthorizationRequest(input, query) {
     clientMetadata.jwks = { keys: [jwk] };
     const encValues = enc3 ?? [...DEFAULT_SUPPORTED_ENC_VALUES];
     clientMetadata.encrypted_response_enc_values_supported = encValues;
-    clientMetadata.authorization_encrypted_response_alg = "ECDH-ES";
-    clientMetadata.authorization_encrypted_response_enc = encValues[0];
   }
   const payload = {
     iss: clientId,
@@ -8344,6 +8351,10 @@ function bytesEqual(a, b) {
   }
   return true;
 }
+async function sha256Base64Url(derCert) {
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", toArrayBuffer(derCert)));
+  return bytesToBase64(digest).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 function bytesToBase64(bytes) {
   let s = "";
   for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
@@ -9663,8 +9674,9 @@ async function verifyPresentation(vpToken, query, options) {
   const parsed = await parsePresentation(vpToken, options);
   const dcqlFormat = INTERNAL_TO_DCQL_FORMAT[parsed.format] ?? parsed.format;
   const decodedClaims = parsed.format === "mdoc" && parsed.namespacedClaims !== void 0 ? parsed.namespacedClaims : parsed.claims;
+  const presentedCredentialQuery = query.credentials.find((c) => c.format === dcqlFormat) ?? query.credentials[0];
   const decoded = {
-    id: query.credentials[0]?.id ?? "presented",
+    id: presentedCredentialQuery?.id ?? "presented",
     format: dcqlFormat,
     claims: decodedClaims
   };
@@ -9785,8 +9797,12 @@ async function verifyAuthorizationResponse(envelope, query, options) {
   if (queryIds.length > 1 || presentationCount > 1) {
     throw new MultipleCredentialsNotSupportedError(queryIds.length, presentationCount);
   }
-  const presentation = vpToken[queryIds[0]][0];
-  const decodedPresentation = query.credentials[0]?.format === "mso_mdoc" && typeof presentation === "string" ? base64UrlToBytes(presentation) : presentation;
+  const presentedQueryId = queryIds[0];
+  const presentation = vpToken[presentedQueryId][0];
+  const presentedCredentialQuery = query.credentials.find(
+    (c) => c.id === presentedQueryId
+  );
+  const decodedPresentation = presentedCredentialQuery?.format === "mso_mdoc" && typeof presentation === "string" ? base64UrlToBytes(presentation) : presentation;
   return verifyPresentation(decodedPresentation, query, options);
 }
 
@@ -10419,7 +10435,7 @@ function equalBytes(a, b) {
 
 // src/index.ts
 init_errors();
-var VERSION = "0.9.3";
+var VERSION = "0.10.1";
 /*! Bundled license information:
 
 pvtsutils/build/index.es.js: