@openid4vc/oauth2 0.3.0-alpha-20250315153009 → 0.3.0-alpha-20250315172536

package/dist/index.mjs

@@ -462,7 +462,7 @@ ${JSON.stringify(errorResponse, null, 2)}`,
 };
 
 // src/metadata/authorization-server/authorization-server-metadata.ts
-import { joinUriParts } from "@openid4vc/utils";
+import { URL, joinUriParts } from "@openid4vc/utils";
 
 // src/metadata/fetch-well-known-metadata.ts
 import { ContentType, createZodFetcher } from "@openid4vc/utils";
@@ -610,7 +610,12 @@ var wellKnownAuthorizationServerSuffix = ".well-known/oauth-authorization-server
 var wellKnownOpenIdConfigurationServerSuffix = ".well-known/openid-configuration";
 async function fetchAuthorizationServerMetadata(issuer, fetch) {
   const openIdConfigurationWellKnownMetadataUrl = joinUriParts(issuer, [wellKnownOpenIdConfigurationServerSuffix]);
-  const authorizationServerWellKnownMetadataUrl = joinUriParts(issuer, [wellKnownAuthorizationServerSuffix]);
+  const parsedIssuerUrl = new URL(issuer);
+  const authorizationServerWellKnownMetadataUrl = joinUriParts(parsedIssuerUrl.origin, [
+    wellKnownAuthorizationServerSuffix,
+    parsedIssuerUrl.pathname
+  ]);
+  const nonCompliantAuthorizationServerWellKnownMetadataUrl = joinUriParts(issuer, [wellKnownAuthorizationServerSuffix]);
   const authorizationServerResult = await fetchWellKnownMetadata(
     authorizationServerWellKnownMetadataUrl,
     zAuthorizationServerMetadata,
@@ -624,6 +629,19 @@ async function fetchAuthorizationServerMetadata(issuer, fetch) {
     }
     return authorizationServerResult;
   }
+  const alternativeAuthorizationServerResult = await fetchWellKnownMetadata(
+    nonCompliantAuthorizationServerWellKnownMetadataUrl,
+    zAuthorizationServerMetadata,
+    fetch
+  );
+  if (alternativeAuthorizationServerResult) {
+    if (alternativeAuthorizationServerResult.issuer !== issuer) {
+      throw new Oauth2Error(
+        `The 'issuer' parameter '${alternativeAuthorizationServerResult.issuer}' in the well known authorization server metadata at '${nonCompliantAuthorizationServerWellKnownMetadataUrl}' does not match the provided issuer '${issuer}'.`
+      );
+    }
+    return alternativeAuthorizationServerResult;
+  }
   const openIdConfigurationResult = await fetchWellKnownMetadata(
     openIdConfigurationWellKnownMetadataUrl,
     zAuthorizationServerMetadata,
@@ -796,7 +814,7 @@ import { defaultFetcher } from "@openid4vc/utils";
 
 // src/dpop/dpop.ts
 import {
-  URL,
+  URL as URL2,
   dateToSeconds as dateToSeconds2,
   decodeUtf8String as decodeUtf8String2,
   encodeToBase64Url as encodeToBase64Url2,
@@ -925,7 +943,7 @@ async function verifyDpopJwt(options) {
   };
 }
 function htuFromRequestUrl(requestUrl) {
-  const htu = new URL(requestUrl);
+  const htu = new URL2(requestUrl);
   htu.search = "";
   htu.hash = "";
   return htu.toString();