@openid4vc/oauth2 0.3.0-alpha-20250322171044 → 0.3.0-alpha-20250324183425

package/dist/index.mjs

@@ -237,7 +237,9 @@ var zJwtPayload = z5.object({
   jti: z5.string().optional(),
   cnf: zJwtConfirmationPayload.optional(),
   // Reserved for status parameters
-  status: z5.record(z5.string(), z5.any()).optional()
+  status: z5.record(z5.string(), z5.any()).optional(),
+  // Reserved for OpenID Federation
+  trust_chain: z5.array(z5.string()).nonempty().optional()
 }).passthrough();
 var zJwtHeader = z5.object({
   alg: zAlgValueNotNone,
@@ -245,7 +247,8 @@ var zJwtHeader = z5.object({
   kid: z5.string().optional(),
   jwk: zJwk.optional(),
   x5c: z5.array(z5.string()).optional(),
-  trust_chain: z5.array(z5.string()).optional()
+  // Reserved for OpenID Federation
+  trust_chain: z5.array(z5.string()).nonempty().optional()
 }).passthrough();
 
 // src/common/jwt/decode-jwt-header.ts
@@ -299,7 +302,7 @@ function jwtHeaderFromJwtSigner(signer) {
       kid: signer.didUrl
     };
   }
-  if (signer.method === "trustChain") {
+  if (signer.method === "federation") {
     return {
       alg: signer.alg,
       kid: signer.kid,
@@ -323,56 +326,101 @@ function jwtHeaderFromJwtSigner(signer) {
     alg: signer.alg
   };
 }
-function jwtSignerFromJwt({ header, payload }) {
+function jwtSignerFromJwt({
+  header,
+  payload,
+  allowedSignerMethods
+}) {
+  const found = [];
   if (header.x5c) {
-    return {
-      alg: header.alg,
+    found.push({
       method: "x5c",
-      x5c: header.x5c
-    };
+      valid: true,
+      signer: {
+        alg: header.alg,
+        method: "x5c",
+        x5c: header.x5c
+      }
+    });
   }
   if (header.trust_chain) {
     if (!header.kid) {
-      throw new Error(`When 'trust_chain' is used in jwt header, the 'kid' parameter is required.`);
+      found.push({
+        method: "federation",
+        valid: false,
+        error: `When 'trust_chain' is used in jwt header, the 'kid' parameter is required.`
+      });
+    } else {
+      found.push({
+        method: "federation",
+        valid: true,
+        signer: {
+          alg: header.alg,
+          trustChain: header.trust_chain,
+          kid: header.kid,
+          method: "federation"
+        }
+      });
     }
-    return {
-      method: "trustChain",
-      alg: header.alg,
-      trustChain: header.trust_chain,
-      kid: header.kid
-    };
   }
-  if (header.kid) {
-    if (header.kid.startsWith("did:")) {
-      if (payload.iss && header.kid.startsWith(payload.iss)) {
-      }
-      if (!header.kid.includes("#")) {
-      }
-      return {
+  if (header.kid?.startsWith("did:") || payload.iss?.startsWith("did:")) {
+    if (payload.iss && header.kid?.startsWith("did:") && !header.kid.startsWith(payload.iss)) {
+      found.push({
         method: "did",
-        didUrl: header.kid,
-        alg: header.alg
-      };
-    }
-    if (header.kid.startsWith("#") && payload.iss?.startsWith("did:")) {
-      return {
+        valid: false,
+        error: `kid in header starst with did that is different from did value in 'iss'`
+      });
+    } else if (!header.kid?.startsWith("did:") && !header.kid?.startsWith("#")) {
+      found.push({
         method: "did",
-        didUrl: `${payload.iss}${header.kid}`,
-        alg: header.alg
-      };
+        valid: false,
+        error: `kid in header must start with either 'did:' or '#' when 'iss' value is a did`
+      });
+    } else {
+      found.push({
+        method: "did",
+        valid: true,
+        signer: {
+          method: "did",
+          alg: header.alg,
+          didUrl: header.kid.startsWith("did:") ? header.kid : `${payload.iss}${header.kid}`
+        }
+      });
     }
   }
   if (header.jwk) {
-    return {
-      alg: header.alg,
+    found.push({
       method: "jwk",
-      publicJwk: header.jwk
+      signer: { alg: header.alg, method: "jwk", publicJwk: header.jwk },
+      valid: true
+    });
+  }
+  const allowedFoundMethods = found.filter((f) => !allowedSignerMethods || allowedSignerMethods?.includes(f.method));
+  const allowedValidMethods = allowedFoundMethods.filter((f) => f.valid);
+  if (allowedValidMethods.length > 0) {
+    return allowedValidMethods[0].signer;
+  }
+  if (allowedFoundMethods.length > 0) {
+    throw new Oauth2Error(
+      `Unable to extract signer method from jwt. Found ${allowedFoundMethods.length} allowed signer method(s) but contained invalid configuration:
+${allowedFoundMethods.map((m) => m.valid ? "" : `FAILED: method ${m.method} - ${m.error}`).join("\n")}`
+    );
+  }
+  if (found.length > 0) {
+    throw new Oauth2Error(
+      `Unable to extract signer method from jwt. Found ${found.length} signer method(s) that are not allowed:
+${found.map((m) => m.valid ? `SUCCEEDED: method ${m.method}` : `FAILED: method ${m.method} - ${m.error}`).join("\n")}`
+    );
+  }
+  if (!allowedSignerMethods || allowedSignerMethods.includes("custom")) {
+    return {
+      method: "custom",
+      alg: header.alg
     };
   }
-  return {
-    method: "custom",
-    alg: header.alg
-  };
+  throw new Oauth2Error(
+    `Unable to extract signer method from jwt. Found no signer methods and 'custom' signer method is not allowed.`
+  );
 }
 
 // src/common/jwt/z-jwe.ts