@openid4vc/openid4vci 0.3.0-alpha-20251001121503 → 0.3.0-alpha-20251017092354
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.mts +44480 -47059
- package/dist/index.d.ts +44479 -47058
- package/dist/index.js +1819 -2450
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +1778 -2451
- package/dist/index.mjs.map +1 -1
- package/package.json +6 -6
package/dist/index.js
CHANGED
|
@@ -1,2642 +1,2011 @@
|
|
|
1
|
-
|
|
1
|
+
//#region rolldown:runtime
|
|
2
2
|
var __create = Object.create;
|
|
3
3
|
var __defProp = Object.defineProperty;
|
|
4
4
|
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
|
|
5
5
|
var __getOwnPropNames = Object.getOwnPropertyNames;
|
|
6
6
|
var __getProtoOf = Object.getPrototypeOf;
|
|
7
7
|
var __hasOwnProp = Object.prototype.hasOwnProperty;
|
|
8
|
-
var __export = (target, all) => {
|
|
9
|
-
for (var name in all)
|
|
10
|
-
__defProp(target, name, { get: all[name], enumerable: true });
|
|
11
|
-
};
|
|
12
8
|
var __copyProps = (to, from, except, desc) => {
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
9
|
+
if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
|
|
10
|
+
key = keys[i];
|
|
11
|
+
if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
|
|
12
|
+
get: ((k) => from[k]).bind(null, key),
|
|
13
|
+
enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
|
|
14
|
+
});
|
|
15
|
+
}
|
|
16
|
+
return to;
|
|
19
17
|
};
|
|
20
|
-
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
// "default" to the CommonJS "module.exports" for node compatibility.
|
|
25
|
-
isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
|
|
26
|
-
mod
|
|
27
|
-
));
|
|
28
|
-
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
|
|
18
|
+
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
|
|
19
|
+
value: mod,
|
|
20
|
+
enumerable: true
|
|
21
|
+
}) : target, mod));
|
|
29
22
|
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
Openid4vciIssuer: () => Openid4vciIssuer,
|
|
38
|
-
Openid4vciRetrieveCredentialsError: () => Openid4vciRetrieveCredentialsError,
|
|
39
|
-
Openid4vciSendNotificationError: () => Openid4vciSendNotificationError,
|
|
40
|
-
Openid4vciWalletProvider: () => Openid4vciWalletProvider,
|
|
41
|
-
createKeyAttestationJwt: () => createKeyAttestationJwt,
|
|
42
|
-
credentialsSupportedToCredentialConfigurationsSupported: () => credentialsSupportedToCredentialConfigurationsSupported,
|
|
43
|
-
determineAuthorizationServerForCredentialOffer: () => determineAuthorizationServerForCredentialOffer,
|
|
44
|
-
extractScopesForCredentialConfigurationIds: () => extractScopesForCredentialConfigurationIds,
|
|
45
|
-
getCredentialConfigurationsMatchingRequestFormat: () => getCredentialConfigurationsMatchingRequestFormat,
|
|
46
|
-
getGlobalConfig: () => import_utils22.getGlobalConfig,
|
|
47
|
-
parseKeyAttestationJwt: () => parseKeyAttestationJwt,
|
|
48
|
-
setGlobalConfig: () => import_utils22.setGlobalConfig,
|
|
49
|
-
verifyKeyAttestationJwt: () => verifyKeyAttestationJwt
|
|
50
|
-
});
|
|
51
|
-
module.exports = __toCommonJS(index_exports);
|
|
23
|
+
//#endregion
|
|
24
|
+
let __openid4vc_utils = require("@openid4vc/utils");
|
|
25
|
+
__openid4vc_utils = __toESM(__openid4vc_utils);
|
|
26
|
+
let __openid4vc_oauth2 = require("@openid4vc/oauth2");
|
|
27
|
+
__openid4vc_oauth2 = __toESM(__openid4vc_oauth2);
|
|
28
|
+
let zod = require("zod");
|
|
29
|
+
zod = __toESM(zod);
|
|
52
30
|
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
31
|
+
//#region src/version.ts
|
|
32
|
+
let Openid4vciDraftVersion = /* @__PURE__ */ function(Openid4vciDraftVersion$1) {
|
|
33
|
+
Openid4vciDraftVersion$1["Draft16"] = "Draft16";
|
|
34
|
+
Openid4vciDraftVersion$1["Draft15"] = "Draft15";
|
|
35
|
+
Openid4vciDraftVersion$1["Draft14"] = "Draft14";
|
|
36
|
+
Openid4vciDraftVersion$1["Draft11"] = "Draft11";
|
|
37
|
+
return Openid4vciDraftVersion$1;
|
|
38
|
+
}({});
|
|
56
39
|
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
return Openid4vciDraftVersion2;
|
|
64
|
-
})(Openid4vciDraftVersion || {});
|
|
65
|
-
|
|
66
|
-
// src/credential-offer/z-credential-offer.ts
|
|
67
|
-
var import_oauth2 = require("@openid4vc/oauth2");
|
|
68
|
-
var import_utils = require("@openid4vc/utils");
|
|
69
|
-
var import_zod = __toESM(require("zod"));
|
|
70
|
-
var zTxCode = import_zod.default.object({
|
|
71
|
-
input_mode: import_zod.default.union([import_zod.default.literal("numeric"), import_zod.default.literal("text")]).optional(),
|
|
72
|
-
length: import_zod.default.number().int().optional(),
|
|
73
|
-
description: import_zod.default.string().max(300).optional()
|
|
40
|
+
//#endregion
|
|
41
|
+
//#region src/credential-offer/z-credential-offer.ts
|
|
42
|
+
const zTxCode = zod.default.object({
|
|
43
|
+
input_mode: zod.default.union([zod.default.literal("numeric"), zod.default.literal("text")]).optional(),
|
|
44
|
+
length: zod.default.number().int().optional(),
|
|
45
|
+
description: zod.default.string().max(300).optional()
|
|
74
46
|
}).passthrough();
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
47
|
+
const zCredentialOfferGrants = zod.default.object({
|
|
48
|
+
authorization_code: zod.default.object({
|
|
49
|
+
issuer_state: zod.default.string().optional(),
|
|
50
|
+
authorization_server: __openid4vc_utils.zHttpsUrl.optional()
|
|
51
|
+
}).passthrough().optional(),
|
|
52
|
+
[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier]: zod.default.object({
|
|
53
|
+
"pre-authorized_code": zod.default.string(),
|
|
54
|
+
tx_code: zTxCode.optional(),
|
|
55
|
+
authorization_server: __openid4vc_utils.zHttpsUrl.optional()
|
|
56
|
+
}).passthrough().optional()
|
|
85
57
|
}).passthrough();
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
58
|
+
const zCredentialOfferObjectDraft14 = zod.default.object({
|
|
59
|
+
credential_issuer: __openid4vc_utils.zHttpsUrl,
|
|
60
|
+
credential_configuration_ids: zod.default.array(zod.default.string()),
|
|
61
|
+
grants: zod.default.optional(zCredentialOfferGrants)
|
|
90
62
|
}).passthrough();
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
const { user_pin_required, ...restGrants } = grants[import_oauth2.preAuthorizedCodeGrantIdentifier];
|
|
116
|
-
v14.grants[import_oauth2.preAuthorizedCodeGrantIdentifier] = {
|
|
117
|
-
...restGrants
|
|
118
|
-
};
|
|
119
|
-
if (user_pin_required) {
|
|
120
|
-
v14.grants[import_oauth2.preAuthorizedCodeGrantIdentifier].tx_code = {
|
|
121
|
-
input_mode: "text"
|
|
122
|
-
};
|
|
123
|
-
}
|
|
124
|
-
}
|
|
125
|
-
}
|
|
126
|
-
return v14;
|
|
63
|
+
const zCredentialOfferObjectDraft11To14 = zod.default.object({
|
|
64
|
+
credential_issuer: __openid4vc_utils.zHttpsUrl,
|
|
65
|
+
credentials: zod.default.array(zod.default.string({ message: "Only string credential identifiers are supported for draft 11 credential offers" })),
|
|
66
|
+
grants: zod.default.optional(zod.default.object({
|
|
67
|
+
authorization_code: zCredentialOfferGrants.shape.authorization_code,
|
|
68
|
+
[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier]: zod.default.object({
|
|
69
|
+
"pre-authorized_code": zod.default.string(),
|
|
70
|
+
user_pin_required: zod.default.optional(zod.default.boolean())
|
|
71
|
+
}).passthrough().optional()
|
|
72
|
+
}))
|
|
73
|
+
}).passthrough().transform(({ credentials, grants,...rest }) => {
|
|
74
|
+
const v14 = {
|
|
75
|
+
...rest,
|
|
76
|
+
credential_configuration_ids: credentials
|
|
77
|
+
};
|
|
78
|
+
if (grants) {
|
|
79
|
+
v14.grants = { ...grants };
|
|
80
|
+
if (grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier]) {
|
|
81
|
+
const { user_pin_required,...restGrants } = grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier];
|
|
82
|
+
v14.grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier] = { ...restGrants };
|
|
83
|
+
if (user_pin_required) v14.grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier].tx_code = { input_mode: "text" };
|
|
84
|
+
}
|
|
85
|
+
}
|
|
86
|
+
return v14;
|
|
127
87
|
}).pipe(zCredentialOfferObjectDraft14);
|
|
128
|
-
|
|
129
|
-
// First prioritize draft 14 (and 13)
|
|
130
|
-
zCredentialOfferObjectDraft14,
|
|
131
|
-
// Then try parsing draft 11 and transform into draft 14
|
|
132
|
-
zCredentialOfferObjectDraft11To14
|
|
133
|
-
]);
|
|
88
|
+
const zCredentialOfferObject = zod.default.union([zCredentialOfferObjectDraft14, zCredentialOfferObjectDraft11To14]);
|
|
134
89
|
|
|
135
|
-
|
|
90
|
+
//#endregion
|
|
91
|
+
//#region src/credential-offer/credential-offer.ts
|
|
92
|
+
/**
|
|
93
|
+
* Resolve a credential offer, optionally fetching it if the credential_offer_uri is provided.
|
|
94
|
+
*/
|
|
136
95
|
async function resolveCredentialOffer(credentialOffer, options) {
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
} else if (parsedQueryParams.credential_offer) {
|
|
155
|
-
let credentialOfferJson;
|
|
156
|
-
try {
|
|
157
|
-
credentialOfferJson = JSON.parse(decodeURIComponent(parsedQueryParams.credential_offer));
|
|
158
|
-
} catch (error) {
|
|
159
|
-
throw new import_oauth22.Oauth2Error(`Error parsing JSON from 'credential_offer' param in credential offer '${credentialOffer}'`);
|
|
160
|
-
}
|
|
161
|
-
credentialOfferParseResult = zCredentialOfferObject.safeParse(credentialOfferJson);
|
|
162
|
-
} else {
|
|
163
|
-
throw new import_oauth22.Oauth2Error(`Credential offer did not contain either 'credential_offer' or 'credential_offer_uri' param.`);
|
|
164
|
-
}
|
|
165
|
-
if (credentialOfferParseResult.error) {
|
|
166
|
-
throw new import_utils2.ValidationError(
|
|
167
|
-
`Error parsing credential offer in draft 11, 13 or 14 format extracted from credential offer '${credentialOffer}'`,
|
|
168
|
-
credentialOfferParseResult.error
|
|
169
|
-
);
|
|
170
|
-
}
|
|
171
|
-
return credentialOfferParseResult.data;
|
|
96
|
+
const parsedQueryParams = (0, __openid4vc_utils.getQueryParams)(credentialOffer);
|
|
97
|
+
let credentialOfferParseResult;
|
|
98
|
+
if (parsedQueryParams.credential_offer_uri) {
|
|
99
|
+
const { response, result } = await (0, __openid4vc_utils.createZodFetcher)(options?.fetch)(zCredentialOfferObject, __openid4vc_utils.ContentType.Json, parsedQueryParams.credential_offer_uri);
|
|
100
|
+
if (!response.ok || !result) throw new __openid4vc_oauth2.InvalidFetchResponseError(`Fetching credential offer from '${parsedQueryParams.credential_offer_uri}' resulted in an unsuccessful response with status '${response.status}'`, await response.clone().text(), response);
|
|
101
|
+
credentialOfferParseResult = result;
|
|
102
|
+
} else if (parsedQueryParams.credential_offer) {
|
|
103
|
+
let credentialOfferJson;
|
|
104
|
+
try {
|
|
105
|
+
credentialOfferJson = JSON.parse(decodeURIComponent(parsedQueryParams.credential_offer));
|
|
106
|
+
} catch (_error) {
|
|
107
|
+
throw new __openid4vc_oauth2.Oauth2Error(`Error parsing JSON from 'credential_offer' param in credential offer '${credentialOffer}'`);
|
|
108
|
+
}
|
|
109
|
+
credentialOfferParseResult = zCredentialOfferObject.safeParse(credentialOfferJson);
|
|
110
|
+
} else throw new __openid4vc_oauth2.Oauth2Error(`Credential offer did not contain either 'credential_offer' or 'credential_offer_uri' param.`);
|
|
111
|
+
if (credentialOfferParseResult.error) throw new __openid4vc_utils.ValidationError(`Error parsing credential offer in draft 11, 13 or 14 format extracted from credential offer '${credentialOffer}'`, credentialOfferParseResult.error);
|
|
112
|
+
return credentialOfferParseResult.data;
|
|
172
113
|
}
|
|
173
114
|
function determineAuthorizationServerForCredentialOffer(options) {
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
}
|
|
188
|
-
} else if (!authorizationServers) {
|
|
189
|
-
authorizationServer = options.issuerMetadata.credentialIssuer.credential_issuer;
|
|
190
|
-
} else {
|
|
191
|
-
if (authorizationServers.length === 0) {
|
|
192
|
-
throw new import_oauth22.Oauth2Error(`Credential issuer metadata has 'authorization_servers' value with length of 0`);
|
|
193
|
-
}
|
|
194
|
-
if (authorizationServers.length > 1) {
|
|
195
|
-
throw new import_oauth22.Oauth2Error(
|
|
196
|
-
`Credential issuer metadata has 'authorization_server' with multiple entries, but the credential offer grant did not specify which authorization server to use.`
|
|
197
|
-
);
|
|
198
|
-
}
|
|
199
|
-
authorizationServer = authorizationServers[0];
|
|
200
|
-
}
|
|
201
|
-
return authorizationServer;
|
|
115
|
+
const authorizationServers = options.issuerMetadata.credentialIssuer.authorization_servers;
|
|
116
|
+
let authorizationServer;
|
|
117
|
+
if (options.grantAuthorizationServer) {
|
|
118
|
+
authorizationServer = options.grantAuthorizationServer;
|
|
119
|
+
if (!authorizationServers) throw new __openid4vc_oauth2.Oauth2Error(`Credential offer grant contains 'authorization_server' with value '${options.grantAuthorizationServer}' but credential issuer metadata does not have an 'authorization_servers' property to match the value against.`);
|
|
120
|
+
if (!authorizationServers.includes(authorizationServer)) throw new __openid4vc_oauth2.Oauth2Error(`Credential offer grant contains 'authorization_server' with value '${options.grantAuthorizationServer}' but credential issuer metadata does not include this authorization server. Available 'authorization_server' values are ${authorizationServers.join(", ")}.`);
|
|
121
|
+
} else if (!authorizationServers) authorizationServer = options.issuerMetadata.credentialIssuer.credential_issuer;
|
|
122
|
+
else {
|
|
123
|
+
if (authorizationServers.length === 0) throw new __openid4vc_oauth2.Oauth2Error(`Credential issuer metadata has 'authorization_servers' value with length of 0`);
|
|
124
|
+
if (authorizationServers.length > 1) throw new __openid4vc_oauth2.Oauth2Error(`Credential issuer metadata has 'authorization_server' with multiple entries, but the credential offer grant did not specify which authorization server to use.`);
|
|
125
|
+
authorizationServer = authorizationServers[0];
|
|
126
|
+
}
|
|
127
|
+
return authorizationServer;
|
|
202
128
|
}
|
|
203
129
|
async function createCredentialOffer(options) {
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
214
|
-
|
|
215
|
-
|
|
216
|
-
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
|
|
224
|
-
|
|
225
|
-
|
|
226
|
-
|
|
227
|
-
|
|
228
|
-
|
|
229
|
-
|
|
230
|
-
|
|
231
|
-
|
|
232
|
-
|
|
233
|
-
|
|
234
|
-
|
|
235
|
-
|
|
236
|
-
|
|
237
|
-
|
|
238
|
-
|
|
239
|
-
|
|
240
|
-
|
|
241
|
-
|
|
242
|
-
|
|
243
|
-
|
|
244
|
-
...options.additionalPayload
|
|
245
|
-
});
|
|
246
|
-
if (options.issuerMetadata.originalDraftVersion === "Draft11" /* Draft11 */) {
|
|
247
|
-
credentialOfferObject.credentials = credentialOfferObject.credential_configuration_ids;
|
|
248
|
-
}
|
|
249
|
-
const url = new import_utils2.URL(credentialOfferScheme);
|
|
250
|
-
url.search = `?${new import_utils2.URLSearchParams([
|
|
251
|
-
...url.searchParams.entries(),
|
|
252
|
-
...(0, import_utils2.objectToQueryParams)({
|
|
253
|
-
credential_offer_uri: options.credentialOfferUri,
|
|
254
|
-
// Only add credential_offer is uri is undefined
|
|
255
|
-
credential_offer: options.credentialOfferUri ? void 0 : credentialOfferObject
|
|
256
|
-
}).entries()
|
|
257
|
-
]).toString()}`;
|
|
258
|
-
return {
|
|
259
|
-
credentialOffer: url.toString(),
|
|
260
|
-
credentialOfferObject
|
|
261
|
-
};
|
|
130
|
+
const { [__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier]: preAuthorizedCodeGrant, [__openid4vc_oauth2.authorizationCodeGrantIdentifier]: authorizationCodeGrant,...restGrants } = options.grants;
|
|
131
|
+
const grants = { ...restGrants };
|
|
132
|
+
if (authorizationCodeGrant) {
|
|
133
|
+
determineAuthorizationServerForCredentialOffer({
|
|
134
|
+
issuerMetadata: options.issuerMetadata,
|
|
135
|
+
grantAuthorizationServer: authorizationCodeGrant.authorization_server
|
|
136
|
+
});
|
|
137
|
+
grants[__openid4vc_oauth2.authorizationCodeGrantIdentifier] = authorizationCodeGrant;
|
|
138
|
+
}
|
|
139
|
+
if (preAuthorizedCodeGrant) {
|
|
140
|
+
determineAuthorizationServerForCredentialOffer({
|
|
141
|
+
issuerMetadata: options.issuerMetadata,
|
|
142
|
+
grantAuthorizationServer: preAuthorizedCodeGrant.authorization_server
|
|
143
|
+
});
|
|
144
|
+
grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier] = {
|
|
145
|
+
...preAuthorizedCodeGrant,
|
|
146
|
+
"pre-authorized_code": preAuthorizedCodeGrant["pre-authorized_code"] ?? (0, __openid4vc_utils.encodeToBase64Url)(await options.callbacks.generateRandom(32))
|
|
147
|
+
};
|
|
148
|
+
const txCode = grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier].tx_code;
|
|
149
|
+
if (txCode && options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft11) grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier].user_pin_required = txCode !== void 0;
|
|
150
|
+
}
|
|
151
|
+
const idsNotInMetadata = options.credentialConfigurationIds.filter((id) => options.issuerMetadata.credentialIssuer.credential_configurations_supported[id] === void 0);
|
|
152
|
+
if (idsNotInMetadata.length > 0) throw new __openid4vc_oauth2.Oauth2Error(`Credential configuration ids ${idsNotInMetadata} not found in the credential issuer metadata 'credential_configurations_supported'. Available ids are ${Object.keys(options.issuerMetadata.credentialIssuer.credential_configurations_supported).join(", ")}.`);
|
|
153
|
+
const credentialOfferScheme = options.credentialOfferScheme ?? "openid-credential-offer://";
|
|
154
|
+
const credentialOfferObject = (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialOfferObject, {
|
|
155
|
+
credential_issuer: options.issuerMetadata.credentialIssuer.credential_issuer,
|
|
156
|
+
credential_configuration_ids: options.credentialConfigurationIds,
|
|
157
|
+
grants,
|
|
158
|
+
...options.additionalPayload
|
|
159
|
+
});
|
|
160
|
+
if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft11) credentialOfferObject.credentials = credentialOfferObject.credential_configuration_ids;
|
|
161
|
+
const url = new __openid4vc_utils.URL(credentialOfferScheme);
|
|
162
|
+
url.search = `?${new __openid4vc_utils.URLSearchParams([...url.searchParams.entries(), ...(0, __openid4vc_utils.objectToQueryParams)({
|
|
163
|
+
credential_offer_uri: options.credentialOfferUri,
|
|
164
|
+
credential_offer: options.credentialOfferUri ? void 0 : credentialOfferObject
|
|
165
|
+
}).entries()]).toString()}`;
|
|
166
|
+
return {
|
|
167
|
+
credentialOffer: url.toString(),
|
|
168
|
+
credentialOfferObject
|
|
169
|
+
};
|
|
262
170
|
}
|
|
263
171
|
|
|
264
|
-
|
|
265
|
-
|
|
266
|
-
|
|
267
|
-
|
|
268
|
-
|
|
269
|
-
|
|
270
|
-
|
|
271
|
-
|
|
272
|
-
|
|
273
|
-
|
|
274
|
-
// src/metadata/credential-issuer/z-credential-issuer-metadata.ts
|
|
275
|
-
var import_oauth24 = require("@openid4vc/oauth2");
|
|
276
|
-
var import_utils4 = require("@openid4vc/utils");
|
|
277
|
-
var import_zod13 = __toESM(require("zod"));
|
|
278
|
-
|
|
279
|
-
// src/formats/credential/mso-mdoc/z-mso-mdoc.ts
|
|
280
|
-
var import_zod5 = __toESM(require("zod"));
|
|
281
|
-
|
|
282
|
-
// src/metadata/credential-issuer/z-claims-description.ts
|
|
283
|
-
var import_zod2 = __toESM(require("zod"));
|
|
284
|
-
var zCredentialConfigurationSupportedClaimsDescriptionDraft14 = import_zod2.default.object({
|
|
285
|
-
mandatory: import_zod2.default.boolean().optional(),
|
|
286
|
-
value_type: import_zod2.default.string().optional(),
|
|
287
|
-
display: import_zod2.default.array(
|
|
288
|
-
import_zod2.default.object({
|
|
289
|
-
name: import_zod2.default.string().optional(),
|
|
290
|
-
locale: import_zod2.default.string().optional()
|
|
291
|
-
}).passthrough()
|
|
292
|
-
).optional()
|
|
172
|
+
//#endregion
|
|
173
|
+
//#region src/metadata/credential-issuer/z-claims-description.ts
|
|
174
|
+
const zCredentialConfigurationSupportedClaimsDescriptionDraft14 = zod.default.object({
|
|
175
|
+
mandatory: zod.default.boolean().optional(),
|
|
176
|
+
value_type: zod.default.string().optional(),
|
|
177
|
+
display: zod.default.array(zod.default.object({
|
|
178
|
+
name: zod.default.string().optional(),
|
|
179
|
+
locale: zod.default.string().optional()
|
|
180
|
+
}).passthrough()).optional()
|
|
293
181
|
}).passthrough();
|
|
294
|
-
|
|
295
|
-
|
|
296
|
-
|
|
297
|
-
|
|
298
|
-
|
|
299
|
-
|
|
300
|
-
);
|
|
301
|
-
|
|
302
|
-
|
|
303
|
-
|
|
304
|
-
|
|
305
|
-
|
|
306
|
-
|
|
307
|
-
|
|
308
|
-
display: import_zod2.default.array(
|
|
309
|
-
import_zod2.default.object({
|
|
310
|
-
name: import_zod2.default.string().optional(),
|
|
311
|
-
locale: import_zod2.default.string().optional()
|
|
312
|
-
}).passthrough()
|
|
313
|
-
).optional()
|
|
182
|
+
const zCredentialConfigurationSupportedClaimsDraft14 = zod.default.record(zod.default.string(), zod.default.union([zCredentialConfigurationSupportedClaimsDescriptionDraft14, zod.default.lazy(() => zCredentialConfigurationSupportedClaimsDraft14)]));
|
|
183
|
+
const zClaimsDescriptionPath = zod.default.array(zod.default.union([
|
|
184
|
+
zod.default.string(),
|
|
185
|
+
zod.default.number().int().nonnegative(),
|
|
186
|
+
zod.default.null()
|
|
187
|
+
])).nonempty();
|
|
188
|
+
const zMsoMdocClaimsDescriptionPath = zod.default.tuple([zod.default.string(), zod.default.string()], { message: "mso_mdoc claims description path MUST be an array with exactly two string elements, pointing to the namespace and element identifier within an mdoc credential" });
|
|
189
|
+
const zIssuerMetadataClaimsDescription = zod.default.object({
|
|
190
|
+
path: zClaimsDescriptionPath,
|
|
191
|
+
mandatory: zod.default.boolean().optional(),
|
|
192
|
+
display: zod.default.array(zod.default.object({
|
|
193
|
+
name: zod.default.string().optional(),
|
|
194
|
+
locale: zod.default.string().optional()
|
|
195
|
+
}).passthrough()).optional()
|
|
314
196
|
}).passthrough();
|
|
315
|
-
|
|
316
|
-
path: zMsoMdocClaimsDescriptionPath
|
|
317
|
-
});
|
|
318
|
-
|
|
319
|
-
// src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
|
|
320
|
-
var import_zod4 = __toESM(require("zod"));
|
|
197
|
+
const zMsoMdocIssuerMetadataClaimsDescription = zIssuerMetadataClaimsDescription.extend({ path: zMsoMdocClaimsDescriptionPath });
|
|
321
198
|
|
|
322
|
-
|
|
323
|
-
|
|
324
|
-
|
|
325
|
-
|
|
326
|
-
|
|
327
|
-
|
|
328
|
-
|
|
329
|
-
|
|
330
|
-
|
|
331
|
-
|
|
332
|
-
|
|
333
|
-
|
|
334
|
-
|
|
335
|
-
|
|
336
|
-
|
|
337
|
-
|
|
338
|
-
|
|
339
|
-
|
|
340
|
-
|
|
341
|
-
|
|
342
|
-
attested_keys: import_zod3.default.array(import_oauth23.zJwk),
|
|
343
|
-
key_storage: import_zod3.default.optional(zIso18045OrStringArray),
|
|
344
|
-
user_authentication: import_zod3.default.optional(zIso18045OrStringArray),
|
|
345
|
-
certification: import_zod3.default.optional(import_zod3.default.string().url())
|
|
199
|
+
//#endregion
|
|
200
|
+
//#region src/key-attestation/z-key-attestation.ts
|
|
201
|
+
const zKeyAttestationJwtHeader = zod.default.object({
|
|
202
|
+
...__openid4vc_oauth2.zJwtHeader.shape,
|
|
203
|
+
typ: zod.default.literal("keyattestation+jwt").or(zod.default.literal("key-attestation+jwt"))
|
|
204
|
+
}).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, { message: `Both 'jwk' and 'kid' are defined. Only one is allowed` }).refine(({ trust_chain, kid }) => !trust_chain || !kid, { message: `When 'trust_chain' is provided, 'kid' is required` });
|
|
205
|
+
const zIso18045 = zod.default.enum([
|
|
206
|
+
"iso_18045_high",
|
|
207
|
+
"iso_18045_moderate",
|
|
208
|
+
"iso_18045_enhanced-basic",
|
|
209
|
+
"iso_18045_basic"
|
|
210
|
+
]);
|
|
211
|
+
const zIso18045OrStringArray = zod.default.array(zod.default.union([zIso18045, zod.default.string()]));
|
|
212
|
+
const zKeyAttestationJwtPayload = zod.default.object({
|
|
213
|
+
...__openid4vc_oauth2.zJwtPayload.shape,
|
|
214
|
+
iat: __openid4vc_utils.zInteger,
|
|
215
|
+
attested_keys: zod.default.array(__openid4vc_oauth2.zJwk),
|
|
216
|
+
key_storage: zod.default.optional(zIso18045OrStringArray),
|
|
217
|
+
user_authentication: zod.default.optional(zIso18045OrStringArray),
|
|
218
|
+
certification: zod.default.optional(zod.default.string().url())
|
|
346
219
|
}).passthrough();
|
|
347
|
-
|
|
348
|
-
|
|
349
|
-
|
|
350
|
-
|
|
351
|
-
message: `Nonce must be defined when key attestation is used as 'proof_type.attestation' directly`
|
|
352
|
-
}) : import_zod3.default.optional(import_zod3.default.string()),
|
|
353
|
-
// REQUIRED when used within header of proof_type.jwt
|
|
354
|
-
exp: use === "proof_type.jwt" ? import_utils3.zInteger : import_zod3.default.optional(import_utils3.zInteger)
|
|
220
|
+
const zKeyAttestationJwtPayloadForUse = (use) => zod.default.object({
|
|
221
|
+
...zKeyAttestationJwtPayload.shape,
|
|
222
|
+
nonce: use === "proof_type.attestation" ? zod.default.string({ message: `Nonce must be defined when key attestation is used as 'proof_type.attestation' directly` }) : zod.default.optional(zod.default.string()),
|
|
223
|
+
exp: use === "proof_type.jwt" ? __openid4vc_utils.zInteger : zod.default.optional(__openid4vc_utils.zInteger)
|
|
355
224
|
}).passthrough();
|
|
356
225
|
|
|
357
|
-
|
|
358
|
-
|
|
359
|
-
|
|
360
|
-
|
|
361
|
-
|
|
362
|
-
|
|
363
|
-
|
|
364
|
-
|
|
365
|
-
|
|
366
|
-
|
|
367
|
-
|
|
368
|
-
|
|
369
|
-
|
|
370
|
-
uri: import_zod4.default.string().optional()
|
|
371
|
-
}).passthrough().optional(),
|
|
372
|
-
text_color: import_zod4.default.string().optional()
|
|
226
|
+
//#endregion
|
|
227
|
+
//#region src/metadata/credential-issuer/z-credential-configuration-supported-common.ts
|
|
228
|
+
const zCredentialConfigurationSupportedDisplayEntry = zod.default.object({
|
|
229
|
+
name: zod.default.string(),
|
|
230
|
+
locale: zod.default.string().optional(),
|
|
231
|
+
logo: zod.default.object({
|
|
232
|
+
uri: zod.default.string().optional(),
|
|
233
|
+
alt_text: zod.default.string().optional()
|
|
234
|
+
}).passthrough().optional(),
|
|
235
|
+
description: zod.default.string().optional(),
|
|
236
|
+
background_color: zod.default.string().optional(),
|
|
237
|
+
background_image: zod.default.object({ uri: zod.default.string().optional() }).passthrough().optional(),
|
|
238
|
+
text_color: zod.default.string().optional()
|
|
373
239
|
}).passthrough();
|
|
374
|
-
|
|
375
|
-
|
|
376
|
-
|
|
377
|
-
|
|
378
|
-
|
|
379
|
-
|
|
380
|
-
|
|
381
|
-
|
|
382
|
-
|
|
383
|
-
|
|
384
|
-
|
|
385
|
-
|
|
386
|
-
|
|
387
|
-
|
|
388
|
-
|
|
389
|
-
|
|
390
|
-
|
|
391
|
-
|
|
392
|
-
|
|
393
|
-
// For typing purposes. Can be removed once we drop support for draft <= 15.
|
|
394
|
-
claims: import_zod4.default.optional(import_zod4.default.never())
|
|
240
|
+
const zCredentialConfigurationSupportedCommonCredentialMetadata = zod.default.object({ display: zod.default.array(zCredentialConfigurationSupportedDisplayEntry).optional() });
|
|
241
|
+
const zCredentialConfigurationSupportedCommon = zod.default.object({
|
|
242
|
+
format: zod.default.string(),
|
|
243
|
+
scope: zod.default.string().optional(),
|
|
244
|
+
cryptographic_binding_methods_supported: zod.default.array(zod.default.string()).optional(),
|
|
245
|
+
credential_signing_alg_values_supported: zod.default.array(zod.default.string()).or(zod.default.array(zod.default.number())).optional(),
|
|
246
|
+
proof_types_supported: zod.default.record(zod.default.union([
|
|
247
|
+
zod.default.literal("jwt"),
|
|
248
|
+
zod.default.literal("attestation"),
|
|
249
|
+
zod.default.string()
|
|
250
|
+
]), zod.default.object({
|
|
251
|
+
proof_signing_alg_values_supported: zod.default.array(zod.default.string()),
|
|
252
|
+
key_attestations_required: zod.default.object({
|
|
253
|
+
key_storage: zIso18045OrStringArray.optional(),
|
|
254
|
+
user_authentication: zIso18045OrStringArray.optional()
|
|
255
|
+
}).passthrough().optional()
|
|
256
|
+
})).optional(),
|
|
257
|
+
credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.optional(),
|
|
258
|
+
claims: zod.default.optional(zod.default.never())
|
|
395
259
|
}).passthrough();
|
|
396
|
-
|
|
397
|
-
|
|
398
|
-
|
|
399
|
-
|
|
400
|
-
|
|
401
|
-
|
|
402
|
-
|
|
403
|
-
|
|
404
|
-
|
|
405
|
-
|
|
406
|
-
|
|
407
|
-
|
|
408
|
-
|
|
409
|
-
|
|
410
|
-
|
|
411
|
-
|
|
412
|
-
|
|
413
|
-
|
|
260
|
+
const zCredentialConfigurationSupportedCommonDraft15 = zod.default.object({
|
|
261
|
+
format: zod.default.string(),
|
|
262
|
+
scope: zod.default.string().optional(),
|
|
263
|
+
cryptographic_binding_methods_supported: zod.default.array(zod.default.string()).optional(),
|
|
264
|
+
credential_signing_alg_values_supported: zod.default.array(zod.default.string()).or(zod.default.array(zod.default.number())).optional(),
|
|
265
|
+
proof_types_supported: zod.default.record(zod.default.union([
|
|
266
|
+
zod.default.literal("jwt"),
|
|
267
|
+
zod.default.literal("attestation"),
|
|
268
|
+
zod.default.string()
|
|
269
|
+
]), zod.default.object({
|
|
270
|
+
proof_signing_alg_values_supported: zod.default.array(zod.default.string()),
|
|
271
|
+
key_attestations_required: zod.default.object({
|
|
272
|
+
key_storage: zIso18045OrStringArray.optional(),
|
|
273
|
+
user_authentication: zIso18045OrStringArray.optional()
|
|
274
|
+
}).passthrough().optional()
|
|
275
|
+
})).optional(),
|
|
276
|
+
display: zod.default.array(zCredentialConfigurationSupportedDisplayEntry).optional(),
|
|
277
|
+
credential_metadata: zod.default.optional(zod.default.never())
|
|
414
278
|
}).passthrough();
|
|
415
279
|
|
|
416
|
-
|
|
417
|
-
|
|
418
|
-
|
|
419
|
-
|
|
420
|
-
|
|
421
|
-
|
|
422
|
-
|
|
423
|
-
}).optional()
|
|
280
|
+
//#endregion
|
|
281
|
+
//#region src/formats/credential/mso-mdoc/z-mso-mdoc.ts
|
|
282
|
+
const zMsoMdocFormatIdentifier = zod.default.literal("mso_mdoc");
|
|
283
|
+
const zMsoMdocCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
|
|
284
|
+
format: zMsoMdocFormatIdentifier,
|
|
285
|
+
doctype: zod.default.string(),
|
|
286
|
+
credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zMsoMdocIssuerMetadataClaimsDescription).optional() }).optional()
|
|
424
287
|
});
|
|
425
|
-
|
|
426
|
-
|
|
427
|
-
|
|
428
|
-
|
|
288
|
+
const zMsoMdocCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
|
|
289
|
+
format: zMsoMdocFormatIdentifier,
|
|
290
|
+
doctype: zod.default.string(),
|
|
291
|
+
claims: zod.default.array(zMsoMdocIssuerMetadataClaimsDescription).optional()
|
|
429
292
|
});
|
|
430
|
-
|
|
431
|
-
|
|
432
|
-
|
|
433
|
-
|
|
434
|
-
|
|
293
|
+
const zMsoMdocCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
|
|
294
|
+
format: zMsoMdocFormatIdentifier,
|
|
295
|
+
doctype: zod.default.string(),
|
|
296
|
+
claims: zCredentialConfigurationSupportedClaimsDraft14.optional(),
|
|
297
|
+
order: zod.default.optional(zod.default.array(zod.default.string()))
|
|
435
298
|
});
|
|
436
|
-
|
|
437
|
-
|
|
438
|
-
|
|
439
|
-
|
|
440
|
-
claims: zCredentialConfigurationSupportedClaimsDraft14.optional()
|
|
299
|
+
const zMsoMdocCredentialRequestFormatDraft14 = zod.default.object({
|
|
300
|
+
format: zMsoMdocFormatIdentifier,
|
|
301
|
+
doctype: zod.default.string(),
|
|
302
|
+
claims: zCredentialConfigurationSupportedClaimsDraft14.optional()
|
|
441
303
|
});
|
|
442
304
|
|
|
443
|
-
|
|
444
|
-
|
|
445
|
-
|
|
446
|
-
|
|
447
|
-
|
|
448
|
-
|
|
449
|
-
|
|
450
|
-
credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
|
|
451
|
-
claims: import_zod6.default.array(zIssuerMetadataClaimsDescription).optional()
|
|
452
|
-
}).optional(),
|
|
453
|
-
credential_definition: import_zod6.default.optional(import_zod6.default.never())
|
|
305
|
+
//#endregion
|
|
306
|
+
//#region src/formats/credential/sd-jwt-dc/z-sd-jwt-dc.ts
|
|
307
|
+
const zSdJwtDcFormatIdentifier = zod.default.literal("dc+sd-jwt");
|
|
308
|
+
const zSdJwtDcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
|
|
309
|
+
vct: zod.default.string(),
|
|
310
|
+
format: zSdJwtDcFormatIdentifier,
|
|
311
|
+
credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional() }).optional()
|
|
454
312
|
});
|
|
455
|
-
|
|
456
|
-
|
|
457
|
-
|
|
458
|
-
|
|
459
|
-
order: import_zod6.default.optional(import_zod6.default.array(import_zod6.default.string())),
|
|
460
|
-
credential_definition: import_zod6.default.optional(import_zod6.default.never())
|
|
461
|
-
});
|
|
462
|
-
var zLegacySdJwtVcCredentialRequestFormatDraft14 = import_zod6.default.object({
|
|
463
|
-
format: zLegacySdJwtVcFormatIdentifier,
|
|
464
|
-
vct: import_zod6.default.string(),
|
|
465
|
-
claims: import_zod6.default.optional(zCredentialConfigurationSupportedClaimsDraft14),
|
|
466
|
-
credential_definition: import_zod6.default.optional(import_zod6.default.never())
|
|
313
|
+
const zSdJwtDcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
|
|
314
|
+
vct: zod.default.string(),
|
|
315
|
+
format: zSdJwtDcFormatIdentifier,
|
|
316
|
+
claims: zod.default.array(zIssuerMetadataClaimsDescription).optional()
|
|
467
317
|
});
|
|
468
318
|
|
|
469
|
-
|
|
470
|
-
|
|
471
|
-
|
|
472
|
-
|
|
473
|
-
|
|
474
|
-
|
|
475
|
-
|
|
476
|
-
|
|
477
|
-
|
|
319
|
+
//#endregion
|
|
320
|
+
//#region src/formats/credential/sd-jwt-vc/z-sd-jwt-vc.ts
|
|
321
|
+
/**
|
|
322
|
+
* @deprecated format has been deprecated in favor of "dc+sd-jwt" since Draft 23
|
|
323
|
+
* of the OpenID for Verifiable Presentations specification. Please update your
|
|
324
|
+
* implementations accordingly.
|
|
325
|
+
*/
|
|
326
|
+
const zLegacySdJwtVcFormatIdentifier = zod.default.literal("vc+sd-jwt");
|
|
327
|
+
/**
|
|
328
|
+
* @deprecated format has been deprecated in favor of "dc+sd-jwt" since Draft 23
|
|
329
|
+
* of the OpenID for Verifiable Presentations specification. Please update your
|
|
330
|
+
* implementations accordingly.
|
|
331
|
+
*/
|
|
332
|
+
const zLegacySdJwtVcCredentialIssuerMetadataDraft16 = zCredentialConfigurationSupportedCommon.extend({
|
|
333
|
+
vct: zod.default.string(),
|
|
334
|
+
format: zLegacySdJwtVcFormatIdentifier,
|
|
335
|
+
order: zod.default.optional(zod.default.array(zod.default.string())),
|
|
336
|
+
credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional() }).optional(),
|
|
337
|
+
credential_definition: zod.default.optional(zod.default.never())
|
|
478
338
|
});
|
|
479
|
-
|
|
480
|
-
|
|
481
|
-
|
|
482
|
-
|
|
339
|
+
/**
|
|
340
|
+
* @deprecated format has been deprecated in favor of "dc+sd-jwt" since Draft 23
|
|
341
|
+
* of the OpenID for Verifiable Presentations specification. Please update your
|
|
342
|
+
* implementations accordingly.
|
|
343
|
+
*/
|
|
344
|
+
const zLegacySdJwtVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
|
|
345
|
+
vct: zod.default.string(),
|
|
346
|
+
format: zLegacySdJwtVcFormatIdentifier,
|
|
347
|
+
claims: zod.default.optional(zCredentialConfigurationSupportedClaimsDraft14),
|
|
348
|
+
order: zod.default.optional(zod.default.array(zod.default.string())),
|
|
349
|
+
credential_definition: zod.default.optional(zod.default.never())
|
|
350
|
+
});
|
|
351
|
+
/**
|
|
352
|
+
* @deprecated format has been deprecated in favor of "dc+sd-jwt" since Draft 23
|
|
353
|
+
* of the OpenID for Verifiable Presentations specification. Please update your
|
|
354
|
+
* implementations accordingly.
|
|
355
|
+
*/
|
|
356
|
+
const zLegacySdJwtVcCredentialRequestFormatDraft14 = zod.default.object({
|
|
357
|
+
format: zLegacySdJwtVcFormatIdentifier,
|
|
358
|
+
vct: zod.default.string(),
|
|
359
|
+
claims: zod.default.optional(zCredentialConfigurationSupportedClaimsDraft14),
|
|
360
|
+
credential_definition: zod.default.optional(zod.default.never())
|
|
483
361
|
});
|
|
484
362
|
|
|
485
|
-
|
|
486
|
-
|
|
487
|
-
|
|
488
|
-
|
|
489
|
-
|
|
490
|
-
|
|
491
|
-
|
|
492
|
-
|
|
493
|
-
|
|
494
|
-
import_zod8.default.object({
|
|
495
|
-
name: import_zod8.default.string().optional(),
|
|
496
|
-
locale: import_zod8.default.string().optional()
|
|
497
|
-
}).passthrough()
|
|
498
|
-
).optional()
|
|
363
|
+
//#endregion
|
|
364
|
+
//#region src/formats/credential/w3c-vc/z-w3c-vc-common.ts
|
|
365
|
+
const zCredentialSubjectLeafTypeDraft14 = zod.default.object({
|
|
366
|
+
mandatory: zod.default.boolean().optional(),
|
|
367
|
+
value_type: zod.default.string().optional(),
|
|
368
|
+
display: zod.default.array(zod.default.object({
|
|
369
|
+
name: zod.default.string().optional(),
|
|
370
|
+
locale: zod.default.string().optional()
|
|
371
|
+
}).passthrough()).optional()
|
|
499
372
|
}).passthrough();
|
|
500
|
-
|
|
501
|
-
|
|
502
|
-
|
|
503
|
-
|
|
373
|
+
const zClaimValueSchemaDraft14 = zod.default.union([
|
|
374
|
+
zod.default.array(zod.default.any()),
|
|
375
|
+
zod.default.record(zod.default.string(), zod.default.any()),
|
|
376
|
+
zCredentialSubjectLeafTypeDraft14
|
|
504
377
|
]);
|
|
505
|
-
|
|
506
|
-
|
|
507
|
-
|
|
508
|
-
|
|
378
|
+
const zW3cVcCredentialSubjectDraft14 = zod.default.record(zod.default.string(), zClaimValueSchemaDraft14);
|
|
379
|
+
const zW3cVcJsonLdCredentialDefinition = zod.default.object({
|
|
380
|
+
"@context": zod.default.array(zod.default.string()),
|
|
381
|
+
type: zod.default.array(zod.default.string()).nonempty()
|
|
509
382
|
}).passthrough();
|
|
510
|
-
|
|
511
|
-
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
512
|
-
});
|
|
383
|
+
const zW3cVcJsonLdCredentialDefinitionDraft14 = zW3cVcJsonLdCredentialDefinition.extend({ credentialSubject: zW3cVcCredentialSubjectDraft14.optional() });
|
|
513
384
|
|
|
514
|
-
|
|
515
|
-
|
|
516
|
-
|
|
517
|
-
|
|
518
|
-
|
|
519
|
-
|
|
520
|
-
|
|
521
|
-
|
|
385
|
+
//#endregion
|
|
386
|
+
//#region src/formats/credential/w3c-vc/z-w3c-jwt-vc-json.ts
|
|
387
|
+
const zJwtVcJsonFormatIdentifier = zod.default.literal("jwt_vc_json");
|
|
388
|
+
const zJwtVcJsonCredentialDefinition = zod.default.object({ type: zod.default.array(zod.default.string()).nonempty() }).passthrough();
|
|
389
|
+
const zJwtVcJsonCredentialDefinitionDraft14 = zJwtVcJsonCredentialDefinition.extend({ credentialSubject: zW3cVcCredentialSubjectDraft14.optional() });
|
|
390
|
+
const zJwtVcJsonCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
|
|
391
|
+
format: zJwtVcJsonFormatIdentifier,
|
|
392
|
+
credential_definition: zJwtVcJsonCredentialDefinition,
|
|
393
|
+
credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional() }).optional()
|
|
522
394
|
});
|
|
523
|
-
|
|
524
|
-
|
|
525
|
-
|
|
526
|
-
|
|
395
|
+
const zJwtVcJsonCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
|
|
396
|
+
format: zJwtVcJsonFormatIdentifier,
|
|
397
|
+
credential_definition: zJwtVcJsonCredentialDefinition,
|
|
398
|
+
claims: zod.default.array(zIssuerMetadataClaimsDescription).optional()
|
|
527
399
|
});
|
|
528
|
-
|
|
529
|
-
|
|
530
|
-
|
|
531
|
-
|
|
400
|
+
const zJwtVcJsonCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
|
|
401
|
+
format: zJwtVcJsonFormatIdentifier,
|
|
402
|
+
credential_definition: zJwtVcJsonCredentialDefinitionDraft14,
|
|
403
|
+
order: zod.default.array(zod.default.string()).optional()
|
|
532
404
|
});
|
|
533
|
-
|
|
534
|
-
|
|
535
|
-
|
|
536
|
-
|
|
537
|
-
|
|
538
|
-
"@context": import_zod9.default.array(import_zod9.default.string()),
|
|
539
|
-
types: import_zod9.default.array(import_zod9.default.string()),
|
|
540
|
-
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
405
|
+
const zJwtVcJsonCredentialIssuerMetadataDraft11 = zod.default.object({
|
|
406
|
+
format: zJwtVcJsonFormatIdentifier,
|
|
407
|
+
order: zod.default.array(zod.default.string()).optional(),
|
|
408
|
+
types: zod.default.array(zod.default.string()),
|
|
409
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
541
410
|
}).passthrough();
|
|
542
|
-
|
|
543
|
-
|
|
544
|
-
|
|
545
|
-
|
|
546
|
-
|
|
547
|
-
|
|
548
|
-
|
|
549
|
-
|
|
550
|
-
|
|
551
|
-
|
|
552
|
-
|
|
553
|
-
|
|
554
|
-
|
|
555
|
-
|
|
556
|
-
|
|
557
|
-
})).pipe(zLdpVcCredentialIssuerMetadataDraft11);
|
|
558
|
-
var zLdpVcCredentialRequestFormatDraft14 = import_zod9.default.object({
|
|
559
|
-
format: zLdpVcFormatIdentifier,
|
|
560
|
-
credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14
|
|
411
|
+
const zJwtVcJsonCredentialIssuerMetadataDraft11To14 = zJwtVcJsonCredentialIssuerMetadataDraft11.transform(({ types, credentialSubject,...rest }) => ({
|
|
412
|
+
...rest,
|
|
413
|
+
credential_definition: {
|
|
414
|
+
type: types,
|
|
415
|
+
...credentialSubject ? { credentialSubject } : {}
|
|
416
|
+
}
|
|
417
|
+
}));
|
|
418
|
+
const zJwtVcJsonCredentialIssuerMetadataDraft14To11 = zJwtVcJsonCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type,...credentialDefinition },...rest }) => ({
|
|
419
|
+
...rest,
|
|
420
|
+
types: type,
|
|
421
|
+
...credentialDefinition
|
|
422
|
+
})).pipe(zJwtVcJsonCredentialIssuerMetadataDraft11);
|
|
423
|
+
const zJwtVcJsonCredentialRequestFormatDraft14 = zod.default.object({
|
|
424
|
+
format: zJwtVcJsonFormatIdentifier,
|
|
425
|
+
credential_definition: zJwtVcJsonCredentialDefinition
|
|
561
426
|
});
|
|
562
|
-
|
|
563
|
-
|
|
564
|
-
|
|
565
|
-
|
|
566
|
-
// credential_definition was using types instead of type in v11
|
|
567
|
-
types: import_zod9.default.array(import_zod9.default.string()),
|
|
568
|
-
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
569
|
-
})
|
|
427
|
+
const zJwtVcJsonCredentialRequestDraft11 = zod.default.object({
|
|
428
|
+
format: zJwtVcJsonFormatIdentifier,
|
|
429
|
+
types: zod.default.array(zod.default.string()),
|
|
430
|
+
credentialSubject: zod.default.optional(zW3cVcCredentialSubjectDraft14)
|
|
570
431
|
}).passthrough();
|
|
571
|
-
|
|
572
|
-
|
|
573
|
-
|
|
574
|
-
|
|
575
|
-
|
|
576
|
-
|
|
577
|
-
|
|
578
|
-
|
|
579
|
-
);
|
|
580
|
-
|
|
581
|
-
|
|
582
|
-
|
|
583
|
-
|
|
584
|
-
|
|
585
|
-
}
|
|
586
|
-
})).pipe(zLdpVcCredentialRequestDraft11);
|
|
432
|
+
const zJwtVcJsonCredentialRequestDraft11To14 = zJwtVcJsonCredentialRequestDraft11.transform(({ types, credentialSubject,...rest }) => {
|
|
433
|
+
return {
|
|
434
|
+
...rest,
|
|
435
|
+
credential_definition: {
|
|
436
|
+
type: types,
|
|
437
|
+
...credentialSubject ? { credentialSubject } : {}
|
|
438
|
+
}
|
|
439
|
+
};
|
|
440
|
+
});
|
|
441
|
+
const zJwtVcJsonCredentialRequestDraft14To11 = zJwtVcJsonCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type,...credentialDefinition },...rest }) => ({
|
|
442
|
+
...rest,
|
|
443
|
+
types: type,
|
|
444
|
+
...credentialDefinition
|
|
445
|
+
})).pipe(zJwtVcJsonCredentialRequestDraft11);
|
|
587
446
|
|
|
588
|
-
|
|
589
|
-
|
|
590
|
-
|
|
591
|
-
|
|
592
|
-
|
|
593
|
-
|
|
594
|
-
|
|
595
|
-
claims: import_zod10.default.array(zIssuerMetadataClaimsDescription).optional()
|
|
596
|
-
}).optional()
|
|
447
|
+
//#endregion
|
|
448
|
+
//#region src/formats/credential/w3c-vc/z-w3c-jwt-vc-json-ld.ts
|
|
449
|
+
const zJwtVcJsonLdFormatIdentifier = zod.default.literal("jwt_vc_json-ld");
|
|
450
|
+
const zJwtVcJsonLdCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
|
|
451
|
+
format: zJwtVcJsonLdFormatIdentifier,
|
|
452
|
+
credential_definition: zW3cVcJsonLdCredentialDefinition,
|
|
453
|
+
credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional() }).optional()
|
|
597
454
|
});
|
|
598
|
-
|
|
599
|
-
|
|
600
|
-
|
|
601
|
-
|
|
455
|
+
const zJwtVcJsonLdCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
|
|
456
|
+
format: zJwtVcJsonLdFormatIdentifier,
|
|
457
|
+
credential_definition: zW3cVcJsonLdCredentialDefinition,
|
|
458
|
+
claims: zod.default.array(zIssuerMetadataClaimsDescription).optional()
|
|
602
459
|
});
|
|
603
|
-
|
|
604
|
-
|
|
605
|
-
|
|
606
|
-
|
|
460
|
+
const zJwtVcJsonLdCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
|
|
461
|
+
format: zJwtVcJsonLdFormatIdentifier,
|
|
462
|
+
credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
|
|
463
|
+
order: zod.default.optional(zod.default.array(zod.default.string()))
|
|
607
464
|
});
|
|
608
|
-
|
|
609
|
-
|
|
610
|
-
|
|
611
|
-
|
|
612
|
-
|
|
613
|
-
|
|
614
|
-
types: import_zod10.default.array(import_zod10.default.string()),
|
|
615
|
-
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
465
|
+
const zJwtVcJsonLdCredentialIssuerMetadataDraft11 = zod.default.object({
|
|
466
|
+
order: zod.default.array(zod.default.string()).optional(),
|
|
467
|
+
format: zJwtVcJsonLdFormatIdentifier,
|
|
468
|
+
"@context": zod.default.array(zod.default.string()),
|
|
469
|
+
types: zod.default.array(zod.default.string()),
|
|
470
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
616
471
|
}).passthrough();
|
|
617
|
-
|
|
618
|
-
|
|
619
|
-
|
|
620
|
-
|
|
621
|
-
|
|
622
|
-
|
|
623
|
-
|
|
624
|
-
|
|
625
|
-
|
|
626
|
-
|
|
627
|
-
|
|
628
|
-
|
|
629
|
-
...rest,
|
|
630
|
-
...credentialDefinition,
|
|
631
|
-
types: type
|
|
472
|
+
const zJwtVcJsonLdCredentialIssuerMetadataDraft11To14 = zJwtVcJsonLdCredentialIssuerMetadataDraft11.transform(({ "@context": context, types, credentialSubject,...rest }) => ({
|
|
473
|
+
...rest,
|
|
474
|
+
credential_definition: {
|
|
475
|
+
"@context": context,
|
|
476
|
+
type: types,
|
|
477
|
+
...credentialSubject ? { credentialSubject } : {}
|
|
478
|
+
}
|
|
479
|
+
}));
|
|
480
|
+
const zJwtVcJsonLdCredentialIssuerMetadataDraft14To11 = zJwtVcJsonLdCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type,...credentialDefinition },...rest }) => ({
|
|
481
|
+
...rest,
|
|
482
|
+
...credentialDefinition,
|
|
483
|
+
types: type
|
|
632
484
|
})).pipe(zJwtVcJsonLdCredentialIssuerMetadataDraft11);
|
|
633
|
-
|
|
634
|
-
|
|
635
|
-
|
|
485
|
+
const zJwtVcJsonLdCredentialRequestFormatDraft14 = zod.default.object({
|
|
486
|
+
format: zJwtVcJsonLdFormatIdentifier,
|
|
487
|
+
credential_definition: zW3cVcJsonLdCredentialDefinition
|
|
636
488
|
});
|
|
637
|
-
|
|
638
|
-
|
|
639
|
-
|
|
640
|
-
|
|
641
|
-
|
|
642
|
-
|
|
643
|
-
|
|
644
|
-
}).passthrough()
|
|
489
|
+
const zJwtVcJsonLdCredentialRequestDraft11 = zod.default.object({
|
|
490
|
+
format: zJwtVcJsonLdFormatIdentifier,
|
|
491
|
+
credential_definition: zod.default.object({
|
|
492
|
+
"@context": zod.default.array(zod.default.string()),
|
|
493
|
+
types: zod.default.array(zod.default.string()),
|
|
494
|
+
credentialSubject: zod.default.optional(zW3cVcCredentialSubjectDraft14)
|
|
495
|
+
}).passthrough()
|
|
645
496
|
}).passthrough();
|
|
646
|
-
|
|
647
|
-
|
|
648
|
-
|
|
649
|
-
|
|
650
|
-
|
|
651
|
-
|
|
652
|
-
|
|
653
|
-
|
|
654
|
-
|
|
655
|
-
|
|
656
|
-
|
|
657
|
-
|
|
658
|
-
|
|
659
|
-
types: type
|
|
660
|
-
}
|
|
497
|
+
const zJwtVcJsonLdCredentialRequestDraft11To14 = zJwtVcJsonLdCredentialRequestDraft11.transform(({ credential_definition: { types,...restCredentialDefinition },...rest }) => ({
|
|
498
|
+
...rest,
|
|
499
|
+
credential_definition: {
|
|
500
|
+
...restCredentialDefinition,
|
|
501
|
+
type: types
|
|
502
|
+
}
|
|
503
|
+
}));
|
|
504
|
+
const zJwtVcJsonLdCredentialRequestDraft14To11 = zJwtVcJsonLdCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type,...restCredentialDefinition },...rest }) => ({
|
|
505
|
+
...rest,
|
|
506
|
+
credential_definition: {
|
|
507
|
+
...restCredentialDefinition,
|
|
508
|
+
types: type
|
|
509
|
+
}
|
|
661
510
|
})).pipe(zJwtVcJsonLdCredentialRequestDraft11);
|
|
662
511
|
|
|
663
|
-
|
|
664
|
-
|
|
665
|
-
|
|
666
|
-
|
|
667
|
-
|
|
668
|
-
|
|
669
|
-
|
|
670
|
-
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
671
|
-
});
|
|
672
|
-
var zJwtVcJsonCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
|
|
673
|
-
format: zJwtVcJsonFormatIdentifier,
|
|
674
|
-
credential_definition: zJwtVcJsonCredentialDefinition,
|
|
675
|
-
credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
|
|
676
|
-
claims: import_zod11.default.array(zIssuerMetadataClaimsDescription).optional()
|
|
677
|
-
}).optional()
|
|
512
|
+
//#endregion
|
|
513
|
+
//#region src/formats/credential/w3c-vc/z-w3c-ldp-vc.ts
|
|
514
|
+
const zLdpVcFormatIdentifier = zod.default.literal("ldp_vc");
|
|
515
|
+
const zLdpVcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
|
|
516
|
+
format: zLdpVcFormatIdentifier,
|
|
517
|
+
credential_definition: zW3cVcJsonLdCredentialDefinition,
|
|
518
|
+
credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional() }).optional()
|
|
678
519
|
});
|
|
679
|
-
|
|
680
|
-
|
|
681
|
-
|
|
682
|
-
|
|
520
|
+
const zLdpVcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
|
|
521
|
+
format: zLdpVcFormatIdentifier,
|
|
522
|
+
credential_definition: zW3cVcJsonLdCredentialDefinition,
|
|
523
|
+
claims: zod.default.array(zIssuerMetadataClaimsDescription).optional()
|
|
683
524
|
});
|
|
684
|
-
|
|
685
|
-
|
|
686
|
-
|
|
687
|
-
|
|
525
|
+
const zLdpVcCredentialIssuerMetadataDraft14 = zCredentialConfigurationSupportedCommonDraft15.extend({
|
|
526
|
+
format: zLdpVcFormatIdentifier,
|
|
527
|
+
credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14,
|
|
528
|
+
order: zod.default.array(zod.default.string()).optional()
|
|
688
529
|
});
|
|
689
|
-
|
|
690
|
-
|
|
691
|
-
|
|
692
|
-
|
|
693
|
-
|
|
694
|
-
|
|
695
|
-
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
530
|
+
const zLdpVcCredentialIssuerMetadataDraft11 = zod.default.object({
|
|
531
|
+
order: zod.default.array(zod.default.string()).optional(),
|
|
532
|
+
format: zLdpVcFormatIdentifier,
|
|
533
|
+
"@context": zod.default.array(zod.default.string()),
|
|
534
|
+
types: zod.default.array(zod.default.string()),
|
|
535
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
696
536
|
}).passthrough();
|
|
697
|
-
|
|
698
|
-
|
|
699
|
-
|
|
700
|
-
|
|
701
|
-
|
|
702
|
-
|
|
703
|
-
|
|
704
|
-
|
|
705
|
-
|
|
706
|
-
|
|
707
|
-
|
|
708
|
-
|
|
709
|
-
|
|
710
|
-
|
|
711
|
-
|
|
712
|
-
|
|
713
|
-
format: zJwtVcJsonFormatIdentifier,
|
|
714
|
-
credential_definition: zJwtVcJsonCredentialDefinition
|
|
537
|
+
const zLdpVcCredentialIssuerMetadataDraft11To14 = zLdpVcCredentialIssuerMetadataDraft11.transform(({ "@context": context, types, credentialSubject,...rest }) => ({
|
|
538
|
+
...rest,
|
|
539
|
+
credential_definition: {
|
|
540
|
+
"@context": context,
|
|
541
|
+
type: types,
|
|
542
|
+
...credentialSubject ? { credentialSubject } : {}
|
|
543
|
+
}
|
|
544
|
+
}));
|
|
545
|
+
const zLdpVcCredentialIssuerMetadataDraft14To11 = zLdpVcCredentialIssuerMetadataDraft14.passthrough().transform(({ credential_definition: { type,...credentialDefinition },...rest }) => ({
|
|
546
|
+
...rest,
|
|
547
|
+
...credentialDefinition,
|
|
548
|
+
types: type
|
|
549
|
+
})).pipe(zLdpVcCredentialIssuerMetadataDraft11);
|
|
550
|
+
const zLdpVcCredentialRequestFormatDraft14 = zod.default.object({
|
|
551
|
+
format: zLdpVcFormatIdentifier,
|
|
552
|
+
credential_definition: zW3cVcJsonLdCredentialDefinitionDraft14
|
|
715
553
|
});
|
|
716
|
-
|
|
717
|
-
|
|
718
|
-
|
|
719
|
-
|
|
720
|
-
|
|
721
|
-
|
|
554
|
+
const zLdpVcCredentialRequestDraft11 = zod.default.object({
|
|
555
|
+
format: zLdpVcFormatIdentifier,
|
|
556
|
+
credential_definition: zod.default.object({
|
|
557
|
+
"@context": zod.default.array(zod.default.string()),
|
|
558
|
+
types: zod.default.array(zod.default.string()),
|
|
559
|
+
credentialSubject: zW3cVcCredentialSubjectDraft14.optional()
|
|
560
|
+
})
|
|
722
561
|
}).passthrough();
|
|
723
|
-
|
|
724
|
-
|
|
725
|
-
|
|
726
|
-
|
|
727
|
-
|
|
728
|
-
|
|
729
|
-
|
|
730
|
-
|
|
731
|
-
|
|
732
|
-
|
|
733
|
-
|
|
734
|
-
|
|
735
|
-
|
|
736
|
-
|
|
737
|
-
types: type,
|
|
738
|
-
...credentialDefinition
|
|
739
|
-
})).pipe(zJwtVcJsonCredentialRequestDraft11);
|
|
562
|
+
const zLdpVcCredentialRequestDraft11To14 = zLdpVcCredentialRequestDraft11.transform(({ credential_definition: { types,...restCredentialDefinition },...rest }) => ({
|
|
563
|
+
...rest,
|
|
564
|
+
credential_definition: {
|
|
565
|
+
...restCredentialDefinition,
|
|
566
|
+
type: types
|
|
567
|
+
}
|
|
568
|
+
}));
|
|
569
|
+
const zLdpVcCredentialRequestDraft14To11 = zLdpVcCredentialRequestFormatDraft14.passthrough().transform(({ credential_definition: { type,...restCredentialDefinition },...rest }) => ({
|
|
570
|
+
...rest,
|
|
571
|
+
credential_definition: {
|
|
572
|
+
...restCredentialDefinition,
|
|
573
|
+
types: type
|
|
574
|
+
}
|
|
575
|
+
})).pipe(zLdpVcCredentialRequestDraft11);
|
|
740
576
|
|
|
741
|
-
|
|
742
|
-
|
|
743
|
-
|
|
744
|
-
|
|
745
|
-
|
|
746
|
-
|
|
747
|
-
|
|
748
|
-
|
|
749
|
-
|
|
750
|
-
credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({
|
|
751
|
-
claims: import_zod12.default.array(zIssuerMetadataClaimsDescription).optional()
|
|
752
|
-
}).optional(),
|
|
753
|
-
// FIXME(vc+sd-jwt): remove when dropping support for legacy vc+sd-jwt. Allows type narrowing.
|
|
754
|
-
vct: import_zod12.default.optional(import_zod12.default.never())
|
|
577
|
+
//#endregion
|
|
578
|
+
//#region src/formats/credential/w3c-vc/z-w3c-sd-jwt-vc.ts
|
|
579
|
+
const zSdJwtW3VcFormatIdentifier = zod.default.literal("vc+sd-jwt");
|
|
580
|
+
const zSdJwtW3VcCredentialDefinition = zod.default.object({ type: zod.default.array(zod.default.string()).nonempty() }).passthrough();
|
|
581
|
+
const zSdJwtW3VcCredentialIssuerMetadata = zCredentialConfigurationSupportedCommon.extend({
|
|
582
|
+
format: zSdJwtW3VcFormatIdentifier,
|
|
583
|
+
credential_definition: zSdJwtW3VcCredentialDefinition,
|
|
584
|
+
credential_metadata: zCredentialConfigurationSupportedCommonCredentialMetadata.extend({ claims: zod.default.array(zIssuerMetadataClaimsDescription).optional() }).optional(),
|
|
585
|
+
vct: zod.default.optional(zod.default.never())
|
|
755
586
|
});
|
|
756
|
-
|
|
757
|
-
|
|
758
|
-
|
|
759
|
-
|
|
760
|
-
|
|
761
|
-
vct: import_zod12.default.optional(import_zod12.default.never())
|
|
587
|
+
const zSdJwtW3VcCredentialIssuerMetadataDraft15 = zCredentialConfigurationSupportedCommonDraft15.extend({
|
|
588
|
+
format: zSdJwtW3VcFormatIdentifier,
|
|
589
|
+
credential_definition: zSdJwtW3VcCredentialDefinition,
|
|
590
|
+
claims: zod.default.array(zIssuerMetadataClaimsDescription).optional(),
|
|
591
|
+
vct: zod.default.optional(zod.default.never())
|
|
762
592
|
});
|
|
763
|
-
|
|
764
|
-
|
|
765
|
-
|
|
766
|
-
|
|
767
|
-
vct: import_zod12.default.optional(import_zod12.default.never())
|
|
593
|
+
const zSdJwtW3VcCredentialRequestFormatDraft14 = zod.default.object({
|
|
594
|
+
format: zSdJwtW3VcFormatIdentifier,
|
|
595
|
+
credential_definition: zSdJwtW3VcCredentialDefinition,
|
|
596
|
+
vct: zod.default.optional(zod.default.never())
|
|
768
597
|
});
|
|
769
598
|
|
|
770
|
-
|
|
771
|
-
|
|
772
|
-
|
|
773
|
-
|
|
774
|
-
|
|
775
|
-
|
|
776
|
-
|
|
777
|
-
|
|
778
|
-
|
|
779
|
-
|
|
780
|
-
|
|
781
|
-
|
|
782
|
-
|
|
783
|
-
|
|
784
|
-
|
|
785
|
-
|
|
786
|
-
|
|
787
|
-
|
|
788
|
-
|
|
789
|
-
|
|
599
|
+
//#endregion
|
|
600
|
+
//#region src/metadata/credential-issuer/z-credential-issuer-metadata.ts
|
|
601
|
+
const allCredentialIssuerMetadataFormats = [
|
|
602
|
+
zSdJwtDcCredentialIssuerMetadata,
|
|
603
|
+
zMsoMdocCredentialIssuerMetadata,
|
|
604
|
+
zJwtVcJsonLdCredentialIssuerMetadata,
|
|
605
|
+
zLdpVcCredentialIssuerMetadata,
|
|
606
|
+
zJwtVcJsonCredentialIssuerMetadata,
|
|
607
|
+
zSdJwtW3VcCredentialIssuerMetadata,
|
|
608
|
+
zSdJwtW3VcCredentialIssuerMetadataDraft15,
|
|
609
|
+
zLegacySdJwtVcCredentialIssuerMetadataDraft16,
|
|
610
|
+
zSdJwtDcCredentialIssuerMetadataDraft15,
|
|
611
|
+
zMsoMdocCredentialIssuerMetadataDraft15,
|
|
612
|
+
zJwtVcJsonLdCredentialIssuerMetadataDraft15,
|
|
613
|
+
zLdpVcCredentialIssuerMetadataDraft15,
|
|
614
|
+
zJwtVcJsonCredentialIssuerMetadataDraft15,
|
|
615
|
+
zMsoMdocCredentialIssuerMetadataDraft14,
|
|
616
|
+
zLegacySdJwtVcCredentialIssuerMetadataDraft14,
|
|
617
|
+
zJwtVcJsonLdCredentialIssuerMetadataDraft14,
|
|
618
|
+
zLdpVcCredentialIssuerMetadataDraft14,
|
|
619
|
+
zJwtVcJsonCredentialIssuerMetadataDraft14
|
|
790
620
|
];
|
|
791
|
-
|
|
792
|
-
|
|
793
|
-
);
|
|
794
|
-
|
|
795
|
-
|
|
796
|
-
|
|
797
|
-
|
|
798
|
-
|
|
799
|
-
const result = import_zod13.default.object({}).passthrough().and(
|
|
800
|
-
validators.length > 1 ? import_zod13.default.union(
|
|
801
|
-
validators
|
|
802
|
-
) : validators[0]
|
|
803
|
-
).safeParse(data);
|
|
804
|
-
if (result.success) {
|
|
805
|
-
return result.data;
|
|
806
|
-
}
|
|
807
|
-
for (const issue of result.error.issues) {
|
|
808
|
-
ctx.addIssue(issue);
|
|
809
|
-
}
|
|
810
|
-
return import_zod13.default.NEVER;
|
|
621
|
+
const allCredentialIssuerMetadataFormatIdentifiers = allCredentialIssuerMetadataFormats.map((format) => format.shape.format.value);
|
|
622
|
+
const zCredentialConfigurationSupportedWithFormats = zod.default.union([zCredentialConfigurationSupportedCommon, zCredentialConfigurationSupportedCommonDraft15]).transform((data, ctx) => {
|
|
623
|
+
if (!allCredentialIssuerMetadataFormatIdentifiers.includes(data.format)) return data;
|
|
624
|
+
const validators = allCredentialIssuerMetadataFormats.filter((formatValidator) => formatValidator.shape.format.value === data.format);
|
|
625
|
+
const result = zod.default.object({}).passthrough().and(validators.length > 1 ? zod.default.union(validators) : validators[0]).safeParse(data);
|
|
626
|
+
if (result.success) return result.data;
|
|
627
|
+
for (const issue of result.error.issues) ctx.addIssue(issue);
|
|
628
|
+
return zod.default.NEVER;
|
|
811
629
|
});
|
|
812
|
-
|
|
813
|
-
|
|
814
|
-
|
|
815
|
-
|
|
816
|
-
|
|
817
|
-
|
|
818
|
-
|
|
819
|
-
}).passthrough().optional()
|
|
630
|
+
const zCredentialIssuerMetadataDisplayEntry = zod.default.object({
|
|
631
|
+
name: zod.default.string().optional(),
|
|
632
|
+
locale: zod.default.string().optional(),
|
|
633
|
+
logo: zod.default.object({
|
|
634
|
+
uri: zod.default.string().optional(),
|
|
635
|
+
alt_text: zod.default.string().optional()
|
|
636
|
+
}).passthrough().optional()
|
|
820
637
|
}).passthrough();
|
|
821
|
-
|
|
822
|
-
|
|
823
|
-
|
|
824
|
-
|
|
825
|
-
|
|
826
|
-
|
|
827
|
-
|
|
828
|
-
|
|
829
|
-
|
|
830
|
-
|
|
831
|
-
|
|
832
|
-
|
|
833
|
-
|
|
834
|
-
|
|
835
|
-
|
|
836
|
-
|
|
837
|
-
signed_metadata: import_oauth24.zCompactJwt.optional(),
|
|
838
|
-
display: import_zod13.default.array(zCredentialIssuerMetadataDisplayEntry).optional(),
|
|
839
|
-
credential_configurations_supported: import_zod13.default.record(import_zod13.default.string(), zCredentialConfigurationSupportedWithFormats)
|
|
638
|
+
const zCredentialIssuerMetadataDraft14Draft15Draft16 = zod.default.object({
|
|
639
|
+
credential_issuer: __openid4vc_utils.zHttpsUrl,
|
|
640
|
+
authorization_servers: zod.default.array(__openid4vc_utils.zHttpsUrl).optional(),
|
|
641
|
+
credential_endpoint: __openid4vc_utils.zHttpsUrl,
|
|
642
|
+
deferred_credential_endpoint: __openid4vc_utils.zHttpsUrl.optional(),
|
|
643
|
+
notification_endpoint: __openid4vc_utils.zHttpsUrl.optional(),
|
|
644
|
+
nonce_endpoint: __openid4vc_utils.zHttpsUrl.optional(),
|
|
645
|
+
credential_response_encryption: zod.default.object({
|
|
646
|
+
alg_values_supported: zod.default.array(zod.default.string()),
|
|
647
|
+
enc_values_supported: zod.default.array(zod.default.string()),
|
|
648
|
+
encryption_required: zod.default.boolean()
|
|
649
|
+
}).passthrough().optional(),
|
|
650
|
+
batch_credential_issuance: zod.default.object({ batch_size: zod.default.number().positive() }).passthrough().optional(),
|
|
651
|
+
signed_metadata: __openid4vc_oauth2.zCompactJwt.optional(),
|
|
652
|
+
display: zod.default.array(zCredentialIssuerMetadataDisplayEntry).optional(),
|
|
653
|
+
credential_configurations_supported: zod.default.record(zod.default.string(), zCredentialConfigurationSupportedWithFormats)
|
|
840
654
|
}).passthrough();
|
|
841
|
-
|
|
842
|
-
|
|
843
|
-
|
|
844
|
-
|
|
845
|
-
|
|
846
|
-
|
|
847
|
-
|
|
848
|
-
|
|
849
|
-
|
|
850
|
-
|
|
851
|
-
|
|
852
|
-
|
|
853
|
-
|
|
854
|
-
|
|
855
|
-
|
|
856
|
-
|
|
857
|
-
|
|
858
|
-
|
|
859
|
-
|
|
860
|
-
|
|
861
|
-
...claims ? { claims } : {},
|
|
862
|
-
...display ? {
|
|
863
|
-
display: display.map(({ logo, background_image, ...displayRest }) => ({
|
|
864
|
-
...displayRest,
|
|
865
|
-
// url became uri and also required
|
|
866
|
-
// so if there's no url in the logo, we remove the whole logo object
|
|
867
|
-
...logo?.url ? {
|
|
868
|
-
// TODO: we should add the other params from logo as well
|
|
869
|
-
logo: {
|
|
870
|
-
uri: logo.url
|
|
871
|
-
}
|
|
872
|
-
} : {},
|
|
873
|
-
// TODO: we should add the other params from background_image as well
|
|
874
|
-
// url became uri and also required
|
|
875
|
-
// so if there's no url in the background_image, we remove the whole logo object
|
|
876
|
-
...background_image?.url ? {
|
|
877
|
-
background_image: {
|
|
878
|
-
uri: background_image.url
|
|
879
|
-
}
|
|
880
|
-
} : {}
|
|
881
|
-
}))
|
|
882
|
-
} : {}
|
|
883
|
-
}
|
|
884
|
-
} : {}
|
|
655
|
+
const zCredentialConfigurationSupportedDraft11To16 = zod.default.object({
|
|
656
|
+
id: zod.default.string().optional(),
|
|
657
|
+
format: zod.default.string(),
|
|
658
|
+
cryptographic_suites_supported: zod.default.array(zod.default.string()).optional(),
|
|
659
|
+
display: zod.default.array(zod.default.object({
|
|
660
|
+
logo: zod.default.object({ url: zod.default.string().url().optional() }).passthrough().optional(),
|
|
661
|
+
background_image: zod.default.object({ url: zod.default.string().url().optional() }).passthrough().optional()
|
|
662
|
+
}).passthrough()).optional(),
|
|
663
|
+
claims: zod.default.any().optional()
|
|
664
|
+
}).passthrough().transform(({ cryptographic_suites_supported, display, claims, id,...rest }) => ({
|
|
665
|
+
...rest,
|
|
666
|
+
...cryptographic_suites_supported ? { credential_signing_alg_values_supported: cryptographic_suites_supported } : {},
|
|
667
|
+
...claims || display ? { credential_metadata: {
|
|
668
|
+
...claims ? { claims } : {},
|
|
669
|
+
...display ? { display: display.map(({ logo, background_image,...displayRest }) => ({
|
|
670
|
+
...displayRest,
|
|
671
|
+
...logo?.url ? { logo: { uri: logo.url } } : {},
|
|
672
|
+
...background_image?.url ? { background_image: { uri: background_image.url } } : {}
|
|
673
|
+
})) } : {}
|
|
674
|
+
} } : {}
|
|
885
675
|
})).transform((data, ctx) => {
|
|
886
|
-
|
|
887
|
-
|
|
888
|
-
|
|
889
|
-
|
|
890
|
-
|
|
891
|
-
|
|
892
|
-
|
|
893
|
-
|
|
894
|
-
|
|
895
|
-
|
|
896
|
-
ctx.addIssue(issue);
|
|
897
|
-
}
|
|
898
|
-
return import_zod13.default.NEVER;
|
|
676
|
+
const formatSpecificTransformations = {
|
|
677
|
+
[zLdpVcFormatIdentifier.value]: zLdpVcCredentialIssuerMetadataDraft11To14,
|
|
678
|
+
[zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialIssuerMetadataDraft11To14,
|
|
679
|
+
[zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialIssuerMetadataDraft11To14
|
|
680
|
+
};
|
|
681
|
+
if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
|
|
682
|
+
const result = formatSpecificTransformations[data.format].safeParse(data);
|
|
683
|
+
if (result.success) return result.data;
|
|
684
|
+
for (const issue of result.error.issues) ctx.addIssue(issue);
|
|
685
|
+
return zod.default.NEVER;
|
|
899
686
|
}).pipe(zCredentialConfigurationSupportedWithFormats);
|
|
900
|
-
|
|
901
|
-
|
|
902
|
-
|
|
903
|
-
|
|
904
|
-
|
|
905
|
-
|
|
906
|
-
|
|
907
|
-
|
|
908
|
-
|
|
909
|
-
|
|
910
|
-
|
|
911
|
-
|
|
912
|
-
|
|
913
|
-
|
|
914
|
-
|
|
915
|
-
|
|
916
|
-
|
|
917
|
-
|
|
918
|
-
|
|
919
|
-
|
|
920
|
-
|
|
921
|
-
|
|
922
|
-
|
|
923
|
-
|
|
924
|
-
|
|
925
|
-
|
|
926
|
-
|
|
927
|
-
|
|
928
|
-
|
|
929
|
-
|
|
930
|
-
|
|
931
|
-
|
|
932
|
-
|
|
933
|
-
|
|
934
|
-
|
|
935
|
-
|
|
936
|
-
|
|
937
|
-
|
|
938
|
-
|
|
939
|
-
|
|
940
|
-
|
|
941
|
-
|
|
942
|
-
|
|
943
|
-
|
|
944
|
-
|
|
945
|
-
)
|
|
946
|
-
|
|
947
|
-
|
|
948
|
-
|
|
949
|
-
|
|
950
|
-
|
|
951
|
-
|
|
952
|
-
|
|
953
|
-
|
|
954
|
-
|
|
955
|
-
|
|
956
|
-
|
|
957
|
-
|
|
958
|
-
|
|
959
|
-
|
|
960
|
-
|
|
961
|
-
|
|
962
|
-
|
|
963
|
-
|
|
964
|
-
|
|
965
|
-
|
|
966
|
-
|
|
967
|
-
|
|
968
|
-
|
|
969
|
-
|
|
970
|
-
...issuerMetadata.authorization_servers ? { authorization_server: issuerMetadata.authorization_servers[0] } : {},
|
|
971
|
-
credentials_supported: Object.entries(issuerMetadata.credential_configurations_supported).map(([id, value]) => ({
|
|
972
|
-
...value,
|
|
973
|
-
id
|
|
974
|
-
}))
|
|
975
|
-
})).pipe(
|
|
976
|
-
zCredentialIssuerMetadataDraft14Draft15Draft16.extend({
|
|
977
|
-
credentials_supported: import_zod13.default.array(zCredentialConfigurationSupportedDraft16To11)
|
|
978
|
-
})
|
|
979
|
-
);
|
|
980
|
-
var zCredentialIssuerMetadata = import_zod13.default.union([
|
|
981
|
-
// First prioritize draft 16/15/14 (and 13)
|
|
982
|
-
zCredentialIssuerMetadataDraft14Draft15Draft16,
|
|
983
|
-
// Then try parsing draft 11 and transform into draft 16
|
|
984
|
-
zCredentialIssuerMetadataDraft11To16
|
|
985
|
-
]);
|
|
986
|
-
var zCredentialIssuerMetadataWithDraftVersion = import_zod13.default.union([
|
|
987
|
-
zCredentialIssuerMetadataDraft14Draft15Draft16.transform((credentialIssuerMetadata) => {
|
|
988
|
-
const credentialConfigurations = Object.values(credentialIssuerMetadata.credential_configurations_supported);
|
|
989
|
-
const isDraft15 = credentialConfigurations.some((configuration) => {
|
|
990
|
-
const knownConfiguration = configuration;
|
|
991
|
-
if (knownConfiguration.format === zSdJwtDcFormatIdentifier.value) return true;
|
|
992
|
-
if (Array.isArray(knownConfiguration.claims)) return true;
|
|
993
|
-
if (Object.values(knownConfiguration.proof_types_supported ?? {}).some(
|
|
994
|
-
(proofType) => proofType.key_attestations_required !== void 0
|
|
995
|
-
))
|
|
996
|
-
return true;
|
|
997
|
-
return false;
|
|
998
|
-
});
|
|
999
|
-
const isDraft16 = credentialConfigurations.some((configuration) => {
|
|
1000
|
-
return configuration.credential_metadata;
|
|
1001
|
-
});
|
|
1002
|
-
return {
|
|
1003
|
-
credentialIssuerMetadata,
|
|
1004
|
-
originalDraftVersion: isDraft16 ? "Draft16" /* Draft16 */ : isDraft15 ? "Draft15" /* Draft15 */ : "Draft14" /* Draft14 */
|
|
1005
|
-
};
|
|
1006
|
-
}),
|
|
1007
|
-
// Then try parsing draft 11 and transform into draft 14
|
|
1008
|
-
zCredentialIssuerMetadataDraft11To16.transform((credentialIssuerMetadata) => ({
|
|
1009
|
-
credentialIssuerMetadata,
|
|
1010
|
-
originalDraftVersion: "Draft11" /* Draft11 */
|
|
1011
|
-
}))
|
|
1012
|
-
]);
|
|
687
|
+
const zCredentialConfigurationSupportedDraft16To11 = zCredentialConfigurationSupportedWithFormats.transform(({ credential_metadata,...rest }) => ({
|
|
688
|
+
...credential_metadata,
|
|
689
|
+
...rest
|
|
690
|
+
})).and(zod.default.object({ id: zod.default.string() }).passthrough()).transform(({ id, credential_signing_alg_values_supported, display, proof_types_supported, scope,...rest }) => ({
|
|
691
|
+
...rest,
|
|
692
|
+
...credential_signing_alg_values_supported ? { cryptographic_suites_supported: credential_signing_alg_values_supported } : {},
|
|
693
|
+
...display ? { display: display.map(({ logo, background_image,...displayRest }) => {
|
|
694
|
+
const { uri: logoUri,...logoRest } = logo ?? {};
|
|
695
|
+
const { uri: backgroundImageUri,...backgroundImageRest } = background_image ?? {};
|
|
696
|
+
return {
|
|
697
|
+
...displayRest,
|
|
698
|
+
...logoUri ? { logo: {
|
|
699
|
+
url: logoUri,
|
|
700
|
+
...logoRest
|
|
701
|
+
} } : {},
|
|
702
|
+
...backgroundImageUri ? { logo: {
|
|
703
|
+
url: backgroundImageUri,
|
|
704
|
+
...backgroundImageRest
|
|
705
|
+
} } : {}
|
|
706
|
+
};
|
|
707
|
+
}) } : {},
|
|
708
|
+
id
|
|
709
|
+
})).pipe(zod.default.union([
|
|
710
|
+
zLdpVcCredentialIssuerMetadataDraft14To11,
|
|
711
|
+
zJwtVcJsonCredentialIssuerMetadataDraft14To11,
|
|
712
|
+
zJwtVcJsonLdCredentialIssuerMetadataDraft14To11,
|
|
713
|
+
zod.default.object({ format: zod.default.string().refine((input) => ![
|
|
714
|
+
zLdpVcFormatIdentifier.value,
|
|
715
|
+
zJwtVcJsonFormatIdentifier.value,
|
|
716
|
+
zJwtVcJsonLdFormatIdentifier.value
|
|
717
|
+
].includes(input)) }).passthrough()
|
|
718
|
+
]));
|
|
719
|
+
const zCredentialIssuerMetadataDraft11To16 = zod.default.object({
|
|
720
|
+
authorization_server: zod.default.string().optional(),
|
|
721
|
+
credentials_supported: zod.default.array(zod.default.object({ id: zod.default.string().optional() }).passthrough())
|
|
722
|
+
}).passthrough().transform(({ authorization_server, credentials_supported,...rest }) => {
|
|
723
|
+
return {
|
|
724
|
+
...rest,
|
|
725
|
+
...authorization_server ? { authorization_servers: [authorization_server] } : {},
|
|
726
|
+
credential_configurations_supported: Object.fromEntries(credentials_supported.map((supported) => supported.id ? [supported.id, supported] : void 0).filter((i) => i !== void 0))
|
|
727
|
+
};
|
|
728
|
+
}).pipe(zod.default.object({ credential_configurations_supported: zod.default.record(zod.default.string(), zCredentialConfigurationSupportedDraft11To16) }).passthrough()).pipe(zCredentialIssuerMetadataDraft14Draft15Draft16);
|
|
729
|
+
const zCredentialIssuerMetadataWithDraft11 = zCredentialIssuerMetadataDraft14Draft15Draft16.transform((issuerMetadata) => ({
|
|
730
|
+
...issuerMetadata,
|
|
731
|
+
...issuerMetadata.authorization_servers ? { authorization_server: issuerMetadata.authorization_servers[0] } : {},
|
|
732
|
+
credentials_supported: Object.entries(issuerMetadata.credential_configurations_supported).map(([id, value]) => ({
|
|
733
|
+
...value,
|
|
734
|
+
id
|
|
735
|
+
}))
|
|
736
|
+
})).pipe(zCredentialIssuerMetadataDraft14Draft15Draft16.extend({ credentials_supported: zod.default.array(zCredentialConfigurationSupportedDraft16To11) }));
|
|
737
|
+
const zCredentialIssuerMetadata = zod.default.union([zCredentialIssuerMetadataDraft14Draft15Draft16, zCredentialIssuerMetadataDraft11To16]);
|
|
738
|
+
const zCredentialIssuerMetadataWithDraftVersion = zod.default.union([zCredentialIssuerMetadataDraft14Draft15Draft16.transform((credentialIssuerMetadata) => {
|
|
739
|
+
const credentialConfigurations = Object.values(credentialIssuerMetadata.credential_configurations_supported);
|
|
740
|
+
const isDraft15 = credentialConfigurations.some((configuration) => {
|
|
741
|
+
const knownConfiguration = configuration;
|
|
742
|
+
if (knownConfiguration.format === zSdJwtDcFormatIdentifier.value) return true;
|
|
743
|
+
if (Array.isArray(knownConfiguration.claims)) return true;
|
|
744
|
+
if (Object.values(knownConfiguration.proof_types_supported ?? {}).some((proofType) => proofType.key_attestations_required !== void 0)) return true;
|
|
745
|
+
return false;
|
|
746
|
+
});
|
|
747
|
+
return {
|
|
748
|
+
credentialIssuerMetadata,
|
|
749
|
+
originalDraftVersion: credentialConfigurations.some((configuration) => {
|
|
750
|
+
return configuration.credential_metadata;
|
|
751
|
+
}) ? Openid4vciDraftVersion.Draft16 : isDraft15 ? Openid4vciDraftVersion.Draft15 : Openid4vciDraftVersion.Draft14
|
|
752
|
+
};
|
|
753
|
+
}), zCredentialIssuerMetadataDraft11To16.transform((credentialIssuerMetadata) => ({
|
|
754
|
+
credentialIssuerMetadata,
|
|
755
|
+
originalDraftVersion: Openid4vciDraftVersion.Draft11
|
|
756
|
+
}))]);
|
|
1013
757
|
|
|
1014
|
-
|
|
1015
|
-
|
|
758
|
+
//#endregion
|
|
759
|
+
//#region src/metadata/credential-issuer/credential-issuer-metadata.ts
|
|
760
|
+
const wellKnownCredentialIssuerSuffix = ".well-known/openid-credential-issuer";
|
|
761
|
+
/**
|
|
762
|
+
* @inheritdoc {@link fetchWellKnownMetadata}
|
|
763
|
+
*/
|
|
1016
764
|
async function fetchCredentialIssuerMetadata(credentialIssuer, fetch) {
|
|
1017
|
-
|
|
1018
|
-
|
|
1019
|
-
|
|
1020
|
-
|
|
1021
|
-
`The 'credential_issuer' parameter '${result.credentialIssuerMetadata.credential_issuer}' in the well known credential issuer metadata at '${wellKnownMetadataUrl}' does not match the provided credential issuer '${credentialIssuer}'.`
|
|
1022
|
-
);
|
|
1023
|
-
}
|
|
1024
|
-
return result;
|
|
765
|
+
const wellKnownMetadataUrl = (0, __openid4vc_utils.joinUriParts)(credentialIssuer, [wellKnownCredentialIssuerSuffix]);
|
|
766
|
+
const result = await (0, __openid4vc_oauth2.fetchWellKnownMetadata)(wellKnownMetadataUrl, zCredentialIssuerMetadataWithDraftVersion, fetch);
|
|
767
|
+
if (result && result.credentialIssuerMetadata.credential_issuer !== credentialIssuer) throw new __openid4vc_oauth2.Oauth2Error(`The 'credential_issuer' parameter '${result.credentialIssuerMetadata.credential_issuer}' in the well known credential issuer metadata at '${wellKnownMetadataUrl}' does not match the provided credential issuer '${credentialIssuer}'.`);
|
|
768
|
+
return result;
|
|
1025
769
|
}
|
|
770
|
+
/**
|
|
771
|
+
* Extract credential configuration supported entries where the `format` is known to this
|
|
772
|
+
* library. Should be ran only after verifying the credential issuer metadata structure, so
|
|
773
|
+
* we can be certain that if the `format` matches the other format specific requirements are also met.
|
|
774
|
+
*
|
|
775
|
+
* Validation is done when resolving issuer metadata, or when calling `createIssuerMetadata`.
|
|
776
|
+
*/
|
|
1026
777
|
function extractKnownCredentialConfigurationSupportedFormats(credentialConfigurationsSupported) {
|
|
1027
|
-
|
|
1028
|
-
Object.entries(credentialConfigurationsSupported).filter(
|
|
1029
|
-
(entry) => allCredentialIssuerMetadataFormatIdentifiers.includes(entry[1].format)
|
|
1030
|
-
)
|
|
1031
|
-
);
|
|
778
|
+
return Object.fromEntries(Object.entries(credentialConfigurationsSupported).filter((entry) => allCredentialIssuerMetadataFormatIdentifiers.includes(entry[1].format)));
|
|
1032
779
|
}
|
|
1033
780
|
function getCredentialConfigurationSupportedById(credentialConfigurations, credentialConfigurationId) {
|
|
1034
|
-
|
|
1035
|
-
|
|
1036
|
-
|
|
1037
|
-
`Credential configuration with id '${credentialConfigurationId}' not found in credential configurations supported.`
|
|
1038
|
-
);
|
|
1039
|
-
}
|
|
1040
|
-
return configuration;
|
|
781
|
+
const configuration = credentialConfigurations[credentialConfigurationId];
|
|
782
|
+
if (!configuration) throw new __openid4vc_oauth2.Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' not found in credential configurations supported.`);
|
|
783
|
+
return configuration;
|
|
1041
784
|
}
|
|
1042
785
|
|
|
1043
|
-
|
|
1044
|
-
|
|
1045
|
-
|
|
1046
|
-
|
|
1047
|
-
|
|
1048
|
-
|
|
1049
|
-
|
|
1050
|
-
|
|
1051
|
-
|
|
1052
|
-
|
|
1053
|
-
|
|
1054
|
-
|
|
1055
|
-
|
|
1056
|
-
|
|
1057
|
-
|
|
1058
|
-
|
|
1059
|
-
|
|
1060
|
-
if (c.format === "vc+sd-jwt" && r.format === c.format) {
|
|
1061
|
-
if (r.vct && c.vct) {
|
|
1062
|
-
return r.vct === c.vct;
|
|
1063
|
-
}
|
|
1064
|
-
if (c.credential_definition && r.credential_definition) {
|
|
1065
|
-
return (0, import_utils6.arrayEqualsIgnoreOrder)(r.credential_definition.type, c.credential_definition.type);
|
|
1066
|
-
}
|
|
1067
|
-
}
|
|
1068
|
-
if (c.format === "mso_mdoc" && r.format === c.format) {
|
|
1069
|
-
return r.doctype === c.doctype;
|
|
1070
|
-
}
|
|
1071
|
-
return false;
|
|
1072
|
-
})
|
|
1073
|
-
);
|
|
786
|
+
//#endregion
|
|
787
|
+
//#region src/credential-request/credential-request-configurations.ts
|
|
788
|
+
function getCredentialConfigurationsMatchingRequestFormat({ requestFormat, credentialConfigurations }) {
|
|
789
|
+
const knownCredentialConfigurations = extractKnownCredentialConfigurationSupportedFormats(credentialConfigurations);
|
|
790
|
+
return Object.fromEntries(Object.entries(knownCredentialConfigurations).filter(([, credentialConfiguration]) => {
|
|
791
|
+
if (credentialConfiguration.format !== requestFormat.format) return false;
|
|
792
|
+
const r = requestFormat;
|
|
793
|
+
const c = credentialConfiguration;
|
|
794
|
+
if ((c.format === "ldp_vc" || c.format === "jwt_vc_json-ld") && r.format === c.format) return (0, __openid4vc_utils.arrayEqualsIgnoreOrder)(r.credential_definition.type, c.credential_definition.type) && (0, __openid4vc_utils.arrayEqualsIgnoreOrder)(r.credential_definition["@context"], c.credential_definition["@context"]);
|
|
795
|
+
if (c.format === "jwt_vc_json" && r.format === c.format) return (0, __openid4vc_utils.arrayEqualsIgnoreOrder)(r.credential_definition.type, c.credential_definition.type);
|
|
796
|
+
if (c.format === "vc+sd-jwt" && r.format === c.format) {
|
|
797
|
+
if (r.vct && c.vct) return r.vct === c.vct;
|
|
798
|
+
if (c.credential_definition && r.credential_definition) return (0, __openid4vc_utils.arrayEqualsIgnoreOrder)(r.credential_definition.type, c.credential_definition.type);
|
|
799
|
+
}
|
|
800
|
+
if (c.format === "mso_mdoc" && r.format === c.format) return r.doctype === c.doctype;
|
|
801
|
+
return false;
|
|
802
|
+
}));
|
|
1074
803
|
}
|
|
1075
804
|
|
|
1076
|
-
|
|
805
|
+
//#endregion
|
|
806
|
+
//#region src/error/Openid4vciError.ts
|
|
1077
807
|
var Openid4vciError = class extends Error {
|
|
1078
|
-
|
|
1079
|
-
|
|
1080
|
-
|
|
1081
|
-
|
|
1082
|
-
|
|
1083
|
-
|
|
808
|
+
constructor(message, options) {
|
|
809
|
+
const errorMessage = message ?? "Unknown error occured.";
|
|
810
|
+
const causeMessage = options?.cause instanceof Error ? ` ${options.cause.message}` : options?.cause ? ` ${options?.cause}` : "";
|
|
811
|
+
super(`${errorMessage}${causeMessage}`);
|
|
812
|
+
this.cause = options?.cause;
|
|
813
|
+
}
|
|
1084
814
|
};
|
|
1085
815
|
|
|
1086
|
-
|
|
1087
|
-
|
|
816
|
+
//#endregion
|
|
817
|
+
//#region src/error/Openid4vciRetrieveCredentialsError.ts
|
|
1088
818
|
var Openid4vciRetrieveCredentialsError = class extends Openid4vciError {
|
|
1089
|
-
|
|
1090
|
-
|
|
1091
|
-
|
|
1092
|
-
|
|
1093
|
-
|
|
1094
|
-
}
|
|
819
|
+
constructor(message, response, responseText) {
|
|
820
|
+
const errorData = response.credentialResponseResult?.data ?? response.credentialErrorResponseResult?.data ?? (response.credentialResponseResult?.error ? (0, __openid4vc_utils.formatZodError)(response.credentialResponseResult.error) : void 0) ?? responseText;
|
|
821
|
+
super(`${message}\n${JSON.stringify(errorData, null, 2)}`);
|
|
822
|
+
this.response = response;
|
|
823
|
+
}
|
|
1095
824
|
};
|
|
1096
825
|
|
|
1097
|
-
|
|
826
|
+
//#endregion
|
|
827
|
+
//#region src/error/Openid4vciSendNotificationError.ts
|
|
1098
828
|
var Openid4vciSendNotificationError = class extends Openid4vciError {
|
|
1099
|
-
|
|
1100
|
-
|
|
1101
|
-
|
|
1102
|
-
|
|
829
|
+
constructor(message, response) {
|
|
830
|
+
super(message);
|
|
831
|
+
this.response = response;
|
|
832
|
+
}
|
|
1103
833
|
};
|
|
1104
834
|
|
|
1105
|
-
|
|
1106
|
-
|
|
1107
|
-
var import_oauth27 = require("@openid4vc/oauth2");
|
|
1108
|
-
var import_utils8 = require("@openid4vc/utils");
|
|
835
|
+
//#endregion
|
|
836
|
+
//#region src/key-attestation/key-attestation.ts
|
|
1109
837
|
async function createKeyAttestationJwt(options) {
|
|
1110
|
-
|
|
1111
|
-
|
|
1112
|
-
|
|
1113
|
-
|
|
1114
|
-
|
|
1115
|
-
|
|
1116
|
-
|
|
1117
|
-
|
|
1118
|
-
|
|
1119
|
-
|
|
1120
|
-
|
|
1121
|
-
|
|
1122
|
-
|
|
1123
|
-
|
|
1124
|
-
|
|
1125
|
-
|
|
838
|
+
const header = (0, __openid4vc_utils.parseWithErrorHandling)(zKeyAttestationJwtHeader, {
|
|
839
|
+
...(0, __openid4vc_oauth2.jwtHeaderFromJwtSigner)(options.signer),
|
|
840
|
+
typ: "keyattestation+jwt"
|
|
841
|
+
});
|
|
842
|
+
const payload = (0, __openid4vc_utils.parseWithErrorHandling)(zKeyAttestationJwtPayloadForUse(options.use), {
|
|
843
|
+
iat: (0, __openid4vc_utils.dateToSeconds)(options.issuedAt),
|
|
844
|
+
exp: options.expiresAt ? (0, __openid4vc_utils.dateToSeconds)(options.expiresAt) : void 0,
|
|
845
|
+
nonce: options.nonce,
|
|
846
|
+
attested_keys: options.attestedKeys,
|
|
847
|
+
user_authentication: options.userAuthentication,
|
|
848
|
+
key_storage: options.keyStorage,
|
|
849
|
+
certification: options.certification,
|
|
850
|
+
...options.additionalPayload
|
|
851
|
+
});
|
|
852
|
+
const { jwt } = await options.callbacks.signJwt(options.signer, {
|
|
853
|
+
header,
|
|
854
|
+
payload
|
|
855
|
+
});
|
|
856
|
+
return jwt;
|
|
1126
857
|
}
|
|
1127
858
|
function parseKeyAttestationJwt({ keyAttestationJwt, use }) {
|
|
1128
|
-
|
|
1129
|
-
|
|
1130
|
-
|
|
1131
|
-
|
|
1132
|
-
|
|
859
|
+
return (0, __openid4vc_oauth2.decodeJwt)({
|
|
860
|
+
jwt: keyAttestationJwt,
|
|
861
|
+
headerSchema: zKeyAttestationJwtHeader,
|
|
862
|
+
payloadSchema: zKeyAttestationJwtPayloadForUse(use)
|
|
863
|
+
});
|
|
1133
864
|
}
|
|
1134
865
|
async function verifyKeyAttestationJwt(options) {
|
|
1135
|
-
|
|
1136
|
-
|
|
1137
|
-
|
|
1138
|
-
|
|
1139
|
-
|
|
1140
|
-
|
|
1141
|
-
|
|
1142
|
-
|
|
1143
|
-
|
|
1144
|
-
|
|
1145
|
-
|
|
1146
|
-
|
|
1147
|
-
|
|
1148
|
-
|
|
1149
|
-
|
|
1150
|
-
|
|
1151
|
-
|
|
1152
|
-
|
|
1153
|
-
|
|
1154
|
-
|
|
866
|
+
const { header, payload } = parseKeyAttestationJwt({
|
|
867
|
+
keyAttestationJwt: options.keyAttestationJwt,
|
|
868
|
+
use: options.use
|
|
869
|
+
});
|
|
870
|
+
const now = options.now?.getTime() ?? Date.now();
|
|
871
|
+
if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) throw new Openid4vciError("Nonce used for key attestation jwt expired");
|
|
872
|
+
const { signer } = await (0, __openid4vc_oauth2.verifyJwt)({
|
|
873
|
+
compact: options.keyAttestationJwt,
|
|
874
|
+
header,
|
|
875
|
+
payload,
|
|
876
|
+
signer: (0, __openid4vc_oauth2.jwtSignerFromJwt)({
|
|
877
|
+
header,
|
|
878
|
+
payload
|
|
879
|
+
}),
|
|
880
|
+
verifyJwtCallback: options.callbacks.verifyJwt,
|
|
881
|
+
errorMessage: "Error verifiying key attestation jwt",
|
|
882
|
+
expectedNonce: options.expectedNonce,
|
|
883
|
+
now: options.now
|
|
884
|
+
});
|
|
885
|
+
return {
|
|
886
|
+
header,
|
|
887
|
+
payload,
|
|
888
|
+
signer
|
|
889
|
+
};
|
|
1155
890
|
}
|
|
1156
891
|
|
|
1157
|
-
|
|
1158
|
-
|
|
1159
|
-
var import_utils9 = require("@openid4vc/utils");
|
|
892
|
+
//#endregion
|
|
893
|
+
//#region src/metadata/credential-issuer/credential-configurations.ts
|
|
1160
894
|
function extractScopesForCredentialConfigurationIds(options) {
|
|
1161
|
-
|
|
1162
|
-
|
|
1163
|
-
|
|
1164
|
-
|
|
1165
|
-
|
|
1166
|
-
|
|
1167
|
-
|
|
1168
|
-
|
|
1169
|
-
|
|
1170
|
-
if (scope) scopes.add(scope);
|
|
1171
|
-
else if (!scope && options.throwOnConfigurationWithoutScope) {
|
|
1172
|
-
throw new import_oauth28.Oauth2Error(
|
|
1173
|
-
`Credential configuration with id '${credentialConfigurationId}' does not have a 'scope' configured, and 'throwOnConfigurationWithoutScope' was enabled.`
|
|
1174
|
-
);
|
|
1175
|
-
}
|
|
1176
|
-
}
|
|
1177
|
-
return scopes.size > 0 ? Array.from(scopes) : void 0;
|
|
895
|
+
const scopes = /* @__PURE__ */ new Set();
|
|
896
|
+
for (const credentialConfigurationId of options.credentialConfigurationIds) {
|
|
897
|
+
const credentialConfiguration = options.issuerMetadata.credentialIssuer.credential_configurations_supported[credentialConfigurationId];
|
|
898
|
+
if (!credentialConfiguration) throw new __openid4vc_oauth2.Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' not found in metadata from credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`);
|
|
899
|
+
const scope = credentialConfiguration.scope;
|
|
900
|
+
if (scope) scopes.add(scope);
|
|
901
|
+
else if (!scope && options.throwOnConfigurationWithoutScope) throw new __openid4vc_oauth2.Oauth2Error(`Credential configuration with id '${credentialConfigurationId}' does not have a 'scope' configured, and 'throwOnConfigurationWithoutScope' was enabled.`);
|
|
902
|
+
}
|
|
903
|
+
return scopes.size > 0 ? Array.from(scopes) : void 0;
|
|
1178
904
|
}
|
|
905
|
+
/**
|
|
906
|
+
* Transforms draft 11 credentials supported syntax to credential configurations supported
|
|
907
|
+
*
|
|
908
|
+
* @throws if a credentials supported entry without id is passed
|
|
909
|
+
* @throws if a credentials supported entry with invalid structure or format specific properties is passed
|
|
910
|
+
*/
|
|
1179
911
|
function credentialsSupportedToCredentialConfigurationsSupported(credentialsSupported) {
|
|
1180
|
-
|
|
1181
|
-
|
|
1182
|
-
|
|
1183
|
-
|
|
1184
|
-
|
|
1185
|
-
|
|
1186
|
-
|
|
1187
|
-
|
|
1188
|
-
|
|
1189
|
-
if (!parseResult.success) {
|
|
1190
|
-
throw new import_utils9.ValidationError(
|
|
1191
|
-
`Error transforming credential supported with id '${credentialSupported.id}' to credential configuration supported format`,
|
|
1192
|
-
parseResult.error
|
|
1193
|
-
);
|
|
1194
|
-
}
|
|
1195
|
-
credentialConfigurationsSupported[credentialSupported.id] = parseResult.data;
|
|
1196
|
-
}
|
|
1197
|
-
return credentialConfigurationsSupported;
|
|
912
|
+
const credentialConfigurationsSupported = {};
|
|
913
|
+
for (let index = 0; index < credentialsSupported.length; index++) {
|
|
914
|
+
const credentialSupported = credentialsSupported[index];
|
|
915
|
+
if (!credentialSupported.id) throw new Openid4vciError(`Credential supported at index '${index}' does not have an 'id' property. Credential configuration requires the 'id' property as key`);
|
|
916
|
+
const parseResult = zCredentialConfigurationSupportedDraft11To16.safeParse(credentialSupported);
|
|
917
|
+
if (!parseResult.success) throw new __openid4vc_utils.ValidationError(`Error transforming credential supported with id '${credentialSupported.id}' to credential configuration supported format`, parseResult.error);
|
|
918
|
+
credentialConfigurationsSupported[credentialSupported.id] = parseResult.data;
|
|
919
|
+
}
|
|
920
|
+
return credentialConfigurationsSupported;
|
|
1198
921
|
}
|
|
1199
922
|
|
|
1200
|
-
|
|
1201
|
-
|
|
1202
|
-
|
|
1203
|
-
// src/credential-request/format-payload.ts
|
|
1204
|
-
var import_utils10 = require("@openid4vc/utils");
|
|
923
|
+
//#endregion
|
|
924
|
+
//#region src/credential-request/format-payload.ts
|
|
1205
925
|
function getCredentialRequestFormatPayloadForCredentialConfigurationId(options) {
|
|
1206
|
-
|
|
1207
|
-
|
|
1208
|
-
|
|
1209
|
-
|
|
1210
|
-
|
|
1211
|
-
|
|
1212
|
-
|
|
1213
|
-
|
|
1214
|
-
|
|
1215
|
-
|
|
1216
|
-
|
|
1217
|
-
|
|
1218
|
-
|
|
1219
|
-
|
|
1220
|
-
|
|
1221
|
-
|
|
1222
|
-
|
|
1223
|
-
|
|
1224
|
-
|
|
1225
|
-
|
|
1226
|
-
|
|
1227
|
-
|
|
1228
|
-
|
|
1229
|
-
|
|
1230
|
-
|
|
1231
|
-
|
|
1232
|
-
|
|
1233
|
-
|
|
1234
|
-
|
|
1235
|
-
|
|
1236
|
-
|
|
1237
|
-
|
|
1238
|
-
|
|
1239
|
-
}
|
|
1240
|
-
if ((0, import_utils10.zIs)(zJwtVcJsonCredentialIssuerMetadata, credentialConfiguration) || (0, import_utils10.zIs)(zJwtVcJsonCredentialIssuerMetadataDraft14, credentialConfiguration)) {
|
|
1241
|
-
return {
|
|
1242
|
-
format: credentialConfiguration.format,
|
|
1243
|
-
credential_definition: {
|
|
1244
|
-
type: credentialConfiguration.credential_definition.type
|
|
1245
|
-
}
|
|
1246
|
-
};
|
|
1247
|
-
}
|
|
1248
|
-
if ((0, import_utils10.zIs)(zSdJwtDcCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1249
|
-
throw new Openid4vciError(
|
|
1250
|
-
`Credential configuration id '${options.credentialConfigurationId}' with format ${zLegacySdJwtVcFormatIdentifier.value} does not support credential request based on 'format'. Use 'credential_configuration_id' directly.`
|
|
1251
|
-
);
|
|
1252
|
-
}
|
|
1253
|
-
if ((0, import_utils10.zIs)(zSdJwtW3VcCredentialIssuerMetadata, credentialConfiguration)) {
|
|
1254
|
-
return {
|
|
1255
|
-
format: credentialConfiguration.format,
|
|
1256
|
-
credential_definition: {
|
|
1257
|
-
type: credentialConfiguration.credential_definition.type
|
|
1258
|
-
}
|
|
1259
|
-
};
|
|
1260
|
-
}
|
|
1261
|
-
throw new Openid4vciError(
|
|
1262
|
-
`Unknown format '${credentialConfiguration.format}' in credential configuration with id '${options.credentialConfigurationId}' for credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`
|
|
1263
|
-
);
|
|
926
|
+
const credentialConfiguration = getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, options.credentialConfigurationId);
|
|
927
|
+
if ((0, __openid4vc_utils.zIs)(zLegacySdJwtVcCredentialIssuerMetadataDraft16, credentialConfiguration) || (0, __openid4vc_utils.zIs)(zLegacySdJwtVcCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
|
|
928
|
+
format: credentialConfiguration.format,
|
|
929
|
+
vct: credentialConfiguration.vct
|
|
930
|
+
};
|
|
931
|
+
if ((0, __openid4vc_utils.zIs)(zMsoMdocCredentialIssuerMetadata, credentialConfiguration) || (0, __openid4vc_utils.zIs)(zMsoMdocCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
|
|
932
|
+
format: credentialConfiguration.format,
|
|
933
|
+
doctype: credentialConfiguration.doctype
|
|
934
|
+
};
|
|
935
|
+
if ((0, __openid4vc_utils.zIs)(zLdpVcCredentialIssuerMetadata, credentialConfiguration) || (0, __openid4vc_utils.zIs)(zLdpVcCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
|
|
936
|
+
format: credentialConfiguration.format,
|
|
937
|
+
credential_definition: {
|
|
938
|
+
"@context": credentialConfiguration.credential_definition["@context"],
|
|
939
|
+
type: credentialConfiguration.credential_definition.type
|
|
940
|
+
}
|
|
941
|
+
};
|
|
942
|
+
if ((0, __openid4vc_utils.zIs)(zJwtVcJsonLdCredentialIssuerMetadata, credentialConfiguration) || (0, __openid4vc_utils.zIs)(zJwtVcJsonLdCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
|
|
943
|
+
format: credentialConfiguration.format,
|
|
944
|
+
credential_definition: {
|
|
945
|
+
"@context": credentialConfiguration.credential_definition["@context"],
|
|
946
|
+
type: credentialConfiguration.credential_definition.type
|
|
947
|
+
}
|
|
948
|
+
};
|
|
949
|
+
if ((0, __openid4vc_utils.zIs)(zJwtVcJsonCredentialIssuerMetadata, credentialConfiguration) || (0, __openid4vc_utils.zIs)(zJwtVcJsonCredentialIssuerMetadataDraft14, credentialConfiguration)) return {
|
|
950
|
+
format: credentialConfiguration.format,
|
|
951
|
+
credential_definition: { type: credentialConfiguration.credential_definition.type }
|
|
952
|
+
};
|
|
953
|
+
if ((0, __openid4vc_utils.zIs)(zSdJwtDcCredentialIssuerMetadata, credentialConfiguration)) throw new Openid4vciError(`Credential configuration id '${options.credentialConfigurationId}' with format ${zLegacySdJwtVcFormatIdentifier.value} does not support credential request based on 'format'. Use 'credential_configuration_id' directly.`);
|
|
954
|
+
if ((0, __openid4vc_utils.zIs)(zSdJwtW3VcCredentialIssuerMetadata, credentialConfiguration)) return {
|
|
955
|
+
format: credentialConfiguration.format,
|
|
956
|
+
credential_definition: { type: credentialConfiguration.credential_definition.type }
|
|
957
|
+
};
|
|
958
|
+
throw new Openid4vciError(`Unknown format '${credentialConfiguration.format}' in credential configuration with id '${options.credentialConfigurationId}' for credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`);
|
|
1264
959
|
}
|
|
1265
960
|
|
|
1266
|
-
|
|
1267
|
-
|
|
1268
|
-
|
|
1269
|
-
|
|
1270
|
-
|
|
1271
|
-
|
|
1272
|
-
|
|
1273
|
-
|
|
1274
|
-
// src/credential-request/z-credential-request-common.ts
|
|
1275
|
-
var import_oauth211 = require("@openid4vc/oauth2");
|
|
1276
|
-
var import_zod16 = __toESM(require("zod"));
|
|
1277
|
-
|
|
1278
|
-
// src/formats/proof-type/jwt/z-jwt-proof-type.ts
|
|
1279
|
-
var import_oauth29 = require("@openid4vc/oauth2");
|
|
1280
|
-
var import_utils11 = require("@openid4vc/utils");
|
|
1281
|
-
var import_zod14 = __toESM(require("zod"));
|
|
1282
|
-
var zJwtProofTypeIdentifier = import_zod14.default.literal("jwt");
|
|
1283
|
-
var jwtProofTypeIdentifier = zJwtProofTypeIdentifier.value;
|
|
1284
|
-
var zCredentialRequestProofJwt = import_zod14.default.object({
|
|
1285
|
-
proof_type: zJwtProofTypeIdentifier,
|
|
1286
|
-
jwt: import_oauth29.zCompactJwt
|
|
961
|
+
//#endregion
|
|
962
|
+
//#region src/formats/proof-type/attestation/z-attestation-proof-type.ts
|
|
963
|
+
const zAttestationProofTypeIdentifier = zod.default.literal("attestation");
|
|
964
|
+
const attestationProofTypeIdentifier = zAttestationProofTypeIdentifier.value;
|
|
965
|
+
const zCredentialRequestProofAttestation = zod.default.object({
|
|
966
|
+
proof_type: zAttestationProofTypeIdentifier,
|
|
967
|
+
attestation: __openid4vc_oauth2.zCompactJwt
|
|
1287
968
|
});
|
|
1288
|
-
|
|
1289
|
-
import_zod14.default.object({
|
|
1290
|
-
key_attestation: import_zod14.default.optional(import_oauth29.zCompactJwt),
|
|
1291
|
-
typ: import_zod14.default.literal("openid4vci-proof+jwt")
|
|
1292
|
-
})
|
|
1293
|
-
).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, {
|
|
1294
|
-
message: `Both 'jwk' and 'kid' are defined. Only one is allowed`
|
|
1295
|
-
}).refine(({ trust_chain, kid }) => !trust_chain || !kid, {
|
|
1296
|
-
message: `When 'trust_chain' is provided, 'kid' is required`
|
|
1297
|
-
});
|
|
1298
|
-
var zCredentialRequestJwtProofTypePayload = import_zod14.default.object({
|
|
1299
|
-
...import_oauth29.zJwtPayload.shape,
|
|
1300
|
-
aud: import_utils11.zHttpsUrl,
|
|
1301
|
-
iat: import_utils11.zInteger
|
|
1302
|
-
}).passthrough();
|
|
969
|
+
const zCredentialRequestAttestationProofTypePayload = zKeyAttestationJwtPayloadForUse("proof_type.attestation");
|
|
1303
970
|
|
|
1304
|
-
|
|
1305
|
-
|
|
1306
|
-
|
|
1307
|
-
|
|
1308
|
-
|
|
1309
|
-
|
|
1310
|
-
|
|
1311
|
-
attestation: import_oauth210.zCompactJwt
|
|
971
|
+
//#endregion
|
|
972
|
+
//#region src/formats/proof-type/jwt/z-jwt-proof-type.ts
|
|
973
|
+
const zJwtProofTypeIdentifier = zod.default.literal("jwt");
|
|
974
|
+
const jwtProofTypeIdentifier = zJwtProofTypeIdentifier.value;
|
|
975
|
+
const zCredentialRequestProofJwt = zod.default.object({
|
|
976
|
+
proof_type: zJwtProofTypeIdentifier,
|
|
977
|
+
jwt: __openid4vc_oauth2.zCompactJwt
|
|
1312
978
|
});
|
|
1313
|
-
|
|
1314
|
-
|
|
1315
|
-
|
|
1316
|
-
|
|
1317
|
-
|
|
979
|
+
const zCredentialRequestJwtProofTypeHeader = __openid4vc_oauth2.zJwtHeader.merge(zod.default.object({
|
|
980
|
+
key_attestation: zod.default.optional(__openid4vc_oauth2.zCompactJwt),
|
|
981
|
+
typ: zod.default.literal("openid4vci-proof+jwt")
|
|
982
|
+
})).passthrough().refine(({ kid, jwk }) => jwk === void 0 || kid === void 0, { message: `Both 'jwk' and 'kid' are defined. Only one is allowed` }).refine(({ trust_chain, kid }) => !trust_chain || !kid, { message: `When 'trust_chain' is provided, 'kid' is required` });
|
|
983
|
+
const zCredentialRequestJwtProofTypePayload = zod.default.object({
|
|
984
|
+
...__openid4vc_oauth2.zJwtPayload.shape,
|
|
985
|
+
aud: __openid4vc_utils.zHttpsUrl,
|
|
986
|
+
iat: __openid4vc_utils.zInteger
|
|
1318
987
|
}).passthrough();
|
|
1319
|
-
|
|
1320
|
-
|
|
1321
|
-
|
|
1322
|
-
|
|
1323
|
-
]
|
|
1324
|
-
|
|
1325
|
-
|
|
1326
|
-
|
|
1327
|
-
|
|
1328
|
-
|
|
1329
|
-
var zCredentialRequestCommon = import_zod16.default.object({
|
|
1330
|
-
proof: zCredentialRequestProof.optional(),
|
|
1331
|
-
proofs: import_zod16.default.optional(
|
|
1332
|
-
import_zod16.default.intersection(zCredentialRequestProofsCommon, zCredentialRequestProofs).refine((proofs) => Object.values(proofs).length === 1, {
|
|
1333
|
-
message: `The 'proofs' object in a credential request should contain exactly one attribute`
|
|
1334
|
-
})
|
|
1335
|
-
),
|
|
1336
|
-
credential_response_encryption: import_zod16.default.object({
|
|
1337
|
-
jwk: import_oauth211.zJwk,
|
|
1338
|
-
alg: import_zod16.default.string(),
|
|
1339
|
-
enc: import_zod16.default.string()
|
|
1340
|
-
}).passthrough().optional()
|
|
1341
|
-
}).passthrough().refine(({ proof, proofs }) => !(proof !== void 0 && proofs !== void 0), {
|
|
1342
|
-
message: `Both 'proof' and 'proofs' are defined. Only one is allowed`
|
|
988
|
+
|
|
989
|
+
//#endregion
|
|
990
|
+
//#region src/credential-request/z-credential-request-common.ts
|
|
991
|
+
const zCredentialRequestProofCommon = zod.default.object({ proof_type: zod.default.string() }).passthrough();
|
|
992
|
+
const allCredentialRequestProofs = [zCredentialRequestProofJwt, zCredentialRequestProofAttestation];
|
|
993
|
+
const zCredentialRequestProof = zod.default.union([zCredentialRequestProofCommon, zod.default.discriminatedUnion("proof_type", allCredentialRequestProofs)]);
|
|
994
|
+
const zCredentialRequestProofsCommon = zod.default.record(zod.default.string(), zod.default.array(zod.default.unknown()));
|
|
995
|
+
const zCredentialRequestProofs = zod.default.object({
|
|
996
|
+
[zJwtProofTypeIdentifier.value]: zod.default.optional(zod.default.array(zCredentialRequestProofJwt.shape.jwt)),
|
|
997
|
+
[zAttestationProofTypeIdentifier.value]: zod.default.optional(zod.default.array(zCredentialRequestProofAttestation.shape.attestation))
|
|
1343
998
|
});
|
|
999
|
+
const zCredentialRequestCommon = zod.default.object({
|
|
1000
|
+
proof: zCredentialRequestProof.optional(),
|
|
1001
|
+
proofs: zod.default.optional(zod.default.intersection(zCredentialRequestProofsCommon, zCredentialRequestProofs).refine((proofs) => Object.values(proofs).length === 1, { message: `The 'proofs' object in a credential request should contain exactly one attribute` })),
|
|
1002
|
+
credential_response_encryption: zod.default.object({
|
|
1003
|
+
jwk: __openid4vc_oauth2.zJwk,
|
|
1004
|
+
alg: zod.default.string(),
|
|
1005
|
+
enc: zod.default.string()
|
|
1006
|
+
}).passthrough().optional()
|
|
1007
|
+
}).passthrough().refine(({ proof, proofs }) => !(proof !== void 0 && proofs !== void 0), { message: `Both 'proof' and 'proofs' are defined. Only one is allowed` });
|
|
1344
1008
|
|
|
1345
|
-
|
|
1346
|
-
|
|
1347
|
-
|
|
1348
|
-
|
|
1349
|
-
|
|
1350
|
-
|
|
1351
|
-
|
|
1352
|
-
|
|
1009
|
+
//#endregion
|
|
1010
|
+
//#region src/credential-request/z-credential-request.ts
|
|
1011
|
+
const allCredentialRequestFormats = [
|
|
1012
|
+
zSdJwtW3VcCredentialRequestFormatDraft14,
|
|
1013
|
+
zMsoMdocCredentialRequestFormatDraft14,
|
|
1014
|
+
zLdpVcCredentialRequestFormatDraft14,
|
|
1015
|
+
zJwtVcJsonLdCredentialRequestFormatDraft14,
|
|
1016
|
+
zJwtVcJsonCredentialRequestFormatDraft14,
|
|
1017
|
+
zLegacySdJwtVcCredentialRequestFormatDraft14
|
|
1353
1018
|
];
|
|
1354
|
-
|
|
1355
|
-
|
|
1356
|
-
)
|
|
1357
|
-
|
|
1358
|
-
|
|
1359
|
-
format: import_zod17.default.never({ message: "'format' cannot be defined when 'credential_configuration_id' is set." }).optional(),
|
|
1360
|
-
credential_identifier: import_zod17.default.never({ message: "'credential_identifier' cannot be defined when 'credential_configuration_id' is set." }).optional()
|
|
1019
|
+
const allCredentialRequestFormatIdentifiers = allCredentialRequestFormats.map((format) => format.shape.format.value);
|
|
1020
|
+
const zCredentialRequestCredentialConfigurationId = zod.default.object({
|
|
1021
|
+
credential_configuration_id: zod.default.string(),
|
|
1022
|
+
format: zod.default.never({ message: "'format' cannot be defined when 'credential_configuration_id' is set." }).optional(),
|
|
1023
|
+
credential_identifier: zod.default.never({ message: "'credential_identifier' cannot be defined when 'credential_configuration_id' is set." }).optional()
|
|
1361
1024
|
});
|
|
1362
|
-
|
|
1363
|
-
|
|
1364
|
-
|
|
1365
|
-
|
|
1366
|
-
format: import_zod17.default.never({ message: "'format' cannot be defined when 'credential_identifier' is set." }).optional()
|
|
1025
|
+
const zAuthorizationDetailsCredentialRequest = zod.default.object({
|
|
1026
|
+
credential_identifier: zod.default.string(),
|
|
1027
|
+
credential_configuration_id: zod.default.never({ message: "'credential_configuration_id' cannot be defined when 'credential_identifier' is set." }).optional(),
|
|
1028
|
+
format: zod.default.never({ message: "'format' cannot be defined when 'credential_identifier' is set." }).optional()
|
|
1367
1029
|
});
|
|
1368
|
-
|
|
1369
|
-
|
|
1370
|
-
|
|
1371
|
-
|
|
1030
|
+
const zCredentialRequestFormat = zod.default.object({
|
|
1031
|
+
format: zod.default.string(),
|
|
1032
|
+
credential_identifier: zod.default.never({ message: "'credential_identifier' cannot be defined when 'format' is set." }).optional(),
|
|
1033
|
+
credential_configuration_id: zod.default.never({ message: "'credential_configuration_id' cannot be defined when 'format' is set." }).optional()
|
|
1372
1034
|
}).passthrough();
|
|
1373
|
-
|
|
1374
|
-
|
|
1375
|
-
|
|
1376
|
-
|
|
1377
|
-
|
|
1378
|
-
|
|
1379
|
-
if (result.success) {
|
|
1380
|
-
return result.data;
|
|
1381
|
-
}
|
|
1382
|
-
for (const issue of result.error.issues) {
|
|
1383
|
-
ctx.addIssue(issue);
|
|
1384
|
-
}
|
|
1385
|
-
return import_zod17.default.NEVER;
|
|
1035
|
+
const zCredentialRequestDraft14WithFormat = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
|
|
1036
|
+
if (!allCredentialRequestFormatIdentifiers.includes(data.format)) return data;
|
|
1037
|
+
const result = zod.default.object({}).passthrough().and(zod.default.union(allCredentialRequestFormats)).safeParse(data);
|
|
1038
|
+
if (result.success) return result.data;
|
|
1039
|
+
for (const issue of result.error.issues) ctx.addIssue(issue);
|
|
1040
|
+
return zod.default.NEVER;
|
|
1386
1041
|
});
|
|
1387
|
-
|
|
1388
|
-
|
|
1389
|
-
|
|
1390
|
-
|
|
1391
|
-
|
|
1392
|
-
|
|
1393
|
-
|
|
1394
|
-
|
|
1395
|
-
|
|
1396
|
-
|
|
1397
|
-
|
|
1398
|
-
|
|
1399
|
-
|
|
1400
|
-
};
|
|
1401
|
-
if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
|
|
1402
|
-
const schema = formatSpecificTransformations[data.format];
|
|
1403
|
-
const result = schema.safeParse(data);
|
|
1404
|
-
if (result.success) return result.data;
|
|
1405
|
-
for (const issue of result.error.issues) {
|
|
1406
|
-
ctx.addIssue(issue);
|
|
1407
|
-
}
|
|
1408
|
-
return import_zod17.default.NEVER;
|
|
1042
|
+
const zCredentialRequestDraft15 = zod.default.union([zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest), zCredentialRequestCommon.and(zCredentialRequestCredentialConfigurationId)]);
|
|
1043
|
+
const zCredentialRequestDraft14 = zod.default.union([zCredentialRequestDraft14WithFormat, zCredentialRequestCommon.and(zAuthorizationDetailsCredentialRequest)]);
|
|
1044
|
+
const zCredentialRequestDraft11To14 = zCredentialRequestCommon.and(zCredentialRequestFormat).transform((data, ctx) => {
|
|
1045
|
+
const formatSpecificTransformations = {
|
|
1046
|
+
[zLdpVcFormatIdentifier.value]: zLdpVcCredentialRequestDraft11To14,
|
|
1047
|
+
[zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialRequestDraft11To14,
|
|
1048
|
+
[zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialRequestDraft11To14
|
|
1049
|
+
};
|
|
1050
|
+
if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
|
|
1051
|
+
const result = formatSpecificTransformations[data.format].safeParse(data);
|
|
1052
|
+
if (result.success) return result.data;
|
|
1053
|
+
for (const issue of result.error.issues) ctx.addIssue(issue);
|
|
1054
|
+
return zod.default.NEVER;
|
|
1409
1055
|
}).pipe(zCredentialRequestDraft14);
|
|
1410
|
-
|
|
1411
|
-
|
|
1412
|
-
|
|
1413
|
-
|
|
1414
|
-
|
|
1415
|
-
|
|
1416
|
-
|
|
1417
|
-
|
|
1418
|
-
|
|
1419
|
-
|
|
1420
|
-
|
|
1421
|
-
const result = schema.safeParse(data);
|
|
1422
|
-
if (result.success) return result.data;
|
|
1423
|
-
for (const issue of result.error.issues) {
|
|
1424
|
-
ctx.addIssue(issue);
|
|
1425
|
-
}
|
|
1426
|
-
return import_zod17.default.NEVER;
|
|
1056
|
+
const zCredentialRequestDraft14To11 = zCredentialRequestDraft14.refine((data) => data.credential_identifier === void 0, `'credential_identifier' is not supported in OpenID4VCI draft 11`).transform((data, ctx) => {
|
|
1057
|
+
const formatSpecificTransformations = {
|
|
1058
|
+
[zLdpVcFormatIdentifier.value]: zLdpVcCredentialRequestDraft14To11,
|
|
1059
|
+
[zJwtVcJsonFormatIdentifier.value]: zJwtVcJsonCredentialRequestDraft14To11,
|
|
1060
|
+
[zJwtVcJsonLdFormatIdentifier.value]: zJwtVcJsonLdCredentialRequestDraft14To11
|
|
1061
|
+
};
|
|
1062
|
+
if (!Object.keys(formatSpecificTransformations).includes(data.format)) return data;
|
|
1063
|
+
const result = formatSpecificTransformations[data.format].safeParse(data);
|
|
1064
|
+
if (result.success) return result.data;
|
|
1065
|
+
for (const issue of result.error.issues) ctx.addIssue(issue);
|
|
1066
|
+
return zod.default.NEVER;
|
|
1427
1067
|
});
|
|
1428
|
-
|
|
1429
|
-
|
|
1430
|
-
|
|
1431
|
-
|
|
1068
|
+
const zCredentialRequest = zod.default.union([
|
|
1069
|
+
zCredentialRequestDraft15,
|
|
1070
|
+
zCredentialRequestDraft14,
|
|
1071
|
+
zCredentialRequestDraft11To14
|
|
1432
1072
|
]);
|
|
1433
|
-
|
|
1434
|
-
|
|
1435
|
-
|
|
1436
|
-
|
|
1437
|
-
|
|
1438
|
-
|
|
1439
|
-
|
|
1073
|
+
const zDeferredCredentialRequest = zod.default.object({
|
|
1074
|
+
transaction_id: zod.default.string().nonempty(),
|
|
1075
|
+
credential_response_encryption: zod.default.object({
|
|
1076
|
+
jwk: __openid4vc_oauth2.zJwk,
|
|
1077
|
+
alg: zod.default.string(),
|
|
1078
|
+
enc: zod.default.string()
|
|
1079
|
+
}).passthrough().optional()
|
|
1440
1080
|
});
|
|
1441
1081
|
|
|
1442
|
-
|
|
1443
|
-
|
|
1444
|
-
|
|
1445
|
-
|
|
1446
|
-
|
|
1447
|
-
|
|
1448
|
-
|
|
1449
|
-
|
|
1450
|
-
|
|
1451
|
-
|
|
1452
|
-
|
|
1453
|
-
|
|
1454
|
-
|
|
1455
|
-
|
|
1456
|
-
|
|
1457
|
-
|
|
1458
|
-
|
|
1459
|
-
|
|
1460
|
-
|
|
1461
|
-
|
|
1462
|
-
|
|
1463
|
-
|
|
1464
|
-
|
|
1465
|
-
|
|
1466
|
-
|
|
1467
|
-
|
|
1468
|
-
|
|
1469
|
-
|
|
1470
|
-
|
|
1471
|
-
|
|
1472
|
-
|
|
1473
|
-
|
|
1474
|
-
|
|
1475
|
-
|
|
1476
|
-
|
|
1477
|
-
|
|
1478
|
-
|
|
1479
|
-
|
|
1480
|
-
|
|
1481
|
-
|
|
1482
|
-
|
|
1483
|
-
|
|
1484
|
-
|
|
1485
|
-
|
|
1486
|
-
|
|
1487
|
-
error: import_zod18.default.union([import_zod18.default.nativeEnum(Oauth2ErrorCodes), import_zod18.default.string()]),
|
|
1488
|
-
error_description: import_zod18.default.string().optional(),
|
|
1489
|
-
error_uri: import_zod18.default.string().optional()
|
|
1082
|
+
//#endregion
|
|
1083
|
+
//#region ../oauth2/src/common/z-oauth2-error.ts
|
|
1084
|
+
let Oauth2ErrorCodes$2 = /* @__PURE__ */ function(Oauth2ErrorCodes$3) {
|
|
1085
|
+
Oauth2ErrorCodes$3["ServerError"] = "server_error";
|
|
1086
|
+
Oauth2ErrorCodes$3["InvalidTarget"] = "invalid_target";
|
|
1087
|
+
Oauth2ErrorCodes$3["InvalidRequest"] = "invalid_request";
|
|
1088
|
+
Oauth2ErrorCodes$3["InvalidToken"] = "invalid_token";
|
|
1089
|
+
Oauth2ErrorCodes$3["InsufficientScope"] = "insufficient_scope";
|
|
1090
|
+
Oauth2ErrorCodes$3["InvalidGrant"] = "invalid_grant";
|
|
1091
|
+
Oauth2ErrorCodes$3["InvalidClient"] = "invalid_client";
|
|
1092
|
+
Oauth2ErrorCodes$3["UnauthorizedClient"] = "unauthorized_client";
|
|
1093
|
+
Oauth2ErrorCodes$3["UnsupportedGrantType"] = "unsupported_grant_type";
|
|
1094
|
+
Oauth2ErrorCodes$3["InvalidScope"] = "invalid_scope";
|
|
1095
|
+
Oauth2ErrorCodes$3["InvalidDpopProof"] = "invalid_dpop_proof";
|
|
1096
|
+
Oauth2ErrorCodes$3["UseDpopNonce"] = "use_dpop_nonce";
|
|
1097
|
+
Oauth2ErrorCodes$3["RedirectToWeb"] = "redirect_to_web";
|
|
1098
|
+
Oauth2ErrorCodes$3["InvalidSession"] = "invalid_session";
|
|
1099
|
+
Oauth2ErrorCodes$3["InsufficientAuthorization"] = "insufficient_authorization";
|
|
1100
|
+
Oauth2ErrorCodes$3["InvalidCredentialRequest"] = "invalid_credential_request";
|
|
1101
|
+
Oauth2ErrorCodes$3["CredentialRequestDenied"] = "credential_request_denied";
|
|
1102
|
+
Oauth2ErrorCodes$3["InvalidProof"] = "invalid_proof";
|
|
1103
|
+
Oauth2ErrorCodes$3["InvalidNonce"] = "invalid_nonce";
|
|
1104
|
+
Oauth2ErrorCodes$3["InvalidEncryptionParameters"] = "invalid_encryption_parameters";
|
|
1105
|
+
Oauth2ErrorCodes$3["UnknownCredentialConfiguration"] = "unknown_credential_configuration";
|
|
1106
|
+
Oauth2ErrorCodes$3["UnknownCredentialIdentifier"] = "unknown_credential_identifier";
|
|
1107
|
+
Oauth2ErrorCodes$3["InvalidTransactionId"] = "invalid_transaction_id";
|
|
1108
|
+
Oauth2ErrorCodes$3["UnsupportedCredentialType"] = "unsupported_credential_type";
|
|
1109
|
+
Oauth2ErrorCodes$3["UnsupportedCredentialFormat"] = "unsupported_credential_format";
|
|
1110
|
+
Oauth2ErrorCodes$3["InvalidRequestUri"] = "invalid_request_uri";
|
|
1111
|
+
Oauth2ErrorCodes$3["InvalidRequestObject"] = "invalid_request_object";
|
|
1112
|
+
Oauth2ErrorCodes$3["RequestNotSupported"] = "request_not_supported";
|
|
1113
|
+
Oauth2ErrorCodes$3["RequestUriNotSupported"] = "request_uri_not_supported";
|
|
1114
|
+
Oauth2ErrorCodes$3["VpFormatsNotSupported"] = "vp_formats_not_supported";
|
|
1115
|
+
Oauth2ErrorCodes$3["AccessDenied"] = "access_denied";
|
|
1116
|
+
Oauth2ErrorCodes$3["InvalidPresentationDefinitionUri"] = "invalid_presentation_definition_uri";
|
|
1117
|
+
Oauth2ErrorCodes$3["InvalidPresentationDefinitionReference"] = "invalid_presentation_definition_reference";
|
|
1118
|
+
Oauth2ErrorCodes$3["InvalidRequestUriMethod"] = "invalid_request_uri_method";
|
|
1119
|
+
Oauth2ErrorCodes$3["InvalidTransactionData"] = "invalid_transaction_data";
|
|
1120
|
+
Oauth2ErrorCodes$3["WalletUnavailable"] = "wallet_unavailable";
|
|
1121
|
+
return Oauth2ErrorCodes$3;
|
|
1122
|
+
}({});
|
|
1123
|
+
const zOauth2ErrorResponse = zod.default.object({
|
|
1124
|
+
error: zod.default.union([zod.default.nativeEnum(Oauth2ErrorCodes$2), zod.default.string()]),
|
|
1125
|
+
error_description: zod.default.string().optional(),
|
|
1126
|
+
error_uri: zod.default.string().optional()
|
|
1490
1127
|
}).passthrough();
|
|
1491
1128
|
|
|
1492
|
-
|
|
1493
|
-
|
|
1494
|
-
|
|
1495
|
-
|
|
1496
|
-
|
|
1497
|
-
|
|
1498
|
-
|
|
1499
|
-
import_zod19.default.array(zCredentialEncoding)
|
|
1500
|
-
]).optional(),
|
|
1501
|
-
interval: import_zod19.default.number().int().positive().optional(),
|
|
1502
|
-
notification_id: import_zod19.default.string().optional()
|
|
1129
|
+
//#endregion
|
|
1130
|
+
//#region src/credential-request/z-credential-response.ts
|
|
1131
|
+
const zCredentialEncoding = zod.default.union([zod.default.string(), zod.default.record(zod.default.string(), zod.default.any())]);
|
|
1132
|
+
const zBaseCredentialResponse = zod.default.object({
|
|
1133
|
+
credentials: zod.default.union([zod.default.array(zod.default.object({ credential: zCredentialEncoding })), zod.default.array(zCredentialEncoding)]).optional(),
|
|
1134
|
+
interval: zod.default.number().int().positive().optional(),
|
|
1135
|
+
notification_id: zod.default.string().optional()
|
|
1503
1136
|
}).passthrough();
|
|
1504
|
-
|
|
1505
|
-
|
|
1506
|
-
|
|
1507
|
-
|
|
1508
|
-
|
|
1137
|
+
const zCredentialResponse = zBaseCredentialResponse.extend({
|
|
1138
|
+
credential: zod.default.optional(zCredentialEncoding),
|
|
1139
|
+
transaction_id: zod.default.string().optional(),
|
|
1140
|
+
c_nonce: zod.default.string().optional(),
|
|
1141
|
+
c_nonce_expires_in: zod.default.number().int().optional()
|
|
1509
1142
|
}).passthrough().superRefine((value, ctx) => {
|
|
1510
|
-
|
|
1511
|
-
|
|
1512
|
-
|
|
1513
|
-
|
|
1514
|
-
|
|
1515
|
-
|
|
1516
|
-
|
|
1517
|
-
|
|
1518
|
-
|
|
1519
|
-
|
|
1520
|
-
|
|
1521
|
-
|
|
1522
|
-
|
|
1523
|
-
|
|
1524
|
-
|
|
1525
|
-
|
|
1526
|
-
|
|
1527
|
-
});
|
|
1528
|
-
}
|
|
1143
|
+
const { credential, credentials, transaction_id, interval, notification_id } = value;
|
|
1144
|
+
if ([
|
|
1145
|
+
credential,
|
|
1146
|
+
credentials,
|
|
1147
|
+
transaction_id
|
|
1148
|
+
].filter((i) => i !== void 0).length !== 1) ctx.addIssue({
|
|
1149
|
+
code: zod.default.ZodIssueCode.custom,
|
|
1150
|
+
message: `Exactly one of 'credential', 'credentials', or 'transaction_id' MUST be defined.`
|
|
1151
|
+
});
|
|
1152
|
+
if (transaction_id && !interval) ctx.addIssue({
|
|
1153
|
+
code: zod.default.ZodIssueCode.custom,
|
|
1154
|
+
message: `'interval' MUST be defined when 'transaction_id' is defined.`
|
|
1155
|
+
});
|
|
1156
|
+
if (notification_id && !(credentials || credential)) ctx.addIssue({
|
|
1157
|
+
code: zod.default.ZodIssueCode.custom,
|
|
1158
|
+
message: `'notification_id' MUST NOT be defined when 'credential' or 'credentials' are not defined.`
|
|
1159
|
+
});
|
|
1529
1160
|
});
|
|
1530
|
-
|
|
1531
|
-
|
|
1532
|
-
|
|
1533
|
-
|
|
1161
|
+
const zCredentialErrorResponse = zod.default.object({
|
|
1162
|
+
...zOauth2ErrorResponse.shape,
|
|
1163
|
+
c_nonce: zod.default.string().optional(),
|
|
1164
|
+
c_nonce_expires_in: zod.default.number().int().optional()
|
|
1534
1165
|
}).passthrough();
|
|
1535
|
-
|
|
1536
|
-
|
|
1537
|
-
|
|
1538
|
-
|
|
1539
|
-
},
|
|
1540
|
-
{
|
|
1541
|
-
message: `Exactly one of 'credentials' or 'interval' MUST be defined.`
|
|
1542
|
-
}
|
|
1543
|
-
);
|
|
1166
|
+
const zDeferredCredentialResponse = zBaseCredentialResponse.refine((value) => {
|
|
1167
|
+
const { credentials, interval } = value;
|
|
1168
|
+
return [credentials, interval].filter((i) => i !== void 0).length === 1;
|
|
1169
|
+
}, { message: `Exactly one of 'credentials' or 'interval' MUST be defined.` });
|
|
1544
1170
|
|
|
1545
|
-
|
|
1171
|
+
//#endregion
|
|
1172
|
+
//#region src/credential-request/retrieve-credentials.ts
|
|
1546
1173
|
async function retrieveCredentialsWithCredentialConfigurationId(options) {
|
|
1547
|
-
|
|
1548
|
-
|
|
1549
|
-
|
|
1550
|
-
|
|
1551
|
-
|
|
1552
|
-
|
|
1553
|
-
|
|
1554
|
-
|
|
1555
|
-
|
|
1556
|
-
|
|
1557
|
-
|
|
1558
|
-
|
|
1559
|
-
|
|
1560
|
-
|
|
1561
|
-
|
|
1562
|
-
return retrieveCredentials({
|
|
1563
|
-
callbacks: options.callbacks,
|
|
1564
|
-
credentialRequest,
|
|
1565
|
-
issuerMetadata: options.issuerMetadata,
|
|
1566
|
-
accessToken: options.accessToken,
|
|
1567
|
-
dpop: options.dpop
|
|
1568
|
-
});
|
|
1174
|
+
if (options.issuerMetadata.originalDraftVersion !== Openid4vciDraftVersion.Draft15 && options.issuerMetadata.originalDraftVersion !== Openid4vciDraftVersion.Draft16) throw new Openid4vciError("Requesting credentials based on credential configuration ID is not supported in OpenID4VCI below draft 15. Make sure to provide the format and format specific claims in the request.");
|
|
1175
|
+
getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, options.credentialConfigurationId);
|
|
1176
|
+
const credentialRequest = {
|
|
1177
|
+
...options.additionalRequestPayload,
|
|
1178
|
+
credential_configuration_id: options.credentialConfigurationId,
|
|
1179
|
+
proof: options.proof,
|
|
1180
|
+
proofs: options.proofs
|
|
1181
|
+
};
|
|
1182
|
+
return retrieveCredentials({
|
|
1183
|
+
callbacks: options.callbacks,
|
|
1184
|
+
credentialRequest,
|
|
1185
|
+
issuerMetadata: options.issuerMetadata,
|
|
1186
|
+
accessToken: options.accessToken,
|
|
1187
|
+
dpop: options.dpop
|
|
1188
|
+
});
|
|
1569
1189
|
}
|
|
1570
1190
|
async function retrieveCredentialsWithFormat(options) {
|
|
1571
|
-
|
|
1572
|
-
|
|
1573
|
-
|
|
1574
|
-
|
|
1575
|
-
|
|
1576
|
-
|
|
1577
|
-
|
|
1578
|
-
|
|
1579
|
-
|
|
1580
|
-
|
|
1581
|
-
|
|
1582
|
-
|
|
1583
|
-
|
|
1584
|
-
|
|
1585
|
-
issuerMetadata: options.issuerMetadata,
|
|
1586
|
-
accessToken: options.accessToken,
|
|
1587
|
-
dpop: options.dpop
|
|
1588
|
-
});
|
|
1191
|
+
if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft15 || options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft16) throw new Openid4vciError("Requesting credentials based on format is not supported in OpenID4VCI draft 15. Provide the credential configuration id directly in the request.");
|
|
1192
|
+
const credentialRequest = {
|
|
1193
|
+
...options.formatPayload,
|
|
1194
|
+
...options.additionalRequestPayload,
|
|
1195
|
+
proof: options.proof,
|
|
1196
|
+
proofs: options.proofs
|
|
1197
|
+
};
|
|
1198
|
+
return retrieveCredentials({
|
|
1199
|
+
callbacks: options.callbacks,
|
|
1200
|
+
credentialRequest,
|
|
1201
|
+
issuerMetadata: options.issuerMetadata,
|
|
1202
|
+
accessToken: options.accessToken,
|
|
1203
|
+
dpop: options.dpop
|
|
1204
|
+
});
|
|
1589
1205
|
}
|
|
1206
|
+
/**
|
|
1207
|
+
* internal method
|
|
1208
|
+
*/
|
|
1590
1209
|
async function retrieveCredentials(options) {
|
|
1591
|
-
|
|
1592
|
-
|
|
1593
|
-
|
|
1594
|
-
|
|
1595
|
-
|
|
1596
|
-
|
|
1597
|
-
|
|
1598
|
-
|
|
1599
|
-
|
|
1600
|
-
|
|
1601
|
-
|
|
1602
|
-
|
|
1603
|
-
|
|
1604
|
-
|
|
1605
|
-
|
|
1606
|
-
|
|
1607
|
-
|
|
1608
|
-
|
|
1609
|
-
|
|
1610
|
-
|
|
1611
|
-
|
|
1612
|
-
|
|
1613
|
-
|
|
1614
|
-
|
|
1615
|
-
|
|
1616
|
-
|
|
1617
|
-
|
|
1618
|
-
|
|
1619
|
-
|
|
1620
|
-
|
|
1621
|
-
|
|
1622
|
-
|
|
1623
|
-
|
|
1624
|
-
|
|
1625
|
-
|
|
1626
|
-
|
|
1627
|
-
|
|
1628
|
-
body: JSON.stringify(credentialRequest)
|
|
1629
|
-
}
|
|
1630
|
-
});
|
|
1631
|
-
if (!resourceResponse.ok) {
|
|
1632
|
-
const credentialErrorResponseResult = (0, import_utils12.isResponseContentType)(import_utils12.ContentType.Json, resourceResponse.response) ? zCredentialErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
|
|
1633
|
-
return {
|
|
1634
|
-
...resourceResponse,
|
|
1635
|
-
credentialErrorResponseResult
|
|
1636
|
-
};
|
|
1637
|
-
}
|
|
1638
|
-
const credentialResponseResult = (0, import_utils12.isResponseContentType)(import_utils12.ContentType.Json, resourceResponse.response) ? zCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
|
|
1639
|
-
if (!credentialResponseResult?.success) {
|
|
1640
|
-
return {
|
|
1641
|
-
...resourceResponse,
|
|
1642
|
-
ok: false,
|
|
1643
|
-
credentialResponseResult
|
|
1644
|
-
};
|
|
1645
|
-
}
|
|
1646
|
-
return {
|
|
1647
|
-
...resourceResponse,
|
|
1648
|
-
credentialResponse: credentialResponseResult.data
|
|
1649
|
-
};
|
|
1210
|
+
const credentialEndpoint = options.issuerMetadata.credentialIssuer.credential_endpoint;
|
|
1211
|
+
let credentialRequest = (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialRequest, options.credentialRequest, "Error validating credential request");
|
|
1212
|
+
if (credentialRequest.proofs) {
|
|
1213
|
+
const { batch_credential_issuance } = options.issuerMetadata.credentialIssuer;
|
|
1214
|
+
if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft11) throw new __openid4vc_oauth2.Oauth2Error(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not support batch credential issuance using the 'proofs' request property. Only 'proof' is supported.`);
|
|
1215
|
+
const proofs = Object.values(credentialRequest.proofs)[0];
|
|
1216
|
+
if (proofs.length > (batch_credential_issuance?.batch_size ?? 1)) throw new __openid4vc_oauth2.Oauth2Error(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' supports batch issuance, but the max batch size is '${batch_credential_issuance?.batch_size ?? 1}'. A total of '${proofs.length}' proofs were provided.`);
|
|
1217
|
+
}
|
|
1218
|
+
if (options.issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft11) credentialRequest = (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialRequestDraft14To11, credentialRequest, `Error transforming credential request from ${Openid4vciDraftVersion.Draft14} to ${Openid4vciDraftVersion.Draft11}`);
|
|
1219
|
+
const resourceResponse = await (0, __openid4vc_oauth2.resourceRequest)({
|
|
1220
|
+
dpop: options.dpop,
|
|
1221
|
+
accessToken: options.accessToken,
|
|
1222
|
+
callbacks: options.callbacks,
|
|
1223
|
+
url: credentialEndpoint,
|
|
1224
|
+
requestOptions: {
|
|
1225
|
+
method: "POST",
|
|
1226
|
+
headers: { "Content-Type": __openid4vc_utils.ContentType.Json },
|
|
1227
|
+
body: JSON.stringify(credentialRequest)
|
|
1228
|
+
}
|
|
1229
|
+
});
|
|
1230
|
+
if (!resourceResponse.ok) {
|
|
1231
|
+
const credentialErrorResponseResult = (0, __openid4vc_utils.isResponseContentType)(__openid4vc_utils.ContentType.Json, resourceResponse.response) ? zCredentialErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
|
|
1232
|
+
return {
|
|
1233
|
+
...resourceResponse,
|
|
1234
|
+
credentialErrorResponseResult
|
|
1235
|
+
};
|
|
1236
|
+
}
|
|
1237
|
+
const credentialResponseResult = (0, __openid4vc_utils.isResponseContentType)(__openid4vc_utils.ContentType.Json, resourceResponse.response) ? zCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
|
|
1238
|
+
if (!credentialResponseResult?.success) return {
|
|
1239
|
+
...resourceResponse,
|
|
1240
|
+
ok: false,
|
|
1241
|
+
credentialResponseResult
|
|
1242
|
+
};
|
|
1243
|
+
return {
|
|
1244
|
+
...resourceResponse,
|
|
1245
|
+
credentialResponse: credentialResponseResult.data
|
|
1246
|
+
};
|
|
1650
1247
|
}
|
|
1651
1248
|
async function retrieveDeferredCredentials(options) {
|
|
1652
|
-
|
|
1653
|
-
|
|
1654
|
-
|
|
1655
|
-
|
|
1656
|
-
|
|
1657
|
-
|
|
1658
|
-
|
|
1659
|
-
|
|
1660
|
-
|
|
1661
|
-
|
|
1662
|
-
|
|
1663
|
-
|
|
1664
|
-
|
|
1665
|
-
|
|
1666
|
-
|
|
1667
|
-
|
|
1668
|
-
|
|
1669
|
-
|
|
1670
|
-
|
|
1671
|
-
|
|
1672
|
-
|
|
1673
|
-
|
|
1674
|
-
|
|
1675
|
-
|
|
1676
|
-
|
|
1677
|
-
|
|
1678
|
-
|
|
1679
|
-
|
|
1680
|
-
|
|
1681
|
-
|
|
1682
|
-
|
|
1683
|
-
|
|
1684
|
-
|
|
1685
|
-
|
|
1686
|
-
const deferredCredentialResponseResult = (0, import_utils12.isResponseContentType)(import_utils12.ContentType.Json, resourceResponse.response) ? zDeferredCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
|
|
1687
|
-
if (!deferredCredentialResponseResult?.success) {
|
|
1688
|
-
return {
|
|
1689
|
-
...resourceResponse,
|
|
1690
|
-
ok: false,
|
|
1691
|
-
deferredCredentialResponseResult
|
|
1692
|
-
};
|
|
1693
|
-
}
|
|
1694
|
-
return {
|
|
1695
|
-
...resourceResponse,
|
|
1696
|
-
deferredCredentialResponse: deferredCredentialResponseResult.data
|
|
1697
|
-
};
|
|
1249
|
+
const credentialEndpoint = options.issuerMetadata.credentialIssuer.deferred_credential_endpoint;
|
|
1250
|
+
if (!credentialEndpoint) throw new Openid4vciError(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not support deferred credential retrieval.`);
|
|
1251
|
+
const deferredCredentialRequest = (0, __openid4vc_utils.parseWithErrorHandling)(zDeferredCredentialRequest, {
|
|
1252
|
+
transaction_id: options.transactionId,
|
|
1253
|
+
...options.additionalRequestPayload
|
|
1254
|
+
}, "Error validating deferred credential request");
|
|
1255
|
+
const resourceResponse = await (0, __openid4vc_oauth2.resourceRequest)({
|
|
1256
|
+
dpop: options.dpop,
|
|
1257
|
+
accessToken: options.accessToken,
|
|
1258
|
+
callbacks: options.callbacks,
|
|
1259
|
+
url: credentialEndpoint,
|
|
1260
|
+
requestOptions: {
|
|
1261
|
+
method: "POST",
|
|
1262
|
+
headers: { "Content-Type": __openid4vc_utils.ContentType.Json },
|
|
1263
|
+
body: JSON.stringify(deferredCredentialRequest)
|
|
1264
|
+
}
|
|
1265
|
+
});
|
|
1266
|
+
if (!resourceResponse.ok) {
|
|
1267
|
+
const deferredCredentialErrorResponseResult = (0, __openid4vc_utils.isResponseContentType)(__openid4vc_utils.ContentType.Json, resourceResponse.response) ? zCredentialErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
|
|
1268
|
+
return {
|
|
1269
|
+
...resourceResponse,
|
|
1270
|
+
deferredCredentialErrorResponseResult
|
|
1271
|
+
};
|
|
1272
|
+
}
|
|
1273
|
+
const deferredCredentialResponseResult = (0, __openid4vc_utils.isResponseContentType)(__openid4vc_utils.ContentType.Json, resourceResponse.response) ? zDeferredCredentialResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
|
|
1274
|
+
if (!deferredCredentialResponseResult?.success) return {
|
|
1275
|
+
...resourceResponse,
|
|
1276
|
+
ok: false,
|
|
1277
|
+
deferredCredentialResponseResult
|
|
1278
|
+
};
|
|
1279
|
+
return {
|
|
1280
|
+
...resourceResponse,
|
|
1281
|
+
deferredCredentialResponse: deferredCredentialResponseResult.data
|
|
1282
|
+
};
|
|
1698
1283
|
}
|
|
1699
1284
|
|
|
1700
|
-
|
|
1701
|
-
|
|
1702
|
-
var import_oauth215 = require("@openid4vc/oauth2");
|
|
1703
|
-
var import_utils13 = require("@openid4vc/utils");
|
|
1285
|
+
//#endregion
|
|
1286
|
+
//#region src/formats/proof-type/jwt/jwt-proof-type.ts
|
|
1704
1287
|
async function createCredentialRequestJwtProof(options) {
|
|
1705
|
-
|
|
1706
|
-
|
|
1707
|
-
|
|
1708
|
-
|
|
1709
|
-
|
|
1710
|
-
|
|
1711
|
-
|
|
1712
|
-
|
|
1713
|
-
|
|
1714
|
-
|
|
1715
|
-
|
|
1716
|
-
|
|
1717
|
-
|
|
1718
|
-
|
|
1719
|
-
|
|
1720
|
-
|
|
1721
|
-
|
|
1722
|
-
|
|
1723
|
-
|
|
1724
|
-
|
|
1725
|
-
|
|
1726
|
-
|
|
1727
|
-
|
|
1728
|
-
|
|
1729
|
-
|
|
1730
|
-
|
|
1731
|
-
|
|
1732
|
-
}
|
|
1733
|
-
}
|
|
1734
|
-
return jwt;
|
|
1288
|
+
const header = (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialRequestJwtProofTypeHeader, {
|
|
1289
|
+
...(0, __openid4vc_oauth2.jwtHeaderFromJwtSigner)(options.signer),
|
|
1290
|
+
key_attestation: options.keyAttestationJwt,
|
|
1291
|
+
typ: "openid4vci-proof+jwt"
|
|
1292
|
+
});
|
|
1293
|
+
const payload = (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialRequestJwtProofTypePayload, {
|
|
1294
|
+
nonce: options.nonce,
|
|
1295
|
+
aud: options.credentialIssuer,
|
|
1296
|
+
iat: (0, __openid4vc_utils.dateToSeconds)(options.issuedAt),
|
|
1297
|
+
iss: options.clientId
|
|
1298
|
+
});
|
|
1299
|
+
const { jwt, signerJwk } = await options.callbacks.signJwt(options.signer, {
|
|
1300
|
+
header,
|
|
1301
|
+
payload
|
|
1302
|
+
});
|
|
1303
|
+
if (options.keyAttestationJwt) {
|
|
1304
|
+
if (!await (0, __openid4vc_oauth2.isJwkInSet)({
|
|
1305
|
+
jwk: signerJwk,
|
|
1306
|
+
jwks: (0, __openid4vc_oauth2.decodeJwt)({
|
|
1307
|
+
jwt: options.keyAttestationJwt,
|
|
1308
|
+
headerSchema: zKeyAttestationJwtHeader,
|
|
1309
|
+
payloadSchema: zKeyAttestationJwtPayload
|
|
1310
|
+
}).payload.attested_keys,
|
|
1311
|
+
callbacks: options.callbacks
|
|
1312
|
+
})) throw new Openid4vciError(`Credential request jwt proof is not signed with a key in the 'key_attestation' jwt payload 'attested_keys'`);
|
|
1313
|
+
}
|
|
1314
|
+
return jwt;
|
|
1735
1315
|
}
|
|
1736
1316
|
async function verifyCredentialRequestJwtProof(options) {
|
|
1737
|
-
|
|
1738
|
-
|
|
1739
|
-
|
|
1740
|
-
|
|
1741
|
-
|
|
1742
|
-
|
|
1743
|
-
|
|
1744
|
-
|
|
1745
|
-
|
|
1746
|
-
|
|
1747
|
-
|
|
1748
|
-
|
|
1749
|
-
|
|
1750
|
-
|
|
1751
|
-
|
|
1752
|
-
|
|
1753
|
-
|
|
1754
|
-
|
|
1755
|
-
|
|
1756
|
-
|
|
1757
|
-
|
|
1758
|
-
|
|
1759
|
-
|
|
1760
|
-
|
|
1761
|
-
|
|
1762
|
-
|
|
1763
|
-
|
|
1764
|
-
|
|
1765
|
-
|
|
1766
|
-
|
|
1767
|
-
|
|
1768
|
-
|
|
1769
|
-
|
|
1770
|
-
|
|
1771
|
-
|
|
1772
|
-
|
|
1773
|
-
|
|
1774
|
-
|
|
1775
|
-
|
|
1776
|
-
|
|
1777
|
-
|
|
1778
|
-
payload,
|
|
1779
|
-
signer,
|
|
1780
|
-
keyAttestation: keyAttestationResult
|
|
1781
|
-
};
|
|
1317
|
+
const { header, payload } = (0, __openid4vc_oauth2.decodeJwt)({
|
|
1318
|
+
jwt: options.jwt,
|
|
1319
|
+
headerSchema: zCredentialRequestJwtProofTypeHeader,
|
|
1320
|
+
payloadSchema: zCredentialRequestJwtProofTypePayload
|
|
1321
|
+
});
|
|
1322
|
+
const now = options.now?.getTime() ?? Date.now();
|
|
1323
|
+
if (options.nonceExpiresAt && now > options.nonceExpiresAt.getTime()) throw new Openid4vciError("Nonce used for credential request proof expired");
|
|
1324
|
+
const { signer } = await (0, __openid4vc_oauth2.verifyJwt)({
|
|
1325
|
+
compact: options.jwt,
|
|
1326
|
+
header,
|
|
1327
|
+
payload,
|
|
1328
|
+
signer: (0, __openid4vc_oauth2.jwtSignerFromJwt)({
|
|
1329
|
+
header,
|
|
1330
|
+
payload
|
|
1331
|
+
}),
|
|
1332
|
+
verifyJwtCallback: options.callbacks.verifyJwt,
|
|
1333
|
+
errorMessage: "Error verifiying credential request proof jwt.",
|
|
1334
|
+
expectedNonce: options.expectedNonce,
|
|
1335
|
+
expectedAudience: options.credentialIssuer,
|
|
1336
|
+
expectedIssuer: options.clientId,
|
|
1337
|
+
now: options.now
|
|
1338
|
+
});
|
|
1339
|
+
let keyAttestationResult;
|
|
1340
|
+
if (header.key_attestation) {
|
|
1341
|
+
keyAttestationResult = await verifyKeyAttestationJwt({
|
|
1342
|
+
callbacks: options.callbacks,
|
|
1343
|
+
keyAttestationJwt: header.key_attestation,
|
|
1344
|
+
use: "proof_type.jwt"
|
|
1345
|
+
});
|
|
1346
|
+
if (!await (0, __openid4vc_oauth2.isJwkInSet)({
|
|
1347
|
+
jwk: signer.publicJwk,
|
|
1348
|
+
jwks: keyAttestationResult.payload.attested_keys,
|
|
1349
|
+
callbacks: options.callbacks
|
|
1350
|
+
})) throw new Openid4vciError(`Credential request jwt proof is not signed with a key in the 'key_attestation' jwt payload 'attested_keys'`);
|
|
1351
|
+
}
|
|
1352
|
+
return {
|
|
1353
|
+
header,
|
|
1354
|
+
payload,
|
|
1355
|
+
signer,
|
|
1356
|
+
keyAttestation: keyAttestationResult
|
|
1357
|
+
};
|
|
1782
1358
|
}
|
|
1783
1359
|
|
|
1784
|
-
|
|
1785
|
-
|
|
1786
|
-
var import_utils14 = require("@openid4vc/utils");
|
|
1360
|
+
//#endregion
|
|
1361
|
+
//#region src/metadata/fetch-issuer-metadata.ts
|
|
1787
1362
|
async function resolveIssuerMetadata(credentialIssuer, options) {
|
|
1788
|
-
|
|
1789
|
-
|
|
1790
|
-
|
|
1791
|
-
|
|
1792
|
-
|
|
1793
|
-
|
|
1794
|
-
|
|
1795
|
-
|
|
1796
|
-
|
|
1797
|
-
|
|
1798
|
-
|
|
1799
|
-
|
|
1800
|
-
|
|
1801
|
-
|
|
1802
|
-
|
|
1803
|
-
|
|
1804
|
-
|
|
1805
|
-
|
|
1806
|
-
|
|
1807
|
-
|
|
1808
|
-
|
|
1809
|
-
);
|
|
1810
|
-
}
|
|
1811
|
-
if (!authorizationServerMetadata) {
|
|
1812
|
-
throw new import_oauth216.Oauth2Error(
|
|
1813
|
-
`Well known openid configuration or authorization server metadata for authorization server '${authorizationServer}' not found.`
|
|
1814
|
-
);
|
|
1815
|
-
}
|
|
1816
|
-
authoriationServersMetadata.push(authorizationServerMetadata);
|
|
1817
|
-
}
|
|
1818
|
-
return {
|
|
1819
|
-
originalDraftVersion,
|
|
1820
|
-
credentialIssuer: credentialIssuerMetadata,
|
|
1821
|
-
authorizationServers: authoriationServersMetadata
|
|
1822
|
-
};
|
|
1363
|
+
const allowAuthorizationMetadataFromCredentialIssuerMetadata = options?.allowAuthorizationMetadataFromCredentialIssuerMetadata ?? true;
|
|
1364
|
+
const credentialIssuerMetadataWithDraftVersion = await fetchCredentialIssuerMetadata(credentialIssuer, options?.fetch);
|
|
1365
|
+
if (!credentialIssuerMetadataWithDraftVersion) throw new __openid4vc_oauth2.Oauth2Error(`Well known credential issuer metadata for issuer '${credentialIssuer}' not found.`);
|
|
1366
|
+
const { credentialIssuerMetadata, originalDraftVersion } = credentialIssuerMetadataWithDraftVersion;
|
|
1367
|
+
const authorizationServers = credentialIssuerMetadata.authorization_servers ?? [credentialIssuer];
|
|
1368
|
+
const authoriationServersMetadata = [];
|
|
1369
|
+
for (const authorizationServer of authorizationServers) {
|
|
1370
|
+
if (options?.restrictToAuthorizationServers && !options.restrictToAuthorizationServers.includes(authorizationServer)) continue;
|
|
1371
|
+
let authorizationServerMetadata = await (0, __openid4vc_oauth2.fetchAuthorizationServerMetadata)(authorizationServer, options?.fetch);
|
|
1372
|
+
if (!authorizationServerMetadata && authorizationServer === credentialIssuer && allowAuthorizationMetadataFromCredentialIssuerMetadata) authorizationServerMetadata = (0, __openid4vc_utils.parseWithErrorHandling)(__openid4vc_oauth2.zAuthorizationServerMetadata, {
|
|
1373
|
+
token_endpoint: credentialIssuerMetadata.token_endpoint,
|
|
1374
|
+
issuer: credentialIssuer
|
|
1375
|
+
}, `Well known authorization server metadata for authorization server '${authorizationServer}' not found, and could also not extract required values from the credential issuer metadata as a fallback.`);
|
|
1376
|
+
if (!authorizationServerMetadata) throw new __openid4vc_oauth2.Oauth2Error(`Well known openid configuration or authorization server metadata for authorization server '${authorizationServer}' not found.`);
|
|
1377
|
+
authoriationServersMetadata.push(authorizationServerMetadata);
|
|
1378
|
+
}
|
|
1379
|
+
return {
|
|
1380
|
+
originalDraftVersion,
|
|
1381
|
+
credentialIssuer: credentialIssuerMetadata,
|
|
1382
|
+
authorizationServers: authoriationServersMetadata
|
|
1383
|
+
};
|
|
1823
1384
|
}
|
|
1824
1385
|
|
|
1825
|
-
|
|
1826
|
-
|
|
1827
|
-
|
|
1828
|
-
|
|
1829
|
-
|
|
1830
|
-
var import_utils15 = require("@openid4vc/utils");
|
|
1831
|
-
var import_zod20 = __toESM(require("zod"));
|
|
1832
|
-
var zNonceResponse = import_zod20.default.object({
|
|
1833
|
-
c_nonce: import_zod20.default.string(),
|
|
1834
|
-
c_nonce_expires_in: import_zod20.default.optional(import_utils15.zInteger)
|
|
1386
|
+
//#endregion
|
|
1387
|
+
//#region src/nonce/z-nonce.ts
|
|
1388
|
+
const zNonceResponse = zod.default.object({
|
|
1389
|
+
c_nonce: zod.default.string(),
|
|
1390
|
+
c_nonce_expires_in: zod.default.optional(__openid4vc_utils.zInteger)
|
|
1835
1391
|
}).passthrough();
|
|
1836
1392
|
|
|
1837
|
-
|
|
1393
|
+
//#endregion
|
|
1394
|
+
//#region src/nonce/nonce-request.ts
|
|
1395
|
+
/**
|
|
1396
|
+
* Request a nonce from the `nonce_endpoint`
|
|
1397
|
+
*
|
|
1398
|
+
* @throws Openid4vciError - if no `nonce_endpoint` is configured in the issuer metadata
|
|
1399
|
+
* @throws InvalidFetchResponseError - if the nonce endpoint did not return a successful response
|
|
1400
|
+
* @throws ValidationError - if validating the nonce response failed
|
|
1401
|
+
*/
|
|
1838
1402
|
async function requestNonce(options) {
|
|
1839
|
-
|
|
1840
|
-
|
|
1841
|
-
|
|
1842
|
-
|
|
1843
|
-
|
|
1844
|
-
|
|
1845
|
-
|
|
1846
|
-
const { response, result } = await fetchWithZod(zNonceResponse, import_utils16.ContentType.Json, nonceEndpoint, {
|
|
1847
|
-
method: "POST"
|
|
1848
|
-
});
|
|
1849
|
-
if (!response.ok || !result) {
|
|
1850
|
-
throw new import_oauth217.InvalidFetchResponseError(
|
|
1851
|
-
`Requesting nonce from '${nonceEndpoint}' resulted in an unsuccessful response with status '${response.status}'`,
|
|
1852
|
-
await response.clone().text(),
|
|
1853
|
-
response
|
|
1854
|
-
);
|
|
1855
|
-
}
|
|
1856
|
-
if (!result.success) {
|
|
1857
|
-
throw new import_utils16.ValidationError("Error parsing nonce response", result.error);
|
|
1858
|
-
}
|
|
1859
|
-
return result.data;
|
|
1403
|
+
const fetchWithZod = (0, __openid4vc_utils.createZodFetcher)(options?.fetch);
|
|
1404
|
+
const nonceEndpoint = options.issuerMetadata.credentialIssuer.nonce_endpoint;
|
|
1405
|
+
if (!nonceEndpoint) throw new Openid4vciError(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not have a nonce endpoint.`);
|
|
1406
|
+
const { response, result } = await fetchWithZod(zNonceResponse, __openid4vc_utils.ContentType.Json, nonceEndpoint, { method: "POST" });
|
|
1407
|
+
if (!response.ok || !result) throw new __openid4vc_oauth2.InvalidFetchResponseError(`Requesting nonce from '${nonceEndpoint}' resulted in an unsuccessful response with status '${response.status}'`, await response.clone().text(), response);
|
|
1408
|
+
if (!result.success) throw new __openid4vc_utils.ValidationError("Error parsing nonce response", result.error);
|
|
1409
|
+
return result.data;
|
|
1860
1410
|
}
|
|
1861
1411
|
function createNonceResponse(options) {
|
|
1862
|
-
|
|
1863
|
-
|
|
1864
|
-
|
|
1865
|
-
|
|
1866
|
-
|
|
1412
|
+
return (0, __openid4vc_utils.parseWithErrorHandling)(zNonceResponse, {
|
|
1413
|
+
c_nonce: options.cNonce,
|
|
1414
|
+
c_nonce_expires_in: options.cNonceExpiresIn,
|
|
1415
|
+
...options.additionalPayload
|
|
1416
|
+
});
|
|
1867
1417
|
}
|
|
1868
1418
|
|
|
1869
|
-
|
|
1870
|
-
|
|
1871
|
-
|
|
1872
|
-
|
|
1873
|
-
|
|
1874
|
-
|
|
1875
|
-
|
|
1876
|
-
|
|
1877
|
-
|
|
1878
|
-
|
|
1879
|
-
|
|
1880
|
-
}).passthrough();
|
|
1881
|
-
var zNotificationErrorResponse = import_zod21.default.object({
|
|
1882
|
-
error: import_zod21.default.enum(["invalid_notification_id", "invalid_notification_request"])
|
|
1419
|
+
//#endregion
|
|
1420
|
+
//#region src/notification/z-notification.ts
|
|
1421
|
+
const zNotificationEvent = zod.default.enum([
|
|
1422
|
+
"credential_accepted",
|
|
1423
|
+
"credential_failure",
|
|
1424
|
+
"credential_deleted"
|
|
1425
|
+
]);
|
|
1426
|
+
const zNotificationRequest = zod.default.object({
|
|
1427
|
+
notification_id: zod.default.string(),
|
|
1428
|
+
event: zNotificationEvent,
|
|
1429
|
+
event_description: zod.default.optional(zod.default.string())
|
|
1883
1430
|
}).passthrough();
|
|
1431
|
+
const zNotificationErrorResponse = zod.default.object({ error: zod.default.enum(["invalid_notification_id", "invalid_notification_request"]) }).passthrough();
|
|
1884
1432
|
|
|
1885
|
-
|
|
1433
|
+
//#endregion
|
|
1434
|
+
//#region src/notification/notification.ts
|
|
1886
1435
|
async function sendNotification(options) {
|
|
1887
|
-
|
|
1888
|
-
|
|
1889
|
-
|
|
1890
|
-
|
|
1891
|
-
|
|
1892
|
-
|
|
1893
|
-
|
|
1894
|
-
|
|
1895
|
-
|
|
1896
|
-
|
|
1897
|
-
|
|
1898
|
-
|
|
1899
|
-
|
|
1900
|
-
|
|
1901
|
-
|
|
1902
|
-
|
|
1903
|
-
|
|
1904
|
-
|
|
1905
|
-
|
|
1906
|
-
|
|
1907
|
-
|
|
1908
|
-
|
|
1909
|
-
|
|
1910
|
-
|
|
1911
|
-
|
|
1912
|
-
|
|
1913
|
-
}
|
|
1914
|
-
});
|
|
1915
|
-
if (!resourceResponse.ok) {
|
|
1916
|
-
const notificationErrorResponseResult = (0, import_utils17.isResponseContentType)(import_utils17.ContentType.Json, resourceResponse.response) ? zNotificationErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
|
|
1917
|
-
return {
|
|
1918
|
-
...resourceResponse,
|
|
1919
|
-
notificationErrorResponseResult
|
|
1920
|
-
};
|
|
1921
|
-
}
|
|
1922
|
-
return resourceResponse;
|
|
1436
|
+
const notificationEndpoint = options.issuerMetadata.credentialIssuer.notification_endpoint;
|
|
1437
|
+
if (!notificationEndpoint) throw new __openid4vc_oauth2.Oauth2Error(`Credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}' does not have a notification endpiont configured.`);
|
|
1438
|
+
const notificationRequest = (0, __openid4vc_utils.parseWithErrorHandling)(zNotificationRequest, {
|
|
1439
|
+
event: options.notification.event,
|
|
1440
|
+
notification_id: options.notification.notificationId,
|
|
1441
|
+
event_description: options.notification.eventDescription
|
|
1442
|
+
}, "Error validating notification request");
|
|
1443
|
+
const resourceResponse = await (0, __openid4vc_oauth2.resourceRequest)({
|
|
1444
|
+
dpop: options.dpop,
|
|
1445
|
+
accessToken: options.accessToken,
|
|
1446
|
+
callbacks: options.callbacks,
|
|
1447
|
+
url: notificationEndpoint,
|
|
1448
|
+
requestOptions: {
|
|
1449
|
+
method: "POST",
|
|
1450
|
+
headers: { "Content-Type": __openid4vc_utils.ContentType.Json },
|
|
1451
|
+
body: JSON.stringify(notificationRequest)
|
|
1452
|
+
}
|
|
1453
|
+
});
|
|
1454
|
+
if (!resourceResponse.ok) {
|
|
1455
|
+
const notificationErrorResponseResult = (0, __openid4vc_utils.isResponseContentType)(__openid4vc_utils.ContentType.Json, resourceResponse.response) ? zNotificationErrorResponse.safeParse(await resourceResponse.response.clone().json()) : void 0;
|
|
1456
|
+
return {
|
|
1457
|
+
...resourceResponse,
|
|
1458
|
+
notificationErrorResponseResult
|
|
1459
|
+
};
|
|
1460
|
+
}
|
|
1461
|
+
return resourceResponse;
|
|
1923
1462
|
}
|
|
1924
1463
|
|
|
1925
|
-
|
|
1926
|
-
|
|
1927
|
-
|
|
1928
|
-
|
|
1929
|
-
|
|
1930
|
-
|
|
1464
|
+
//#endregion
|
|
1465
|
+
//#region src/Openid4vciClient.ts
|
|
1466
|
+
let AuthorizationFlow = /* @__PURE__ */ function(AuthorizationFlow$1) {
|
|
1467
|
+
AuthorizationFlow$1["Oauth2Redirect"] = "Oauth2Redirect";
|
|
1468
|
+
AuthorizationFlow$1["PresentationDuringIssuance"] = "PresentationDuringIssuance";
|
|
1469
|
+
return AuthorizationFlow$1;
|
|
1470
|
+
}({});
|
|
1931
1471
|
var Openid4vciClient = class {
|
|
1932
|
-
|
|
1933
|
-
|
|
1934
|
-
|
|
1935
|
-
|
|
1936
|
-
|
|
1937
|
-
|
|
1938
|
-
|
|
1939
|
-
|
|
1940
|
-
|
|
1941
|
-
|
|
1942
|
-
|
|
1943
|
-
|
|
1944
|
-
|
|
1945
|
-
|
|
1946
|
-
|
|
1947
|
-
|
|
1948
|
-
|
|
1949
|
-
|
|
1950
|
-
|
|
1951
|
-
|
|
1952
|
-
|
|
1953
|
-
|
|
1954
|
-
|
|
1955
|
-
|
|
1956
|
-
|
|
1957
|
-
|
|
1958
|
-
|
|
1959
|
-
|
|
1960
|
-
|
|
1961
|
-
|
|
1962
|
-
|
|
1963
|
-
|
|
1964
|
-
|
|
1965
|
-
|
|
1966
|
-
|
|
1967
|
-
|
|
1968
|
-
|
|
1969
|
-
|
|
1970
|
-
|
|
1971
|
-
|
|
1972
|
-
|
|
1973
|
-
|
|
1974
|
-
|
|
1975
|
-
|
|
1976
|
-
|
|
1977
|
-
|
|
1978
|
-
|
|
1979
|
-
|
|
1980
|
-
|
|
1981
|
-
|
|
1982
|
-
|
|
1983
|
-
|
|
1984
|
-
|
|
1985
|
-
|
|
1986
|
-
|
|
1987
|
-
|
|
1988
|
-
|
|
1989
|
-
|
|
1990
|
-
|
|
1991
|
-
|
|
1992
|
-
|
|
1993
|
-
|
|
1994
|
-
|
|
1995
|
-
|
|
1996
|
-
|
|
1997
|
-
|
|
1998
|
-
|
|
1999
|
-
|
|
2000
|
-
|
|
2001
|
-
|
|
2002
|
-
|
|
2003
|
-
|
|
2004
|
-
|
|
2005
|
-
|
|
2006
|
-
|
|
2007
|
-
|
|
2008
|
-
|
|
2009
|
-
|
|
2010
|
-
|
|
2011
|
-
|
|
2012
|
-
|
|
2013
|
-
|
|
2014
|
-
|
|
2015
|
-
|
|
2016
|
-
|
|
2017
|
-
|
|
2018
|
-
|
|
2019
|
-
|
|
2020
|
-
|
|
2021
|
-
|
|
2022
|
-
|
|
2023
|
-
|
|
2024
|
-
|
|
2025
|
-
|
|
2026
|
-
|
|
2027
|
-
|
|
2028
|
-
|
|
2029
|
-
|
|
2030
|
-
|
|
2031
|
-
|
|
2032
|
-
|
|
2033
|
-
|
|
2034
|
-
|
|
2035
|
-
|
|
2036
|
-
|
|
2037
|
-
|
|
2038
|
-
|
|
2039
|
-
|
|
2040
|
-
|
|
2041
|
-
|
|
2042
|
-
|
|
2043
|
-
|
|
2044
|
-
|
|
2045
|
-
|
|
2046
|
-
|
|
2047
|
-
|
|
2048
|
-
|
|
2049
|
-
|
|
2050
|
-
|
|
2051
|
-
|
|
2052
|
-
|
|
2053
|
-
|
|
2054
|
-
|
|
2055
|
-
|
|
2056
|
-
|
|
2057
|
-
|
|
2058
|
-
|
|
2059
|
-
|
|
2060
|
-
|
|
2061
|
-
|
|
2062
|
-
|
|
2063
|
-
|
|
2064
|
-
|
|
2065
|
-
|
|
2066
|
-
|
|
2067
|
-
|
|
2068
|
-
|
|
2069
|
-
|
|
2070
|
-
|
|
2071
|
-
|
|
2072
|
-
|
|
2073
|
-
|
|
2074
|
-
|
|
2075
|
-
|
|
2076
|
-
|
|
2077
|
-
|
|
2078
|
-
|
|
2079
|
-
|
|
2080
|
-
|
|
2081
|
-
|
|
2082
|
-
|
|
2083
|
-
|
|
2084
|
-
|
|
2085
|
-
|
|
2086
|
-
|
|
2087
|
-
|
|
2088
|
-
|
|
2089
|
-
|
|
2090
|
-
|
|
2091
|
-
|
|
2092
|
-
|
|
2093
|
-
|
|
2094
|
-
|
|
2095
|
-
|
|
2096
|
-
|
|
2097
|
-
|
|
2098
|
-
|
|
2099
|
-
|
|
2100
|
-
|
|
2101
|
-
|
|
2102
|
-
|
|
2103
|
-
|
|
2104
|
-
|
|
2105
|
-
|
|
2106
|
-
|
|
2107
|
-
|
|
2108
|
-
|
|
2109
|
-
|
|
2110
|
-
|
|
2111
|
-
|
|
2112
|
-
|
|
2113
|
-
|
|
2114
|
-
|
|
2115
|
-
|
|
2116
|
-
|
|
2117
|
-
|
|
2118
|
-
|
|
2119
|
-
|
|
2120
|
-
|
|
2121
|
-
|
|
2122
|
-
|
|
2123
|
-
|
|
2124
|
-
|
|
2125
|
-
|
|
2126
|
-
|
|
2127
|
-
|
|
2128
|
-
|
|
2129
|
-
|
|
2130
|
-
|
|
2131
|
-
|
|
2132
|
-
|
|
2133
|
-
|
|
2134
|
-
|
|
2135
|
-
|
|
2136
|
-
|
|
2137
|
-
|
|
2138
|
-
|
|
2139
|
-
|
|
2140
|
-
|
|
2141
|
-
|
|
2142
|
-
|
|
2143
|
-
|
|
2144
|
-
|
|
2145
|
-
|
|
2146
|
-
|
|
2147
|
-
|
|
2148
|
-
|
|
2149
|
-
|
|
2150
|
-
|
|
2151
|
-
|
|
2152
|
-
|
|
2153
|
-
|
|
2154
|
-
|
|
2155
|
-
|
|
2156
|
-
|
|
2157
|
-
|
|
2158
|
-
|
|
2159
|
-
|
|
2160
|
-
|
|
2161
|
-
|
|
2162
|
-
|
|
2163
|
-
|
|
2164
|
-
|
|
2165
|
-
|
|
2166
|
-
|
|
2167
|
-
|
|
2168
|
-
|
|
2169
|
-
|
|
2170
|
-
|
|
2171
|
-
|
|
2172
|
-
|
|
2173
|
-
|
|
2174
|
-
|
|
2175
|
-
|
|
2176
|
-
|
|
2177
|
-
|
|
2178
|
-
|
|
2179
|
-
|
|
2180
|
-
|
|
2181
|
-
|
|
2182
|
-
|
|
2183
|
-
|
|
2184
|
-
|
|
2185
|
-
|
|
2186
|
-
|
|
2187
|
-
|
|
2188
|
-
|
|
2189
|
-
|
|
2190
|
-
|
|
2191
|
-
|
|
2192
|
-
|
|
2193
|
-
|
|
2194
|
-
|
|
2195
|
-
|
|
2196
|
-
|
|
2197
|
-
|
|
2198
|
-
|
|
2199
|
-
|
|
2200
|
-
|
|
2201
|
-
|
|
2202
|
-
|
|
2203
|
-
|
|
2204
|
-
|
|
2205
|
-
);
|
|
2206
|
-
}
|
|
2207
|
-
}
|
|
2208
|
-
const jwt = await createCredentialRequestJwtProof({
|
|
2209
|
-
credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
|
|
2210
|
-
signer: options.signer,
|
|
2211
|
-
clientId: options.clientId,
|
|
2212
|
-
issuedAt: options.issuedAt,
|
|
2213
|
-
nonce: options.nonce,
|
|
2214
|
-
keyAttestationJwt: options.keyAttestationJwt,
|
|
2215
|
-
callbacks: this.options.callbacks
|
|
2216
|
-
});
|
|
2217
|
-
return {
|
|
2218
|
-
jwt
|
|
2219
|
-
};
|
|
2220
|
-
}
|
|
2221
|
-
/**
|
|
2222
|
-
* @throws Openid4vciRetrieveCredentialsError - if an unsuccessful response or the response couldn't be parsed as credential response
|
|
2223
|
-
* @throws ValidationError - if validation of the credential request failed
|
|
2224
|
-
* @throws Openid4vciError - if the `credentialConfigurationId` couldn't be found, or if the the format specific request couldn't be constructed
|
|
2225
|
-
*/
|
|
2226
|
-
async retrieveCredentials({
|
|
2227
|
-
issuerMetadata,
|
|
2228
|
-
proof,
|
|
2229
|
-
proofs,
|
|
2230
|
-
credentialConfigurationId,
|
|
2231
|
-
additionalRequestPayload,
|
|
2232
|
-
accessToken,
|
|
2233
|
-
dpop
|
|
2234
|
-
}) {
|
|
2235
|
-
let credentialResponse;
|
|
2236
|
-
if (issuerMetadata.originalDraftVersion === "Draft15" /* Draft15 */ || issuerMetadata.originalDraftVersion === "Draft16" /* Draft16 */) {
|
|
2237
|
-
credentialResponse = await retrieveCredentialsWithCredentialConfigurationId({
|
|
2238
|
-
accessToken,
|
|
2239
|
-
credentialConfigurationId,
|
|
2240
|
-
issuerMetadata,
|
|
2241
|
-
additionalRequestPayload,
|
|
2242
|
-
proof,
|
|
2243
|
-
proofs,
|
|
2244
|
-
callbacks: this.options.callbacks,
|
|
2245
|
-
dpop
|
|
2246
|
-
});
|
|
2247
|
-
} else {
|
|
2248
|
-
const formatPayload = getCredentialRequestFormatPayloadForCredentialConfigurationId({
|
|
2249
|
-
credentialConfigurationId,
|
|
2250
|
-
issuerMetadata
|
|
2251
|
-
});
|
|
2252
|
-
credentialResponse = await retrieveCredentialsWithFormat({
|
|
2253
|
-
accessToken,
|
|
2254
|
-
formatPayload,
|
|
2255
|
-
issuerMetadata,
|
|
2256
|
-
additionalRequestPayload,
|
|
2257
|
-
proof,
|
|
2258
|
-
proofs,
|
|
2259
|
-
callbacks: this.options.callbacks,
|
|
2260
|
-
dpop
|
|
2261
|
-
});
|
|
2262
|
-
}
|
|
2263
|
-
if (!credentialResponse.ok) {
|
|
2264
|
-
throw new Openid4vciRetrieveCredentialsError(
|
|
2265
|
-
`Error retrieving credentials from '${issuerMetadata.credentialIssuer.credential_issuer}'`,
|
|
2266
|
-
credentialResponse,
|
|
2267
|
-
await credentialResponse.response.clone().text()
|
|
2268
|
-
);
|
|
2269
|
-
}
|
|
2270
|
-
return credentialResponse;
|
|
2271
|
-
}
|
|
2272
|
-
/**
|
|
2273
|
-
* @throws Openid4vciRetrieveCredentialsError - if an unsuccessful response or the response couldn't be parsed as credential response
|
|
2274
|
-
* @throws ValidationError - if validation of the credential request failed
|
|
2275
|
-
*/
|
|
2276
|
-
async retrieveDeferredCredentials(options) {
|
|
2277
|
-
const credentialResponse = await retrieveDeferredCredentials({
|
|
2278
|
-
...options,
|
|
2279
|
-
callbacks: this.options.callbacks
|
|
2280
|
-
});
|
|
2281
|
-
if (!credentialResponse.ok) {
|
|
2282
|
-
throw new Openid4vciRetrieveCredentialsError(
|
|
2283
|
-
`Error retrieving deferred credentials from '${options.issuerMetadata.credentialIssuer.credential_issuer}'`,
|
|
2284
|
-
credentialResponse,
|
|
2285
|
-
await credentialResponse.response.clone().text()
|
|
2286
|
-
);
|
|
2287
|
-
}
|
|
2288
|
-
return credentialResponse;
|
|
2289
|
-
}
|
|
2290
|
-
/**
|
|
2291
|
-
* @throws Openid4vciSendNotificationError - if an unsuccessful response
|
|
2292
|
-
* @throws ValidationError - if validation of the notification request failed
|
|
2293
|
-
*/
|
|
2294
|
-
async sendNotification({
|
|
2295
|
-
issuerMetadata,
|
|
2296
|
-
notification,
|
|
2297
|
-
additionalRequestPayload,
|
|
2298
|
-
accessToken,
|
|
2299
|
-
dpop
|
|
2300
|
-
}) {
|
|
2301
|
-
const notificationResponse = await sendNotification({
|
|
2302
|
-
accessToken,
|
|
2303
|
-
issuerMetadata,
|
|
2304
|
-
additionalRequestPayload,
|
|
2305
|
-
callbacks: this.options.callbacks,
|
|
2306
|
-
dpop,
|
|
2307
|
-
notification
|
|
2308
|
-
});
|
|
2309
|
-
if (!notificationResponse.ok) {
|
|
2310
|
-
throw new Openid4vciSendNotificationError(
|
|
2311
|
-
`Error sending notification to '${issuerMetadata.credentialIssuer.credential_issuer}'`,
|
|
2312
|
-
notificationResponse
|
|
2313
|
-
);
|
|
2314
|
-
}
|
|
2315
|
-
return notificationResponse;
|
|
2316
|
-
}
|
|
1472
|
+
constructor(options) {
|
|
1473
|
+
this.options = options;
|
|
1474
|
+
this.oauth2Client = new __openid4vc_oauth2.Oauth2Client({ callbacks: this.options.callbacks });
|
|
1475
|
+
}
|
|
1476
|
+
getKnownCredentialConfigurationsSupported(credentialIssuerMetadata) {
|
|
1477
|
+
return extractKnownCredentialConfigurationSupportedFormats(credentialIssuerMetadata.credential_configurations_supported);
|
|
1478
|
+
}
|
|
1479
|
+
/**
|
|
1480
|
+
* Resolve a credential offer into a credential offer object, handling both
|
|
1481
|
+
* 'credential_offer' and 'credential_offer_uri' params.
|
|
1482
|
+
*/
|
|
1483
|
+
async resolveCredentialOffer(credentialOffer) {
|
|
1484
|
+
return resolveCredentialOffer(credentialOffer, { fetch: this.options.callbacks.fetch });
|
|
1485
|
+
}
|
|
1486
|
+
async resolveIssuerMetadata(credentialIssuer) {
|
|
1487
|
+
return resolveIssuerMetadata(credentialIssuer, { fetch: this.options.callbacks.fetch });
|
|
1488
|
+
}
|
|
1489
|
+
/**
|
|
1490
|
+
* Retrieve an authorization code for a presentation during issuance session
|
|
1491
|
+
*
|
|
1492
|
+
* This can only be called if an authorization challenge was performed before and returned a
|
|
1493
|
+
* `presentation` parameter along with an `auth_session`. If the presentation response included
|
|
1494
|
+
* an `presentation_during_issuance_session` parameter it MUST be included in this request as well.
|
|
1495
|
+
*/
|
|
1496
|
+
async retrieveAuthorizationCodeUsingPresentation(options) {
|
|
1497
|
+
if (!options.credentialOffer.grants?.[__openid4vc_oauth2.authorizationCodeGrantIdentifier]) throw new __openid4vc_oauth2.Oauth2Error(`Provided credential offer does not include the 'authorization_code' grant.`);
|
|
1498
|
+
const authorizationCodeGrant = options.credentialOffer.grants[__openid4vc_oauth2.authorizationCodeGrantIdentifier];
|
|
1499
|
+
const authorizationServer = determineAuthorizationServerForCredentialOffer({
|
|
1500
|
+
issuerMetadata: options.issuerMetadata,
|
|
1501
|
+
grantAuthorizationServer: authorizationCodeGrant.authorization_server
|
|
1502
|
+
});
|
|
1503
|
+
const authorizationServerMetadata = (0, __openid4vc_oauth2.getAuthorizationServerMetadataFromList)(options.issuerMetadata.authorizationServers, authorizationServer);
|
|
1504
|
+
const { authorizationChallengeResponse, dpop } = await new __openid4vc_oauth2.Oauth2Client({ callbacks: this.options.callbacks }).sendAuthorizationChallengeRequest({
|
|
1505
|
+
authorizationServerMetadata,
|
|
1506
|
+
authSession: options.authSession,
|
|
1507
|
+
presentationDuringIssuanceSession: options.presentationDuringIssuanceSession,
|
|
1508
|
+
dpop: options.dpop
|
|
1509
|
+
});
|
|
1510
|
+
return {
|
|
1511
|
+
authorizationChallengeResponse,
|
|
1512
|
+
dpop
|
|
1513
|
+
};
|
|
1514
|
+
}
|
|
1515
|
+
/**
|
|
1516
|
+
* Initiates authorization for credential issuance. It handles the following cases:
|
|
1517
|
+
* - Authorization Challenge
|
|
1518
|
+
* - Pushed Authorization Request
|
|
1519
|
+
* - Regular Authorization url
|
|
1520
|
+
*
|
|
1521
|
+
* In case the authorization challenge request returns an error with `insufficient_authorization`
|
|
1522
|
+
* with a `presentation` field it means the authorization server expects presentation of credentials
|
|
1523
|
+
* before issuance of credentials. If this is the case, the value in `presentation` should be treated
|
|
1524
|
+
* as an openid4vp authorization request and submitted to the verifier. Once the presentation response
|
|
1525
|
+
* has been submitted, the RP will respond with a `presentation_during_issuance_session` parameter.
|
|
1526
|
+
* Together with the `auth_session` parameter returned in this call you can retrieve an `authorization_code`
|
|
1527
|
+
* using
|
|
1528
|
+
*/
|
|
1529
|
+
async initiateAuthorization(options) {
|
|
1530
|
+
if (!options.credentialOffer.grants?.[__openid4vc_oauth2.authorizationCodeGrantIdentifier]) throw new __openid4vc_oauth2.Oauth2Error(`Provided credential offer does not include the 'authorization_code' grant.`);
|
|
1531
|
+
const authorizationCodeGrant = options.credentialOffer.grants[__openid4vc_oauth2.authorizationCodeGrantIdentifier];
|
|
1532
|
+
const authorizationServer = determineAuthorizationServerForCredentialOffer({
|
|
1533
|
+
issuerMetadata: options.issuerMetadata,
|
|
1534
|
+
grantAuthorizationServer: authorizationCodeGrant.authorization_server
|
|
1535
|
+
});
|
|
1536
|
+
const authorizationServerMetadata = (0, __openid4vc_oauth2.getAuthorizationServerMetadataFromList)(options.issuerMetadata.authorizationServers, authorizationServer);
|
|
1537
|
+
const oauth2Client = new __openid4vc_oauth2.Oauth2Client({ callbacks: this.options.callbacks });
|
|
1538
|
+
try {
|
|
1539
|
+
return {
|
|
1540
|
+
...await oauth2Client.initiateAuthorization({
|
|
1541
|
+
clientId: options.clientId,
|
|
1542
|
+
pkceCodeVerifier: options.pkceCodeVerifier,
|
|
1543
|
+
redirectUri: options.redirectUri,
|
|
1544
|
+
scope: options.scope,
|
|
1545
|
+
additionalRequestPayload: {
|
|
1546
|
+
...options.additionalRequestPayload,
|
|
1547
|
+
issuer_state: options.credentialOffer?.grants?.authorization_code?.issuer_state
|
|
1548
|
+
},
|
|
1549
|
+
dpop: options.dpop,
|
|
1550
|
+
resource: options.issuerMetadata.credentialIssuer.credential_issuer,
|
|
1551
|
+
authorizationServerMetadata
|
|
1552
|
+
}),
|
|
1553
|
+
authorizationFlow: AuthorizationFlow.Oauth2Redirect,
|
|
1554
|
+
authorizationServer: authorizationServerMetadata.issuer
|
|
1555
|
+
};
|
|
1556
|
+
} catch (error) {
|
|
1557
|
+
if (error instanceof __openid4vc_oauth2.Oauth2ClientAuthorizationChallengeError && error.errorResponse.error === __openid4vc_oauth2.Oauth2ErrorCodes.InsufficientAuthorization && error.errorResponse.presentation) {
|
|
1558
|
+
if (!error.errorResponse.auth_session) throw new Openid4vciError(`Expected 'auth_session' to be defined with authorization challenge response error '${error.errorResponse.error}' and 'presentation' parameter`);
|
|
1559
|
+
return {
|
|
1560
|
+
authorizationFlow: AuthorizationFlow.PresentationDuringIssuance,
|
|
1561
|
+
openid4vpRequestUrl: error.errorResponse.presentation,
|
|
1562
|
+
authSession: error.errorResponse.auth_session,
|
|
1563
|
+
authorizationServer: authorizationServerMetadata.issuer
|
|
1564
|
+
};
|
|
1565
|
+
}
|
|
1566
|
+
throw error;
|
|
1567
|
+
}
|
|
1568
|
+
}
|
|
1569
|
+
/**
|
|
1570
|
+
* Convenience method around {@link Oauth2Client.createAuthorizationRequestUrl}
|
|
1571
|
+
* but specifically focused on a credential offer
|
|
1572
|
+
*/
|
|
1573
|
+
async createAuthorizationRequestUrlFromOffer(options) {
|
|
1574
|
+
if (!options.credentialOffer.grants?.[__openid4vc_oauth2.authorizationCodeGrantIdentifier]) throw new __openid4vc_oauth2.Oauth2Error(`Provided credential offer does not include the 'authorization_code' grant.`);
|
|
1575
|
+
const authorizationCodeGrant = options.credentialOffer.grants[__openid4vc_oauth2.authorizationCodeGrantIdentifier];
|
|
1576
|
+
const authorizationServer = determineAuthorizationServerForCredentialOffer({
|
|
1577
|
+
issuerMetadata: options.issuerMetadata,
|
|
1578
|
+
grantAuthorizationServer: authorizationCodeGrant.authorization_server
|
|
1579
|
+
});
|
|
1580
|
+
const authorizationServerMetadata = (0, __openid4vc_oauth2.getAuthorizationServerMetadataFromList)(options.issuerMetadata.authorizationServers, authorizationServer);
|
|
1581
|
+
const { authorizationRequestUrl, pkce, dpop } = await this.oauth2Client.createAuthorizationRequestUrl({
|
|
1582
|
+
authorizationServerMetadata,
|
|
1583
|
+
clientId: options.clientId,
|
|
1584
|
+
additionalRequestPayload: {
|
|
1585
|
+
...options.additionalRequestPayload,
|
|
1586
|
+
issuer_state: options.credentialOffer?.grants?.authorization_code?.issuer_state
|
|
1587
|
+
},
|
|
1588
|
+
resource: options.issuerMetadata.credentialIssuer.credential_issuer,
|
|
1589
|
+
redirectUri: options.redirectUri,
|
|
1590
|
+
scope: options.scope,
|
|
1591
|
+
pkceCodeVerifier: options.pkceCodeVerifier,
|
|
1592
|
+
dpop: options.dpop
|
|
1593
|
+
});
|
|
1594
|
+
return {
|
|
1595
|
+
authorizationRequestUrl,
|
|
1596
|
+
pkce,
|
|
1597
|
+
dpop,
|
|
1598
|
+
authorizationServer: authorizationServerMetadata.issuer
|
|
1599
|
+
};
|
|
1600
|
+
}
|
|
1601
|
+
/**
|
|
1602
|
+
* Convenience method around {@link Oauth2Client.retrievePreAuthorizedCodeAccessToken}
|
|
1603
|
+
* but specifically focused on a credential offer
|
|
1604
|
+
*/
|
|
1605
|
+
async retrievePreAuthorizedCodeAccessTokenFromOffer({ credentialOffer, issuerMetadata, additionalRequestPayload, txCode, dpop }) {
|
|
1606
|
+
if (!credentialOffer.grants?.[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier]) throw new __openid4vc_oauth2.Oauth2Error(`The credential offer does not contain the '${__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier}' grant.`);
|
|
1607
|
+
if (credentialOffer.grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier].tx_code && !txCode) throw new __openid4vc_oauth2.Oauth2Error(`Retrieving access token requires a 'tx_code' in the request, but the 'txCode' parameter was not provided.`);
|
|
1608
|
+
const preAuthorizedCode = credentialOffer.grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier]["pre-authorized_code"];
|
|
1609
|
+
const authorizationServer = determineAuthorizationServerForCredentialOffer({
|
|
1610
|
+
grantAuthorizationServer: credentialOffer.grants[__openid4vc_oauth2.preAuthorizedCodeGrantIdentifier].authorization_server,
|
|
1611
|
+
issuerMetadata
|
|
1612
|
+
});
|
|
1613
|
+
const authorizationServerMetadata = (0, __openid4vc_oauth2.getAuthorizationServerMetadataFromList)(issuerMetadata.authorizationServers, authorizationServer);
|
|
1614
|
+
return {
|
|
1615
|
+
...await this.oauth2Client.retrievePreAuthorizedCodeAccessToken({
|
|
1616
|
+
authorizationServerMetadata,
|
|
1617
|
+
preAuthorizedCode,
|
|
1618
|
+
txCode,
|
|
1619
|
+
resource: issuerMetadata.credentialIssuer.credential_issuer,
|
|
1620
|
+
additionalRequestPayload,
|
|
1621
|
+
dpop
|
|
1622
|
+
}),
|
|
1623
|
+
authorizationServer
|
|
1624
|
+
};
|
|
1625
|
+
}
|
|
1626
|
+
/**
|
|
1627
|
+
* Convenience method around {@link Oauth2Client.retrieveAuthorizationCodeAccessTokenFrom}
|
|
1628
|
+
* but specifically focused on a credential offer
|
|
1629
|
+
*/
|
|
1630
|
+
async retrieveAuthorizationCodeAccessTokenFromOffer({ issuerMetadata, additionalRequestPayload, credentialOffer, authorizationCode, pkceCodeVerifier, redirectUri, dpop }) {
|
|
1631
|
+
if (!credentialOffer.grants?.[__openid4vc_oauth2.authorizationCodeGrantIdentifier]) throw new __openid4vc_oauth2.Oauth2Error(`The credential offer does not contain the '${__openid4vc_oauth2.authorizationCodeGrantIdentifier}' grant.`);
|
|
1632
|
+
const authorizationServer = determineAuthorizationServerForCredentialOffer({
|
|
1633
|
+
grantAuthorizationServer: credentialOffer.grants[__openid4vc_oauth2.authorizationCodeGrantIdentifier].authorization_server,
|
|
1634
|
+
issuerMetadata
|
|
1635
|
+
});
|
|
1636
|
+
const authorizationServerMetadata = (0, __openid4vc_oauth2.getAuthorizationServerMetadataFromList)(issuerMetadata.authorizationServers, authorizationServer);
|
|
1637
|
+
return {
|
|
1638
|
+
...await this.oauth2Client.retrieveAuthorizationCodeAccessToken({
|
|
1639
|
+
authorizationServerMetadata,
|
|
1640
|
+
authorizationCode,
|
|
1641
|
+
pkceCodeVerifier,
|
|
1642
|
+
additionalRequestPayload,
|
|
1643
|
+
dpop,
|
|
1644
|
+
redirectUri,
|
|
1645
|
+
resource: issuerMetadata.credentialIssuer.credential_issuer
|
|
1646
|
+
}),
|
|
1647
|
+
authorizationServer
|
|
1648
|
+
};
|
|
1649
|
+
}
|
|
1650
|
+
/**
|
|
1651
|
+
* Request a nonce to be used in credential request proofs from the `nonce_endpoint`
|
|
1652
|
+
*
|
|
1653
|
+
* @throws Openid4vciError - if no `nonce_endpoint` is configured in the issuer metadata
|
|
1654
|
+
* @throws InvalidFetchResponseError - if the nonce endpoint did not return a successful response
|
|
1655
|
+
* @throws ValidationError - if validating the nonce response failed
|
|
1656
|
+
*/
|
|
1657
|
+
async requestNonce(options) {
|
|
1658
|
+
return requestNonce({
|
|
1659
|
+
...options,
|
|
1660
|
+
fetch: this.options.callbacks.fetch
|
|
1661
|
+
});
|
|
1662
|
+
}
|
|
1663
|
+
/**
|
|
1664
|
+
* Creates the jwt proof payload and header to be included in a credential request.
|
|
1665
|
+
*/
|
|
1666
|
+
async createCredentialRequestJwtProof(options) {
|
|
1667
|
+
const credentialConfiguration = options.issuerMetadata.credentialIssuer.credential_configurations_supported[options.credentialConfigurationId];
|
|
1668
|
+
if (!credentialConfiguration) throw new Openid4vciError(`Credential configuration with '${options.credentialConfigurationId}' not found in 'credential_configurations_supported' from credential issuer '${options.issuerMetadata.credentialIssuer.credential_issuer}'`);
|
|
1669
|
+
if (credentialConfiguration.proof_types_supported) {
|
|
1670
|
+
if (!credentialConfiguration.proof_types_supported.jwt) throw new Openid4vciError(`Credential configuration with id '${options.credentialConfigurationId}' does not support the 'jwt' proof type.`);
|
|
1671
|
+
if (!credentialConfiguration.proof_types_supported.jwt.proof_signing_alg_values_supported.includes(options.signer.alg)) throw new Openid4vciError(`Credential configuration with id '${options.credentialConfigurationId}' does not support the '${options.signer.alg}' alg for 'jwt' proof type.`);
|
|
1672
|
+
if (credentialConfiguration.proof_types_supported.jwt.key_attestations_required && !options.keyAttestationJwt) throw new Openid4vciError(`Credential configuration with id '${options.credentialConfigurationId}' requires key attestations for 'jwt' proof type but no 'keyAttestationJwt' was provided`);
|
|
1673
|
+
}
|
|
1674
|
+
return { jwt: await createCredentialRequestJwtProof({
|
|
1675
|
+
credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
|
|
1676
|
+
signer: options.signer,
|
|
1677
|
+
clientId: options.clientId,
|
|
1678
|
+
issuedAt: options.issuedAt,
|
|
1679
|
+
nonce: options.nonce,
|
|
1680
|
+
keyAttestationJwt: options.keyAttestationJwt,
|
|
1681
|
+
callbacks: this.options.callbacks
|
|
1682
|
+
}) };
|
|
1683
|
+
}
|
|
1684
|
+
/**
|
|
1685
|
+
* @throws Openid4vciRetrieveCredentialsError - if an unsuccessful response or the response couldn't be parsed as credential response
|
|
1686
|
+
* @throws ValidationError - if validation of the credential request failed
|
|
1687
|
+
* @throws Openid4vciError - if the `credentialConfigurationId` couldn't be found, or if the the format specific request couldn't be constructed
|
|
1688
|
+
*/
|
|
1689
|
+
async retrieveCredentials({ issuerMetadata, proof, proofs, credentialConfigurationId, additionalRequestPayload, accessToken, dpop }) {
|
|
1690
|
+
let credentialResponse;
|
|
1691
|
+
if (issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft15 || issuerMetadata.originalDraftVersion === Openid4vciDraftVersion.Draft16) credentialResponse = await retrieveCredentialsWithCredentialConfigurationId({
|
|
1692
|
+
accessToken,
|
|
1693
|
+
credentialConfigurationId,
|
|
1694
|
+
issuerMetadata,
|
|
1695
|
+
additionalRequestPayload,
|
|
1696
|
+
proof,
|
|
1697
|
+
proofs,
|
|
1698
|
+
callbacks: this.options.callbacks,
|
|
1699
|
+
dpop
|
|
1700
|
+
});
|
|
1701
|
+
else credentialResponse = await retrieveCredentialsWithFormat({
|
|
1702
|
+
accessToken,
|
|
1703
|
+
formatPayload: getCredentialRequestFormatPayloadForCredentialConfigurationId({
|
|
1704
|
+
credentialConfigurationId,
|
|
1705
|
+
issuerMetadata
|
|
1706
|
+
}),
|
|
1707
|
+
issuerMetadata,
|
|
1708
|
+
additionalRequestPayload,
|
|
1709
|
+
proof,
|
|
1710
|
+
proofs,
|
|
1711
|
+
callbacks: this.options.callbacks,
|
|
1712
|
+
dpop
|
|
1713
|
+
});
|
|
1714
|
+
if (!credentialResponse.ok) throw new Openid4vciRetrieveCredentialsError(`Error retrieving credentials from '${issuerMetadata.credentialIssuer.credential_issuer}'`, credentialResponse, await credentialResponse.response.clone().text());
|
|
1715
|
+
return credentialResponse;
|
|
1716
|
+
}
|
|
1717
|
+
/**
|
|
1718
|
+
* @throws Openid4vciRetrieveCredentialsError - if an unsuccessful response or the response couldn't be parsed as credential response
|
|
1719
|
+
* @throws ValidationError - if validation of the credential request failed
|
|
1720
|
+
*/
|
|
1721
|
+
async retrieveDeferredCredentials(options) {
|
|
1722
|
+
const credentialResponse = await retrieveDeferredCredentials({
|
|
1723
|
+
...options,
|
|
1724
|
+
callbacks: this.options.callbacks
|
|
1725
|
+
});
|
|
1726
|
+
if (!credentialResponse.ok) throw new Openid4vciRetrieveCredentialsError(`Error retrieving deferred credentials from '${options.issuerMetadata.credentialIssuer.credential_issuer}'`, credentialResponse, await credentialResponse.response.clone().text());
|
|
1727
|
+
return credentialResponse;
|
|
1728
|
+
}
|
|
1729
|
+
/**
|
|
1730
|
+
* @throws Openid4vciSendNotificationError - if an unsuccessful response
|
|
1731
|
+
* @throws ValidationError - if validation of the notification request failed
|
|
1732
|
+
*/
|
|
1733
|
+
async sendNotification({ issuerMetadata, notification, additionalRequestPayload, accessToken, dpop }) {
|
|
1734
|
+
const notificationResponse = await sendNotification({
|
|
1735
|
+
accessToken,
|
|
1736
|
+
issuerMetadata,
|
|
1737
|
+
additionalRequestPayload,
|
|
1738
|
+
callbacks: this.options.callbacks,
|
|
1739
|
+
dpop,
|
|
1740
|
+
notification
|
|
1741
|
+
});
|
|
1742
|
+
if (!notificationResponse.ok) throw new Openid4vciSendNotificationError(`Error sending notification to '${issuerMetadata.credentialIssuer.credential_issuer}'`, notificationResponse);
|
|
1743
|
+
return notificationResponse;
|
|
1744
|
+
}
|
|
2317
1745
|
};
|
|
2318
1746
|
|
|
2319
|
-
|
|
2320
|
-
|
|
2321
|
-
var import_utils21 = require("@openid4vc/utils");
|
|
2322
|
-
|
|
2323
|
-
// src/credential-request/credential-response.ts
|
|
2324
|
-
var import_utils18 = require("@openid4vc/utils");
|
|
1747
|
+
//#endregion
|
|
1748
|
+
//#region src/credential-request/credential-response.ts
|
|
2325
1749
|
function createCredentialResponse(options) {
|
|
2326
|
-
|
|
2327
|
-
|
|
2328
|
-
|
|
2329
|
-
|
|
2330
|
-
|
|
2331
|
-
|
|
2332
|
-
|
|
2333
|
-
|
|
2334
|
-
|
|
2335
|
-
|
|
2336
|
-
|
|
2337
|
-
...options.additionalPayload
|
|
2338
|
-
});
|
|
1750
|
+
return (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialResponse, {
|
|
1751
|
+
c_nonce: options.cNonce,
|
|
1752
|
+
c_nonce_expires_in: options.cNonceExpiresInSeconds,
|
|
1753
|
+
credential: options.credential,
|
|
1754
|
+
credentials: options.credentials,
|
|
1755
|
+
notification_id: options.notificationId,
|
|
1756
|
+
transaction_id: options.transactionId,
|
|
1757
|
+
interval: options.interval,
|
|
1758
|
+
format: options.credentialRequest.format?.format,
|
|
1759
|
+
...options.additionalPayload
|
|
1760
|
+
});
|
|
2339
1761
|
}
|
|
2340
1762
|
function createDeferredCredentialResponse(options) {
|
|
2341
|
-
|
|
2342
|
-
|
|
2343
|
-
|
|
2344
|
-
|
|
2345
|
-
|
|
2346
|
-
|
|
1763
|
+
return (0, __openid4vc_utils.parseWithErrorHandling)(zDeferredCredentialResponse, {
|
|
1764
|
+
credentials: options.credentials,
|
|
1765
|
+
notification_id: options.notificationId,
|
|
1766
|
+
interval: options.interval,
|
|
1767
|
+
...options.additionalPayload
|
|
1768
|
+
});
|
|
2347
1769
|
}
|
|
2348
1770
|
|
|
2349
|
-
|
|
2350
|
-
|
|
2351
|
-
var import_zod22 = __toESM(require("zod"));
|
|
1771
|
+
//#endregion
|
|
1772
|
+
//#region src/credential-request/parse-credential-request.ts
|
|
2352
1773
|
function parseCredentialRequest(options) {
|
|
2353
|
-
|
|
2354
|
-
|
|
2355
|
-
|
|
2356
|
-
|
|
2357
|
-
|
|
2358
|
-
|
|
2359
|
-
|
|
2360
|
-
|
|
2361
|
-
|
|
2362
|
-
|
|
2363
|
-
|
|
2364
|
-
|
|
2365
|
-
|
|
2366
|
-
|
|
2367
|
-
|
|
2368
|
-
|
|
2369
|
-
|
|
2370
|
-
|
|
2371
|
-
|
|
2372
|
-
|
|
2373
|
-
|
|
2374
|
-
|
|
2375
|
-
|
|
2376
|
-
|
|
2377
|
-
|
|
2378
|
-
|
|
2379
|
-
|
|
2380
|
-
|
|
2381
|
-
|
|
2382
|
-
|
|
2383
|
-
}
|
|
2384
|
-
if (credentialRequest.credential_identifier) {
|
|
2385
|
-
return {
|
|
2386
|
-
credentialIdentifier: credentialRequest.credential_identifier,
|
|
2387
|
-
credentialRequest,
|
|
2388
|
-
proofs
|
|
2389
|
-
};
|
|
2390
|
-
}
|
|
2391
|
-
if (credentialRequest.format && allCredentialRequestFormatIdentifiers.includes(
|
|
2392
|
-
credentialRequest.format
|
|
2393
|
-
)) {
|
|
2394
|
-
return {
|
|
2395
|
-
// Removes all claims that are not specific to this format
|
|
2396
|
-
format: (0, import_utils19.parseWithErrorHandling)(
|
|
2397
|
-
import_zod22.default.union(allCredentialRequestFormats),
|
|
2398
|
-
credentialRequest,
|
|
2399
|
-
"Unable to validate format specific properties from credential request"
|
|
2400
|
-
),
|
|
2401
|
-
credentialRequest,
|
|
2402
|
-
proofs
|
|
2403
|
-
};
|
|
2404
|
-
}
|
|
2405
|
-
return {
|
|
2406
|
-
credentialRequest,
|
|
2407
|
-
proofs
|
|
2408
|
-
};
|
|
1774
|
+
const credentialRequest = (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialRequest, options.credentialRequest, "Error validating credential request");
|
|
1775
|
+
let proofs;
|
|
1776
|
+
const knownProofs = zCredentialRequestProofs.strict().safeParse(credentialRequest.proofs);
|
|
1777
|
+
if (knownProofs.success) proofs = knownProofs.data;
|
|
1778
|
+
const knownProof = zod.default.union(allCredentialRequestProofs).safeParse(credentialRequest.proof);
|
|
1779
|
+
if (knownProof.success && knownProof.data.proof_type === jwtProofTypeIdentifier) proofs = { [jwtProofTypeIdentifier]: [knownProof.data.jwt] };
|
|
1780
|
+
else if (knownProof.success && knownProof.data.proof_type === attestationProofTypeIdentifier) proofs = { [attestationProofTypeIdentifier]: [knownProof.data.attestation] };
|
|
1781
|
+
if (credentialRequest.credential_configuration_id) {
|
|
1782
|
+
getCredentialConfigurationSupportedById(options.issuerMetadata.credentialIssuer.credential_configurations_supported, credentialRequest.credential_configuration_id);
|
|
1783
|
+
return {
|
|
1784
|
+
credentialConfiguration: extractKnownCredentialConfigurationSupportedFormats(options.issuerMetadata.credentialIssuer.credential_configurations_supported)[credentialRequest.credential_configuration_id],
|
|
1785
|
+
credentialConfigurationId: credentialRequest.credential_configuration_id,
|
|
1786
|
+
credentialRequest,
|
|
1787
|
+
proofs
|
|
1788
|
+
};
|
|
1789
|
+
}
|
|
1790
|
+
if (credentialRequest.credential_identifier) return {
|
|
1791
|
+
credentialIdentifier: credentialRequest.credential_identifier,
|
|
1792
|
+
credentialRequest,
|
|
1793
|
+
proofs
|
|
1794
|
+
};
|
|
1795
|
+
if (credentialRequest.format && allCredentialRequestFormatIdentifiers.includes(credentialRequest.format)) return {
|
|
1796
|
+
format: (0, __openid4vc_utils.parseWithErrorHandling)(zod.default.union(allCredentialRequestFormats), credentialRequest, "Unable to validate format specific properties from credential request"),
|
|
1797
|
+
credentialRequest,
|
|
1798
|
+
proofs
|
|
1799
|
+
};
|
|
1800
|
+
return {
|
|
1801
|
+
credentialRequest,
|
|
1802
|
+
proofs
|
|
1803
|
+
};
|
|
2409
1804
|
}
|
|
2410
1805
|
|
|
2411
|
-
|
|
2412
|
-
|
|
1806
|
+
//#endregion
|
|
1807
|
+
//#region src/credential-request/parse-deferred-credential-request.ts
|
|
2413
1808
|
function parseDeferredCredentialRequest(options) {
|
|
2414
|
-
|
|
2415
|
-
zDeferredCredentialRequest,
|
|
2416
|
-
options.deferredCredentialRequest,
|
|
2417
|
-
"Error validating credential request"
|
|
2418
|
-
);
|
|
2419
|
-
return {
|
|
2420
|
-
deferredCredentialRequest
|
|
2421
|
-
};
|
|
1809
|
+
return { deferredCredentialRequest: (0, __openid4vc_utils.parseWithErrorHandling)(zDeferredCredentialRequest, options.deferredCredentialRequest, "Error validating credential request") };
|
|
2422
1810
|
}
|
|
2423
1811
|
|
|
2424
|
-
|
|
1812
|
+
//#endregion
|
|
1813
|
+
//#region src/formats/proof-type/attestation/attestation-proof-type.ts
|
|
2425
1814
|
async function verifyCredentialRequestAttestationProof(options) {
|
|
2426
|
-
|
|
2427
|
-
|
|
2428
|
-
|
|
2429
|
-
|
|
2430
|
-
return verificationResult;
|
|
1815
|
+
return await verifyKeyAttestationJwt({
|
|
1816
|
+
...options,
|
|
1817
|
+
use: "proof_type.attestation"
|
|
1818
|
+
});
|
|
2431
1819
|
}
|
|
2432
1820
|
|
|
2433
|
-
|
|
1821
|
+
//#endregion
|
|
1822
|
+
//#region src/Openid4vciIssuer.ts
|
|
2434
1823
|
var Openid4vciIssuer = class {
|
|
2435
|
-
|
|
2436
|
-
|
|
2437
|
-
|
|
2438
|
-
|
|
2439
|
-
|
|
2440
|
-
|
|
2441
|
-
|
|
2442
|
-
|
|
2443
|
-
|
|
2444
|
-
|
|
2445
|
-
|
|
2446
|
-
|
|
2447
|
-
|
|
2448
|
-
|
|
2449
|
-
|
|
2450
|
-
|
|
2451
|
-
|
|
2452
|
-
|
|
2453
|
-
|
|
2454
|
-
|
|
2455
|
-
|
|
2456
|
-
|
|
2457
|
-
|
|
2458
|
-
|
|
2459
|
-
|
|
2460
|
-
|
|
2461
|
-
|
|
2462
|
-
|
|
2463
|
-
|
|
2464
|
-
|
|
2465
|
-
|
|
2466
|
-
|
|
2467
|
-
|
|
2468
|
-
|
|
2469
|
-
|
|
2470
|
-
|
|
2471
|
-
|
|
2472
|
-
|
|
2473
|
-
|
|
2474
|
-
|
|
2475
|
-
|
|
2476
|
-
|
|
2477
|
-
|
|
2478
|
-
|
|
2479
|
-
|
|
2480
|
-
|
|
2481
|
-
|
|
2482
|
-
|
|
2483
|
-
|
|
2484
|
-
|
|
2485
|
-
|
|
2486
|
-
|
|
2487
|
-
|
|
2488
|
-
|
|
2489
|
-
|
|
2490
|
-
|
|
2491
|
-
|
|
2492
|
-
|
|
2493
|
-
|
|
2494
|
-
|
|
2495
|
-
|
|
2496
|
-
|
|
2497
|
-
|
|
2498
|
-
|
|
2499
|
-
|
|
2500
|
-
|
|
2501
|
-
|
|
2502
|
-
|
|
2503
|
-
|
|
2504
|
-
|
|
2505
|
-
|
|
2506
|
-
|
|
2507
|
-
|
|
2508
|
-
|
|
2509
|
-
|
|
2510
|
-
|
|
2511
|
-
|
|
2512
|
-
|
|
2513
|
-
|
|
2514
|
-
|
|
2515
|
-
|
|
2516
|
-
|
|
2517
|
-
|
|
2518
|
-
|
|
2519
|
-
|
|
2520
|
-
|
|
2521
|
-
|
|
2522
|
-
|
|
2523
|
-
|
|
2524
|
-
|
|
2525
|
-
|
|
2526
|
-
|
|
2527
|
-
|
|
2528
|
-
|
|
2529
|
-
|
|
2530
|
-
|
|
2531
|
-
|
|
2532
|
-
|
|
2533
|
-
|
|
2534
|
-
|
|
2535
|
-
|
|
2536
|
-
|
|
2537
|
-
|
|
2538
|
-
|
|
2539
|
-
|
|
2540
|
-
|
|
2541
|
-
|
|
2542
|
-
|
|
2543
|
-
|
|
2544
|
-
|
|
2545
|
-
|
|
2546
|
-
|
|
2547
|
-
|
|
2548
|
-
|
|
2549
|
-
|
|
2550
|
-
|
|
2551
|
-
|
|
2552
|
-
|
|
2553
|
-
|
|
2554
|
-
|
|
2555
|
-
|
|
2556
|
-
|
|
2557
|
-
|
|
2558
|
-
|
|
2559
|
-
|
|
2560
|
-
|
|
2561
|
-
|
|
2562
|
-
|
|
2563
|
-
internalMessage: "Error parsing deferred credential request",
|
|
2564
|
-
cause: error
|
|
2565
|
-
}
|
|
2566
|
-
);
|
|
2567
|
-
}
|
|
2568
|
-
}
|
|
2569
|
-
/**
|
|
2570
|
-
* @throws ValidationError - when validation of the credential response fails
|
|
2571
|
-
*/
|
|
2572
|
-
createCredentialResponse(options) {
|
|
2573
|
-
return createCredentialResponse(options);
|
|
2574
|
-
}
|
|
2575
|
-
/**
|
|
2576
|
-
* @throws ValidationError - when validation of the credential response fails
|
|
2577
|
-
*/
|
|
2578
|
-
createDeferredCredentialResponse(options) {
|
|
2579
|
-
return createDeferredCredentialResponse(options);
|
|
2580
|
-
}
|
|
2581
|
-
/**
|
|
2582
|
-
* @throws ValidationError - when validation of the nonce response fails
|
|
2583
|
-
*/
|
|
2584
|
-
createNonceResponse(options) {
|
|
2585
|
-
return createNonceResponse(options);
|
|
2586
|
-
}
|
|
2587
|
-
async verifyWalletAttestation(options) {
|
|
2588
|
-
return new import_oauth220.Oauth2AuthorizationServer({
|
|
2589
|
-
callbacks: this.options.callbacks
|
|
2590
|
-
}).verifyClientAttestation(options);
|
|
2591
|
-
}
|
|
1824
|
+
constructor(options) {
|
|
1825
|
+
this.options = options;
|
|
1826
|
+
}
|
|
1827
|
+
getCredentialIssuerMetadataDraft11(credentialIssuerMetadata) {
|
|
1828
|
+
return (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialIssuerMetadataWithDraft11, credentialIssuerMetadata);
|
|
1829
|
+
}
|
|
1830
|
+
getKnownCredentialConfigurationsSupported(credentialIssuerMetadata) {
|
|
1831
|
+
return extractKnownCredentialConfigurationSupportedFormats(credentialIssuerMetadata.credential_configurations_supported);
|
|
1832
|
+
}
|
|
1833
|
+
/**
|
|
1834
|
+
* Create issuer metadata and validates the structure is correct
|
|
1835
|
+
*/
|
|
1836
|
+
createCredentialIssuerMetadata(credentialIssuerMetadata) {
|
|
1837
|
+
return (0, __openid4vc_utils.parseWithErrorHandling)(zCredentialIssuerMetadata, credentialIssuerMetadata, "Error validating credential issuer metadata");
|
|
1838
|
+
}
|
|
1839
|
+
async createCredentialOffer(options) {
|
|
1840
|
+
return createCredentialOffer({
|
|
1841
|
+
callbacks: this.options.callbacks,
|
|
1842
|
+
credentialConfigurationIds: options.credentialConfigurationIds,
|
|
1843
|
+
grants: options.grants,
|
|
1844
|
+
issuerMetadata: options.issuerMetadata,
|
|
1845
|
+
additionalPayload: options.additionalPayload,
|
|
1846
|
+
credentialOfferScheme: options.credentialOfferScheme,
|
|
1847
|
+
credentialOfferUri: options.credentialOfferUri
|
|
1848
|
+
});
|
|
1849
|
+
}
|
|
1850
|
+
/**
|
|
1851
|
+
* @throws Oauth2ServerErrorResponseError - if verification of the jwt failed. You can extract
|
|
1852
|
+
* the credential error response from this.
|
|
1853
|
+
*/
|
|
1854
|
+
async verifyCredentialRequestJwtProof(options) {
|
|
1855
|
+
try {
|
|
1856
|
+
return await verifyCredentialRequestJwtProof({
|
|
1857
|
+
callbacks: this.options.callbacks,
|
|
1858
|
+
credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
|
|
1859
|
+
expectedNonce: options.expectedNonce,
|
|
1860
|
+
nonceExpiresAt: options.nonceExpiresAt,
|
|
1861
|
+
jwt: options.jwt,
|
|
1862
|
+
clientId: options.clientId,
|
|
1863
|
+
now: options.now
|
|
1864
|
+
});
|
|
1865
|
+
} catch (error) {
|
|
1866
|
+
throw new __openid4vc_oauth2.Oauth2ServerErrorResponseError({
|
|
1867
|
+
error: __openid4vc_oauth2.Oauth2ErrorCodes.InvalidProof,
|
|
1868
|
+
error_description: error instanceof __openid4vc_oauth2.Oauth2JwtVerificationError || error instanceof Openid4vciError ? error.message : "Invalid proof"
|
|
1869
|
+
}, {
|
|
1870
|
+
internalMessage: "Error verifying credential request proof jwt",
|
|
1871
|
+
cause: error
|
|
1872
|
+
});
|
|
1873
|
+
}
|
|
1874
|
+
}
|
|
1875
|
+
/**
|
|
1876
|
+
* @throws Oauth2ServerErrorResponseError - if verification of the key attestation failed. You can extract
|
|
1877
|
+
* the credential error response from this.
|
|
1878
|
+
*/
|
|
1879
|
+
async verifyCredentialRequestAttestationProof(options) {
|
|
1880
|
+
try {
|
|
1881
|
+
return await verifyCredentialRequestAttestationProof({
|
|
1882
|
+
callbacks: this.options.callbacks,
|
|
1883
|
+
expectedNonce: options.expectedNonce,
|
|
1884
|
+
keyAttestationJwt: options.keyAttestationJwt,
|
|
1885
|
+
nonceExpiresAt: options.nonceExpiresAt,
|
|
1886
|
+
now: options.now
|
|
1887
|
+
});
|
|
1888
|
+
} catch (error) {
|
|
1889
|
+
throw new __openid4vc_oauth2.Oauth2ServerErrorResponseError({
|
|
1890
|
+
error: __openid4vc_oauth2.Oauth2ErrorCodes.InvalidProof,
|
|
1891
|
+
error_description: error instanceof __openid4vc_oauth2.Oauth2JwtVerificationError || error instanceof Openid4vciError ? error.message : "Invalid proof"
|
|
1892
|
+
}, {
|
|
1893
|
+
internalMessage: "Error verifying credential request proof attestation",
|
|
1894
|
+
cause: error
|
|
1895
|
+
});
|
|
1896
|
+
}
|
|
1897
|
+
}
|
|
1898
|
+
/**
|
|
1899
|
+
* @throws Oauth2ServerErrorResponseError - when validation of the credential request fails
|
|
1900
|
+
* You can extract the credential error response from this.
|
|
1901
|
+
*/
|
|
1902
|
+
parseCredentialRequest(options) {
|
|
1903
|
+
try {
|
|
1904
|
+
return parseCredentialRequest(options);
|
|
1905
|
+
} catch (error) {
|
|
1906
|
+
throw new __openid4vc_oauth2.Oauth2ServerErrorResponseError({
|
|
1907
|
+
error: __openid4vc_oauth2.Oauth2ErrorCodes.InvalidCredentialRequest,
|
|
1908
|
+
error_description: error instanceof __openid4vc_utils.ValidationError ? error.message : "Invalid request"
|
|
1909
|
+
}, {
|
|
1910
|
+
internalMessage: "Error verifying credential request proof jwt",
|
|
1911
|
+
cause: error
|
|
1912
|
+
});
|
|
1913
|
+
}
|
|
1914
|
+
}
|
|
1915
|
+
/**
|
|
1916
|
+
* @throws Oauth2ServerErrorResponseError - when validation of the deferred credential request fails
|
|
1917
|
+
*/
|
|
1918
|
+
parseDeferredCredentialRequest(options) {
|
|
1919
|
+
try {
|
|
1920
|
+
return parseDeferredCredentialRequest(options);
|
|
1921
|
+
} catch (error) {
|
|
1922
|
+
throw new __openid4vc_oauth2.Oauth2ServerErrorResponseError({
|
|
1923
|
+
error: __openid4vc_oauth2.Oauth2ErrorCodes.InvalidCredentialRequest,
|
|
1924
|
+
error_description: error instanceof __openid4vc_utils.ValidationError ? error.message : "Invalid request"
|
|
1925
|
+
}, {
|
|
1926
|
+
internalMessage: "Error parsing deferred credential request",
|
|
1927
|
+
cause: error
|
|
1928
|
+
});
|
|
1929
|
+
}
|
|
1930
|
+
}
|
|
1931
|
+
/**
|
|
1932
|
+
* @throws ValidationError - when validation of the credential response fails
|
|
1933
|
+
*/
|
|
1934
|
+
createCredentialResponse(options) {
|
|
1935
|
+
return createCredentialResponse(options);
|
|
1936
|
+
}
|
|
1937
|
+
/**
|
|
1938
|
+
* @throws ValidationError - when validation of the credential response fails
|
|
1939
|
+
*/
|
|
1940
|
+
createDeferredCredentialResponse(options) {
|
|
1941
|
+
return createDeferredCredentialResponse(options);
|
|
1942
|
+
}
|
|
1943
|
+
/**
|
|
1944
|
+
* @throws ValidationError - when validation of the nonce response fails
|
|
1945
|
+
*/
|
|
1946
|
+
createNonceResponse(options) {
|
|
1947
|
+
return createNonceResponse(options);
|
|
1948
|
+
}
|
|
1949
|
+
async verifyWalletAttestation(options) {
|
|
1950
|
+
return new __openid4vc_oauth2.Oauth2AuthorizationServer({ callbacks: this.options.callbacks }).verifyClientAttestation(options);
|
|
1951
|
+
}
|
|
2592
1952
|
};
|
|
2593
1953
|
|
|
2594
|
-
|
|
2595
|
-
|
|
1954
|
+
//#endregion
|
|
1955
|
+
//#region src/Openid4vciWalletProvider.ts
|
|
2596
1956
|
var Openid4vciWalletProvider = class {
|
|
2597
|
-
|
|
2598
|
-
|
|
2599
|
-
|
|
2600
|
-
|
|
2601
|
-
|
|
2602
|
-
|
|
2603
|
-
|
|
2604
|
-
|
|
2605
|
-
|
|
2606
|
-
|
|
2607
|
-
|
|
2608
|
-
|
|
2609
|
-
|
|
2610
|
-
|
|
2611
|
-
|
|
2612
|
-
|
|
2613
|
-
|
|
1957
|
+
constructor(options) {
|
|
1958
|
+
this.options = options;
|
|
1959
|
+
}
|
|
1960
|
+
async createWalletAttestationJwt(options) {
|
|
1961
|
+
const additionalPayload = options.additionalPayload ? {
|
|
1962
|
+
wallet_name: options.walletName,
|
|
1963
|
+
wallet_link: options.walletLink,
|
|
1964
|
+
...options.additionalPayload
|
|
1965
|
+
} : {
|
|
1966
|
+
wallet_name: options.walletName,
|
|
1967
|
+
wallet_link: options.walletLink
|
|
1968
|
+
};
|
|
1969
|
+
return await (0, __openid4vc_oauth2.createClientAttestationJwt)({
|
|
1970
|
+
...options,
|
|
1971
|
+
callbacks: this.options.callbacks,
|
|
1972
|
+
additionalPayload
|
|
1973
|
+
});
|
|
1974
|
+
}
|
|
1975
|
+
async createKeyAttestationJwt(options) {
|
|
1976
|
+
return await createKeyAttestationJwt({
|
|
1977
|
+
callbacks: this.options.callbacks,
|
|
1978
|
+
...options
|
|
1979
|
+
});
|
|
1980
|
+
}
|
|
1981
|
+
};
|
|
1982
|
+
|
|
1983
|
+
//#endregion
|
|
1984
|
+
exports.AuthorizationFlow = AuthorizationFlow;
|
|
1985
|
+
exports.Openid4vciClient = Openid4vciClient;
|
|
1986
|
+
exports.Openid4vciDraftVersion = Openid4vciDraftVersion;
|
|
1987
|
+
exports.Openid4vciError = Openid4vciError;
|
|
1988
|
+
exports.Openid4vciIssuer = Openid4vciIssuer;
|
|
1989
|
+
exports.Openid4vciRetrieveCredentialsError = Openid4vciRetrieveCredentialsError;
|
|
1990
|
+
exports.Openid4vciSendNotificationError = Openid4vciSendNotificationError;
|
|
1991
|
+
exports.Openid4vciWalletProvider = Openid4vciWalletProvider;
|
|
1992
|
+
exports.createKeyAttestationJwt = createKeyAttestationJwt;
|
|
1993
|
+
exports.credentialsSupportedToCredentialConfigurationsSupported = credentialsSupportedToCredentialConfigurationsSupported;
|
|
1994
|
+
exports.determineAuthorizationServerForCredentialOffer = determineAuthorizationServerForCredentialOffer;
|
|
1995
|
+
exports.extractScopesForCredentialConfigurationIds = extractScopesForCredentialConfigurationIds;
|
|
1996
|
+
exports.getCredentialConfigurationsMatchingRequestFormat = getCredentialConfigurationsMatchingRequestFormat;
|
|
1997
|
+
Object.defineProperty(exports, 'getGlobalConfig', {
|
|
1998
|
+
enumerable: true,
|
|
1999
|
+
get: function () {
|
|
2000
|
+
return __openid4vc_utils.getGlobalConfig;
|
|
2614
2001
|
}
|
|
2615
|
-
|
|
2616
|
-
|
|
2617
|
-
|
|
2618
|
-
|
|
2619
|
-
|
|
2002
|
+
});
|
|
2003
|
+
exports.parseKeyAttestationJwt = parseKeyAttestationJwt;
|
|
2004
|
+
Object.defineProperty(exports, 'setGlobalConfig', {
|
|
2005
|
+
enumerable: true,
|
|
2006
|
+
get: function () {
|
|
2007
|
+
return __openid4vc_utils.setGlobalConfig;
|
|
2620
2008
|
}
|
|
2621
|
-
};
|
|
2622
|
-
// Annotate the CommonJS export names for ESM import in node:
|
|
2623
|
-
0 && (module.exports = {
|
|
2624
|
-
AuthorizationFlow,
|
|
2625
|
-
Openid4vciClient,
|
|
2626
|
-
Openid4vciDraftVersion,
|
|
2627
|
-
Openid4vciError,
|
|
2628
|
-
Openid4vciIssuer,
|
|
2629
|
-
Openid4vciRetrieveCredentialsError,
|
|
2630
|
-
Openid4vciSendNotificationError,
|
|
2631
|
-
Openid4vciWalletProvider,
|
|
2632
|
-
createKeyAttestationJwt,
|
|
2633
|
-
credentialsSupportedToCredentialConfigurationsSupported,
|
|
2634
|
-
determineAuthorizationServerForCredentialOffer,
|
|
2635
|
-
extractScopesForCredentialConfigurationIds,
|
|
2636
|
-
getCredentialConfigurationsMatchingRequestFormat,
|
|
2637
|
-
getGlobalConfig,
|
|
2638
|
-
parseKeyAttestationJwt,
|
|
2639
|
-
setGlobalConfig,
|
|
2640
|
-
verifyKeyAttestationJwt
|
|
2641
2009
|
});
|
|
2010
|
+
exports.verifyKeyAttestationJwt = verifyKeyAttestationJwt;
|
|
2642
2011
|
//# sourceMappingURL=index.js.map
|