@openid4vc/openid4vp 0.3.0-alpha-20250225095929 → 0.3.0-alpha-20250225204254

package/dist/index.mjs

@@ -585,7 +585,7 @@ function parseClientIdentifier(options, parserConfig) {
         error_description: 'Using client identifier scheme "redirect_uri" the request MUST NOT be signed.'
       });
     }
-    if (isDcApiRequest) {
+    if (isOpenid4vpAuthorizationRequestDcApi(request)) {
       throw new Oauth2ServerErrorResponseError4({
         error: Oauth2ErrorCodes3.InvalidRequest,
         error_description: `The client identifier scheme 'redirect_uri' is not supported when using the dc_api response mode.`
@@ -661,12 +661,14 @@ function parseClientIdentifier(options, parserConfig) {
           error_description: "Invalid client identifier. Client identifier must be a valid DNS name."
         });
       }
-      const requestUri = jar.authRequestParams.request_uri ?? jar.authRequestParams.response_uri;
-      if (getDomainFromUrl(requestUri) !== identifierPart) {
-        throw new Oauth2ServerErrorResponseError4({
-          error: Oauth2ErrorCodes3.InvalidRequest,
-          error_description: "Invalid client identifier. The fully qualified domain name of the redirect_uri value MUST match the Client Identifier without the prefix x509_san_dns."
-        });
+      if (!isOpenid4vpAuthorizationRequestDcApi(request)) {
+        const uri = request.redirect_uri ?? request.response_uri;
+        if (!uri || getDomainFromUrl(uri) !== identifierPart) {
+          throw new Oauth2ServerErrorResponseError4({
+            error: Oauth2ErrorCodes3.InvalidRequest,
+            error_description: "Invalid client identifier. The fully qualified domain name of the redirect_uri value MUST match the Client Identifier without the prefix x509_san_dns."
+          });
+        }
       }
     } else if (scheme === "x509_san_uri") {
       if (!options.callbacks.getX509CertificateMetadata) {
@@ -686,11 +688,14 @@ function parseClientIdentifier(options, parserConfig) {
           error_description: "Invalid client identifier. Client identifier must be a valid URI."
         });
       }
-      if ((jar.authRequestParams.request_uri ?? jar.authRequestParams.response_uri) !== identifierPart) {
-        throw new Oauth2ServerErrorResponseError4({
-          error: Oauth2ErrorCodes3.InvalidRequest,
-          error_description: "The redirect_uri value MUST match the Client Identifier without the prefix x509_san_uri"
-        });
+      if (!isOpenid4vpAuthorizationRequestDcApi(request)) {
+        const uri = request.redirect_uri || request.response_uri;
+        if (!uri || uri !== identifierPart) {
+          throw new Oauth2ServerErrorResponseError4({
+            error: Oauth2ErrorCodes3.InvalidRequest,
+            error_description: "The redirect_uri value MUST match the Client Identifier without the prefix x509_san_uri"
+          });
+        }
       }
     }
     return {
@@ -723,9 +728,16 @@ function parseClientIdentifier(options, parserConfig) {
   };
 }
 function getDomainFromUrl(url) {
-  const regex = /[#/?]/;
-  const domain = url.split("://")[1].split(regex)[0];
-  return domain;
+  try {
+    const regex = /[#/?]/;
+    const domain = url.split("://")[1].split(regex)[0];
+    return domain;
+  } catch (error) {
+    throw new Oauth2ServerErrorResponseError4({
+      error: Oauth2ErrorCodes3.ServerError,
+      error_description: `Url '${url}' is not a valid URL`
+    });
+  }
 }
 
 // src/jar/handle-jar-request/verify-jar-request.ts