@openid4vc/openid4vp 0.3.0-alpha-20250304095426 → 0.3.0-alpha-20250307131618

package/dist/index.mjs

@@ -1055,7 +1055,7 @@ import { decodeBase64, encodeToUtf8String, parseIfJson } from "@openid4vc/utils"
 import { z as z14 } from "zod";
 var zTransactionEntry = z14.object({
   type: z14.string(),
-  credential_ids: z14.array(z14.string()).min(1),
+  credential_ids: z14.array(z14.string()).nonempty(),
   transaction_data_hashes_alg: z14.array(z14.string()).optional()
 });
 var zTransactionData = z14.array(zTransactionEntry);
@@ -1071,7 +1071,11 @@ function parseTransactionData(options) {
       error_description: "Failed to parse transaction data."
     });
   }
-  return parsedResult.data;
+  return parsedResult.data.map((decoded2, index) => ({
+    transactionData: decoded2,
+    encoded: transactionData[index],
+    transactionDataIndex: index
+  }));
 }
 
 // src/authorization-request/resolve-authorization-request.ts
@@ -1640,6 +1644,75 @@ var Openid4vpClient = class {
   }
 };
 
+// src/transaction-data/verify-transaction-data.ts
+import {
+  HashAlgorithm,
+  Oauth2ErrorCodes as Oauth2ErrorCodes11,
+  Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError13
+} from "@openid4vc/oauth2";
+import { decodeUtf8String, encodeToBase64Url } from "@openid4vc/utils";
+async function verifyTransactionData(options) {
+  const parsedTransactionData = parseTransactionData({
+    transactionData: options.transactionData
+  });
+  const matchedEntries = [];
+  for (const parsedEntry of parsedTransactionData) {
+    const matchedEntry = await verifyTransactionDataEntry({
+      entry: parsedEntry,
+      callbacks: options.callbacks,
+      credentials: options.credentials
+    });
+    matchedEntries.push(matchedEntry);
+  }
+  return matchedEntries;
+}
+async function verifyTransactionDataEntry({
+  entry,
+  credentials,
+  callbacks
+}) {
+  const allowedAlgs = entry.transactionData.transaction_data_hashes_alg ?? ["sha-256"];
+  const supportedAlgs = allowedAlgs.filter(
+    (alg) => Object.values(HashAlgorithm).includes(alg)
+  );
+  const hashes = {};
+  for (const alg of supportedAlgs) {
+    hashes[alg] = encodeToBase64Url(await callbacks.hash(decodeUtf8String(entry.encoded), alg));
+  }
+  for (const credentialId of entry.transactionData.credential_ids) {
+    const transactionDataHashesCredential = credentials[credentialId];
+    if (!transactionDataHashesCredential) continue;
+    const alg = transactionDataHashesCredential.transaction_data_hashes_alg ?? "sha-256";
+    const hash = hashes[alg];
+    if (!allowedAlgs.includes(alg)) {
+      throw new Oauth2ServerErrorResponseError13({
+        error: Oauth2ErrorCodes11.InvalidTransactionData,
+        error_description: `Transaction data entry with index ${entry.transactionDataIndex} is hashed using alg '${alg}'. However transaction data only allows alg values ${allowedAlgs.join(", ")}.`
+      });
+    }
+    if (!hash) {
+      throw new Oauth2ServerErrorResponseError13({
+        error: Oauth2ErrorCodes11.InvalidTransactionData,
+        error_description: `Transaction data entry with index ${entry.transactionDataIndex} is hashed using unsupported alg '${alg}'. This library only supports verification of transaction data hashes using alg values ${Object.values(HashAlgorithm).join(", ")}. Either verify the hashes outside of this library, or limit the allowed alg values to the ones supported by this library.`
+      });
+    }
+    const credentialHashIndex = transactionDataHashesCredential.transaction_data_hashes.indexOf(hash);
+    if (credentialHashIndex !== -1) {
+      return {
+        transactionDataEntry: entry,
+        credentialId,
+        hash,
+        hashAlg: alg,
+        credentialHashIndex
+      };
+    }
+  }
+  throw new Oauth2ServerErrorResponseError13({
+    error: Oauth2ErrorCodes11.InvalidTransactionData,
+    error_description: `Transaction data entry with index ${entry.transactionDataIndex} does not have a matching hash in any of the submitted credentials`
+  });
+}
+
 // src/Openid4vpVerifier.ts
 var Openid4vpVerifier = class {
   constructor(options) {
@@ -1666,6 +1739,9 @@ var Openid4vpVerifier = class {
   parseTransactionData(options) {
     return parseTransactionData(options);
   }
+  verifyTransactionData(options) {
+    return verifyTransactionData(options);
+  }
 };
 
 // src/models/z-credential-formats.ts