@openid4vc/openid4vp 0.3.0-alpha-20250321221213 → 0.3.0-alpha-20250322133827

package/dist/index.mjs

@@ -92,6 +92,8 @@ var zVpFormatsSupported = z2.record(
 
 // src/models/z-client-metadata.ts
 var zClientMetadata = z3.object({
+  // Up until draft 22
+  jwks_uri: z3.string().url().optional(),
   jwks: z3.optional(zJwkSet),
   vp_formats: z3.optional(zVpFormatsSupported),
   ...zJarmClientMetadata.shape,
@@ -1204,7 +1206,8 @@ function validateOpenId4vpAuthorizationRequestPayload(options) {
 import {
   Oauth2Error as Oauth2Error7,
   Oauth2ErrorCodes as Oauth2ErrorCodes10,
-  Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError11
+  Oauth2ServerErrorResponseError as Oauth2ServerErrorResponseError11,
+  fetchJwks
 } from "@openid4vc/oauth2";
 import { dateToSeconds as dateToSeconds3 } from "@openid4vc/utils";
 
@@ -1316,10 +1319,15 @@ async function createOpenid4vpAuthorizationResponse(options) {
   if (!authorizationRequestPayload.client_metadata) {
     throw new Oauth2Error7("Missing client metadata in the request params to assert Jarm metadata support.");
   }
-  if (!authorizationRequestPayload.client_metadata.jwks) {
+  let jwks;
+  if (authorizationRequestPayload.client_metadata.jwks) {
+    jwks = authorizationRequestPayload.client_metadata.jwks;
+  } else if (authorizationRequestPayload.client_metadata.jwks_uri) {
+    jwks = await fetchJwks(authorizationRequestPayload.client_metadata.jwks_uri, options.callbacks.fetch);
+  } else {
     throw new Oauth2ServerErrorResponseError11({
       error: Oauth2ErrorCodes10.InvalidRequest,
-      error_description: "Missing JWKS in client metadata. Cannot extract encryption JWK."
+      error_description: `Missing 'jwks' or 'jwks_uri' in client metadata. Cannot extract encryption JWK.`
     });
   }
   const supportedJarmMetadata = jarmAssertMetadataSupported({
@@ -1328,7 +1336,7 @@ async function createOpenid4vpAuthorizationResponse(options) {
   });
   const clientMetaJwks = extractJwksFromClientMetadata({
     ...authorizationRequestPayload.client_metadata,
-    jwks: authorizationRequestPayload.client_metadata.jwks
+    jwks
   });
   if (!clientMetaJwks?.encJwk) {
     throw new Oauth2ServerErrorResponseError11({