@openid4vc/openid4vp 0.3.0-alpha-20250401105222 → 0.3.0-alpha-20250404080256

package/dist/index.mjs

@@ -1392,11 +1392,17 @@ function jarmAssertMetadataSupported(options) {
 
 // src/authorization-response/create-authorization-response.ts
 async function createOpenid4vpAuthorizationResponse(options) {
-  const { authorizationRequestPayload, jarm, callbacks } = options;
+  const { authorizationRequestPayload, jarm, callbacks, origin } = options;
   const authorizationResponsePayload = {
     ...options.authorizationResponsePayload,
     state: authorizationRequestPayload.state
   };
+  const { clientIdScheme } = getOpenid4vpClientId({
+    responseMode: authorizationRequestPayload.response_mode,
+    clientId: authorizationRequestPayload.client_id,
+    legacyClientIdScheme: authorizationRequestPayload.client_id_scheme,
+    origin
+  });
   if (authorizationRequestPayload.response_mode && isJarmResponseMode(authorizationRequestPayload.response_mode) && !jarm) {
     throw new Oauth2Error8(
       `Missing jarm options for creating Jarm response with response mode '${authorizationRequestPayload.response_mode}'`
@@ -1407,14 +1413,20 @@ async function createOpenid4vpAuthorizationResponse(options) {
       authorizationResponsePayload
     };
   }
-  if (!authorizationRequestPayload.client_metadata) {
+  if (clientIdScheme === "https" && !options.clientMetadata) {
+    throw new Oauth2Error8(
+      "When OpenID Federation is used as the client id scheme (https), passing externally fetched and verified 'clientMetadata' to the 'createOpenid4vpAuthorizationResponse' is required."
+    );
+  }
+  const clientMetadata = options.clientMetadata ?? authorizationRequestPayload.client_metadata;
+  if (!clientMetadata) {
     throw new Oauth2Error8("Missing client metadata in the request params to assert Jarm metadata support.");
   }
   let jwks;
-  if (authorizationRequestPayload.client_metadata.jwks) {
-    jwks = authorizationRequestPayload.client_metadata.jwks;
-  } else if (authorizationRequestPayload.client_metadata.jwks_uri) {
-    jwks = await fetchJwks(authorizationRequestPayload.client_metadata.jwks_uri, options.callbacks.fetch);
+  if (clientMetadata.jwks) {
+    jwks = clientMetadata.jwks;
+  } else if (clientMetadata.jwks_uri) {
+    jwks = await fetchJwks(clientMetadata.jwks_uri, options.callbacks.fetch);
   } else {
     throw new Oauth2ServerErrorResponseError11({
       error: Oauth2ErrorCodes10.InvalidRequest,
@@ -1422,11 +1434,11 @@ async function createOpenid4vpAuthorizationResponse(options) {
     });
   }
   const supportedJarmMetadata = jarmAssertMetadataSupported({
-    clientMetadata: authorizationRequestPayload.client_metadata,
+    clientMetadata,
     serverMetadata: jarm.serverMetadata
   });
   const clientMetaJwks = extractJwksFromClientMetadata({
-    ...authorizationRequestPayload.client_metadata,
+    ...clientMetadata,
     jwks
   });
   if (!clientMetaJwks?.encJwk) {