@openid4vc/openid4vp 0.3.0-alpha-20250713113151 → 0.3.0-alpha-20250714090135

package/dist/index.mjs

@@ -754,10 +754,10 @@ function parseAuthorizationRequestVersion(request) {
   if (request.client_metadata?.vp_formats_supported?.mso_mdoc?.issuer_signed_alg_values || request.client_metadata?.vp_formats_supported?.mso_mdoc?.device_signed_alg_values) {
     requirements.push(["<", 28]);
   }
-  if (request.client_metadata?.vp_formats) {
+  if (request.client_metadata?.vp_formats_supported) {
     requirements.push([">=", 27]);
   }
-  if (request.client_metadata?.vp_formats_supported) {
+  if (request.client_metadata?.vp_formats) {
     requirements.push(["<", 27]);
   }
   if (request.client_id?.startsWith("openid_federation:") || request.client_id?.startsWith("decentralized_identifier:")) {
@@ -1354,7 +1354,8 @@ import { z as z14 } from "zod";
 var zTransactionEntry = z14.object({
   type: z14.string(),
   credential_ids: z14.array(z14.string()).nonempty(),
-  transaction_data_hashes_alg: z14.array(z14.string()).optional()
+  // SD-JWT VC specific
+  transaction_data_hashes_alg: z14.array(z14.string()).nonempty().optional()
 }).passthrough();
 var zTransactionData = z14.array(zTransactionEntry);
 
@@ -2022,32 +2023,44 @@ async function verifyTransactionDataEntry({
     hashes[alg] = encodeToBase64Url3(await callbacks.hash(decodeUtf8String(entry.encoded), alg));
   }
   for (const credentialId of entry.transactionData.credential_ids) {
-    const transactionDataHashesCredential = credentials[credentialId];
-    if (!transactionDataHashesCredential) continue;
-    const alg = transactionDataHashesCredential.transaction_data_hashes_alg ?? "sha-256";
-    const hash = hashes[alg];
-    if (!allowedAlgs.includes(alg)) {
-      throw new Oauth2ServerErrorResponseError13({
-        error: Oauth2ErrorCodes11.InvalidTransactionData,
-        error_description: `Transaction data entry with index ${entry.transactionDataIndex} is hashed using alg '${alg}'. However transaction data only allows alg values ${allowedAlgs.join(", ")}.`
-      });
-    }
-    if (!hash) {
-      throw new Oauth2ServerErrorResponseError13({
-        error: Oauth2ErrorCodes11.InvalidTransactionData,
-        error_description: `Transaction data entry with index ${entry.transactionDataIndex} is hashed using unsupported alg '${alg}'. This library only supports verification of transaction data hashes using alg values ${Object.values(HashAlgorithm2).join(", ")}. Either verify the hashes outside of this library, or limit the allowed alg values to the ones supported by this library.`
-      });
-    }
-    const credentialHashIndex = transactionDataHashesCredential.transaction_data_hashes.indexOf(hash);
-    if (credentialHashIndex !== -1) {
-      return {
-        transactionDataEntry: entry,
-        credentialId,
+    const transactionDataHashesCredentials = credentials[credentialId];
+    if (!transactionDataHashesCredentials) continue;
+    const presentations = [];
+    for (const transactionDataHashesCredential of transactionDataHashesCredentials) {
+      const alg = transactionDataHashesCredential.transaction_data_hashes_alg ?? "sha-256";
+      const hash = hashes[alg];
+      const presentationIndex = transactionDataHashesCredentials.indexOf(transactionDataHashesCredential);
+      if (!allowedAlgs.includes(alg)) {
+        throw new Oauth2ServerErrorResponseError13({
+          error: Oauth2ErrorCodes11.InvalidTransactionData,
+          error_description: `Transaction data entry with index ${entry.transactionDataIndex} for presentation ${credentialId} with index ${presentationIndex} is hashed using alg '${alg}'. However transaction data only allows alg values ${allowedAlgs.join(", ")}.`
+        });
+      }
+      if (!hash) {
+        throw new Oauth2ServerErrorResponseError13({
+          error: Oauth2ErrorCodes11.InvalidTransactionData,
+          error_description: `Transaction data entry with index ${entry.transactionDataIndex} for presentation ${credentialId} with index ${presentationIndex} is hashed using unsupported alg '${alg}'. This library only supports verification of transaction data hashes using alg values ${Object.values(HashAlgorithm2).join(", ")}. Either verify the hashes outside of this library, or limit the allowed alg values to the ones supported by this library.`
+        });
+      }
+      const credentialHashIndex = transactionDataHashesCredential.transaction_data_hashes.indexOf(hash);
+      if (credentialHashIndex === -1) {
+        throw new Oauth2ServerErrorResponseError13({
+          error: Oauth2ErrorCodes11.InvalidTransactionData,
+          error_description: `Transaction data entry with index ${entry.transactionDataIndex} for presentation ${credentialId} with index ${presentationIndex} does not have a matching hash in the transaction_data_hashes`
+        });
+      }
+      presentations.push({
+        credentialHashIndex,
         hash,
         hashAlg: alg,
-        credentialHashIndex
-      };
+        presentationIndex
+      });
     }
+    return {
+      transactionDataEntry: entry,
+      credentialId,
+      presentations
+    };
   }
   throw new Oauth2ServerErrorResponseError13({
     error: Oauth2ErrorCodes11.InvalidTransactionData,
@@ -2081,6 +2094,14 @@ var Openid4vpVerifier = class {
   parseTransactionData(options) {
     return parseTransactionData(options);
   }
+  /**
+   * Verify transaction data against submitted credentials.
+   *
+   * NOTE: this expects transaction data based authorization based on hashes. This is the method defined
+   * for SD-JWT VC, but for mDOCs it's much more generic. If you're using transaction data with mDOCs based
+   * on hashes, you can extract the values from the DeviceResponse, otherwise you must verify the transaction data
+   * manually.
+   */
   verifyTransactionData(options) {
     return verifyTransactionData({
       ...options,