@sphereon/oid4vci-client 0.10.3 → 0.10.4-next.119

package/lib/AccessTokenClientV1_0_11.ts

@@ -0,0 +1,250 @@
+import {
+  AccessTokenRequest,
+  AccessTokenRequestOpts,
+  AccessTokenResponse,
+  assertedUniformCredentialOffer,
+  AuthorizationServerOpts,
+  AuthzFlowType,
+  convertJsonToURI,
+  CredentialOfferV1_0_11,
+  CredentialOfferV1_0_13,
+  EndpointMetadata,
+  formPost,
+  getIssuerFromCredentialOfferPayload,
+  GrantTypes,
+  IssuerOpts,
+  JsonURIMode,
+  OpenIDResponse,
+  PRE_AUTH_CODE_LITERAL,
+  TokenErrorResponse,
+  toUniformCredentialOfferRequest,
+  UniformCredentialOfferPayload,
+} from '@sphereon/oid4vci-common';
+import { ObjectUtils } from '@sphereon/ssi-types';
+import Debug from 'debug';
+
+import { MetadataClientV1_0_13 } from './MetadataClientV1_0_13';
+
+const debug = Debug('sphereon:oid4vci:token');
+
+export class AccessTokenClientV1_0_11 {
+  public async acquireAccessToken(opts: AccessTokenRequestOpts): Promise<OpenIDResponse<AccessTokenResponse>> {
+    const { asOpts, pin, codeVerifier, code, redirectUri, metadata } = opts;
+
+    const credentialOffer = opts.credentialOffer ? await assertedUniformCredentialOffer(opts.credentialOffer) : undefined;
+    const isPinRequired = credentialOffer && this.isPinRequiredValue(credentialOffer.credential_offer);
+    const issuer =
+      opts.credentialIssuer ??
+      (credentialOffer ? getIssuerFromCredentialOfferPayload(credentialOffer.credential_offer) : (metadata?.issuer as string));
+    if (!issuer) {
+      throw Error('Issuer required at this point');
+    }
+    const issuerOpts = {
+      issuer,
+    };
+
+    return await this.acquireAccessTokenUsingRequest({
+      accessTokenRequest: await this.createAccessTokenRequest({
+        credentialOffer,
+        asOpts,
+        codeVerifier,
+        code,
+        redirectUri,
+        pin,
+      }),
+      isPinRequired,
+      metadata,
+      asOpts,
+      issuerOpts,
+    });
+  }
+
+  public async acquireAccessTokenUsingRequest({
+    accessTokenRequest,
+    isPinRequired,
+    metadata,
+    asOpts,
+    issuerOpts,
+  }: {
+    accessTokenRequest: AccessTokenRequest;
+    isPinRequired?: boolean;
+    metadata?: EndpointMetadata;
+    asOpts?: AuthorizationServerOpts;
+    issuerOpts?: IssuerOpts;
+  }): Promise<OpenIDResponse<AccessTokenResponse>> {
+    this.validate(accessTokenRequest, isPinRequired);
+
+    const requestTokenURL = AccessTokenClientV1_0_11.determineTokenURL({
+      asOpts,
+      issuerOpts,
+      metadata: metadata
+        ? metadata
+        : issuerOpts?.fetchMetadata
+          ? await MetadataClientV1_0_13.retrieveAllMetadata(issuerOpts.issuer, { errorOnNotFound: false })
+          : undefined,
+    });
+
+    return this.sendAuthCode(requestTokenURL, accessTokenRequest);
+  }
+
+  public async createAccessTokenRequest(opts: AccessTokenRequestOpts): Promise<AccessTokenRequest> {
+    const { asOpts, pin, codeVerifier, code, redirectUri } = opts;
+    const credentialOfferRequest = opts.credentialOffer
+      ? await toUniformCredentialOfferRequest(opts.credentialOffer as CredentialOfferV1_0_11 | CredentialOfferV1_0_13)
+      : undefined;
+    const request: Partial<AccessTokenRequest> = {};
+
+    if (asOpts?.clientId) {
+      request.client_id = asOpts.clientId;
+    }
+
+    if (credentialOfferRequest?.supportedFlows.includes(AuthzFlowType.PRE_AUTHORIZED_CODE_FLOW)) {
+      this.assertNumericPin(this.isPinRequiredValue(credentialOfferRequest.credential_offer), pin);
+      request.user_pin = pin;
+
+      request.grant_type = GrantTypes.PRE_AUTHORIZED_CODE;
+      // we actually know it is there because of the isPreAuthCode call
+      request[PRE_AUTH_CODE_LITERAL] =
+        credentialOfferRequest?.credential_offer.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.[PRE_AUTH_CODE_LITERAL];
+
+      return request as AccessTokenRequest;
+    }
+
+    if (!credentialOfferRequest || credentialOfferRequest.supportedFlows.includes(AuthzFlowType.AUTHORIZATION_CODE_FLOW)) {
+      request.grant_type = GrantTypes.AUTHORIZATION_CODE;
+      request.code = code;
+      request.redirect_uri = redirectUri;
+
+      if (codeVerifier) {
+        request.code_verifier = codeVerifier;
+      }
+
+      return request as AccessTokenRequest;
+    }
+
+    throw new Error('Credential offer request does not follow neither pre-authorized code nor authorization code flow requirements.');
+  }
+
+  private assertPreAuthorizedGrantType(grantType: GrantTypes): void {
+    if (GrantTypes.PRE_AUTHORIZED_CODE !== grantType) {
+      throw new Error("grant type must be 'urn:ietf:params:oauth:grant-type:pre-authorized_code'");
+    }
+  }
+
+  private assertAuthorizationGrantType(grantType: GrantTypes): void {
+    if (GrantTypes.AUTHORIZATION_CODE !== grantType) {
+      throw new Error("grant type must be 'authorization_code'");
+    }
+  }
+
+  private isPinRequiredValue(requestPayload: UniformCredentialOfferPayload): boolean {
+    let isPinRequired = false;
+    if (!requestPayload) {
+      throw new Error(TokenErrorResponse.invalid_request);
+    }
+    const issuer = getIssuerFromCredentialOfferPayload(requestPayload);
+    if (requestPayload.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']) {
+      isPinRequired = requestPayload.grants['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.user_pin_required ?? false;
+    }
+    debug(`Pin required for issuer ${issuer}: ${isPinRequired}`);
+    return isPinRequired;
+  }
+
+  private assertNumericPin(isPinRequired?: boolean, pin?: string): void {
+    if (isPinRequired) {
+      if (!pin || !/^\d{1,8}$/.test(pin)) {
+        debug(`Pin is not 1 to 8 digits long`);
+        throw new Error('A valid pin consisting of maximal 8 numeric characters must be present.');
+      }
+    } else if (pin) {
+      debug(`Pin set, whilst not required`);
+      throw new Error('Cannot set a pin, when the pin is not required.');
+    }
+  }
+
+  private assertNonEmptyPreAuthorizedCode(accessTokenRequest: AccessTokenRequest): void {
+    if (!accessTokenRequest[PRE_AUTH_CODE_LITERAL]) {
+      debug(`No pre-authorized code present, whilst it is required`);
+      throw new Error('Pre-authorization must be proven by presenting the pre-authorized code. Code must be present.');
+    }
+  }
+
+  private assertNonEmptyCodeVerifier(accessTokenRequest: AccessTokenRequest): void {
+    if (!accessTokenRequest.code_verifier) {
+      debug('No code_verifier present, whilst it is required');
+      throw new Error('Authorization flow requires the code_verifier to be present');
+    }
+  }
+
+  private assertNonEmptyCode(accessTokenRequest: AccessTokenRequest): void {
+    if (!accessTokenRequest.code) {
+      debug('No code present, whilst it is required');
+      throw new Error('Authorization flow requires the code to be present');
+    }
+  }
+  private validate(accessTokenRequest: AccessTokenRequest, isPinRequired?: boolean): void {
+    if (accessTokenRequest.grant_type === GrantTypes.PRE_AUTHORIZED_CODE) {
+      this.assertPreAuthorizedGrantType(accessTokenRequest.grant_type);
+      this.assertNonEmptyPreAuthorizedCode(accessTokenRequest);
+      this.assertNumericPin(isPinRequired, accessTokenRequest.user_pin);
+    } else if (accessTokenRequest.grant_type === GrantTypes.AUTHORIZATION_CODE) {
+      this.assertAuthorizationGrantType(accessTokenRequest.grant_type);
+      this.assertNonEmptyCodeVerifier(accessTokenRequest);
+      this.assertNonEmptyCode(accessTokenRequest);
+    } else {
+      this.throwNotSupportedFlow();
+    }
+  }
+
+  private async sendAuthCode(requestTokenURL: string, accessTokenRequest: AccessTokenRequest): Promise<OpenIDResponse<AccessTokenResponse>> {
+    return await formPost(requestTokenURL, convertJsonToURI(accessTokenRequest, { mode: JsonURIMode.X_FORM_WWW_URLENCODED }));
+  }
+
+  public static determineTokenURL({
+    asOpts,
+    issuerOpts,
+    metadata,
+  }: {
+    asOpts?: AuthorizationServerOpts;
+    issuerOpts?: IssuerOpts;
+    metadata?: EndpointMetadata;
+  }): string {
+    if (!asOpts && !metadata?.token_endpoint && !issuerOpts) {
+      throw new Error('Cannot determine token URL if no issuer, metadata and no Authorization Server values are present');
+    }
+    let url;
+    if (asOpts && asOpts.as) {
+      url = this.creatTokenURLFromURL(asOpts.as, asOpts?.allowInsecureEndpoints, asOpts.tokenEndpoint);
+    } else if (metadata?.token_endpoint) {
+      url = metadata.token_endpoint;
+    } else {
+      if (!issuerOpts?.issuer) {
+        throw Error('Either authorization server options, a token endpoint or issuer options are required at this point');
+      }
+      url = this.creatTokenURLFromURL(issuerOpts.issuer, asOpts?.allowInsecureEndpoints, issuerOpts.tokenEndpoint);
+    }
+
+    if (!url || !ObjectUtils.isString(url)) {
+      throw new Error('No authorization server token URL present. Cannot acquire access token');
+    }
+    debug(`Token endpoint determined to be ${url}`);
+    return url;
+  }
+
+  private static creatTokenURLFromURL(url: string, allowInsecureEndpoints?: boolean, tokenEndpoint?: string): string {
+    if (allowInsecureEndpoints !== true && url.startsWith('http:')) {
+      throw Error(
+        `Unprotected token endpoints are not allowed ${url}. Use the 'allowInsecureEndpoints' param if you really need this for dev/testing!`,
+      );
+    }
+    const hostname = url.replace(/https?:\/\//, '').replace(/\/$/, '');
+    const endpoint = tokenEndpoint ? (tokenEndpoint.startsWith('/') ? tokenEndpoint : tokenEndpoint.substring(1)) : '/token';
+    const scheme = url.split('://')[0];
+    return `${scheme ? scheme + '://' : 'https://'}${hostname}${endpoint}`;
+  }
+
+  private throwNotSupportedFlow(): void {
+    debug(`Only pre-authorized or authorization code flows supported.`);
+    throw new Error('Only pre-authorized-code or authorization code flows are supported');
+  }
+}

package/lib/AuthorizationCodeClient.ts

@@ -3,63 +3,165 @@ import {
   AuthorizationRequestOpts,
   CodeChallengeMethod,
   convertJsonToURI,
+  CreateRequestObjectMode,
+  CredentialConfigurationSupportedV1_0_13,
+  CredentialOfferPayloadV1_0_13,
   CredentialOfferRequestWithBaseUrl,
-  CredentialSupported,
-  EndpointMetadataResult,
+  determineSpecVersionFromOffer,
+  EndpointMetadataResultV1_0_13,
   formPost,
   JsonURIMode,
+  Jwt,
+  OID4VCICredentialFormat,
+  OpenId4VCIVersion,
   PARMode,
   PKCEOpts,
   PushedAuthorizationResponse,
+  RequestObjectOpts,
   ResponseType,
 } from '@sphereon/oid4vci-common';
 import Debug from 'debug';
 
+import { ProofOfPossessionBuilder } from './ProofOfPossessionBuilder';
+
 const debug = Debug('sphereon:oid4vci');
 
+export async function createSignedAuthRequestWhenNeeded(requestObject: Record<string, any>, opts: RequestObjectOpts & { aud?: string }) {
+  if (opts.requestObjectMode === CreateRequestObjectMode.REQUEST_URI) {
+    throw Error(`Request Object Mode ${opts.requestObjectMode} is not supported yet`);
+  } else if (opts.requestObjectMode === CreateRequestObjectMode.REQUEST_OBJECT) {
+    if (typeof opts.signCallbacks?.signCallback !== 'function') {
+      throw Error(`No request object sign callback found, whilst request object mode was set to ${opts.requestObjectMode}`);
+    } else if (!opts.kid) {
+      throw Error(`No kid found, whilst request object mode was set to ${opts.requestObjectMode}`);
+    }
+    let client_metadata: any
+    if (opts.clientMetadata || opts.jwksUri) {
+      client_metadata = opts.clientMetadata ?? {};
+      if (opts.jwksUri) {
+        client_metadata['jwks_uri'] = opts.jwksUri;
+      }
+    }
+    let authorization_details = requestObject['authorization_details']
+    if (typeof authorization_details === 'string') {
+      authorization_details = JSON.parse(requestObject.authorization_details);
+    }
+    if (!requestObject.aud && opts.aud) {
+      requestObject.aud = opts.aud;
+    }
+    const iss = requestObject.iss ?? opts.iss ?? requestObject.client_id
+
+    const jwt: Jwt = { header: { alg: 'ES256', kid: opts.kid, typ: 'jwt' }, payload: {...requestObject, iss, authorization_details, ...(client_metadata && {client_metadata})} };
+    const pop = await ProofOfPossessionBuilder.fromJwt({
+      jwt,
+      callbacks: opts.signCallbacks,
+      version: OpenId4VCIVersion.VER_1_0_11,
+      mode: 'jwt',
+    }).build();
+    requestObject['request'] = pop.jwt;
+  }
+}
+function filterSupportedCredentials(
+  credentialOffer: CredentialOfferPayloadV1_0_13,
+  credentialsSupported?: Record<string, CredentialConfigurationSupportedV1_0_13>,
+): (CredentialConfigurationSupportedV1_0_13 & { configuration_id: string })[] {
+  if (!credentialOffer.credential_configuration_ids || !credentialsSupported) {
+    return [];
+  }
+  return Object.entries(credentialsSupported)
+    .filter((entry) => credentialOffer.credential_configuration_ids?.includes(entry[0]))
+    .map((entry) => {
+      return { ...entry[1], configuration_id: entry[0] };
+    });
+}
+
 export const createAuthorizationRequestUrl = async ({
   pkce,
   endpointMetadata,
   authorizationRequest,
   credentialOffer,
-  credentialsSupported,
+  credentialConfigurationSupported,
+  clientId,
+  version,
 }: {
   pkce: PKCEOpts;
-  endpointMetadata: EndpointMetadataResult;
+  endpointMetadata: EndpointMetadataResultV1_0_13;
   authorizationRequest: AuthorizationRequestOpts;
   credentialOffer?: CredentialOfferRequestWithBaseUrl;
-  credentialsSupported?: CredentialSupported[];
+  credentialConfigurationSupported?: Record<string, CredentialConfigurationSupportedV1_0_13>;
+  clientId?: string;
+  version?: OpenId4VCIVersion;
 }): Promise<string> => {
-  const { redirectUri, clientId } = authorizationRequest;
+  function removeDisplayAndValueTypes(obj: any): void {
+    for (const prop in obj) {
+      if (['display', 'value_type'].includes(prop)) {
+        delete obj[prop];
+      } else if (typeof obj[prop] === 'object') {
+        removeDisplayAndValueTypes(obj[prop]);
+      }
+    }
+  }
+
+  const { redirectUri, requestObjectOpts = { requestObjectMode: CreateRequestObjectMode.NONE } } = authorizationRequest;
+  const client_id = clientId ?? authorizationRequest.clientId;
+
   let { scope, authorizationDetails } = authorizationRequest;
   const parMode = endpointMetadata?.credentialIssuerMetadata?.require_pushed_authorization_requests
     ? PARMode.REQUIRE
-    : authorizationRequest.parMode ?? PARMode.AUTO;
+    : authorizationRequest.parMode ?? (client_id ? PARMode.AUTO : PARMode.NEVER);
   // Scope and authorization_details can be used in the same authorization request
   // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-rar-23#name-relationship-to-scope-param
   if (!scope && !authorizationDetails) {
     if (!credentialOffer) {
       throw Error('Please provide a scope or authorization_details if no credential offer is present');
     }
-    const creds = credentialOffer.credential_offer.credentials;
+    if ('credentials' in credentialOffer.credential_offer) {
+      throw new Error('CredentialOffer format is wrong.');
+    }
+    const ver = version ?? determineSpecVersionFromOffer(credentialOffer.credential_offer) ?? OpenId4VCIVersion.VER_1_0_13;
+    const creds =
+      ver === OpenId4VCIVersion.VER_1_0_13
+        ? filterSupportedCredentials(credentialOffer.credential_offer as CredentialOfferPayloadV1_0_13, credentialConfigurationSupported)
+        : [];
 
     // FIXME: complains about VCT for sd-jwt
     // eslint-disable-next-line @typescript-eslint/ban-ts-comment
     // @ts-ignore
-    authorizationDetails = creds
-      .flatMap((cred) => (typeof cred === 'string' ? credentialsSupported : (cred as CredentialSupported)))
-      .filter((cred) => !!cred)
-      .map((cred) => {
-        return {
-          ...cred,
-          type: 'openid_credential',
-          locations: [endpointMetadata.issuer],
-
-          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-          // @ts-ignore
-          format: cred!.format,
-        } satisfies AuthorizationDetails;
-      });
+    authorizationDetails = creds.flatMap((cred) => {
+      const locations = [credentialOffer?.credential_offer.credential_issuer ?? endpointMetadata.issuer];
+      const credential_configuration_id: string | undefined = cred.configuration_id;
+      const vct: string | undefined = cred.vct;
+      let format: OID4VCICredentialFormat | undefined;
+
+      if (!credential_configuration_id) {
+        format = cred.format;
+      }
+      if (!credential_configuration_id && !cred.format) {
+        throw Error('format is required in authorization details');
+      }
+
+      const meta: any = {};
+      const credential_definition = cred.credential_definition;
+      if (credential_definition?.type && !format) {
+        // ype: OPTIONAL. Array as defined in Appendix A.1.1.2. This claim contains the type values the Wallet requests authorization for at the Credential Issuer. It MUST be present if the claim format is present in the root of the authorization details object. It MUST not be present otherwise.
+        // It meens we have a config_id, already mapping it to an explicit format and types
+        delete credential_definition.type;
+      }
+      if (credential_definition.credentialSubject) {
+        removeDisplayAndValueTypes(credential_definition.credentialSubject);
+      }
+
+      return {
+        type: 'openid_credential',
+        ...meta,
+        locations,
+        ...(credential_definition && { credential_definition }),
+        ...(credential_configuration_id && { credential_configuration_id }),
+        ...(format && { format }),
+        ...(vct && { vct }),
+        ...(cred.claims && { claims: removeDisplayAndValueTypes(JSON.parse(JSON.stringify(cred.claims))) }),
+      } as AuthorizationDetails;
+    });
     if (!authorizationDetails || authorizationDetails.length === 0) {
       throw Error(`Could not create authorization details from credential offer. Please pass in explicit details`);
     }
@@ -74,7 +176,7 @@ export const createAuthorizationRequestUrl = async ({
     scope = ['openid', scope].filter((s) => !!s).join(' ');
   }
 
-  let queryObj: { [key: string]: string } | PushedAuthorizationResponse = {
+  let queryObj: Record<string, any> | PushedAuthorizationResponse = {
     response_type: ResponseType.AUTH_CODE,
     ...(!pkce.disabled && {
       code_challenge_method: pkce.codeChallengeMethod ?? CodeChallengeMethod.S256,
@@ -82,7 +184,7 @@ export const createAuthorizationRequestUrl = async ({
     }),
     authorization_details: JSON.stringify(handleAuthorizationDetails(endpointMetadata, authorizationDetails)),
     ...(redirectUri && { redirect_uri: redirectUri }),
-    ...(clientId && { client_id: clientId }),
+    ...(client_id && { client_id }),
     ...(credentialOffer?.issuerState && { issuer_state: credentialOffer.issuerState }),
     scope,
   };
@@ -106,10 +208,11 @@ export const createAuthorizationRequestUrl = async ({
         throw Error(`PAR error: ${parResponse.origResponse.statusText}`);
       }
     } else {
-      debug(`PAR response: ${(parResponse.successBody, null, 2)}`);
-      queryObj = { request_uri: parResponse.successBody.request_uri };
+      debug(`PAR response: ${JSON.stringify(parResponse.successBody, null, 2)}`);
+      queryObj = { /*response_type: ResponseType.AUTH_CODE,*/ client_id, request_uri: parResponse.successBody.request_uri };
     }
   }
+  await createSignedAuthRequestWhenNeeded(queryObj, { ...requestObjectOpts, aud: endpointMetadata.authorization_server });
 
   debug(`Object that will become query params: ` + JSON.stringify(queryObj, null, 2));
   const url = convertJsonToURI(queryObj, {
@@ -124,7 +227,7 @@ export const createAuthorizationRequestUrl = async ({
 };
 
 const handleAuthorizationDetails = (
-  endpointMetadata: EndpointMetadataResult,
+  endpointMetadata: EndpointMetadataResultV1_0_13,
   authorizationDetails?: AuthorizationDetails | AuthorizationDetails[],
 ): AuthorizationDetails | AuthorizationDetails[] | undefined => {
   if (authorizationDetails) {
@@ -143,7 +246,7 @@ const handleAuthorizationDetails = (
   return authorizationDetails;
 };
 
-const handleLocations = (endpointMetadata: EndpointMetadataResult, authorizationDetails: AuthorizationDetails) => {
+const handleLocations = (endpointMetadata: EndpointMetadataResultV1_0_13, authorizationDetails: AuthorizationDetails) => {
   if (typeof authorizationDetails === 'string') {
     // backwards compat for older versions of the lib
     return authorizationDetails;

package/lib/AuthorizationCodeClientV1_0_11.ts

@@ -0,0 +1,170 @@
+import {
+  AuthorizationDetails,
+  AuthorizationRequestOpts,
+  CodeChallengeMethod,
+  convertJsonToURI,
+  CreateRequestObjectMode,
+  CredentialOfferFormat,
+  CredentialOfferPayloadV1_0_11,
+  CredentialOfferRequestWithBaseUrl,
+  CredentialsSupportedLegacy,
+  EndpointMetadataResultV1_0_11,
+  formPost,
+  JsonURIMode,
+  PARMode,
+  PKCEOpts,
+  PushedAuthorizationResponse,
+  ResponseType,
+} from '@sphereon/oid4vci-common';
+import Debug from 'debug';
+
+import { createSignedAuthRequestWhenNeeded } from './AuthorizationCodeClient';
+
+const debug = Debug('sphereon:oid4vci');
+
+export const createAuthorizationRequestUrlV1_0_11 = async ({
+  pkce,
+  endpointMetadata,
+  authorizationRequest,
+  credentialOffer,
+  credentialsSupported,
+}: {
+  pkce: PKCEOpts;
+  endpointMetadata: EndpointMetadataResultV1_0_11;
+  authorizationRequest: AuthorizationRequestOpts;
+  credentialOffer?: CredentialOfferRequestWithBaseUrl;
+  credentialsSupported?: CredentialsSupportedLegacy[];
+}): Promise<string> => {
+  const { redirectUri, clientId, requestObjectOpts = { requestObjectMode: CreateRequestObjectMode.NONE } } = authorizationRequest;
+  let { scope, authorizationDetails } = authorizationRequest;
+
+  const parMode = endpointMetadata?.credentialIssuerMetadata?.require_pushed_authorization_requests
+    ? PARMode.REQUIRE
+    : authorizationRequest.parMode ?? PARMode.AUTO;
+  // Scope and authorization_details can be used in the same authorization request
+  // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-rar-23#name-relationship-to-scope-param
+  if (!scope && !authorizationDetails) {
+    if (!credentialOffer) {
+      throw Error('Please provide a scope or authorization_details if no credential offer is present');
+    }
+    const creds: (CredentialOfferFormat | string)[] = (credentialOffer.credential_offer as CredentialOfferPayloadV1_0_11).credentials;
+
+    // FIXME: complains about VCT for sd-jwt
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
+    authorizationDetails = creds
+      .flatMap((cred) => (typeof cred === 'string' ? credentialsSupported : (cred as CredentialsSupportedLegacy)))
+      .filter((cred) => !!cred)
+      .map((cred) => {
+        return {
+          ...cred,
+          type: 'openid_credential',
+          locations: [endpointMetadata.issuer],
+
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore
+          format: cred!.format,
+        } satisfies AuthorizationDetails;
+      });
+    if (!authorizationDetails || (Array.isArray(authorizationDetails) && authorizationDetails.length === 0)) {
+      throw Error(`Could not create authorization details from credential offer. Please pass in explicit details`);
+    }
+  }
+  if (!endpointMetadata?.authorization_endpoint) {
+    throw Error('Server metadata does not contain authorization endpoint');
+  }
+  const parEndpoint = endpointMetadata.credentialIssuerMetadata?.pushed_authorization_request_endpoint;
+
+  // add 'openid' scope if not present
+  if (!scope?.includes('openid')) {
+    scope = ['openid', scope].filter((s) => !!s).join(' ');
+  }
+
+  let queryObj: { [key: string]: string } | PushedAuthorizationResponse = {
+    response_type: ResponseType.AUTH_CODE,
+    ...(!pkce.disabled && {
+      code_challenge_method: pkce.codeChallengeMethod ?? CodeChallengeMethod.S256,
+      code_challenge: pkce.codeChallenge,
+    }),
+    authorization_details: JSON.stringify(handleAuthorizationDetailsV1_0_11(endpointMetadata, authorizationDetails)),
+    ...(redirectUri && { redirect_uri: redirectUri }),
+    ...(clientId && { client_id: clientId }),
+    ...(credentialOffer?.issuerState && { issuer_state: credentialOffer.issuerState }),
+    scope,
+  };
+
+  if (!parEndpoint && parMode === PARMode.REQUIRE) {
+    throw Error(`PAR mode is set to required by Authorization Server does not support PAR!`);
+  } else if (parEndpoint && parMode !== PARMode.NEVER) {
+    debug(`USING PAR with endpoint ${parEndpoint}`);
+    const parResponse = await formPost<PushedAuthorizationResponse>(
+      parEndpoint,
+      convertJsonToURI(queryObj, {
+        mode: JsonURIMode.X_FORM_WWW_URLENCODED,
+        uriTypeProperties: ['client_id', 'request_uri', 'redirect_uri', 'scope', 'authorization_details', 'issuer_state'],
+      }),
+      { contentType: 'application/x-www-form-urlencoded', accept: 'application/json' },
+    );
+    if (parResponse.errorBody || !parResponse.successBody) {
+      console.log(JSON.stringify(parResponse.errorBody));
+      console.log('Falling back to regular request URI, since PAR failed');
+      if (parMode === PARMode.REQUIRE) {
+        throw Error(`PAR error: ${parResponse.origResponse.statusText}`);
+      }
+    } else {
+      debug(`PAR response: ${JSON.stringify(parResponse.successBody, null, 2)}`);
+      queryObj = { request_uri: parResponse.successBody.request_uri };
+    }
+  }
+  await createSignedAuthRequestWhenNeeded(queryObj, { ...requestObjectOpts, aud: endpointMetadata.authorization_server });
+
+  debug(`Object that will become query params: ` + JSON.stringify(queryObj, null, 2));
+  const url = convertJsonToURI(queryObj, {
+    baseUrl: endpointMetadata.authorization_endpoint,
+    uriTypeProperties: ['client_id', 'request_uri', 'redirect_uri', 'scope', 'authorization_details', 'issuer_state'],
+    // arrayTypeProperties: ['authorization_details'],
+    mode: JsonURIMode.X_FORM_WWW_URLENCODED,
+    // We do not add the version here, as this always needs to be form encoded
+  });
+  debug(`Authorization Request URL: ${url}`);
+  return url;
+};
+
+const handleAuthorizationDetailsV1_0_11 = (
+  endpointMetadata: EndpointMetadataResultV1_0_11,
+  authorizationDetails?: AuthorizationDetails | AuthorizationDetails[],
+): AuthorizationDetails | AuthorizationDetails[] | undefined => {
+  if (authorizationDetails) {
+    if (typeof authorizationDetails === 'string') {
+      // backwards compat for older versions of the lib
+      return authorizationDetails;
+    }
+    if (Array.isArray(authorizationDetails)) {
+      return authorizationDetails
+        .filter((value) => typeof value !== 'string')
+        .map((value) => handleLocations(endpointMetadata, typeof value === 'string' ? value : { ...value }));
+    } else {
+      return handleLocations(endpointMetadata, { ...authorizationDetails });
+    }
+  }
+  return authorizationDetails;
+};
+
+const handleLocations = (endpointMetadata: EndpointMetadataResultV1_0_11, authorizationDetails: AuthorizationDetails) => {
+  if (typeof authorizationDetails === 'string') {
+    // backwards compat for older versions of the lib
+    return authorizationDetails;
+  }
+  if (authorizationDetails && (endpointMetadata.credentialIssuerMetadata?.authorization_server || endpointMetadata.authorization_endpoint)) {
+    if (authorizationDetails.locations) {
+      if (Array.isArray(authorizationDetails.locations)) {
+        authorizationDetails.locations.push(endpointMetadata.issuer);
+      } else {
+        authorizationDetails.locations = [authorizationDetails.locations as string, endpointMetadata.issuer];
+      }
+    } else {
+      authorizationDetails.locations = [endpointMetadata.issuer];
+    }
+  }
+  return authorizationDetails;
+};