@sphereon/oid4vci-client 0.10.3 → 0.10.4-unstable.15

package/lib/AuthorizationCodeClientV1_0_11.ts

@@ -0,0 +1,167 @@
+import {
+  AuthorizationDetails,
+  AuthorizationRequestOpts,
+  CodeChallengeMethod,
+  convertJsonToURI,
+  CredentialSupported,
+  CredentialOfferFormat,
+  CredentialOfferPayloadV1_0_11,
+  CredentialOfferRequestWithBaseUrl,
+  EndpointMetadataResultV1_0_11,
+  formPost,
+  JsonURIMode,
+  PARMode,
+  PKCEOpts,
+  PushedAuthorizationResponse,
+  ResponseType,
+} from '@sphereon/oid4vci-common';
+import Debug from 'debug';
+
+const debug = Debug('sphereon:oid4vci');
+
+export const createAuthorizationRequestUrlV1_0_11 = async ({
+  pkce,
+  endpointMetadata,
+  authorizationRequest,
+  credentialOffer,
+  credentialsSupported,
+}: {
+  pkce: PKCEOpts;
+  endpointMetadata: EndpointMetadataResultV1_0_11;
+  authorizationRequest: AuthorizationRequestOpts;
+  credentialOffer?: CredentialOfferRequestWithBaseUrl;
+  credentialsSupported?: CredentialSupported[];
+}): Promise<string> => {
+  const { redirectUri, clientId } = authorizationRequest;
+  let { scope, authorizationDetails } = authorizationRequest;
+  const parMode = endpointMetadata?.credentialIssuerMetadata?.require_pushed_authorization_requests
+    ? PARMode.REQUIRE
+    : authorizationRequest.parMode ?? PARMode.AUTO;
+  // Scope and authorization_details can be used in the same authorization request
+  // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-rar-23#name-relationship-to-scope-param
+  if (!scope && !authorizationDetails) {
+    if (!credentialOffer) {
+      throw Error('Please provide a scope or authorization_details if no credential offer is present');
+    }
+    const creds: (CredentialOfferFormat | string)[] = (credentialOffer.credential_offer as CredentialOfferPayloadV1_0_11).credentials;
+
+    // FIXME: complains about VCT for sd-jwt
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
+    authorizationDetails = creds
+      .flatMap((cred) =>
+        typeof cred === 'string' && credentialsSupported ? Object.values(credentialsSupported) : (cred as CredentialSupported),
+      )
+      .filter((cred) => !!cred)
+      .map((cred) => {
+        return {
+          ...cred,
+          type: 'openid_credential',
+          locations: [endpointMetadata.issuer],
+
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore
+          format: cred!.format,
+        } satisfies AuthorizationDetails;
+      });
+    if (!authorizationDetails || authorizationDetails.length === 0) {
+      throw Error(`Could not create authorization details from credential offer. Please pass in explicit details`);
+    }
+  }
+  if (!endpointMetadata?.authorization_endpoint) {
+    throw Error('Server metadata does not contain authorization endpoint');
+  }
+  const parEndpoint = endpointMetadata.credentialIssuerMetadata?.pushed_authorization_request_endpoint;
+
+  // add 'openid' scope if not present
+  if (!scope?.includes('openid')) {
+    scope = ['openid', scope].filter((s) => !!s).join(' ');
+  }
+
+  let queryObj: { [key: string]: string } | PushedAuthorizationResponse = {
+    response_type: ResponseType.AUTH_CODE,
+    ...(!pkce.disabled && {
+      code_challenge_method: pkce.codeChallengeMethod ?? CodeChallengeMethod.S256,
+      code_challenge: pkce.codeChallenge,
+    }),
+    authorization_details: JSON.stringify(handleAuthorizationDetailsV1_0_11(endpointMetadata, authorizationDetails)),
+    ...(redirectUri && { redirect_uri: redirectUri }),
+    ...(clientId && { client_id: clientId }),
+    ...(credentialOffer?.issuerState && { issuer_state: credentialOffer.issuerState }),
+    scope,
+  };
+
+  if (!parEndpoint && parMode === PARMode.REQUIRE) {
+    throw Error(`PAR mode is set to required by Authorization Server does not support PAR!`);
+  } else if (parEndpoint && parMode !== PARMode.NEVER) {
+    debug(`USING PAR with endpoint ${parEndpoint}`);
+    const parResponse = await formPost<PushedAuthorizationResponse>(
+      parEndpoint,
+      convertJsonToURI(queryObj, {
+        mode: JsonURIMode.X_FORM_WWW_URLENCODED,
+        uriTypeProperties: ['client_id', 'request_uri', 'redirect_uri', 'scope', 'authorization_details', 'issuer_state'],
+      }),
+      { contentType: 'application/x-www-form-urlencoded', accept: 'application/json' },
+    );
+    if (parResponse.errorBody || !parResponse.successBody) {
+      console.log(JSON.stringify(parResponse.errorBody));
+      console.log('Falling back to regular request URI, since PAR failed');
+      if (parMode === PARMode.REQUIRE) {
+        throw Error(`PAR error: ${parResponse.origResponse.statusText}`);
+      }
+    } else {
+      debug(`PAR response: ${(parResponse.successBody, null, 2)}`);
+      queryObj = { request_uri: parResponse.successBody.request_uri };
+    }
+  }
+
+  debug(`Object that will become query params: ` + JSON.stringify(queryObj, null, 2));
+  const url = convertJsonToURI(queryObj, {
+    baseUrl: endpointMetadata.authorization_endpoint,
+    uriTypeProperties: ['client_id', 'request_uri', 'redirect_uri', 'scope', 'authorization_details', 'issuer_state'],
+    // arrayTypeProperties: ['authorization_details'],
+    mode: JsonURIMode.X_FORM_WWW_URLENCODED,
+    // We do not add the version here, as this always needs to be form encoded
+  });
+  debug(`Authorization Request URL: ${url}`);
+  return url;
+};
+
+const handleAuthorizationDetailsV1_0_11 = (
+  endpointMetadata: EndpointMetadataResultV1_0_11,
+  authorizationDetails?: AuthorizationDetails | AuthorizationDetails[],
+): AuthorizationDetails | AuthorizationDetails[] | undefined => {
+  if (authorizationDetails) {
+    if (typeof authorizationDetails === 'string') {
+      // backwards compat for older versions of the lib
+      return authorizationDetails;
+    }
+    if (Array.isArray(authorizationDetails)) {
+      return authorizationDetails
+        .filter((value) => typeof value !== 'string')
+        .map((value) => handleLocations(endpointMetadata, typeof value === 'string' ? value : { ...value }));
+    } else {
+      return handleLocations(endpointMetadata, { ...authorizationDetails });
+    }
+  }
+  return authorizationDetails;
+};
+
+const handleLocations = (endpointMetadata: EndpointMetadataResultV1_0_11, authorizationDetails: AuthorizationDetails) => {
+  if (typeof authorizationDetails === 'string') {
+    // backwards compat for older versions of the lib
+    return authorizationDetails;
+  }
+  if (authorizationDetails && (endpointMetadata.credentialIssuerMetadata?.authorization_server || endpointMetadata.authorization_endpoint)) {
+    if (authorizationDetails.locations) {
+      if (Array.isArray(authorizationDetails.locations)) {
+        authorizationDetails.locations.push(endpointMetadata.issuer);
+      } else {
+        authorizationDetails.locations = [authorizationDetails.locations as string, endpointMetadata.issuer];
+      }
+    } else {
+      authorizationDetails.locations = [endpointMetadata.issuer];
+    }
+  }
+  return authorizationDetails;
+};

package/lib/CredentialOfferClient.ts

@@ -1,111 +1,99 @@
-import {
-  CredentialOffer,
-  CredentialOfferPayload,
-  CredentialOfferPayloadV1_0_09,
-  CredentialOfferRequestWithBaseUrl,
-  CredentialOfferV1_0_11,
-  determineSpecVersionFromURI,
-  getClientIdFromCredentialOfferPayload,
-  OpenId4VCIVersion,
-  toUniformCredentialOfferRequest,
-} from '@sphereon/oid4vci-common';
-import Debug from 'debug';
-
-import { convertJsonToURI, convertURIToJsonObject } from './functions';
-
-const debug = Debug('sphereon:oid4vci:offer');
-
-export class CredentialOfferClient {
-  public static async fromURI(uri: string, opts?: { resolve?: boolean }): Promise<CredentialOfferRequestWithBaseUrl> {
-    debug(`Credential Offer URI: ${uri}`);
-    if (!uri.includes('?') || !uri.includes('://')) {
-      debug(`Invalid Credential Offer URI: ${uri}`);
-      throw Error(`Invalid Credential Offer Request`);
-    }
-    const scheme = uri.split('://')[0];
-    const baseUrl = uri.split('?')[0];
-    const version = determineSpecVersionFromURI(uri);
-    let credentialOffer: CredentialOffer;
-    let credentialOfferPayload: CredentialOfferPayload;
-    if (version < OpenId4VCIVersion.VER_1_0_11) {
-      credentialOfferPayload = convertURIToJsonObject(uri, {
-        arrayTypeProperties: ['credential_type'],
-        requiredProperties: uri.includes('credential_offer_uri=') ? ['credential_offer_uri'] : ['issuer', 'credential_type'],
-      }) as CredentialOfferPayloadV1_0_09;
-      credentialOffer = {
-        credential_offer: credentialOfferPayload,
-      };
-    } else {
-      credentialOffer = convertURIToJsonObject(uri, {
-        arrayTypeProperties: ['credentials'],
-        requiredProperties: uri.includes('credential_offer_uri=') ? ['credential_offer_uri'] : ['credential_offer'],
-      }) as CredentialOfferV1_0_11;
-      if (credentialOffer?.credential_offer_uri === undefined && !credentialOffer?.credential_offer) {
-        throw Error('Either a credential_offer or credential_offer_uri should be present in ' + uri);
-      }
-    }
-
-    const request = await toUniformCredentialOfferRequest(credentialOffer, {
-      ...opts,
-      version,
-    });
-    const clientId = getClientIdFromCredentialOfferPayload(request.credential_offer);
-    const grants = request.credential_offer?.grants;
-
-    return {
-      scheme,
-      baseUrl,
-      clientId,
-      ...request,
-      ...(grants?.authorization_code?.issuer_state && { issuerState: grants.authorization_code.issuer_state }),
-      ...(grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.['pre-authorized_code'] && {
-        preAuthorizedCode: grants['urn:ietf:params:oauth:grant-type:pre-authorized_code']['pre-authorized_code'],
-      }),
-      userPinRequired: request.credential_offer?.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.user_pin_required ?? false,
-    };
-  }
-
-  public static toURI(
-    requestWithBaseUrl: CredentialOfferRequestWithBaseUrl,
-    opts?: {
-      version?: OpenId4VCIVersion;
-    },
-  ): string {
-    debug(`Credential Offer Request with base URL: ${JSON.stringify(requestWithBaseUrl)}`);
-    const version = opts?.version ?? requestWithBaseUrl.version;
-    let baseUrl = requestWithBaseUrl.baseUrl.includes(requestWithBaseUrl.scheme)
-      ? requestWithBaseUrl.baseUrl
-      : `${requestWithBaseUrl.scheme.replace('://', '')}://${requestWithBaseUrl.baseUrl}`;
-    let param: string | undefined;
-
-    const isUri = requestWithBaseUrl.credential_offer_uri !== undefined;
-
-    if (version.valueOf() >= OpenId4VCIVersion.VER_1_0_11.valueOf()) {
-      // v11 changed from encoding every param to a encoded json object with a credential_offer param key
-      if (!baseUrl.includes('?')) {
-        param = isUri ? 'credential_offer_uri' : 'credential_offer';
-      } else {
-        const split = baseUrl.split('?');
-        if (split.length > 1 && split[1] !== '') {
-          if (baseUrl.endsWith('&')) {
-            param = isUri ? 'credential_offer_uri' : 'credential_offer';
-          } else if (!baseUrl.endsWith('=')) {
-            baseUrl += `&`;
-            param = isUri ? 'credential_offer_uri' : 'credential_offer';
-          }
-        }
-      }
-    }
-    return convertJsonToURI(requestWithBaseUrl.credential_offer_uri ?? requestWithBaseUrl.original_credential_offer, {
-      baseUrl,
-      arrayTypeProperties: isUri ? [] : ['credential_type'],
-      uriTypeProperties: isUri
-        ? ['credential_offer_uri']
-        : version >= OpenId4VCIVersion.VER_1_0_11
-          ? ['credential_issuer', 'credential_type']
-          : ['issuer', 'credential_type'],
-      param,
-      version,
-    });
-  }
-}
+import {
+  CredentialOfferRequestWithBaseUrl,
+  CredentialOfferV1_0_13,
+  determineSpecVersionFromURI,
+  getClientIdFromCredentialOfferPayload,
+  OpenId4VCIVersion,
+  toUniformCredentialOfferRequest,
+} from '@sphereon/oid4vci-common';
+import Debug from 'debug';
+
+import { convertJsonToURI, convertURIToJsonObject } from './functions';
+
+const debug = Debug('sphereon:oid4vci:offer');
+
+export class CredentialOfferClient {
+  public static async fromURI(uri: string, opts?: { resolve?: boolean }): Promise<CredentialOfferRequestWithBaseUrl> {
+    debug(`Credential Offer URI: ${uri}`);
+    if (!uri.includes('?') || !uri.includes('://')) {
+      debug(`Invalid Credential Offer URI: ${uri}`);
+      throw Error(`Invalid Credential Offer Request`);
+    }
+    const scheme = uri.split('://')[0];
+    const baseUrl = uri.split('?')[0];
+    const version = determineSpecVersionFromURI(uri);
+    const credentialOffer: CredentialOfferV1_0_13 = convertURIToJsonObject(uri, {
+      arrayTypeProperties: ['credential_configuration_ids'],
+      requiredProperties: uri.includes('credential_offer_uri=') ? ['credential_offer_uri'] : ['credential_offer'],
+    }) as CredentialOfferV1_0_13;
+    if (credentialOffer?.credential_offer_uri === undefined && !credentialOffer?.credential_offer) {
+      throw Error('Either a credential_offer or credential_offer_uri should be present in ' + uri);
+    }
+
+    const request = await toUniformCredentialOfferRequest(credentialOffer, {
+      ...opts,
+      version,
+    });
+    const clientId = getClientIdFromCredentialOfferPayload(request.credential_offer);
+    const grants = request.credential_offer?.grants;
+
+    return {
+      scheme,
+      baseUrl,
+      ...(clientId && { clientId }),
+      ...request,
+      ...(grants?.authorization_code?.issuer_state && { issuerState: grants.authorization_code.issuer_state }),
+      ...(grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.['pre-authorized_code'] && {
+        preAuthorizedCode: grants['urn:ietf:params:oauth:grant-type:pre-authorized_code']['pre-authorized_code'],
+      }),
+      ...(request.credential_offer?.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.tx_code &&
+        {
+          // txCode: request.credential_offer?.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.tx_code,
+        }),
+    };
+  }
+
+  public static toURI(
+    requestWithBaseUrl: CredentialOfferRequestWithBaseUrl,
+    opts?: {
+      version?: OpenId4VCIVersion;
+    },
+  ): string {
+    debug(`Credential Offer Request with base URL: ${JSON.stringify(requestWithBaseUrl)}`);
+    const version = opts?.version ?? requestWithBaseUrl.version;
+    let baseUrl = requestWithBaseUrl.baseUrl.includes(requestWithBaseUrl.scheme)
+      ? requestWithBaseUrl.baseUrl
+      : `${requestWithBaseUrl.scheme.replace('://', '')}://${requestWithBaseUrl.baseUrl}`;
+    let param: string | undefined;
+
+    const isUri = requestWithBaseUrl.credential_offer_uri !== undefined;
+
+    if (version.valueOf() >= OpenId4VCIVersion.VER_1_0_11.valueOf()) {
+      // v11 changed from encoding every param to a encoded json object with a credential_offer param key
+      if (!baseUrl.includes('?')) {
+        param = isUri ? 'credential_offer_uri' : 'credential_offer';
+      } else {
+        const split = baseUrl.split('?');
+        if (split.length > 1 && split[1] !== '') {
+          if (baseUrl.endsWith('&')) {
+            param = isUri ? 'credential_offer_uri' : 'credential_offer';
+          } else if (!baseUrl.endsWith('=')) {
+            baseUrl += `&`;
+            param = isUri ? 'credential_offer_uri' : 'credential_offer';
+          }
+        }
+      }
+    }
+    return convertJsonToURI(requestWithBaseUrl.credential_offer_uri ?? requestWithBaseUrl.original_credential_offer, {
+      baseUrl,
+      arrayTypeProperties: isUri ? [] : ['credential_type'],
+      uriTypeProperties: isUri
+        ? ['credential_offer_uri']
+        : version >= OpenId4VCIVersion.VER_1_0_13
+          ? ['credential_issuer', 'credential_type']
+          : ['issuer', 'credential_type'],
+      param,
+      version,
+    });
+  }
+}

package/lib/CredentialOfferClientV1_0_11.ts

@@ -0,0 +1,112 @@
+import {
+  CredentialOffer,
+  CredentialOfferPayload,
+  CredentialOfferPayloadV1_0_09,
+  CredentialOfferRequestWithBaseUrl,
+  CredentialOfferRequestWithBaseUrlV1_0_11,
+  CredentialOfferV1_0_11,
+  determineSpecVersionFromURI,
+  getClientIdFromCredentialOfferPayload,
+  OpenId4VCIVersion,
+  toUniformCredentialOfferRequestV1_0_11,
+} from '@sphereon/oid4vci-common';
+import Debug from 'debug';
+
+import { convertJsonToURI, convertURIToJsonObject } from './functions';
+
+const debug = Debug('sphereon:oid4vci:offer');
+
+export class CredentialOfferClientV1_0_11 {
+  public static async fromURI(uri: string, opts?: { resolve?: boolean }): Promise<CredentialOfferRequestWithBaseUrlV1_0_11> {
+    debug(`Credential Offer URI: ${uri}`);
+    if (!uri.includes('?') || !uri.includes('://')) {
+      debug(`Invalid Credential Offer URI: ${uri}`);
+      throw Error(`Invalid Credential Offer Request`);
+    }
+    const scheme = uri.split('://')[0];
+    const baseUrl = uri.split('?')[0];
+    const version = determineSpecVersionFromURI(uri);
+    let credentialOffer: CredentialOffer;
+    let credentialOfferPayload: CredentialOfferPayload;
+    if (version < OpenId4VCIVersion.VER_1_0_11) {
+      credentialOfferPayload = convertURIToJsonObject(uri, {
+        arrayTypeProperties: ['credential_type'],
+        requiredProperties: uri.includes('credential_offer_uri=') ? ['credential_offer_uri'] : ['issuer', 'credential_type'],
+      }) as CredentialOfferPayloadV1_0_09;
+      credentialOffer = {
+        credential_offer: credentialOfferPayload,
+      };
+    } else {
+      credentialOffer = convertURIToJsonObject(uri, {
+        arrayTypeProperties: ['credentials'],
+        requiredProperties: uri.includes('credential_offer_uri=') ? ['credential_offer_uri'] : ['credential_offer'],
+      }) as CredentialOfferV1_0_11;
+      if (credentialOffer?.credential_offer_uri === undefined && !credentialOffer?.credential_offer) {
+        throw Error('Either a credential_offer or credential_offer_uri should be present in ' + uri);
+      }
+    }
+
+    const request = await toUniformCredentialOfferRequestV1_0_11(credentialOffer, {
+      ...opts,
+      version,
+    });
+    const clientId = getClientIdFromCredentialOfferPayload(request.credential_offer);
+    const grants = request.credential_offer?.grants;
+
+    return {
+      scheme,
+      baseUrl,
+      clientId,
+      ...request,
+      ...(grants?.authorization_code?.issuer_state && { issuerState: grants.authorization_code.issuer_state }),
+      ...(grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.['pre-authorized_code'] && {
+        preAuthorizedCode: grants['urn:ietf:params:oauth:grant-type:pre-authorized_code']['pre-authorized_code'],
+      }),
+      userPinRequired: request.credential_offer?.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.user_pin_required ?? false,
+    };
+  }
+
+  public static toURI(
+    requestWithBaseUrl: CredentialOfferRequestWithBaseUrl,
+    opts?: {
+      version?: OpenId4VCIVersion;
+    },
+  ): string {
+    debug(`Credential Offer Request with base URL: ${JSON.stringify(requestWithBaseUrl)}`);
+    const version = opts?.version ?? requestWithBaseUrl.version;
+    let baseUrl = requestWithBaseUrl.baseUrl.includes(requestWithBaseUrl.scheme)
+      ? requestWithBaseUrl.baseUrl
+      : `${requestWithBaseUrl.scheme.replace('://', '')}://${requestWithBaseUrl.baseUrl}`;
+    let param: string | undefined;
+
+    const isUri = requestWithBaseUrl.credential_offer_uri !== undefined;
+
+    if (version.valueOf() >= OpenId4VCIVersion.VER_1_0_11.valueOf()) {
+      // v11 changed from encoding every param to a encoded json object with a credential_offer param key
+      if (!baseUrl.includes('?')) {
+        param = isUri ? 'credential_offer_uri' : 'credential_offer';
+      } else {
+        const split = baseUrl.split('?');
+        if (split.length > 1 && split[1] !== '') {
+          if (baseUrl.endsWith('&')) {
+            param = isUri ? 'credential_offer_uri' : 'credential_offer';
+          } else if (!baseUrl.endsWith('=')) {
+            baseUrl += `&`;
+            param = isUri ? 'credential_offer_uri' : 'credential_offer';
+          }
+        }
+      }
+    }
+    return convertJsonToURI(requestWithBaseUrl.credential_offer_uri ?? requestWithBaseUrl.original_credential_offer, {
+      baseUrl,
+      arrayTypeProperties: isUri ? [] : ['credential_type'],
+      uriTypeProperties: isUri
+        ? ['credential_offer_uri']
+        : version >= OpenId4VCIVersion.VER_1_0_11
+          ? ['credential_issuer', 'credential_type']
+          : ['issuer', 'credential_type'],
+      param,
+      version,
+    });
+  }
+}