@sphereon/oid4vci-client 0.21.0 → 0.21.1-next.3

package/dist/index.d.cts

@@ -366,9 +366,25 @@ declare const generateMissingPKCEOpts: (pkce: PKCEOpts) => PKCEOpts;
 
 declare function sendNotification(credentialRequestOpts: Partial<CredentialRequestOpts>, request: NotificationRequest, accessToken?: string): Promise<NotificationResponseResult>;
 
+/**
+ * Determines the well-known location(s) to try for a host and endpoint type, in order of preference.
+ *
+ * OID4VCI 1.0 final and RFC 8414 require the well-known path to be inserted between the host and the path component
+ * (https://host/.well-known/openid-credential-issuer/tenant), whereas earlier OID4VCI drafts appended it to the full
+ * URL (https://host/tenant/.well-known/openid-credential-issuer). For the credential issuer and OAuth AS metadata we
+ * default to the current spec behavior with the legacy location as fallback. For openid-configuration the appended
+ * form is the primary location per OIDC Discovery, with the RFC 8414 form as fallback.
+ *
+ * @param host The host, including an optional path component
+ * @param endpointType The endpoint type, currently supports OID4VCI, OIDC and OAuth2 endpoint types
+ */
+declare const determineWellknownLocations: (host: string, endpointType: WellKnownEndpoints) => string[];
 /**
  * Allows to retrieve information from a well-known location
  *
+ * Tries all applicable locations for the endpoint type (see determineWellknownLocations) and returns the first
+ * successful response containing a JSON object body.
+ *
  * @param host The host
  * @param endpointType The endpoint type, currently supports OID4VCI, OIDC and OAuth2 endpoint types
  * @param opts Options, like for instance whether an error should be thrown in case the endpoint doesn't exist
@@ -701,4 +717,4 @@ declare class OpenID4VCIClient {
 
 declare const LOG: ISimpleLogger<string>;
 
-export { AccessTokenClient, type CreateCredentialRequestOpts, CredentialOfferClient, CredentialOfferClientV1_0_15, CredentialRequestClient, CredentialRequestClientBuilder, CredentialRequestClientBuilderV1_0, CredentialRequestClientBuilderV1_0_15, type CredentialRequestOpts, type EndpointMetadataResult, LOG, MetadataClient, MetadataClientV1_0, MetadataClientV1_0_15, OpenID4VCIClient, type OpenID4VCIClientState, type OpenID4VCIClientStateV1_0_15, OpenID4VCIClientV1_0_15, ProofOfPossessionBuilder, acquireAuthorizationChallengeAuthCode, acquireAuthorizationChallengeAuthCodeUsingRequest, buildProof, constructBaseResponse, createAuthorizationChallengeRequest, createAuthorizationRequestUrl, createJwtBearerClientAssertion, createSignedAuthRequestWhenNeeded, generateMissingPKCEOpts, handleCredentialOfferUri, isUriEncoded, retrieveWellknown, sendAuthorizationChallengeRequest, sendNotification };
+export { AccessTokenClient, type CreateCredentialRequestOpts, CredentialOfferClient, CredentialOfferClientV1_0_15, CredentialRequestClient, CredentialRequestClientBuilder, CredentialRequestClientBuilderV1_0, CredentialRequestClientBuilderV1_0_15, type CredentialRequestOpts, type EndpointMetadataResult, LOG, MetadataClient, MetadataClientV1_0, MetadataClientV1_0_15, OpenID4VCIClient, type OpenID4VCIClientState, type OpenID4VCIClientStateV1_0_15, OpenID4VCIClientV1_0_15, ProofOfPossessionBuilder, acquireAuthorizationChallengeAuthCode, acquireAuthorizationChallengeAuthCodeUsingRequest, buildProof, constructBaseResponse, createAuthorizationChallengeRequest, createAuthorizationRequestUrl, createJwtBearerClientAssertion, createSignedAuthRequestWhenNeeded, determineWellknownLocations, generateMissingPKCEOpts, handleCredentialOfferUri, isUriEncoded, retrieveWellknown, sendAuthorizationChallengeRequest, sendNotification };

package/dist/index.d.ts

@@ -366,9 +366,25 @@ declare const generateMissingPKCEOpts: (pkce: PKCEOpts) => PKCEOpts;
 
 declare function sendNotification(credentialRequestOpts: Partial<CredentialRequestOpts>, request: NotificationRequest, accessToken?: string): Promise<NotificationResponseResult>;
 
+/**
+ * Determines the well-known location(s) to try for a host and endpoint type, in order of preference.
+ *
+ * OID4VCI 1.0 final and RFC 8414 require the well-known path to be inserted between the host and the path component
+ * (https://host/.well-known/openid-credential-issuer/tenant), whereas earlier OID4VCI drafts appended it to the full
+ * URL (https://host/tenant/.well-known/openid-credential-issuer). For the credential issuer and OAuth AS metadata we
+ * default to the current spec behavior with the legacy location as fallback. For openid-configuration the appended
+ * form is the primary location per OIDC Discovery, with the RFC 8414 form as fallback.
+ *
+ * @param host The host, including an optional path component
+ * @param endpointType The endpoint type, currently supports OID4VCI, OIDC and OAuth2 endpoint types
+ */
+declare const determineWellknownLocations: (host: string, endpointType: WellKnownEndpoints) => string[];
 /**
  * Allows to retrieve information from a well-known location
  *
+ * Tries all applicable locations for the endpoint type (see determineWellknownLocations) and returns the first
+ * successful response containing a JSON object body.
+ *
  * @param host The host
  * @param endpointType The endpoint type, currently supports OID4VCI, OIDC and OAuth2 endpoint types
  * @param opts Options, like for instance whether an error should be thrown in case the endpoint doesn't exist
@@ -701,4 +717,4 @@ declare class OpenID4VCIClient {
 
 declare const LOG: ISimpleLogger<string>;
 
-export { AccessTokenClient, type CreateCredentialRequestOpts, CredentialOfferClient, CredentialOfferClientV1_0_15, CredentialRequestClient, CredentialRequestClientBuilder, CredentialRequestClientBuilderV1_0, CredentialRequestClientBuilderV1_0_15, type CredentialRequestOpts, type EndpointMetadataResult, LOG, MetadataClient, MetadataClientV1_0, MetadataClientV1_0_15, OpenID4VCIClient, type OpenID4VCIClientState, type OpenID4VCIClientStateV1_0_15, OpenID4VCIClientV1_0_15, ProofOfPossessionBuilder, acquireAuthorizationChallengeAuthCode, acquireAuthorizationChallengeAuthCodeUsingRequest, buildProof, constructBaseResponse, createAuthorizationChallengeRequest, createAuthorizationRequestUrl, createJwtBearerClientAssertion, createSignedAuthRequestWhenNeeded, generateMissingPKCEOpts, handleCredentialOfferUri, isUriEncoded, retrieveWellknown, sendAuthorizationChallengeRequest, sendNotification };
+export { AccessTokenClient, type CreateCredentialRequestOpts, CredentialOfferClient, CredentialOfferClientV1_0_15, CredentialRequestClient, CredentialRequestClientBuilder, CredentialRequestClientBuilderV1_0, CredentialRequestClientBuilderV1_0_15, type CredentialRequestOpts, type EndpointMetadataResult, LOG, MetadataClient, MetadataClientV1_0, MetadataClientV1_0_15, OpenID4VCIClient, type OpenID4VCIClientState, type OpenID4VCIClientStateV1_0_15, OpenID4VCIClientV1_0_15, ProofOfPossessionBuilder, acquireAuthorizationChallengeAuthCode, acquireAuthorizationChallengeAuthCodeUsingRequest, buildProof, constructBaseResponse, createAuthorizationChallengeRequest, createAuthorizationRequestUrl, createJwtBearerClientAssertion, createSignedAuthRequestWhenNeeded, determineWellknownLocations, generateMissingPKCEOpts, handleCredentialOfferUri, isUriEncoded, retrieveWellknown, sendAuthorizationChallengeRequest, sendNotification };

package/dist/index.js

@@ -68,17 +68,70 @@ async function sendNotification(credentialRequestOpts, request, accessToken) {
 __name(sendNotification, "sendNotification");
 
 // lib/functions/OpenIDUtils.ts
-import { getJson } from "@sphereon/oid4vci-common";
+import { getJson, WellKnownEndpoints } from "@sphereon/oid4vci-common";
 import { Loggers } from "@sphereon/ssi-types";
 var logger = Loggers.DEFAULT.get("sphereon:openid4vci:openid-utils");
+var determineWellknownLocations = /* @__PURE__ */ __name((host, endpointType) => {
+  const base = host.endsWith("/") ? host.slice(0, -1) : host;
+  const legacyLocation = `${base}${endpointType}`;
+  try {
+    const url = new URL(base);
+    let pathname = url.pathname;
+    while (pathname.endsWith("/")) {
+      pathname = pathname.slice(0, -1);
+    }
+    if (pathname.length > 0) {
+      const rfc8414Location = `${url.origin}${endpointType}${pathname}`;
+      return endpointType === WellKnownEndpoints.OPENID_CONFIGURATION ? [
+        legacyLocation,
+        rfc8414Location
+      ] : [
+        rfc8414Location,
+        legacyLocation
+      ];
+    }
+  } catch (error) {
+    logger.debug(`host ${host} could not be parsed as URL, using legacy well-known location only`);
+  }
+  return [
+    legacyLocation
+  ];
+}, "determineWellknownLocations");
 var retrieveWellknown = /* @__PURE__ */ __name(async (host, endpointType, opts) => {
-  const result = await getJson(`${host.endsWith("/") ? host.slice(0, -1) : host}${endpointType}`, {
-    exceptionOnHttpErrorStatus: opts?.errorOnNotFound
-  });
-  if (result.origResponse.status >= 400) {
-    logger.debug(`host ${host} with endpoint type ${endpointType} status: ${result.origResponse.status}, ${result.origResponse.statusText}`);
+  const locations = determineWellknownLocations(host, endpointType);
+  let successResult;
+  let errorResult;
+  let lastError;
+  for (const location of locations) {
+    try {
+      const response = await getJson(location, {
+        exceptionOnHttpErrorStatus: false
+      });
+      if (response.origResponse.status < 400) {
+        if (response.successBody !== void 0 && typeof response.successBody === "object" && response.successBody !== null) {
+          return response;
+        }
+        successResult = successResult ?? response;
+      } else {
+        logger.debug(`host ${host} with endpoint type ${endpointType} at ${location} status: ${response.origResponse.status}, ${response.origResponse.statusText}`);
+        errorResult = errorResult ?? response;
+      }
+    } catch (error) {
+      logger.debug(`host ${host} with endpoint type ${endpointType} at ${location} error: ${error instanceof Error ? error.message : error}`);
+      lastError = error;
+    }
   }
-  return result;
+  if (successResult) {
+    return successResult;
+  }
+  if (errorResult) {
+    if (opts?.errorOnNotFound) {
+      const error = JSON.stringify(errorResult.errorBody ?? {});
+      throw new Error(error === "{}" ? '{"error": "not found"}' : error);
+    }
+    return errorResult;
+  }
+  throw lastError instanceof Error ? lastError : new Error(`Could not retrieve well-known ${endpointType} for host ${host}`);
 }, "retrieveWellknown");
 
 // lib/functions/AccessTokenUtil.ts
@@ -411,7 +464,7 @@ function shouldRetryResourceRequestWithDPoPNonce(response) {
 __name(shouldRetryResourceRequestWithDPoPNonce, "shouldRetryResourceRequestWithDPoPNonce");
 
 // lib/MetadataClientV1_0_15.ts
-import { getIssuerFromCredentialOfferPayload, processSignedMetadata, WellKnownEndpoints } from "@sphereon/oid4vci-common";
+import { getIssuerFromCredentialOfferPayload, processSignedMetadata, WellKnownEndpoints as WellKnownEndpoints2 } from "@sphereon/oid4vci-common";
 import { Loggers as Loggers2 } from "@sphereon/ssi-types";
 var logger2 = Loggers2.DEFAULT.get("sphereon:oid4vci:metadata");
 var MetadataClientV1_0_15 = class _MetadataClientV1_0_15 {
@@ -473,7 +526,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
         authorization_servers = credentialIssuerMetadata.authorization_servers;
       }
     }
-    let response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints.OPENID_CONFIGURATION, {
+    let response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints2.OPENID_CONFIGURATION, {
       errorOnNotFound: false
     });
     let authMetadata = response.successBody;
@@ -481,7 +534,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       logger2.debug(`Issuer ${issuer} has OpenID Connect Server metadata in well-known location`);
       authorizationServerType = "OIDC";
     } else {
-      response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints.OAUTH_AS, {
+      response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints2.OAUTH_AS, {
         errorOnNotFound: false
       });
       authMetadata = response.successBody;
@@ -597,7 +650,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
   * @param opts
   */
   static async retrieveOpenID4VCIServerMetadata(issuerHost, opts) {
-    return retrieveWellknown(issuerHost, WellKnownEndpoints.OPENID4VCI_ISSUER, {
+    return retrieveWellknown(issuerHost, WellKnownEndpoints2.OPENID4VCI_ISSUER, {
       errorOnNotFound: opts?.errorOnNotFound === void 0 ? true : opts.errorOnNotFound
     });
   }
@@ -717,6 +770,9 @@ var AccessTokenClient = class _AccessTokenClient {
       }
       request.grant_type = GrantTypes.PRE_AUTHORIZED_CODE;
       request[PRE_AUTH_CODE_LITERAL2] = credentialOfferRequest?.credential_offer.grants?.[PRE_AUTH_GRANT_LITERAL2]?.[PRE_AUTH_CODE_LITERAL2];
+      if (request.client_id && !request.client_secret && opts.additionalParams?.client_id === void 0) {
+        delete request.client_id;
+      }
       return request;
     }
     throw new Error("Credential offer request follows neither pre-authorized code nor authorization code flow requirements.");
@@ -846,7 +902,7 @@ import { CodeChallengeMethod as CodeChallengeMethod2, convertJsonToURI as conver
 import { Loggers as Loggers4 } from "@sphereon/ssi-types";
 
 // lib/MetadataClient.ts
-import { determineSpecVersionFromOffer, determineVersionsFromIssuerMetadata, getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload3, OpenId4VCIVersion as OpenId4VCIVersion2, processSignedMetadata as processSignedMetadata2, WellKnownEndpoints as WellKnownEndpoints2 } from "@sphereon/oid4vci-common";
+import { determineSpecVersionFromOffer, determineVersionsFromIssuerMetadata, getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload3, OpenId4VCIVersion as OpenId4VCIVersion2, processSignedMetadata as processSignedMetadata2, WellKnownEndpoints as WellKnownEndpoints3 } from "@sphereon/oid4vci-common";
 import { Loggers as Loggers3 } from "@sphereon/ssi-types";
 var logger3 = Loggers3.DEFAULT.get("sphereon:oid4vci:metadata");
 var MetadataClient = class _MetadataClient {
@@ -920,7 +976,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
     } else {
       throw new Error(`Issuer ${issuer} does not expose /.well-known/openid-credential-issuer`);
     }
-    let response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints2.OPENID_CONFIGURATION, {
+    let response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints3.OPENID_CONFIGURATION, {
       errorOnNotFound: false
     });
     let authMetadata = response.successBody;
@@ -928,7 +984,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       logger3.debug(`Issuer ${issuer} has OpenID Connect Server metadata in well-known location`);
       authorizationServerType = "OIDC";
     } else {
-      response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints2.OAUTH_AS, {
+      response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints3.OAUTH_AS, {
         errorOnNotFound: false
       });
       authMetadata = response.successBody;
@@ -1029,7 +1085,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
   * @param opts
   */
   static async retrieveOpenID4VCIServerMetadata(issuerHost, opts) {
-    return retrieveWellknown(issuerHost, WellKnownEndpoints2.OPENID4VCI_ISSUER, {
+    return retrieveWellknown(issuerHost, WellKnownEndpoints3.OPENID4VCI_ISSUER, {
       errorOnNotFound: opts?.errorOnNotFound === void 0 ? true : opts.errorOnNotFound
     });
   }
@@ -2273,7 +2329,7 @@ var CredentialRequestClientBuilder = class _CredentialRequestClientBuilder {
 };
 
 // lib/MetadataClientV1_0.ts
-import { getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload6, processSignedMetadata as processSignedMetadata3, WellKnownEndpoints as WellKnownEndpoints3 } from "@sphereon/oid4vci-common";
+import { getIssuerFromCredentialOfferPayload as getIssuerFromCredentialOfferPayload6, processSignedMetadata as processSignedMetadata3, WellKnownEndpoints as WellKnownEndpoints4 } from "@sphereon/oid4vci-common";
 import { Loggers as Loggers7 } from "@sphereon/ssi-types";
 var logger7 = Loggers7.DEFAULT.get("sphereon:oid4vci:metadata");
 var MetadataClientV1_0 = class _MetadataClientV1_0 {
@@ -2321,7 +2377,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
         authorization_servers = credentialIssuerMetadata.authorization_servers;
       }
     }
-    let response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints3.OPENID_CONFIGURATION, {
+    let response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints4.OPENID_CONFIGURATION, {
       errorOnNotFound: false
     });
     let authMetadata = response.successBody;
@@ -2329,7 +2385,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
       logger7.debug(`Issuer ${issuer} has OpenID Connect Server metadata in well-known location`);
       authorizationServerType = "OIDC";
     } else {
-      response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints3.OAUTH_AS, {
+      response = await retrieveWellknown(authorization_servers[0], WellKnownEndpoints4.OAUTH_AS, {
         errorOnNotFound: false
       });
       authMetadata = response.successBody;
@@ -2445,7 +2501,7 @@ ${JSON.stringify(credentialIssuerMetadata)}`);
     };
   }
   static async retrieveOpenID4VCIServerMetadata(issuerHost, opts) {
-    return retrieveWellknown(issuerHost, WellKnownEndpoints3.OPENID4VCI_ISSUER, {
+    return retrieveWellknown(issuerHost, WellKnownEndpoints4.OPENID4VCI_ISSUER, {
       errorOnNotFound: opts?.errorOnNotFound === void 0 ? true : opts.errorOnNotFound
     });
   }
@@ -3658,6 +3714,7 @@ export {
   createAuthorizationRequestUrl,
   createJwtBearerClientAssertion,
   createSignedAuthRequestWhenNeeded,
+  determineWellknownLocations,
   generateMissingPKCEOpts,
   handleCredentialOfferUri,
   isUriEncoded,