@sphereon/oid4vci-client 0.8.2-unstable.49 → 0.8.2-unstable.52

package/dist/functions/AuthorizationUtil.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createPKCEOpts = void 0;
+exports.generateMissingPKCEOpts = void 0;
 const oid4vci_common_1 = require("@sphereon/oid4vci-common");
-const createPKCEOpts = (pkce) => {
+const generateMissingPKCEOpts = (pkce) => {
     if (pkce.disabled) {
         return pkce;
     }
@@ -18,5 +18,5 @@ const createPKCEOpts = (pkce) => {
     }
     return pkce;
 };
-exports.createPKCEOpts = createPKCEOpts;
+exports.generateMissingPKCEOpts = generateMissingPKCEOpts;
 //# sourceMappingURL=AuthorizationUtil.js.map

package/dist/functions/AuthorizationUtil.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationUtil.js","sourceRoot":"","sources":["../../lib/functions/AuthorizationUtil.ts"],"names":[],"mappings":";;;AAAA,6DAAmI;AAI5H,MAAM,cAAc,GAAG,CAAC,IAAc,EAAE,EAAE;IAC/C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9B,IAAI,CAAC,mBAAmB,GAAG,oCAAmB,CAAC,IAAI,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,GAAG,IAAA,qCAAoB,GAAE,CAAC;IAC7C,CAAC;IACD,IAAA,wCAAuB,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,IAAA,oCAAmB,EAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAfW,QAAA,cAAc,kBAezB"}
+{"version":3,"file":"AuthorizationUtil.js","sourceRoot":"","sources":["../../lib/functions/AuthorizationUtil.ts"],"names":[],"mappings":";;;AAAA,6DAA6I;AAEtI,MAAM,uBAAuB,GAAG,CAAC,IAAc,EAAE,EAAE;IACxD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9B,IAAI,CAAC,mBAAmB,GAAG,oCAAmB,CAAC,IAAI,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,GAAG,IAAA,qCAAoB,GAAE,CAAC;IAC7C,CAAC;IACD,IAAA,wCAAuB,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,IAAA,oCAAmB,EAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAfW,QAAA,uBAAuB,2BAelC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from './AccessTokenClient';
+export * from './CredentialRequestClient';
 export * from './CredentialOfferClient';
 export * from './CredentialRequestClient';
 export * from './CredentialRequestClientBuilder';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AACjD,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AACjD,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,4BAA4B,CAAC"}

package/dist/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./AccessTokenClient"), exports);
+__exportStar(require("./CredentialRequestClient"), exports);
 __exportStar(require("./CredentialOfferClient"), exports);
 __exportStar(require("./CredentialRequestClient"), exports);
 __exportStar(require("./CredentialRequestClientBuilder"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,0DAAwC;AACxC,4DAA0C;AAC1C,mEAAiD;AACjD,8CAA4B;AAC5B,mDAAiC;AACjC,qDAAmC;AACnC,6DAA2C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../lib/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC;AACpC,4DAA0C;AAC1C,0DAAwC;AACxC,4DAA0C;AAC1C,mEAAiD;AACjD,8CAA4B;AAC5B,mDAAiC;AACjC,qDAAmC;AACnC,6DAA2C"}

package/dist/types/index.d.ts

@@ -1,49 +1 @@
-import { CodeChallengeMethod } from '@sphereon/oid4vci-common';
-import { CredentialFormat } from '@sphereon/ssi-types';
-export interface AuthDetails {
-    type: 'openid_credential' | string;
-    locations?: string | string[];
-    format: CredentialFormat | CredentialFormat[];
-    [s: string]: unknown;
-}
-/**
- * Determinse whether PAR should be used when supported
- *
- * REQUIRE: Require PAR, if AS does not support it throw an error
- * AUTO: Use PAR is the AS supports it, otherwise construct a reqular URI,
- * NEVER: Do not use PAR even if the AS supports it (not recommended)
- */
-export declare enum PARMode {
-    REQUIRE = 0,
-    AUTO = 1,
-    NEVER = 2
-}
-export interface AuthRequestOpts {
-    pkce?: PKCEOpts;
-    parMode?: PARMode;
-    authorizationDetails?: AuthDetails | AuthDetails[];
-    redirectUri: string;
-    scope?: string;
-}
-/**
- * Optional options to provide PKCE params like code verifier and challenge yourself, or to disable PKCE altogether. If not provide PKCE will still be used! If individual params are not provide, they will be generated/calculated
- */
-export interface PKCEOpts {
-    /**
-     * PKCE is enabled by default even if you do not provide these options. Set this to true to disable PKCE
-     */
-    disabled?: boolean;
-    /**
-     * Provide a code_challenge, otherwise it will be calculated using the code_verifier and method
-     */
-    codeChallenge?: string;
-    /**
-     * The code_challenge_method, should always by S256
-     */
-    codeChallengeMethod?: CodeChallengeMethod;
-    /**
-     * Provide a code_verifier, otherwise it will be generated
-     */
-    codeVerifier?: string;
-}
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../lib/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAC;IAE9C,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,OAAO;IACjB,OAAO,IAAA;IACP,IAAI,IAAA;IACJ,KAAK,IAAA;CACN;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oBAAoB,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAE1C;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../lib/types/index.ts"],"names":[],"mappings":""}

package/dist/types/index.js

@@ -1,17 +1,2 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PARMode = void 0;
-/**
- * Determinse whether PAR should be used when supported
- *
- * REQUIRE: Require PAR, if AS does not support it throw an error
- * AUTO: Use PAR is the AS supports it, otherwise construct a reqular URI,
- * NEVER: Do not use PAR even if the AS supports it (not recommended)
- */
-var PARMode;
-(function (PARMode) {
-    PARMode[PARMode["REQUIRE"] = 0] = "REQUIRE";
-    PARMode[PARMode["AUTO"] = 1] = "AUTO";
-    PARMode[PARMode["NEVER"] = 2] = "NEVER";
-})(PARMode || (exports.PARMode = PARMode = {}));
 //# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/types/index.ts"],"names":[],"mappings":";;;AAWA;;;;;;GAMG;AACH,IAAY,OAIX;AAJD,WAAY,OAAO;IACjB,2CAAO,CAAA;IACP,qCAAI,CAAA;IACJ,uCAAK,CAAA;AACP,CAAC,EAJW,OAAO,uBAAP,OAAO,QAIlB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/types/index.ts"],"names":[],"mappings":""}

package/lib/AuthorizationCodeClient.ts

@@ -0,0 +1,149 @@
+import {
+  AuthorizationDetails,
+  AuthorizationRequestOpts,
+  CodeChallengeMethod,
+  convertJsonToURI,
+  CredentialOfferRequestWithBaseUrl,
+  CredentialSupported,
+  EndpointMetadataResult,
+  JsonURIMode,
+  PARMode,
+  PKCEOpts,
+  PushedAuthorizationResponse,
+  ResponseType,
+} from '@sphereon/oid4vci-common';
+import { formPost } from '@sphereon/oid4vci-common';
+
+export const createAuthorizationRequestUrl = async ({
+  pkce,
+  endpointMetadata,
+  authorizationRequest,
+  credentialOffer,
+  credentialsSupported,
+}: {
+  pkce: PKCEOpts;
+  endpointMetadata: EndpointMetadataResult;
+  authorizationRequest: AuthorizationRequestOpts;
+  credentialOffer?: CredentialOfferRequestWithBaseUrl;
+  credentialsSupported?: CredentialSupported[];
+}): Promise<string> => {
+  const { redirectUri } = authorizationRequest;
+  let { scope, authorizationDetails } = authorizationRequest;
+  const parMode = endpointMetadata?.credentialIssuerMetadata?.require_pushed_authorization_requests
+    ? PARMode.REQUIRE
+    : authorizationRequest.parMode ?? PARMode.AUTO;
+  // Scope and authorization_details can be used in the same authorization request
+  // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-rar-23#name-relationship-to-scope-param
+  if (!scope && !authorizationDetails) {
+    if (!credentialOffer) {
+      throw Error('Please provide a scope or authorization_details if no credential offer is present');
+    }
+    const creds = credentialOffer.credential_offer.credentials;
+
+    // FIXME: complains about VCT for sd-jwt
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
+    authorizationDetails = creds
+      .flatMap((cred) => (typeof cred === 'string' ? credentialsSupported : (cred as CredentialSupported)))
+      .filter((cred) => !!cred)
+      .map((cred) => {
+        return {
+          ...cred,
+          type: 'openid_credential',
+          locations: [endpointMetadata.issuer],
+
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore
+          format: cred!.format,
+        } satisfies AuthorizationDetails;
+      });
+    if (!authorizationDetails || authorizationDetails.length === 0) {
+      throw Error(`Could not create authorization details from credential offer. Please pass in explicit details`);
+    }
+  }
+  if (!endpointMetadata?.authorization_endpoint) {
+    throw Error('Server metadata does not contain authorization endpoint');
+  }
+  const parEndpoint = endpointMetadata.credentialIssuerMetadata?.pushed_authorization_request_endpoint;
+
+  // add 'openid' scope if not present
+  if (!scope?.includes('openid')) {
+    scope = ['openid', scope].filter((s) => !!s).join(' ');
+  }
+
+  let queryObj: { [key: string]: string } | PushedAuthorizationResponse = {
+    response_type: ResponseType.AUTH_CODE,
+    ...(!pkce.disabled && {
+      code_challenge_method: pkce.codeChallengeMethod ?? CodeChallengeMethod.S256,
+      code_challenge: pkce.codeChallenge,
+    }),
+    authorization_details: JSON.stringify(handleAuthorizationDetails(endpointMetadata, authorizationDetails)),
+    redirect_uri: redirectUri,
+    scope: scope,
+  };
+
+  if (authorizationRequest.clientId) {
+    queryObj['client_id'] = authorizationRequest.clientId;
+  }
+
+  if (credentialOffer?.issuerState) {
+    queryObj['issuer_state'] = credentialOffer.issuerState;
+  }
+  if (!parEndpoint && parMode === PARMode.REQUIRE) {
+    throw Error(`PAR mode is set to required by Authorization Server does not support PAR!`);
+  } else if (parEndpoint && parMode !== PARMode.NEVER) {
+    const parResponse = await formPost<PushedAuthorizationResponse>(parEndpoint, new URLSearchParams(queryObj));
+    if (parResponse.errorBody || !parResponse.successBody) {
+      throw Error(`PAR error`);
+    }
+    queryObj = { request_uri: parResponse.successBody.request_uri };
+  }
+
+  const url = convertJsonToURI(queryObj, {
+    baseUrl: endpointMetadata.authorization_endpoint,
+    uriTypeProperties: ['request_uri', 'redirect_uri', 'scope', 'authorization_details', 'issuer_state'],
+    mode: JsonURIMode.X_FORM_WWW_URLENCODED,
+    // We do not add the version here, as this always needs to be form encoded
+  });
+  console.log(`Authorization Request URL: ${url}`);
+  return url;
+};
+
+const handleAuthorizationDetails = (
+  endpointMetadata: EndpointMetadataResult,
+  authorizationDetails?: AuthorizationDetails | AuthorizationDetails[],
+): AuthorizationDetails | AuthorizationDetails[] | undefined => {
+  if (authorizationDetails) {
+    if (typeof authorizationDetails === 'string') {
+      // backwards compat for older versions of the lib
+      return authorizationDetails;
+    }
+    if (Array.isArray(authorizationDetails)) {
+      return authorizationDetails
+        .filter((value) => typeof value !== 'string')
+        .map((value) => handleLocations(endpointMetadata, typeof value === 'string' ? value : { ...value }));
+    } else {
+      return handleLocations(endpointMetadata, { ...authorizationDetails });
+    }
+  }
+  return authorizationDetails;
+};
+
+const handleLocations = (endpointMetadata: EndpointMetadataResult, authorizationDetails: AuthorizationDetails) => {
+  if (typeof authorizationDetails === 'string') {
+    // backwards compat for older versions of the lib
+    return authorizationDetails;
+  }
+  if (authorizationDetails && (endpointMetadata.credentialIssuerMetadata?.authorization_server || endpointMetadata.authorization_endpoint)) {
+    if (authorizationDetails.locations) {
+      if (Array.isArray(authorizationDetails.locations)) {
+        (authorizationDetails.locations as string[]).push(endpointMetadata.issuer);
+      } else {
+        authorizationDetails.locations = [authorizationDetails.locations as string, endpointMetadata.issuer];
+      }
+    } else {
+      authorizationDetails.locations = [endpointMetadata.issuer];
+    }
+  }
+  return authorizationDetails;
+};

package/lib/CredentialOfferClient.ts

@@ -5,6 +5,7 @@ import {
   CredentialOfferRequestWithBaseUrl,
   CredentialOfferV1_0_11,
   determineSpecVersionFromURI,
+  getClientIdFromCredentialOfferPayload,
   OpenId4VCIVersion,
   toUniformCredentialOfferRequest,
 } from '@sphereon/oid4vci-common';
@@ -43,6 +44,7 @@ export class CredentialOfferClient {
         throw Error('Either a credential_offer or credential_offer_uri should be present in ' + uri);
       }
     }
+    const clientId = getClientIdFromCredentialOfferPayload(credentialOffer?.credential_offer);
     const request = await toUniformCredentialOfferRequest(credentialOffer, {
       ...opts,
       version,
@@ -53,6 +55,7 @@ export class CredentialOfferClient {
     return {
       scheme,
       baseUrl,
+      clientId,
       ...request,
       ...(grants?.authorization_code?.issuer_state && { issuerState: grants.authorization_code.issuer_state }),
       ...(grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.['pre-authorized_code'] && {

package/lib/OpenID4VCIClient.ts

@@ -1,6 +1,7 @@
 import {
   AccessTokenResponse,
   Alg,
+  AuthorizationRequestOpts,
   AuthzFlowType,
   CodeChallengeMethod,
   CredentialOfferPayloadV1_0_08,
@@ -11,26 +12,23 @@ import {
   getIssuerFromCredentialOfferPayload,
   getSupportedCredentials,
   getTypesFromCredentialSupported,
-  JsonURIMode,
   JWK,
   KID_JWK_X5C_ERROR,
   OID4VCICredentialFormat,
   OpenId4VCIVersion,
+  PKCEOpts,
   ProofOfPossessionCallbacks,
-  PushedAuthorizationResponse,
-  ResponseType,
 } from '@sphereon/oid4vci-common';
 import { CredentialFormat } from '@sphereon/ssi-types';
 import Debug from 'debug';
 
 import { AccessTokenClient } from './AccessTokenClient';
+import { createAuthorizationRequestUrl } from './AuthorizationCodeClient';
 import { CredentialOfferClient } from './CredentialOfferClient';
 import { CredentialRequestClientBuilder } from './CredentialRequestClientBuilder';
 import { MetadataClient } from './MetadataClient';
 import { ProofOfPossessionBuilder } from './ProofOfPossessionBuilder';
-import { convertJsonToURI, formPost } from './functions';
-import { createPKCEOpts } from './functions/AuthorizationUtil';
-import { AuthDetails, AuthRequestOpts, PARMode, PKCEOpts } from './types';
+import { generateMissingPKCEOpts } from './functions/AuthorizationUtil';
 
 const debug = Debug('sphereon:oid4vci');
 
@@ -44,6 +42,9 @@ export class OpenID4VCIClient {
   private _endpointMetadata: EndpointMetadataResult | undefined;
   private _accessTokenResponse: AccessTokenResponse | undefined;
   private _pkce: PKCEOpts = { disabled: false, codeChallengeMethod: CodeChallengeMethod.S256 };
+  private _authorizationRequestOpts?: AuthorizationRequestOpts;
+
+  private _authorizationURL?: string;
 
   private constructor({
     credentialOffer,
@@ -51,12 +52,16 @@ export class OpenID4VCIClient {
     kid,
     alg,
     credentialIssuer,
+    pkce,
+    authorizationRequest,
   }: {
     credentialOffer?: CredentialOfferRequestWithBaseUrl;
     kid?: string;
     alg?: Alg | string;
     clientId?: string;
     credentialIssuer?: string;
+    pkce?: PKCEOpts;
+    authorizationRequest?: AuthorizationRequestOpts; // Can be provided here, or when manually calling createAuthorizationUrl
   }) {
     this._credentialOffer = credentialOffer;
     const issuer = credentialIssuer ?? (credentialOffer ? getIssuerFromCredentialOfferPayload(credentialOffer.credential_offer) : undefined);
@@ -67,6 +72,9 @@ export class OpenID4VCIClient {
     this._kid = kid;
     this._alg = alg;
     this._clientId = clientId;
+    this._pkce = { ...this._pkce, ...pkce };
+    this._authorizationRequestOpts = authorizationRequest;
+    this.syncAuthorizationRequestOpts(authorizationRequest);
   }
 
   public static async fromCredentialIssuer({
@@ -75,17 +83,33 @@ export class OpenID4VCIClient {
     retrieveServerMetadata,
     clientId,
     credentialIssuer,
+    pkce,
+    authorizationRequest,
+    createAuthorizationRequestURL,
   }: {
     credentialIssuer: string;
     kid?: string;
     alg?: Alg | string;
     retrieveServerMetadata?: boolean;
     clientId?: string;
+    createAuthorizationRequestURL?: boolean;
+    authorizationRequest?: AuthorizationRequestOpts; // Can be provided here, or when manually calling createAuthorizationUrl
+    pkce?: PKCEOpts;
   }) {
-    const client = new OpenID4VCIClient({ kid, alg, clientId, credentialIssuer });
+    const client = new OpenID4VCIClient({
+      kid,
+      alg,
+      clientId: clientId ?? authorizationRequest?.clientId,
+      credentialIssuer,
+      pkce,
+      authorizationRequest,
+    });
     if (retrieveServerMetadata === undefined || retrieveServerMetadata) {
       await client.retrieveServerMetadata();
     }
+    if (createAuthorizationRequestURL === undefined || createAuthorizationRequestURL) {
+      await client.createAuthorizationRequestUrl({ authorizationRequest, pkce });
+    }
     return client;
   }
 
@@ -95,28 +119,74 @@ export class OpenID4VCIClient {
     alg,
     retrieveServerMetadata,
     clientId,
+    pkce,
+    createAuthorizationRequestURL,
+    authorizationRequest,
     resolveOfferUri,
   }: {
     uri: string;
     kid?: string;
     alg?: Alg | string;
     retrieveServerMetadata?: boolean;
+    createAuthorizationRequestURL?: boolean;
     resolveOfferUri?: boolean;
+    pkce?: PKCEOpts;
     clientId?: string;
+    authorizationRequest?: AuthorizationRequestOpts; // Can be provided here, or when manually calling createAuthorizationUrl
   }): Promise<OpenID4VCIClient> {
+    const credentialOfferClient = await CredentialOfferClient.fromURI(uri, { resolve: resolveOfferUri });
     const client = new OpenID4VCIClient({
-      credentialOffer: await CredentialOfferClient.fromURI(uri, { resolve: resolveOfferUri }),
+      credentialOffer: credentialOfferClient,
       kid,
       alg,
-      clientId,
+      clientId: clientId ?? authorizationRequest?.clientId ?? credentialOfferClient.clientId,
+      pkce,
+      authorizationRequest,
     });
 
     if (retrieveServerMetadata === undefined || retrieveServerMetadata) {
       await client.retrieveServerMetadata();
     }
+    if (
+      credentialOfferClient.supportedFlows.includes(AuthzFlowType.AUTHORIZATION_CODE_FLOW) &&
+      (createAuthorizationRequestURL === undefined || createAuthorizationRequestURL)
+    ) {
+      console.log(`AUTH REQ`);
+      await client.createAuthorizationRequestUrl({ authorizationRequest, pkce });
+      console.log(`AUTH REQ URL: ${client._authorizationURL}`);
+    }
+
     return client;
   }
 
+  public async createAuthorizationRequestUrl(opts?: { authorizationRequest?: AuthorizationRequestOpts; pkce?: PKCEOpts }): Promise<string> {
+    if (!this._authorizationURL) {
+      this.calculatePKCEOpts(opts?.pkce);
+      this.syncAuthorizationRequestOpts(opts?.authorizationRequest);
+      if (!this._authorizationRequestOpts) {
+        throw Error(`No Authorization Request options present or provided in this call`);
+      }
+
+      // todo: Probably can go with current logic in MetadataClient who will always set the authorization_endpoint when found
+      //  handling this because of the support for v1_0-08
+      if (
+        this._endpointMetadata &&
+        this._endpointMetadata.credentialIssuerMetadata &&
+        'authorization_endpoint' in this._endpointMetadata.credentialIssuerMetadata
+      ) {
+        this._endpointMetadata.authorization_endpoint = this._endpointMetadata.credentialIssuerMetadata.authorization_endpoint as string;
+      }
+      this._authorizationURL = await createAuthorizationRequestUrl({
+        pkce: this._pkce,
+        endpointMetadata: this.endpointMetadata,
+        authorizationRequest: this._authorizationRequestOpts,
+        credentialOffer: this.credentialOffer,
+        credentialsSupported: this.getCredentialsSupported(true),
+      });
+    }
+    return this._authorizationURL;
+  }
+
   public async retrieveServerMetadata(): Promise<EndpointMetadataResult> {
     this.assertIssuerData();
     if (!this._endpointMetadata) {
@@ -131,117 +201,8 @@ export class OpenID4VCIClient {
     return this.endpointMetadata;
   }
 
-  public async createAuthorizationRequestUrl(opts: AuthRequestOpts): Promise<string> {
-    const { redirectUri } = opts;
-    let { scope, authorizationDetails } = opts;
-    const parMode = this._endpointMetadata?.credentialIssuerMetadata?.require_pushed_authorization_requests
-      ? PARMode.REQUIRE
-      : opts.parMode ?? PARMode.AUTO;
-    this._pkce = createPKCEOpts({ ...this._pkce, ...opts.pkce });
-    // Scope and authorization_details can be used in the same authorization request
-    // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-rar-23#name-relationship-to-scope-param
-    if (!scope && !authorizationDetails) {
-      if (!this.credentialOffer) {
-        throw Error('Please provide a scope or authorization_details');
-      }
-      const creds = this.credentialOffer.credential_offer.credentials;
-
-      authorizationDetails = creds
-        .flatMap((cred) => (typeof cred === 'string' ? this.getCredentialsSupported(true) : (cred as CredentialSupported)))
-        .map((cred) => {
-          return {
-            ...cred,
-            type: 'openid_credential',
-            locations: [this._credentialIssuer],
-            format: cred.format,
-          } satisfies AuthDetails;
-        });
-      if (authorizationDetails.length === 0) {
-        throw Error(`Could not create authorization details from credential offer. Please pass in explicit details`);
-      }
-    }
-    // todo: Probably can go with current logic in MetadataClient who will always set the authorization_endpoint when found
-    //  handling this because of the support for v1_0-08
-    if (
-      this._endpointMetadata &&
-      this._endpointMetadata.credentialIssuerMetadata &&
-      'authorization_endpoint' in this._endpointMetadata.credentialIssuerMetadata
-    ) {
-      this._endpointMetadata.authorization_endpoint = this._endpointMetadata.credentialIssuerMetadata.authorization_endpoint as string;
-    }
-    if (!this._endpointMetadata?.authorization_endpoint) {
-      throw Error('Server metadata does not contain authorization endpoint');
-    }
-    const parEndpoint = this._endpointMetadata.credentialIssuerMetadata?.pushed_authorization_request_endpoint;
-
-    // add 'openid' scope if not present
-    if (!scope?.includes('openid')) {
-      scope = ['openid', scope].filter((s) => !!s).join(' ');
-    }
-
-    let queryObj: { [key: string]: string } | PushedAuthorizationResponse = {
-      response_type: ResponseType.AUTH_CODE,
-      ...(!this._pkce.disabled && {
-        code_challenge_method: this._pkce.codeChallengeMethod ?? CodeChallengeMethod.S256,
-        code_challenge: this._pkce.codeChallenge,
-      }),
-      authorization_details: JSON.stringify(this.handleAuthorizationDetails(authorizationDetails)),
-      redirect_uri: redirectUri,
-      scope: scope,
-    };
-
-    if (this.clientId) {
-      queryObj['client_id'] = this.clientId;
-    }
-
-    if (this.credentialOffer?.issuerState) {
-      queryObj['issuer_state'] = this.credentialOffer.issuerState;
-    }
-    if (!parEndpoint && parMode === PARMode.REQUIRE) {
-      throw Error(`PAR mode is set to required by Authorization Server does not support PAR!`);
-    } else if (parEndpoint && parMode !== PARMode.NEVER) {
-      const parResponse = await formPost<PushedAuthorizationResponse>(parEndpoint, new URLSearchParams(queryObj));
-      if (parResponse.errorBody || !parResponse.successBody) {
-        throw Error(`PAR error`);
-      }
-      queryObj = { request_uri: parResponse.successBody.request_uri };
-    }
-
-    return convertJsonToURI(queryObj, {
-      baseUrl: this._endpointMetadata.authorization_endpoint,
-      uriTypeProperties: ['request_uri', 'redirect_uri', 'scope', 'authorization_details', 'issuer_state'],
-      mode: JsonURIMode.X_FORM_WWW_URLENCODED,
-      // We do not add the version here, as this always needs to be form encoded
-    });
-  }
-
-  public handleAuthorizationDetails(authorizationDetails?: AuthDetails | AuthDetails[]): AuthDetails | AuthDetails[] | undefined {
-    if (authorizationDetails) {
-      if (Array.isArray(authorizationDetails)) {
-        return authorizationDetails.map((value) => this.handleLocations({ ...value }));
-      } else {
-        return this.handleLocations({ ...authorizationDetails });
-      }
-    }
-    return authorizationDetails;
-  }
-
-  private handleLocations(authorizationDetails: AuthDetails) {
-    if (
-      authorizationDetails &&
-      (this.endpointMetadata.credentialIssuerMetadata?.authorization_server || this.endpointMetadata.authorization_endpoint)
-    ) {
-      if (authorizationDetails.locations) {
-        if (Array.isArray(authorizationDetails.locations)) {
-          (authorizationDetails.locations as string[]).push(this.endpointMetadata.issuer);
-        } else {
-          authorizationDetails.locations = [authorizationDetails.locations as string, this.endpointMetadata.issuer];
-        }
-      } else {
-        authorizationDetails.locations = this.endpointMetadata.issuer;
-      }
-    }
-    return authorizationDetails;
+  private calculatePKCEOpts(pkce?: PKCEOpts) {
+    this._pkce = generateMissingPKCEOpts({ ...this._pkce, ...pkce });
   }
 
   public async acquireAccessToken(opts?: {
@@ -452,7 +413,22 @@ export class OpenID4VCIClient {
   }
 
   issuerSupportedFlowTypes(): AuthzFlowType[] {
-    return this.credentialOffer?.supportedFlows ?? [AuthzFlowType.AUTHORIZATION_CODE_FLOW];
+    return (
+      this.credentialOffer?.supportedFlows ??
+      (this._endpointMetadata?.credentialIssuerMetadata?.authorization_endpoint ? [AuthzFlowType.AUTHORIZATION_CODE_FLOW] : [])
+    );
+  }
+
+  isFlowTypeSupported(flowType: AuthzFlowType): boolean {
+    return this.issuerSupportedFlowTypes().includes(flowType);
+  }
+
+  get authorizationURL(): string | undefined {
+    return this._authorizationURL;
+  }
+
+  public hasAuthorizationURL(): boolean {
+    return !!this.authorizationURL;
   }
 
   get credentialOffer(): CredentialOfferRequestWithBaseUrl | undefined {
@@ -522,10 +498,10 @@ export class OpenID4VCIClient {
   }
 
   private assertIssuerData(): void {
-    if (!this._credentialOffer && this.issuerSupportedFlowTypes().includes(AuthzFlowType.PRE_AUTHORIZED_CODE_FLOW)) {
-      throw Error(`No issuance initiation or credential offer present`);
-    } else if (!this._credentialIssuer) {
+    if (!this._credentialIssuer) {
       throw Error(`No credential issuer value present`);
+    } else if (!this._credentialOffer && this._endpointMetadata && this.issuerSupportedFlowTypes().length === 0) {
+      throw Error(`No issuance initiation or credential offer present`);
     }
   }
 
@@ -540,4 +516,21 @@ export class OpenID4VCIClient {
       throw Error(`No access token present`);
     }
   }
+
+  private syncAuthorizationRequestOpts(opts?: AuthorizationRequestOpts) {
+    if (!this._authorizationRequestOpts && !opts) {
+      return;
+    }
+    const authorizationRequestOpts = { ...this._authorizationRequestOpts, ...opts } as AuthorizationRequestOpts;
+    if (authorizationRequestOpts.clientId) {
+      this._clientId = authorizationRequestOpts.clientId;
+    }
+    if (this._clientId && authorizationRequestOpts) {
+      authorizationRequestOpts.clientId = this._clientId;
+    }
+    if (!authorizationRequestOpts.redirectUri) {
+      authorizationRequestOpts.redirectUri = 'openid4vc%3A';
+    }
+    this._authorizationRequestOpts = authorizationRequestOpts;
+  }
 }

package/lib/__tests__/EBSIE2E.spec.test.ts

@@ -69,7 +69,9 @@ describe('OID4VCI-Client using Sphereon issuer should', () => {
 
     if (credentialType !== 'CTWalletCrossPreAuthorisedInTime') {
       const url = await client.createAuthorizationRequestUrl({
-        redirectUri: 'openid4vc%3A',
+        authorizationRequest: {
+          redirectUri: 'openid4vc%3A',
+        },
       });
       const result = await fetch(url);
       console.log(result.text());