@sphereon/oid4vci-common 0.10.3 → 0.10.4-next.119

package/lib/functions/IssuerMetadataUtils.ts

@@ -1,106 +1,158 @@
+import { CredentialDefinitionV1_0_13, CredentialOfferFormat, JsonLdIssuerCredentialDefinition, VCI_LOG_COMMON } from '../index';
 import {
   AuthorizationServerMetadata,
+  CredentialConfigurationSupported,
+  CredentialConfigurationSupportedV1_0_13,
   CredentialIssuerMetadata,
-  CredentialOfferFormat,
-  CredentialSupported,
   CredentialSupportedTypeV1_0_08,
   CredentialSupportedV1_0_08,
-  IssuerMetadataV1_0_08,
+  IssuerMetadata,
   MetadataDisplay,
   OID4VCICredentialFormat,
   OpenId4VCIVersion,
 } from '../types';
 
 export function getSupportedCredentials(opts?: {
-  issuerMetadata?: CredentialIssuerMetadata | IssuerMetadataV1_0_08;
+  issuerMetadata?: CredentialIssuerMetadata | IssuerMetadata;
   version: OpenId4VCIVersion;
   types?: string[][];
-  format?: (OID4VCICredentialFormat | string) | (OID4VCICredentialFormat | string)[];
-}): CredentialSupported[] {
-  if (opts?.types && Array.isArray(opts?.types)) {
-    return opts.types.flatMap((types) => getSupportedCredential({ ...opts, types }));
+  format?: OID4VCICredentialFormat | string | (OID4VCICredentialFormat | string)[];
+}): Record<string, CredentialConfigurationSupportedV1_0_13> | Array<CredentialConfigurationSupported> {
+  const { version = OpenId4VCIVersion.VER_1_0_13, types } = opts ?? {};
+  if (types && Array.isArray(types)) {
+    if (version < OpenId4VCIVersion.VER_1_0_13) {
+      return types.flatMap((typeSet) => getSupportedCredential({ ...opts, version, types: typeSet }) as Array<CredentialConfigurationSupported>);
+    } else {
+      return types
+        .map((typeSet) => {
+          return getSupportedCredential({ ...opts, version, types: typeSet });
+        })
+        .reduce(
+          (acc, result) => {
+            Object.assign(acc, result);
+            return acc;
+          },
+          {} as Record<string, CredentialConfigurationSupportedV1_0_13>,
+        );
+    }
   }
+
   return getSupportedCredential(opts ? { ...opts, types: undefined } : undefined);
 }
 
-export function getSupportedCredential(opts?: {
-  issuerMetadata?: CredentialIssuerMetadata | IssuerMetadataV1_0_08;
-  version: OpenId4VCIVersion;
-  types?: string | string[];
-  format?: (OID4VCICredentialFormat | string) | (OID4VCICredentialFormat | string)[];
-}): CredentialSupported[] {
-  const { issuerMetadata } = opts ?? {};
-  let formats: (OID4VCICredentialFormat | string)[];
-  if (opts?.format && Array.isArray(opts.format)) {
-    formats = opts.format;
-  } else if (opts?.format && !Array.isArray(opts.format)) {
-    formats = [opts.format];
-  } else {
-    formats = [];
+export function determineVersionsFromIssuerMetadata(issuerMetadata: CredentialIssuerMetadata | IssuerMetadata): Array<OpenId4VCIVersion> {
+  const versions = new Set<OpenId4VCIVersion>();
+  if ('authorization_server' in issuerMetadata) {
+    versions.add(OpenId4VCIVersion.VER_1_0_11);
+  } else if ('authorization_servers' in issuerMetadata) {
+    versions.add(OpenId4VCIVersion.VER_1_0_13);
   }
-  let credentialsSupported: CredentialSupported[];
-  if (!issuerMetadata) {
-    return [];
+  if (versions.size === 0) {
+    // The above checks where already very specific and only applicable to single versions we support, so let's skip if we encounter them
+    if ('credential_configurations_supported' in issuerMetadata) {
+      versions.add(OpenId4VCIVersion.VER_1_0_13);
+    } else if ('credentials_supported' in issuerMetadata) {
+      if (typeof issuerMetadata.credentials_supported === 'object') {
+        versions.add(OpenId4VCIVersion.VER_1_0_08);
+      } else {
+        versions.add(OpenId4VCIVersion.VER_1_0_09).add(OpenId4VCIVersion.VER_1_0_11);
+      }
+    }
   }
-  const { version, types } = opts ?? { version: OpenId4VCIVersion.VER_1_0_11 };
-  if (version === OpenId4VCIVersion.VER_1_0_08 || !Array.isArray(issuerMetadata.credentials_supported)) {
-    credentialsSupported = credentialsSupportedV8ToV11((issuerMetadata as IssuerMetadataV1_0_08).credentials_supported ?? {});
-  } else {
-    credentialsSupported = (issuerMetadata as CredentialIssuerMetadata).credentials_supported;
+  if (versions.size === 0) {
+    versions.add(OpenId4VCIVersion.VER_UNKNOWN);
   }
 
-  if (credentialsSupported === undefined || credentialsSupported.length === 0) {
-    return [];
-  } else if (!types || types.length === 0) {
-    return credentialsSupported;
-  }
-  /**
-   * the following (not array part is a legacy code from version 1_0-08 which JFF plugfest 2 implementors used)
-   */
-  let initiationTypes: string[] | undefined;
-  if (opts?.types) {
-    if (typeof opts.types === 'string') {
-      initiationTypes = [opts.types];
+  return Array.from(versions).sort().reverse(); // highest version first
+}
+
+export function getSupportedCredential(opts?: {
+  issuerMetadata?: CredentialIssuerMetadata | IssuerMetadata;
+  version: OpenId4VCIVersion;
+  types?: string | string[];
+  format?: OID4VCICredentialFormat | string | (OID4VCICredentialFormat | string)[];
+}): Record<string, CredentialConfigurationSupportedV1_0_13> | Array<CredentialConfigurationSupported> {
+  const { issuerMetadata, types, format, version = OpenId4VCIVersion.VER_1_0_13 } = opts ?? {};
+
+  let credentialConfigurationsV11: Array<CredentialConfigurationSupported> | undefined = undefined;
+  let credentialConfigurationsV13: Record<string, CredentialConfigurationSupportedV1_0_13> | undefined = undefined;
+  if (version < OpenId4VCIVersion.VER_1_0_12 || issuerMetadata?.credentials_supported) {
+    if (issuerMetadata?.credentials_supported && !Array.isArray(issuerMetadata?.credentials_supported)) {
+      // The current code duplication and logic is such a mess, that we re-adjust the object to the proper type again
+      credentialConfigurationsV11 = [];
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+      Object.entries(issuerMetadata.credentials_supported!).forEach(([id, supported]) => {
+        if (!supported.id) {
+          supported.id = id;
+        }
+        credentialConfigurationsV11?.push(supported as CredentialConfigurationSupported);
+      });
     } else {
-      initiationTypes = opts.types;
+      credentialConfigurationsV11 = (issuerMetadata?.credentials_supported as Array<CredentialConfigurationSupported>) ?? [];
     }
+  } else {
+    credentialConfigurationsV13 =
+      (issuerMetadata?.credential_configurations_supported as Record<string, CredentialConfigurationSupportedV1_0_13>) ?? {};
   }
-  if (version === OpenId4VCIVersion.VER_1_0_08 && (!initiationTypes || initiationTypes?.length === 0)) {
-    initiationTypes = formats;
+  if (!issuerMetadata || (!issuerMetadata.credential_configurations_supported && !issuerMetadata.credentials_supported)) {
+    VCI_LOG_COMMON.warning(`No credential issuer metadata or supported credentials found for issuer}`);
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    return version < OpenId4VCIVersion.VER_1_0_13 ? credentialConfigurationsV11! : credentialConfigurationsV13!;
   }
-  const supportedFormats: (CredentialOfferFormat | string)[] = formats && formats.length > 0 ? formats : ['jwt_vc_json', 'jwt_vc_json-ld', 'ldp_vc'];
 
-  const credentialSupportedOverlap: CredentialSupported[] = [];
-  if ((opts?.types && typeof opts?.types === 'string') || opts?.types?.length === 1) {
-    const types = Array.isArray(opts.types) ? opts.types[0] : opts.types;
-    const supported = credentialsSupported.filter(
-      (sup) => sup.id === types || (initiationTypes && arrayEqualsIgnoreOrder(getTypesFromCredentialSupported(sup), initiationTypes)),
-    );
-    if (supported) {
-      credentialSupportedOverlap.push(...supported);
-    }
-  }
+  const normalizedTypes: string[] = Array.isArray(types) ? types : types ? [types] : [];
+  const normalizedFormats: string[] = Array.isArray(format) ? format : format ? [format] : [];
 
-  if (credentialSupportedOverlap.length === 0) {
-    // Make sure we include Verifiable Credential both on the offer side as well as in the metadata side, to ensure consistency of the issuer does not.
-    if (initiationTypes && !initiationTypes.includes('VerifiableCredential')) {
-      initiationTypes.push('VerifiableCredential');
-    }
-    const supported = credentialsSupported.filter((sup) => {
-      const supTypes = getTypesFromCredentialSupported(sup);
-      if (!supTypes.includes('VerifiableCredential')) {
-        supTypes.push('VerifiableCredential');
+  function filterMatchingConfig(config: CredentialConfigurationSupported): CredentialConfigurationSupported | undefined {
+    let isTypeMatch = normalizedTypes.length === 0;
+    const types = getTypesFromObject(config);
+    if (!isTypeMatch) {
+      if (normalizedTypes.length === 1 && config.id === normalizedTypes[0]) {
+        isTypeMatch = true;
+      } else if (types) {
+        isTypeMatch = normalizedTypes.every((type) => types.includes(type));
+      } else {
+        if ('credential_definition' in config) {
+          isTypeMatch = normalizedTypes.every((type) => config.credential_definition.type?.includes(type));
+        } else if ('type' in config && Array.isArray(config.type)) {
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore
+          isTypeMatch = normalizedTypes.every((type) => config.type.includes(type));
+        } else if ('types' in config) {
+          isTypeMatch = normalizedTypes.every((type) => config.types?.includes(type));
+        }
       }
-      return (!initiationTypes || arrayEqualsIgnoreOrder(supTypes, initiationTypes)) && supportedFormats.includes(sup.format);
-    });
-    if (supported) {
-      credentialSupportedOverlap.push(...supported);
     }
+
+    const isFormatMatch = normalizedFormats.length === 0 || normalizedFormats.includes(config.format);
+
+    return isTypeMatch && isFormatMatch ? config : undefined;
+  }
+
+  if (credentialConfigurationsV13) {
+    return Object.entries(credentialConfigurationsV13).reduce(
+      (filteredConfigs, [id, config]) => {
+        if (filterMatchingConfig(config)) {
+          filteredConfigs[id] = config;
+          // Added to enable support < 13. We basically assign the
+          if (!config.id) {
+            config.id = id;
+          }
+        }
+        return filteredConfigs;
+      },
+      {} as Record<string, CredentialConfigurationSupportedV1_0_13>,
+    );
+  } else if (credentialConfigurationsV11) {
+    return credentialConfigurationsV11.filter((config) => filterMatchingConfig(config));
   }
-  return credentialSupportedOverlap;
+  throw Error(`Either < v11 configurations or V13 configurations should have been filtered at this point`);
 }
 
-export function getTypesFromCredentialSupported(credentialSupported: CredentialSupported, opts?: { filterVerifiableCredential: boolean }) {
+export function getTypesFromCredentialSupported(
+  credentialSupported: CredentialConfigurationSupported,
+  opts?: { filterVerifiableCredential: boolean },
+) {
   let types: string[] = [];
   if (
     credentialSupported.format === 'jwt_vc_json' ||
@@ -108,8 +160,10 @@ export function getTypesFromCredentialSupported(credentialSupported: CredentialS
     credentialSupported.format === 'jwt_vc_json-ld' ||
     credentialSupported.format === 'ldp_vc'
   ) {
-    types = credentialSupported.types;
+    types = getTypesFromObject(credentialSupported) ?? [];
   } else if (credentialSupported.format === 'vc+sd-jwt') {
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
     types = [credentialSupported.vct];
   }
 
@@ -122,44 +176,36 @@ export function getTypesFromCredentialSupported(credentialSupported: CredentialS
   return types;
 }
 
-function arrayEqualsIgnoreOrder(a: string[], b: string[]) {
-  if (a.length !== b.length) return false;
-  const uniqueValues = new Set([...a, ...b]);
-  for (const v of uniqueValues) {
-    const aCount = a.filter((e) => e === v).length;
-    const bCount = b.filter((e) => e === v).length;
-    if (aCount !== bCount) return false;
-  }
-  return true;
-}
-
-export function credentialsSupportedV8ToV11(supportedV8: CredentialSupportedTypeV1_0_08): CredentialSupported[] {
-  return Object.entries(supportedV8).flatMap((entry) => {
+export function credentialsSupportedV8ToV13(supportedV8: CredentialSupportedTypeV1_0_08): Record<string, CredentialConfigurationSupported> {
+  const credentialConfigsSupported: Record<string, CredentialConfigurationSupported> = {};
+  Object.entries(supportedV8).flatMap((entry) => {
     const type = entry[0];
     const supportedV8 = entry[1];
-    return credentialSupportedV8ToV11(type, supportedV8);
+    Object.assign(credentialConfigsSupported, credentialSupportedV8ToV13(type, supportedV8));
   });
+  return credentialConfigsSupported;
 }
 
-export function credentialSupportedV8ToV11(key: string, supportedV8: CredentialSupportedV1_0_08): CredentialSupported[] {
-  return Object.entries(supportedV8.formats).map((entry) => {
+export function credentialSupportedV8ToV13(key: string, supportedV8: CredentialSupportedV1_0_08): Record<string, CredentialConfigurationSupported> {
+  const credentialConfigsSupported: Record<string, CredentialConfigurationSupported> = {};
+  Object.entries(supportedV8.formats).map((entry) => {
     const format = entry[0];
     const credentialSupportBrief = entry[1];
     if (typeof format !== 'string') {
       throw Error(`Unknown format received ${JSON.stringify(format)}`);
     }
-    let credentialSupport: Partial<CredentialSupported> = {};
-    credentialSupport = {
+    const credentialConfigSupported: Partial<CredentialConfigurationSupported> = {
       format: format as OID4VCICredentialFormat,
       display: supportedV8.display,
       ...credentialSupportBrief,
       credentialSubject: supportedV8.claims,
     };
-    return credentialSupport as CredentialSupported;
+    credentialConfigsSupported[key] = credentialConfigSupported as CredentialConfigurationSupported;
   });
+  return credentialConfigsSupported;
 }
 
-export function getIssuerDisplays(metadata: CredentialIssuerMetadata | IssuerMetadataV1_0_08, opts?: { prefLocales: string[] }): MetadataDisplay[] {
+export function getIssuerDisplays(metadata: CredentialIssuerMetadata | IssuerMetadata, opts?: { prefLocales: string[] }): MetadataDisplay[] {
   const matchedDisplays =
     metadata.display?.filter(
       (item) => !opts?.prefLocales || opts.prefLocales.length === 0 || (item.locale && opts.prefLocales.includes(item.locale)) || !item.locale,
@@ -172,7 +218,7 @@ export function getIssuerDisplays(metadata: CredentialIssuerMetadata | IssuerMet
  */
 export function getIssuerName(
   url: string,
-  credentialIssuerMetadata?: Partial<AuthorizationServerMetadata> & (CredentialIssuerMetadata | IssuerMetadataV1_0_08),
+  credentialIssuerMetadata?: Partial<AuthorizationServerMetadata> & (CredentialIssuerMetadata | IssuerMetadata),
 ): string {
   if (credentialIssuerMetadata) {
     const displays: Array<MetadataDisplay> = credentialIssuerMetadata ? getIssuerDisplays(credentialIssuerMetadata) : [];
@@ -184,3 +230,28 @@ export function getIssuerName(
   }
   return url;
 }
+
+/**
+ * The specs had many places where types could be expressed. This method ensures we get them in any way possible
+ * @param subject
+ */
+export function getTypesFromObject(
+  subject: CredentialConfigurationSupported | CredentialOfferFormat | CredentialDefinitionV1_0_13 | JsonLdIssuerCredentialDefinition | string,
+): string[] | undefined {
+  if (subject === undefined) {
+    return undefined;
+  } else if (typeof subject === 'string') {
+    return [subject];
+  } else if ('credential_definition' in subject && subject.credential_definition) {
+    return getTypesFromObject(subject.credential_definition);
+  } else if ('types' in subject && subject.types) {
+    return Array.isArray(subject.types) ? subject.types : [subject.types];
+  } else if ('type' in subject && subject.type) {
+    return Array.isArray(subject.type) ? subject.type : [subject.type];
+  } else if ('vct' in subject && subject.vct) {
+    return [subject.vct];
+  }
+
+  VCI_LOG_COMMON.warning('Could not deduce credential types. Probably a failure down the line will happen!');
+  return undefined;
+}

package/lib/functions/ProofUtil.ts

@@ -0,0 +1,185 @@
+import Debug from 'debug';
+import jwtDecode from 'jwt-decode';
+
+import { PoPMode, VCI_LOG_COMMON } from '..';
+import {
+  BAD_PARAMS,
+  BaseJWK,
+  JWK,
+  JWS_NOT_VALID,
+  Jwt,
+  JWTHeader,
+  JWTPayload,
+  JWTVerifyCallback,
+  JwtVerifyResult,
+  ProofOfPossession,
+  ProofOfPossessionCallbacks,
+  Typ,
+} from '../types';
+
+const debug = Debug('sphereon:openid4vci:common');
+
+/**
+ *
+ *  - proofOfPossessionCallback: JWTSignerCallback
+ *    Mandatory if you want to create (sign) ProofOfPossession
+ *  - proofOfPossessionVerifierCallback?: JWTVerifyCallback
+ *    If exists, verifies the ProofOfPossession
+ *  - proofOfPossessionCallbackArgs: ProofOfPossessionCallbackArgs
+ *    arguments needed for signing ProofOfPossession
+ * @param callbacks:
+ *    - proofOfPossessionCallback: JWTSignerCallback
+ *      Mandatory to create (sign) ProofOfPossession
+ *    - proofOfPossessionVerifierCallback?: JWTVerifyCallback
+ *      If exists, verifies the ProofOfPossession
+ * @param jwtProps
+ * @param existingJwt
+ *  - Optional, clientId of the party requesting the credential
+ */
+export const createProofOfPossession = async <DIDDoc>(
+  popMode: PoPMode,
+  callbacks: ProofOfPossessionCallbacks<DIDDoc>,
+  jwtProps?: JwtProps,
+  existingJwt?: Jwt,
+): Promise<ProofOfPossession> => {
+  if (!callbacks.signCallback) {
+    debug(`no jwt signer callback or arguments supplied!`);
+    throw new Error(BAD_PARAMS);
+  }
+
+  const signerArgs = createJWT(popMode, jwtProps, existingJwt);
+  const jwt = await callbacks.signCallback(signerArgs, signerArgs.header.kid);
+  const proof = {
+    proof_type: 'jwt',
+    jwt,
+  } as ProofOfPossession;
+
+  try {
+    partiallyValidateJWS(jwt);
+    if (callbacks.verifyCallback) {
+      debug(`Calling supplied verify callback....`);
+      await callbacks.verifyCallback({ jwt, kid: signerArgs.header.kid });
+      debug(`Supplied verify callback return success result`);
+    }
+  } catch {
+    debug(`JWS was not valid`);
+    throw new Error(JWS_NOT_VALID);
+  }
+  debug(`Proof of Possession JWT:\r\n${jwt}`);
+  return proof;
+};
+
+const partiallyValidateJWS = (jws: string): void => {
+  if (jws.split('.').length !== 3 || !jws.startsWith('ey')) {
+    throw new Error(JWS_NOT_VALID);
+  }
+};
+
+export const isJWS = (token: string): boolean => {
+  try {
+    partiallyValidateJWS(token);
+    return true;
+  } catch (e) {
+    return false;
+  }
+};
+
+export const extractBearerToken = (authorizationHeader?: string): string | undefined => {
+  return authorizationHeader ? /Bearer (.*)/i.exec(authorizationHeader)?.[1] : undefined;
+};
+
+export const validateJWT = async (
+  jwt?: string,
+  opts?: { kid?: string; accessTokenVerificationCallback?: JWTVerifyCallback<never> },
+): Promise<JwtVerifyResult<any>> => {
+  if (!jwt) {
+    throw Error('No JWT was supplied');
+  }
+
+  if (!opts?.accessTokenVerificationCallback) {
+    VCI_LOG_COMMON.warning(`No access token verification callback supplied. Access tokens will not be verified, except for a very basic check`);
+    partiallyValidateJWS(jwt);
+    const header = jwtDecode<JWTHeader>(jwt, { header: true });
+    const payload = jwtDecode<JWTPayload>(jwt, { header: false });
+    return {
+      jwt: { header, payload } satisfies Jwt,
+      ...header,
+      ...payload,
+    };
+  } else {
+    return await opts.accessTokenVerificationCallback({ jwt, kid: opts.kid });
+  }
+};
+
+export interface JwtProps {
+  typ?: Typ;
+  kid?: string;
+  jwk?: JWK;
+  aud?: string | string[];
+  issuer?: string;
+  clientId?: string;
+  alg?: string;
+  jti?: string;
+  nonce?: string;
+}
+
+const createJWT = (mode: PoPMode, jwtProps?: JwtProps, existingJwt?: Jwt): Jwt => {
+  const aud =
+    mode === 'pop'
+      ? getJwtProperty<string | string[]>('aud', true, jwtProps?.issuer, existingJwt?.payload?.aud)
+      : getJwtProperty<string | string[]>('aud', false, jwtProps?.aud, existingJwt?.payload?.aud);
+  const iss =
+    // mode === 'pop'
+       getJwtProperty<string>('iss', false, jwtProps?.clientId, existingJwt?.payload?.iss)
+      // : getJwtProperty<string>('iss', false, jwtProps?.issuer, existingJwt?.payload?.iss);
+  const client_id = mode === 'jwt' ? getJwtProperty<string>('client_id', false, jwtProps?.clientId, existingJwt?.payload?.client_id) : undefined;
+  const jti = getJwtProperty<string>('jti', false, jwtProps?.jti, existingJwt?.payload?.jti);
+  const typ = getJwtProperty<string>('typ', true, jwtProps?.typ, existingJwt?.header?.typ, 'jwt');
+  const nonce = getJwtProperty<string>('nonce', false, jwtProps?.nonce, existingJwt?.payload?.nonce); // Officially this is required, but some implementations don't have it
+  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+  const alg = getJwtProperty<string>('alg', false, jwtProps?.alg, existingJwt?.header?.alg, 'ES256')!;
+  const kid = getJwtProperty<string>('kid', false, jwtProps?.kid, existingJwt?.header?.kid);
+  const jwk = getJwtProperty<BaseJWK>('jwk', false, jwtProps?.jwk, existingJwt?.header?.jwk);
+  const jwt: Partial<Jwt> = existingJwt ? existingJwt : {};
+  const now = +new Date();
+  const jwtPayload: Partial<JWTPayload> = {
+    ...(aud && { aud }),
+    iat: jwt.payload?.iat ?? Math.round(now / 1000 - 60), // Let's ensure we subtract 60 seconds for potential time offsets
+    exp: jwt.payload?.exp ?? Math.round(now / 1000 + 10 * 60),
+    nonce,
+    ...(client_id && { client_id }),
+    ...(iss && { iss }),
+    ...(jti && { jti }),
+  };
+
+  const jwtHeader: JWTHeader = {
+    typ,
+    alg,
+    ...(kid && { kid }),
+    ...(jwk && { jwk }),
+  };
+  return {
+    payload: { ...jwt.payload, ...jwtPayload },
+    header: { ...jwt.header, ...jwtHeader },
+  };
+};
+
+const getJwtProperty = <T>(
+  propertyName: string,
+  required: boolean,
+  option?: string | string[] | JWK,
+  jwtProperty?: T,
+  defaultValue?: T,
+): T | undefined => {
+  if (typeof option === 'string' && option && jwtProperty && option !== jwtProperty) {
+    throw Error(`Cannot have a property '${propertyName}' with value '${option}' and different JWT value '${jwtProperty}' at the same time`);
+  }
+  let result = (jwtProperty ? jwtProperty : option) as T | undefined;
+  if (!result) {
+    if (required) {
+      throw Error(`No ${propertyName} property provided either in a JWT or as option`);
+    }
+    result = defaultValue;
+  }
+  return result;
+};

package/lib/functions/index.ts

@@ -7,6 +7,7 @@ export * from './TypeConversionUtils';
 export * from './IssuerMetadataUtils';
 export * from './FormatUtils';
 export * from './HttpUtils';
+export * from './ProofUtil';
 export * from './AuthorizationResponseUtil';
 export { randomBytes };
 export * from './RandomUtils';

package/lib/index.ts

@@ -1,2 +1,9 @@
+import { Loggers } from '@sphereon/ssi-types';
+
+export const VCI_LOGGERS = Loggers.DEFAULT;
+export const VCI_LOG_COMMON = VCI_LOGGERS.get('sphereon:oid4vci:common');
+
 export * from './functions';
 export * from './types';
+export * from './experimental/holder-vci';
+export * from './events';

package/lib/types/Authorization.types.ts

@@ -1,10 +1,11 @@
-import { CredentialOfferPayload, UniformCredentialOffer } from './CredentialIssuance.types';
+import { CredentialOfferPayload, ProofOfPossessionCallbacks, UniformCredentialOffer } from './CredentialIssuance.types';
 import {
   ErrorResponse,
   IssuerCredentialSubject,
   JsonLdIssuerCredentialDefinition,
   OID4VCICredentialFormat,
   PRE_AUTH_CODE_LITERAL,
+  TxCode,
 } from './Generic.types';
 import { EndpointMetadata } from './ServerMetadata';
 
@@ -104,21 +105,27 @@ export interface CommonAuthorizationDetails {
    * MUST be set to openid_credential for the purpose of this specification.
    */
   type: 'openid_credential' | string;
+
+  /**
+   *  REQUIRED when format parameter is not present. String specifying a unique identifier of the Credential being described in the credential_configurations_supported map in the Credential Issuer Metadata as defined in Section 11.2.3. The referenced object in the credential_configurations_supported map conveys the details, such as the format, for issuance of the requested Credential. This specification defines Credential Format specific Issuer Metadata in Appendix A. It MUST NOT be present if format parameter is present.
+   */
+  credential_configuration_id?: string; // FIXME maybe split up and make this & format required again
+
   /**
    * REQUIRED. JSON string representing the format in which the Credential is requested to be issued.
    * This Credential format identifier determines further claims in the authorization details object
    * specifically used to identify the Credential type to be issued. This specification defines
    * Credential Format Profiles in Appendix E.
    */
-  format: OID4VCICredentialFormat;
+  format?: OID4VCICredentialFormat;
   /**
    * If the Credential Issuer metadata contains an authorization_server parameter,
    * the authorization detail's locations common data field MUST be set to the Credential Issuer Identifier value.
    */
   locations?: string[];
 
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  [key: string]: any;
+  /* // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  // [key: string]: any;*/
 }
 
 export interface AuthorizationDetailsJwtVcJson extends CommonAuthorizationDetails {
@@ -191,6 +198,9 @@ export interface IssuerOpts {
 export interface AccessTokenFromAuthorizationResponseOpts extends AccessTokenRequestOpts {
   authorizationResponse: AuthorizationResponse;
 }
+
+export type TxCodeAndPinRequired = { isPinRequired?: boolean; txCode?: TxCode };
+
 export interface AccessTokenRequestOpts {
   credentialOffer?: UniformCredentialOffer;
   credentialIssuer?: string;
@@ -200,6 +210,7 @@ export interface AccessTokenRequestOpts {
   code?: string; // only required for authorization flow
   redirectUri?: string; // only required for authorization flow
   pin?: string; // Pin-number. Only used when required
+  pinMetadata?: TxCodeAndPinRequired; // OPTIONAL. String value containing a Transaction Code. This value MUST be present if a tx_code object was present in the Credential Offer (including if the object was empty). This parameter MUST only be used if the grant_type is urn:ietf:params:oauth:grant-type:pre-authorized_code.
 }
 
 /*export interface AuthorizationRequestOpts {
@@ -249,6 +260,21 @@ export interface PKCEOpts {
   codeVerifier?: string;
 }
 
+export enum CreateRequestObjectMode {
+  NONE,
+  REQUEST_OBJECT,
+  REQUEST_URI,
+}
+
+export type RequestObjectOpts = {
+  requestObjectMode?: CreateRequestObjectMode;
+  signCallbacks?: ProofOfPossessionCallbacks<never>;
+  clientMetadata?: Record<string, any>; // TODO: Merge SIOP/OID4VP
+  iss?: string;
+  jwksUri?: string;
+  kid?: string;
+};
+
 export interface AuthorizationRequestOpts {
   clientId?: string;
   pkce?: PKCEOpts;
@@ -256,6 +282,7 @@ export interface AuthorizationRequestOpts {
   authorizationDetails?: AuthorizationDetails | AuthorizationDetails[];
   redirectUri?: string;
   scope?: string;
+  requestObjectOpts?: RequestObjectOpts;
 }
 
 export interface AuthorizationResponse {