@sphereon/oid4vci-common 0.10.4-unstable.98 → 0.12.0

package/lib/functions/IssuerMetadataUtils.ts

@@ -1,3 +1,4 @@
+import { CredentialDefinitionV1_0_13, CredentialOfferFormat, JsonLdIssuerCredentialDefinition, VCI_LOG_COMMON } from '../index';
 import {
   AuthorizationServerMetadata,
   CredentialConfigurationSupported,
@@ -11,27 +12,58 @@ import {
   OpenId4VCIVersion,
 } from '../types';
 
-export function getSupportedCredentials(options?: {
+export function getSupportedCredentials(opts?: {
   issuerMetadata?: CredentialIssuerMetadata | IssuerMetadata;
   version: OpenId4VCIVersion;
   types?: string[][];
   format?: OID4VCICredentialFormat | string | (OID4VCICredentialFormat | string)[];
-}): Record<string, CredentialConfigurationSupportedV1_0_13> {
-  if (options?.types && Array.isArray(options.types)) {
-    return options.types
-      .map((typeSet) => {
-        return getSupportedCredential({ ...options, types: typeSet });
-      })
-      .reduce(
-        (acc, result) => {
-          Object.assign(acc, result);
-          return acc;
-        },
-        {} as Record<string, CredentialConfigurationSupportedV1_0_13>,
-      );
+}): Record<string, CredentialConfigurationSupportedV1_0_13> | Array<CredentialConfigurationSupported> {
+  const { version = OpenId4VCIVersion.VER_1_0_13, types } = opts ?? {};
+  if (types && Array.isArray(types)) {
+    if (version < OpenId4VCIVersion.VER_1_0_13) {
+      return types.flatMap((typeSet) => getSupportedCredential({ ...opts, version, types: typeSet }) as Array<CredentialConfigurationSupported>);
+    } else {
+      return types
+        .map((typeSet) => {
+          return getSupportedCredential({ ...opts, version, types: typeSet });
+        })
+        .reduce(
+          (acc, result) => {
+            Object.assign(acc, result);
+            return acc;
+          },
+          {} as Record<string, CredentialConfigurationSupportedV1_0_13>,
+        );
+    }
+  }
+
+  return getSupportedCredential(opts ? { ...opts, types: undefined } : undefined);
+}
+
+export function determineVersionsFromIssuerMetadata(issuerMetadata: CredentialIssuerMetadata | IssuerMetadata): Array<OpenId4VCIVersion> {
+  const versions = new Set<OpenId4VCIVersion>();
+  if ('authorization_server' in issuerMetadata) {
+    versions.add(OpenId4VCIVersion.VER_1_0_11);
+  } else if ('authorization_servers' in issuerMetadata) {
+    versions.add(OpenId4VCIVersion.VER_1_0_13);
+  }
+  if (versions.size === 0) {
+    // The above checks where already very specific and only applicable to single versions we support, so let's skip if we encounter them
+    if ('credential_configurations_supported' in issuerMetadata) {
+      versions.add(OpenId4VCIVersion.VER_1_0_13);
+    } else if ('credentials_supported' in issuerMetadata) {
+      if (typeof issuerMetadata.credentials_supported === 'object') {
+        versions.add(OpenId4VCIVersion.VER_1_0_08);
+      } else {
+        versions.add(OpenId4VCIVersion.VER_1_0_09).add(OpenId4VCIVersion.VER_1_0_11);
+      }
+    }
+  }
+  if (versions.size === 0) {
+    versions.add(OpenId4VCIVersion.VER_UNKNOWN);
   }
 
-  return getSupportedCredential(options ? { ...options, types: undefined } : undefined);
+  return Array.from(versions).sort().reverse(); // highest version first
 }
 
 export function getSupportedCredential(opts?: {
@@ -39,31 +71,82 @@ export function getSupportedCredential(opts?: {
   version: OpenId4VCIVersion;
   types?: string | string[];
   format?: OID4VCICredentialFormat | string | (OID4VCICredentialFormat | string)[];
-}): Record<string, CredentialConfigurationSupportedV1_0_13> {
-  const { issuerMetadata, types, format } = opts ?? {};
+}): Record<string, CredentialConfigurationSupportedV1_0_13> | Array<CredentialConfigurationSupported> {
+  const { issuerMetadata, types, format, version = OpenId4VCIVersion.VER_1_0_13 } = opts ?? {};
 
-  if (!issuerMetadata || !issuerMetadata.credential_configurations_supported) {
-    return {};
+  let credentialConfigurationsV11: Array<CredentialConfigurationSupported> | undefined = undefined;
+  let credentialConfigurationsV13: Record<string, CredentialConfigurationSupportedV1_0_13> | undefined = undefined;
+  if (version < OpenId4VCIVersion.VER_1_0_12 || issuerMetadata?.credentials_supported) {
+    if (issuerMetadata?.credentials_supported && !Array.isArray(issuerMetadata?.credentials_supported)) {
+      // The current code duplication and logic is such a mess, that we re-adjust the object to the proper type again
+      credentialConfigurationsV11 = [];
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+      Object.entries(issuerMetadata.credentials_supported!).forEach(([id, supported]) => {
+        if (!supported.id) {
+          supported.id = id;
+        }
+        credentialConfigurationsV11?.push(supported as CredentialConfigurationSupported);
+      });
+    } else {
+      credentialConfigurationsV11 = (issuerMetadata?.credentials_supported as Array<CredentialConfigurationSupported>) ?? [];
+    }
+  } else {
+    credentialConfigurationsV13 =
+      (issuerMetadata?.credential_configurations_supported as Record<string, CredentialConfigurationSupportedV1_0_13>) ?? {};
+  }
+  if (!issuerMetadata || (!issuerMetadata.credential_configurations_supported && !issuerMetadata.credentials_supported)) {
+    VCI_LOG_COMMON.warning(`No credential issuer metadata or supported credentials found for issuer}`);
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    return version < OpenId4VCIVersion.VER_1_0_13 ? credentialConfigurationsV11! : credentialConfigurationsV13!;
   }
 
-  const credentialConfigurations: Record<string, CredentialConfigurationSupportedV1_0_13> =
-    issuerMetadata.credential_configurations_supported as Record<string, CredentialConfigurationSupportedV1_0_13>;
   const normalizedTypes: string[] = Array.isArray(types) ? types : types ? [types] : [];
   const normalizedFormats: string[] = Array.isArray(format) ? format : format ? [format] : [];
 
-  return Object.entries(credentialConfigurations).reduce(
-    (filteredConfigs, [id, config]) => {
-      const isTypeMatch = normalizedTypes.length === 0 || normalizedTypes.some((type) => config.credential_definition.type?.includes(type));
-      const isFormatMatch = normalizedFormats.length === 0 || normalizedFormats.includes(config.format);
-
-      if (isTypeMatch && isFormatMatch) {
-        filteredConfigs[id] = config;
+  function filterMatchingConfig(config: CredentialConfigurationSupported): CredentialConfigurationSupported | undefined {
+    let isTypeMatch = normalizedTypes.length === 0;
+    const types = getTypesFromObject(config);
+    if (!isTypeMatch) {
+      if (normalizedTypes.length === 1 && config.id === normalizedTypes[0]) {
+        isTypeMatch = true;
+      } else if (types) {
+        isTypeMatch = normalizedTypes.every((type) => types.includes(type));
+      } else {
+        if ('credential_definition' in config) {
+          isTypeMatch = normalizedTypes.every((type) => config.credential_definition.type?.includes(type));
+        } else if ('type' in config && Array.isArray(config.type)) {
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore
+          isTypeMatch = normalizedTypes.every((type) => config.type.includes(type));
+        } else if ('types' in config) {
+          isTypeMatch = normalizedTypes.every((type) => config.types?.includes(type));
+        }
       }
+    }
+
+    const isFormatMatch = normalizedFormats.length === 0 || normalizedFormats.includes(config.format);
+
+    return isTypeMatch && isFormatMatch ? config : undefined;
+  }
 
-      return filteredConfigs;
-    },
-    {} as Record<string, CredentialConfigurationSupportedV1_0_13>,
-  );
+  if (credentialConfigurationsV13) {
+    return Object.entries(credentialConfigurationsV13).reduce(
+      (filteredConfigs, [id, config]) => {
+        if (filterMatchingConfig(config)) {
+          filteredConfigs[id] = config;
+          // Added to enable support < 13. We basically assign the
+          if (!config.id) {
+            config.id = id;
+          }
+        }
+        return filteredConfigs;
+      },
+      {} as Record<string, CredentialConfigurationSupportedV1_0_13>,
+    );
+  } else if (credentialConfigurationsV11) {
+    return credentialConfigurationsV11.filter((config) => filterMatchingConfig(config));
+  }
+  throw Error(`Either < v11 configurations or V13 configurations should have been filtered at this point`);
 }
 
 export function getTypesFromCredentialSupported(
@@ -77,12 +160,7 @@ export function getTypesFromCredentialSupported(
     credentialSupported.format === 'jwt_vc_json-ld' ||
     credentialSupported.format === 'ldp_vc'
   ) {
-    types =
-      (credentialSupported.types
-        ? (credentialSupported.types as string[])
-        : 'credential_definition' in credentialSupported
-          ? credentialSupported.credential_definition?.type
-          : []) ?? [];
+    types = getTypesFromObject(credentialSupported) ?? [];
   } else if (credentialSupported.format === 'vc+sd-jwt') {
     // eslint-disable-next-line @typescript-eslint/ban-ts-comment
     // @ts-ignore
@@ -152,3 +230,28 @@ export function getIssuerName(
   }
   return url;
 }
+
+/**
+ * The specs had many places where types could be expressed. This method ensures we get them in any way possible
+ * @param subject
+ */
+export function getTypesFromObject(
+  subject: CredentialConfigurationSupported | CredentialOfferFormat | CredentialDefinitionV1_0_13 | JsonLdIssuerCredentialDefinition | string,
+): string[] | undefined {
+  if (subject === undefined) {
+    return undefined;
+  } else if (typeof subject === 'string') {
+    return [subject];
+  } else if ('credential_definition' in subject && subject.credential_definition) {
+    return getTypesFromObject(subject.credential_definition);
+  } else if ('types' in subject && subject.types) {
+    return Array.isArray(subject.types) ? subject.types : [subject.types];
+  } else if ('type' in subject && subject.type) {
+    return Array.isArray(subject.type) ? subject.type : [subject.type];
+  } else if ('vct' in subject && subject.vct) {
+    return [subject.vct];
+  }
+
+  VCI_LOG_COMMON.warning('Could not deduce credential types. Probably a failure down the line will happen!');
+  return undefined;
+}

package/lib/functions/ProofUtil.ts

@@ -1,7 +1,7 @@
 import Debug from 'debug';
 import jwtDecode from 'jwt-decode';
 
-import { VCI_LOG_COMMON } from '..';
+import { PoPMode, VCI_LOG_COMMON } from '..';
 import {
   BAD_PARAMS,
   BaseJWK,
@@ -37,6 +37,7 @@ const debug = Debug('sphereon:openid4vci:common');
  *  - Optional, clientId of the party requesting the credential
  */
 export const createProofOfPossession = async <DIDDoc>(
+  popMode: PoPMode,
   callbacks: ProofOfPossessionCallbacks<DIDDoc>,
   jwtProps?: JwtProps,
   existingJwt?: Jwt,
@@ -46,7 +47,7 @@ export const createProofOfPossession = async <DIDDoc>(
     throw new Error(BAD_PARAMS);
   }
 
-  const signerArgs = createJWT(jwtProps, existingJwt);
+  const signerArgs = createJWT(popMode, jwtProps, existingJwt);
   const jwt = await callbacks.signCallback(signerArgs, signerArgs.header.kid);
   const proof = {
     proof_type: 'jwt',
@@ -114,6 +115,7 @@ export interface JwtProps {
   typ?: Typ;
   kid?: string;
   jwk?: JWK;
+  aud?: string | string[];
   issuer?: string;
   clientId?: string;
   alg?: string;
@@ -121,9 +123,16 @@ export interface JwtProps {
   nonce?: string;
 }
 
-const createJWT = (jwtProps?: JwtProps, existingJwt?: Jwt): Jwt => {
-  const aud = getJwtProperty<string | string[]>('aud', true, jwtProps?.issuer, existingJwt?.payload?.aud);
-  const iss = getJwtProperty<string>('iss', false, jwtProps?.clientId, existingJwt?.payload?.iss);
+const createJWT = (mode: PoPMode, jwtProps?: JwtProps, existingJwt?: Jwt): Jwt => {
+  const aud =
+    mode === 'pop'
+      ? getJwtProperty<string | string[]>('aud', true, jwtProps?.issuer, existingJwt?.payload?.aud)
+      : getJwtProperty<string | string[]>('aud', false, jwtProps?.aud, existingJwt?.payload?.aud);
+  const iss =
+    // mode === 'pop'
+       getJwtProperty<string>('iss', false, jwtProps?.clientId, existingJwt?.payload?.iss)
+      // : getJwtProperty<string>('iss', false, jwtProps?.issuer, existingJwt?.payload?.iss);
+  const client_id = mode === 'jwt' ? getJwtProperty<string>('client_id', false, jwtProps?.clientId, existingJwt?.payload?.client_id) : undefined;
   const jti = getJwtProperty<string>('jti', false, jwtProps?.jti, existingJwt?.payload?.jti);
   const typ = getJwtProperty<string>('typ', true, jwtProps?.typ, existingJwt?.header?.typ, 'jwt');
   const nonce = getJwtProperty<string>('nonce', false, jwtProps?.nonce, existingJwt?.payload?.nonce); // Officially this is required, but some implementations don't have it
@@ -134,19 +143,20 @@ const createJWT = (jwtProps?: JwtProps, existingJwt?: Jwt): Jwt => {
   const jwt: Partial<Jwt> = existingJwt ? existingJwt : {};
   const now = +new Date();
   const jwtPayload: Partial<JWTPayload> = {
-    aud,
+    ...(aud && { aud }),
     iat: jwt.payload?.iat ?? Math.round(now / 1000 - 60), // Let's ensure we subtract 60 seconds for potential time offsets
     exp: jwt.payload?.exp ?? Math.round(now / 1000 + 10 * 60),
     nonce,
-    ...(iss ? { iss } : {}),
-    ...(jti ? { jti } : {}),
+    ...(client_id && { client_id }),
+    ...(iss && { iss }),
+    ...(jti && { jti }),
   };
 
   const jwtHeader: JWTHeader = {
     typ,
     alg,
-    kid,
-    jwk,
+    ...(kid && { kid }),
+    ...(jwk && { jwk }),
   };
   return {
     payload: { ...jwt.payload, ...jwtPayload },
@@ -154,7 +164,13 @@ const createJWT = (jwtProps?: JwtProps, existingJwt?: Jwt): Jwt => {
   };
 };
 
-const getJwtProperty = <T>(propertyName: string, required: boolean, option?: string | JWK, jwtProperty?: T, defaultValue?: T): T | undefined => {
+const getJwtProperty = <T>(
+  propertyName: string,
+  required: boolean,
+  option?: string | string[] | JWK,
+  jwtProperty?: T,
+  defaultValue?: T,
+): T | undefined => {
   if (typeof option === 'string' && option && jwtProperty && option !== jwtProperty) {
     throw Error(`Cannot have a property '${propertyName}' with value '${option}' and different JWT value '${jwtProperty}' at the same time`);
   }

package/lib/index.ts

@@ -1,9 +1,7 @@
-import { Loggers, LogMethod } from '@sphereon/ssi-types';
+import { Loggers } from '@sphereon/ssi-types';
 
 export const VCI_LOGGERS = Loggers.DEFAULT;
-export const VCI_LOG_COMMON = VCI_LOGGERS.options('sphereon:oid4vci:common', { methods: [LogMethod.EVENT, LogMethod.DEBUG_PKG] }).get(
-  'sphereon:oid4vci:common',
-);
+export const VCI_LOG_COMMON = VCI_LOGGERS.get('sphereon:oid4vci:common');
 
 export * from './functions';
 export * from './types';

package/lib/types/Authorization.types.ts

@@ -1,4 +1,4 @@
-import { CredentialOfferPayload, UniformCredentialOffer } from './CredentialIssuance.types';
+import { CredentialOfferPayload, ProofOfPossessionCallbacks, UniformCredentialOffer } from './CredentialIssuance.types';
 import {
   ErrorResponse,
   IssuerCredentialSubject,
@@ -260,6 +260,21 @@ export interface PKCEOpts {
   codeVerifier?: string;
 }
 
+export enum CreateRequestObjectMode {
+  NONE,
+  REQUEST_OBJECT,
+  REQUEST_URI,
+}
+
+export type RequestObjectOpts = {
+  requestObjectMode?: CreateRequestObjectMode;
+  signCallbacks?: ProofOfPossessionCallbacks<never>;
+  clientMetadata?: Record<string, any>; // TODO: Merge SIOP/OID4VP
+  iss?: string;
+  jwksUri?: string;
+  kid?: string;
+};
+
 export interface AuthorizationRequestOpts {
   clientId?: string;
   pkce?: PKCEOpts;
@@ -267,6 +282,7 @@ export interface AuthorizationRequestOpts {
   authorizationDetails?: AuthorizationDetails | AuthorizationDetails[];
   redirectUri?: string;
   scope?: string;
+  requestObjectOpts?: RequestObjectOpts;
 }
 
 export interface AuthorizationResponse {

package/lib/types/CredentialIssuance.types.ts

@@ -27,6 +27,7 @@ export interface CredentialOfferRequestWithBaseUrl extends UniformCredentialOffe
   txCode?: TxCode;
   issuerState?: string;
   preAuthorizedCode?: string;
+  userPinRequired: boolean;
 }
 
 export type CredentialOffer = CredentialOfferV1_0_09 | CredentialOfferV1_0_11 | CredentialOfferV1_0_13;
@@ -198,6 +199,7 @@ export interface JWTPayload {
   nonce?: string; // REQUIRED (string). The value type of this claim MUST be a string, where the value is a c_nonce provided by the credential issuer. //TODO: Marked as required not present in NGI flow
   jti?: string; // A new nonce chosen by the wallet. Used to prevent replay
   exp?: number; // Not longer than 5 minutes
+  client_id?: string; // (string). The value of this claim MUST be the client_id of the client making the credential request.
   [s: string]: unknown;
 }
 

package/lib/types/Generic.types.ts

@@ -17,6 +17,8 @@ import {
 export type InputCharSet = 'numeric' | 'text';
 export type KeyProofType = 'jwt' | 'cwt' | 'ldp_vp';
 
+export type PoPMode = 'pop' | 'jwt'; // Proof of posession, or regular JWT
+
 /**
  * Important Note: please be aware that these Common interfaces are based on versions v1_0.11 and v1_0.09
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphereon/oid4vci-common",
-  "version": "0.10.4-unstable.98+b0ade3b",
+  "version": "0.12.0",
   "description": "OpenID 4 Verifiable Credential Issuance Common Types",
   "source": "lib/index.ts",
   "main": "dist/index.js",
@@ -10,7 +10,7 @@
     "build:clean": "tsc --build --clean && tsc --build"
   },
   "dependencies": {
-    "@sphereon/ssi-types": "0.24.1-unstable.129",
+    "@sphereon/ssi-types": "0.25.1-unstable.87",
     "cross-fetch": "^3.1.8",
     "jwt-decode": "^3.1.2",
     "sha.js": "^2.4.11",
@@ -49,5 +49,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "b0ade3b9482bc6be469b46e8ce886359e3ccdf82"
+  "gitHead": "a76c382a36e38428391c9e8d1a6b67e477fc659a"
 }