@sphereon/oid4vci-common 0.8.2-next.6 → 0.8.2-next.87

package/dist/types/v1_0_12.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v1_0_12.types.d.ts","sourceRoot":"","sources":["../../lib/types/v1_0_12.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,oCAAoC,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEtJ,MAAM,MAAM,wBAAwB,GAAG,uBAAuB,GAC5D,CAAC,0BAA0B,GAAG,oCAAoC,GAAG,wBAAwB,CAAC,CAAC"}

package/dist/types/v1_0_12.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=v1_0_12.types.js.map

package/dist/types/v1_0_12.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v1_0_12.types.js","sourceRoot":"","sources":["../../lib/types/v1_0_12.types.ts"],"names":[],"mappings":""}

package/lib/__tests__/CredentialOfferUtil.spec.ts

@@ -1,5 +1,5 @@
-import { determineSpecVersionFromURI } from '../functions';
-import { OpenId4VCIVersion } from '../types';
+import { determineSpecVersionFromURI, getClientIdFromCredentialOfferPayload } from '../functions';
+import { CredentialOfferPayload, OpenId4VCIVersion } from '../types';
 
 export const UNIT_TEST_TIMEOUT = 30000;
 
@@ -52,4 +52,53 @@ describe('CredentialOfferUtil should', () => {
     },
     UNIT_TEST_TIMEOUT,
   );
+
+  it('get client_id from JWT pre-auth code offer', () => {
+    const offer = {
+      credential_issuer: 'https://conformance-test.ebsi.eu/conformance/v3/issuer-mock',
+      credentials: [
+        {
+          format: 'jwt_vc',
+          types: ['VerifiableCredential', 'VerifiableAttestation', 'CTWalletCrossPreAuthorisedInTime'],
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore
+          trust_framework: { name: 'ebsi', type: 'Accreditation', uri: 'TIR link towards accreditation' },
+        },
+      ],
+      grants: {
+        'urn:ietf:params:oauth:grant-type:pre-authorized_code': {
+          'pre-authorized_code':
+            'eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6IkJFTmRqRGZhdGxLai11UW92WUpsT184U2pPY1ZIdmk2SHJYS0xLRUI3UG8ifQ.eyJjbGllbnRfaWQiOiJkaWQ6a2V5OnoyZG16RDgxY2dQeDhWa2k3SmJ1dU1tRllyV1BnWW95dHlrVVozZXlxaHQxajlLYnFTWlpGakc0dFZnS2hFd0twcm9qcUxCM0MyWXBqNEg3M1N0Z2pNa1NYZzJtUXh1V0xmenVSMTJRc052Z1FXenJ6S1NmN1lSQk5yUlhLNzF2ZnExMkJieXhUTEZFWkJXZm5IcWV6QlZHUWlOTGZxZXV5d1pIZ3N0TUNjUzQ0VFhmYjIiLCJhdXRob3JpemF0aW9uX2RldGFpbHMiOlt7InR5cGUiOiJvcGVuaWRfY3JlZGVudGlhbCIsImZvcm1hdCI6Imp3dF92YyIsImxvY2F0aW9ucyI6WyJodHRwczovL2NvbmZvcm1hbmNlLXRlc3QuZWJzaS5ldS9jb25mb3JtYW5jZS92My9pc3N1ZXItbW9jayJdLCJ0eXBlcyI6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCIsIlZlcmlmaWFibGVBdHRlc3RhdGlvbiIsIkNUV2FsbGV0Q3Jvc3NQcmVBdXRob3Jpc2VkSW5UaW1lIl19XSwiaWF0IjoxNzA2MTI2NDI5LCJleHAiOjE3MDYxMjY3MjksImlzcyI6Imh0dHBzOi8vY29uZm9ybWFuY2UtdGVzdC5lYnNpLmV1L2NvbmZvcm1hbmNlL3YzL2lzc3Vlci1tb2NrIiwiYXVkIjoiaHR0cHM6Ly9jb25mb3JtYW5jZS10ZXN0LmVic2kuZXUvY29uZm9ybWFuY2UvdjMvYXV0aC1tb2NrIiwic3ViIjoiZGlkOmtleTp6MmRtekQ4MWNnUHg4VmtpN0pidXVNbUZZcldQZ1lveXR5a1VaM2V5cWh0MWo5S2JxU1paRmpHNHRWZ0toRXdLcHJvanFMQjNDMllwajRINzNTdGdqTWtTWGcybVF4dVdMZnp1UjEyUXNOdmdRV3pyektTZjdZUkJOclJYSzcxdmZxMTJCYnl4VExGRVpCV2ZuSHFlekJWR1FpTkxmcWV1eXdaSGdzdE1DY1M0NFRYZmIyIn0.Zq2o33CU4wlRNtWOIITI5qbJcuNc2c9hLwIio7OlsHBa5ZAyQR8UUU_r5EufSChe4ji15Ihrr20m5-oUiZW80A',
+          user_pin_required: true,
+        },
+      },
+    } as CredentialOfferPayload;
+    expect(getClientIdFromCredentialOfferPayload(offer)).toEqual(
+      'did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqSZZFjG4tVgKhEwKprojqLB3C2Ypj4H73StgjMkSXg2mQxuWLfzuR12QsNvgQWzrzKSf7YRBNrRXK71vfq12BbyxTLFEZBWfnHqezBVGQiNLfqeuywZHgstMCcS44TXfb2',
+    );
+  });
+
+  it('get client_id from JWT authorization code offer', () => {
+    const offer = {
+      credential_issuer: 'https://conformance-test.ebsi.eu/conformance/v3/issuer-mock',
+      credentials: [
+        {
+          format: 'jwt_vc',
+          types: ['VerifiableCredential', 'VerifiableAttestation', 'CTWalletCrossAuthorisedInTime'],
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore
+          trust_framework: { name: 'ebsi', type: 'Accreditation', uri: 'TIR link towards accreditation' },
+        },
+      ],
+      grants: {
+        authorization_code: {
+          issuer_state:
+            'eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6IkJFTmRqRGZhdGxLai11UW92WUpsT184U2pPY1ZIdmk2SHJYS0xLRUI3UG8ifQ.eyJjbGllbnRfaWQiOiJkaWQ6a2V5OnoyZG16RDgxY2dQeDhWa2k3SmJ1dU1tRllyV1BnWW95dHlrVVozZXlxaHQxajlLYnFTWlpGakc0dFZnS2hFd0twcm9qcUxCM0MyWXBqNEg3M1N0Z2pNa1NYZzJtUXh1V0xmenVSMTJRc052Z1FXenJ6S1NmN1lSQk5yUlhLNzF2ZnExMkJieXhUTEZFWkJXZm5IcWV6QlZHUWlOTGZxZXV5d1pIZ3N0TUNjUzQ0VFhmYjIiLCJjcmVkZW50aWFsX3R5cGVzIjpbIlZlcmlmaWFibGVDcmVkZW50aWFsIiwiVmVyaWZpYWJsZUF0dGVzdGF0aW9uIiwiQ1RXYWxsZXRDcm9zc0F1dGhvcmlzZWRJblRpbWUiXSwiaWF0IjoxNzA2MTI1ODUwLCJleHAiOjE3MDYxMjYxNTAsImlzcyI6Imh0dHBzOi8vY29uZm9ybWFuY2UtdGVzdC5lYnNpLmV1L2NvbmZvcm1hbmNlL3YzL2lzc3Vlci1tb2NrIiwiYXVkIjoiaHR0cHM6Ly9jb25mb3JtYW5jZS10ZXN0LmVic2kuZXUvY29uZm9ybWFuY2UvdjMvYXV0aC1tb2NrIiwic3ViIjoiZGlkOmtleTp6MmRtekQ4MWNnUHg4VmtpN0pidXVNbUZZcldQZ1lveXR5a1VaM2V5cWh0MWo5S2JxU1paRmpHNHRWZ0toRXdLcHJvanFMQjNDMllwajRINzNTdGdqTWtTWGcybVF4dVdMZnp1UjEyUXNOdmdRV3pyektTZjdZUkJOclJYSzcxdmZxMTJCYnl4VExGRVpCV2ZuSHFlekJWR1FpTkxmcWV1eXdaSGdzdE1DY1M0NFRYZmIyIn0.jxzbE6OdqnJfLzSfwYcgRZQURI5UcAtuYU9gPOZYyUwjWMDtVo1k4PCYH4mnjok7pfj47ik8FnaHWE7d99u-_w',
+        },
+      },
+    } as CredentialOfferPayload;
+    expect(getClientIdFromCredentialOfferPayload(offer)).toEqual(
+      'did:key:z2dmzD81cgPx8Vki7JbuuMmFYrWPgYoytykUZ3eyqht1j9KbqSZZFjG4tVgKhEwKprojqLB3C2Ypj4H73StgjMkSXg2mQxuWLfzuR12QsNvgQWzrzKSf7YRBNrRXK71vfq12BbyxTLFEZBWfnHqezBVGQiNLfqeuywZHgstMCcS44TXfb2',
+    );
+  });
 });

package/lib/__tests__/Encoding.spec.ts

@@ -0,0 +1,15 @@
+import { convertURIToJsonObject } from '../functions';
+
+import { UNIT_TEST_TIMEOUT } from './CredentialOfferUtil.spec';
+
+describe('URI to json enconding', () => {
+  const CREDENTIAL_OFFER_CODE = 'openid-credential-offer://code=1234-1234-1234';
+
+  it(
+    'should get code from auth-code redirect URI',
+    async () => {
+      expect(convertURIToJsonObject(CREDENTIAL_OFFER_CODE)).toEqual({ code: '1234-1234-1234' });
+    },
+    UNIT_TEST_TIMEOUT,
+  );
+});

package/lib/__tests__/randomBytes.spec.ts

@@ -0,0 +1,15 @@
+import { randomBytes } from '../functions';
+
+import { UNIT_TEST_TIMEOUT } from './CredentialOfferUtil.spec';
+
+describe('randomBytes should', () => {
+  it(
+    'generate random bytes of length 32',
+    () => {
+      const bytes = randomBytes(32);
+      expect(bytes).toBeDefined();
+      expect(bytes.length).toEqual(32);
+    },
+    UNIT_TEST_TIMEOUT,
+  );
+});

package/lib/functions/AuthorizationResponseUtil.ts

@@ -0,0 +1,18 @@
+import { AuthorizationResponse } from '../types';
+
+import { convertURIToJsonObject } from './Encoding';
+
+export const toAuthorizationResponsePayload = (input: AuthorizationResponse | string): AuthorizationResponse => {
+  let response = input;
+  if (typeof input === 'string') {
+    if (input.trim().startsWith('{') && input.trim().endsWith('}')) {
+      response = JSON.parse(input);
+    } else if (input.includes('?') && input.includes('code')) {
+      response = convertURIToJsonObject(input) as AuthorizationResponse;
+    }
+  }
+  if (response && typeof response !== 'string') {
+    return response;
+  }
+  throw Error(`Could not create authorization response from the input ${input}`);
+};

package/lib/functions/CredentialOfferUtil.ts

@@ -1,4 +1,5 @@
 import Debug from 'debug';
+import jwtDecode, { JwtPayload } from 'jwt-decode';
 
 import {
   AssertedUniformCredentialOffer,
@@ -68,8 +69,53 @@ export function getIssuerFromCredentialOfferPayload(request: CredentialOfferPayl
   return 'issuer' in request ? request.issuer : request['credential_issuer'];
 }
 
+export const getClientIdFromCredentialOfferPayload = (credentialOffer?: CredentialOfferPayload): string | undefined => {
+  if (!credentialOffer) {
+    return;
+  }
+  if ('client_id' in credentialOffer) {
+    return credentialOffer.client_id;
+  }
+
+  const state: string | undefined = getStateFromCredentialOfferPayload(credentialOffer);
+  if (state && isJWT(state)) {
+    const decoded = jwtDecode<JwtPayload>(state, { header: false });
+    if ('client_id' in decoded && typeof decoded.client_id === 'string') {
+      return decoded.client_id;
+    }
+  }
+  return;
+};
+
+const isJWT = (input?: string) => {
+  if (!input) {
+    return false;
+  }
+  const noParts = input?.split('.').length;
+  return input?.startsWith('ey') && noParts === 3;
+};
+export const getStateFromCredentialOfferPayload = (credentialOffer: CredentialOfferPayload): string | undefined => {
+  if ('grants' in credentialOffer) {
+    if (credentialOffer.grants?.authorization_code) {
+      return credentialOffer.grants.authorization_code.issuer_state;
+    } else if (credentialOffer.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']) {
+      return credentialOffer.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.['pre-authorized_code'];
+    }
+  }
+  if ('op_state' in credentialOffer) {
+    // older spec versions
+    return credentialOffer.op_state;
+  } else if ('pre-authorized_code' in credentialOffer) {
+    return credentialOffer['pre-authorized_code'];
+  }
+
+  return;
+};
+
 export function determineSpecVersionFromOffer(offer: CredentialOfferPayload | CredentialOffer): OpenId4VCIVersion {
-  if (isCredentialOfferV1_0_11(offer)) {
+  if (isCredentialOfferV1_0_12(offer)) {
+    return OpenId4VCIVersion.VER_1_0_12;
+  } else if (isCredentialOfferV1_0_11(offer)) {
     return OpenId4VCIVersion.VER_1_0_11;
   } else if (isCredentialOfferV1_0_09(offer)) {
     return OpenId4VCIVersion.VER_1_0_09;
@@ -139,6 +185,21 @@ function isCredentialOfferV1_0_11(offer: CredentialOfferPayload | CredentialOffe
   return 'credential_offer_uri' in offer;
 }
 
+function isCredentialOfferV1_0_12(offer: CredentialOfferPayload | CredentialOffer): boolean {
+  if (!offer) {
+    return false;
+  }
+  if ('credential_issuer' in offer && 'credentials' in offer) {
+    // payload
+    return true;
+  }
+  if ('credential_offer' in offer && offer['credential_offer']) {
+    // offer, so check payload
+    return isCredentialOfferV1_0_12(offer['credential_offer']);
+  }
+  return 'credential_offer_uri' in offer;
+}
+
 export async function toUniformCredentialOfferRequest(
   offer: CredentialOffer,
   opts?: {
@@ -340,3 +401,30 @@ function recordVersion(currentVersion: OpenId4VCIVersion, matchingVersion: OpenI
     `Invalid param. Some keys have been used from version: ${currentVersion} version while '${key}' is used from version: ${matchingVersion}`,
   );
 }
+
+export function getTypesFromOffer(credentialOffer: UniformCredentialOfferPayload, opts?: { filterVerifiableCredential: boolean }) {
+  const types = credentialOffer.credentials.reduce<string[]>((prev, curr) => {
+    // FIXME returning the string value is wrong (as it's an id), but just matching the current behavior of this library
+    // The credential_type (from draft 8) and the actual 'type' value in a VC (from draft 11) are mixed up
+    // Fix for this here: https://github.com/Sphereon-Opensource/OID4VCI/pull/54
+    if (typeof curr === 'string') {
+      return [...prev, curr];
+    } else if (curr.format === 'jwt_vc_json-ld' || curr.format === 'ldp_vc') {
+      return [...prev, ...curr.credential_definition.types];
+    } else if (curr.format === 'jwt_vc_json' || curr.format === 'jwt_vc') {
+      return [...prev, ...curr.types];
+    } else if (curr.format === 'vc+sd-jwt') {
+      return [...prev, curr.vct];
+    }
+
+    return prev;
+  }, []);
+
+  if (!types || types.length === 0) {
+    throw Error('Could not deduce types from credential offer');
+  }
+  if (opts?.filterVerifiableCredential) {
+    return types.filter((type) => type !== 'VerifiableCredential');
+  }
+  return types;
+}

package/lib/functions/CredentialRequestUtil.ts

@@ -1,7 +1,24 @@
-import { CredentialRequestV1_0_11 } from '../types';
+import { CredentialRequestV1_0_08, CredentialRequestV1_0_11, OpenId4VCIVersion, UniformCredentialRequest } from '../types';
+
+import { getFormatForVersion } from './FormatUtils';
+
+export function getTypesFromRequest(credentialRequest: UniformCredentialRequest, opts?: { filterVerifiableCredential: boolean }) {
+  let types: string[] = [];
+  if (credentialRequest.format === 'jwt_vc_json' || credentialRequest.format === 'jwt_vc') {
+    types = credentialRequest.types;
+  } else if (credentialRequest.format === 'jwt_vc_json-ld' || credentialRequest.format === 'ldp_vc') {
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
+    types =
+      'credential_definition' in credentialRequest && credentialRequest.credential_definition
+        ? // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore
+          credentialRequest.credential_definition.types
+        : credentialRequest.types;
+  } else if (credentialRequest.format === 'vc+sd-jwt') {
+    types = [credentialRequest.vct];
+  }
 
-export function getTypesFromRequest(credentialRequest: CredentialRequestV1_0_11, opts?: { filterVerifiableCredential: boolean }) {
-  const types = 'types' in credentialRequest ? credentialRequest.types : credentialRequest.credential_definition.types;
   if (!types || types.length === 0) {
     throw Error('Could not deduce types from credential request');
   }
@@ -10,3 +27,29 @@ export function getTypesFromRequest(credentialRequest: CredentialRequestV1_0_11,
   }
   return types;
 }
+
+export function getCredentialRequestForVersion(
+  credentialRequest: UniformCredentialRequest,
+  version: OpenId4VCIVersion,
+): UniformCredentialRequest | CredentialRequestV1_0_08 | CredentialRequestV1_0_11 {
+  if (version === OpenId4VCIVersion.VER_1_0_08) {
+    const draft8Format = getFormatForVersion(credentialRequest.format, version);
+    const types = getTypesFromRequest(credentialRequest, { filterVerifiableCredential: true });
+
+    return {
+      format: draft8Format,
+      proof: credentialRequest.proof,
+      type: types[0],
+    } satisfies CredentialRequestV1_0_08;
+    /* } else if (version === OpenId4VCIVersion.VER_1_0_11) {
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
+    const { credential_definition = undefined, ...requestv11 } = credentialRequest;
+    return {
+      ...requestv11,
+      ...credential_definition,
+    } as CredentialRequestV1_0_11;*/
+  }
+
+  return credentialRequest;
+}

package/lib/functions/CredentialResponseUtil.ts

@@ -0,0 +1,90 @@
+import { CredentialResponse, OpenIDResponse } from '../types';
+
+import { post } from './HttpUtils';
+
+export function isDeferredCredentialResponse(credentialResponse: OpenIDResponse<CredentialResponse>) {
+  const orig = credentialResponse.successBody;
+  // Specs mention 202, but some implementations like EBSI return 200
+  return credentialResponse.origResponse.status % 200 <= 2 && !!orig && !orig.credential && (!!orig.acceptance_token || !!orig.transaction_id);
+}
+function assertNonFatalError(credentialResponse: OpenIDResponse<CredentialResponse>) {
+  if (credentialResponse.origResponse.status === 400 && credentialResponse.errorBody?.error) {
+    if (credentialResponse.errorBody.error === 'invalid_transaction_id' || credentialResponse.errorBody.error.includes('acceptance_token')) {
+      throw Error('Invalid transaction id. Probably the deferred credential request expired');
+    }
+  }
+}
+
+export function isDeferredCredentialIssuancePending(credentialResponse: OpenIDResponse<CredentialResponse>) {
+  if (isDeferredCredentialResponse(credentialResponse)) {
+    return !!credentialResponse?.successBody?.transaction_id ?? !!credentialResponse?.successBody?.acceptance_token;
+  }
+  if (credentialResponse.origResponse.status === 400 && credentialResponse.errorBody?.error) {
+    if (credentialResponse.errorBody.error === 'issuance_pending') {
+      return true;
+    } else if (credentialResponse.errorBody.error_description?.toLowerCase().includes('not available yet')) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function sleep(ms: number) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+
+export async function acquireDeferredCredential({
+  bearerToken,
+  transactionId,
+  deferredCredentialEndpoint,
+  deferredCredentialIntervalInMS,
+  deferredCredentialAwait,
+}: {
+  bearerToken: string;
+  transactionId?: string;
+  deferredCredentialIntervalInMS?: number;
+  deferredCredentialAwait?: boolean;
+  deferredCredentialEndpoint: string;
+}): Promise<OpenIDResponse<CredentialResponse>> {
+  let credentialResponse: OpenIDResponse<CredentialResponse> = await acquireDeferredCredentialImpl({
+    bearerToken,
+    transactionId,
+    deferredCredentialEndpoint,
+  });
+
+  const DEFAULT_SLEEP_IN_MS = 5000;
+  while (!credentialResponse.successBody?.credential && deferredCredentialAwait) {
+    assertNonFatalError(credentialResponse);
+    const pending = isDeferredCredentialIssuancePending(credentialResponse);
+    console.log(`Issuance still pending?: ${pending}`);
+    if (!pending) {
+      throw Error(`Issuance isn't pending anymore: ${credentialResponse}`);
+    }
+
+    await sleep(deferredCredentialIntervalInMS ?? DEFAULT_SLEEP_IN_MS);
+    credentialResponse = await acquireDeferredCredentialImpl({ bearerToken, transactionId, deferredCredentialEndpoint });
+  }
+  return credentialResponse;
+}
+
+async function acquireDeferredCredentialImpl({
+  bearerToken,
+  transactionId,
+  deferredCredentialEndpoint,
+}: {
+  bearerToken: string;
+  transactionId?: string;
+  deferredCredentialEndpoint: string;
+}): Promise<OpenIDResponse<CredentialResponse>> {
+  const response: OpenIDResponse<CredentialResponse> = await post(
+    deferredCredentialEndpoint,
+    JSON.stringify(transactionId ? { transaction_id: transactionId } : ''),
+    { bearerToken },
+  );
+  console.log(JSON.stringify(response, null, 2));
+  assertNonFatalError(response);
+
+  return response;
+}

package/lib/functions/Encoding.ts

@@ -88,7 +88,7 @@ export function convertJsonToURI(
  *          - arrayTypeProperties: properties that can show up more that once
  */
 export function convertURIToJsonObject(uri: string, opts?: DecodeURIAsJsonOpts): unknown {
-  if (!uri || !opts?.requiredProperties?.every((p) => uri.includes(p))) {
+  if (!uri || (opts?.requiredProperties && !opts.requiredProperties?.every((p) => uri.includes(p)))) {
     throw new Error(BAD_PARAMS);
   }
   const uriComponents = getURIComponentsAsArray(uri, opts?.arrayTypeProperties);

package/lib/functions/FormatUtils.ts

@@ -0,0 +1,52 @@
+import { CredentialFormat } from '@sphereon/ssi-types';
+
+import { OID4VCICredentialFormat, OpenId4VCIVersion } from '../types';
+
+export function isFormat<T extends { format?: OID4VCICredentialFormat }, Format extends OID4VCICredentialFormat>(
+  formatObject: T,
+  format: Format,
+): formatObject is T & { format: Format } {
+  return formatObject.format === format;
+}
+
+export function isNotFormat<T extends { format?: OID4VCICredentialFormat }, Format extends OID4VCICredentialFormat>(
+  formatObject: T,
+  format: Format,
+): formatObject is T & { format: Exclude<OID4VCICredentialFormat, Format> } {
+  return formatObject.format !== format;
+}
+
+const isUniformFormat = (format: string): format is OID4VCICredentialFormat => {
+  return ['jwt_vc_json', 'jwt_vc_json-ld', 'ldp_vc', 'vc+sd-jwt'].includes(format);
+};
+
+export function getUniformFormat(format: string | OID4VCICredentialFormat | CredentialFormat): OID4VCICredentialFormat {
+  // Already valid format
+  if (isUniformFormat(format)) {
+    return format;
+  }
+
+  // Older formats
+  if (format === 'jwt_vc' || format === 'jwt') {
+    return 'jwt_vc';
+  }
+  if (format === 'ldp_vc' || format === 'ldp') {
+    return 'ldp_vc';
+  }
+
+  throw new Error(`Invalid format: ${format}`);
+}
+
+export function getFormatForVersion(format: string, version: OpenId4VCIVersion) {
+  const uniformFormat = isUniformFormat(format) ? format : getUniformFormat(format);
+
+  if (version === OpenId4VCIVersion.VER_1_0_08) {
+    if (uniformFormat === 'jwt_vc_json') {
+      return 'jwt_vc' as const;
+    } else if (uniformFormat === 'ldp_vc' || uniformFormat === 'jwt_vc_json-ld') {
+      return 'ldp_vc' as const;
+    }
+  }
+
+  return uniformFormat;
+}

package/lib/functions/HttpUtils.ts

@@ -8,7 +8,7 @@ const debug = Debug('sphereon:openid4vci:http');
 export const getJson = async <T>(
   URL: string,
   opts?: {
-    bearerToken?: string;
+    bearerToken?: (() => Promise<string>) | string;
     contentType?: string;
     accept?: string;
     customHeaders?: Record<string, string>;
@@ -22,7 +22,7 @@ export const formPost = async <T>(
   url: string,
   body: BodyInit,
   opts?: {
-    bearerToken?: string;
+    bearerToken?: (() => Promise<string>) | string;
     contentType?: string;
     accept?: string;
     customHeaders?: Record<string, string>;
@@ -36,7 +36,7 @@ export const post = async <T>(
   url: string,
   body?: BodyInit,
   opts?: {
-    bearerToken?: string;
+    bearerToken?: (() => Promise<string>) | string;
     contentType?: string;
     accept?: string;
     customHeaders?: Record<string, string>;
@@ -51,7 +51,7 @@ const openIdFetch = async <T>(
   body?: BodyInit,
   opts?: {
     method?: string;
-    bearerToken?: string;
+    bearerToken?: (() => Promise<string>) | string;
     contentType?: string;
     accept?: string;
     customHeaders?: Record<string, string>;
@@ -60,7 +60,7 @@ const openIdFetch = async <T>(
 ): Promise<OpenIDResponse<T>> => {
   const headers: Record<string, string> = opts?.customHeaders ?? {};
   if (opts?.bearerToken) {
-    headers['Authorization'] = `Bearer ${opts.bearerToken}`;
+    headers['Authorization'] = `Bearer ${typeof opts.bearerToken === 'function' ? await opts.bearerToken() : opts.bearerToken}`;
   }
   const method = opts?.method ? opts.method : body ? 'POST' : 'GET';
   const accept = opts?.accept ? opts.accept : 'application/json';
@@ -87,7 +87,7 @@ const openIdFetch = async <T>(
 
   debug(`START fetching url: ${url}`);
   if (body) {
-    debug(`Body:\r\n${JSON.stringify(body)}`);
+    debug(`Body:\r\n${typeof body == 'string' ? body : JSON.stringify(body)}`);
   }
   debug(`Headers:\r\n${JSON.stringify(payload.headers)}`);
   const origResponse = await fetch(url, payload);

package/lib/functions/IssuerMetadataUtils.ts

@@ -1,4 +1,5 @@
 import {
+  AuthorizationServerMetadata,
   CredentialIssuerMetadata,
   CredentialOfferFormat,
   CredentialSupported,
@@ -43,7 +44,7 @@ export function getSupportedCredential(opts?: {
   }
   const { version, types } = opts ?? { version: OpenId4VCIVersion.VER_1_0_11 };
   if (version === OpenId4VCIVersion.VER_1_0_08 || !Array.isArray(issuerMetadata.credentials_supported)) {
-    credentialsSupported = credentialsSupportedV8ToV11((issuerMetadata as IssuerMetadataV1_0_08).credentials_supported);
+    credentialsSupported = credentialsSupportedV8ToV11((issuerMetadata as IssuerMetadataV1_0_08).credentials_supported ?? {});
   } else {
     credentialsSupported = (issuerMetadata as CredentialIssuerMetadata).credentials_supported;
   }
@@ -73,7 +74,7 @@ export function getSupportedCredential(opts?: {
   if ((opts?.types && typeof opts?.types === 'string') || opts?.types?.length === 1) {
     const types = Array.isArray(opts.types) ? opts.types[0] : opts.types;
     const supported = credentialsSupported.filter(
-      (sup) => sup.id === types || (initiationTypes && arrayEqualsIgnoreOrder(sup.types, initiationTypes)),
+      (sup) => sup.id === types || (initiationTypes && arrayEqualsIgnoreOrder(getTypesFromCredentialSupported(sup), initiationTypes)),
     );
     if (supported) {
       credentialSupportedOverlap.push(...supported);
@@ -86,7 +87,7 @@ export function getSupportedCredential(opts?: {
       initiationTypes.push('VerifiableCredential');
     }
     const supported = credentialsSupported.filter((sup) => {
-      const supTypes = sup.types;
+      const supTypes = getTypesFromCredentialSupported(sup);
       if (!supTypes.includes('VerifiableCredential')) {
         supTypes.push('VerifiableCredential');
       }
@@ -99,6 +100,28 @@ export function getSupportedCredential(opts?: {
   return credentialSupportedOverlap;
 }
 
+export function getTypesFromCredentialSupported(credentialSupported: CredentialSupported, opts?: { filterVerifiableCredential: boolean }) {
+  let types: string[] = [];
+  if (
+    credentialSupported.format === 'jwt_vc_json' ||
+    credentialSupported.format === 'jwt_vc' ||
+    credentialSupported.format === 'jwt_vc_json-ld' ||
+    credentialSupported.format === 'ldp_vc'
+  ) {
+    types = credentialSupported.types;
+  } else if (credentialSupported.format === 'vc+sd-jwt') {
+    types = [credentialSupported.vct];
+  }
+
+  if (!types || types.length === 0) {
+    throw Error('Could not deduce types from credential supported');
+  }
+  if (opts?.filterVerifiableCredential) {
+    return types.filter((type) => type !== 'VerifiableCredential');
+  }
+  return types;
+}
+
 function arrayEqualsIgnoreOrder(a: string[], b: string[]) {
   if (a.length !== b.length) return false;
   const uniqueValues = new Set([...a, ...b]);
@@ -127,7 +150,7 @@ export function credentialSupportedV8ToV11(key: string, supportedV8: CredentialS
     }
     let credentialSupport: Partial<CredentialSupported> = {};
     credentialSupport = {
-      format,
+      format: format as OID4VCICredentialFormat,
       display: supportedV8.display,
       ...credentialSupportBrief,
       credentialSubject: supportedV8.claims,
@@ -143,3 +166,21 @@ export function getIssuerDisplays(metadata: CredentialIssuerMetadata | IssuerMet
     ) ?? [];
   return matchedDisplays.sort((item) => (item.locale ? opts?.prefLocales.indexOf(item.locale) ?? 1 : Number.MAX_VALUE));
 }
+
+/**
+ * TODO check again when WAL-617 is done to replace how we get the issuer name.
+ */
+export function getIssuerName(
+  url: string,
+  credentialIssuerMetadata?: Partial<AuthorizationServerMetadata> & (CredentialIssuerMetadata | IssuerMetadataV1_0_08),
+): string {
+  if (credentialIssuerMetadata) {
+    const displays: Array<MetadataDisplay> = credentialIssuerMetadata ? getIssuerDisplays(credentialIssuerMetadata) : [];
+    for (const display of displays) {
+      if (display.name) {
+        return display.name;
+      }
+    }
+  }
+  return url;
+}

package/lib/functions/RandomUtils.ts

@@ -0,0 +1,43 @@
+import SHA from 'sha.js';
+import * as u8a from 'uint8arrays';
+import { SupportedEncodings } from 'uint8arrays/to-string';
+
+import { CodeChallengeMethod } from '../types';
+
+import { randomBytes } from './randomBytes';
+
+export const CODE_VERIFIER_DEFAULT_LENGTH = 128;
+export const NONCE_LENGTH = 32;
+
+export const generateRandomString = (length: number, encoding?: SupportedEncodings): string => {
+  return u8a.toString(randomBytes(length), encoding).slice(0, length);
+};
+
+export const generateNonce = (length?: number): string => {
+  return generateRandomString(length ?? NONCE_LENGTH);
+};
+export const generateCodeVerifier = (length?: number): string => {
+  const codeVerifier = generateRandomString(length ?? CODE_VERIFIER_DEFAULT_LENGTH, 'base64url');
+  assertValidCodeVerifier(codeVerifier);
+  return codeVerifier;
+};
+
+export const createCodeChallenge = (codeVerifier: string, codeChallengeMethod?: CodeChallengeMethod): string => {
+  if (codeChallengeMethod === CodeChallengeMethod.plain) {
+    return codeVerifier;
+  } else if (!codeChallengeMethod || codeChallengeMethod === CodeChallengeMethod.S256) {
+    return u8a.toString(SHA('sha256').update(codeVerifier).digest(), 'base64url');
+  } else {
+    // Just a precaution if a new method would be introduced
+    throw Error(`code challenge method ${codeChallengeMethod} not implemented`);
+  }
+};
+
+export const assertValidCodeVerifier = (codeVerifier: string) => {
+  const length = codeVerifier.length;
+  if (length < 43) {
+    throw Error(`code_verifier should have a minimum length of 43; see rfc7636`);
+  } else if (length > 128) {
+    throw Error(`code_verifier should have a maximum length of 128; see rfc7636`);
+  }
+};

package/lib/functions/index.ts

@@ -1,4 +1,12 @@
+import { randomBytes } from './randomBytes.js';
 export * from './CredentialRequestUtil';
+export * from './CredentialResponseUtil';
 export * from './CredentialOfferUtil';
 export * from './Encoding';
 export * from './TypeConversionUtils';
+export * from './IssuerMetadataUtils';
+export * from './FormatUtils';
+export * from './HttpUtils';
+export * from './AuthorizationResponseUtil';
+export { randomBytes };
+export * from './RandomUtils';