@sphereon/ssi-sdk.ebsi-support 0.26.1-unstable.101

package/dist/types/IEbsiSupport.d.ts

@@ -0,0 +1,211 @@
+import { DiscoveryMetadataPayload, JWK } from '@sphereon/did-auth-siop';
+import { OID4VCICredentialFormat, RequestObjectOpts } from '@sphereon/oid4vci-common';
+import { Format, PresentationDefinitionV2 } from '@sphereon/pex-models';
+import { IIdentifierOpts } from '@sphereon/ssi-sdk-ext.did-utils';
+import { IBasicCredentialLocaleBranding, Party } from '@sphereon/ssi-sdk.data-store';
+import { ErrorDetails, IOID4VCIHolder, MappedCredentialToAccept } from '@sphereon/ssi-sdk.oid4vci-holder';
+import { IPresentationExchange } from '@sphereon/ssi-sdk.presentation-exchange';
+import { IDidAuthSiopOpAuthenticator } from '@sphereon/ssi-sdk.siopv2-oid4vp-op-auth';
+import { PresentationSubmission, W3CVerifiableCredential } from '@sphereon/ssi-types';
+import { IAgentContext, IDIDManager, IIdentifier, IKeyManager, IPluginMethodMap, IResolver } from '@veramo/core';
+import { AttestationAuthRequestUrlResult } from '../functions';
+/**
+ * The OpenID scope
+ * @readonly
+ * @enum {string}
+ */
+export type EBSIScope = 'didr_write' | 'didr_invite' | 'tir_write' | 'tir_invite' | 'timestamp_write' | 'tnt_authorise' | 'tnt_create' | 'tnt_write' | 'did_authn';
+export declare enum TokenType {
+    BEARER = "Bearer"
+}
+export type EbsiEnvironment = 'pilot' | 'conformance' | 'conformance-test';
+export type EbsiApiVersion = 'v3' | 'v4' | 'v5';
+export type WellknownType = 'openid-credential-issuer' | 'openid-configuration';
+export type EbsiMock = 'issuer-mock' | 'auth-mock';
+export type EbsiSystem = 'authorisation' | 'conformance' | 'did-registry';
+export type ApiOpts = {
+    environment?: EbsiEnvironment;
+    version: EbsiApiVersion;
+};
+export type WellknownOpts = ApiOpts & {
+    type: WellknownType;
+    system?: EbsiSystem | EbsiEnvironment;
+    mock?: EbsiMock;
+};
+export interface IEbsiSupport extends IPluginMethodMap {
+    ebsiWellknownMetadata(args?: ApiOpts): Promise<GetOIDProviderMetadataResponse>;
+    ebsiAuthorizationServerJwks(args?: ApiOpts): Promise<GetOIDProviderJwksResponse>;
+    ebsiPresentationDefinitionGet(args: GetPresentationDefinitionArgs): Promise<GetPresentationDefinitionResponse>;
+    ebsiAccessTokenGet(args: EBSIAuthAccessTokenGetArgs, context: IRequiredContext): Promise<GetAccessTokenResult>;
+    ebsiCreateAttestationAuthRequestURL(args: CreateAttestationAuthRequestURLArgs, context: IRequiredContext): Promise<AttestationAuthRequestUrlResult>;
+    ebsiGetAttestation(args: GetAttestationArgs, context: IRequiredContext): Promise<AttestationResult>;
+}
+/**
+ * @typedef EbsiOpenIDMetadata
+ * @type {object}
+ * @property {(URL | string)} issuer URL using the https scheme with no query or fragment component that the OP asserts as its Issuer Identifier. MUST be identical to the iss Claim value in ID Tokens issued from this Issuer.
+ * @property {(URL | string)} authorization_endpoint URL of the OP's OAuth 2.0 Authorization Endpoint.
+ * @property {(URL | string)} token_endpoint URL of the OP's OAuth 2.0 Token Endpoint.
+ * @property {(URL | string)} [presentation_definition_endpoint] URL of the OP's presentation definitions endpoint. Non-standard, used in EBSI
+ * @property {(URL | string)} jwks_uri URL of the authorization server's JWK Set [JWK] document
+ * @property {string[]} scopes_supported JSON array containing a list of the OAuth 2.0 [RFC6749] scope values that this server supports. (SIOP v2)
+ * @property {string[]} response_types_supported JSON array containing a list of the OAuth 2.0 "response_type" values that this authorization server supports (SIOP v2)
+ * @property {string[]} [response_mode_supported] JSON array containing a list of the OAuth 2.0 response_mode values that this OP supports
+ * @property {string[]} [grant_types_supported] JSON array containing a list of the OAuth 2.0 grant type values that this authorization server supports.
+ * @property {string[]} subject_types_supported JSON array containing a list of the Subject Identifier types that this OP supports.
+ * @property {string[]} id_token_signing_alg_values_supported JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT
+ * @property {string[]} [request_object_signing_alg_values_supported] JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects
+ * @property {string[]} [request_parameter_supported] Boolean value specifying whether the OP supports use of the request parameter, with true indicating support
+ * @property {string[]} [token_endpoint_auth_methods_supported] JSON array containing a list of client authentication methods supported by this token endpoint
+ * @property {{ authorization_endpoint: string[] }} [request_authentication_methods_supported] A JSON Object defining the client authentications supported for each endpoint
+ * @property {string[]} [vp_formats_supported] An object containing a list of key value pairs, where the key is a string identifying a credential format supported by the AS
+ * @property {(URL[] | string[])} [subject_syntax_types_supported]  A JSON array of strings representing URI scheme identifiers and optionally method names of supported Subject Syntax Types
+ * @property {string[]} [subject_trust_frameworks_supported] A JSON array of supported trust frameworks.
+ * @property {string[]} [id_token_types_supported] A JSON array of strings containing the list of ID Token types supported by the OP
+ */
+export type EbsiOpenIDMetadata = DiscoveryMetadataPayload & {
+    presentation_definition_endpoint?: URL | string;
+};
+/**
+ * JSON Web Key Set
+ * @typedef GetOIDProviderJwksSuccessResponse
+ * @property {JWK[]} keys
+ */
+export interface GetOIDProviderJwksSuccessResponse {
+    keys: JWK[];
+}
+/**
+ * @typedef GetPresentationDefinitionArgs
+ * @type {object}
+ * @property {EBSIScope} scope
+ * @property {ApiOpts} [apiOpts] The environment and version of the API
+ */
+export interface GetPresentationDefinitionArgs {
+    scope: EBSIScope;
+    apiOpts?: WellknownOpts;
+    openIDMetadata?: EbsiOpenIDMetadata;
+}
+export type CreateAttestationAuthRequestURLArgs = {
+    credentialIssuer: string;
+    credentialType: string;
+    idOpts: IIdentifierOpts;
+    requestObjectOpts: RequestObjectOpts;
+    clientId?: string;
+    redirectUri?: string;
+    formats?: Array<Extract<OID4VCICredentialFormat, 'jwt_vc' | 'jwt_vc_json'>>;
+};
+export type GetAttestationArgs = {
+    clientId: string;
+    authReqResult: AttestationAuthRequestUrlResult;
+    opts?: {
+        timeout: number;
+    };
+};
+/**
+ * Presentation Definition V2
+ * @typedef GetPresentationDefinitionSuccessResponse
+ * @type {object}
+ * @property {string} id A UUID or some other unique ID to identify this Presentation Definition
+ * @property {string} [name] A name property is a human-friendly string intended to constitute a distinctive designation of the Presentation Definition.
+ * @property {string} [purpose] It describes the purpose for which the Presentation Definition's inputs are being requested.
+ * @property {Format} [format] What claim variants Verifiers and Holders support.
+ * @property {SubmissionRequirement[]} [submission_requirements] List of requirements for described inputs in input descriptors.
+ * @property {InputDescriptor[]} input_descriptors List of descriptions of the required inputs.
+ * @property {object} [frame] a JSON LD Framing Document object.
+ */
+export type GetPresentationDefinitionSuccessResponse = PresentationDefinitionV2 & {
+    format?: Pick<Format, 'jwt_vc' | 'jwt_vc_json' | 'jwt_vp' | 'jwt_vp_json'>;
+};
+/**
+ * @typedef GetAccessTokenArgs
+ * @type {object}
+ * @property {string} grant_type MUST be set to "vp_token"
+ * @property {string} vp_token  Signed Verifiable Presentation. See also the VP Token schema definition.
+ * @property {PresentationSubmission} presentation_submission Descriptor for the vp_token, linked by presentation_definition. See also the Presentation Definition schema.
+ * @property {EBSIScope} scope Possible values: [openid didr_write, openid didr_invite, openid tir_write, openid tir_invite, openid timestamp_write, openid tnt_authorise, openid tnt_create, openid tnt_write] OIDC scope
+ * @property {ApiOpts} [apiOpts] The environment and the version of the API
+ */
+export interface GetAccessTokenArgs {
+    grant_type?: string;
+    vp_token: string;
+    presentation_submission: PresentationSubmission;
+    scope: EBSIScope;
+    openIDMetadata?: EbsiOpenIDMetadata;
+    apiOpts: ApiOpts;
+}
+export type GetAccessTokenResult = {
+    identifier: IIdentifier;
+    scope: EBSIScope;
+    accessTokenResponse: GetAccessTokenSuccessResponse;
+};
+/**
+ * @typedef EBSIAuthAccessTokenGetArgs
+ * @type {object}
+ * @property {string} attestationCredential Verifiable Credential (Verifiable Authorisation to Onboard) JWT format
+ // * @property {ScopeByDefinition} definitionId The presentation definition id
+ * @property {string} [domain] The domain of the issuer
+ * @property {string} did The did of the VP issuer
+ * @property {string} kid kid in the format: did#kid
+ * @property {EBSIScope} scope Needed to retrieve the authentication request
+ * @property {ApiOpts} [apiOpts] The environment and the version of the API
+ */
+export interface EBSIAuthAccessTokenGetArgs {
+    clientId: string;
+    credentialIssuer?: string;
+    attestationCredential?: W3CVerifiableCredential;
+    allVerifiableCredentials?: W3CVerifiableCredential[];
+    redirectUri?: string;
+    jwksUri: string;
+    idOpts: IIdentifierOpts;
+    scope: EBSIScope;
+    environment: EbsiEnvironment;
+    skipDidResolution?: boolean;
+}
+/**
+ * @typedef GetAccessTokenSuccessResponse
+ * @type {object}
+ * @property {string} access_token ^(([A-Za-z0-9\-_])+\.)([A-Za-z0-9\-_]+)(\.([A-Za-z0-9\-_]+)?$ The access token issued by the authorization server in JWS format. See also the "Access Token" schema definition
+ * @property {TokenType} token_type Possible values: [Bearer]/MUST be Bearer
+ * @property {number} [expires_in] Possible values: >= 1. The lifetime in seconds of the access token
+ * @property {EBSIScope} scope  Possible values: [openid didr_write, openid didr_invite, openid tir_invite, openid tir_write, openid timestamp_write, openid tnt_authorise, openid tnt_create, openid tnt_write] The scope of the access token
+ * @property {string} id_token ^(([A-Za-z0-9\-_])+\.)([A-Za-z0-9\-_]+)(\.([A-Za-z0-9\-_]+)?$ ID Token value associated with the authenticated session. Presents client's identity. ID Token is issued in a JWS format. See also the "ID Token" schema definition.
+ * @property {ApiOpts} apiOpts The environment and the version of the API
+ */
+export interface GetAccessTokenSuccessResponse {
+    access_token: string;
+    token_type: TokenType;
+    expires_in?: number;
+    scope: EBSIScope;
+    id_token: string;
+    apiOpts: ApiOpts;
+}
+/**
+ * @typedef ExceptionResponse
+ * @type {object}
+ * @property {(URL | string)} [type] An absolute URI that identifies the problem type. When dereferenced, it SHOULD provide human-readable documentation for the problem type.
+ * @property {string} [title] A short summary of the problem type.
+ * @property {number} [status] Possible values: >= 400 and <= 600.  The HTTP status code generated by the origin server for this occurrence of the problem.
+ * @property {string} [detail] A human readable explanation specific to this occurrence of the problem.
+ * @property {(URL | string)} [instance] An absolute URI that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.
+ */
+export interface ExceptionResponse {
+    type?: URL | string;
+    title?: string;
+    status?: number;
+    detail?: string;
+    instance?: URL | string;
+}
+export type AttestationResult = {
+    contactAlias: string;
+    contact: Party;
+    credentialBranding?: Record<string, Array<IBasicCredentialLocaleBranding>> | undefined;
+    identifier: IIdentifier;
+    error: ErrorDetails | undefined;
+    credentials: Array<MappedCredentialToAccept>;
+};
+export type GetOIDProviderMetadataResponse = EbsiOpenIDMetadata;
+export type GetOIDProviderJwksResponse = GetOIDProviderJwksSuccessResponse | ExceptionResponse;
+export type GetPresentationDefinitionResponse = GetPresentationDefinitionSuccessResponse;
+export type GetAccessTokenResponse = GetAccessTokenSuccessResponse | ExceptionResponse;
+export type IRequiredContext = IAgentContext<IKeyManager & IDIDManager & IResolver & IDidAuthSiopOpAuthenticator & IPresentationExchange & IOID4VCIHolder & IEbsiSupport>;
+//# sourceMappingURL=IEbsiSupport.d.ts.map

package/dist/types/IEbsiSupport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IEbsiSupport.d.ts","sourceRoot":"","sources":["../../src/types/IEbsiSupport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AACvE,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACrF,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AACjE,OAAO,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACpF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AACzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAA;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAA;AACrF,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAChH,OAAO,EAAE,+BAA+B,EAAE,MAAM,cAAc,CAAA;AAE9D;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB,YAAY,GACZ,aAAa,GACb,WAAW,GACX,YAAY,GACZ,iBAAiB,GACjB,eAAe,GACf,YAAY,GACZ,WAAW,GACX,WAAW,CAAA;AAEf,oBAAY,SAAS;IACnB,MAAM,WAAW;CAClB;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,aAAa,GAAG,kBAAkB,CAAA;AAC1E,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AAC/C,MAAM,MAAM,aAAa,GAAG,0BAA0B,GAAG,sBAAsB,CAAA;AAC/E,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,WAAW,CAAA;AAClD,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,aAAa,GAAG,cAAc,CAAA;AAEzE,MAAM,MAAM,OAAO,GAAG;IAAE,WAAW,CAAC,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAA;AAChF,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,GAAG,eAAe,CAAC;IAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;CAAE,CAAA;AAErH,MAAM,WAAW,YAAa,SAAQ,gBAAgB;IACpD,qBAAqB,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAE9E,2BAA2B,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAEhF,6BAA6B,CAAC,IAAI,EAAE,6BAA6B,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAE9G,kBAAkB,CAAC,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAE9G,mCAAmC,CAAC,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAA;IAEnJ,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACpG;AAID;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,kBAAkB,GAAG,wBAAwB,GAAG;IAC1D,gCAAgC,CAAC,EAAE,GAAG,GAAG,MAAM,CAAA;CAChD,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,GAAG,EAAE,CAAA;CACZ;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,SAAS,CAAA;IAChB,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,cAAc,CAAC,EAAE,kBAAkB,CAAA;CACpC;AAED,MAAM,MAAM,mCAAmC,GAAG;IAChD,gBAAgB,EAAE,MAAM,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,eAAe,CAAA;IACvB,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,uBAAuB,EAAE,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAA;CAC5E,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,+BAA+B,CAAA;IAC9C,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,wCAAwC,GAAG,wBAAwB,GAAG;IAChF,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC,CAAA;CAC3E,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,uBAAuB,EAAE,sBAAsB,CAAA;IAC/C,KAAK,EAAE,SAAS,CAAA;IAChB,cAAc,CAAC,EAAE,kBAAkB,CAAA;IACnC,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,UAAU,EAAE,WAAW,CAAA;IACvB,KAAK,EAAE,SAAS,CAAA;IAGhB,mBAAmB,EAAE,6BAA6B,CAAA;CACnD,CAAA;AACD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,qBAAqB,CAAC,EAAE,uBAAuB,CAAA;IAC/C,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,CAAA;IACpD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IAEf,MAAM,EAAE,eAAe,CAAA;IACvB,KAAK,EAAE,SAAS,CAAA;IAChB,WAAW,EAAE,eAAe,CAAA;IAC5B,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,SAAS,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,SAAS,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,GAAG,GAAG,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,GAAG,GAAG,MAAM,CAAA;CACxB;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,KAAK,CAAA;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,8BAA8B,CAAC,CAAC,GAAG,SAAS,CAAA;IACtF,UAAU,EAAE,WAAW,CAAA;IACvB,KAAK,EAAE,YAAY,GAAG,SAAS,CAAA;IAC/B,WAAW,EAAE,KAAK,CAAC,wBAAwB,CAAC,CAAA;CAC7C,CAAA;AAED,MAAM,MAAM,8BAA8B,GAAG,kBAAkB,CAAA;AAC/D,MAAM,MAAM,0BAA0B,GAAG,iCAAiC,GAAG,iBAAiB,CAAA;AAC9F,MAAM,MAAM,iCAAiC,GAAG,wCAAwC,CAAA;AACxF,MAAM,MAAM,sBAAsB,GAAG,6BAA6B,GAAG,iBAAiB,CAAA;AACtF,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAC1C,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,2BAA2B,GAAG,qBAAqB,GAAG,cAAc,GAAG,YAAY,CAC5H,CAAA"}

package/dist/types/IEbsiSupport.js

@@ -0,0 +1,5 @@
+export var TokenType;
+(function (TokenType) {
+    TokenType["BEARER"] = "Bearer";
+})(TokenType || (TokenType = {}));
+//# sourceMappingURL=IEbsiSupport.js.map

package/dist/types/IEbsiSupport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IEbsiSupport.js","sourceRoot":"","sources":["../../src/types/IEbsiSupport.ts"],"names":[],"mappings":"AA4BA,MAAM,CAAN,IAAY,SAEX;AAFD,WAAY,SAAS;IACnB,8BAAiB,CAAA;AACnB,CAAC,EAFW,SAAS,KAAT,SAAS,QAEpB"}

package/package.json

@@ -0,0 +1,86 @@
+{
+  "name": "@sphereon/ssi-sdk.ebsi-support",
+  "version": "0.26.1-unstable.101+b11e0f4d",
+  "source": "src/index.ts",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "veramo": {
+    "pluginInterfaces": {
+      "IEbsiSupport": "./src/types/IEbsiSupport.ts"
+    }
+  },
+  "scripts": {
+    "build": "tsc --build",
+    "build:clean": "tsc --build --clean && tsc --build"
+  },
+  "dependencies": {
+    "@ethersproject/random": "^5.7.0",
+    "@sphereon/did-auth-siop": "0.6.4",
+    "@sphereon/pex": "^3.3.3",
+    "@sphereon/pex-models": "^2.2.4",
+    "@sphereon/ssi-sdk-ext.did-resolver-ebsi": "0.22.0",
+    "@sphereon/ssi-sdk-ext.did-utils": "0.22.0",
+    "@sphereon/ssi-sdk-ext.key-utils": "0.22.0",
+    "@sphereon/ssi-sdk.contact-manager": "0.26.1-unstable.101+b11e0f4d",
+    "@sphereon/ssi-sdk.core": "0.26.1-unstable.101+b11e0f4d",
+    "@sphereon/ssi-sdk.oid4vci-holder": "0.26.1-unstable.101+b11e0f4d",
+    "@sphereon/ssi-sdk.presentation-exchange": "0.26.1-unstable.101+b11e0f4d",
+    "@sphereon/ssi-sdk.siopv2-oid4vp-op-auth": "0.26.1-unstable.101+b11e0f4d",
+    "@sphereon/ssi-types": "0.26.1-unstable.101+b11e0f4d",
+    "@veramo/core": "4.2.0",
+    "@veramo/did-manager": "4.2.0",
+    "@veramo/utils": "4.2.0",
+    "cross-fetch": "^3.1.8",
+    "debug": "^4.3.4",
+    "did-resolver": "^4.1.0",
+    "ethers": "^6.11.1",
+    "multiformats": "9.9.0",
+    "qs": "^6.11.2",
+    "uint8arrays": "^3.1.1",
+    "uuid": "^10.0.0",
+    "xstate": "^4.38.3"
+  },
+  "devDependencies": {
+    "@sphereon/oid4vci-client": "0.12.1-next.29",
+    "@sphereon/oid4vci-common": "0.12.1-next.29",
+    "@sphereon/ssi-express-support": "0.26.1-unstable.101+b11e0f4d",
+    "@sphereon/ssi-sdk-ext.key-manager": "0.22.0",
+    "@sphereon/ssi-sdk-ext.kms-local": "0.22.0",
+    "@sphereon/ssi-sdk.agent-config": "0.26.1-unstable.101+b11e0f4d",
+    "@sphereon/ssi-sdk.data-store": "0.26.1-unstable.101+b11e0f4d",
+    "@sphereon/ssi-sdk.public-key-hosting": "0.26.1-unstable.101+b11e0f4d",
+    "@transmute/json-web-signature": "0.7.0-unstable.81",
+    "@types/cors": "^2.8.17",
+    "@types/express": "^4.17.21",
+    "@types/express-serve-static-core": "^4.19.1",
+    "@types/node": "^20.12.7",
+    "@types/qs": "^6.9.7",
+    "@types/uuid": "^10.0.0",
+    "@veramo/data-store": "4.2.0",
+    "@veramo/key-manager": "4.2.0",
+    "@veramo/remote-client": "4.2.0",
+    "@veramo/remote-server": "4.2.0",
+    "cors": "^2.8.5",
+    "express": "^4.19.2",
+    "jose": "^5.3.0",
+    "typeorm": "^0.3.20"
+  },
+  "files": [
+    "dist/**/*",
+    "src/**/*",
+    "README.md",
+    "LICENSE"
+  ],
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": "git@github.com:Sphereon-Opensource/SSI-SDK.git",
+  "author": "Sphereon <dev@sphereon.com>",
+  "license": "Apache-2.0",
+  "keywords": [
+    "EBSI",
+    "EBSI Authorization Client"
+  ],
+  "gitHead": "b11e0f4da798c754081f00900051f1b6c6eb2439"
+}

package/src/agent/EbsiSupport.ts

@@ -0,0 +1,250 @@
+import { CheckLinkedDomain, PresentationDefinitionLocation, PresentationDefinitionWithLocation, SupportedVersion } from '@sphereon/did-auth-siop'
+import { CreateRequestObjectMode } from '@sphereon/oid4vci-common'
+import { getIdentifier } from '@sphereon/ssi-sdk-ext.did-utils'
+import { IPEXFilterResult } from '@sphereon/ssi-sdk.presentation-exchange'
+import { CredentialMapper, PresentationSubmission } from '@sphereon/ssi-types'
+import { IAgentPlugin } from '@veramo/core'
+import fetch from 'cross-fetch'
+import { determineWellknownEndpoint, ebsiGetIssuerMock } from '../did/functions'
+import { ebsiCreateAttestationAuthRequestURL, ebsiGetAttestation } from '../functions'
+import {
+  ApiOpts,
+  EBSIAuthAccessTokenGetArgs,
+  EbsiOpenIDMetadata,
+  GetAccessTokenResult,
+  GetPresentationDefinitionSuccessResponse,
+  IRequiredContext,
+  schema,
+  WellknownOpts,
+} from '../index'
+import {
+  ExceptionResponse,
+  GetAccessTokenArgs,
+  GetAccessTokenResponse,
+  GetOIDProviderJwksResponse,
+  GetOIDProviderMetadataResponse,
+  GetPresentationDefinitionArgs,
+  GetPresentationDefinitionResponse,
+  IEbsiSupport,
+} from '../types/IEbsiSupport'
+
+import { v4 } from 'uuid'
+
+export class EbsiSupport implements IAgentPlugin {
+  readonly schema = schema.IEbsiSupport
+  readonly methods: IEbsiSupport = {
+    ebsiWellknownMetadata: this.ebsiWellknownMetadata.bind(this),
+    ebsiAuthorizationServerJwks: this.ebsiAuthorizationServerJwks.bind(this),
+    ebsiPresentationDefinitionGet: this.ebsiPresentationDefinitionGet.bind(this),
+    ebsiAccessTokenGet: this.ebsiAccessTokenGet.bind(this),
+    ebsiCreateAttestationAuthRequestURL: ebsiCreateAttestationAuthRequestURL.bind(this),
+    ebsiGetAttestation: ebsiGetAttestation.bind(this),
+  }
+
+  private async ebsiWellknownMetadata(args: WellknownOpts): Promise<GetOIDProviderMetadataResponse> {
+    const url = determineWellknownEndpoint(args)
+    return await (
+      await fetch(url, {
+        method: 'GET',
+        headers: {
+          Accept: 'application/json',
+        },
+      })
+    ).json()
+  }
+
+  private async ebsiAuthorizationServerJwks(args: ApiOpts): Promise<GetOIDProviderJwksResponse | ExceptionResponse> {
+    const discoveryMetadata: EbsiOpenIDMetadata = await this.ebsiWellknownMetadata({
+      ...args,
+      type: 'openid-configuration',
+    })
+    return await (
+      await fetch(`${discoveryMetadata.jwks_uri}`, {
+        method: 'GET',
+        headers: {
+          Accept: 'application/jwk-set+json',
+        },
+      })
+    ).json()
+  }
+
+  private async ebsiPresentationDefinitionGet(args: GetPresentationDefinitionArgs): Promise<GetPresentationDefinitionResponse> {
+    const { scope, apiOpts, openIDMetadata } = args
+    const discoveryMetadata: EbsiOpenIDMetadata =
+      openIDMetadata ??
+      (await this.ebsiWellknownMetadata({
+        ...apiOpts,
+        type: 'openid-configuration',
+        system: apiOpts?.mock ? 'authorisation' : apiOpts?.system,
+        version: apiOpts?.version ?? 'v4',
+      }))
+    return (await (
+      await fetch(`${discoveryMetadata.presentation_definition_endpoint}?scope=openid%20${scope}`, {
+        method: 'GET',
+        headers: {
+          Accept: 'application/json',
+        },
+      })
+    ).json()) satisfies GetPresentationDefinitionSuccessResponse
+  }
+
+  private async ebsiAccessTokenGet(args: EBSIAuthAccessTokenGetArgs, context: IRequiredContext): Promise<GetAccessTokenResult> {
+    const { scope, idOpts, jwksUri, clientId, allVerifiableCredentials, redirectUri, environment, skipDidResolution = false } = args
+    const identifier = await getIdentifier(idOpts, context)
+    const openIDMetadata = await this.ebsiWellknownMetadata({
+      environment,
+      version: 'v4',
+      mock: undefined,
+      system: 'authorisation',
+      type: 'openid-configuration',
+    })
+    const definitionResponse = await this.ebsiPresentationDefinitionGet({
+      ...args,
+      openIDMetadata,
+      apiOpts: { environment, version: 'v4', type: 'openid-configuration' },
+    })
+    const hasInputDescriptors = definitionResponse.input_descriptors.length > 0
+
+    if (!hasInputDescriptors) {
+      // Yes EBSI expects VPs without a VC in some situations. This is not according to the PEX spec!
+      // They probably should have used SIOP in these cases. We need to go through hoops as our libs do not expect PDs/VPs without VCs :(
+      console.warn(`No INPUT descriptor returned for scope ${scope}`)
+    }
+
+    let attestationCredential = args.attestationCredential
+
+    if (hasInputDescriptors && !attestationCredential) {
+      if (allVerifiableCredentials && allVerifiableCredentials.length > 0) {
+        const pexResult = await context.agent.pexDefinitionFilterCredentials({
+          presentationDefinition: definitionResponse,
+          credentialFilterOpts: { verifiableCredentials: allVerifiableCredentials },
+        })
+        if (pexResult.filteredCredentials.length > 0) {
+          const filtered = pexResult.filteredCredentials
+            .map((cred) => CredentialMapper.toUniformCredential(cred))
+            .filter((cred) => {
+              if (!cred.expirationDate) {
+                return cred
+              } else if (new Date(cred.expirationDate!).getDate() >= Date.now()) {
+                return cred
+              }
+              return undefined
+            })
+            .filter((cred) => !!cred)
+          if (filtered.length > 0) {
+            attestationCredential = filtered[0]
+          }
+        }
+      }
+      if (!attestationCredential) {
+        const credentialIssuer = args.credentialIssuer ?? ebsiGetIssuerMock({ environment })
+        const authReqResult = await context.agent.ebsiCreateAttestationAuthRequestURL({
+          credentialIssuer,
+          idOpts,
+          formats: ['jwt_vc'],
+          clientId,
+          redirectUri,
+          requestObjectOpts: {
+            iss: clientId,
+            requestObjectMode: CreateRequestObjectMode.REQUEST_OBJECT,
+            jwksUri,
+          },
+          credentialType: 'VerifiableAuthorisationToOnboard',
+        })
+        const attestationResult = await context.agent.ebsiGetAttestation({
+          authReqResult,
+          clientId,
+          opts: { timeout: 30_000 },
+        })
+        // @ts-ignore
+        attestationCredential = attestationResult.credentials[0]!.rawVerifiableCredential! as W3CVerifiableCredential
+      }
+    }
+
+    const definition = {
+      definition: definitionResponse,
+      location: PresentationDefinitionLocation.TOPLEVEL_PRESENTATION_DEF,
+      version: SupportedVersion.SIOPv2_D11,
+    } satisfies PresentationDefinitionWithLocation
+
+    const pexResult = hasInputDescriptors
+      ? await context.agent.pexDefinitionFilterCredentials({
+          presentationDefinition: definitionResponse,
+          credentialFilterOpts: { verifiableCredentials: [attestationCredential!] },
+          // LOL, let's see whether we can trick PEX to create a VP without VCs
+        })
+      : ({
+          filteredCredentials: [],
+          id: definitionResponse.id,
+          selectResults: { verifiableCredential: [], areRequiredCredentialsPresent: 'info' },
+        } satisfies IPEXFilterResult)
+    const opSesssion = await context.agent.siopRegisterOPSession({
+      requestJwtOrUri: '', // Siop assumes we use an auth request, which we don't have in this case
+      op: { checkLinkedDomains: CheckLinkedDomain.NEVER },
+      providedPresentationDefinitions: [definition],
+    })
+    const oid4vp = await opSesssion.getOID4VP([identifier.did])
+    const vp = await oid4vp.createVerifiablePresentation(
+      { definition, credentials: pexResult.filteredCredentials },
+      {
+        proofOpts: { domain: openIDMetadata.issuer, nonce: v4(), created: new Date(Date.now() - 120_000).toString() },
+        holderDID: identifier.did,
+        identifierOpts: idOpts,
+        skipDidResolution,
+        forceNoCredentialsInVP: !hasInputDescriptors,
+      },
+    )
+
+    const presentationSubmission = hasInputDescriptors
+      ? vp.presentationSubmission
+      : ({ id: v4(), definition_id: definitionResponse.id, descriptor_map: [] } satisfies PresentationSubmission)
+
+    const tokenRequestArgs = {
+      grant_type: 'vp_token',
+      vp_token: CredentialMapper.toCompactJWT(vp.verifiablePresentation),
+      scope,
+      presentation_submission: presentationSubmission,
+      apiOpts: { environment, version: 'v4' },
+      openIDMetadata,
+    } satisfies GetAccessTokenArgs
+    const accessTokenResponse = await this.getAccessTokenResponse(tokenRequestArgs)
+
+    if (!('access_token' in accessTokenResponse)) {
+      throw Error(`Error response: ${JSON.stringify(accessTokenResponse)}`)
+    }
+
+    return {
+      accessTokenResponse,
+      // vp,
+      scope,
+      // definition,
+      identifier,
+    }
+  }
+
+  private async getAccessTokenResponse(args: GetAccessTokenArgs): Promise<GetAccessTokenResponse> {
+    const { grant_type = 'vp_token', scope, vp_token, presentation_submission, apiOpts, openIDMetadata } = args
+    const discoveryMetadata: EbsiOpenIDMetadata =
+      openIDMetadata ??
+      (await this.ebsiWellknownMetadata({
+        ...apiOpts,
+        type: 'openid-configuration',
+      }))
+    const request = {
+      grant_type,
+      scope: `openid ${scope}`,
+      vp_token,
+      presentation_submission: JSON.stringify(presentation_submission),
+    }
+    return await (
+      await fetch(`${discoveryMetadata.token_endpoint}`, {
+        method: 'POST',
+        headers: {
+          ContentType: 'application/x-www-form-urlencoded',
+          Accept: 'application/json',
+        },
+        body: new URLSearchParams(request),
+      })
+    ).json()
+  }
+}