openbadgeslib 4.4.2__tar.gz → 4.4.3__tar.gz

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/CONTRIBUTING.md

@@ -75,8 +75,9 @@ policy is deliberately simple and predictable:
 
 - A version is **dropped** — from `requires-python`, the classifiers, and the CI
   matrix — at the next **major** release after it reaches end-of-life. For
-  example, Python **3.10 (EOL 2026-10)** is dropped in **4.0.0**; until then it
-  stays supported. Grouping drops into majors keeps breaking changes rare.
+  example, Python **3.10 (EOL 2026-10)** stays supported through 4.x and is
+  dropped at the next major after that EOL (5.0). Grouping drops into majors
+  keeps breaking changes rare.
 - A new CPython minor is **added** to the CI matrix once it has a stable
   (non-pre) release, so downstreams can adopt it early.
 - The current matrix is **3.10–3.14**, and `requires-python = ">=3.10"`.

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/Changelog.txt

@@ -4,6 +4,50 @@ OpenBadgesLib - Changelog
 Newest first. Dates are ISO 8601 (YYYY-MM-DD).
 
 
+* v4.4.3 - 2026-08-18
+
+  - security(oid4vci): an issuer that advertises
+    ``key_attestations_required`` now refuses a proof without
+    ``key_attestation`` before the signature is checked and before the
+    ``c_nonce`` is spent (openvc-core 1.26's ``require_key_attestation``).
+    Set ``oid4vci_key_attestations_required`` on the badge section, or pass
+    ``require_key_attestation=True`` to ``handle_credential_request``.
+    Without this, a software wallet's §8.3.1 retry spent a fresh nonce on
+    every attempt and looped.
+
+  - build(deps): raise the openvc-core floors to `>=1.26` in the `[eudi]`,
+    `[ldp-sd]` and `[oid4vci]` extras.
+
+  - security(oid4vci): `--reclaim-unclaimed` no longer frees a status-list
+    index whose credential was already delivered to a wallet. Issued grants
+    are kept past the offer TTL (they are the only proof of delivery), and
+    a missing grant row is treated as undecided rather than "never claimed".
+  - security(oid4vci): presenting a pre-authorized code again after the
+    wallet has claimed no longer demotes the grant from issued to
+    invalidated (tokens are still revoked). That demotion made the next
+    `--reclaim-unclaimed` free the delivered credential's status index.
+  - security(ob2): a HostedBadge BadgeClass that embeds an issuer Profile
+    object is no longer trusted as-is. The Profile at ``issuer.id`` is
+    fetched and used for scope and revocation.
+  - security(publish): ``sd_jwt_vct`` paths are POSIX-normalized; a ``..``
+    that would write Type Metadata outside ``-o`` is refused.
+  - security(ob1): an empty revocation-list response fails closed instead
+    of treating the badge as not revoked.
+  - security(mail): attachment filenames are RFC 2231 encoded, and CR/LF
+    or quotes in a badge/recipient name are rejected before they can
+    inject MIME headers.
+  - security(ob2): HostedBadge ``startsWith`` is an origin + path-segment
+    prefix, not a raw string prefix (blocks subdomain / userinfo tricks).
+  - fix(oid4vci): a Credential Offer that fails validation (e.g. batch_size
+    > 1 with status_lists) no longer reserves a status-list index first.
+  - fix(ci): the Ubuntu test job installs ``[oid4vci]`` and sets
+    ``OPENBADGES_REQUIRE_OID4VCI=1`` so the credential-endpoint suite cannot
+    skip itself green.
+  - fix(oid4vci): minting an access token stretches the grant to cover the
+    advertised ``expires_in``, so redeeming late in the offer window no
+    longer clips the token's lifetime.
+
+
 * v4.4.2 - 2026-08-13
 
   - fix(cli): key generation no longer crashes on Windows, where

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 4.4.2
+Version: 4.4.3
 Summary: Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0.
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3
@@ -36,11 +36,11 @@ Requires-Dist: defusedxml>=0.7
 Provides-Extra: ldp
 Requires-Dist: pyld>=2.0.4; extra == "ldp"
 Provides-Extra: eudi
-Requires-Dist: openvc-core<2,>=1.25; extra == "eudi"
+Requires-Dist: openvc-core<2,>=1.26; extra == "eudi"
 Provides-Extra: ldp-sd
-Requires-Dist: openvc-core[data-integrity]<2,>=1.25; extra == "ldp-sd"
+Requires-Dist: openvc-core[data-integrity]<2,>=1.26; extra == "ldp-sd"
 Provides-Extra: oid4vci
-Requires-Dist: openvc-core<2,>=1.25; extra == "oid4vci"
+Requires-Dist: openvc-core<2,>=1.26; extra == "oid4vci"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-cov>=5.0; extra == "dev"
@@ -144,7 +144,7 @@ all three OB versions.
 - Python >= 3.10 (tested on 3.10–3.14)
 - [pypng](https://pypi.org/project/pypng/) >= 0.20220715.0
 - [PyJWT[crypto]](https://pypi.org/project/PyJWT/) >= 2.13
-- [cryptography](https://pypi.org/project/cryptography/) >= 42
+- [cryptography](https://pypi.org/project/cryptography/) >= 45
 - [defusedxml](https://pypi.org/project/defusedxml/) >= 0.7
 
 ## Installation
@@ -157,8 +157,10 @@ All dependencies are installed automatically. The two OB 3.0 side-tracks ship
 as optional extras (the base install stays lean):
 
 ```bash
-pip install "openbadgeslib[ldp]"    # W3C Data Integrity issuance/verification
-pip install "openbadgeslib[eudi]"   # EUDI SD-JWT VC (pulls openvc-core)
+pip install "openbadgeslib[ldp]"     # W3C Data Integrity issuance/verification
+pip install "openbadgeslib[ldp-sd]"  # verify ecdsa-sd-2023 (selective disclosure)
+pip install "openbadgeslib[eudi]"    # EUDI SD-JWT VC (pulls openvc-core)
+pip install "openbadgeslib[oid4vci]" # issue to wallets (pre-authorized code flow)
 ```
 
 For a development checkout with the test suite and linters:

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/README.md

@@ -89,7 +89,7 @@ all three OB versions.
 - Python >= 3.10 (tested on 3.10–3.14)
 - [pypng](https://pypi.org/project/pypng/) >= 0.20220715.0
 - [PyJWT[crypto]](https://pypi.org/project/PyJWT/) >= 2.13
-- [cryptography](https://pypi.org/project/cryptography/) >= 42
+- [cryptography](https://pypi.org/project/cryptography/) >= 45
 - [defusedxml](https://pypi.org/project/defusedxml/) >= 0.7
 
 ## Installation
@@ -102,8 +102,10 @@ All dependencies are installed automatically. The two OB 3.0 side-tracks ship
 as optional extras (the base install stays lean):
 
 ```bash
-pip install "openbadgeslib[ldp]"    # W3C Data Integrity issuance/verification
-pip install "openbadgeslib[eudi]"   # EUDI SD-JWT VC (pulls openvc-core)
+pip install "openbadgeslib[ldp]"     # W3C Data Integrity issuance/verification
+pip install "openbadgeslib[ldp-sd]"  # verify ecdsa-sd-2023 (selective disclosure)
+pip install "openbadgeslib[eudi]"    # EUDI SD-JWT VC (pulls openvc-core)
+pip install "openbadgeslib[oid4vci]" # issue to wallets (pre-authorized code flow)
 ```
 
 For a development checkout with the test suite and linters:

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/openbadgeslib/config.ini.example

@@ -143,6 +143,13 @@ key_type    = RSA
 ; above; vc+sd-jwt is the EUDI track and is IRREVOCABLE, so it cannot be
 ; combined with status_lists. vc+sd-jwt also needs key_type = ED25519 or ECC.
 ;oid4vci_formats  = jwt_vc_json
+; Demand a key attestation from the wallet (OID4VCI 1.0 §12.2.4). Unset is
+; the spec default: the parameter MUST NOT appear unless you actually
+; require one, or software wallets are locked out. true / {} = required
+; with no extra constraints; a JSON object is the Appendix D.2 set.
+; Advertising this also refuses a proof without key_attestation before
+; the nonce is spent — do not publish it and then accept inline-jwk proofs.
+;oid4vci_key_attestations_required = true
 ;mail        = ${paths:base}/badge_1_mail.txt
 
 [badge_2]

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/openbadgeslib/confparser.py

@@ -23,7 +23,8 @@
 
 from configparser import ConfigParser, ExtendedInterpolation, Error as ConfigParserError
 from dataclasses import dataclass
-from typing import Dict, List, Optional, Tuple, TYPE_CHECKING
+from typing import Any, Dict, List, Optional, Tuple, TYPE_CHECKING
+import json
 import os
 import sys
 import logging
@@ -380,6 +381,52 @@ def oid4vci_formats(conf: ConfigParser, badge_section: str) -> Tuple[str, ...]:
     return tuple(formats)
 
 
+def oid4vci_key_attestations_required(
+        conf: ConfigParser, badge_section: str) -> Optional[Dict[str, Any]]:
+    """The key-attestation policy a badge advertises over OID4VCI, or None.
+
+    Absent (the default) means the issuer does **not** require a key
+    attestation, and OpenID4VCI 1.0 §12.2.4 says the parameter MUST NOT then
+    appear in metadata. Present means it is required:
+
+    * ``true`` / ``yes`` / ``1`` / ``{}`` / empty advertise an unconstrained
+      requirement (a key attestation is needed, with no extra constraints);
+    * a JSON object is the Appendix D.2 constraint set, validated by the same
+      shape check :func:`~openbadgeslib.ob3.eudi.badge_credential_configuration`
+      uses.
+
+    The credential endpoint reads this same key, so advertising the
+    requirement without enforcing it — the wallet-retry loop openvc-core
+    1.26's ``require_key_attestation`` exists to close — cannot happen from
+    configuration alone.
+    """
+    if (badge_section not in conf
+            or 'oid4vci_key_attestations_required' not in conf[badge_section]):
+        return None
+    raw = (conf[badge_section].get('oid4vci_key_attestations_required')
+           or '').strip()
+    if raw.lower() in ('', 'true', 'yes', '1', '{}'):
+        value: Any = {}
+    else:
+        try:
+            parsed = json.loads(raw)
+        except ValueError as exc:
+            raise ConfigError(
+                "[%s] oid4vci_key_attestations_required must be true or a "
+                "JSON object, got %r" % (badge_section, raw)) from exc
+        if not isinstance(parsed, dict):
+            raise ConfigError(
+                "[%s] oid4vci_key_attestations_required must be a JSON "
+                "object, got %s" % (badge_section, type(parsed).__name__))
+        value = parsed
+    from .ob3.eudi import EudiError, _key_attestations_required
+    try:
+        return _key_attestations_required(value)
+    except EudiError as exc:
+        raise ConfigError("[%s] oid4vci_key_attestations_required: %s"
+                          % (badge_section, exc)) from exc
+
+
 # ── centralized config defaults ──────────────────────────────────────────────
 # One inventory for the accepted-key defaults, so each lives in a single place
 # rather than being re-spelled at every read site. (The status-list defaults —

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/openbadgeslib/issue.py

@@ -116,6 +116,12 @@ def _safe_filename_component(value: str, field_name: str) -> str:
         raise ValueError('%s is not safe for use in an output filename' % field_name)
     if os.path.basename(value) != value or ntpath.basename(value) != value:
         raise ValueError('%s must not contain path separators' % field_name)
+    # CR/LF/quotes/semicolons would inject MIME headers when this name is
+    # used as Content-Disposition filename (#316).
+    if any(ch in value for ch in '\r\n"\';'):
+        raise ValueError(
+            '%s contains characters that are not safe in a filename'
+            % field_name)
     return value
 
 

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/openbadgeslib/mail.py

@@ -67,10 +67,12 @@ class BadgeMail():
             raise BadgeImgFormatUnsupported(
                 'Unsupported image type: %r' % (badge.source.image_type,))
 
-        image = MIMEImage(badge.source.image,
-                          Content_Disposition='attachment; filename=%s' % basename(badge.file_out),
-                          Content_Description='Signed OpenBadge',
-                          _subtype=mime_type)
+        image = MIMEImage(badge.source.image, _subtype=mime_type)
+        # Keyword form so the filename is RFC 2231 encoded, never interpolated
+        # into the header value as raw bytes (#316).
+        image.add_header('Content-Disposition', 'attachment',
+                         filename=basename(badge.file_out))
+        image.add_header('Content-Description', 'Signed OpenBadge')
         msg.attach(image)
 
         try:

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/openbadgeslib/ob1/verifier.py

@@ -182,7 +182,10 @@ class Verifier():
 
         revocation_json = download_file(revocation_url)
         if not revocation_json:
-            return None
+            # The issuer published a revocationList URL; an empty body is not
+            # "no revocations" — that is a missing key. Fail closed (#317).
+            raise AssertionFormatIncorrect(
+                "Revocation list at %s is empty" % revocation_url)
         try:
             revocation = jws_utils.from_json(revocation_json)
         except Exception:

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/openbadgeslib/ob2/verifier.py

@@ -274,7 +274,8 @@ class OB2Verifier:
             starts_with = _as_str_list(verification.get("startsWith"))
             allowed_origins = _as_str_list(verification.get("allowedOrigins"))
             if starts_with:
-                if not any(assertion_id.startswith(prefix) for prefix in starts_with):
+                if not any(_url_starts_with(assertion_id, prefix)
+                           for prefix in starts_with):
                     raise OB2VerificationError(
                         "Hosted assertion id %s is outside the issuer's declared "
                         "startsWith scope" % assertion_id)
@@ -342,16 +343,33 @@ class OB2Verifier:
     # ── network / decode helpers ─────────────────────────────────────────────────
 
     def _fetch_issuer(self, assertion: Assertion) -> dict[str, Any]:
-        """Resolve the issuer Profile via the assertion's BadgeClass ``badge`` URL."""
+        """Resolve the issuer Profile via the assertion's BadgeClass ``badge`` URL.
+
+        An embedded Profile object is not trusted: its ``id`` is fetched and
+        that retrieved document is the trust anchor (scope, revocation). A
+        holder-supplied BadgeClass could otherwise name a real issuer ``id``
+        while writing its own ``startsWith`` / ``revocationList`` (#315).
+        """
         badge = self._fetch_json(assertion.badge, "BadgeClass")
-        issuer_url = badge.get("issuer")
-        if isinstance(issuer_url, dict):
-            # BadgeClass.issuer may be an embedded Profile object.
-            return issuer_url
-        if not isinstance(issuer_url, str) or not issuer_url:
+        issuer = badge.get("issuer")
+        if isinstance(issuer, dict):
+            issuer_url = issuer.get("id")
+            if not isinstance(issuer_url, str) or not issuer_url:
+                raise OB2VerificationError(
+                    "BadgeClass at %s has an embedded issuer with no id"
+                    % assertion.badge)
+        elif isinstance(issuer, str) and issuer:
+            issuer_url = issuer
+        else:
             raise OB2VerificationError(
                 "BadgeClass at %s has no valid 'issuer'" % assertion.badge)
-        return self._fetch_json(issuer_url, "issuer Profile")
+        fetched = self._fetch_json(issuer_url, "issuer Profile")
+        fetched_id = fetched.get("id")
+        if isinstance(fetched_id, str) and fetched_id != issuer_url:
+            raise OB2VerificationError(
+                "Issuer Profile at %s has id %r, expected %r"
+                % (issuer_url, fetched_id, issuer_url))
+        return fetched
 
     def _fetch_json(self, url: str, where: str) -> dict[str, Any]:
         try:
@@ -445,3 +463,24 @@ def _same_origin(a: str, b: str) -> bool:
     """Return True if two URLs share scheme + host + port (their origin)."""
     pa, pb = urlparse(a), urlparse(b)
     return (pa.scheme, pa.hostname, pa.port) == (pb.scheme, pb.hostname, pb.port)
+
+
+def _url_starts_with(url: str, prefix: str) -> bool:
+    """True if *url* is in the hosted scope declared by *prefix*.
+
+    A raw ``str.startswith`` treats ``https://issuer.example`` as a prefix of
+    ``https://issuer.example.attacker.tld/…`` (and similar userinfo tricks).
+    Require the same origin, then a path that equals the prefix path or is
+    a strict path-segment descendant (#314).
+    """
+    if not prefix:
+        return False
+    if not _same_origin(url, prefix):
+        return False
+    u, p = urlparse(url), urlparse(prefix)
+    upath, ppath = u.path or '/', p.path or '/'
+    if upath == ppath:
+        return True
+    if not ppath.endswith('/'):
+        ppath += '/'
+    return upath.startswith(ppath)

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/openbadgeslib/ob3/publish.py

@@ -39,6 +39,7 @@
 
 import configparser
 import os
+import posixpath
 import shutil
 import tempfile
 
@@ -174,14 +175,28 @@ def _write_atomic(path: str, data: str) -> None:
 def _sd_jwt_vct_relpath(vct: str, publish_url: str) -> Optional[str]:
     """The output-relative path to write Type Metadata for *vct* so serving the
     output dir at *publish_url* resolves it there — or None if *vct* is not
-    hosted under *publish_url* (same scheme+host, path under it)."""
+    hosted under *publish_url* (same scheme+host, path under it).
+
+    The remainder is POSIX-normalized. A ``..`` that would leave the publish
+    prefix is refused (PublishError) rather than joined onto ``-o`` — a vct
+    of ``https://host/out/../../../tmp/x`` used to write outside the output
+    directory (#318).
+    """
     v, p = urlparse(vct), urlparse(publish_url)
     if (v.scheme, v.netloc) != (p.scheme, p.netloc):
         return None
     base = p.path if p.path.endswith('/') else p.path + '/'
     if not v.path.startswith(base):
         return None
-    return v.path[len(base):] or None
+    rel = v.path[len(base):]
+    if not rel:
+        return None
+    normalized = posixpath.normpath(rel)
+    if posixpath.isabs(normalized) or normalized == '..' \
+            or normalized.startswith('../'):
+        raise PublishError(
+            "[issuer] sd_jwt_vct path escapes the publish_url prefix")
+    return normalized
 
 
 def _publish_type_metadata(vct: str, publish_url: str, output: str,
@@ -198,6 +213,12 @@ def _publish_type_metadata(vct: str, publish_url: str, output: str,
     document = badge_type_metadata(vct)
     served = type_metadata_document_bytes(document)
     path = os.path.join(output, rel.replace('/', os.sep))
+    root = os.path.abspath(output)
+    dest = os.path.abspath(path)
+    if os.path.commonpath([root, dest]) != root:
+        raise PublishError(
+            "[issuer] sd_jwt_vct would write Type Metadata outside %s"
+            % output)
     parent = os.path.dirname(path)
     if parent:
         os.makedirs(parent, exist_ok=True)

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/openbadgeslib/oid4vci/handler.py

@@ -43,7 +43,7 @@ from dataclasses import dataclass, field
 from datetime import datetime, timedelta, timezone
 from typing import Any, Dict, List, Mapping, Optional, Union
 
-from ..confparser import oid4vci_config
+from ..confparser import oid4vci_config, oid4vci_key_attestations_required
 from ..issue import CredentialResult, issue_credential_from_conf
 from .codes import (dummy_tx_verification, new_secret, secret_id,
                     verify_tx_code)
@@ -70,11 +70,13 @@ MAX_REQUEST_BYTES = 128 * 1024
 def _require_openvc() -> Any:
     """Import the openvc-core OID4VCI pieces, or raise with an actionable hint.
 
-    The openvc-core floor is 1.25 across every extra that pulls it, so
-    ``resolve_proof_key_in_context`` (1.24) and the discovery parsers (1.25)
-    are guaranteed present when the import succeeds; a resolver that somehow
-    resolves older anyway fails loudly at the unexpected-keyword call rather
-    than silently dropping the attested-key form.
+    The openvc-core floor is 1.26 across every extra that pulls it, so
+    ``resolve_proof_key_in_context`` (1.24), the discovery parsers (1.25)
+    and ``require_key_attestation`` (1.26) are guaranteed present when the
+    import succeeds; a resolver that somehow resolves older anyway fails
+    loudly at the unexpected-keyword call rather than silently dropping
+    the attested-key form or spending a nonce on a proof that lacked the
+    advertised attestation.
     """
     try:
         from openvc.openid4vci import (parse_credential_request,
@@ -215,7 +217,8 @@ def handle_credential_request(conf: configparser.ConfigParser,
                               access_token: Optional[str], store: Any,
                               nonces: NonceIssuer,
                               now: Optional[datetime] = None,
-                              resolve_proof_key_in_context: Any = None
+                              resolve_proof_key_in_context: Any = None,
+                              require_key_attestation: bool = False
                               ) -> CredentialResponse:
     """Verify a Credential Request and issue what its grant authorises.
 
@@ -237,6 +240,19 @@ def handle_credential_request(conf: configparser.ConfigParser,
     decision, not this library's default. When None (the default), only
     proofs that carry their key inline are accepted, exactly as before.
 
+    *require_key_attestation* refuses a proof whose header has no
+    ``key_attestation`` **before** the signature is checked and **before**
+    the ``c_nonce`` is spent (openvc-core ≥1.26). Default False, matching
+    the normative metadata default: OpenID4VCI 1.0 §12.2.4 says
+    ``key_attestations_required`` MUST NOT appear unless the issuer
+    actually requires one. The flag is also forced on when the grant's
+    badge advertises that parameter (via
+    ``oid4vci_key_attestations_required`` in the config, or an explicit
+    True here for a caller that published the requirement through
+    :func:`~openbadgeslib.ob3.eudi.badge_credential_configuration`).
+    Advertising it without this check spends the nonce on a proof the
+    wallet will retry forever.
+
     Raises :class:`OID4VCIError` for anything the wallet did wrong, and lets
     :class:`~openbadgeslib.errors.IssuanceError` through untouched for anything
     the ISSUER did wrong (broken config, unreadable key, exhausted status
@@ -286,6 +302,9 @@ def handle_credential_request(conf: configparser.ConfigParser,
             'this issuer does not use credential_identifier; send a '
             'credential_configuration_id')
 
+    badge, _fmt = parse_credential_configuration_id(
+        conf, grant.credential_configuration_id)
+    advertised = oid4vci_key_attestations_required(conf, badge) is not None
     try:
         proofs = verify_proofs(
             request,
@@ -303,6 +322,9 @@ def handle_credential_request(conf: configparser.ConfigParser,
             resolve_proof_key=None,
             resolve_proof_key_in_context=resolve_proof_key_in_context,
             trust_anchors=None,
+            # OR, never AND-NOT: advertising the requirement without
+            # enforcing it is the retry loop this flag exists to close.
+            require_key_attestation=require_key_attestation or advertised,
             max_age_s=cfg.proof_max_age_s, now=moment,
             batch_size=grant.max_proofs)
     except OID4VCIStoreError:

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/openbadgeslib/oid4vci/memory_store.py

@@ -118,7 +118,9 @@ class InMemoryOID4VCIStore:
     def invalidate_grant(self, grant_id: str) -> None:
         with self._lock:
             grant = self._grants.get(grant_id)
-            if grant is not None:
+            # Keep STATE_ISSUED: it is the delivery evidence reclaim needs
+            # (#313). Tokens are still dropped (OAuth 2.1 code-reuse).
+            if grant is not None and grant.state != STATE_ISSUED:
                 grant.state = STATE_INVALIDATED
             self._tokens = {tid: entry for tid, entry in self._tokens.items()
                             if entry[0] != grant_id}
@@ -129,6 +131,10 @@ class InMemoryOID4VCIStore:
                    expires_at: datetime) -> None:
         with self._lock:
             self._tokens[token_id] = (grant_id, expires_at)
+            grant = self._grants.get(grant_id)
+            # Cover the advertised token TTL (#320).
+            if grant is not None and grant.expires_at < expires_at:
+                grant.expires_at = expires_at
 
     def grant_for_token(self, token_id: str, *,
                         now: datetime) -> Optional[PreAuthorizedGrant]:
@@ -179,8 +185,12 @@ class InMemoryOID4VCIStore:
     def purge_expired(self, *, now: datetime, limit: int = 500) -> PurgeStats:
         with self._lock:
             stats = PurgeStats()
+            # Keep STATE_ISSUED grants past expiry: they are the only proof
+            # a wallet claimed the offer, and reconcile needs them so it
+            # does not free a delivered credential's status-list index (#303).
             dead_grants = [gid for gid, g in self._grants.items()
-                           if g.is_expired(now)][:limit]
+                           if g.is_expired(now)
+                           and g.state != STATE_ISSUED][:limit]
             for gid in dead_grants:
                 grant = self._grants.pop(gid)
                 self._codes.pop(grant.code_id, None)

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/openbadgeslib/oid4vci/metadata.py

@@ -40,7 +40,7 @@ import logging
 from typing import Any, Dict, List, Optional, Sequence
 
 from ..confparser import (OID4VCIConfig, oid4vci_config, oid4vci_formats,
-                          resolve_key_type)
+                          oid4vci_key_attestations_required, resolve_key_type)
 from ..errors import ConfigError
 from ..keys import KeyType
 from .formats import FORMAT_JWT_VC_JSON, FORMAT_SD_JWT_VC
@@ -175,9 +175,10 @@ def _validate_issuer_metadata(metadata: Dict[str, Any]) -> None:
     try:
         from openvc.openid4vci import parse_credential_issuer_metadata
     except ImportError:
-        # An install WITH the extra that lands an openvc-core below the 1.25
-        # parser would take this branch too — indistinguishable from a plain
-        # minimal install, and silent about the skipped check either way.
+        # An install WITH the extra that lands an openvc-core below the 1.26
+        # floor (parsers landed in 1.25) would take this branch too —
+        # indistinguishable from a plain minimal install, and silent about
+        # the skipped check either way.
         logger.debug('openvc-core OID4VCI discovery parsers unavailable; '
                      'the issuer metadata self-check is skipped (install the '
                      '[oid4vci] extra for it)')
@@ -232,6 +233,12 @@ def _configuration(conf: configparser.ConfigParser, cfg: OID4VCIConfig,
                     list(PROOF_SIGNING_ALGS)},
         },
     }
+    required = oid4vci_key_attestations_required(conf, badge)
+    if required is not None:
+        # Presence is the requirement. An empty object is the spec's
+        # "needed, unconstrained" spelling — not a placeholder.
+        entry['proof_types_supported']['jwt'][
+            'key_attestations_required'] = required
     if credential_format == FORMAT_SD_JWT_VC:
         from ..ob3.eudi import OB3_SD_JWT_VCT
         entry['vct'] = (conf['issuer'].get('sd_jwt_vct') or '').strip() \

{openbadgeslib-4.4.2 → openbadgeslib-4.4.3}/openbadgeslib/oid4vci/offer.py

@@ -139,22 +139,22 @@ def build_credential_offer(conf: configparser.ConfigParser, badge: str,
     notices: List[str] = []
     expires_at = moment + timedelta(
         seconds=expires_in_s if expires_in_s is not None else cfg.offer_ttl_s)
+    if cfg.batch_size > 1:
+        # Check before reserving: a failed offer used to burn a status-list
+        # index on every retry (#319).
+        from ..confparser import ob3_status_config
+        if ob3_status_config(conf, badge) is not None:
+            raise ConfigError(
+                "[%s] configures status_lists and [oid4vci] sets batch_size = %d, "
+                "but one grant reserves one revocation slot — the extra "
+                "credentials would be irrevocable. Set batch_size = 1, or drop "
+                "status_lists from that section."
+                % (badge, cfg.batch_size))
+
     # The credential's id is fixed now, not at signing time: the status
     # registry indexes the reserved slot by it, and a signing-time id would
     # leave the registry naming a credential that never existed.
     credential_id = 'urn:uuid:%s' % uuid.uuid4()
-    status_index = _reserve_status_index(conf, badge, chosen, recipient,
-                                         credential_id, expires_at, notices)
-    if status_index is not None and cfg.batch_size > 1:
-        # A grant reserves exactly one status-list slot, so batch issuance
-        # would hand out N credentials of which N-1 could never be revoked.
-        raise ConfigError(
-            "[%s] configures status_lists and [oid4vci] sets batch_size = %d, "
-            "but one grant reserves one revocation slot — the extra "
-            "credentials would be irrevocable. Set batch_size = 1, or drop "
-            "status_lists from that section."
-            % (badge, cfg.batch_size))
-
     code = new_secret()
     configuration_id = credential_configuration_id(badge, chosen)
 
@@ -162,7 +162,7 @@ def build_credential_offer(conf: configparser.ConfigParser, badge: str,
         grant_id=new_id(), code_id=secret_id(code), badge=badge,
         credential_configuration_id=configuration_id,
         credential_format=chosen, recipient=recipient,
-        expires_at=expires_at, status_index=status_index,
+        expires_at=expires_at, status_index=None,
         credential_id=credential_id,
         max_proofs=cfg.batch_size, created_at=moment)
 
@@ -178,7 +178,15 @@ def build_credential_offer(conf: configparser.ConfigParser, badge: str,
     offer = _offer_document(cfg.credential_issuer, [configuration_id], code,
                             cfg if tx_code else None)
     _validate_offer(offer)
-    store.save_grant(grant)
+    status_index = _reserve_status_index(conf, badge, chosen, recipient,
+                                         credential_id, expires_at, notices)
+    grant.status_index = status_index
+    try:
+        store.save_grant(grant)
+    except BaseException:
+        if status_index is not None:
+            _release_status_index(conf, badge, credential_id)
+        raise
     return CredentialOffer(
         offer=offer, uri=_offer_uri(offer), pre_authorized_code=code,
         grant_id=grant.grant_id, recipient=recipient, expires_at=expires_at,
@@ -224,7 +232,8 @@ def _validate_offer(offer: Dict[str, Any]) -> None:
         from openvc.openid4vci import parse_credential_offer
     except ImportError:
         # Same caveat as the metadata self-check: an openvc-core older than
-        # 1.25 takes this branch too, silently skipping the check.
+        # the 1.26 floor (parsers landed in 1.25) takes this branch too,
+        # silently skipping the check.
         logger.debug('openvc-core OID4VCI discovery parsers unavailable; '
                      'the Credential Offer self-check is skipped (install '
                      'the [oid4vci] extra for it)')
@@ -323,5 +332,22 @@ def _reserve_status_index(conf: configparser.ConfigParser, badge: str,
     return index
 
 
+def _release_status_index(conf: configparser.ConfigParser, badge: str,
+                          credential_id: str) -> None:
+    """Undo a reservation if the grant could not be persisted (#319)."""
+    from ..confparser import ob3_status_config
+    from ..ob3.status_registry import StatusRegistry
+
+    status_conf = ob3_status_config(conf, badge)
+    if status_conf is None:
+        return
+    with StatusRegistry.locked(status_conf.registry_path,
+                               status_conf.size_bits) as registry:
+        if credential_id in registry.entries \
+                and registry.entries[credential_id].pending:
+            registry.reclaim(credential_id)
+            registry.save()
+
+
 __all__ = ['CredentialOffer', 'OFFER_SCHEME', 'QR_COMFORTABLE_LIMIT',
            'build_credential_offer', 'parse_received_credential_offer']