WIP

Author: nodh

openid-data-classes/src/commonMain/kotlin/at/asitplus/openid/CredentialResponseEncryption.kt

@@ -18,7 +18,7 @@ data class CredentialResponseEncryption(
      * OID4VCI: REQUIRED. JWE (RFC7516) `alg` algorithm (RFC7518) for encrypting Credential Responses.
      */
     @SerialName("alg")
-    val jweAlgorithm: JweAlgorithm,
+    val jweAlgorithm: JweAlgorithm? = null,
 
     /**
      * OID4VCI: REQUIRED. JWE (RFC7516) `enc` algorithm (RFC7518) for encrypting Credential Responses.

openid-data-classes/src/commonMain/kotlin/at/asitplus/openid/SupportedAlgorithmsContainer.kt

@@ -16,7 +16,7 @@ data class SupportedAlgorithmsContainer(
      * context-specific, e.g. `EdDSA` and `ES256`.
      */
     @SerialName("alg_values_supported")
-    val supportedAlgorithmsStrings: Set<String>,
+    val supportedAlgorithmsStrings: Set<String>? = null,
 
     /**
      * OID4VCI: REQUIRED. Array containing a list of the JWE (RFC7516) encryption algorithms (enc values) (RFC7518)
@@ -32,7 +32,7 @@ data class SupportedAlgorithmsContainer(
      * every Credential Response and therefore the Wallet MUST provide encryption keys in the Credential Request.
      * If the value is `false`, the Wallet MAY choose whether it provides encryption keys or not.
      */
-    @SerialName("encryption_required")
+    @SerialName("encryption_required") // TODO make this non-optional?!
     val encryptionRequired: Boolean? = null,
 
     /**
@@ -52,8 +52,8 @@ data class SupportedAlgorithmsContainer(
      * context-specific, e.g. `EdDSA` and `ES256`.
      */
     @Transient
-    val supportedAlgorithms: Set<JsonWebAlgorithm> = supportedAlgorithmsStrings
-        .mapNotNull { s -> JsonWebAlgorithm.entries.firstOrNull { it.identifier == s } }.toSet()
+    val supportedAlgorithms: Set<JsonWebAlgorithm>? = supportedAlgorithmsStrings
+        ?.mapNotNull { s -> JsonWebAlgorithm.entries.firstOrNull { it.identifier == s } }?.toSet()
 
     /**
      * OID4VCI: REQUIRED. Array containing a list of the JWE (RFC7516) encryption algorithms (enc values) (RFC7518)

openid-data-classes/src/commonMain/kotlin/at/asitplus/openid/SupportedCredentialFormat.kt

@@ -169,16 +169,18 @@ data class SupportedCredentialFormat private constructor(
             supportedBindingMethods: Set<String>? = null,
             supportedProofTypes: Map<String, CredentialRequestProofSupported>? = null,
             credentialDefinition: SupportedCredentialFormatDefinition,
+            vcJwtClaims: Set<ClaimDescription>,
             display: Set<DisplayProperties>? = null,
         ) = SupportedCredentialFormat(
             format = format,
             scope = scope,
             supportedBindingMethods = supportedBindingMethods,
             supportedProofTypes = supportedProofTypes,
             credentialDefinition = credentialDefinition,
-            credentialMetadata = display?.let {
-                CredentialMetadata(display = display)
-            }
+            credentialMetadata = CredentialMetadata(
+                claimDescription = vcJwtClaims,
+                display = display,
+            )
         )
 
     }

openid-data-classes/src/commonMain/kotlin/at/asitplus/openid/SupportedCredentialFormatDefinition.kt

@@ -17,13 +17,4 @@ data class SupportedCredentialFormatDefinition(
     @SerialName("type")
     val types: Set<String>? = null,
 
-    /**
-     * OID4VCI:
-     * W3C VC: OPTIONAL. Object containing a list of name/value pairs, where each name identifies
-     * a claim offered in the Credential. The value can be another such object (nested data structures), or an array
-     * of such objects
-     */
-    @SerialName("credentialSubject")
-    val credentialSubject: Map<String, CredentialSubjectMetadataSingle>? = null,
-
 )

vck-openid-ktor/src/commonMain/kotlin/at/asitplus/wallet/lib/ktor/openid/Extensions.kt

@@ -61,7 +61,7 @@ fun OAuth2Error?.dpopNonce(response: HttpResponse) = runCatching {
     authorizationServerProvidedNonce(response)
         ?: resourceServerProvidedNonce(response)
 }.getOrNull()
-
+// todo need to handle "wrong nonce"?
 /** [RFC 9449 8.](https://datatracker.ietf.org/doc/html/rfc9449#name-authorization-server-provid) */
 private fun OAuth2Error?.authorizationServerProvidedNonce(response: HttpResponse): String? =
     this?.error.takeIf { it == USE_DPOP_NONCE }?.let { response.headers[HttpHeaders.DPoPNonce] }

vck-openid-ktor/src/commonMain/kotlin/at/asitplus/wallet/lib/ktor/openid/OpenId4VciClient.kt

@@ -271,7 +271,7 @@ class OpenId4VciClient(
                 tokenResponse = tokenResponse,
                 credentialFormat = credentialFormat,
                 credentialScheme = credentialScheme,
-                dpopNonce = dpopNonce
+                dpopNonce = dpopNonce ?: tokenResponse.dpopNonce,
             )
         }
         return CredentialIssuanceResult.Success(

vck-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/oidvci/CredentialIssuer.kt

@@ -12,6 +12,7 @@ import at.asitplus.openid.OidcUserInfoExtended
 import at.asitplus.openid.OpenIdConstants
 import at.asitplus.signum.indispensable.SignatureAlgorithm
 import at.asitplus.signum.indispensable.josef.JsonWebKeySet
+import at.asitplus.signum.indispensable.josef.JweEncrypted
 import at.asitplus.signum.indispensable.josef.JwsSigned
 import at.asitplus.wallet.lib.agent.EphemeralKeyWithoutCert
 import at.asitplus.wallet.lib.agent.Issuer
@@ -70,6 +71,20 @@ class CredentialIssuer(
     private val encryptionService: IssuerEncryptionService = IssuerEncryptionService(),
 ) {
 
+    sealed interface CredentialResponse {
+        /**
+         * Send [response] as JSON-serialized content to the client with media
+         * type `application/json` (see [at.asitplus.wallet.lib.data.MediaTypes.Application.JSON]).
+         */
+        data class Plain(val response: CredentialResponseParameters) : CredentialResponse
+
+        /**
+         * Send [response] as JWE-serialized content to the client with media
+         * type `application/jwt` (see [at.asitplus.wallet.lib.data.MediaTypes.Application.JWT]).
+         */
+        data class Encrypted(val response: JweEncrypted) : CredentialResponse
+    }
+
     private val supportedCredentialConfigurations = credentialSchemes
         .flatMap { it.toSupportedCredentialFormat().entries }
         .associate {
@@ -165,12 +180,12 @@ class CredentialIssuer(
         input: String,
         credentialDataProvider: CredentialDataProviderFun,
         request: RequestInfo? = null,
-    ): KmmResult<CredentialResponseParameters> = catching {
+    ): KmmResult<CredentialResponse> = catching {
         credentialInternal(
             authorizationHeader = authorizationHeader,
-            params = encryptionService.decrypt(input).getOrThrow(),
+            request = encryptionService.decrypt(input).getOrThrow(),
             credentialDataProvider = credentialDataProvider,
-            request = request,
+            requestInfo = request,
             hasBeenEncrypted = true,
         ).getOrThrow()
     }
@@ -196,11 +211,11 @@ class CredentialIssuer(
         params: CredentialRequestParameters,
         credentialDataProvider: CredentialDataProviderFun,
         request: RequestInfo? = null,
-    ): KmmResult<CredentialResponseParameters> = credentialInternal(
+    ): KmmResult<CredentialResponse> = credentialInternal(
         authorizationHeader = authorizationHeader,
-        params = params,
+        request = params,
         credentialDataProvider = credentialDataProvider,
-        request = request,
+        requestInfo = request,
         hasBeenEncrypted = false,
     )
 
@@ -225,12 +240,12 @@ class CredentialIssuer(
         params: WalletService.CredentialRequest,
         credentialDataProvider: CredentialDataProviderFun,
         request: RequestInfo? = null,
-    ): KmmResult<CredentialResponseParameters> = catching {
+    ): KmmResult<CredentialResponse> = catching {
         credentialInternal(
             authorizationHeader = authorizationHeader,
-            params = params.decryptIfNeeded(),
+            request = params.decryptIfNeeded(),
             credentialDataProvider = credentialDataProvider,
-            request = request,
+            requestInfo = request,
             hasBeenEncrypted = false,
         ).getOrThrow()
     }
@@ -242,19 +257,19 @@ class CredentialIssuer(
 
     private suspend fun credentialInternal(
         authorizationHeader: String,
-        params: CredentialRequestParameters,
+        request: CredentialRequestParameters,
         credentialDataProvider: CredentialDataProviderFun,
-        request: RequestInfo? = null,
+        requestInfo: RequestInfo? = null,
         hasBeenEncrypted: Boolean = false,
-    ): KmmResult<CredentialResponseParameters> = catching {
+    ): KmmResult<CredentialResponse> = catching {
         Napier.i("credential called")
-        Napier.d("credential called with $authorizationHeader, $params")
+        Napier.d("credential called with $authorizationHeader, $request")
         if (!hasBeenEncrypted && encryptionService.requireRequestEncryption)
             throw InvalidEncryptionParameters("Credential request has not been encrypted")
-        authorizationService.validateAccessToken(authorizationHeader, request).getOrThrow()
-        val userInfo = params.introspectTokenLoadUserInfo(authorizationHeader, request)
-        val (scheme, representation) = params.extractCredentialRepresentation()
-        proofValidator.validateProofExtractSubjectPublicKeys(params).map { subjectPublicKey ->
+        authorizationService.validateAccessToken(authorizationHeader, requestInfo).getOrThrow()
+        val userInfo = request.introspectTokenLoadUserInfo(authorizationHeader, requestInfo)
+        val (scheme, representation) = request.extractCredentialRepresentation()
+        val responseParameters = proofValidator.validateProofExtractSubjectPublicKeys(request).map { subjectPublicKey ->
             issuer.issueCredential(
                 credentialDataProvider(
                     CredentialDataProviderInput(
@@ -269,7 +284,8 @@ class CredentialIssuer(
             ).getOrElse {
                 throw CredentialRequestDenied("No credential from issuer", it)
             }
-        }.toCredentialResponseParameters(encryptionService.encryptResponseIfNecessary(params))
+        }.toCredentialResponseParameters()
+        encryptionService.encryptResponse(responseParameters, request)
             .also { Napier.i("credential returns"); Napier.d("credential returns $it") }
     }
 
@@ -299,10 +315,16 @@ class CredentialIssuer(
             if (!it.validCredentialIdentifiers.contains(credentialIdentifier))
                 throw InvalidToken("credential_identifier $credentialIdentifier expected to be in $it")
         } ?: credentialConfigurationId?.let { credentialConfigurationId ->
-            if (it.scope == null)
-                throw InvalidToken("no scope stored for access token $authorizationHeader")
-            if (!it.scope.contains(credentialConfigurationId))
-                throw InvalidToken("credential_configuration_id $credentialConfigurationId expected to be $it")
+            // TODO Test this
+            if (it.scope != null) {
+                if (!it.scope.contains(credentialConfigurationId))
+                    throw InvalidToken("credential_configuration_id $credentialConfigurationId expected to be $it")
+            } else if (it.authorizationDetails != null) {
+                if (!it.validCredentialConfigurationIds.contains(credentialConfigurationId))
+                    throw InvalidToken("credential_configuration_id $credentialConfigurationId expected to be in $it")
+            } else {
+                throw InvalidToken("neither scope nor authorization details stored $authorizationHeader")
+            }
         } ?: authorizationHeader.run {
             throw InvalidToken("neither credential_identifier nor credential_configuration_id set")
         }

vck-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/oidvci/CredentialSchemeMapping.kt

@@ -49,9 +49,11 @@ object CredentialSchemeMapping {
                     scope = this,
                     credentialDefinition = SupportedCredentialFormatDefinition(
                         types = setOf(VcDataModelConstants.VERIFIABLE_CREDENTIAL, vcType!!),
-                        credentialSubject = claimNames.associateWith { CredentialSubjectMetadataSingle() }
                     ),
                     supportedBindingMethods = setOf(BINDING_METHOD_JWK, URN_TYPE_JWK_THUMBPRINT),
+                    vcJwtClaims = claimNames.map {
+                        ClaimDescription(path = it.split("."))
+                    }.toSet()
                 )
             }
         } else null

vck-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/oidvci/Extensions.kt

@@ -27,48 +27,33 @@ fun CredentialFormatEnum.toRepresentation() = when (this) {
     else -> CredentialRepresentation.PLAIN_JWT
 }
 
-/**
- * @param transformer may be used to encrypt the credentials before serializing
- */
-suspend fun Issuer.IssuedCredential.toCredentialResponseParameters(
-    transformer: (suspend (String) -> String) = { it },
-) = when (this) {
+suspend fun Issuer.IssuedCredential.toCredentialResponseParameters() = when (this) {
     is Issuer.IssuedCredential.Iso -> CredentialResponseParameters(
-        credentials = setOf(toCredentialResponseSingleCredential(transformer)),
+        credentials = setOf(toCredentialResponseSingleCredential()),
     )
 
     is Issuer.IssuedCredential.VcJwt -> CredentialResponseParameters(
-        credentials = setOf(toCredentialResponseSingleCredential(transformer)),
+        credentials = setOf(toCredentialResponseSingleCredential()),
     )
 
     is Issuer.IssuedCredential.VcSdJwt -> CredentialResponseParameters(
-        credentials = setOf(toCredentialResponseSingleCredential(transformer)),
+        credentials = setOf(toCredentialResponseSingleCredential()),
     )
 }
 
-/**
- * @param transformer may be used to encrypt the credentials before serializing
- */
-suspend fun Collection<Issuer.IssuedCredential>.toCredentialResponseParameters(
-    transformer: (suspend (String) -> String) = { it },
-) = if (size == 1) {
-    first().toCredentialResponseParameters(transformer)
+suspend fun Collection<Issuer.IssuedCredential>.toCredentialResponseParameters() = if (size == 1) {
+    first().toCredentialResponseParameters()
 } else {
     CredentialResponseParameters(
-        credentials = this.map { it.toCredentialResponseSingleCredential(transformer) }.toSet()
+        credentials = this.map { it.toCredentialResponseSingleCredential() }.toSet()
     )
 }
 
-/**
- * @param transformer may be used to encrypt the credentials before serializing
- */
-suspend fun Issuer.IssuedCredential.toCredentialResponseSingleCredential(
-    transformer: (suspend (String) -> String) = { it },
-): CredentialResponseSingleCredential = CredentialResponseSingleCredential(
+fun Issuer.IssuedCredential.toCredentialResponseSingleCredential() = CredentialResponseSingleCredential(
     when (this) {
-        is Issuer.IssuedCredential.Iso -> JsonPrimitive(transformer(toBase64UrlStrict()))
-        is Issuer.IssuedCredential.VcJwt -> JsonPrimitive(transformer(signedVcJws.serialize()))
-        is Issuer.IssuedCredential.VcSdJwt -> JsonPrimitive(transformer(signedSdJwtVc.serialize()))
+        is Issuer.IssuedCredential.Iso -> JsonPrimitive(toBase64UrlStrict())
+        is Issuer.IssuedCredential.VcJwt -> JsonPrimitive(signedVcJws.serialize())
+        is Issuer.IssuedCredential.VcSdJwt -> JsonPrimitive(signedSdJwtVc.serialize())
     }
 )