OID4VP: Add option to lookup decryption keys for pre-registered clients

Author: nodh

vck-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/openid/OpenId4VpHolder.kt

@@ -106,8 +106,14 @@ class OpenId4VpHolder(
     private val walletNonceMapStore: MapStore<String, String> = DefaultMapStore(),
     /** Source for random bytes, i.e., nonces for encrypted responses. */
     private val randomSource: RandomSource = RandomSource.Secure,
+    /** Callback to load encryption keys for pre-registered clients. */
+    private val lookupJsonWebKeysForClient: (JsonWebKeyLookupInput) -> JsonWebKeySet? = { null }
 ) {
 
+    data class JsonWebKeyLookupInput(
+        val clientId: String?
+    )
+
     private val supportedJwsAlgorithms = supportedAlgorithms
         .mapNotNull { it.toJwsAlgorithm().getOrNull()?.identifier }
     private val supportedCoseAlgorithms = supportedAlgorithms
@@ -194,7 +200,8 @@ class OpenId4VpHolder(
             response = AuthenticationResponse.Error(
                 error = error.toOAuth2Error(request),
                 clientMetadata = request.parameters.clientMetadata,
-                jsonWebKeys = request.parameters.clientMetadata?.loadJsonWebKeySet()?.keys,
+                jsonWebKeys = request.parameters.clientMetadata?.loadJsonWebKeySet()?.keys
+                    ?: lookupJsonWebKeysForClient(JsonWebKeyLookupInput(request.parameters.clientId))?.keys,
             )
         )
     }
@@ -247,7 +254,8 @@ class OpenId4VpHolder(
             request = params,
             credentialPresentationRequest = params.parameters.loadCredentialRequest(),
             clientMetadata = params.parameters.clientMetadata,
-            jsonWebKeys = params.parameters.clientMetadata?.loadJsonWebKeySet()?.keys,
+            jsonWebKeys = params.parameters.clientMetadata?.loadJsonWebKeySet()?.keys
+                ?: lookupJsonWebKeysForClient(JsonWebKeyLookupInput(params.parameters.clientId))?.keys,
             requestObjectVerified = (params as? RequestParametersFrom.JwsSigned)?.verified,
             verifierInfo = params.parameters.verifierInfo
         )
@@ -284,6 +292,7 @@ class OpenId4VpHolder(
         with(state) {
             val audience = request.extractAudience(jsonWebKeys)
             val jsonWebKeys = jsonWebKeys?.combine(request.extractLeafCertKey())
+                ?: lookupJsonWebKeysForClient(JsonWebKeyLookupInput(request.parameters.clientId))?.keys
             val idToken = presentationFactory.createSignedIdToken(clock, keyMaterial.publicKey, request)
                 .getOrNull()?.serialize()
             val presentation = credentialPresentation ?: credentialPresentationRequest?.toCredentialPresentation()
@@ -407,10 +416,6 @@ class OpenId4VpHolder(
             ?.let { remoteResourceRetriever(RemoteResourceRetrieverInput(it)) }
             ?.let { vckJsonSerializer.decodeFromString(it) }
 
-    @Suppress("DEPRECATION")
-    private suspend fun AuthenticationRequestParameters.loadClientMetadata(): RelyingPartyMetadata? =
-        clientMetadata
-
 }
 
 private fun Collection<JsonWebKey>?.combine(certKey: JsonWebKey?): Collection<JsonWebKey> =

vck-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/openid/OpenId4VpVerifier.kt

@@ -6,7 +6,6 @@ import at.asitplus.catchingUnwrapped
 import at.asitplus.dif.ClaimFormat
 import at.asitplus.dif.FormatContainerJwt
 import at.asitplus.dif.FormatContainerSdJwt
-import at.asitplus.dif.FormatHolder
 import at.asitplus.dif.PresentationSubmissionDescriptor
 import at.asitplus.iso.DeviceAuthentication
 import at.asitplus.iso.DeviceResponse
@@ -364,7 +363,7 @@ class OpenId4VpVerifier(
         scope = if (isSiop) buildScope() else null,
         nonce = nonceService.provideNonce(),
         walletNonce = requestObjectParameters?.walletNonce,
-        clientMetadata = clientMetadata(this),
+        clientMetadata = clientMetadata(),
         idTokenType = if (isSiop) IdTokenType.SUBJECT_SIGNED.text else null,
         responseMode = responseMode,
         state = state,
@@ -385,12 +384,12 @@ class OpenId4VpVerifier(
         authenticationRequestParameters,
     )
 
-    private fun clientMetadata(options: RequestOptions): RelyingPartyMetadata? = when (clientIdScheme) {
+    private fun RequestOptions.clientMetadata(): RelyingPartyMetadata? = when (clientIdScheme) {
         is ClientIdScheme.RedirectUri,
         is ClientIdScheme.VerifierAttestation,
         is ClientIdScheme.CertificateSanDns,
         is ClientIdScheme.CertificateHash ->
-            if (options.encryption || options.responseMode.requiresEncryption) metadataWithEncryption else metadata
+            if (encryption || responseMode.requiresEncryption) metadataWithEncryption else metadata
 
         else -> null
     }

vck-openid/src/commonTest/kotlin/at/asitplus/wallet/lib/openid/PreRegisteredClientTest.kt

@@ -4,6 +4,7 @@ import at.asitplus.openid.AuthenticationRequestParameters
 import at.asitplus.openid.JarRequestParameters
 import at.asitplus.openid.OpenIdConstants
 import at.asitplus.openid.RequestParametersFrom
+import at.asitplus.signum.indispensable.josef.JsonWebKeySet
 import at.asitplus.signum.indispensable.josef.JwsSigned
 import at.asitplus.signum.indispensable.josef.io.joseCompliantSerializer
 import at.asitplus.testballoon.invoke
@@ -48,14 +49,16 @@ val PreRegisteredClientTest by testSuite {
     lateinit var redirectUrl: String
     lateinit var holderKeyMaterial: KeyMaterial
     lateinit var verifierKeyMaterial: KeyMaterial
+    lateinit var decryptionKeyMaterial: KeyMaterial
     lateinit var holderAgent: Holder
     lateinit var holderOid4vp: OpenId4VpHolder
     lateinit var verifierOid4vp: OpenId4VpVerifier
     lateinit var defaultRequestOptions: RequestOptions
     testConfig = TestConfig.aroundEach {
         holderKeyMaterial = EphemeralKeyWithoutCert()
         verifierKeyMaterial = EphemeralKeyWithoutCert()
-        clientId = "PRE-REGISTERED-CLIENT"
+        decryptionKeyMaterial = EphemeralKeyWithoutCert()
+        clientId = "PRE-REGISTERED-CLIENT-${uuid4()}"
         redirectUrl = "https://example.com/rp/${uuid4()}"
         walletUrl = "https://example.com/wallet/${uuid4()}"
         holderAgent = HolderAgent(holderKeyMaterial)
@@ -76,10 +79,14 @@ val PreRegisteredClientTest by testSuite {
         holderOid4vp = OpenId4VpHolder(
             holder = holderAgent,
             randomSource = RandomSource.Default,
+            lookupJsonWebKeysForClient = {
+                if (it.clientId == clientId) JsonWebKeySet(listOf(decryptionKeyMaterial.jsonWebKey)) else null
+            }
         )
         verifierOid4vp = OpenId4VpVerifier(
             keyMaterial = verifierKeyMaterial,
             clientIdScheme = ClientIdScheme.PreRegistered(clientId, redirectUrl),
+            decryptionKeyMaterial = decryptionKeyMaterial
         )
         defaultRequestOptions = RequestOptions(
             credentials = setOf(