fix: openid4vci par endpoint

- fix mandatory for scope and authorization_details

Author: saralongobardiacn

pyeudiw/openid4vci/models/par_request.py

@@ -1,5 +1,5 @@
 import logging
-from typing import List
+from typing import List, Optional
 from urllib.parse import urlparse
 
 from pydantic import model_validator
@@ -28,8 +28,8 @@ class ParRequest(OpenId4VciBaseModel):
   state: str = None
   code_challenge: str = None
   code_challenge_method: str = None
-  scope: str = None
-  authorization_details: List[AuthorizationDetail] = None
+  scope: Optional[str] = None
+  authorization_details: Optional[List[AuthorizationDetail]] = None
   redirect_uri: str = None
   jti: str = None
   issuer_state: str = None
@@ -61,27 +61,31 @@ def check_par_request(self) -> "ParRequest":
     self.validate_code_challenge(endpoint)
     self.validate_code_challenge_method(config.code_challenge_methods_supported, endpoint)
     self.validate_scope(config.scopes_supported, endpoint)
+    self.validate_authorization_details(endpoint)
+    if not self.scope and (not self.authorization_details or len(self.authorization_details) == 0):
+      raise InvalidRequestException("Missing `scope` and `authorization_details` in `par` endpoint")
+
     self.validate_redirect_uri(endpoint)
     self.validate_jti(endpoint)
-    self.validate_authorization_details(endpoint)
     return self
 
   def validate_authorization_details(self, endpoint: str):
-    self.check_missing_parameter(self.authorization_details, "authorization_details", endpoint)
-    for ad in self.authorization_details:
-      AuthorizationDetail.model_validate(ad, context = {
-        CONFIG_CTX: self.get_config(),
-      })
+    if self.authorization_details:
+      for ad in self.authorization_details:
+        AuthorizationDetail.model_validate(ad, context = {
+          CONFIG_CTX: self.get_config(),
+          ENDPOINT_CTX: endpoint
+        })
 
 
   def validate_scope(self, scopes_supported: list[str], endpoint: str):
     self.scope = self.strip(self.scope)
-    self.check_missing_parameter(self.scope, "scope", endpoint)
-    scopes = self.scope.split(" ")
-    for s in scopes:
-      if s not in scopes_supported:
-        logger.error(f"invalid scope value '{s}' in `{endpoint}` endpoint")
-        raise InvalidRequestException("invalid `scope` parameter")
+    if self.scope:
+      scopes = self.scope.split(" ")
+      for s in scopes:
+        if s not in scopes_supported:
+          logger.error(f"invalid scope value '{s}' in `{endpoint}` endpoint")
+          raise InvalidRequestException("invalid `scope` parameter")
 
 
   def validate_code_challenge(self, endpoint: str):

pyeudiw/tests/openid4vci/endpoints/test_pushed_authorization_request_endpoint.py

@@ -199,13 +199,6 @@ def _mock_request_deserialized(overrides=None):
     (_mock_request_deserialized({"code_challenge_method": " "}), "missing `code_challenge_method` parameter"),
     (_mock_request_deserialized({"code_challenge_method": REMOVE}), "missing `code_challenge_method` parameter"),
     (_mock_request_deserialized({"code_challenge_method": "code_challenge_method"}), "invalid `code_challenge_method` parameter"),
-    # invalid scope
-    (_mock_request_deserialized({"scope": ""}), "missing `scope` parameter"),
-    (_mock_request_deserialized({"scope": None}), "invalid `scope` parameter"),
-    (_mock_request_deserialized({"scope": " "}), "missing `scope` parameter"),
-    (_mock_request_deserialized({"scope": REMOVE}), "missing `scope` parameter"),
-    (_mock_request_deserialized({"scope": "scope_invalid"}), "invalid `scope` parameter"),
-    (_mock_request_deserialized({"scope": "scope1 scope_invalid"}), "invalid `scope` parameter"),
     # invalid redirect_uri
     (_mock_request_deserialized({"redirect_uri": ""}), "missing `redirect_uri` parameter"),
     (_mock_request_deserialized({"redirect_uri": None}), "invalid `redirect_uri` parameter"),
@@ -222,12 +215,12 @@ def _mock_request_deserialized(overrides=None):
     (_mock_request_deserialized({"jti": REMOVE}), "missing `jti` parameter"),
     (_mock_request_deserialized({"jti": "invalid_jti"}), "invalid `jti` parameter"),
     (_mock_request_deserialized({"jti": "urn:example:wallet:12345"}), "invalid `jti` parameter"),
-    # invalid authorization_details
-    (_mock_request_deserialized({"authorization_details": ""}), "invalid `authorization_details` parameter"),
-    (_mock_request_deserialized({"authorization_details": None}), "invalid `authorization_details` parameter"),
-    (_mock_request_deserialized({"authorization_details": " "}), "invalid `authorization_details` parameter"),
-    (_mock_request_deserialized({"authorization_details": REMOVE}), "missing `authorization_details` parameter"),
-    (_mock_request_deserialized({"authorization_details": []}), "missing `authorization_details` parameter"),
+    # invalid authorization_details and scope
+    (_mock_request_deserialized({"scope": "","authorization_details": ""}), "invalid `authorization_details` parameter"),
+    (_mock_request_deserialized({"scope": None,"authorization_details": None}), "Missing `scope` and `authorization_details` in `par` endpoint"),
+    (_mock_request_deserialized({"scope": " ","authorization_details": " "}), "invalid `authorization_details` parameter"),
+    (_mock_request_deserialized({"scope": REMOVE,"authorization_details": REMOVE}), "Missing `scope` and `authorization_details` in `par` endpoint"),
+    (_mock_request_deserialized({"scope": None,"authorization_details": []}), "Missing `scope` and `authorization_details` in `par` endpoint"),
     (_mock_request_deserialized({"authorization_details": [{"type": OPEN_ID_CREDENTIAL_TYPE}]}), "missing `authorization_details.credential_configuration_id` parameter"),
     (_mock_request_deserialized({"authorization_details": [{"credential_configuration_id": "dc_sd_jwt_EuropeanDisabilityCard"}]}), "missing `authorization_details.type` parameter"),
     (_mock_request_deserialized({"authorization_details": [{"type": OPEN_ID_CREDENTIAL_TYPE, "credential_configuration_id": "invalid_credential_configuration_id"}]}), "invalid `authorization_details.credential_configuration_id` parameter"),

pyeudiw/tests/openid4vci/models/test_par_request.py

@@ -284,27 +284,6 @@ def test_invalid_code_challenge_method(value):
     with pytest.raises(InvalidRequestException, match="invalid `code_challenge_method` parameter"):
         ParRequest.model_validate(payload, context=get_valid_context())
 
-@pytest.mark.parametrize("value", ["", "  ", None])
-def test_empty_or_missing_scope(value):
-    now = int(datetime.datetime.now(datetime.timezone.utc).timestamp())
-    payload = {
-        "iss": "client-123",
-        "aud": "entity-123",
-        "state": "A" * 32,
-        "client_id": "client-123",
-        "iat": now + 29,
-        "exp": now +30,
-        "response_type": "code",
-        "response_mode": "query",
-        "code_challenge": "code_challenge_test",
-        "code_challenge_method": "S256",
-    }
-    if value is not None:
-        payload["scope"] = value
-
-    with pytest.raises(InvalidRequestException, match="missing `scope` parameter"):
-        ParRequest.model_validate(payload, context=get_valid_context())
-
 @pytest.mark.parametrize("value", ["test_0", "  test_1", "test_2", " test_3 ", "scope1, pippo"])
 def test_invalid_code_challenge_method(value):
     now = int(datetime.datetime.now(datetime.timezone.utc).timestamp())
@@ -325,28 +304,38 @@ def test_invalid_code_challenge_method(value):
     with pytest.raises(InvalidRequestException, match="invalid `scope` parameter"):
         ParRequest.model_validate(payload, context=get_valid_context())
 
-@pytest.mark.parametrize("value", [None, []])
-def test_empty_or_missing_authorization_details(value):
+
+@pytest.mark.parametrize("authorization_details, scope", [
+    ([], None),
+    (None, None),
+    (None, ""),
+    (None, " "),
+    ([], ""),
+    ([], " "),
+])
+def test_empty_or_missing_authorization_details(authorization_details, scope):
     now = int(datetime.datetime.now(datetime.timezone.utc).timestamp())
     payload = {
         "iss": "client-123",
         "aud": "entity-123",
         "state": "A" * 32,
         "client_id": "client-123",
         "iat": now + 29,
-        "exp": now +30,
+        "exp": now + 30,
         "response_type": "code",
         "response_mode": "query",
         "code_challenge": "code_challenge_test",
         "code_challenge_method": "S256",
-        "scope": "scope1",
         "redirect_uri": "https://client.example.org/cb",
         "jti": "client-123" + str(uuid4())
     }
-    if value is not None:
-        payload["authorization_details"] = value
 
-    with pytest.raises(InvalidRequestException, match="missing `authorization_details` parameter"):
+    if authorization_details is not None:
+        payload["authorization_details"] = authorization_details
+    if scope is not None:
+        payload["scope"] = scope
+
+    with pytest.raises(InvalidRequestException, match="Missing `scope` and `authorization_details` in `par` endpoint"):
         ParRequest.model_validate(payload, context=get_valid_context())
 
 @pytest.mark.parametrize("value", ["", "  ", None])