fix: openid4vci token endpoint

- fix validation scope with parsing with par request
- fix normalize token.authorization_details

Author: saralongobardiacn

pyeudiw/openid4vci/endpoints/token_endpoint.py

@@ -18,7 +18,8 @@
     TokenRequest,
     REDIRECT_URI_CTX,
     CODE_CHALLENGE_CTX,
-    CODE_CHALLENGE_METHOD_CTX
+    CODE_CHALLENGE_METHOD_CTX,
+    SCOPE_CTX
 )
 from pyeudiw.openid4vci.models.token_response import TokenResponse
 from pyeudiw.openid4vci.storage.engine import OpenId4VciEngine
@@ -79,14 +80,21 @@ def endpoint(self, context: Context):
                 CONFIG_CTX: self.config,
                 REDIRECT_URI_CTX: entity.redirect_uri,
                 CODE_CHALLENGE_METHOD_CTX: entity.code_challenge_method,
-                CODE_CHALLENGE_CTX: entity.code_challenge
+                CODE_CHALLENGE_CTX: entity.code_challenge,
+                SCOPE_CTX: entity.scope
             })
             iat = iat_now()
+            authorization_details = entity.authorization_details
+            if authorization_details or len(authorization_details) > 0:
+                for ad in authorization_details:
+                    ad.credential_identifiers = self.config_utils.get_credential_configurations_supported(
+                        ad.credential_configuration_id).scope
+
             return TokenResponse.to_created_response(
                 self._to_token(iat, entity, TokenTypsEnum.ACCESS_TOKEN_TYP),
                 self._to_token(iat, entity, TokenTypsEnum.REFRESH_TOKEN_TYP),
                 iat + self.config_utils.get_jwt().access_token_exp,
-                entity.authorization_details
+                authorization_details
             )
         except (InvalidRequestException, InvalidScopeException, JWSVerificationError, ValidationError, TypeError) as e:
             return self._handle_400(context, self._handle_validate_request_error(e, "token"), e)

pyeudiw/openid4vci/models/token_request.py

@@ -15,6 +15,7 @@
 REDIRECT_URI_CTX = "redirect_uri"
 CODE_CHALLENGE_METHOD_CTX = "code_challenge_method"
 CODE_CHALLENGE_CTX = "code_challenge"
+SCOPE_CTX = "scope"
 
 TOKEN_ENDPOINT = "token" # nosec B105
 
@@ -61,10 +62,15 @@ def validate_scope(self, is_authorization_code_grant):
       self.check_unexpected_parameter(self.scope, "scope", TOKEN_ENDPOINT)
     elif self.scope:
       scopes = self.scope.split(" ")
+      par_scope_ctx = self.get_ctx(SCOPE_CTX)
+      par_scopes = par_scope_ctx.split(" ") if par_scope_ctx is not None else None
       for s in scopes:
         if s not in self.get_config().metadata.oauth_authorization_server.scopes_supported:
           logger.error(f"invalid scope value '{s}' in `token` endpoint")
           raise InvalidRequestException(f"invalid scope value '{s}'")
+        elif par_scopes and (s not in par_scopes):
+          logger.error(f"invalid scope in `token` endpoint: value '{s}' not present in previous `par` endpoint")
+          raise InvalidRequestException(f"invalid scope value '{s}'")
 
   def validate_refresh_token(self, is_authorization_code_grant):
     self.refresh_token = self.strip(self.refresh_token)

pyeudiw/openid4vci/models/token_response.py

@@ -1,4 +1,4 @@
-from typing import List
+from typing import List, Optional
 
 from pydantic import BaseModel
 from satosa.response import Created
@@ -22,7 +22,7 @@ class TokenResponse(BaseModel):
   refresh_token: str
   token_type: str
   expires_in: int
-  authorization_details: List[AuthorizationDetail] = None
+  authorization_details: Optional[List[AuthorizationDetail]] = None
 
   @staticmethod
   def to_created_response(access_token: str, refresh_token: str, expires_in: int, authorization_details: List[AuthorizationDetail]) -> Created:
@@ -36,7 +36,9 @@ def to_created_response(access_token: str, refresh_token: str, expires_in: int,
       refresh_token=refresh_token,
       token_type="DPOP", # nosec B106
       expires_in=expires_in,
-      authorization_details=authorization_details
+      authorization_details= None
+      if not authorization_details and len(authorization_details) == 0
+      else authorization_details
     )
     return Created(
       message=data.model_dump_json(),

pyeudiw/tests/openid4vci/endpoints/test_token_endpoint.py

@@ -364,7 +364,9 @@ def _assert_valid_request(result: Response, entity: OpenId4VCIEntity, exp_access
     assert response["refresh_token"] ==  exp_refresh_token
     assert response["token_type"] == "DPOP"
     assert isinstance(response["expires_in"], int)
-    assert response["authorization_details"] == entity.authorization_details
+    assert response["authorization_details"] == None \
+        if not entity.authorization_details and len(entity.authorization_details) == 0 \
+        else entity.authorization_details
 
 def _assert_invalid_request(result: Response, error_desc: str):
     assert result.status == '400'

pyeudiw/tests/openid4vci/models/test_token_request.py

@@ -8,7 +8,7 @@
     TokenRequest,
     CODE_CHALLENGE_CTX,
     CODE_CHALLENGE_METHOD_CTX,
-    REDIRECT_URI_CTX
+    REDIRECT_URI_CTX, SCOPE_CTX
 )
 from pyeudiw.openid4vci.tools.exceptions import InvalidRequestException
 from pyeudiw.tests.openid4vci.mock_openid4vci import MOCK_PYEUDIW_FRONTEND_CONFIG
@@ -29,7 +29,8 @@ def get_valid_context(code_verifier="testverifier", redirect_uri="https://client
         CODE_CHALLENGE_CTX: code_challenge,
         CODE_CHALLENGE_METHOD_CTX: challenge_method,
         REDIRECT_URI_CTX: redirect_uri,
-        CONFIG_CTX: PyeudiwFrontendConfig(**MOCK_PYEUDIW_FRONTEND_CONFIG)
+        CONFIG_CTX: PyeudiwFrontendConfig(**MOCK_PYEUDIW_FRONTEND_CONFIG),
+        SCOPE_CTX: scopes_supported[0]
     }
 
 def test_token_request_valid_authorization_code_grant():
@@ -75,7 +76,7 @@ def test_token_request_valid_refresh_token_grant():
     payload = {
         "grant_type": "refresh_token",
         "refresh_token": "some-refresh-token",
-        "scope": "scope1 openid"
+        "scope": "scope1"
     }
     req = TokenRequest.model_validate(payload, context= get_valid_context(
         scopes_supported = ["scope1", "scope2", "openid"]