fix(openid4vci): align wallet nonce handling with 1.0

Author: szijpeter

waltid-libraries/protocols/waltid-openid4vc-wallet-server/src/main/kotlin/id/walt/wallet2/server/handlers/Wallet2RouteHandler.kt

@@ -585,6 +585,15 @@ object Wallet2RouteHandler {
                         )
                     }
 
+                    post("/request-nonce", {
+                        summary = "Isolated: obtain a fresh credential proof nonce"
+                        request { pathParameter<String>("walletId"); body<RequestNonceRequest>() }
+                        response { HttpStatusCode.OK to { body<RequestNonceResult>() } }
+                    }) {
+                        val req = call.receive<RequestNonceRequest>()
+                        call.respond(WalletIssuanceHandler.requestNonce(req))
+                    }
+
                     post("/sign-proof", {
                         summary = "Isolated: sign a proof-of-possession JWT"
                         request { pathParameter<String>("walletId"); body<SignProofRequest>() }

waltid-libraries/protocols/waltid-openid4vc-wallet/src/commonMain/kotlin/id/walt/wallet2/handlers/WalletIssuanceHandler.kt

@@ -22,6 +22,7 @@ import id.waltid.openid4vci.wallet.attestation.ClientAttestationAssembler
 import id.waltid.openid4vci.wallet.attestation.ClientAttestationHeaders
 import id.waltid.openid4vci.wallet.metadata.IssuerMetadataResolver
 import id.waltid.openid4vci.wallet.metadata.OfferedCredentialResolver
+import id.waltid.openid4vci.wallet.nonce.NonceRequestBuilder
 import id.waltid.openid4vci.wallet.oauth.ClientConfiguration
 import id.waltid.openid4vci.wallet.offer.CredentialOfferParser
 import id.waltid.openid4vci.wallet.offer.CredentialOfferResolver
@@ -169,6 +170,7 @@ data class ResolveOfferResult(
     val credentialEndpoint: Url,
     val offeredCredentials: List<String>,
     val tokenEndpoint: Url? = null,
+    val nonceEndpoint: Url? = null,
 )
 
 /**
@@ -203,14 +205,28 @@ data class RequestTokenRequest(
 @Serializable
 data class RequestTokenResult(
     val accessToken: String,
-    val cNonce: String? = null,
     val expiresIn: Long? = null
+) {
+    override fun toString(): String =
+        "RequestTokenResult(accessToken=<redacted>, expiresIn=$expiresIn)"
+}
+
+@Serializable
+data class RequestNonceRequest(
+    val credentialIssuer: Url,
 )
 
+@Serializable
+data class RequestNonceResult(
+    val nonce: String?,
+) {
+    override fun toString(): String = "RequestNonceResult(nonce=<redacted>)"
+}
+
 @Serializable
 data class SignProofRequest(
     val issuerUrl: Url,
-    val nonce: String,
+    val nonce: String? = null,
     /** Inline key to sign the proof with; takes precedence over [keyId]. */
     val key: DirectSerializedKey? = null,
     val keyId: String? = null,
@@ -273,6 +289,7 @@ data class GenerateAuthorizationUrlResult(
     val codeVerifier: String? = null,
     val credentialConfigurationId: String,
     val credentialIssuerBaseUrl: String,
+    val nonceEndpoint: Url? = null,
 )
 
 @Serializable
@@ -345,7 +362,7 @@ object WalletIssuanceHandler {
      * Builds a proof JWT, choosing DID-based binding when [did] is non-null, or JWK-inclusion
      * otherwise. Extracted to eliminate three identical `if (did != null)` proof-building blocks.
      */
-    private suspend fun JwtProofBuilder.buildProof(key: Key, issuer: String, nonce: String, did: String?) =
+    private suspend fun JwtProofBuilder.buildProof(key: Key, issuer: String, nonce: String?, did: String?) =
         if (did != null) buildJwtProof(key, issuer, nonce, keyId = did)
         else buildJwtProof(key, issuer, nonce, includeJwk = true)
 
@@ -371,6 +388,24 @@ object WalletIssuanceHandler {
          * [transactionId] should be stored and passed to [pollDeferredFlow] later.
          */
         onDeferredTransactionId: suspend (credentialConfigurationId: String, transactionId: String) -> Unit = { _, _ -> },
+    ): Flow<StoredCredential> = receiveCredentialFlowInternal(
+        wallet = wallet,
+        request = request,
+        attestationAssembler = attestationAssembler,
+        onEvent = onEvent,
+        httpClient = httpClient,
+        onDeferredTransactionId = onDeferredTransactionId,
+        allowInsecureHttpForTests = false,
+    )
+
+    private fun receiveCredentialFlowInternal(
+        wallet: Wallet,
+        request: ReceiveCredentialRequest,
+        attestationAssembler: ClientAttestationAssembler?,
+        onEvent: suspend (WalletSessionEvent) -> Unit,
+        httpClient: HttpClient,
+        onDeferredTransactionId: suspend (credentialConfigurationId: String, transactionId: String) -> Unit,
+        allowInsecureHttpForTests: Boolean,
     ): Flow<StoredCredential> = channelFlow {
         val key = wallet.resolveKey(request.key, request.keyId)
             ?: error("No key available: wallet has no keyStores, no staticKey, no inline key, and no keyId was specified")
@@ -433,25 +468,18 @@ object WalletIssuanceHandler {
             attestationHeaders = attestationHeaders,
             anonymous = anonymousPreAuthorizedCode,
         )
-        log.trace { "Token obtained, c_nonce=${tokenResponse.c_nonce}" }
+        log.trace { "Token obtained" }
         onEvent(WalletSessionEvent.issuance_token_obtained)
 
-        // 5. Fetch c_nonce
-        val cNonce = issuerMetadata.nonceEndpoint
-            ?.let { fetchCNonce(httpClient, it) }
-            ?: tokenResponse.c_nonce
-        log.trace { "Using nonce: $cNonce (from ${if (issuerMetadata.nonceEndpoint != null) "nonce endpoint" else "token response"})" }
-
         val credentialEndpoint = issuerMetadata.credentialEndpoint
         log.trace { "Credential endpoint: $credentialEndpoint" }
 
-        // 6. Issue each offered credential
+        // 5. Issue each offered credential with a fresh nonce when proof is required.
         for (offeredCredential in offeredCredentials) {
             log.trace { "Issuing credential configId=${offeredCredential.credentialConfigurationId}, format=${offeredCredential.configuration.format}" }
             val proofs = if (offeredCredential.configuration.proofTypesSupported?.isNotEmpty() == true) {
-                val nonce = cNonce
-                    ?: error("Issuer requires proof but did not provide a c_nonce")
-                log.trace { "Building proof JWT, did=$did, nonce=$nonce" }
+                val nonce = requestProofNonce(httpClient, issuerMetadata, allowInsecureHttpForTests)
+                log.trace { "Building credential proof JWT" }
                 val preferJwkBinding =
                     shouldPreferJwkBinding(offeredCredential.configuration.cryptographicBindingMethodsSupported)
                 if (did != null && !preferJwkBinding) {
@@ -460,7 +488,7 @@ object WalletIssuanceHandler {
                     proofBuilder.buildJwtProof(key, offer.credentialIssuer, nonce, includeJwk = true)
                 }
             } else null
-            log.trace { "Proof JWT present: ${proofs?.jwt?.firstOrNull()?.take(40)}..." }
+            log.trace { "Proof JWT present: ${proofs?.jwt?.isNotEmpty() == true}" }
             onEvent(WalletSessionEvent.issuance_proof_signed)
 
             // Build the credential request JSON manually to ensure proofs serializes correctly.
@@ -529,16 +557,37 @@ object WalletIssuanceHandler {
         attestationAssembler: ClientAttestationAssembler? = null,
         onEvent: suspend (WalletSessionEvent) -> Unit = {},
         httpClient: HttpClient = defaultHttpClient()
+    ): ReceiveCredentialResult = receiveCredential(
+        wallet = wallet,
+        request = request,
+        attestationAssembler = attestationAssembler,
+        onEvent = onEvent,
+        httpClient = httpClient,
+        allowInsecureHttpForTests = false,
+    )
+
+    /**
+     * Test-only variant for local issuer fixtures that cannot expose an HTTPS nonce endpoint.
+     * Production callers must use the strict overload above.
+     */
+    suspend fun receiveCredential(
+        wallet: Wallet,
+        request: ReceiveCredentialRequest,
+        attestationAssembler: ClientAttestationAssembler? = null,
+        onEvent: suspend (WalletSessionEvent) -> Unit = {},
+        httpClient: HttpClient = defaultHttpClient(),
+        allowInsecureHttpForTests: Boolean,
     ): ReceiveCredentialResult {
         val ids = mutableListOf<String>()
         val deferredIds = mutableMapOf<String, String>()
-        receiveCredentialFlow(
-            wallet,
-            request,
-            attestationAssembler,
-            onEvent,
-            httpClient,
-            onDeferredTransactionId = { configId, txId -> deferredIds[configId] = txId }
+        receiveCredentialFlowInternal(
+            wallet = wallet,
+            request = request,
+            attestationAssembler = attestationAssembler,
+            onEvent = onEvent,
+            httpClient = httpClient,
+            onDeferredTransactionId = { configId, txId -> deferredIds[configId] = txId },
+            allowInsecureHttpForTests = allowInsecureHttpForTests,
         ).collect { ids += it.id }
         return ReceiveCredentialResult(credentialIds = ids, deferredTransactionIds = deferredIds)
     }
@@ -590,6 +639,7 @@ object WalletIssuanceHandler {
                 tokenEndpoint = asMetadata.tokenEndpoint?.let { Url(it) },
                 credentialEndpoint = Url(issuerMetadata.credentialEndpoint),
                 offeredCredentials = offeredCredentials.map { it.credentialConfigurationId },
+                nonceEndpoint = issuerMetadata.nonceEndpoint?.let { Url(it) },
             ),
             offer = offer,
             issuerMetadata = issuerMetadata,
@@ -690,11 +740,19 @@ object WalletIssuanceHandler {
         )
         return RequestTokenResult(
             accessToken = tokenResponse.access_token,
-            cNonce = tokenResponse.c_nonce,
             expiresIn = tokenResponse.expires_in
         )
     }
 
+    suspend fun requestNonce(
+        request: RequestNonceRequest,
+        httpClient: HttpClient = defaultHttpClient(),
+    ): RequestNonceResult {
+        val issuerMetadata = IssuerMetadataResolver(httpClient)
+            .resolveCredentialIssuerMetadata(request.credentialIssuer.toString())
+        return RequestNonceResult(nonce = requestProofNonce(httpClient, issuerMetadata))
+    }
+
     suspend fun signProof(wallet: Wallet, request: SignProofRequest): SignProofResult {
         val key = wallet.resolveKey(request.key, request.keyId)
             ?: error("No key available for signing proof")
@@ -832,16 +890,17 @@ object WalletIssuanceHandler {
         return response
     }
 
-    private suspend fun fetchCNonce(httpClient: HttpClient, nonceEndpoint: String): String? =
-        runCatching {
-            val response = postFollowingRedirects(httpClient, nonceEndpoint) {
-                contentType(ContentType.Application.Json)
-            }
-            if (response.status.isSuccess()) {
-                response.body<JsonObject>()["c_nonce"]
-                    ?.let { (it as? JsonPrimitive)?.content }
-            } else null
-        }.getOrNull()
+    private suspend fun requestProofNonce(
+        httpClient: HttpClient,
+        issuerMetadata: CredentialIssuerMetadata,
+        allowInsecureHttpForTests: Boolean = false,
+    ): String? = issuerMetadata.nonceEndpoint
+        ?.let {
+            NonceRequestBuilder(
+                httpClient = httpClient,
+                allowInsecureHttpForTests = allowInsecureHttpForTests,
+            ).requestNonce(it).cNonce
+        }
 
     private fun shouldPreferJwkBinding(
         methods: Set<CryptographicBindingMethod>?
@@ -895,6 +954,7 @@ object WalletIssuanceHandler {
             codeVerifier = authRequest.pkceData?.codeVerifier,
             credentialConfigurationId = credentialConfigurationId,
             credentialIssuerBaseUrl = offer.credentialIssuer,
+            nonceEndpoint = issuerMetadata.nonceEndpoint?.let { Url(it) },
         )
     }
 
@@ -962,7 +1022,6 @@ object WalletIssuanceHandler {
         )
         return RequestTokenResult(
             accessToken = tokenResponse.access_token,
-            cNonce = tokenResponse.c_nonce,
             expiresIn = tokenResponse.expires_in
         )
     }
@@ -1052,6 +1111,44 @@ object WalletIssuanceHandler {
         attestationAssembler: ClientAttestationAssembler? = null,
         onEvent: suspend (WalletSessionEvent) -> Unit = {},
         httpClient: HttpClient = defaultHttpClient()
+    ): Flow<StoredCredential> = receiveCredentialAuthCodeFlow(
+        wallet = wallet,
+        code = code,
+        codeVerifier = codeVerifier,
+        credentialIssuerBaseUrl = credentialIssuerBaseUrl,
+        credentialEndpoint = credentialEndpoint,
+        credentialConfigurationId = credentialConfigurationId,
+        nonceEndpoint = nonceEndpoint,
+        clientId = clientId,
+        redirectUri = redirectUri,
+        inlineKey = inlineKey,
+        inlineDid = inlineDid,
+        attestationAssembler = attestationAssembler,
+        onEvent = onEvent,
+        httpClient = httpClient,
+        allowInsecureHttpForTests = false,
+    )
+
+    /**
+     * Test-only variant for local issuer fixtures that cannot expose an HTTPS nonce endpoint.
+     * Production callers must use the strict overload above.
+     */
+    fun receiveCredentialAuthCodeFlow(
+        wallet: Wallet,
+        code: String,
+        codeVerifier: String?,
+        credentialIssuerBaseUrl: String,
+        credentialEndpoint: Url,
+        credentialConfigurationId: String,
+        nonceEndpoint: String? = null,
+        clientId: String = DEFAULT_CLIENT_ID,
+        redirectUri: Url = Url("openid://"),
+        inlineKey: DirectSerializedKey? = null,
+        inlineDid: String? = null,
+        attestationAssembler: ClientAttestationAssembler? = null,
+        onEvent: suspend (WalletSessionEvent) -> Unit = {},
+        httpClient: HttpClient = defaultHttpClient(),
+        allowInsecureHttpForTests: Boolean,
     ): Flow<StoredCredential> = channelFlow {
         val key = wallet.resolveKey(inlineKey)
             ?: error("No key available for proof-of-possession")
@@ -1074,10 +1171,15 @@ object WalletIssuanceHandler {
         )
         onEvent(WalletSessionEvent.issuance_token_obtained)
 
-        // Sign proof — nonce from nonce endpoint or token response (never fall back to access_token)
-        val cNonce = nonceEndpoint?.let { fetchCNonce(httpClient, it) }
-            ?: tokenResult.cNonce
-            ?: error("Issuer did not provide a c_nonce (neither via nonce endpoint nor token response)")
+        // Resolve issuer metadata again at continuation time and use only its advertised nonce endpoint.
+        val issuerMetadata = IssuerMetadataResolver(httpClient)
+            .resolveCredentialIssuerMetadata(credentialIssuerBaseUrl)
+        nonceEndpoint?.let { expected ->
+            require(expected == issuerMetadata.nonceEndpoint) {
+                "Provided nonce endpoint does not match credential issuer metadata"
+            }
+        }
+        val cNonce = requestProofNonce(httpClient, issuerMetadata, allowInsecureHttpForTests)
         val proofBuilder = JwtProofBuilder()
         val proofs = proofBuilder.buildProof(key, credentialIssuerBaseUrl, cNonce, did)
         onEvent(WalletSessionEvent.issuance_proof_signed)