Merge pull request #1966 from walt-id/fix/error-responses-encryption

chsavvaidis · web-flow · commit f4b663bb8ae7 · 2026-07-23T13:28:53.000+02:00
Fix/error responses encryption
diff --git a/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/dpop/DefaultDPoPProofVerifier.kt b/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/dpop/DefaultDPoPProofVerifier.kt
@@ -7,7 +7,6 @@ import id.walt.crypto.utils.ShaUtils
 import id.walt.openid4vci.tokens.jwt.JwtHeaderParams
 import id.walt.openid4vci.tokens.jwt.JwtPayloadClaims
 import io.ktor.http.Url
-import io.ktor.http.encodedPath
 import kotlinx.serialization.json.JsonArray
 import kotlinx.serialization.json.JsonObject
 import kotlinx.serialization.json.JsonPrimitive
diff --git a/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/handlers/credential/SdJwtVcCredentialSigner.kt b/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/handlers/credential/SdJwtVcCredentialSigner.kt
@@ -114,7 +114,8 @@ object SdJwtVcCredentialSigner {
 
 
         val extraClaims = sdJwtCredentialClaims ?: emptyMap()
-        val undisclosedPayload = sdPayload.undisclosedPayload.plus(defaultPayloadProperties).plus(extraClaims).let { JsonObject(it) }
+        val undisclosedPayload =
+            sdPayload.undisclosedPayload.plus(defaultPayloadProperties).plus(extraClaims).let { JsonObject(it) }
 
         val fullPayload = sdPayload.fullPayload.plus(defaultPayloadProperties).plus(extraClaims).let { JsonObject(it) }
 
@@ -124,7 +125,9 @@ object SdJwtVcCredentialSigner {
             JWT_HEADER_KID to getKidHeader(issuerKey, issuerDid),
             JWT_HEADER_TYPE to (sdJwtTypeHeader ?: SD_JWT_VC_TYPE_HEADER)
         ).plus(x5Chain?.let {
-            mapOf(JWT_HEADER_X5C to JsonArray(it.map { cert -> cert.bytes.toByteArray().encodeToBase64().toJsonElement() }))
+            mapOf(JWT_HEADER_X5C to JsonArray(it.map { cert ->
+                cert.bytes.toByteArray().encodeToBase64().toJsonElement()
+            }))
         } ?: mapOf())
 
         val finalSdPayload = SDPayload.createSDPayload(
diff --git a/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/handlers/credential/W3cJwtVcCredentialSigner.kt b/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/handlers/credential/W3cJwtVcCredentialSigner.kt
@@ -49,7 +49,11 @@ object W3cJwtVcCredentialSigner {
             if (!holderKid.isNullOrEmpty() && DidUtils.isDidUrl(holderKid)) holderKid.substringBefore("#") else null
 
         val additionalJwtHeaders = x5Chain?.let {
-            mapOf(JWT_HEADER_X5C to JsonArray(it.map { cert -> JsonPrimitive(cert.bytes.toByteArray().encodeToBase64()) }))
+            mapOf(JWT_HEADER_X5C to JsonArray(it.map { cert ->
+                JsonPrimitive(
+                    cert.bytes.toByteArray().encodeToBase64()
+                )
+            }))
         } ?: mapOf()
 
         val vcPayload = credentialStatus?.let { status ->
diff --git a/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/handlers/granttypes/authorizationcode/AuthorizationCodeAuthorizationEndpoint.kt b/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/handlers/granttypes/authorizationcode/AuthorizationCodeAuthorizationEndpoint.kt
@@ -1,4 +1,3 @@
-
 package id.walt.openid4vci.handlers.granttypes.authorizationcode
 
 import id.walt.crypto.utils.Base64Utils.encodeToBase64Url
diff --git a/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/requests/authorization/AuthorizationRequest.kt b/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/requests/authorization/AuthorizationRequest.kt
@@ -36,4 +36,4 @@ interface AuthorizationRequest {
     fun withAuthenticatedClient(authenticatedClient: AuthenticatedClient?): AuthorizationRequest
     fun didHandleAllResponseTypes(): Boolean =
         responseTypes.isNotEmpty() && responseTypes.all { handledResponseTypes.contains(it) }
-}
+}
diff --git a/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/requests/authorization/DefaultAuthorizationRequest.kt b/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/requests/authorization/DefaultAuthorizationRequest.kt
@@ -44,4 +44,4 @@ data class DefaultAuthorizationRequest(
 
     override fun withAuthenticatedClient(authenticatedClient: AuthenticatedClient?): AuthorizationRequest =
         copy(authenticatedClient = authenticatedClient)
-}
+}
diff --git a/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/validation/DefaultAccessRequestValidator.kt b/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/validation/DefaultAccessRequestValidator.kt
diff --git a/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/validation/DefaultAccessTokenRequestValidator.kt b/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/validation/DefaultAccessTokenRequestValidator.kt
@@ -157,4 +157,4 @@ class DefaultAccessTokenRequestValidator : AccessTokenRequestValidator {
 
         return AccessTokenRequestResult.Success(request)
     }
-}
+}
diff --git a/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/validation/DefaultAuthorizationRequestValidator.kt b/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/validation/DefaultAuthorizationRequestValidator.kt
@@ -83,4 +83,4 @@ class DefaultAuthorizationRequestValidator(
             )
         }
     }
-}
+}
diff --git a/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/validation/DefaultAuthorizeRequestValidator.kt b/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/validation/DefaultAuthorizeRequestValidator.kt
diff --git a/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/validation/DefaultCredentialRequestValidator.kt b/waltid-libraries/protocols/waltid-openid4vci/src/commonMain/kotlin/id/walt/openid4vci/validation/DefaultCredentialRequestValidator.kt
@@ -38,14 +38,7 @@ class DefaultCredentialRequestValidator : CredentialRequestValidator {
             }
 
             // OpenID4VCI: credential_response_encryption is an optional JSON object.
-            val credentialResponseEncryption =
-                parameters.optionalSingle("credential_response_encryption")?.takeIf { it.isNotBlank() }?.let { value ->
-                    val trimmed = value.trim()
-                    if (!trimmed.startsWith("{")) {
-                        throw IllegalArgumentException("credential_response_encryption must be a JSON object")
-                    }
-                    CredentialResponseEncryptionParameters.fromJsonObject(Json.parseToJsonElement(trimmed).jsonObject)
-                }
+            val credentialResponseEncryption = parseCredentialResponseEncryption(parameters)
 
             // OAuth2: client_id is not required at the credential endpoint (access token authenticates the client).
             val clientId = parameters.optionalSingle("client_id")?.takeIf { it.isNotBlank() } ?: ""
@@ -68,10 +61,36 @@ class DefaultCredentialRequestValidator : CredentialRequestValidator {
             )
 
             CredentialRequestResult.Success(request)
+        } catch (e: InvalidCredentialResponseEncryptionParameters) {
+            CredentialRequestResult.Failure(
+                CredentialError(CredentialErrorCodes.INVALID_ENCRYPTION_PARAMETERS, e.message)
+            )
         } catch (e: SerializationException) {
             CredentialRequestResult.Failure(CredentialError(CredentialErrorCodes.INVALID_CREDENTIAL_REQUEST, e.message))
         } catch (e: IllegalArgumentException) {
             CredentialRequestResult.Failure(CredentialError(CredentialErrorCodes.INVALID_CREDENTIAL_REQUEST, e.message))
         }
     }
 }
+
+private fun parseCredentialResponseEncryption(
+    parameters: Map<String, List<String>>,
+): CredentialResponseEncryptionParameters? =
+    try {
+        parameters.optionalSingle("credential_response_encryption")?.takeIf { it.isNotBlank() }?.let { value ->
+            val trimmed = value.trim()
+            if (!trimmed.startsWith("{")) {
+                throw IllegalArgumentException("credential_response_encryption must be a JSON object")
+            }
+            CredentialResponseEncryptionParameters.fromJsonObject(Json.parseToJsonElement(trimmed).jsonObject)
+        }
+    } catch (e: SerializationException) {
+        throw InvalidCredentialResponseEncryptionParameters(e.message, e)
+    } catch (e: IllegalArgumentException) {
+        throw InvalidCredentialResponseEncryptionParameters(e.message, e)
+    }
+
+private class InvalidCredentialResponseEncryptionParameters(
+    message: String?,
+    cause: Throwable,
+) : IllegalArgumentException(message, cause)
diff --git a/waltid-libraries/protocols/waltid-openid4vci/src/jvmTest/kotlin/id/walt/openid4vci/responses/credential/encryption/CredentialEndpointEncryptionTest.kt b/waltid-libraries/protocols/waltid-openid4vci/src/jvmTest/kotlin/id/walt/openid4vci/responses/credential/encryption/CredentialEndpointEncryptionTest.kt
@@ -98,6 +98,72 @@ class CredentialEndpointEncryptionTest {
         assertEquals(response.toJsonObject(), parts.payload)
     }
 
+    @Test
+    fun `encrypted credential request accepts response encryption JWK without kid`() = runBlocking {
+        val issuerKey = JWKKey.generate(KeyType.secp256r1, JwkKeyMeta("issuer-key"))
+        val walletKey = JWKKey.generate(KeyType.secp256r1, JwkKeyMeta("wallet-key"))
+        val provider = buildOAuth2Provider(
+            createTestConfig(
+                credentialRequestDecryptor = JweCredentialRequestDecryptor(issuerKey.exportJWK()),
+            )
+        )
+
+        val credentialRequestJwe = encryptCredentialRequest(
+            payload = buildJsonObject {
+                put("credential_configuration_id", "test-credential")
+                put("credential_response_encryption", responseEncryptionRequest(walletKey, includeKid = false))
+            },
+            issuerKey = issuerKey,
+        )
+
+        val requestResult = provider.createCredentialRequest(
+            encryptedCredentialRequest = credentialRequestJwe,
+            session = DefaultSession(subject = "subject"),
+        )
+
+        assertTrue(requestResult is CredentialRequestResult.Success)
+        assertNull(requestResult.request.credentialResponseEncryption?.jwk?.get("kid"))
+        assertEquals(CredentialEncryptionProfile.ALG_ECDH_ES, requestResult.request.credentialResponseEncryption?.alg)
+    }
+
+    @Test
+    fun `encrypted credential request rejects unsupported response encryption alg`() = runBlocking {
+        val issuerKey = JWKKey.generate(KeyType.secp256r1, JwkKeyMeta("issuer-key"))
+        val walletKey = JWKKey.generate(KeyType.secp256r1, JwkKeyMeta("wallet-key"))
+        val provider = buildOAuth2Provider(
+            createTestConfig(
+                credentialRequestDecryptor = JweCredentialRequestDecryptor(issuerKey.exportJWK()),
+            )
+        )
+
+        val credentialRequestJwe = encryptCredentialRequest(
+            payload = buildJsonObject {
+                put("credential_configuration_id", "test-credential")
+                put(
+                    "credential_response_encryption",
+                    responseEncryptionRequest(
+                        walletKey = walletKey,
+                        includeKid = false,
+                        alg = "UNSUPPORTED_ALG",
+                    ),
+                )
+            },
+            issuerKey = issuerKey,
+        )
+
+        val requestResult = provider.createCredentialRequest(
+            encryptedCredentialRequest = credentialRequestJwe,
+            session = DefaultSession(subject = "subject"),
+        )
+
+        assertTrue(requestResult is CredentialRequestResult.Failure)
+        assertEquals(CredentialErrorCodes.INVALID_ENCRYPTION_PARAMETERS, requestResult.error.error)
+        assertEquals(
+            "credential_response_encryption.jwk.alg must be ${CredentialEncryptionProfile.ALG_ECDH_ES}",
+            requestResult.error.description,
+        )
+    }
+
     @Test
     fun `encrypted credential response omits kid when wallet JWK has no kid`() = runBlocking {
         val walletKey = JWKKey.generate(KeyType.secp256r1, JwkKeyMeta("wallet-key"))
@@ -180,13 +246,21 @@ class CredentialEndpointEncryptionTest {
         )
     }
 
-    private suspend fun responseEncryptionRequest(walletKey: JWKKey): JsonObject =
+    private suspend fun responseEncryptionRequest(
+        walletKey: JWKKey,
+        includeKid: Boolean = true,
+        alg: String = CredentialEncryptionProfile.ALG_ECDH_ES,
+    ): JsonObject =
         buildJsonObject {
-            put("jwk", encryptionPublicJwk(walletKey))
+            put("jwk", encryptionPublicJwk(walletKey, includeKid = includeKid, alg = alg))
             put("enc", CredentialEncryptionProfile.ENC_A128GCM)
         }
 
-    private suspend fun encryptionPublicJwk(key: Key, includeKid: Boolean = true): JsonObject =
+    private suspend fun encryptionPublicJwk(
+        key: Key,
+        includeKid: Boolean = true,
+        alg: String = CredentialEncryptionProfile.ALG_ECDH_ES,
+    ): JsonObject =
         JsonObject(
             key.getPublicKey().exportJWKObject().toMutableMap().apply {
                 if (includeKid) {
@@ -195,7 +269,7 @@ class CredentialEndpointEncryptionTest {
                     remove("kid")
                 }
                 put("use", JsonPrimitive(CredentialEncryptionProfile.KEY_USE_ENC))
-                put("alg", JsonPrimitive(CredentialEncryptionProfile.ALG_ECDH_ES))
+                put("alg", JsonPrimitive(alg))
             }
         )
 }
diff --git a/waltid-services/waltid-issuer-api2/src/main/kotlin/id/walt/issuer2/controller/openapi/Issuer2RequestExamples.kt b/waltid-services/waltid-issuer-api2/src/main/kotlin/id/walt/issuer2/controller/openapi/Issuer2RequestExamples.kt
@@ -198,7 +198,7 @@ object Issuer2RequestExamples {
         authMethod = AuthenticationMethod.AUTHORIZED,
         issuerStateMode = IssuerStateMode.INCLUDE,
         expiresAt = EXAMPLE_EXPIRES_AT,
-        credentialOffer = byValueAuthorizationOfferUrl(issuerState = EXAMPLE_OFFER_ID),
+        credentialOffer = byValueAuthorizationOfferUrl(),
     )
 
     val CREDENTIAL_OFFER_RESPONSE_BY_VALUE_WITH_ISSUER_STATE = CredentialOfferCreateResponse(
@@ -207,7 +207,7 @@ object Issuer2RequestExamples {
         authMethod = AuthenticationMethod.AUTHORIZED,
         issuerStateMode = IssuerStateMode.INCLUDE,
         expiresAt = EXAMPLE_EXPIRES_AT,
-        credentialOffer = byValueAuthorizationOfferUrl(issuerState = EXAMPLE_OFFER_ID),
+        credentialOffer = byValueAuthorizationOfferUrl(),
     )
 
     val PRE_AUTHORIZED_CREDENTIAL_OFFER_RESPONSE_WITH_GENERATED_TX_CODE = CredentialOfferCreateResponse(
@@ -237,7 +237,7 @@ object Issuer2RequestExamples {
             credentialOfferUri = "$EXAMPLE_CREDENTIAL_ISSUER/credential-offer?id=$EXAMPLE_OFFER_ID",
         ).toUrl()
 
-    private fun byValueAuthorizationOfferUrl(issuerState: String? = null): String =
+    private fun byValueAuthorizationOfferUrl(issuerState: String? = EXAMPLE_OFFER_ID): String =
         CredentialOfferRequest(
             credentialOffer = CredentialOffer.withAuthorizationCodeGrant(
                 credentialIssuer = EXAMPLE_CREDENTIAL_ISSUER,
diff --git a/waltid-services/waltid-issuer-api2/src/main/kotlin/id/walt/issuer2/service/openid4vci/ExternalLoginAuthorizationParameters.kt b/waltid-services/waltid-issuer-api2/src/main/kotlin/id/walt/issuer2/service/openid4vci/ExternalLoginAuthorizationParameters.kt
@@ -1,7 +1,5 @@
 package id.walt.issuer2.service.openid4vci
 
-import kotlinx.serialization.decodeFromString
-import kotlinx.serialization.encodeToString
 import kotlinx.serialization.json.Json
 import kotlin.io.encoding.Base64
 
diff --git a/waltid-services/waltid-issuer-api2/src/main/kotlin/id/walt/issuer2/service/openid4vci/OpenId4VciProtocolService.kt b/waltid-services/waltid-issuer-api2/src/main/kotlin/id/walt/issuer2/service/openid4vci/OpenId4VciProtocolService.kt
@@ -10,13 +10,6 @@ import id.walt.issuer2.notifications.IssuanceSessionEvent
 import id.walt.issuer2.service.CredentialProfileService
 import id.walt.issuer2.service.IssuanceSessionService
 import id.walt.issuer2.utils.JsonObjectPathMapper
-import id.walt.mdoc.dataelement.DataElement
-import id.walt.mdoc.dataelement.MapElement
-import id.walt.mdoc.dataelement.MapKey
-import id.walt.mdoc.dataelement.NumberElement
-import id.walt.mdoc.dataelement.StringElement
-import id.walt.mdoc.doc.MDoc
-import id.walt.mdoc.issuersigned.IssuerSigned
 import id.walt.openid4vci.CredentialFormat
 import id.walt.openid4vci.DefaultSession
 import id.walt.openid4vci.errors.CredentialError
@@ -330,7 +323,10 @@ class OpenId4VciProtocolService(
         } catch (e: CancellationException) {
             throw e
         } catch (e: Exception) {
-            return oauth2Provider.writeCredentialError(credentialRequest, OAuthError(OAuthErrorCodes.INVALID_TOKEN, e.message))
+            return oauth2Provider.writeCredentialError(
+                credentialRequest,
+                OAuthError(OAuthErrorCodes.INVALID_TOKEN, e.message)
+            )
         }
 
         val sessionId = tokenClaims.stringClaim("sub")
@@ -411,12 +407,14 @@ class OpenId4VciProtocolService(
                         put("credentialStatus", status)
                     })
                 }
+
                 CredentialFormat.SD_JWT_VC -> {
                     // For SD-JWT VC, inject status at root level (as "status" claim)
                     JsonObject(session.credentialData.toMutableMap().apply {
                         put("status", status)
                     })
                 }
+
                 else -> session.credentialData
             }
         } ?: session.credentialData
@@ -719,10 +717,14 @@ class OpenId4VciProtocolService(
             val uri = statusList["uri"]?.jsonPrimitive?.content
                 ?: return null
 
-            MdocStatus(statusList = MdocStatusListInfo(index = idx, uri = id.walt.mdoc.objects.mso.UniformResourceIdentifier(uri)))
+            MdocStatus(
+                statusList = MdocStatusListInfo(
+                    index = idx,
+                    uri = id.walt.mdoc.objects.mso.UniformResourceIdentifier(uri)
+                )
+            )
         } catch (e: Exception) {
             null
         }
     }
-
 }
diff --git a/waltid-services/waltid-issuer-api2/src/test/kotlin/id/walt/issuer2/Issuer2DevModeConfigTest.kt b/waltid-services/waltid-issuer-api2/src/test/kotlin/id/walt/issuer2/Issuer2DevModeConfigTest.kt
@@ -34,7 +34,7 @@ class Issuer2DevModeConfigTest {
 
     @Test
     fun devModeConfigMatchesIssuer1DevelopmentDefaults() {
-        System.setProperty("config.file.dev-mode", issuer2ConfigFile("dev-mode.conf").toString())
+        System.setProperty("config.file.dev-mode", issuer2ConfigFile().toString())
 
         ConfigManager.registerConfig("dev-mode", DevModeConfig::class)
         ConfigManager.loadConfigs()
@@ -43,7 +43,7 @@ class Issuer2DevModeConfigTest {
         assertFalse(devModeConfig.enableDidWebResolverHttps)
     }
 
-    private fun issuer2ConfigFile(fileName: String): Path =
+    private fun issuer2ConfigFile(fileName: String = "dev-mode.conf"): Path =
         listOf(
             Path.of("config"),
             Path.of("waltid-services/waltid-issuer-api2/config"),
diff --git a/waltid-services/waltid-issuer-api2/src/test/kotlin/id/walt/issuer2/profile/Issuer2ProfileEndpointTest.kt b/waltid-services/waltid-issuer-api2/src/test/kotlin/id/walt/issuer2/profile/Issuer2ProfileEndpointTest.kt
@@ -471,7 +471,7 @@ class Issuer2ProfileEndpointTest {
     }
 
     private fun assertNoUnresolvedString(context: String, value: String) {
-        assertFalse(value.contains("\${"), "Expected $context to have resolved HOCON substitutions, got: $value")
+        assertFalse(value.contains($$"${"), "Expected $context to have resolved HOCON substitutions, got: $value")
     }
 
     private data class SdJwtProfileExpectation(

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,3 @@`
`1`		`-`
`2`	`1`	`package id.walt.openid4vci.handlers.granttypes.authorizationcode`
`3`	`2`
`4`	`3`	`import id.walt.crypto.utils.Base64Utils.encodeToBase64Url`
Original file line number	Diff line number	Diff line change
`@@ -157,4 +157,4 @@ class DefaultAccessTokenRequestValidator : AccessTokenRequestValidator {`
`157`	`157`
`158`	`158`	`return AccessTokenRequestResult.Success(request)`
`159`	`159`	`}`
`160`		`-}`
	`160`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -83,4 +83,4 @@ class DefaultAuthorizationRequestValidator(`
`83`	`83`	`)`
`84`	`84`	`}`
`85`	`85`	`}`
`86`		`-}`
	`86`	`+}`