feat: add support for 1.0 final for both oid4vp (was already mostly there) and OID4VCI

Author: nklomp

packages/callback-example/lib/__tests__/issuerCallback.spec.ts

@@ -169,6 +169,7 @@ describe('issuerCallback', () => {
     const nonces = new MemoryStates<CNonceState>()
     await nonces.set('test_value', { cNonce: 'test_value', createdAt: +new Date() })
     vcIssuer = new VcIssuerBuilder()
+      .withVersion(OpenId4VCIVersion.VER_1_0_15)
       .withAuthorizationServers('https://authorization-server')
       .withCredentialEndpoint('https://credential-endpoint')
       .withCredentialIssuer(IDENTIPROOF_ISSUER_URL)

packages/client/lib/CredentialRequestClient.ts

@@ -2,8 +2,10 @@ import { createDPoP, CreateDPoPClientOpts, getCreateDPoPOptions } from '@sphereo
 import {
   acquireDeferredCredential,
   AuthorizationDetailsV1_0_15,
+  AuthorizationDetailsV1_0,
   CredentialRequest,
   CredentialRequestV1_0_15,
+  CredentialRequestV1_0,
   CredentialResponse,
   DPoPResponseParams,
   ExperimentalSubjectIssuance,
@@ -20,6 +22,7 @@ import {
 import { CredentialFormat, Loggers } from '@sphereon/ssi-types'
 
 import { CredentialRequestClientBuilderV1_0_15 } from './CredentialRequestClientBuilderV1_0_15'
+import { CredentialRequestClientBuilderV1_0 } from './CredentialRequestClientBuilderV1_0'
 import { ProofOfPossessionBuilder } from './ProofOfPossessionBuilder'
 import { shouldRetryResourceRequestWithDPoPNonce } from './functions/dpopUtil'
 
@@ -32,14 +35,15 @@ export interface CredentialRequestOpts {
   notificationEndpoint?: string
   deferredCredentialEndpoint?: string
   credentialTypes?: string[]
-  credentialIdentifier?: string
+  credentialIdentifier?: string // d15: singular
+  credentialIdentifiers?: string[] // 1.0 final: array
   credentialConfigurationId?: string
   proof: ProofOfPossession
   token: string
   version: OpenId4VCIVersion
   subjectIssuance?: ExperimentalSubjectIssuance
   issuerState?: string
-  authorizationDetails?: AuthorizationDetailsV1_0_15[]
+  authorizationDetails?: (AuthorizationDetailsV1_0_15 | AuthorizationDetailsV1_0)[]
 }
 
 export type CreateCredentialRequestOpts = {
@@ -134,7 +138,7 @@ export class CredentialRequestClient {
     return this.credentialRequestOpts.deferredCredentialEndpoint
   }
 
-  public constructor(builder: CredentialRequestClientBuilderV1_0_15) {
+  public constructor(builder: CredentialRequestClientBuilderV1_0_15 | CredentialRequestClientBuilderV1_0) {
     this._credentialRequestOpts = { ...builder }
   }
 
@@ -304,41 +308,74 @@ export class CredentialRequestClient {
     })
   }
 
-  public async createCredentialRequestWithoutProof(opts: CreateCredentialRequestOpts): Promise<CredentialRequestV1_0_15> {
+  public async createCredentialRequestWithoutProof(opts: CreateCredentialRequestOpts): Promise<CredentialRequestV1_0_15 | CredentialRequestV1_0> {
     return await this.createCredentialRequestImpl(opts)
   }
 
   public async createCredentialRequest(
     opts: CreateCredentialRequestOpts & {
       proofInput: ProofOfPossessionBuilder | ProofOfPossession
     },
-  ): Promise<CredentialRequestV1_0_15> {
+  ): Promise<CredentialRequestV1_0_15 | CredentialRequestV1_0> {
     return await this.createCredentialRequestImpl(opts)
   }
 
   private async createCredentialRequestImpl(
     opts: CreateCredentialRequestOpts & {
       proofInput?: ProofOfPossessionBuilder | ProofOfPossession
     },
-  ): Promise<CredentialRequestV1_0_15> {
+  ): Promise<CredentialRequestV1_0_15 | CredentialRequestV1_0> {
     const { proofInput, credentialIdentifier, credentialConfigurationId } = opts
     let proof: ProofOfPossession | undefined = undefined
     if (proofInput) {
       proof = await buildProof(proofInput, opts)
     }
 
-    // For v15, handle authorization details from token response
-    if (this.version() >= OpenId4VCIVersion.VER_1_0_15) {
-      const authDetail = findAuthorizationDetail(this.credentialRequestOpts.authorizationDetails, credentialConfigurationId ?? credentialIdentifier)
+    const issuer_state = this.credentialRequestOpts.issuerState
+    const commonBody = {
+      ...(issuer_state && { issuer_state }),
+      ...(proof && { proof }),
+      ...opts.subjectIssuance,
+    }
 
-      const issuer_state = this.credentialRequestOpts.issuerState
+    // 1.0 final: credential_configuration_id is REQUIRED, credential_identifiers is OPTIONAL array
+    if (this.version() >= OpenId4VCIVersion.VER_1_0) {
+      const authDetail = findAuthorizationDetail(
+        this.credentialRequestOpts.authorizationDetails as AuthorizationDetailsV1_0_15[],
+        credentialConfigurationId ?? credentialIdentifier,
+      )
+      const authDetailObj = authDetail && typeof authDetail === 'object' ? (authDetail as any) : null
 
-      const commonBody = {
-        ...(issuer_state && { issuer_state }),
-        ...(proof && { proof }),
-        ...opts.subjectIssuance,
+      const configId =
+        credentialConfigurationId ?? authDetailObj?.credential_configuration_id ?? this._credentialRequestOpts.credentialConfigurationId
+
+      if (!configId) {
+        return Promise.reject(Error('credential_configuration_id is required for 1.0 final credential request'))
       }
 
+      // Build credential_identifiers array from various sources
+      const identifiers: string[] | undefined =
+        this._credentialRequestOpts.credentialIdentifiers ??
+        (authDetailObj?.credential_identifiers && authDetailObj.credential_identifiers.length > 0
+          ? authDetailObj.credential_identifiers
+          : credentialIdentifier
+            ? [credentialIdentifier]
+            : undefined)
+
+      const request: CredentialRequestV1_0 = {
+        credential_configuration_id: configId,
+        ...(identifiers && identifiers.length > 0 && { credential_identifiers: identifiers }),
+        ...commonBody,
+      }
+      return request
+    }
+
+    // Draft 15: credential_identifier (singular) OR credential_configuration_id
+    if (this.version() >= OpenId4VCIVersion.VER_1_0_15) {
+      const authDetail = findAuthorizationDetail(
+        this.credentialRequestOpts.authorizationDetails as AuthorizationDetailsV1_0_15[],
+        credentialConfigurationId ?? credentialIdentifier,
+      )
       const authDetailObj = authDetail && typeof authDetail === 'object' ? (authDetail as any) : null
 
       if (authDetailObj?.credential_identifier) {
@@ -374,7 +411,6 @@ export class CredentialRequestClient {
       return Promise.reject(Error('No credential_identifier or credential_configuration_id available for v1.0-15 request'))
     }
 
-    // Since you only support V15+, this should never execute
     throw new Error(`Unsupported version: ${this.version()}`)
   }
 

packages/client/lib/CredentialRequestClientBuilder.ts

@@ -5,20 +5,26 @@ import {
   CredentialOfferRequestWithBaseUrl,
   EndpointMetadata,
   EndpointMetadataResultV1_0_15,
+  EndpointMetadataResultV1_0,
   ExperimentalSubjectIssuance,
   OpenId4VCIVersion,
   UniformCredentialOfferRequest,
 } from '@sphereon/oid4vci-common'
 
 import { CredentialOfferClient } from './CredentialOfferClient'
 import { CredentialRequestClientBuilderV1_0_15 } from './CredentialRequestClientBuilderV1_0_15'
+import { CredentialRequestClientBuilderV1_0 } from './CredentialRequestClientBuilderV1_0'
 
-type CredentialRequestClientBuilderVersionSpecific = CredentialRequestClientBuilderV1_0_15
+type CredentialRequestClientBuilderVersionSpecific = CredentialRequestClientBuilderV1_0_15 | CredentialRequestClientBuilderV1_0
 
 function isV1_0_15(builder: CredentialRequestClientBuilderVersionSpecific): builder is CredentialRequestClientBuilderV1_0_15 {
   return (builder as CredentialRequestClientBuilderV1_0_15).withCredentialIdentifier !== undefined
 }
 
+function isV1_0(builder: CredentialRequestClientBuilderVersionSpecific): builder is CredentialRequestClientBuilderV1_0 {
+  return (builder as CredentialRequestClientBuilderV1_0).withCredentialIdentifiers !== undefined
+}
+
 export class CredentialRequestClientBuilder {
   private _builder: CredentialRequestClientBuilderVersionSpecific
 
@@ -31,26 +37,35 @@ export class CredentialRequestClientBuilder {
     metadata,
     version,
     credentialIdentifier,
+    credentialIdentifiers,
     credentialTypes,
   }: {
     credentialIssuer: string
     metadata?: EndpointMetadata
     version?: OpenId4VCIVersion
     credentialIdentifier?: string
+    credentialIdentifiers?: string[]
     credentialTypes?: string | string[]
   }): CredentialRequestClientBuilder {
-    // const specVersion = version ?? OpenId4VCIVersion.VER_1_0_15
-    let builder
-    const metadataV15 = metadata as EndpointMetadataResultV1_0_15
-    //  if (specVersion >= OpenId4VCIVersion.VER_1_0_15) {
-    builder = CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
-      credentialIssuer,
-      metadata: metadataV15,
-      version,
-      credentialIdentifier,
-      credentialTypes,
-    })
-    //  }
+    const specVersion = version ?? OpenId4VCIVersion.VER_1_0
+    let builder: CredentialRequestClientBuilderVersionSpecific
+    if (specVersion >= OpenId4VCIVersion.VER_1_0) {
+      builder = CredentialRequestClientBuilderV1_0.fromCredentialIssuer({
+        credentialIssuer,
+        metadata: metadata as EndpointMetadataResultV1_0,
+        version: specVersion,
+        credentialIdentifiers: credentialIdentifiers ?? (credentialIdentifier ? [credentialIdentifier] : undefined),
+        credentialTypes,
+      })
+    } else {
+      builder = CredentialRequestClientBuilderV1_0_15.fromCredentialIssuer({
+        credentialIssuer,
+        metadata: metadata as EndpointMetadataResultV1_0_15,
+        version: specVersion,
+        credentialIdentifier,
+        credentialTypes,
+      })
+    }
 
     return new CredentialRequestClientBuilder(builder)
   }
@@ -138,7 +153,21 @@ export class CredentialRequestClientBuilder {
     if (this._builder.version === undefined || this._builder.version < OpenId4VCIVersion.VER_1_0_15) {
       throw new Error('Version of spec should be equal or higher than v1_0_15')
     }
-    ;(this._builder as CredentialRequestClientBuilderV1_0_15).withCredentialIdentifier(credentialIdentifier)
+    if (isV1_0(this._builder)) {
+      this._builder.withCredentialIdentifiers([credentialIdentifier])
+    } else if (isV1_0_15(this._builder)) {
+      this._builder.withCredentialIdentifier(credentialIdentifier)
+    }
+    return this
+  }
+
+  public withCredentialIdentifiers(credentialIdentifiers: string[]): this {
+    if (isV1_0(this._builder)) {
+      this._builder.withCredentialIdentifiers(credentialIdentifiers)
+    } else if (isV1_0_15(this._builder) && credentialIdentifiers.length > 0) {
+      // d15 only supports singular, use the first one
+      this._builder.withCredentialIdentifier(credentialIdentifiers[0])
+    }
     return this
   }