feat: dpop support

packages/core/src/modules/x509/X509ModuleConfig.ts

@@ -1,4 +1,8 @@
 export interface X509ModuleConfigOptions {
+  /**
+   *
+   * Array of trusted base64-encoded certificate strings in the DER-format.
+   */
   trustedCertificates?: [string, ...string[]]
 }
 

packages/openid4vc/package.json

@@ -27,10 +27,11 @@
   },
   "dependencies": {
     "@credo-ts/core": "workspace:*",
-    "@sphereon/did-auth-siop": "0.15.1-next.4",
-    "@sphereon/oid4vci-client": "0.15.1-next.4",
-    "@sphereon/oid4vci-common": "0.15.1-next.4",
-    "@sphereon/oid4vci-issuer": "0.15.1-next.4",
+    "@sphereon/did-auth-siop": "link:../../../../Documents/OID4VCI/packages/siop-oid4vp",
+    "@sphereon/oid4vc-common": "link:../../../../Documents/OID4VCI/packages/common",
+    "@sphereon/oid4vci-client": "link:../../../../Documents/OID4VCI/packages/client",
+    "@sphereon/oid4vci-common": "link:../../../../Documents/OID4VCI/packages/oid4vci-common",
+    "@sphereon/oid4vci-issuer": "link:../../../../Documents/OID4VCI/packages/issuer",
     "@sphereon/ssi-types": "0.26.1-next.132",
     "class-transformer": "^0.5.1",
     "rxjs": "^7.8.0"

packages/openid4vc/src/openid4vc-holder/OpenId4VcHolderApi.ts

@@ -146,11 +146,12 @@ export class OpenId4VcHolderApi {
    * @param options.code The authorization code obtained via the authorization request URI
    */
   public async requestToken(options: OpenId4VciRequestTokenOptions): Promise<OpenId4VciRequestTokenResponse> {
-    const { access_token: accessToken, c_nonce: cNonce } = await this.openId4VciHolderService.requestAccessToken(
-      this.agentContext,
-      options
-    )
-    return { accessToken, cNonce }
+    const {
+      access_token: accessToken,
+      c_nonce: cNonce,
+      dpop,
+    } = await this.openId4VciHolderService.requestAccessToken(this.agentContext, options)
+    return { accessToken, cNonce, dpop }
   }
 
   /**
@@ -160,13 +161,14 @@ export class OpenId4VcHolderApi {
    * @param options.tokenResponse Obtained through @see requestAccessToken
    */
   public async requestCredentials(options: OpenId4VciRequestCredentialOptions) {
-    const { resolvedCredentialOffer, cNonce, accessToken, ...credentialRequestOptions } = options
+    const { resolvedCredentialOffer, cNonce, accessToken, dpop, ...credentialRequestOptions } = options
 
     return this.openId4VciHolderService.acceptCredentialOffer(this.agentContext, {
       resolvedCredentialOffer,
       acceptCredentialOfferOptions: credentialRequestOptions,
       accessToken,
       cNonce,
+      dpop,
     })
   }
 

packages/openid4vc/src/openid4vc-holder/OpenId4VciHolderService.ts

@@ -1,80 +1,89 @@
 import type {
+  OpenId4VciAcceptCredentialOfferOptions,
   OpenId4VciAuthCodeFlowOptions,
-  OpenId4VciProofOfPossessionRequirements,
   OpenId4VciCredentialBindingResolver,
-  OpenId4VciResolvedCredentialOffer,
+  OpenId4VciCredentialResponse,
+  OpenId4VciNotificationEvent,
+  OpenId4VciProofOfPossessionRequirements,
   OpenId4VciResolvedAuthorizationRequest,
   OpenId4VciResolvedAuthorizationRequestWithCode,
+  OpenId4VciResolvedCredentialOffer,
   OpenId4VciSupportedCredentialFormats,
-  OpenId4VciCredentialResponse,
-  OpenId4VciNotificationEvent,
-  OpenId4VciAcceptCredentialOfferOptions,
   OpenId4VciTokenRequestOptions,
 } from './OpenId4VciHolderServiceOptions'
 import type {
-  OpenId4VciCredentialConfigurationsSupported,
   OpenId4VciCredentialConfigurationSupported,
+  OpenId4VciCredentialConfigurationsSupported,
   OpenId4VciCredentialSupported,
   OpenId4VciIssuerMetadata,
 } from '../shared'
-import type { AgentContext, JwaSignatureAlgorithm, Key, JwkJson } from '@credo-ts/core'
+import type { AgentContext, JwaSignatureAlgorithm, JwkJson, Key } from '@credo-ts/core'
 import type {
   AccessTokenResponse,
-  CredentialResponse,
-  Jwt,
-  OpenIDResponse,
   AuthorizationDetails,
   AuthorizationDetailsJwtVcJson,
-  CredentialIssuerMetadataV1_0_11,
-  CredentialIssuerMetadataV1_0_13,
   AuthorizationDetailsJwtVcJsonLdAndLdpVc,
   AuthorizationDetailsSdJwtVc,
+  CredentialIssuerMetadataV1_0_11,
+  CredentialIssuerMetadataV1_0_13,
+  CredentialResponse,
+  Jwt,
+  OpenIDResponse,
 } from '@sphereon/oid4vci-common'
 
 import {
-  SdJwtVcApi,
-  getJwkFromJson,
-  DidsApi,
   CredoError,
+  DidsApi,
   Hasher,
   InjectionSymbols,
   JsonEncoder,
+  Jwk,
   JwsService,
   Logger,
+  SdJwtVcApi,
   SignatureSuiteRegistry,
   TypedArrayEncoder,
   W3cCredentialService,
   W3cJsonLdVerifiableCredential,
   W3cJwtVerifiableCredential,
   getJwkClassFromJwaSignatureAlgorithm,
+  getJwkFromJson,
   getJwkFromKey,
   getKeyFromVerificationMethod,
   getSupportedVerificationMethodTypesFromKeyType,
   inject,
   injectable,
   parseDid,
 } from '@credo-ts/core'
+import { CreateDPoPClientOpts, SigningAlgo } from '@sphereon/oid4vc-common'
 import {
   AccessTokenClient,
   CredentialRequestClientBuilder,
-  ProofOfPossessionBuilder,
   OpenID4VCIClient,
+  OpenID4VCIClientStateV1_0_13,
   OpenID4VCIClientV1_0_11,
   OpenID4VCIClientV1_0_13,
-  OpenID4VCIClientStateV1_0_13,
+  ProofOfPossessionBuilder,
 } from '@sphereon/oid4vci-client'
-import { CodeChallengeMethod, OpenId4VCIVersion, PARMode, post } from '@sphereon/oid4vci-common'
+import {
+  CodeChallengeMethod,
+  DPoPResponseParams,
+  EndpointMetadataResult,
+  OpenId4VCIVersion,
+  PARMode,
+  post,
+} from '@sphereon/oid4vci-common'
 
 import { OpenId4VciCredentialFormatProfile } from '../shared'
 import {
-  getTypesFromCredentialSupported,
-  getOfferedCredentials,
   credentialsSupportedV11ToV13,
+  getOfferedCredentials,
+  getTypesFromCredentialSupported,
 } from '../shared/issuerMetadataUtils'
 import { OpenId4VciCredentialSupportedWithId } from '../shared/models/index'
-import { getSupportedJwaSignatureAlgorithms, isCredentialOfferV1Draft13 } from '../shared/utils'
+import { getCreateJwtCallback, getSupportedJwaSignatureAlgorithms, isCredentialOfferV1Draft13 } from '../shared/utils'
 
-import { openId4VciSupportedCredentialFormats, OpenId4VciNotificationMetadata } from './OpenId4VciHolderServiceOptions'
+import { OpenId4VciNotificationMetadata, openId4VciSupportedCredentialFormats } from './OpenId4VciHolderServiceOptions'
 
 @injectable()
 export class OpenId4VciHolderService {
@@ -266,14 +275,60 @@
     }
   }
 
+  private async getCreateDPoPOptions(
+    agentContext: AgentContext,
+    metadata: Pick<EndpointMetadataResult, 'authorizationServerMetadata'> & {
+      credentialIssuerMetadata: OpenId4VciIssuerMetadata
+    }
+  ) {
+    const dpopSigningAlgValuesSupported =
+      metadata.authorizationServerMetadata?.dpop_signing_alg_values_supported ??
+      metadata.credentialIssuerMetadata.dpop_signing_alg_values_supported
+
+    if (!dpopSigningAlgValuesSupported) return undefined
+
+    const alg = dpopSigningAlgValuesSupported.find((alg) => getJwkClassFromJwaSignatureAlgorithm(alg))
+
+    const JwkClass = alg ? getJwkClassFromJwaSignatureAlgorithm(alg) : undefined
+
+    if (!JwkClass) {
+      throw new CredoError(
+        `No supported dpop signature algorithms found in dpop_signing_alg_values_supported '${dpopSigningAlgValuesSupported.join(
+          ', '
+        )}'`
+      )
+    }
+
+    const key = await agentContext.wallet.createKey({ keyType: JwkClass.keyType })
+    const jwk = getJwkFromKey(key)
+
+    const createDPoPOpts: CreateDPoPClientOpts = {
+      jwtIssuer: { alg: alg as unknown as SigningAlgo, jwk: jwk.toJson() },
+      dPoPSigningAlgValuesSupported: dpopSigningAlgValuesSupported,
+      jwtPayloadProps: {},
+      createJwtCallback: getCreateJwtCallback(agentContext),
+    }
+    return createDPoPOpts
+  }
+
   public async requestAccessToken(agentContext: AgentContext, options: OpenId4VciTokenRequestOptions) {
     const { resolvedCredentialOffer, txCode, resolvedAuthorizationRequest, code } = options
     const { metadata, credentialOfferRequestWithBaseUrl } = resolvedCredentialOffer
 
     // acquire the access token
-    let accessTokenResponse: OpenIDResponse<AccessTokenResponse>
+    let accessTokenResponse: OpenIDResponse<AccessTokenResponse, DPoPResponseParams>
 
     const accessTokenClient = new AccessTokenClient()
+
+    const createDPoPOpts = await this.getCreateDPoPOptions(agentContext, metadata)
+
+    let dpopJwk: Jwk | undefined
+    if (createDPoPOpts) {
+      if (!createDPoPOpts.jwtIssuer.jwk.kty) {
+        throw new CredoError('Missing required key type (kty) in the jwk.')
+      }
+      dpopJwk = getJwkFromJson(createDPoPOpts.jwtIssuer.jwk as JwkJson)
+    }
     if (resolvedAuthorizationRequest) {
       const { codeVerifier, redirectUri } = resolvedAuthorizationRequest
       accessTokenResponse = await accessTokenClient.acquireAccessToken({
@@ -283,12 +338,14 @@
         code,
         codeVerifier,
         redirectUri,
+        createDPoPOpts,
       })
     } else {
       accessTokenResponse = await accessTokenClient.acquireAccessToken({
         metadata: metadata,
         credentialOffer: { credential_offer: credentialOfferRequestWithBaseUrl.credential_offer },
         pin: txCode,
+        createDPoPOpts,
       })
     }
 
@@ -300,7 +357,10 @@
 
     this.logger.debug('Requested OpenId4VCI Access Token.')
 
-    return accessTokenResponse.successBody
+    return {
+      ...accessTokenResponse.successBody,
+      ...(dpopJwk && { dpop: { dpopJwk: dpopJwk, dpopNonce: accessTokenResponse.params?.dpop?.dpopNonce } }),
+    }
   }
 
   public async acceptCredentialOffer(
@@ -311,6 +371,7 @@
       resolvedAuthorizationRequestWithCode?: OpenId4VciResolvedAuthorizationRequestWithCode
       accessToken?: string
       cNonce?: string
+      dpop?: { dpopJwk: Jwk; dpopNonce?: string }
       clientId?: string
     }
   ) {
@@ -324,7 +385,9 @@
       return []
     }
 
-    this.logger.info(`Accepting the following credential offers '${credentialsToRequest}'`)
+    this.logger.info(
+      `Accepting the following credential offers '${credentialsToRequest ? credentialsToRequest.join(', ') : 'all'}`
+    )
 
     const supportedJwaSignatureAlgorithms = getSupportedJwaSignatureAlgorithms(agentContext)
 
@@ -351,7 +414,11 @@
     } as OpenId4VciTokenRequestOptions
 
     const tokenResponse = options.accessToken
-      ? { access_token: options.accessToken, c_nonce: options.cNonce }
+      ? {
+          access_token: options.accessToken,
+          c_nonce: options.cNonce,
+          ...(options.dpop && { dpop: { dpopJwk: options.dpop.dpopJwk, dpopNonce: options.dpop?.dpopNonce } }),
+        }
       : await this.requestAccessToken(agentContext, tokenRequestOptions)
 
     const receivedCredentials: Array<OpenId4VciCredentialResponse> = []
@@ -425,10 +492,24 @@
         .withToken(tokenResponse.access_token)
 
       const credentialRequestClient = credentialRequestBuilder.build()
+
+      let createDpopOpts: CreateDPoPClientOpts | undefined
+      if (tokenResponse.dpop) {
+        const jwk = tokenResponse.dpop.dpopJwk
+        const alg = jwk.supportedSignatureAlgorithms[0]
+
+        createDpopOpts = {
+          jwtIssuer: { alg: alg as unknown as SigningAlgo, jwk: jwk.toJson() },
+          jwtPayloadProps: { accessToken: tokenResponse.access_token, nonce: tokenResponse.dpop?.dpopNonce },
+          createJwtCallback: getCreateJwtCallback(agentContext),
+        }
+      }
+
       const credentialResponse = await credentialRequestClient.acquireCredentialsUsingProof({
         proofInput: proofOfPossession,
         credentialTypes: getTypesFromCredentialSupported(offeredCredentialConfiguration),
         format: offeredCredentialConfiguration.format,
+        createDPoPOpts: createDpopOpts,
       })
 
       newCNonce = credentialResponse.successBody?.c_nonce
@@ -625,7 +706,7 @@
 
   private async handleCredentialResponse(
     agentContext: AgentContext,
-    credentialResponse: OpenIDResponse<CredentialResponse>,
+    credentialResponse: OpenIDResponse<CredentialResponse, DPoPResponseParams>,
     options: {
       verifyCredentialStatus: boolean
       credentialIssuerMetadata: OpenId4VciIssuerMetadata

packages/openid4vc/src/openid4vc-holder/OpenId4VciHolderServiceOptions.ts

@@ -4,7 +4,7 @@ import type {
   OpenId4VciIssuerMetadata,
   OpenId4VciCredentialOfferPayload,
 } from '../shared'
-import type { JwaSignatureAlgorithm, KeyType } from '@credo-ts/core'
+import type { JwaSignatureAlgorithm, Jwk, KeyType } from '@credo-ts/core'
 import type { VerifiableCredential } from '@credo-ts/core/src/modules/dif-presentation-exchange/models/index'
 import type {
   AccessTokenResponse,
@@ -42,7 +42,11 @@ export type OpenId4VciNotificationEvent = 'credential_accepted' | 'credential_fa
 
 export type OpenId4VciTokenResponse = Pick<AccessTokenResponse, 'access_token' | 'c_nonce'>
 
-export type OpenId4VciRequestTokenResponse = { accessToken: string; cNonce?: string }
+export type OpenId4VciRequestTokenResponse = {
+  accessToken: string
+  cNonce?: string
+  dpop?: { dpopJwk: Jwk; dpopNonce?: string }
+}
 
 export interface OpenId4VciCredentialResponse {
   credential: VerifiableCredential
@@ -112,6 +116,7 @@ export interface OpenId4VciCredentialRequestOptions extends Omit<OpenId4VciAccep
   resolvedCredentialOffer: OpenId4VciResolvedCredentialOffer
   accessToken: string
   cNonce?: string
+  dpop?: { dpopJwk: Jwk; dpopNonce?: string }
 
   /**
    * The client id used for authorization. Only required if authorization_code flow was used.

packages/openid4vc/src/openid4vc-issuer/OpenId4VcIssuerApi.ts

@@ -63,21 +63,22 @@ export class OpenId4VcIssuerApi {
   }
 
   public async updateIssuerMetadata(
-    options: Pick<OpenId4VcIssuerRecordProps, 'issuerId' | 'display'> &
+    options: Pick<OpenId4VcIssuerRecordProps, 'issuerId' | 'display' | 'dpopSigningAlgValuesSupported'> &
       (OpenId4VcIssuerRecordCredentialSupportedProps | OpenId4VcIssuerRecordCredentialConfigurationsSupportedProps)
   ) {
-    const issuer = await this.openId4VcIssuerService.getIssuerByIssuerId(this.agentContext, options.issuerId)
+    const { issuerId, credentialConfigurationsSupported, credentialsSupported, ...issuerOptions } = options
 
-    if (options.credentialConfigurationsSupported) {
-      issuer.credentialConfigurationsSupported = options.credentialConfigurationsSupported
-      issuer.credentialsSupported = credentialsSupportedV13ToV11(options.credentialConfigurationsSupported)
+    const issuer = await this.openId4VcIssuerService.getIssuerByIssuerId(this.agentContext, issuerId)
+
+    if (credentialConfigurationsSupported) {
+      issuer.credentialConfigurationsSupported = credentialConfigurationsSupported
+      issuer.credentialsSupported = credentialsSupportedV13ToV11(credentialConfigurationsSupported)
     } else {
-      issuer.credentialsSupported = options.credentialsSupported
+      issuer.credentialsSupported = credentialsSupported
       issuer.credentialConfigurationsSupported = undefined
     }
-    issuer.display = options.display
 
-    return this.openId4VcIssuerService.updateIssuer(this.agentContext, issuer)
+    return this.openId4VcIssuerService.updateIssuer(this.agentContext, Object.assign(issuer, issuerOptions))
   }
 
   /**