Ensure credential identifiers are used, if provided

src/main/kotlin/eu/europa/ec/eudi/openid4vci/Issuance.kt

@@ -160,6 +160,10 @@ fun interface RequestIssuance {
     /**
      * Places a request to the credential issuance endpoint.
      *
+     * If the [AuthorizedRequest] contains authorization details for the requested
+     * [IssuanceRequestPayload.credentialConfigurationIdentifier], then the [requestPayload] must be
+     * [IssuanceRequestPayload.IdentifierBased] and the credential identifier must be one of the authorized identifiers.
+     *
      * @param requestPayload the payload of the request
      * @param proofsSpecification the specification of proofs to be included in the request
      * @return the possibly updated [AuthorizedRequest] (if updated it will contain a fresh updated Resource-Server DPoP Nonce)

src/main/kotlin/eu/europa/ec/eudi/openid4vci/internal/RequestIssuanceImpl.kt

@@ -57,6 +57,16 @@ internal class RequestIssuanceImpl(
         requestPayload: IssuanceRequestPayload,
         proofsSpecification: ProofsSpecification,
     ): Result<AuthorizedRequestAnd<SubmissionOutcome>> = runCatchingCancellable {
+        val authorizedIdentifiers = credentialIdentifiers?.get(requestPayload.credentialConfigurationIdentifier)
+        if (!authorizedIdentifiers.isNullOrEmpty()) {
+            require(requestPayload is IssuanceRequestPayload.IdentifierBased) {
+                "Authorization detail type of openid_credential require usage of credential identifiers in credential request"
+            }
+            require(requestPayload.credentialIdentifier in authorizedIdentifiers) {
+                "Credential identifier ${requestPayload.credentialIdentifier.value} is not authorized"
+            }
+        }
+
         val (proofs, proofsDpopNonce) = buildProofs(proofsSpecification, requestPayload.credentialConfigurationIdentifier, grant)
         val credentialRequest = buildRequest(requestPayload, proofs, credentialIdentifiers.orEmpty())
 

src/test/kotlin/eu/europa/ec/eudi/openid4vci/IssuanceSingleRequestTest.kt

@@ -346,7 +346,7 @@ class IssuanceSingleRequestTest {
             CredentialConfigurationIdentifier("eu.europa.ec.eudiw.pid_vc_sd_jwt"),
             CredentialIdentifier("DUMMY"),
         )
-        assertThrows<IllegalStateException> {
+        assertThrows<IllegalArgumentException> {
             with(issuer) {
                 authorizedRequest.request(requestPayload, noKeyAttestationJwtProofsSpec(Curve.P_256, 1)).getOrThrow()
             }