feat: add method to calculate x509 hash (#129)

Signed-off-by: Timo Glastra <timo@animo.id>

Author: TimoGlastra

.changeset/orange-needles-peel.md

@@ -0,0 +1,5 @@
+---
+"@openid4vc/openid4vp": patch
+---
+
+feat: add method to calculate x509_hash

packages/oauth2/src/Oauth2AuthorizationServer.ts

@@ -167,8 +167,11 @@ export class Oauth2AuthorizationServer {
   /**
    * Parse a pushed authorization request
    */
-  public async parsePushedAuthorizationRequest(options: ParsePushedAuthorizationRequestOptions) {
-    return await parsePushedAuthorizationRequest(options)
+  public async parsePushedAuthorizationRequest(options: Omit<ParsePushedAuthorizationRequestOptions, 'callbacks'>) {
+    return await parsePushedAuthorizationRequest({
+      ...options,
+      callbacks: this.options.callbacks,
+    })
   }
 
   /**

packages/openid4vci/tests/full-flow.test.mts

@@ -517,7 +517,6 @@ describe('Full E2E test', () => {
               method: request.method as HttpMethod,
               url: request.url,
             },
-            callbacks,
           })
 
         const verifiedParRequest = await authorizationServer.verifyPushedAuthorizationRequest({

packages/openid4vp/src/client-identifier-prefix/parse-client-identifier-prefix.ts

@@ -1,10 +1,5 @@
-import {
-  type CallbackContext,
-  HashAlgorithm,
-  Oauth2ErrorCodes,
-  Oauth2ServerErrorResponseError,
-} from '@openid4vc/oauth2'
-import { decodeBase64, encodeToBase64Url, URL, zHttpsUrl } from '@openid4vc/utils'
+import { type CallbackContext, Oauth2ErrorCodes, Oauth2ServerErrorResponseError } from '@openid4vc/oauth2'
+import { URL, zHttpsUrl } from '@openid4vc/utils'
 import type { Openid4vpAuthorizationRequest } from '../authorization-request/z-authorization-request'
 import {
   isOpenid4vpAuthorizationRequestDcApi,
@@ -14,6 +9,7 @@ import {
 import type { VerifiedJarRequest } from '../jar/handle-jar-request/verify-jar-request'
 import type { ClientMetadata } from '../models/z-client-metadata'
 import type { Openid4vpVersionNumber } from '../version'
+import { calculateX509HashClientIdPrefixValue } from './x509-hash'
 import {
   type ClientIdPrefix,
   type LegacyClientIdScheme,
@@ -507,9 +503,10 @@ export async function validateOpenid4vpClientId(
         }
       }
     } else if (clientIdPrefix === 'x509_hash') {
-      const x509Hash = encodeToBase64Url(
-        await options.callbacks.hash(decodeBase64(jar.signer.x5c[0]), HashAlgorithm.Sha256)
-      )
+      const x509Hash = await calculateX509HashClientIdPrefixValue({
+        hash: options.callbacks.hash,
+        x509Certificate: jar.signer.x5c[0],
+      })
 
       if (x509Hash !== clientIdIdentifier) {
         throw new Oauth2ServerErrorResponseError({

packages/openid4vp/src/client-identifier-prefix/x509-hash.ts

@@ -0,0 +1,21 @@
+import { type CallbackContext, HashAlgorithm } from '@openid4vc/oauth2'
+import { decodeBase64, encodeToBase64Url } from '@openid4vc/utils'
+
+export async function calculateX509HashClientIdPrefixValue({
+  x509Certificate,
+  hash,
+}: {
+  /**
+   * DER encoded x509 certificate. Either encoded as base64 or directly as Uint8Array
+   */
+  x509Certificate: string | Uint8Array
+
+  hash: CallbackContext['hash']
+}) {
+  return encodeToBase64Url(
+    await hash(
+      typeof x509Certificate === 'string' ? decodeBase64(x509Certificate) : x509Certificate,
+      HashAlgorithm.Sha256
+    )
+  )
+}

packages/openid4vp/src/index.ts

@@ -57,6 +57,7 @@ export {
   type GetOpenid4vpClientIdOptions,
   getOpenid4vpClientId,
 } from './client-identifier-prefix/parse-client-identifier-prefix'
+export { calculateX509HashClientIdPrefixValue } from './client-identifier-prefix/x509-hash'
 export { type ClientIdPrefix, zClientIdPrefix } from './client-identifier-prefix/z-client-id-prefix'
 export {
   JarmMode,