fix: allow to pass skew in seconds for wallet attestation (#204)

Signed-off-by: Mirko Mollik <mirko.mollik@eudi.sprind.org>

Author: cre8

.changeset/nine-spiders-cheat.md

@@ -0,0 +1,6 @@
+---
+"@openid4vc/openid4vp": minor
+"@openid4vc/oauth2": minor
+---
+
+Pass allowedSkewInSeconds to verifyClientAttestation and verifyAttestationJWT functions, and deprecate clockSkewSec in favor of allowedSkewInSeconds for better naming consistency.

packages/oauth2/src/client-attestation/client-attestation-pop.ts

@@ -88,6 +88,14 @@ export interface VerifyClientAttestationPopJwtOptions {
    */
   now?: Date
 
+  /**
+   * Allowed skew time in seconds for validity of token. Used for `exp` and `nbf`
+   * verification.
+   *
+   * @default 0
+   */
+  allowedSkewInSeconds?: number
+
   /**
    * Callbacks used for verifying client attestation pop jwt.
    */
@@ -130,6 +138,7 @@ export async function verifyClientAttestationPopJwt(options: VerifyClientAttesta
     compact: options.clientAttestationPopJwt,
     verifyJwtCallback: options.callbacks.verifyJwt,
     errorMessage: 'client attestation pop jwt verification failed',
+    allowedSkewInSeconds: options.allowedSkewInSeconds,
   })
 
   return {

packages/oauth2/src/client-attestation/client-attestation.ts

@@ -27,6 +27,14 @@ export interface VerifyClientAttestationJwtOptions {
    */
   now?: Date
 
+  /**
+   * Allowed skew time in seconds for validity of token. Used for `exp` and `nbf`
+   * verification.
+   *
+   * @default 0
+   */
+  allowedSkewInSeconds?: number
+
   /**
    * Callbacks used for verifying client attestation pop jwt.
    */
@@ -167,6 +175,14 @@ export interface VerifyClientAttestationOptions {
    * Date to use for expiration. If not provided current date will be used.
    */
   now?: Date
+
+  /**
+   * Allowed skew time in seconds for validity of token. Used for `exp` and `nbf`
+   * verification.
+   *
+   * @default 0
+   */
+  allowedSkewInSeconds?: number
 }
 
 export async function verifyClientAttestation({
@@ -175,12 +191,14 @@ export async function verifyClientAttestation({
   clientAttestationPopJwt,
   callbacks,
   now,
+  allowedSkewInSeconds,
 }: VerifyClientAttestationOptions) {
   try {
     const clientAttestation = await verifyClientAttestationJwt({
       callbacks,
       clientAttestationJwt,
       now,
+      allowedSkewInSeconds,
     })
 
     const clientAttestationPop = await verifyClientAttestationPopJwt({
@@ -189,6 +207,7 @@ export async function verifyClientAttestation({
       clientAttestation,
       clientAttestationPopJwt,
       now,
+      allowedSkewInSeconds,
     })
 
     return {

packages/openid4vp/src/client-identifier-prefix/validate-verifier-attestation-jwt.ts

@@ -45,15 +45,10 @@ export async function verifyAttestation(options: VerifyAttestationOptions) {
 export interface VerifyAttestationJwtOptions {
   attestationJwt: string
   clientId: string
-  clockSkewSec?: number
+  allowedSkewInSeconds?: number
   callbacks: Pick<CallbackContext, 'verifyJwt'>
 }
-export async function verifyAttestationJWT(options: {
-  attestationJwt: string
-  clientId: string
-  clockSkewSec?: number
-  callbacks: Pick<CallbackContext, 'verifyJwt'>
-}) {
+export async function verifyAttestationJWT(options: VerifyAttestationJwtOptions) {
   const errors = []
 
   const { header, payload } = decodeJwt({
@@ -70,7 +65,7 @@ export async function verifyAttestationJWT(options: {
     verifyJwtCallback: options.callbacks.verifyJwt,
     now: new Date(),
     expectedSubject: options.clientId,
-    allowedSkewInSeconds: options.clockSkewSec || 300,
+    allowedSkewInSeconds: options.allowedSkewInSeconds,
     requiredClaims: ['iss', 'sub', 'exp', 'cnf'],
   })