fix: loosen the allowed content type for JWK Set to include application/json (#79)

Signed-off-by: Timo Glastra <timo@animo.id>

Author: TimoGlastra

.changeset/sad-jokes-cry.md

@@ -0,0 +1,5 @@
+---
+"@openid4vc/oauth2": patch
+---
+
+fix: loosen the allowed content type for JWK Set to include application/json

packages/oauth2/src/metadata/fetch-jwks-uri.ts

@@ -15,7 +15,7 @@ import { type JwkSet, zJwkSet } from '../common/jwk/z-jwk'
 export async function fetchJwks(jwksUrl: string, fetch?: Fetch): Promise<JwkSet> {
   const fetcher = createZodFetcher(fetch)
 
-  const { result, response } = await fetcher(zJwkSet, ContentType.JwkSet, jwksUrl)
+  const { result, response } = await fetcher(zJwkSet, [ContentType.JwkSet, ContentType.Json], jwksUrl)
   if (!response.ok) {
     throw new InvalidFetchResponseError(
       `Fetching JWKs from jwks_uri '${jwksUrl}' resulted in an unsuccessfull response with status code '${response.status}'.`,

packages/utils/src/content-type.ts

@@ -10,11 +10,13 @@ export enum ContentType {
 }
 
 export function isContentType(contentType: ContentType, value: string) {
-  return value.toLowerCase().trim().split(';')[0] === contentType
+  return value.toLowerCase().includes(contentType)
 }
 
-export function isResponseContentType(contentType: ContentType, response: FetchResponse) {
+export function isResponseContentType(contentType: ContentType | ContentType[], response: FetchResponse) {
+  const contentTypeArray = Array.isArray(contentType) ? contentType : [contentType]
+
   const header = response.headers.get('Content-Type')
   if (!header) return false
-  return isContentType(contentType, header)
+  return contentTypeArray.some((contentTypeEntry) => isContentType(contentTypeEntry, header))
 }

packages/utils/src/fetcher.ts

@@ -10,7 +10,7 @@ import { type Fetch, URLSearchParams } from './globals'
  */
 export type ZodFetcher = <Schema extends z.ZodTypeAny>(
   schema: Schema,
-  expectedContentType: ContentType,
+  expectedContentType: ContentType | ContentType[],
   ...args: Parameters<Fetch>
 ) => Promise<{ response: Awaited<ReturnType<Fetch>>; result?: z.SafeParseReturnType<Schema, z.infer<Schema>> }>
 
@@ -62,15 +62,17 @@ export function createZodFetcher(fetcher?: Fetch): ZodFetcher {
   return async (schema, expectedContentType, ...args) => {
     const response = await createFetcher(fetcher)(...args)
 
-    if (response.ok && !isResponseContentType(expectedContentType, response)) {
+    const expectedContentTypeArray = Array.isArray(expectedContentType) ? expectedContentType : [expectedContentType]
+
+    if (response.ok && !isResponseContentType(expectedContentTypeArray, response)) {
       throw new InvalidFetchResponseError(
-        `Expected response to match content type '${expectedContentType}', but received '${response.headers.get('Content-Type')}'`,
+        `Expected response to match content type ${expectedContentTypeArray.join(' | ')}, but received '${response.headers.get('Content-Type')}'`,
         await response.clone().text(),
         response
       )
     }
 
-    if (expectedContentType === ContentType.OAuthAuthorizationRequestJwt) {
+    if (expectedContentTypeArray.includes(ContentType.OAuthAuthorizationRequestJwt)) {
       return {
         response,
         result: response.ok ? schema.safeParse(await response.text()) : undefined,