Add support for di_vp proofs in credential requests as PoP (#257)

Signed-off-by: Sebastian Dechant <763247+S3bb1@users.noreply.github.com>

Author: S3bb1

.changeset/all-garlics-know.md

@@ -0,0 +1,6 @@
+---
+"@openid4vc/oauth2": patch
+"@openid4vc/openid4vci": patch
+---
+
+Add support for di_vp proofs in credential requests

packages/oauth2/src/callbacks.ts

@@ -43,6 +43,20 @@ export type VerifyJwtCallback = (
     }
 >
 
+export type VerifyDataIntegrityProofCallback = (
+  dataIntegrityProof: Record<string, unknown>,
+  document: Record<string, unknown>
+) => OrPromise<
+  | {
+      verified: true
+      signerJwk: Jwk
+    }
+  | {
+      verified: false
+      signerJwk?: Jwk
+    }
+>
+
 export interface DecryptJweCallbackOptions {
   jwk?: Jwk
 }
@@ -105,6 +119,12 @@ export interface CallbackContext {
    */
   verifyJwt: VerifyJwtCallback
 
+  /**
+   * Verify a Data Integrity proof (e.g. the `proof` of a `di_vp` key proof's Verifiable
+   * Presentation). Optional because most issuers won't support the `di_vp` proof type.
+   */
+  verifyDataIntegrityProof?: VerifyDataIntegrityProofCallback
+
   /**
    * Generate random callback to generate random bytes. Used for
    * e.g. the 'jti' value in a dpop jwt, and 'code_verifier' in pkce.

packages/oauth2/src/index.ts

@@ -72,6 +72,7 @@ export type {
   GenerateRandomCallback,
   HashCallback,
   SignJwtCallback,
+  VerifyDataIntegrityProofCallback,
   VerifyJwtCallback,
 } from './callbacks'
 export { HashAlgorithm } from './callbacks'

packages/openid4vci/src/Openid4vciIssuer.ts

@@ -29,6 +29,10 @@ import {
   type VerifyCredentialRequestAttestationProofOptions,
   verifyCredentialRequestAttestationProof,
 } from './formats/proof-type/attestation/attestation-proof-type'
+import {
+  type VerifyCredentialRequestDiVpProofOptions,
+  verifyCredentialRequestDiVpProof,
+} from './formats/proof-type/di-vp/di-vp-proof-type'
 import {
   type VerifyCredentialRequestJwtProofOptions,
   verifyCredentialRequestJwtProof,
@@ -209,6 +213,38 @@ export class Openid4vciIssuer {
     }
   }
 
+  /**
+   * @throws Oauth2ServerErrorResponseError - if verification of the di_vp proof failed. You can
+   *  extract the credential error response from this.
+   */
+  public async verifyCredentialRequestDiVpProof(
+    options: Pick<VerifyCredentialRequestDiVpProofOptions, 'vp' | 'now' | 'expectedNonce' | 'nonceExpiresAt'> & {
+      issuerMetadata: IssuerMetadataResult
+    }
+  ) {
+    try {
+      return await verifyCredentialRequestDiVpProof({
+        callbacks: this.options.callbacks,
+        credentialIssuer: options.issuerMetadata.credentialIssuer.credential_issuer,
+        expectedNonce: options.expectedNonce,
+        nonceExpiresAt: options.nonceExpiresAt,
+        vp: options.vp,
+        now: options.now,
+      })
+    } catch (error) {
+      throw new Oauth2ServerErrorResponseError(
+        {
+          error: Oauth2ErrorCodes.InvalidProof,
+          error_description: error instanceof Openid4vciError ? error.message : 'Invalid proof',
+        },
+        {
+          internalMessage: 'Error verifying credential request di_vp proof',
+          cause: error,
+        }
+      )
+    }
+  }
+
   /**
    * @throws Oauth2ServerErrorResponseError - when validation of the credential request fails
    *  You can extract the credential error response from this.

packages/openid4vci/src/credential-request/__tests__/parse-credential-request.test.mts

@@ -422,6 +422,87 @@ describe('Parse Credential Request', () => {
     })
   })
 
+  test('parse draft 14 credential request with known di_vp proof_type', () => {
+    expect(
+      parseCredentialRequest({
+        issuerMetadata: {
+          authorizationServers: [],
+          credentialIssuer: issuerMetadata,
+          originalDraftVersion: Openid4vciVersion.Draft14,
+          knownCredentialConfigurations: {
+            my_credential: {
+              format: 'dc+sd-jwt',
+              vct: 'hello',
+            },
+          },
+        },
+        credentialRequest: {
+          credential_identifier: 'some-identifier',
+          extra_prop: 'should-stay',
+          proof: {
+            proof_type: 'di_vp',
+            di_vp: {
+              '@context': ['https://www.w3.org/ns/credentials/v2'],
+              type: ['VerifiablePresentation'],
+              proof: {
+                type: 'DataIntegrityProof',
+                cryptosuite: 'eddsa-2022',
+                proofPurpose: 'authentication',
+                verificationMethod: 'did:key:z6Mk...#z6Mk...',
+                created: '2023-03-01T14:56:29.280619Z',
+                challenge: '82d4cb36-...',
+                domain: 'https://issuer.com',
+                proofValue: 'z5hrbHzZ...',
+              },
+            },
+          },
+        },
+      })
+    ).toStrictEqual({
+      proofs: {
+        di_vp: [
+          {
+            '@context': ['https://www.w3.org/ns/credentials/v2'],
+            type: ['VerifiablePresentation'],
+            proof: {
+              type: 'DataIntegrityProof',
+              cryptosuite: 'eddsa-2022',
+              proofPurpose: 'authentication',
+              verificationMethod: 'did:key:z6Mk...#z6Mk...',
+              created: '2023-03-01T14:56:29.280619Z',
+              challenge: '82d4cb36-...',
+              domain: 'https://issuer.com',
+              proofValue: 'z5hrbHzZ...',
+            },
+          },
+        ],
+      },
+      credentialIdentifier: 'some-identifier',
+      credentialRequest: {
+        credential_identifier: 'some-identifier',
+        extra_prop: 'should-stay',
+        proof: {
+          proof_type: 'di_vp',
+          di_vp: {
+            '@context': ['https://www.w3.org/ns/credentials/v2'],
+            type: ['VerifiablePresentation'],
+            proof: {
+              type: 'DataIntegrityProof',
+              cryptosuite: 'eddsa-2022',
+              proofPurpose: 'authentication',
+              verificationMethod: 'did:key:z6Mk...#z6Mk...',
+              created: '2023-03-01T14:56:29.280619Z',
+              challenge: '82d4cb36-...',
+              domain: 'https://issuer.com',
+              proofValue: 'z5hrbHzZ...',
+            },
+          },
+        },
+      },
+      credentialResponseEncryption: undefined,
+    })
+  })
+
   test('parse draft 14 credential request with unknown proof_type', () => {
     expect(
       parseCredentialRequest({

packages/openid4vci/src/credential-request/parse-credential-request.ts

@@ -1,6 +1,7 @@
 import { parseWithErrorHandling } from '@openid4vc/utils'
 import z from 'zod'
 import { attestationProofTypeIdentifier } from '../formats/proof-type/attestation/z-attestation-proof-type'
+import { diVpProofTypeIdentifier } from '../formats/proof-type/di-vp/z-di-vp-proof-type'
 import { jwtProofTypeIdentifier } from '../formats/proof-type/jwt/z-jwt-proof-type'
 import { getKnownCredentialConfigurationSupportedById } from '../metadata/credential-issuer/credential-issuer-metadata'
 import type { CredentialConfigurationSupportedWithFormats } from '../metadata/credential-issuer/z-credential-issuer-metadata'
@@ -105,6 +106,8 @@ export function parseCredentialRequest(options: ParseCredentialRequestOptions):
     proofs = { [jwtProofTypeIdentifier]: [knownProof.data.jwt] }
   } else if (knownProof.success && knownProof.data.proof_type === attestationProofTypeIdentifier) {
     proofs = { [attestationProofTypeIdentifier]: [knownProof.data.attestation] }
+  } else if (knownProof.success && knownProof.data.proof_type === diVpProofTypeIdentifier) {
+    proofs = { [diVpProofTypeIdentifier]: [knownProof.data.di_vp] }
   }
 
   const credentialResponseEncryption = credentialRequest.credential_response_encryption

packages/openid4vci/src/credential-request/z-credential-request-common.ts

@@ -4,7 +4,9 @@ import z from 'zod'
 import {
   zAttestationProofTypeIdentifier,
   zCredentialRequestProofAttestation,
+  zCredentialRequestProofDiVp,
   zCredentialRequestProofJwt,
+  zDiVpProofTypeIdentifier,
   zJwtProofTypeIdentifier,
 } from '../formats/proof-type'
 
@@ -14,7 +16,11 @@ const zCredentialRequestProofCommon = z
   })
   .loose()
 
-export const allCredentialRequestProofs = [zCredentialRequestProofJwt, zCredentialRequestProofAttestation] as const
+export const allCredentialRequestProofs = [
+  zCredentialRequestProofJwt,
+  zCredentialRequestProofAttestation,
+  zCredentialRequestProofDiVp,
+] as const
 
 export const zCredentialRequestProof = z.union([
   zCredentialRequestProofCommon,
@@ -25,6 +31,7 @@ const zCredentialRequestProofsCommon = z.record(z.string(), z.array(z.unknown())
 export const zCredentialRequestProofs = z.object({
   [zJwtProofTypeIdentifier.value]: z.optional(z.array(zCredentialRequestProofJwt.shape.jwt)),
   [zAttestationProofTypeIdentifier.value]: z.optional(z.array(zCredentialRequestProofAttestation.shape.attestation)),
+  [zDiVpProofTypeIdentifier.value]: z.optional(z.array(zCredentialRequestProofDiVp.shape.di_vp)),
 })
 
 type CredentialRequestProofCommon = z.infer<typeof zCredentialRequestProofCommon>