feat: update openid4vp to 1.0 final (#81)

Signed-off-by: Timo Glastra <timo@animo.id>

Author: TimoGlastra

.changeset/angry-parks-ring.md

@@ -0,0 +1,5 @@
+---
+"@openid4vc/openid4vp": minor
+---
+
+update the parsed dcql vp_token presentation result to always return an array of presentations

.changeset/shiny-zebras-wash.md

@@ -0,0 +1,7 @@
+---
+"@openid4vc/openid4vp": minor
+---
+
+feat: update openid4vp to 1.0 final.
+
+The `version` returned in the `resolveOpenid4vpAuthorizationRequest` now returns `100` instead of `29` for the 1.0 final version of OpenID4VP.

packages/openid4vp/src/authorization-request/resolve-authorization-request.ts

@@ -14,7 +14,7 @@ import {
 } from '../jar/z-jar-authorization-request'
 import type { PexPresentationDefinition } from '../models/z-pex'
 import { type ParsedTransactionDataEntry, parseTransactionData } from '../transaction-data/parse-transaction-data'
-import { type Openid4vpDraftVersionNumber, parseAuthorizationRequestVersion } from '../version'
+import { type Openid4vpVersionNumber, parseAuthorizationRequestVersion } from '../version'
 import {
   type WalletVerificationOptions,
   validateOpenid4vpAuthorizationRequestPayload,
@@ -50,10 +50,13 @@ export type ResolvedOpenid4vpAuthorizationRequest = {
   dcql?: { query: unknown } | undefined
 
   /**
-   * The highest possible draft version number based on draft-specific version checks done on the request.
+   * The highest possible version number based on (draft)-version checks done on the request.
+   *
+   * 100 means 1.0 final, all other numbers are draft versions.
    */
-  version: Openid4vpDraftVersionNumber
+  version: Openid4vpVersionNumber
 }
+
 export async function resolveOpenid4vpAuthorizationRequest(
   options: ResolveOpenid4vpAuthorizationRequestOptions
 ): Promise<ResolvedOpenid4vpAuthorizationRequest> {

packages/openid4vp/src/authorization-response/validate-authorization-response-result.ts

@@ -1,12 +1,12 @@
 import type { PexPresentationSubmission } from '../models/z-pex'
-import type { VpTokenDcql, VpTokenPexEntry } from '../vp-token/z-vp-token'
+import type { VpTokenPresentationEntry } from '../vp-token/z-vp-token'
 
 export interface ValidateOpenid4VpPexAuthorizationResponseResult {
   type: 'pex'
 
   pex: {
     presentationSubmission: PexPresentationSubmission
-    presentations: [VpTokenPexEntry, ...VpTokenPexEntry[]]
+    presentations: [VpTokenPresentationEntry, ...VpTokenPresentationEntry[]]
   } & (
     | { scope: string; presentationDefinition?: never }
     | { scope?: never; presentationDefinition: Record<string, unknown> | string }
@@ -16,7 +16,7 @@ export interface ValidateOpenid4VpPexAuthorizationResponseResult {
 export interface ValidateOpenid4VpDcqlAuthorizationResponseResult {
   type: 'dcql'
   dcql: {
-    presentations: VpTokenDcql
+    presentations: Record<string, [VpTokenPresentationEntry, ...VpTokenPresentationEntry[]]>
   } & ({ scope: string; query?: never } | { scope?: never; query: unknown })
 }
 

packages/openid4vp/src/index.ts

@@ -56,7 +56,7 @@ export {
   parsePexVpToken,
   parseDcqlVpToken,
 } from './vp-token/parse-vp-token'
-export type { VpToken, VpTokenDcql, VpTokenPex, VpTokenPexEntry } from './vp-token/z-vp-token'
+export type { VpToken, VpTokenDcql, VpTokenPex, VpTokenPresentationEntry } from './vp-token/z-vp-token'
 
 export {
   parseOpenid4vpAuthorizationResponse,

packages/openid4vp/src/version.ts

@@ -6,18 +6,23 @@ import {
 } from './authorization-request/z-authorization-request-dc-api'
 import { zClientIdPrefix } from './client-identifier-prefix/z-client-id-prefix'
 
-export type Openid4vpDraftVersionNumber = 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29
+/**
+ * The Openid4vpVersionNumber
+ *
+ * 100 means 1.0 final, all others are draft versions
+ */
+export type Openid4vpVersionNumber = 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 100
 
 export function parseAuthorizationRequestVersion(
   request: Openid4vpAuthorizationRequest | Openid4vpAuthorizationRequestDcApi
-): Openid4vpDraftVersionNumber {
-  const requirements: ['<' | '>=', Openid4vpDraftVersionNumber][] = []
+): Openid4vpVersionNumber {
+  const requirements: ['<' | '>=', Openid4vpVersionNumber][] = []
   // 29
   if (request.verifier_info) {
-    requirements.push(['>=', 29])
+    requirements.push(['>=', 100])
   }
   if (request.verifier_attestations) {
-    requirements.push(['<', 29])
+    requirements.push(['<', 100])
   }
 
   // 28
@@ -171,20 +176,20 @@ export function parseAuthorizationRequestVersion(
   // Find the minimum version that satisfies all "less than" constraints
   const highestPossibleVersion =
     lessThanVersions.length > 0
-      ? (Math.max(Math.min(...lessThanVersions) - 1, 18) as Openid4vpDraftVersionNumber)
-      : (29 as const) // Default to highest version
+      ? (Math.max(Math.min(...lessThanVersions) - 1, 18) as Openid4vpVersionNumber)
+      : (100 as const) // Default to highest version
 
   // Find the maximum version that satisfies all "greater than or equal to" constraints
   const lowestRequiredVersion =
-    greaterThanVersions.length > 0 ? (Math.max(...greaterThanVersions) as Openid4vpDraftVersionNumber) : (18 as const) // Default to lowest version
+    greaterThanVersions.length > 0 ? (Math.max(...greaterThanVersions) as Openid4vpVersionNumber) : (18 as const) // Default to lowest version
 
   // The acceptable range is [lowestRequiredVersion, highestPossibleVersion]
   // We return the lowest possible version that satisfies all constraints
   if (lowestRequiredVersion > highestPossibleVersion) {
     // No valid version exists that satisfies all constraints
     throw new Oauth2ServerErrorResponseError({
       error: Oauth2ErrorCodes.InvalidRequest,
-      error_description: 'Could not infer openid4vp version from the openid4vp request payload.',
+      error_description: `Could not infer openid4vp version from the openid4vp request payload. Based on specification requirements, lowest required version is ${lowestRequiredVersion} and highest possible version is ${highestPossibleVersion}`,
     })
   }
 

packages/openid4vp/src/vp-token/parse-vp-token.ts

@@ -1,20 +1,33 @@
 import { parseIfJson, parseWithErrorHandling } from '@openid4vc/utils'
-import { type VpTokenDcql, type VpTokenPexEntry, zVpTokenDcql, zVpTokenPex } from './z-vp-token'
+import { type VpTokenPresentationEntry, zVpTokenDcql, zVpTokenPex } from './z-vp-token'
 
-export function parsePexVpToken(vpToken: unknown): [VpTokenPexEntry, ...VpTokenPexEntry[]] {
+export function parsePexVpToken(vpToken: unknown): [VpTokenPresentationEntry, ...VpTokenPresentationEntry[]] {
   const parsedVpToken = parseWithErrorHandling(
     zVpTokenPex,
     parseIfJson(vpToken),
     'Could not parse presentation exchange vp_token. Expected a string or an array of strings'
   )
 
-  return Array.isArray(parsedVpToken) ? (parsedVpToken as [VpTokenPexEntry, ...VpTokenPexEntry[]]) : [parsedVpToken]
+  return Array.isArray(parsedVpToken)
+    ? (parsedVpToken as [VpTokenPresentationEntry, ...VpTokenPresentationEntry[]])
+    : [parsedVpToken]
 }
 
-export function parseDcqlVpToken(vpToken: unknown): VpTokenDcql {
-  return parseWithErrorHandling(
+export function parseDcqlVpToken(
+  vpToken: unknown
+): Record<string, [VpTokenPresentationEntry, ...VpTokenPresentationEntry[]]> {
+  const parsedVpToken = parseWithErrorHandling(
     zVpTokenDcql,
     parseIfJson(vpToken),
     'Could not parse dcql vp_token. Expected an object where the values are encoded presentations'
   )
+
+  return Object.fromEntries(
+    Object.entries(parsedVpToken).map(([queryId, presentations]) => [
+      queryId,
+      Array.isArray(presentations)
+        ? (presentations as [VpTokenPresentationEntry, ...VpTokenPresentationEntry[]])
+        : [presentations],
+    ])
+  )
 }

packages/openid4vp/src/vp-token/z-vp-token.ts

@@ -1,22 +1,28 @@
 import { z } from 'zod'
 
-const zVpTokenPexEntry = z.union([z.string(), z.record(z.any())], {
-  message: 'pex vp_token entry must be a string or object',
+const zVpTokenPresentationEntry = z.union([z.string(), z.record(z.any())], {
+  message: 'vp_token presentation entry must be string or object',
 })
+export type VpTokenPresentationEntry = z.infer<typeof zVpTokenPresentationEntry>
 
 export const zVpTokenPex = z.union(
-  [zVpTokenPexEntry, z.array(zVpTokenPexEntry).nonempty('Must have at least entry in vp_token array')],
+  [
+    zVpTokenPresentationEntry,
+    z.array(zVpTokenPresentationEntry).nonempty('Must have at least entry in vp_token array'),
+  ],
   {
-    message: 'pex vp_token must be a string, object or array of strings and objects',
+    message: 'pex vp_token must be a string, object or non-empty array of strings and objects',
   }
 )
 export type VpTokenPex = z.infer<typeof zVpTokenPex>
-export type VpTokenPexEntry = z.infer<typeof zVpTokenPexEntry>
 
-export const zVpTokenDcql = z.record(z.union([z.string(), z.record(z.any())]), {
-  message:
-    'dcql vp_token must be an object with keys referencing the dcql credential query id, and values the encoded (string or object) presentation',
-})
+export const zVpTokenDcql = z.record(
+  z.union([z.array(zVpTokenPresentationEntry).nonempty(), zVpTokenPresentationEntry]),
+  {
+    message:
+      'dcql vp_token must be an object with keys referencing the dcql credential query id, and values a non-empty array of strings and objects, or string, or object',
+  }
+)
 export type VpTokenDcql = z.infer<typeof zVpTokenDcql>
 
 export const zVpToken = zVpTokenDcql.or(zVpTokenPex)

packages/openid4vp/tests/full-flow.test.mts

@@ -104,10 +104,12 @@ describe('Full E2E openid4vp test', () => {
             dcql: {
               query: exampleDcqlQuery,
               presentations: {
-                orgeuuniversity:
+                orgeuuniversity: [
                   'uQADZ3ZlcnNpb25jMS4waWRvY3VtZW50c4GjZ2RvY1R5cGVxb3JnLmV1LnVuaXZlcnNpdHlsaXNzdWVyU2lnbmVkuQACam5hbWVTcGFjZXOhd2V1LmV1cm9wYS5lYy5ldWRpLnBpZC4xg9gYWGGkaGRpZ2VzdElEA3FlbGVtZW50SWRlbnRpZmllcmRuYW1lbGVsZW1lbnRWYWx1ZWhKb2huIERvZWZyYW5kb21YIEWyJGCZTVxZPQlUipZgJrFHAG953ShscUxOhqcVj5zZ2BhYY6RoZGlnZXN0SUQBcWVsZW1lbnRJZGVudGlmaWVyZmRlZ3JlZWxlbGVtZW50VmFsdWVoYmFjaGVsb3JmcmFuZG9tWCAK5tJW8iDu2_pFMZbncXHsVSoMPB-j6NHzTidrmAwglNgYWGakaGRpZ2VzdElEAnFlbGVtZW50SWRlbnRpZmllcmRkYXRlbGVsZW1lbnRWYWx1ZdkD7GoyMDI1LTAyLTI3ZnJhbmRvbVggHkxQ5P0ym4b-S2YhPULns-6950O_pu1f01YH4KZf7RFqaXNzdWVyQXV0aIRDoQEmogRYMXpEbmFlYVpVV3dVUmpyNVE1TTJnMnVjZjE2bjNwVUx4bzRDaHFuZktYTnJNMk53MUsYIYFZAR4wggEaMIHAoAMCAQICEBe3X5XsrOs2ZhTfjDA0whkwCgYIKoZIzj0EAwIwDTELMAkGA1UEAxMCREUwHhcNMjUwMjI3MDkxOTMzWhcNMjYwMjI3MDkxOTMzWjANMQswCQYDVQQDEwJERTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJaBQfh-jpNhVxqwlTlv39Gm3nkewRvcA4p9TRao8YlC271XGo2ojTBcNh-RX65ql--tNygiJh6BHNhz98VPcVCjAjAAMAoGCCqGSM49BAMCA0kAMEYCIQCx9YNNPzp7YPPdy4k3IVR_XLl6e7bnKS91cGEwArbMzgIhAIuglfUtfZM-ZYoEX1xYB47wMm666Trcykjag1sYMfgZWQIA2BhZAfu5AAZndmVyc2lvbmMxLjBvZGlnZXN0QWxnb3JpdGhtZ1NIQS0yNTZsdmFsdWVEaWdlc3RzoXdldS5ldXJvcGEuZWMuZXVkaS5waWQuMaUAWCAVPsuROLqNqsVsaaCrTJzdHdZ_IznS1nCh1qVKWZ2ezQFYIPeazaLvXv5M-s2h9713AG_QJcCZW-eu6UGzoGI6O9ZnAlggqnuFzR9wHj_51ftmjpqo5s-XIvjoLPw-5sfQ-IGtp1kDWCByQ8dnllyBLPNL1DgHqA0B8yAuvY-EoCVGmEAWMAbeowRYICrRJfwVhE9JJzLpa6tfc1LJ9rvv0sr2OzQ9ot-68CnNbWRldmljZUtleUluZm-5AAFpZGV2aWNlS2V5pAECIAEhWCAakKubHmMGh9_OHyUGEZ8102VOMM6j7C-MlEyHDyYJ1yJYIJbQibZhVZZ2ghRAClhsQO_fXpWcqRQKhriSZ4azbE2oZ2RvY1R5cGVxb3JnLmV1LnVuaXZlcnNpdHlsdmFsaWRpdHlJbmZvuQAEZnNpZ25lZMB0MjAyNS0wMi0yN1QwOToxOTozM1ppdmFsaWRGcm9twHQyMDI1LTAyLTI3VDA5OjE5OjMzWmp2YWxpZFVudGlswHQyMDI2LTAyLTI3VDA5OjE5OjMzWm5leHBlY3RlZFVwZGF0ZfdYQCFznxzCxRUqSe65YB3p1pjTEK7Sma4-JTUhnbwsdmtAoLBv5NMlu54mHj7oGCRBmN3G_un8GeX2opmG78yVdJNsZGV2aWNlU2lnbmVkuQACam5hbWVTcGFjZXPYGEGgamRldmljZUF1dGi5AAJvZGV2aWNlU2lnbmF0dXJlhEOhASag9lhA0kcpmpDK-lGZnNZ_cCjb_CbEz6UZ_MwymXE9r1j9YFrSpoahLj6dkprCZuaS1K79dvSZQTHw23KHzP_JAGFcj2lkZXZpY2VNYWP3ZnN0YXR1cwA',
-                OpenBadgeCredentialDescriptor:
+                ],
+                OpenBadgeCredentialDescriptor: [
                   'eyJ0eXAiOiJ2YytzZC1qd3QiLCJhbGciOiJFZERTQSIsImtpZCI6IiN6Nk1rcnpRUEJyNHB5cUM3NzZLS3RyejEzU2NoTTVlUFBic3N1UHVRWmI1dDR1S1EifQ.eyJ2Y3QiOiJPcGVuQmFkZ2VDcmVkZW50aWFsIiwiZGVncmVlIjoiYmFjaGVsb3IiLCJjbmYiOnsia2lkIjoiZGlkOmtleTp6Nk1rcEdSNGdzNFJjM1pwaDR2ajh3Um5qbkF4Z0FQU3hjUjhNQVZLdXRXc3BRemMjejZNa3BHUjRnczRSYzNacGg0dmo4d1Juam5BeGdBUFN4Y1I4TUFWS3V0V3NwUXpjIn0sImlzcyI6ImRpZDprZXk6ejZNa3J6UVBCcjRweXFDNzc2S0t0cnoxM1NjaE01ZVBQYnNzdVB1UVpiNXQ0dUtRIiwiaWF0IjoxNzQwNjQ3OTczLCJfc2QiOlsiSEtyNW1mYkE2OGRZY0JYZTVMRDREdFJHdjVoNWp0NEVDT2JSOWF5VkJCOCIsImlBYS1YVXhGaG1nU0g2SWhTOHZ2cm1TWF95VHJ2ZTQtZjFjTWRPLU41VUUiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.pP2G3YxexmDGpF-vfb04zMhVLLJGjkiVUiA-I-aLVdhNqzCjexOAu9xQOt0uTGT-4_ly_j66FXR2v4p0z9iyBw~WyI2NTgyNDY2MzM4MjYyODgyMjY2Nzc2MTkiLCJ1bml2ZXJzaXR5IiwiaW5uc2JydWNrIl0~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFZERTQSJ9.eyJpYXQiOjE3NDA2NDc5NzYsIm5vbmNlIjoiNDczODIzNzM5Nzg4MzU1NzEyMTc3MzUwIiwiYXVkIjoieDUwOV9zYW5fZG5zOmxvY2FsaG9zdDoxMjM0IiwidHJhbnNhY3Rpb25fZGF0YV9oYXNoZXMiOlsiWHd5VmQ3d0ZSRWRWV0xwbmk1UU5IZ2dOV1hvMko0TG41OHQyX2VjSjczcyJdLCJ0cmFuc2FjdGlvbl9kYXRhX2hhc2hlc19hbGciOiJzaGEtMjU2Iiwic2RfaGFzaCI6IkJFQ09xRm9OMjM0UldtRzEtTUlSWXl5SnpXTDg1XzRLdTdHNC1KcUl4V0UifQ.ZnDZBS8o_WPsTlvuUO0SnARUIvx1M8t9Fd6TiaQbMtT_0OA7QCvdpisSh9-NfLAb40frAED875W8RI3zi06-DQ',
+                ],
               },
             },
           })
@@ -142,7 +144,7 @@ describe('Full E2E openid4vp test', () => {
 
     expect(resolved).toEqual({
       transactionData: undefined,
-      version: 29,
+      version: 100,
       authorizationRequestPayload: {
         response_type: 'vp_token',
         client_id: 'client_id',

packages/openid4vp/tests/version-inference.test.mts

@@ -19,7 +19,7 @@ describe('Version inference test', () => {
       response_type: 'vp_token',
     })
 
-    expect(version).toBe(29)
+    expect(version).toBe(100)
   })
 
   test('client_metadata_uri requires version below 21', () => {