feat! auth code flow #2088

TimoGlastra · 2024-11-09T18:05:20Z

See #2056

Signed-off-by: Timo Glastra <[email protected]>

…esentation during issuance and batch issuance. This is a big change to OpenID4VCI in Credo, with the neccsary breaking changes since we first added it to the framework. Over time the spec has changed significantly, but also our understanding of the standards and protocols. **Authorization Code Flow** Credo now supports the authorization code flow, for both issuer and holder. An issuer can configure multiple authorization servers, and work with external authorization servers as well. The integration is based on OAuth2, with several extension specifications, mainly the OAuth2 JWT Access Token Profile, as well as Token Introspection (for opaque access tokens). Verification works out of the box, as longs as the authorization server has a `jwks_uri` configured. For Token Introspection it's also required to provide a `clientId` and `clientSecret` in the authorization server config. To use an external authorization server, the authorization server MUST include the `issuer_state` parameter from the credential offer in the access token. Otherwise it's not possible for Credo to correlate the authorization session to the offer session. The demo-openid contains an example with external authorization server, which can be used as reference. The Credo authorization server supports DPoP and PKCE. **Batch Issuance** The credential request to credential mapper has been updated to support multiple proofs, and also multiple credential instances. The client can now also handle batch issuance. **Presentation During Issuance** The presenation during issuance allows to request presentation using OID4VP before granting authorization for issuance of one or more credentials. This flow is automatically handled by the `resolveAuthorizationRequest` method on the oid4vci holder service. Signed-off-by: Timo Glastra <[email protected]>

Signed-off-by: Timo Glastra <[email protected]>

changeset-bot · 2024-11-09T18:05:23Z

🦋 Changeset detected

Latest commit: 35c2c96

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 14 packages

Name	Type
@credo-ts/openid4vc	Minor
@credo-ts/action-menu	Minor
@credo-ts/anoncreds	Minor
@credo-ts/askar	Minor
@credo-ts/bbs-signatures	Minor
@credo-ts/cheqd	Minor
@credo-ts/core	Minor
@credo-ts/drpc	Minor
@credo-ts/indy-sdk-to-askar-migration	Minor
@credo-ts/indy-vdr	Minor
@credo-ts/node	Minor
@credo-ts/question-answer	Minor
@credo-ts/react-native	Minor
@credo-ts/tenants	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

berendsliedrecht

There are quite some TODO's still, but I assume everything that should be fixed before merging will be fixed :). Good addition @TimoGlastra !!

berendsliedrecht · 2024-11-13T10:50:27Z

.babelrc

@@ -0,0 +1,11 @@
+{


we use babel now?

berendsliedrecht · 2024-11-13T10:51:02Z

demo-openid/README.md

+- ✅ Issuing a credential without authorization (pre authorized).
+- ✅ Issuing a credenital with external authorization server


Suggested change

- ✅ Issuing a credential without authorization (pre authorized).

- ✅ Issuing a credenital with external authorization server

- ✅ Issuing a credential without authorization (pre authorized code flow).

- ✅ Issuing a credenital with external authorization server (authorized code flow).

berendsliedrecht · 2024-11-13T10:51:44Z

demo-openid/package.json

@@ -10,15 +10,19 @@
  "license": "Apache-2.0",
  "scripts": {
    "issuer": "ts-node src/IssuerInquirer.ts",
+    "provider": "tsx src/Provider.ts",


I think we can just use ts-node or tsx for all of them, we don't need both

berendsliedrecht · 2024-11-13T10:52:44Z

demo-openid/src/Holder.ts

+      if (resolvedAuthorizationRequest.authorizationFlow === OpenId4VciAuthorizationFlow.PresentationDuringIssuance) {
+        return {
+          ...resolvedAuthorizationRequest,
+          authorizationFlow: `${OpenId4VciAuthorizationFlow.PresentationDuringIssuance}`,


Suggested change

authorizationFlow: `${OpenId4VciAuthorizationFlow.PresentationDuringIssuance}`,

authorizationFlow: OpenId4VciAuthorizationFlow.PresentationDuringIssuance,

or

Suggested change

authorizationFlow: `${OpenId4VciAuthorizationFlow.PresentationDuringIssuance}`,

authorizationFlow: OpenId4VciAuthorizationFlow.PresentationDuringIssuance.toString(),

berendsliedrecht · 2024-11-13T10:52:54Z

demo-openid/src/Holder.ts

+      } else {
+        return {
+          ...resolvedAuthorizationRequest,
+          authorizationFlow: `${OpenId4VciAuthorizationFlow.Oauth2Redirect}`,


berendsliedrecht · 2024-11-13T11:06:59Z

packages/openid4vc/src/openid4vc-holder/__tests__/fixtures.ts

@@ -39,6 +42,8 @@ export const matrrLaunchpadDraft11JwtVcJson = {
      {
        id: 'b4c4cdf5-ccc9-4945-8c19-9334558653b2',
        format: 'ldp_vc',
+        // FIXME: should we make this optional? Seems a lot of types break on this


Suggested change

// FIXME: should we make this optional? Seems a lot of types break on this

// TODO: should we make this optional? Seems a lot of types break on this

Do we differentiate between FIXME and TODO? We should keep it conistent if they mean the same.

Might also be nice to have something like // TODO(oid): bla bla

berendsliedrecht · 2024-11-13T11:08:16Z

packages/openid4vc/src/openid4vc-issuer/OpenId4VcIssuerModule.ts

      next()
    })

    // This one will be called for all errors that are thrown
    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    contextRouter.use(async (_error: unknown, req: OpenId4VcIssuanceRequest, _res: unknown, next: any) => {
+    contextRouter.use(async (_error: unknown, req: OpenId4VcIssuanceRequest, res: Response, next: any) => {


next is NextFunction if I am not mistaken

berendsliedrecht · 2024-11-13T11:09:58Z

packages/openid4vc/src/openid4vc-issuer/OpenId4VcIssuerService.ts

-  OpenId4VciSignSdJwtCredential,
-  OpenId4VciSignW3cCredential,
-  OpenId4VciSignMdocCredential,
+  OpenId4VciSignW3cCredentials,


Same comment as with the holder service file. Would really benefit from a split up in files and some helper functions to make it a lot easier to read.

berendsliedrecht · 2024-11-13T11:11:14Z

packages/openid4vc/src/openid4vc-issuer/repository/OpenId4VcIssuanceSessionRecord.ts

+  /**
+   * Whether presentation during issuance is required.
+   */
+  required: true


should this not be a boolean?

berendsliedrecht · 2024-11-13T11:12:01Z

packages/openid4vc/src/openid4vc-issuer/router/accessTokenEndpoint.ts

+      url: fullRequestUrl,
+    } as const
+
+    // What error does this throw?


does this need a TODO?

auer-martin and others added 17 commits August 30, 2024 11:04

fix: auth code flow alpha

5cd08fe

Merge branch 'main' of github.com:openwallet-foundation/credo-ts

b64bce3

fix: make eslint happy

80b55b4

feat: add method to test auth code flow

9ccb645

Merge remote-tracking branch 'upstream/main' into auth-code-flow-2

8ab5b22

Merge branch 'main' into auth-code-flow-2

bd02008

fix: host separate oauth-auhtorization-server

b2eb533

Signed-off-by: Timo Glastra <[email protected]>

temp

3de4e82

Signed-off-by: Timo Glastra <[email protected]>

temp

c0b49dc

Signed-off-by: Timo Glastra <[email protected]>

some updates

be9876b

Signed-off-by: Timo Glastra <[email protected]>

Merge remote-tracking branch 'upstream/main' into auth-code-flow-2

9e1050b

feat: working and tests passing

c7f9eb3

Signed-off-by: Timo Glastra <[email protected]>

Merge remote-tracking branch 'upstream/main' into auth-code-flow-2

ef57b9d

both token introspection and jwt flow working

4b9e845

Signed-off-by: Timo Glastra <[email protected]>

feat: presentation during issuance server side

5545919

Signed-off-by: Timo Glastra <[email protected]>

fix: loading of verifier module

35c2c96

Signed-off-by: Timo Glastra <[email protected]>

berendsliedrecht approved these changes Nov 13, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat! auth code flow #2088

feat! auth code flow #2088

TimoGlastra commented Nov 9, 2024

changeset-bot bot commented Nov 9, 2024

berendsliedrecht left a comment

berendsliedrecht Nov 13, 2024

berendsliedrecht Nov 13, 2024

berendsliedrecht Nov 13, 2024

berendsliedrecht Nov 13, 2024

berendsliedrecht Nov 13, 2024

berendsliedrecht Nov 13, 2024

berendsliedrecht Nov 13, 2024

berendsliedrecht Nov 13, 2024

berendsliedrecht Nov 13, 2024

berendsliedrecht Nov 13, 2024

		- ✅ Issuing a credential without authorization (pre authorized).
		- ✅ Issuing a credenital with external authorization server

	authorizationFlow: `${OpenId4VciAuthorizationFlow.PresentationDuringIssuance}`,
	authorizationFlow: OpenId4VciAuthorizationFlow.PresentationDuringIssuance,

	// FIXME: should we make this optional? Seems a lot of types break on this
	// TODO: should we make this optional? Seems a lot of types break on this

feat! auth code flow #2088

Are you sure you want to change the base?

feat! auth code flow #2088

Conversation

TimoGlastra commented Nov 9, 2024

changeset-bot bot commented Nov 9, 2024

🦋 Changeset detected

berendsliedrecht left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment