Merge remote-tracking branch 'origin/feature/DIIPv4' into feature/DIIPv4

sanderPostma · sanderPostma · commit 0e8d79bc50ba · 2025-09-26T13:44:13.000+02:00
diff --git a/packages/client/lib/__tests__/EBSIE2E.spec.test.ts b/packages/client/lib/__tests__/EBSIE2E.spec.test.ts
@@ -4,7 +4,7 @@ import { CredentialMapper } from '@sphereon/ssi-types'
 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
 //@ts-ignore
 import { from } from '@trust/keyto'
-import { fetch } from 'cross-fetch'
+import fetch from 'cross-fetch'
 import pkg from 'debug'
 const { debug: Debug } = pkg
 import { base64url, importJWK, JWK, SignJWT } from 'jose'
diff --git a/packages/client/lib/__tests__/MattrE2E.spec.test.ts b/packages/client/lib/__tests__/MattrE2E.spec.test.ts
@@ -1,6 +1,6 @@
 import { Alg, Jwt } from '@sphereon/oid4vci-common'
 import { CredentialMapper } from '@sphereon/ssi-types'
-import { fetch } from 'cross-fetch'
+import fetch from 'cross-fetch'
 import { importJWK, JWK, SignJWT } from 'jose'
 import { describe, expect, it } from 'vitest'
 
diff --git a/packages/client/lib/__tests__/SphereonE2E.spec.test.ts b/packages/client/lib/__tests__/SphereonE2E.spec.test.ts
@@ -4,7 +4,7 @@ import { uuidv4 } from '@sphereon/oid4vc-common'
 import { Alg, Jwt, ProofOfPossessionCallbacks } from '@sphereon/oid4vci-common'
 import { CredentialMapper } from '@sphereon/ssi-types'
 import * as didts from '@transmute/did-key.js'
-import { fetch } from 'cross-fetch'
+import fetch from 'cross-fetch'
 import { importJWK, JWK, SignJWT } from 'jose'
 import { describe, expect, it } from 'vitest'
 
diff --git a/packages/client/lib/functions/CredentialOfferCommons.ts b/packages/client/lib/functions/CredentialOfferCommons.ts
@@ -6,7 +6,7 @@ import {
   PRE_AUTH_GRANT_LITERAL,
   UniformCredentialOfferRequest,
 } from '@sphereon/oid4vci-common'
-import { fetch } from 'cross-fetch'
+import fetch from 'cross-fetch'
 
 export function isUriEncoded(str: string): boolean {
   const pattern = /%[0-9A-F]{2}/i
diff --git a/packages/oid4vci-common/lib/functions/HttpUtils.ts b/packages/oid4vci-common/lib/functions/HttpUtils.ts
@@ -1,5 +1,5 @@
 import { Loggers } from '@sphereon/ssi-types'
-import { fetch } from 'cross-fetch'
+import fetch from 'cross-fetch'
 
 import { Encoding, OpenIDResponse } from '../types'
 
diff --git a/packages/siop-oid4vp/lib/__tests__/IT.spec.ts b/packages/siop-oid4vp/lib/__tests__/IT.spec.ts
@@ -1755,3 +1755,75 @@ describe.skip('RP and OP interaction should', () => {
     expect(resState?.status).toBe('error')
   })
 })
+
+
+describe('credential_sets tests', () => {
+  it('DCQL credential_sets: happy flow (single required option is satisfied)', () => {
+    const queryWithSet: DcqlQuery.Input = {
+      credentials: [
+        {
+          id: 'credA',
+          format: 'ldp_vc',
+          meta: {
+            type_values: [
+              ['https://www.w3.org/2018/credentials#VerifiableCredential'],
+              ['PermanentResidentCard']
+            ]
+          },
+          claims: [{ path: ['givenName'], values: ['JANE'] }]
+        }
+      ],
+      credential_sets: [
+        {
+          options: [['credA']],
+          required: true,
+          purpose: 'must include credA'
+        }
+      ]
+    }
+
+    const parsed = DcqlQuery.parse(queryWithSet)
+    DcqlQuery.validate(parsed) // validates structure + credential_sets references
+
+    const dcqlCredential: DcqlW3cVcCredential = {
+      credential_format: 'ldp_vc',
+      claims: (getVCs()[0].credentialSubject as { [x: string]: Json }),
+      type: getVCs()[0].type,
+      cryptographic_holder_binding: true
+    }
+
+    const result: DcqlQueryResult = DcqlQuery.query(parsed, [dcqlCredential])
+
+    // set is satisfied and matching_options should include ['credA']
+    expect(result.can_be_satisfied).toBe(true)
+    expect(result.credential_sets?.[0].matching_options).toEqual([['credA']])
+  })
+
+  it('DCQL credential_sets: invalid rule (references unknown credential id) fails validation', () => {
+    const queryWithBadSet: DcqlQuery.Input = {
+      credentials: [
+        {
+          id: 'credA',
+          format: 'ldp_vc',
+          meta: {
+            type_values: [
+              ['https://www.w3.org/2018/credentials#VerifiableCredential'],
+              ['PermanentResidentCard']
+            ]
+          },
+          claims: [{ path: ['givenName'], values: ['JANE'] }]
+        }
+      ],
+      credential_sets: [
+        {
+          // This option references a non-existent credential query id
+          options: [['does_not_exist']],
+          required: true
+        }
+      ]
+    }
+
+    const parsed = DcqlQuery.parse(queryWithBadSet)
+    expect(() => DcqlQuery.validate(parsed)).toThrowError(/Credential set contains undefined credential id/i)
+  })
+})
diff --git a/packages/siop-oid4vp/lib/__tests__/e2e/mattr.launchpad.spec.ts b/packages/siop-oid4vp/lib/__tests__/e2e/mattr.launchpad.spec.ts
@@ -3,7 +3,7 @@ import { PresentationSignCallBackParams } from '@sphereon/pex'
 import { W3CVerifiablePresentation } from '@sphereon/ssi-types'
 import { DcqlPresentation, DcqlQuery, DcqlQueryResult, DcqlW3cVcCredential } from 'dcql'
 import * as ed25519 from '@transmute/did-key-ed25519'
-import { fetch } from 'cross-fetch'
+import fetch from 'cross-fetch'
 import { DIDDocument, DIDResolutionResult } from 'did-resolver'
 import { importJWK, JWK, SignJWT } from 'jose'
 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
diff --git a/packages/siop-oid4vp/lib/authorization-response/Dcql.ts b/packages/siop-oid4vp/lib/authorization-response/Dcql.ts
@@ -57,7 +57,7 @@ export class Dcql {
       opts: {
         hasher?: HasherSync
       },
-  ) => {
+  ) : DcqlPresentationResult.Output => {
     const dcqlPresentation = Object.fromEntries(
         // FIXME SSISDK-41
         Object.entries(extractDcqlPresentationFromDcqlVpToken(record, opts)).map(([queryId, p]) => {
diff --git a/packages/siop-oid4vp/lib/authorization-response/OpenID4VP.ts b/packages/siop-oid4vp/lib/authorization-response/OpenID4VP.ts
@@ -13,7 +13,7 @@ import {DcqlPresentation, DcqlQuery} from 'dcql'
 import {verifyRevocation} from '../helpers'
 import {AuthorizationResponse} from './AuthorizationResponse'
 import {Dcql} from './Dcql'
-import {RevocationVerification, VerifiedOpenID4VPSubmission} from '../types'
+import {PresentationSubmission, RevocationVerification, VerifiedOpenID4VPSubmission} from '../types'
 import {VerifyAuthorizationResponseOpts,} from './types'
 
 export const extractNonceFromWrappedVerifiablePresentation = (wrappedVp: WrappedVerifiablePresentation): string | undefined => {
@@ -50,6 +50,7 @@ export const verifyPresentations = async (
   verifyOpts: VerifyAuthorizationResponseOpts,
 ): Promise<{ dcql: VerifiedOpenID4VPSubmission }> => {
   const dcqlQuery = DcqlQuery.parse(verifyOpts.dcqlQuery ?? authorizationResponse?.authorizationRequest.payload.dcql_query as DcqlQuery)
+  DcqlQuery.validate(dcqlQuery)
   const dcqlPresentation = extractDcqlPresentationFromDcqlVpToken(authorizationResponse.payload.vp_token as string, { hasher: verifyOpts.hasher })
 
   const wrappedPresentations = Object.values(dcqlPresentation)
@@ -59,7 +60,7 @@ export const verifyPresentations = async (
       ),
     )
 
-    await Dcql.assertValidDcqlPresentationResult(authorizationResponse.payload.vp_token as string, dcqlQuery, { hasher: verifyOpts.hasher })
+    const dcqlPresentationResult = await Dcql.assertValidDcqlPresentationResult(authorizationResponse.payload.vp_token as string, dcqlQuery, { hasher: verifyOpts.hasher })
 
     if (verifiedPresentations.some((verified) => !verified)) {
       const message = verifiedPresentations
@@ -95,13 +96,13 @@ export const verifyPresentations = async (
     }
   }
 
-  return { dcql: { nonce, presentation: dcqlPresentation, dcqlQuery } }
+  return { dcql: { nonce, presentation: dcqlPresentation, dcqlQuery , dcqlPresentationResult} }
 }
 
 export const extractDcqlPresentationFromDcqlVpToken = (
   vpToken: DcqlPresentation.Input | string,
   opts?: { hasher?: HasherSync },
-): { [credentialQueryId: string]: WrappedVerifiablePresentation } => {
+): PresentationSubmission => {
   return Object.fromEntries(
       Object.entries(DcqlPresentation.parse(vpToken)).map(([credentialQueryId, vp]) => [
         credentialQueryId,
diff --git a/packages/siop-oid4vp/lib/helpers/HttpUtils.ts b/packages/siop-oid4vp/lib/helpers/HttpUtils.ts
@@ -1,5 +1,5 @@
 import { Loggers } from '@sphereon/ssi-types'
-import { fetch } from 'cross-fetch'
+import fetch from 'cross-fetch'
 import { ContentType, SIOPErrors, SIOPResonse } from '../types'
 
 const logger = Loggers.DEFAULT.get('sphereon:siopv2:http')
diff --git a/packages/siop-oid4vp/lib/rp/InMemoryRPSessionManager.ts b/packages/siop-oid4vp/lib/rp/InMemoryRPSessionManager.ts
@@ -9,7 +9,8 @@ import {
   AuthorizationRequestStateStatus,
   AuthorizationResponseState,
   AuthorizationResponseStateStatus,
-  AuthorizationResponseStateWithVerifiedData
+  AuthorizationResponseStateWithVerifiedData,
+  CallbackOpts
 } from '../types'
 import { IRPSessionManager } from './types'
 
@@ -27,6 +28,8 @@ export class InMemoryRPSessionManager implements IRPSessionManager {
   private readonly nonceMapping: Record<number, string> = {}
   // stored by hashcode
   private readonly stateMapping: Record<number, string> = {}
+  private readonly callbackMapping: Record<string, CallbackOpts> = {}
+  private readonly queryIdMapping: Record<string, string> = {}
   private readonly maxAgeInSeconds: number
 
   private static getKeysForCorrelationId(mapping: Record<number, string>, correlationId: string): number[] {
@@ -193,12 +196,11 @@ export class InMemoryRPSessionManager implements IRPSessionManager {
     try {
       const eventState = {
         correlationId: event.correlationId,
-        queryId: event.queryId,
+        queryId: event.queryId ?? this.queryIdMapping[event.correlationId],
         ...(type === 'request' && { request: event.subject }),
         ...(type === 'response' && { response: event.subject }),
         ...(event.error && { error: event.error }),
         status,
-        callback: event.callback,
         timestamp: event.timestamp,
         lastUpdated: event.timestamp,
       }
@@ -208,13 +210,20 @@ export class InMemoryRPSessionManager implements IRPSessionManager {
         this.authorizationRequests[event.correlationId] = state
         this.updateMapping(this.nonceMapping, event, 'nonce', event.correlationId, true)
         this.updateMapping(this.stateMapping, event, 'state', event.correlationId, true)
+        if (event.queryId) {
+          this.queryIdMapping[event.correlationId] = event.queryId
+        }
+        if (event.callback) {
+          this.callbackMapping[event.correlationId] = event.callback
+        }
       } else {
         state = eventState as AuthorizationResponseState
         this.authorizationResponses[event.correlationId] = state
       }
 
-      if (event.callback && (event.callback.status === undefined || event.callback.status.includes(status))) {
-        void this.executeCallback(event.callback.url, state)
+      const callback = this.callbackMapping[event.correlationId]
+      if (callback && (callback.status === undefined || callback.status.includes(status))) {
+        void this.executeCallback(callback.url, state)
       }
     } catch (error: unknown) {
       console.log(`Error in update state happened: ${error}`)
@@ -265,7 +274,7 @@ export class InMemoryRPSessionManager implements IRPSessionManager {
       correlation_id: state.correlationId,
       query_id: state.queryId,
       last_updated: state.lastUpdated,
-      ...((state?.status === AuthorizationResponseStateStatus.VERIFIED && state.verifiedData !== undefined) && { verified_data: state.verifiedData }),
+      ...('verifiedData' in state && { verified_data: state.verifiedData }),
       ...(state.error && { message: state.error.message })
     }
 
diff --git a/packages/siop-oid4vp/lib/types/SIOP.types.ts b/packages/siop-oid4vp/lib/types/SIOP.types.ts
@@ -9,7 +9,7 @@ import {
   W3CVerifiablePresentation,
   WrappedVerifiablePresentation
 } from '@sphereon/ssi-types'
-import { DcqlQuery } from 'dcql'
+import { DcqlPresentationResult, DcqlQuery } from 'dcql'
 import { z } from 'zod'
 import {
   AuthorizationRequest,
@@ -191,7 +191,6 @@ export interface AuthorizationResponsePayload {
     | CompactSdJwtVc
     | MdocOid4vpMdocVpToken
     | EncodedDcqlPresentationVpToken
-  verified_data?: VerifiedData
   is_first_party?: boolean
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   [x: string]: any
@@ -483,10 +482,15 @@ export interface VerifiedIDToken {
 
 export interface VerifiedOpenID4VPSubmission {
   dcqlQuery: DcqlQuery
-  presentation: { [credentialQueryId: string]: WrappedVerifiablePresentation }
+  presentation: PresentationSubmission
+  dcqlPresentationResult?: DcqlPresentationResult
   nonce?: string
 }
 
+export interface PresentationSubmission {
+  [credentialQueryId: string]: WrappedVerifiablePresentation
+}
+
 export interface VerifiedAuthorizationResponse {
   correlationId: string
   authorizationResponse: AuthorizationResponse
diff --git a/packages/siop-oid4vp/lib/types/SessionManager.ts b/packages/siop-oid4vp/lib/types/SessionManager.ts
@@ -1,7 +1,6 @@
 import { AuthorizationRequest } from '../authorization-request'
 import { AuthorizationResponse } from '../authorization-response'
-import { AdditionalClaims } from '@sphereon/ssi-types'
-import { CallbackOpts } from '../types'
+import {CallbackOpts, VerifiedData} from '../types'
 
 export interface AuthorizationRequestState {
   correlationId: string
@@ -26,7 +25,7 @@ export interface AuthorizationResponseState {
 }
 
 export interface AuthorizationResponseStateWithVerifiedData extends AuthorizationResponseState {
-  verifiedData?: AdditionalClaims
+  verifiedData?: VerifiedData
 }
 
 export enum AuthorizationRequestStateStatus {
