fix: (WIP) refactored and fixed parts of the logic for v1_0_13.

packages/callback-example/lib/__tests__/issuerCallback.spec.ts

@@ -4,13 +4,14 @@ import { CredentialRequestClient, CredentialRequestClientBuilder, ProofOfPossess
 import {
   Alg,
   CNonceState,
-  CredentialConfigurationSupported, CredentialIssuerMetadata,
+  CredentialConfigurationSupported,
+  CredentialIssuerMetadata,
   IssuerCredentialSubjectDisplay,
   IssueStatus,
   Jwt,
   JwtVerifyResult,
   OpenId4VCIVersion,
-  ProofOfPossession
+  ProofOfPossession,
 } from '@sphereon/oid4vci-common'
 import { CredentialOfferSession } from '@sphereon/oid4vci-common/dist'
 import { CredentialSupportedBuilderV1_13, VcIssuer, VcIssuerBuilder } from '@sphereon/oid4vci-issuer'
@@ -215,9 +216,9 @@ describe('issuerCallback', () => {
     const credReqClient = (await CredentialRequestClientBuilder.fromURI({ uri: INITIATION_TEST_URI }))
       .withCredentialEndpoint('https://oidc4vci.demo.spruceid.com/credential')
       .withCredentialEndpointFromMetadata({
-        credential_configurations_supported: {"VeriCred":{format: 'jwt_vc_json' } as CredentialConfigurationSupported}
+        credential_configurations_supported: { VeriCred: { format: 'jwt_vc_json' } as CredentialConfigurationSupported },
       } as unknown as CredentialIssuerMetadata)
-    .withFormat('jwt_vc_json')
+      .withFormat('jwt_vc_json')
       .withCredentialType('credentialType')
       .withToken('token')
 

packages/client/lib/AccessTokenClient.ts

@@ -18,7 +18,7 @@ import {
   PRE_AUTH_CODE_LITERAL,
   TokenErrorResponse,
   toUniformCredentialOfferRequest,
-  TxCode,
+  TxCodeAndPinRequired,
   UniformCredentialOfferPayload,
 } from '@sphereon/oid4vci-common';
 import { ObjectUtils } from '@sphereon/ssi-types';
@@ -34,8 +34,7 @@ export class AccessTokenClient {
     const { asOpts, pin, codeVerifier, code, redirectUri, metadata } = opts;
 
     const credentialOffer = opts.credentialOffer ? await assertedUniformCredentialOffer(opts.credentialOffer) : undefined;
-    const txCode: TxCode | undefined =
-      credentialOffer?.credential_offer.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.tx_code ?? undefined;
+    const pinMetadata: TxCodeAndPinRequired | undefined = credentialOffer && this.getPinMetadata(credentialOffer.credential_offer);
     const issuer =
       opts.credentialIssuer ??
       (credentialOffer ? getIssuerFromCredentialOfferPayload(credentialOffer.credential_offer) : (metadata?.issuer as string));
@@ -54,9 +53,9 @@ export class AccessTokenClient {
         code,
         redirectUri,
         pin,
-        txCode,
+        pinMetadata,
       }),
-      txCode,
+      pinMetadata,
       metadata,
       asOpts,
       issuerOpts,
@@ -65,18 +64,18 @@ export class AccessTokenClient {
 
   public async acquireAccessTokenUsingRequest({
     accessTokenRequest,
-    txCode,
+    pinMetadata,
     metadata,
     asOpts,
     issuerOpts,
   }: {
     accessTokenRequest: AccessTokenRequest;
-    txCode?: TxCode;
+    pinMetadata?: TxCodeAndPinRequired;
     metadata?: EndpointMetadata;
     asOpts?: AuthorizationServerOpts;
     issuerOpts?: IssuerOpts;
   }): Promise<OpenIDResponse<AccessTokenResponse>> {
-    this.validate(accessTokenRequest, txCode);
+    this.validate(accessTokenRequest, pinMetadata);
 
     const requestTokenURL = AccessTokenClient.determineTokenURL({
       asOpts,
@@ -105,7 +104,7 @@ export class AccessTokenClient {
     }
 
     if (credentialOfferRequest?.supportedFlows.includes(AuthzFlowType.PRE_AUTHORIZED_CODE_FLOW)) {
-      this.assertNumericPin(this.isPinRequiredValue(credentialOfferRequest.credential_offer), pin);
+      this.assertAlphanumericPin(opts.pinMetadata, pin);
       request.user_pin = pin;
 
       request.grant_type = GrantTypes.PRE_AUTHORIZED_CODE;
@@ -143,24 +142,39 @@ export class AccessTokenClient {
     }
   }
 
-  private isPinRequiredValue(requestPayload: UniformCredentialOfferPayload): boolean {
-    let isPinRequired = false;
+  private getPinMetadata(requestPayload: UniformCredentialOfferPayload): TxCodeAndPinRequired {
     if (!requestPayload) {
       throw new Error(TokenErrorResponse.invalid_request);
     }
     const issuer = getIssuerFromCredentialOfferPayload(requestPayload);
-    if (requestPayload.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code']?.tx_code) {
-      isPinRequired = true;
-    }
+
+    const grantDetails = requestPayload.grants?.['urn:ietf:params:oauth:grant-type:pre-authorized_code'];
+    const isPinRequired = !!grantDetails?.tx_code || !!grantDetails?.['pre-authorized_code'];
+
     debug(`Pin required for issuer ${issuer}: ${isPinRequired}`);
-    return isPinRequired;
+    return {
+      txCode: grantDetails?.tx_code,
+      isPinRequired,
+    };
   }
 
-  private assertNumericPin(isPinRequired: boolean, pin?: string): void {
-    if (isPinRequired) {
-      if (!pin || !/^\d{1,8}$/.test(pin)) {
-        debug(`Pin is not 1 to 8 digits long`);
-        throw new Error('A valid pin consisting of maximal 8 numeric characters must be present.');
+  private assertAlphanumericPin(pinMeta?: TxCodeAndPinRequired, pin?: string): void {
+    if (pinMeta && pinMeta.isPinRequired) {
+      let regex;
+      if (pinMeta.txCode && pinMeta.txCode.input_mode === 'numeric') {
+        regex = new RegExp(`^\\d{1,${pinMeta.txCode.length || 8}}$`);
+      } else if (pinMeta.txCode && pinMeta.txCode.input_mode === 'text') {
+        regex = new RegExp(`^[a-zA-Z0-9]{1,${pinMeta.txCode.length || 8}}$`);
+      } else {
+        // default regex that limits the length to 8
+        regex = /^[a-zA-Z0-9]{1,8}$/;
+      }
+
+      if (!pin || !regex.test(pin)) {
+        debug(
+          `Pin is not valid. Expected format: ${pinMeta?.txCode?.input_mode || 'alphanumeric'}, Length: up to ${pinMeta?.txCode?.length || 8} characters`,
+        );
+        throw new Error('A valid pin must be present according to the specified transaction code requirements.');
       }
     } else if (pin) {
       debug(`Pin set, whilst not required`);
@@ -188,11 +202,11 @@ export class AccessTokenClient {
       throw new Error('Authorization flow requires the code to be present');
     }
   }
-  private validate(accessTokenRequest: AccessTokenRequest, txCode?: TxCode): void {
+  private validate(accessTokenRequest: AccessTokenRequest, pinMeta?: TxCodeAndPinRequired): void {
     if (accessTokenRequest.grant_type === GrantTypes.PRE_AUTHORIZED_CODE) {
       this.assertPreAuthorizedGrantType(accessTokenRequest.grant_type);
       this.assertNonEmptyPreAuthorizedCode(accessTokenRequest);
-      this.assertNumericPin(!!txCode, accessTokenRequest.user_pin);
+      this.assertAlphanumericPin(pinMeta, accessTokenRequest['pre-authorized_code']);
     } else if (accessTokenRequest.grant_type === GrantTypes.AUTHORIZATION_CODE) {
       this.assertAuthorizationGrantType(accessTokenRequest.grant_type);
       this.assertNonEmptyCodeVerifier(accessTokenRequest);

packages/client/lib/CredentialRequestClient.ts

@@ -1,5 +1,6 @@
 import {
-  acquireDeferredCredential, CredentialRequestV1_0_13,
+  acquireDeferredCredential,
+  CredentialRequestV1_0_13,
   CredentialResponse,
   getCredentialRequestForVersion,
   getUniformFormat,
@@ -9,14 +10,14 @@ import {
   OpenIDResponse,
   ProofOfPossession,
   UniformCredentialRequest,
-  URL_NOT_VALID
-} from '@sphereon/oid4vci-common'
-import { CredentialFormat } from '@sphereon/ssi-types'
-import Debug from 'debug'
+  URL_NOT_VALID,
+} from '@sphereon/oid4vci-common';
+import { CredentialFormat } from '@sphereon/ssi-types';
+import Debug from 'debug';
 
-import { CredentialRequestClientBuilder } from './CredentialRequestClientBuilder'
-import { isValidURL, post } from './functions'
-import { ProofOfPossessionBuilder } from './ProofOfPossessionBuilder'
+import { CredentialRequestClientBuilder } from './CredentialRequestClientBuilder';
+import { isValidURL, post } from './functions';
+import { ProofOfPossessionBuilder } from './ProofOfPossessionBuilder';
 
 const debug = Debug('sphereon:oid4vci:credential');
 
@@ -89,7 +90,7 @@ export class CredentialRequestClient {
 
   public async acquireCredentialsUsingRequest(uniformRequest: UniformCredentialRequest): Promise<OpenIDResponse<CredentialResponse>> {
     if (this.version() < OpenId4VCIVersion.VER_1_0_13) {
-      throw new Error('Versions below v1.0.13 (draft 13) are not supported.')
+      throw new Error('Versions below v1.0.13 (draft 13) are not supported.');
     }
     const request: CredentialRequestV1_0_13 = getCredentialRequestForVersion(uniformRequest, this.version()) as CredentialRequestV1_0_13;
     const credentialEndpoint: string = this.credentialRequestOpts.credentialEndpoint;

packages/client/lib/CredentialRequestClientBuilderV1_0_11.ts

@@ -14,8 +14,8 @@ import {
 } from '@sphereon/oid4vci-common';
 import { CredentialFormat } from '@sphereon/ssi-types';
 
-import { CredentialOfferClientV1_0_11 } from './CredentialOfferClientV1_0_11'
-import { CredentialRequestClientV1_0_11 } from './CredentialRequestClientV1_0_11'
+import { CredentialOfferClientV1_0_11 } from './CredentialOfferClientV1_0_11';
+import { CredentialRequestClientV1_0_11 } from './CredentialRequestClientV1_0_11';
 
 export class CredentialRequestClientBuilderV1_0_11 {
   credentialEndpoint?: string;

packages/client/lib/CredentialRequestClientV1_0_11.ts

@@ -14,8 +14,8 @@ import {
 import { CredentialFormat } from '@sphereon/ssi-types';
 import Debug from 'debug';
 
-import { buildProof } from './CredentialRequestClient'
-import { CredentialRequestClientBuilderV1_0_11 } from './CredentialRequestClientBuilderV1_0_11'
+import { buildProof } from './CredentialRequestClient';
+import { CredentialRequestClientBuilderV1_0_11 } from './CredentialRequestClientBuilderV1_0_11';
 import { ProofOfPossessionBuilder } from './ProofOfPossessionBuilder';
 import { isValidURL, post } from './functions';
 

packages/client/lib/OpenID4VCIClient.ts

@@ -283,7 +283,6 @@ export class OpenID4VCIClient {
       if (this._state.authorizationRequestOpts?.redirectUri && !redirectUri) {
         redirectUri = this._state.authorizationRequestOpts.redirectUri;
       }
-
       const response = await accessTokenClient.acquireAccessToken({
         credentialOffer: this.credentialOffer,
         metadata: this.endpointMetadata,

packages/client/lib/OpenID4VCIClientV1_0_11.ts

@@ -27,10 +27,10 @@ import {
 import { CredentialFormat } from '@sphereon/ssi-types';
 import Debug from 'debug';
 
-import { AccessTokenClientV1_0_11 } from './AccessTokenClientV1_0_11'
+import { AccessTokenClientV1_0_11 } from './AccessTokenClientV1_0_11';
 import { createAuthorizationRequestUrlV1_0_11 } from './AuthorizationCodeClientV1_0_11';
 import { CredentialOfferClientV1_0_11 } from './CredentialOfferClientV1_0_11';
-import { CredentialRequestClientBuilderV1_0_11 } from './CredentialRequestClientBuilderV1_0_11'
+import { CredentialRequestClientBuilderV1_0_11 } from './CredentialRequestClientBuilderV1_0_11';
 import { MetadataClient } from './MetadataClient';
 import { ProofOfPossessionBuilder } from './ProofOfPossessionBuilder';
 import { generateMissingPKCEOpts } from './functions/AuthorizationUtil';

packages/client/lib/__tests__/AccessTokenClient.spec.ts

@@ -44,6 +44,13 @@ describe('AccessTokenClient should', () => {
 
       const accessTokenResponse: OpenIDResponse<AccessTokenResponse> = await accessTokenClient.acquireAccessTokenUsingRequest({
         accessTokenRequest,
+        pinMetadata: {
+          isPinRequired: true,
+          txCode: {
+            length: accessTokenRequest['pre-authorized_code'].length,
+            input_mode: 'numeric',
+          },
+        },
         asOpts: { as: MOCK_URL },
       });
 
@@ -121,13 +128,16 @@ describe('AccessTokenClient should', () => {
       await expect(
         accessTokenClient.acquireAccessTokenUsingRequest({
           accessTokenRequest,
-          txCode: {
-            length: 8,
-            input_mode: 'text',
+          pinMetadata: {
+            isPinRequired: true,
+            txCode: {
+              length: 6,
+              input_mode: 'text',
+            },
           },
           asOpts: { as: MOCK_URL },
         }),
-      ).rejects.toThrow('A valid pin consisting of maximal 8 numeric characters must be present.');
+      ).rejects.toThrow('A valid pin must be present according to the specified transaction code requirements.');
     },
     UNIT_TEST_TIMEOUT,
   );
@@ -149,13 +159,16 @@ describe('AccessTokenClient should', () => {
       await expect(
         accessTokenClient.acquireAccessTokenUsingRequest({
           accessTokenRequest,
-          txCode: {
-            length: 9,
-            input_mode: 'text',
+          pinMetadata: {
+            isPinRequired: true,
+            txCode: {
+              length: 6,
+              input_mode: 'text',
+            },
           },
           asOpts: { as: MOCK_URL },
         }),
-      ).rejects.toThrow(Error('A valid pin consisting of maximal 8 numeric characters must be present.'));
+      ).rejects.toThrow(Error('A valid pin must be present according to the specified transaction code requirements.'));
     },
     UNIT_TEST_TIMEOUT,
   );
@@ -184,9 +197,12 @@ describe('AccessTokenClient should', () => {
 
       const response = await accessTokenClient.acquireAccessTokenUsingRequest({
         accessTokenRequest,
-        txCode: {
-          length: 8,
-          input_mode: 'text',
+        pinMetadata: {
+          isPinRequired: true,
+          txCode: {
+            length: 8,
+            input_mode: 'text',
+          },
         },
         asOpts: { as: MOCK_URL },
       });
@@ -199,14 +215,16 @@ describe('AccessTokenClient should', () => {
     const accessTokenClient: AccessTokenClient = new AccessTokenClient();
 
     nock(MOCK_URL).post(/.*/).reply(200, {});
-    nock(INITIATION_TEST.credential_offer.credential_issuer+'token').post(/.*/).reply(200, {});
+    nock(INITIATION_TEST.credential_offer.credential_issuer + 'token')
+      .post(/.*/)
+      .reply(200, {});
 
     await expect(() =>
       accessTokenClient.acquireAccessToken({
         credentialOffer: INITIATION_TEST,
         pin: '1234',
       }),
-    ).rejects.toThrow(Error('Cannot set a pin, when the pin is not required.'));
+    ).rejects.toThrow(Error('A valid pin must be present according to the specified transaction code requirements.'));
   });
 
   it('get error if no as, issuer and metadata values are present', async () => {

packages/client/lib/__tests__/CredentialRequestClient.spec.ts

@@ -21,9 +21,8 @@ import {
   CredentialRequestClientBuilder,
   CredentialRequestClientBuilderV1_0_11,
   MetadataClient,
-  ProofOfPossessionBuilder
-} from '..'
-import { CredentialOfferClient } from '../CredentialOfferClient';
+  ProofOfPossessionBuilder,
+} from '..';
 
 import { IDENTIPROOF_ISSUER_URL, IDENTIPROOF_OID4VCI_METADATA, INITIATION_TEST, WALT_OID4VCI_METADATA } from './MetadataMocks';
 import { getMockData } from './data/VciDataFixtures';
@@ -73,7 +72,6 @@ afterEach(async () => {
   nock.cleanAll();
 });
 describe('Credential Request Client ', () => {
-
   it('should get success credential response', async function () {
     const mockedVC =
       'eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2YyI6eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvMjAxOC9jcmVkZW50aWFscy92MSIsImh0dHBzOi8vd3d3LnczLm9yZy8yMDE4L2NyZWRlbnRpYWxzL2V4YW1wbGVzL3YxIl0sImlkIjoiaHR0cDovL2V4YW1wbGUuZWR1L2NyZWRlbnRpYWxzLzM3MzIiLCJ0eXBlIjpbIlZlcmlmaWFibGVDcmVkZW50aWFsIiwiVW5pdmVyc2l0eURlZ3JlZUNyZWRlbnRpYWwiXSwiaXNzdWVyIjoiaHR0cHM6Ly9leGFtcGxlLmVkdS9pc3N1ZXJzLzU2NTA0OSIsImlzc3VhbmNlRGF0ZSI6IjIwMTAtMDEtMDFUMDA6MDA6MDBaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJkaWQ6ZXhhbXBsZTplYmZlYjFmNzEyZWJjNmYxYzI3NmUxMmVjMjEiLCJkZWdyZWUiOnsidHlwZSI6IkJhY2hlbG9yRGVncmVlIiwibmFtZSI6IkJhY2hlbG9yIG9mIFNjaWVuY2UgYW5kIEFydHMifX19LCJpc3MiOiJodHRwczovL2V4YW1wbGUuZWR1L2lzc3VlcnMvNTY1MDQ5IiwibmJmIjoxMjYyMzA0MDAwLCJqdGkiOiJodHRwOi8vZXhhbXBsZS5lZHUvY3JlZGVudGlhbHMvMzczMiIsInN1YiI6ImRpZDpleGFtcGxlOmViZmViMWY3MTJlYmM2ZjFjMjc2ZTEyZWMyMSJ9.z5vgMTK1nfizNCg5N-niCOL3WUIAL7nXy-nGhDZYO_-PNGeE-0djCpWAMH8fD8eWSID5PfkPBYkx_dfLJnQ7NA';
@@ -170,7 +168,7 @@ describe('Credential Request Client with different issuers ', () => {
   });
   it('should create correct CredentialRequest for Spruce', async () => {
     const IRR_URI =
-      'openid-initiate-issuance://?issuer=https%3A%2F%2Fngi%2Doidc4vci%2Dtest%2Espruceid%2Exyz&credential_type=OpenBadgeCredential&pre-authorized_code=eyJhbGciOiJFUzI1NiJ9.eyJjcmVkZW50aWFsX3R5cGUiOlsiT3BlbkJhZGdlQ3JlZGVudGlhbCJdLCJleHAiOiIyMDIzLTA0LTIwVDA5OjA0OjM2WiIsIm5vbmNlIjoibWFibmVpT0VSZVB3V3BuRFFweEt3UnRsVVRFRlhGUEwifQ.qOZRPN8sTv_knhp7WaWte2-aDULaPZX--2i9unF6QDQNUllqDhvxgIHMDCYHCV8O2_Gj-T2x1J84fDMajE3asg&user_pin_required=false';
+      'openid-credential-offer://?credential_offer=%7B%22credential_issuer%22:%22https://credential-issuer.example.com%22,%22credential_configuration_ids%22:%5B%22OpenBadgeCredential%22%5D,%22grants%22:%7B%22urn:ietf:params:oauth:grant-type:pre-authorized_code%22:%7B%22pre-authorized_code%22:%22oaKazRN8I0IbtZ0C7JuMn5%22,%22tx_code%22:%7B%22input_mode%22:%22text%22,%22description%22:%22Please%20enter%20the%20serial%20number%20of%20your%20physical%20drivers%20license%22%7D%7D%7D%7D';
     const credentialRequest = await (
       await CredentialRequestClientBuilder.fromURI({
         uri: IRR_URI,
@@ -185,7 +183,7 @@ describe('Credential Request Client with different issuers ', () => {
         },
         credentialTypes: ['OpenBadgeCredential'],
         format: 'jwt_vc',
-        version: OpenId4VCIVersion.VER_1_0_08,
+        version: OpenId4VCIVersion.VER_1_0_13,
       });
     const draft8CredentialRequest = getCredentialRequestForVersion(credentialRequest, OpenId4VCIVersion.VER_1_0_08);
     expect(draft8CredentialRequest).toEqual(getMockData('spruce')?.credential.request);

packages/client/lib/__tests__/CredentialRequestClientV1_0_11.spec.ts

@@ -16,15 +16,15 @@ import * as jose from 'jose';
 // @ts-ignore
 import nock from 'nock';
 
-import { CredentialOfferClientV1_0_11, CredentialRequestClientBuilderV1_0_11, MetadataClient, ProofOfPossessionBuilder } from '..'
+import { CredentialOfferClientV1_0_11, CredentialRequestClientBuilderV1_0_11, MetadataClient, ProofOfPossessionBuilder } from '..';
 
 import {
   IDENTIPROOF_ISSUER_URL,
   IDENTIPROOF_OID4VCI_METADATA,
   INITIATION_TEST,
   INITIATION_TEST_V1_0_08,
-  WALT_OID4VCI_METADATA
-} from './MetadataMocks'
+  WALT_OID4VCI_METADATA,
+} from './MetadataMocks';
 import { getMockData } from './data/VciDataFixtures';
 
 const partialJWT = 'eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6ZXhhbXBsZTplYmZlYjFmN';