Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
44 commits
Select commit Hold shift + click to select a range
031b0d9
feat(openid4vci): align error codes with v1.0 Section 8.3.1.2
JorisHeadease Feb 24, 2026
7eb1c9c
feat(openid4vci): update types and issuer for v1.0 metadata and offer
JorisHeadease Feb 24, 2026
09e1078
feat(openid4vci): update holder and API handler for v1.0
JorisHeadease Feb 24, 2026
8bf04d0
feat(openid4vci): update OpenAPI spec and remove stale VP metadata
JorisHeadease Feb 24, 2026
31ed810
fix(openid4vci): align wire formats with v1.0 spec review
JorisHeadease Mar 6, 2026
1d3255b
feat(openid4vci): align auth module with v1.0 spec
JorisHeadease Mar 9, 2026
67240c6
fix(openid4vci): harden input validation and add missing tests
JorisHeadease Mar 9, 2026
86be9f4
fix(openid4vci): restore PreAuthorizedGrantAnonymousAccessSupported i…
JorisHeadease Mar 9, 2026
2ed1269
docs(openid4vci): improve OpenAPI spec v1.0 accuracy
JorisHeadease Mar 10, 2026
f56cba3
fix(openid4vci): correct holder error code for unsupported format
JorisHeadease Mar 10, 2026
b2ede53
test(openid4vci): fix auth header bug and add missing test coverage
JorisHeadease Mar 10, 2026
e18dd4f
refactor(openid4vci): restore original error comments and simplify de…
JorisHeadease Mar 10, 2026
757fd54
fix(openid4vci): restore JSON deep copy and remove resolved TODO
JorisHeadease Mar 10, 2026
aa06502
fix(openid4vci): harden validation and fix spec compliance issues
JorisHeadease Mar 10, 2026
9fe7d93
refactor(openid4vci): clean up CredentialRequest and rename Id to ID
JorisHeadease Mar 10, 2026
5562e99
fix(openid4vci): use json.RawMessage for CredentialResponseEntry
JorisHeadease Mar 10, 2026
0c1f574
refactor(openid4vci): unify duplicate types across packages
JorisHeadease Mar 11, 2026
b505e65
qlty fmt
qltysh[bot] Mar 11, 2026
7dc69bf
refactor(openid4vci): introduce auth/openid4vci package for v1.0
JorisHeadease May 7, 2026
a0af85b
refactor(openid4vci): restore vcr internal flow to master (draft-11)
JorisHeadease May 7, 2026
cabaa78
feat(auth/openid4vci): add Client with metadata, nonce, and credentia…
JorisHeadease May 7, 2026
458bf80
feat(auth): expose OpenID4VCIClient() accessor on auth.Authentication…
JorisHeadease May 7, 2026
83af375
refactor(auth/iam): use auth.OpenID4VCIClient() for OpenID4VCI calls
JorisHeadease May 7, 2026
74ddb0d
refactor(auth/client/iam): drop OpenID4VCI methods from OpenID4VPClient
JorisHeadease May 7, 2026
1b04b19
chore: regenerate generated.go from current OpenAPI spec
JorisHeadease May 8, 2026
cb6b600
feat(auth/iam): type authorization_details in OpenAPI schema
JorisHeadease May 8, 2026
a9545b6
docs(auth/iam): cite OpenID4VCI 1.0 §8.3.1.2 on invalid_nonce retry
JorisHeadease May 8, 2026
7971cbe
docs(vcr/openid4vci): clarify package purpose and divergence from v1.0
JorisHeadease May 8, 2026
9a52e06
fix(auth/openid4vci): validate credential_issuer matches requested URL
JorisHeadease May 8, 2026
2376424
fix(auth/iam): unwrap JSON-string credentials in CredentialResponse
JorisHeadease May 8, 2026
f67150c
feat(auth/iam): use credential_identifier from token response per §8.2
JorisHeadease May 8, 2026
a72d50a
fix(auth/iam): tighten authorization_details validation per §5.1.1, §…
JorisHeadease May 8, 2026
6549487
fix(auth/openid4vci): validate target URLs to prevent SSRF (CodeQL)
JorisHeadease May 8, 2026
2d032b2
fix(auth/iam): require non-empty authorization_details
JorisHeadease May 8, 2026
0d580fc
fix(auth/openid4vci): reject query/fragment in Credential Issuer Iden…
JorisHeadease May 8, 2026
1e1fa33
fix(auth/iam): use Credential Issuer Identifier as proof JWT aud
JorisHeadease May 8, 2026
461d770
refactor(auth/openid4vci): reuse oauth.OAuth2Error for wire errors
JorisHeadease May 8, 2026
44ccc6e
docs(auth/openid4vci): note follow-up to move URL validation to HTTPC…
JorisHeadease May 8, 2026
4f95414
docs(auth/iam): explain why JSON-string credential needs unwrapping
JorisHeadease May 8, 2026
09422fb
fix(auth/openid4vci): preserve percent-encoded path segments in well-…
JorisHeadease May 8, 2026
fe2d563
fix(auth/iam): reject empty authorization_details before metadata fetch
JorisHeadease May 8, 2026
f92440c
fix(auth/iam): enforce single authorization_details entry per call
JorisHeadease May 8, 2026
32cb26c
docs: correct OpenID4VCI 1.0 spec section references
JorisHeadease May 8, 2026
0050aec
docs(deployment): add OpenID4VCI section to OAuth profile page
JorisHeadease May 11, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions auth/api/auth/v1/api_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ import (
pkg2 "github.com/nuts-foundation/nuts-node/auth"
"github.com/nuts-foundation/nuts-node/auth/client/iam"
"github.com/nuts-foundation/nuts-node/auth/contract"
"github.com/nuts-foundation/nuts-node/auth/openid4vci"
oauth2 "github.com/nuts-foundation/nuts-node/auth/oauth"
"github.com/nuts-foundation/nuts-node/auth/services"
"github.com/nuts-foundation/nuts-node/auth/services/dummy"
Expand Down Expand Up @@ -86,6 +87,10 @@ func (m *mockAuthClient) IAMClient() iam.Client {
return m.iamClient
}

func (m *mockAuthClient) OpenID4VCIClient() openid4vci.Client {
return nil
}

func (m *mockAuthClient) ContractNotary() services.ContractNotary {
return m.contractNotary
}
Expand Down
5 changes: 3 additions & 2 deletions auth/api/iam/api.go
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ import (
iamclient "github.com/nuts-foundation/nuts-node/auth/client/iam"
"github.com/nuts-foundation/nuts-node/auth/log"
"github.com/nuts-foundation/nuts-node/auth/oauth"
"github.com/nuts-foundation/nuts-node/auth/openid4vci"
"github.com/nuts-foundation/nuts-node/core"
nutsCrypto "github.com/nuts-foundation/nuts-node/crypto"
nutsHttp "github.com/nuts-foundation/nuts-node/http"
Expand Down Expand Up @@ -867,8 +868,8 @@ func (r Wrapper) StatusList(ctx context.Context, request StatusListRequestObject
return StatusList200JSONResponse(*cred), nil
}

func (r Wrapper) openid4vciMetadata(ctx context.Context, issuer string) (*oauth.OpenIDCredentialIssuerMetadata, *oauth.AuthorizationServerMetadata, error) {
credentialIssuerMetadata, err := r.auth.IAMClient().OpenIdCredentialIssuerMetadata(ctx, issuer)
func (r Wrapper) openid4vciMetadata(ctx context.Context, issuer string) (*openid4vci.OpenIDCredentialIssuerMetadata, *oauth.AuthorizationServerMetadata, error) {
credentialIssuerMetadata, err := r.auth.OpenID4VCIClient().OpenIDCredentialIssuerMetadata(ctx, issuer)
if err != nil {
return nil, nil, err
}
Expand Down
5 changes: 5 additions & 0 deletions auth/api/iam/api_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ import (
"github.com/nuts-foundation/nuts-node/auth"
"github.com/nuts-foundation/nuts-node/auth/client/iam"
"github.com/nuts-foundation/nuts-node/auth/oauth"
"github.com/nuts-foundation/nuts-node/auth/openid4vci"
oauthServices "github.com/nuts-foundation/nuts-node/auth/services/oauth"
"github.com/nuts-foundation/nuts-node/core"
"github.com/nuts-foundation/nuts-node/core/to"
Expand Down Expand Up @@ -1588,6 +1589,7 @@ type testCtx struct {
wallet *holder.MockWallet
subjectManager *didsubject.MockManager
jar *MockJAR
openid4vciClient *openid4vci.MockClient
}

func newTestClient(t testing.TB) *testCtx {
Expand All @@ -1605,6 +1607,7 @@ func newCustomTestClient(t testing.TB, publicURL *url.URL, authEndpointEnabled b
vcIssuer := issuer.NewMockIssuer(ctrl)
vcVerifier := verifier.NewMockVerifier(ctrl)
iamClient := iam.NewMockClient(ctrl)
openid4vciClient := openid4vci.NewMockClient(ctrl)
mockDocumentOwner := didsubject.NewMockDocumentOwner(ctrl)
subjectManager := didsubject.NewMockManager(ctrl)
mockVCR := vcr.NewMockVCR(ctrl)
Expand All @@ -1620,6 +1623,7 @@ func newCustomTestClient(t testing.TB, publicURL *url.URL, authEndpointEnabled b
mockVCR.EXPECT().Verifier().Return(vcVerifier).AnyTimes()
mockVCR.EXPECT().Wallet().Return(mockWallet).AnyTimes()
authnServices.EXPECT().IAMClient().Return(iamClient).AnyTimes()
authnServices.EXPECT().OpenID4VCIClient().Return(openid4vciClient).AnyTimes()
authnServices.EXPECT().AuthorizationEndpointEnabled().Return(authEndpointEnabled).AnyTimes()

subjectManager.EXPECT().ListDIDs(gomock.Any(), holderSubjectID).Return([]did.DID{holderDID}, nil).AnyTimes()
Expand Down Expand Up @@ -1657,5 +1661,6 @@ func newCustomTestClient(t testing.TB, publicURL *url.URL, authEndpointEnabled b
jwtSigner: jwtSigner,
jar: mockJAR,
client: client,
openid4vciClient: openid4vciClient,
}
}
39 changes: 35 additions & 4 deletions auth/api/iam/generated.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading