feat: add OAuth client attestation support for OID4VCI flows - #11
Merged
Merged
Conversation
Add types and helper for passing WIA + PoP through WMP flow.start params per draft-ietf-oauth-attestation-based-client-auth-04 §3.1: - OID4VCIFlowParams: typed interface for OID4VCI flow start params, including client_attestation and client_attestation_pop fields - OID4VPFlowParams: typed interface for OID4VP flow start params - buildVCIFlowStart(): helper to construct FlowStartParams with attestation Architecture: The instance key lives client-side in passkey-PRF-encrypted private data. The client signs the PoP locally (aud = issuer AS URL) and passes both WIA + PoP at flow start. The backend forwards them as HTTP headers without modification. Aligns with go-wallet-backend PR #221 (WIA service) and PR #163 (WMP integration) which consume these fields via FlowStartMessage JSON deserialization.
There was a problem hiding this comment.
Pull request overview
Adds typed parameter objects for OpenID4x flows and a convenience helper for constructing wmp.flow.start params, enabling OAuth client attestation (WIA + PoP) to be forwarded through WMP OID4VCI flows.
Changes:
- Introduce
OID4VCIFlowParamsandOID4VPFlowParamsfor theFlowStartParams.paramspayload. - Add
buildVCIFlowStart()helper to constructFlowStartParamsfor OID4VCI. - Export the new helper and types from the package entrypoint.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/openid4x.ts | Adds new OID4VCI/OID4VP flow param types and a helper to build OID4VCI flow start params (including attestation fields). |
| src/index.ts | Re-exports the new helper and types for public consumption. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…dence Decouple WIA/PoP acquisition from any specific backend API: - Add ClientAttestationProvider interface: callers implement getAttestation(audience) to obtain WIA + PoP JWTs using their own backend/provider - Add ClientAttestation type for the WIA + PoP pair - Add withAttestation() helper that calls the provider and merges attestation into OID4VCIFlowParams - Remove references to go-wallet-backend-specific endpoints in docs The library provides the types and protocol plumbing; the caller provides the implementation for obtaining attestation credentials from their specific wallet provider infrastructure.
- Replace hard-coded "1.0" with the library's VERSION constant ("0.1")
in buildVCIFlowStart() to match the protocol version.
- Refactor OID4VCIFlowParams into a discriminated union requiring exactly
one of offer or credential_offer_uri, preventing invalid payloads.
Addresses review comments on #11.
…cation types Addresses SonarCloud quality gate failure (0% coverage on new code).
- Add 'types: ["node"]' to tsconfig.json (required by TypeScript 6) - Add @vitest/coverage-v8 and configure lcov coverage output - Update SonarCloud workflow to run tests with coverage before scan - Add sonar-project.properties with lcov report path - Add coverage/ to .gitignore
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds typed interfaces and a provider abstraction for OAuth client attestation in OID4VCI flows per draft-ietf-oauth-attestation-based-client-auth-04 §3.1.
Design Principle
wmp-js is backend-agnostic. The library defines the protocol types and transport plumbing; the caller provides the implementation for obtaining attestation credentials from their specific wallet provider infrastructure.
New Types
ClientAttestationProvider— interface that callers implement to obtain WIA + PoPClientAttestation— the WIA + PoP pair returned by the providerOID4VCIFlowParams— typed params blob for OID4VCI flows (includes attestation fields)OID4VPFlowParams— typed params blob for OID4VP flowsNew Helpers
buildVCIFlowStart()— builds FlowStartParams for an OID4VCI flowwithAttestation(provider, audience, params)— calls the provider and merges attestation into flow paramsArchitecture
The wallet instance key never resides on the backend. The
ClientAttestationProviderabstraction ensures wmp-js has zero dependency on any specific backend API.