{"version":3,"file":"OpenId4VcIssuerModuleConfig.mjs","names":[],"sources":["../../src/openid4vc-issuer/OpenId4VcIssuerModuleConfig.ts"],"sourcesContent":["import type { Express } from 'express'\nimport type {\n  OpenId4VciCredentialRequestToCredentialMapper,\n  OpenId4VciDeferredCredentialRequestToCredentialMapper,\n  OpenId4VciGetChainedAuthorizationRequestParameters,\n  OpenId4VciGetVerificationSession,\n} from './OpenId4VcIssuerServiceOptions'\n\nconst DEFAULT_C_NONCE_EXPIRES_IN = 1 * 60 // 1 minute\nconst DEFAULT_AUTHORIZATION_CODE_EXPIRES_IN = 1 * 60 // 1 minute\nconst DEFAULT_TOKEN_EXPIRES_IN = 3 * 60 // 3 minutes\nconst DEFAULT_REFRESH_TOKEN_EXPIRES_IN = 90 * 24 * 60 * 60 // 90 days\nconst DEFAULT_DEFERRAL_INTERVAL_GRACE_PERIOD = 7 * 24 * 60 * 60 // 7 days\nconst DEFAULT_STATEFUL_CREDENTIAL_OFFER_EXPIRES_IN = 3 * 60 // 3 minutes\nconst DEFAULT_REQUEST_URI_EXPIRES_IN = 1 * 60 // 1 minute\n\nexport interface InternalOpenId4VcIssuerModuleConfigOptions {\n  /**\n   * Base url at which the issuer endpoints will be hosted. All endpoints will be exposed with\n   * this path as prefix.\n   */\n  baseUrl: string\n\n  /**\n   * Express app on which the openid4vci endpoints will be registered.\n   */\n  app: Express\n\n  /**\n   * The time after which a cNonce will expire.\n   *\n   * @default 60 (1 minute)\n   */\n  cNonceExpiresInSeconds?: number\n\n  /**\n   * The time after which a stateful credential offer not bound to a subject expires. Once the offer has been bound\n   * to a subject the access token expiration takes effect. This is to prevent long-lived `pre-authorized_code` and\n   * `issuer_state` values.\n   *\n   * @default 180 (3 minutes)\n   */\n  statefulCredentialOfferExpirationInSeconds?: number\n\n  /**\n   * For how long should the issuance session be kept alive after the deferral interval\n   * has passed. This is to allow for allow some time for the holder to recheck whether\n   * the credential is ready or not.\n   *\n   * @default 604800 (7 days)\n   */\n  deferralIntervalGracePeriodInSeconds?: number\n\n  /**\n   * The time after which an authorization code will expire.\n   *\n   * @default 60 (1 minute)\n   */\n  authorizationCodeExpiresInSeconds?: number\n\n  /**\n   * The time after which an access token will expire.\n   *\n   * @default 180 (3 minutes)\n   */\n  accessTokenExpiresInSeconds?: number\n\n  /**\n   * The time after which a refresh token will expire.\n   *\n   * @default 7776000 (90 days)\n   */\n  refreshTokenExpiresInSeconds?: number\n\n  /**\n   * The time after which a pushed authorization request URI will expire.\n   *\n   * @default 60 (1 minute)\n   */\n  requestUriExpiresInSeconds?: number\n\n  /**\n   * Whether DPoP is required for all issuance sessions. This value can be overridden when creating\n   * a credential offer. If dpop is not required, but used by a client in the first request to credo,\n   * DPoP will be required going forward.\n   *\n   * @default false\n   */\n  dpopRequired?: boolean\n\n  /**\n   * Whether wallet attestations are required for all issuance sessions. This value can be overridden when creating\n   * a credential offer, but will have effect for dynamic issuance sessions. If wallet attestations are not required\n   * but used by a client in the first request to credo,\n   * wallet attestations will be required going forward.\n   *\n   * @default false\n   */\n  walletAttestationsRequired?: boolean\n\n  /**\n   * Whether to allow dynamic issuance sessions based on a credential request.\n   *\n   * This requires an external authorization server which issues access tokens without\n   * a `pre-authorized_code` or `issuer_state` parameter.\n   *\n   * Credo only support stateful credential offer sessions (pre-auth or presentation during issuance)\n   *\n   * @default false\n   */\n  allowDynamicIssuanceSessions?: boolean\n\n  /**\n   * A function mapping a credential request to the credential to be issued.\n   *\n   * When multiple credentials are returned it is recommended to use different or approximate issuance and expiration\n   * times to prevent correlation based on the specific time\n   */\n  credentialRequestToCredentialMapper: OpenId4VciCredentialRequestToCredentialMapper\n\n  /**\n   * A function mapping a deferred credential request to the credential to be issued.\n   *\n   * When multiple credentials are returned it is recommended to use different or approximate issuance and expiration\n   * times to prevent correlation based on the specific time\n   */\n  deferredCredentialRequestToCredentialMapper?: OpenId4VciDeferredCredentialRequestToCredentialMapper\n\n  /**\n   * @deprecated use `getVerificationSession` instead.\n   */\n  getVerificationSessionForIssuanceSessionAuthorization?: OpenId4VciGetVerificationSession\n\n  /**\n   * Callback to get a verification session that needs to be fulfilled for the authorization of\n   * of a credential issuance session. Once the verification session has been completed the user can\n   * retrieve an authorization code and access token and retrieve the credential(s).\n   *\n   * Required if presentation during issuance flow is used\n   */\n  getVerificationSession?: OpenId4VciGetVerificationSession\n\n  /**\n   * Callback to get additional details for the chained authorization server flow.\n   * This will be called when a credential offer request is configured to use a chained\n   * authorization server, but the scopesMapping configuration is not defined.\n   *\n   * Required if chained authorization server flow is used without a static scopes mapping configuration.\n   */\n  getChainedAuthorizationRequestParameters?: OpenId4VciGetChainedAuthorizationRequestParameters\n\n  /**\n   * Custom the paths used for endpoints\n   */\n  endpoints?: {\n    /**\n     * @default /nonce\n     */\n    nonce?: string\n\n    /**\n     * @default /challenge\n     */\n    authorizationChallenge?: string\n\n    /**\n     * @default /offers\n     */\n    credentialOffer?: string\n\n    /**\n     * @default /credential\n     */\n    credential?: string\n\n    /**\n     * @default /deferred-credential\n     */\n    deferredCredential?: string\n\n    /**\n     * @default /token\n     */\n    accessToken?: string\n\n    /**\n     * @default /par\n     */\n    pushedAuthorizationRequest?: string\n\n    /**\n     * @default /authorize\n     */\n    authorization?: string\n\n    /**\n     * @default /redirect\n     */\n    redirect?: string\n\n    /**\n     * @default /jwks\n     */\n    jwks: string\n  }\n}\n\nexport class OpenId4VcIssuerModuleConfig {\n  private options: InternalOpenId4VcIssuerModuleConfigOptions\n\n  /**\n   * Callback to get a verification session that needs to be fulfilled for the authorization of\n   * of a credential issuance session. Once the verification session has been completed the user can\n   * retrieve an authorization code and access token and retrieve the credential(s).\n   *\n   * Required if presentation during issuance flow is used\n   */\n  public getVerificationSession?: OpenId4VciGetVerificationSession\n\n  /**\n   * Callback to get additional details for the chained authorization server flow.\n   * This will be called when a credential offer request is configured to use a chained\n   * authorization server. If not defined, `scopesMapping` and `redirectUris` from\n   * the authorization server configuration will be used.\n   *\n   * Required if chained authorization server flow is used without a static scopes mapping configuration.\n   */\n  public getChainedAuthorizationRequestParameters?: OpenId4VciGetChainedAuthorizationRequestParameters\n\n  public constructor(options: InternalOpenId4VcIssuerModuleConfigOptions) {\n    this.options = options\n    this.getVerificationSession =\n      options.getVerificationSession ?? options.getVerificationSessionForIssuanceSessionAuthorization\n    this.getChainedAuthorizationRequestParameters = options.getChainedAuthorizationRequestParameters\n  }\n\n  public get app() {\n    return this.options.app\n  }\n\n  public get baseUrl() {\n    return this.options.baseUrl\n  }\n\n  /**\n   * A function mapping a credential request to the credential to be issued.\n   */\n  public get credentialRequestToCredentialMapper() {\n    return this.options.credentialRequestToCredentialMapper\n  }\n\n  /**\n   * A function mapping a credential request to the credential to be issued.\n   */\n  public get deferredCredentialRequestToCredentialMapper() {\n    return this.options.deferredCredentialRequestToCredentialMapper\n  }\n\n  /**\n   * The time after which a cNone will expire.\n   *\n   * @default 60 (1 minute)\n   */\n  public get cNonceExpiresInSeconds(): number {\n    return this.options.cNonceExpiresInSeconds ?? DEFAULT_C_NONCE_EXPIRES_IN\n  }\n\n  /**\n   * The time after which a stateful credential offer not bound to a subject expires. Once the offer has been bound\n   * to a subject the access token expiration takes effect. This is to prevent long-lived `pre-authorized_code` and\n   * `issuer_state` values.\n   *\n   * @default 360 (5 minutes)\n   */\n  public get statefulCredentialOfferExpirationInSeconds(): number {\n    return this.options.statefulCredentialOfferExpirationInSeconds ?? DEFAULT_STATEFUL_CREDENTIAL_OFFER_EXPIRES_IN\n  }\n\n  /**\n   * For how long should the issuance session be kept alive after the deferral interval\n   * has passed. This is to allow for allow some time for the holder to recheck whether\n   * the credential is ready or not.\n   *\n   * @default 604800 (7 days)\n   */\n  public get deferralIntervalGracePeriodInSeconds(): number {\n    return this.options.deferralIntervalGracePeriodInSeconds ?? DEFAULT_DEFERRAL_INTERVAL_GRACE_PERIOD\n  }\n\n  /**\n   * The time after which a cNonce will expire.\n   *\n   * @default 60 (1 minute)\n   */\n  public get authorizationCodeExpiresInSeconds(): number {\n    return this.options.authorizationCodeExpiresInSeconds ?? DEFAULT_AUTHORIZATION_CODE_EXPIRES_IN\n  }\n\n  /**\n   * The time after which an access token will expire.\n   *\n   * @default 180 (3 minutes)\n   */\n  public get accessTokenExpiresInSeconds(): number {\n    return this.options.accessTokenExpiresInSeconds ?? DEFAULT_TOKEN_EXPIRES_IN\n  }\n\n  /**\n   * The time after which a refresh token will expire.\n   *\n   * @default 7776000 (90 days)\n   */\n  public get refreshTokenExpiresInSeconds(): number {\n    return this.options.refreshTokenExpiresInSeconds ?? DEFAULT_REFRESH_TOKEN_EXPIRES_IN\n  }\n\n  /**\n   * The time after which a pushed authorization request URI will expire.\n   *\n   * @default 60 (1 minute)\n   */\n  public get requestUriExpiresInSeconds(): number {\n    return this.options.requestUriExpiresInSeconds ?? DEFAULT_REQUEST_URI_EXPIRES_IN\n  }\n\n  /**\n   * Whether DPoP is required for all issuance sessions. This value can be overridden when creating\n   * a credential offer. If dpop is not required, but used by a client in the first request to credo,\n   * DPoP will be required going forward.\n   *\n   * @default false\n   */\n  public get dpopRequired(): boolean {\n    return this.options.dpopRequired ?? false\n  }\n\n  /**\n   * Whether wallet attestations are required for all issuance sessions. This value can be overridden when creating\n   * a credential offer, but will have effect for dynamic issuance sessions. If wallet attestations are not required\n   * but used by a client in the first request to credo,\n   * wallet attestations will be required going forward.\n   *\n   * @default false\n   */\n  public get walletAttestationsRequired(): boolean {\n    return this.options.walletAttestationsRequired ?? false\n  }\n\n  /**\n   * Whether to allow dynamic issuance sessions based on a credential request.\n   *\n   * This requires an external authorization server which issues access tokens without\n   * a `pre-authorized_code` or `issuer_state` parameter.\n   *\n   * Credo only supports stateful credential offer sessions (pre-auth or presentation during issuance)\n   *\n   * @default false\n   */\n  public get allowDynamicIssuanceSessions(): boolean {\n    return this.options.allowDynamicIssuanceSessions ?? false\n  }\n\n  /**\n   * @default /nonce\n   */\n  public get nonceEndpointPath(): string {\n    return this.options.endpoints?.nonce ?? '/nonce'\n  }\n\n  /**\n   * @default /par\n   */\n  public get pushedAuthorizationRequestEndpoint(): string {\n    return this.options.endpoints?.pushedAuthorizationRequest ?? '/par'\n  }\n\n  /**\n   * @default /authorize\n   */\n  public get authorizationEndpoint(): string {\n    return this.options.endpoints?.authorization ?? '/authorize'\n  }\n\n  /**\n   * @default /redirect\n   */\n  public get redirectEndpoint(): string {\n    return this.options.endpoints?.redirect ?? '/redirect'\n  }\n\n  /**\n   * @default /challenge\n   */\n  public get authorizationChallengeEndpointPath(): string {\n    return this.options.endpoints?.authorizationChallenge ?? '/challenge'\n  }\n\n  /**\n   * @default /offers\n   */\n  public get credentialOfferEndpointPath(): string {\n    return this.options.endpoints?.credentialOffer ?? '/offers'\n  }\n\n  /**\n   * @default /credential\n   */\n  public get credentialEndpointPath(): string {\n    return this.options.endpoints?.credential ?? '/credential'\n  }\n\n  /**\n   * @default /deferred-credential\n   */\n  public get deferredCredentialEndpointPath(): string {\n    return this.options.endpoints?.deferredCredential ?? '/deferred-credential'\n  }\n\n  /**\n   * @default /token\n   */\n  public get accessTokenEndpointPath(): string {\n    return this.options.endpoints?.accessToken ?? '/token'\n  }\n\n  /**\n   * @default /jwks\n   */\n  public get jwksEndpointPath(): string {\n    return this.options.endpoints?.jwks ?? '/jwks'\n  }\n\n  /**\n   * @deprecated use `getVerificationSession` instead.\n   */\n  public get getVerificationSessionForIssuanceSessionAuthorization() {\n    return this.getVerificationSession\n  }\n\n  /**\n   * @deprecated use `getVerificationSession` instead.\n   */\n  public set getVerificationSessionForIssuanceSessionAuthorization(value:\n    | OpenId4VciGetVerificationSession\n    | undefined,) {\n    this.getVerificationSession = value\n  }\n}\n"],"mappings":";AAQA,MAAM,6BAA6B;AACnC,MAAM,wCAAwC;AAC9C,MAAM,2BAA2B;AACjC,MAAM,mCAAmC,OAAU,KAAK;AACxD,MAAM,yCAAyC,QAAc;AAC7D,MAAM,+CAA+C;AACrD,MAAM,iCAAiC;AAiMvC,IAAa,8BAAb,MAAyC;CAsBvC,AAAO,YAAY,SAAqD;AACtE,OAAK,UAAU;AACf,OAAK,yBACH,QAAQ,0BAA0B,QAAQ;AAC5C,OAAK,2CAA2C,QAAQ;;CAG1D,IAAW,MAAM;AACf,SAAO,KAAK,QAAQ;;CAGtB,IAAW,UAAU;AACnB,SAAO,KAAK,QAAQ;;;;;CAMtB,IAAW,sCAAsC;AAC/C,SAAO,KAAK,QAAQ;;;;;CAMtB,IAAW,8CAA8C;AACvD,SAAO,KAAK,QAAQ;;;;;;;CAQtB,IAAW,yBAAiC;AAC1C,SAAO,KAAK,QAAQ,0BAA0B;;;;;;;;;CAUhD,IAAW,6CAAqD;AAC9D,SAAO,KAAK,QAAQ,8CAA8C;;;;;;;;;CAUpE,IAAW,uCAA+C;AACxD,SAAO,KAAK,QAAQ,wCAAwC;;;;;;;CAQ9D,IAAW,oCAA4C;AACrD,SAAO,KAAK,QAAQ,qCAAqC;;;;;;;CAQ3D,IAAW,8BAAsC;AAC/C,SAAO,KAAK,QAAQ,+BAA+B;;;;;;;CAQrD,IAAW,+BAAuC;AAChD,SAAO,KAAK,QAAQ,gCAAgC;;;;;;;CAQtD,IAAW,6BAAqC;AAC9C,SAAO,KAAK,QAAQ,8BAA8B;;;;;;;;;CAUpD,IAAW,eAAwB;AACjC,SAAO,KAAK,QAAQ,gBAAgB;;;;;;;;;;CAWtC,IAAW,6BAAsC;AAC/C,SAAO,KAAK,QAAQ,8BAA8B;;;;;;;;;;;;CAapD,IAAW,+BAAwC;AACjD,SAAO,KAAK,QAAQ,gCAAgC;;;;;CAMtD,IAAW,oBAA4B;AACrC,SAAO,KAAK,QAAQ,WAAW,SAAS;;;;;CAM1C,IAAW,qCAA6C;AACtD,SAAO,KAAK,QAAQ,WAAW,8BAA8B;;;;;CAM/D,IAAW,wBAAgC;AACzC,SAAO,KAAK,QAAQ,WAAW,iBAAiB;;;;;CAMlD,IAAW,mBAA2B;AACpC,SAAO,KAAK,QAAQ,WAAW,YAAY;;;;;CAM7C,IAAW,qCAA6C;AACtD,SAAO,KAAK,QAAQ,WAAW,0BAA0B;;;;;CAM3D,IAAW,8BAAsC;AAC/C,SAAO,KAAK,QAAQ,WAAW,mBAAmB;;;;;CAMpD,IAAW,yBAAiC;AAC1C,SAAO,KAAK,QAAQ,WAAW,cAAc;;;;;CAM/C,IAAW,iCAAyC;AAClD,SAAO,KAAK,QAAQ,WAAW,sBAAsB;;;;;CAMvD,IAAW,0BAAkC;AAC3C,SAAO,KAAK,QAAQ,WAAW,eAAe;;;;;CAMhD,IAAW,mBAA2B;AACpC,SAAO,KAAK,QAAQ,WAAW,QAAQ;;;;;CAMzC,IAAW,wDAAwD;AACjE,SAAO,KAAK;;;;;CAMd,IAAW,sDAAsD,OAEjD;AACd,OAAK,yBAAyB"}