{"version":3,"file":"authorizationEndpoint.mjs","names":[],"sources":["../../../src/openid4vc-issuer/router/authorizationEndpoint.ts"],"sourcesContent":["import {\n  Oauth2ErrorCodes,\n  Oauth2ServerErrorResponseError,\n  parsePushedAuthorizationRequestUriReferenceValue,\n} from '@openid4vc/oauth2'\nimport type { NextFunction, Response, Router } from 'express'\nimport { getRequestContext, sendOauth2ErrorResponse, sendUnknownServerErrorResponse } from '../../shared/router'\nimport { OpenId4VcIssuanceSessionState } from '../OpenId4VcIssuanceSessionState'\nimport { OpenId4VcIssuerModuleConfig } from '../OpenId4VcIssuerModuleConfig'\nimport { OpenId4VcIssuerService } from '../OpenId4VcIssuerService'\nimport type { OpenId4VcIssuanceRequest } from './requestContext'\n\nexport function configureAuthorizationEndpoint(router: Router, config: OpenId4VcIssuerModuleConfig) {\n  router.get(\n    config.authorizationEndpoint,\n    async (request: OpenId4VcIssuanceRequest, response: Response, next: NextFunction) => {\n      const requestContext = getRequestContext(request)\n      const { agentContext, issuer } = requestContext\n      const openId4VcIssuerService = agentContext.dependencyManager.resolve(OpenId4VcIssuerService)\n\n      try {\n        const requestUri = request.query.request_uri\n        const clientId = request.query.client_id\n\n        if (!requestUri || typeof requestUri !== 'string') {\n          throw new Oauth2ServerErrorResponseError({\n            error: Oauth2ErrorCodes.InvalidRequest,\n            error_description: `Missing required 'request_uri' parameter. Pushed authorization requests are required`,\n          })\n        }\n\n        const requestUriReferenceValue = parsePushedAuthorizationRequestUriReferenceValue({ uri: requestUri })\n        const issuanceSession = await openId4VcIssuerService.findSingleIssuanceSessionByQuery(agentContext, {\n          issuerId: issuer.issuerId,\n          chainedIdentityRequestUriReferenceValue: requestUriReferenceValue,\n        })\n\n        if (!issuanceSession || issuanceSession.state !== OpenId4VcIssuanceSessionState.AuthorizationInitiated) {\n          throw new Oauth2ServerErrorResponseError(\n            {\n              error: Oauth2ErrorCodes.InvalidRequest,\n              error_description: `The 'request_uri' parameter is invalid or has expired.`,\n            },\n            {\n              internalMessage: !issuanceSession\n                ? `Issuance session not found for 'request_uri' reference value '${requestUriReferenceValue}'`\n                : `Issuance session '${issuanceSession.id}' has state '${\n                    issuanceSession.state\n                  }' but expected ${OpenId4VcIssuanceSessionState.AuthorizationInitiated}`,\n            }\n          )\n        }\n\n        if (clientId !== issuanceSession.clientId) {\n          throw new Oauth2ServerErrorResponseError(\n            {\n              error: Oauth2ErrorCodes.InvalidRequest,\n              error_description: `The 'client_id' parameter does not match the original value.`,\n            },\n            {\n              internalMessage: `The 'client_id' '${clientId}' does not match the expected value for issuance session '${issuanceSession.id}'.`,\n            }\n          )\n        }\n\n        if (\n          !issuanceSession.chainedIdentity?.externalAuthorizationServerUrl ||\n          !issuanceSession.chainedIdentity.requestUriExpiresAt ||\n          !issuanceSession.chainedIdentity.externalAuthorizationRequestUrl\n        ) {\n          throw new Oauth2ServerErrorResponseError(\n            {\n              error: Oauth2ErrorCodes.InvalidRequest,\n              error_description: `The 'request_uri' parameter is invalid or has expired.`,\n            },\n            {\n              internalMessage: `Issuance session '${issuanceSession.id}' does not have identity chaining configured, so it's not compatible with the authorization endpoint.`,\n            }\n          )\n        }\n\n        if (Date.now() > issuanceSession.chainedIdentity.requestUriExpiresAt.getTime()) {\n          throw new Oauth2ServerErrorResponseError(\n            {\n              error: Oauth2ErrorCodes.InvalidRequest,\n              error_description: `The 'request_uri' parameter is invalid or has expired.`,\n            },\n            {\n              internalMessage: `The 'request_uri' for issuance session '${issuanceSession.id}' has expired.`,\n            }\n          )\n        }\n\n        return response.redirect(issuanceSession.chainedIdentity.externalAuthorizationRequestUrl)\n      } catch (error) {\n        if (error instanceof Oauth2ServerErrorResponseError) {\n          return sendOauth2ErrorResponse(response, next, agentContext.config.logger, error)\n        }\n        return sendUnknownServerErrorResponse(response, next, agentContext.config.logger, error)\n      }\n    }\n  )\n}\n"],"mappings":";;;;;;;;AAYA,SAAgB,+BAA+B,QAAgB,QAAqC;AAClG,QAAO,IACL,OAAO,uBACP,OAAO,SAAmC,UAAoB,SAAuB;EAEnF,MAAM,EAAE,cAAc,WADC,kBAAkB,QAAQ;EAEjD,MAAM,yBAAyB,aAAa,kBAAkB,QAAQ,uBAAuB;AAE7F,MAAI;GACF,MAAM,aAAa,QAAQ,MAAM;GACjC,MAAM,WAAW,QAAQ,MAAM;AAE/B,OAAI,CAAC,cAAc,OAAO,eAAe,SACvC,OAAM,IAAI,+BAA+B;IACvC,OAAO,iBAAiB;IACxB,mBAAmB;IACpB,CAAC;GAGJ,MAAM,2BAA2B,iDAAiD,EAAE,KAAK,YAAY,CAAC;GACtG,MAAM,kBAAkB,MAAM,uBAAuB,iCAAiC,cAAc;IAClG,UAAU,OAAO;IACjB,yCAAyC;IAC1C,CAAC;AAEF,OAAI,CAAC,mBAAmB,gBAAgB,UAAU,8BAA8B,uBAC9E,OAAM,IAAI,+BACR;IACE,OAAO,iBAAiB;IACxB,mBAAmB;IACpB,EACD,EACE,iBAAiB,CAAC,kBACd,iEAAiE,yBAAyB,KAC1F,qBAAqB,gBAAgB,GAAG,eACtC,gBAAgB,MACjB,iBAAiB,8BAA8B,0BACrD,CACF;AAGH,OAAI,aAAa,gBAAgB,SAC/B,OAAM,IAAI,+BACR;IACE,OAAO,iBAAiB;IACxB,mBAAmB;IACpB,EACD,EACE,iBAAiB,oBAAoB,SAAS,4DAA4D,gBAAgB,GAAG,KAC9H,CACF;AAGH,OACE,CAAC,gBAAgB,iBAAiB,kCAClC,CAAC,gBAAgB,gBAAgB,uBACjC,CAAC,gBAAgB,gBAAgB,gCAEjC,OAAM,IAAI,+BACR;IACE,OAAO,iBAAiB;IACxB,mBAAmB;IACpB,EACD,EACE,iBAAiB,qBAAqB,gBAAgB,GAAG,wGAC1D,CACF;AAGH,OAAI,KAAK,KAAK,GAAG,gBAAgB,gBAAgB,oBAAoB,SAAS,CAC5E,OAAM,IAAI,+BACR;IACE,OAAO,iBAAiB;IACxB,mBAAmB;IACpB,EACD,EACE,iBAAiB,2CAA2C,gBAAgB,GAAG,iBAChF,CACF;AAGH,UAAO,SAAS,SAAS,gBAAgB,gBAAgB,gCAAgC;WAClF,OAAO;AACd,OAAI,iBAAiB,+BACnB,QAAO,wBAAwB,UAAU,MAAM,aAAa,OAAO,QAAQ,MAAM;AAEnF,UAAO,+BAA+B,UAAU,MAAM,aAAa,OAAO,QAAQ,MAAM;;GAG7F"}