@sphereon/ssi-sdk.oid4vci-issuer-rest-api/dist/index.js

var __defProp = Object.defineProperty;
var __name = (target, value) => __defProp(target, "name", { value, configurable: true });

// src/OID4VCIRestAPI.ts
import { getBasePath, OID4VCIServer } from "@sphereon/oid4vci-issuer-server";
import { isDidIdentifier, isIIdentifier } from "@sphereon/ssi-sdk-ext.identifier-resolution";
import { ensureRawDocument } from "@sphereon/ssi-sdk.data-store-types";
import { CredentialCorrelationType } from "@sphereon/ssi-sdk.credential-store";
import { createAuthRequestUriCallback, getAccessTokenSignerCallback, createVerifyAuthResponseCallback } from "@sphereon/ssi-sdk.oid4vci-issuer";
import { CredentialMapper, CredentialRole } from "@sphereon/ssi-types";
import express from "express";
import fs from "fs";
import path from "path";
import { fileURLToPath } from "url";
import swaggerUi from "swagger-ui-express";
var __filename = fileURLToPath(import.meta.url);
var __dirname = path.dirname(__filename);
var OID4VCIRestAPI = class _OID4VCIRestAPI {
  static {
    __name(this, "OID4VCIRestAPI");
  }
  _expressSupport;
  _context;
  _opts;
  _restApi;
  _instance;
  _issuer;
  _router;
  _baseUrl;
  _basePath;
  static async init(args) {
    const { issuerInstanceArgs, context } = args;
    const opts = args.opts ?? {};
    const expressSupport = args.expressSupport;
    const instance = await context.agent.oid4vciGetInstance(args.issuerInstanceArgs);
    const wrapCredentialSignerCallback = opts.persistIssuedCredentials ? _OID4VCIRestAPI.buildPersistenceSignerWrapper({
      context,
      instance
    }) : void 0;
    const issuer = await instance.get({
      context,
      credentialDataSupplier: args.credentialDataSupplier,
      wrapCredentialSignerCallback
    });
    if (!opts.endpointOpts) {
      opts.endpointOpts = {};
    }
    if (!opts.endpointOpts.tokenEndpointOpts) {
      opts.endpointOpts.tokenEndpointOpts = {
        accessTokenIssuer: instance.metadataOptions.credentialIssuer ?? issuer.issuerMetadata.credential_issuer
      };
    }
    if (opts?.endpointOpts.tokenEndpointOpts?.tokenEndpointDisabled !== true && typeof opts?.endpointOpts.tokenEndpointOpts?.accessTokenSignerCallback !== "function") {
      const idOpts = instance.issuerOptions.idOpts;
      const tokenOpts = {
        iss: opts.endpointOpts.tokenEndpointOpts.accessTokenIssuer ?? instance.metadataOptions.credentialIssuer,
        didOpts: instance.issuerOptions.didOpts,
        idOpts
      };
      opts.endpointOpts.tokenEndpointOpts.accessTokenSignerCallback = await getAccessTokenSignerCallback({
        ...tokenOpts
      }, args.context);
    }
    if (opts?.endpointOpts.authorizationChallengeOpts?.enabled === true) {
      if (!instance.issuerOptions.presentationDefinitionId) {
        throw Error(`Unable to set createAuthRequestUriCallback. No presentationDefinitionId present in issuer options`);
      }
      if (typeof opts?.endpointOpts.authorizationChallengeOpts.createAuthRequestUriCallback !== "function") {
        if (!opts.endpointOpts.authorizationChallengeOpts?.createAuthRequestUriEndpointPath) {
          throw Error(`Unable to set createAuthRequestUriCallback. No createAuthRequestUriEndpointPath present in options`);
        }
        opts.endpointOpts.authorizationChallengeOpts.createAuthRequestUriCallback = await createAuthRequestUriCallback({
          path: opts.endpointOpts.authorizationChallengeOpts.createAuthRequestUriEndpointPath,
          presentationDefinitionId: instance.issuerOptions.presentationDefinitionId
        });
      }
      if (typeof opts?.endpointOpts.authorizationChallengeOpts?.verifyAuthResponseCallback !== "function") {
        if (!opts.endpointOpts.authorizationChallengeOpts?.verifyAuthResponseEndpointPath) {
          throw Error(`Unable to set verifyAuthResponseCallback. No createAuthRequestUriEndpointPath present in options`);
        }
        opts.endpointOpts.authorizationChallengeOpts.verifyAuthResponseCallback = await createVerifyAuthResponseCallback({
          path: opts.endpointOpts.authorizationChallengeOpts.verifyAuthResponseEndpointPath,
          presentationDefinitionId: instance.issuerOptions.presentationDefinitionId
        });
      }
    }
    return new _OID4VCIRestAPI({
      context,
      issuerInstanceArgs,
      expressSupport,
      opts,
      instance,
      issuer
    });
  }
  /**
  * Builds a {@link CredentialSignerCallback} wrapper that persists each issued credential as a
  * {@link CredentialRole.ISSUER} `DigitalCredential` row after delegating the actual signing to
  * the underlying signer. Issuer identity is resolved from the *signed* credential (so any
  * issuer normalization performed by the signer is preserved in the persisted row). The
  * correlation type is derived from the resolved issuer id (`did:` prefix -> DID, otherwise URL),
  * matching the pattern used by the holder-side persistence in `OID4VCIHolder`.
  *
  * Persistence errors propagate to the caller (fail-fast). Callers that opt into
  * `persistIssuedCredentials` are explicitly requesting the row; a silent drop here would
  * reproduce the DEV-35 defect.
  */
  static buildPersistenceSignerWrapper(args) {
    const { context, instance } = args;
    return (originalSigner) => {
      return async (signerArgs) => {
        const signed = await originalSigner(signerArgs);
        const rawDocument = ensureRawDocument(signed);
        const uniform = CredentialMapper.toUniformCredential(signed);
        let issuerId = CredentialMapper.issuerCorrelationIdFromIssuerType(uniform.issuer);
        if (!issuerId) {
          const fromIdOpts = instance.issuerOptions.idOpts?.identifier ?? instance.issuerOptions.didOpts?.idOpts?.identifier;
          if (typeof fromIdOpts === "string") {
            issuerId = fromIdOpts;
          }
        }
        if (!issuerId) {
          return Promise.reject(Error("Cannot persist issued credential: unable to determine issuer identifier from signed credential"));
        }
        const identifier = await context.agent.identifierManagedGet({
          identifier: issuerId,
          issuer: issuerId,
          vmRelationship: "assertionMethod"
        });
        let issuerCorrelationId = identifier.issuer;
        if (!issuerCorrelationId && isDidIdentifier(identifier.identifier)) {
          if (isIIdentifier(identifier.identifier)) {
            issuerCorrelationId = identifier.identifier.did;
          } else if (typeof identifier.identifier === "string") {
            issuerCorrelationId = identifier.identifier;
          }
        }
        if (!issuerCorrelationId) {
          issuerCorrelationId = issuerId;
        }
        const dc = {
          credential: {
            credentialRole: CredentialRole.ISSUER,
            kmsKeyRef: identifier.kmsKeyRef,
            identifierMethod: identifier.method,
            issuerCorrelationId,
            issuerCorrelationType: issuerCorrelationId.startsWith("did:") ? CredentialCorrelationType.DID : CredentialCorrelationType.URL,
            rawDocument
          }
        };
        await context.agent.crsAddCredential(dc);
        return signed;
      };
    };
  }
  OID4VCI_OPENAPI_FILE = path.join(__dirname, "..", "oid4vci-openapi.yml");
  constructor(args) {
    const { context, opts, issuerInstanceArgs } = args;
    this._baseUrl = new URL(opts?.baseUrl ?? process.env.BASE_URL ?? opts?.issuer?.issuerMetadata?.credential_issuer ?? issuerInstanceArgs.credentialIssuer ?? "http://localhost");
    this._basePath = getBasePath(this._baseUrl);
    this._context = context;
    this._opts = opts ?? {};
    this._expressSupport = args.expressSupport;
    this._issuer = args.issuer;
    this._instance = args.instance;
    this._restApi = new OID4VCIServer(args.expressSupport, {
      ...opts,
      issuer: this._issuer
    });
    this._router = express.Router();
    this.express.use(this._basePath, this._router);
    this.setupSwaggerUi();
  }
  setupSwaggerUi() {
    const apiDocsPath = `/api-docs`;
    const specPath = `/api-docs/spec.yaml`;
    const fullSpecPath = `${this._basePath}${specPath}`;
    if (!fs.existsSync(this.OID4VCI_OPENAPI_FILE)) {
      console.log(`[OID4VCI] OpenAPI spec not found at ${this.OID4VCI_OPENAPI_FILE}. Swagger UI disabled.`);
      return;
    }
    console.log(`[OID4VCI] API docs available at ${this._baseUrl.origin}${this._basePath}${apiDocsPath}`);
    this.express.set("trust proxy", this.opts?.endpointOpts?.trustProxy ?? true);
    this._router.get(specPath, (req, res) => {
      res.type("text/yaml").sendFile(this.OID4VCI_OPENAPI_FILE);
    });
    this._router.use(apiDocsPath, swaggerUi.serve, swaggerUi.setup(void 0, {
      swaggerOptions: {
        url: fullSpecPath
      }
    }));
  }
  get express() {
    return this._expressSupport.express;
  }
  get context() {
    return this._context;
  }
  get opts() {
    return this._opts;
  }
  get restApi() {
    return this._restApi;
  }
  get instance() {
    return this._instance;
  }
  get issuer() {
    return this._issuer;
  }
  async stop() {
    return this._expressSupport.stop();
  }
};
export {
  OID4VCIRestAPI
};
//# sourceMappingURL=index.js.map