fix: access token can only be used for offer

packages/openid4vc/src/openid4vc-issuer/router/accessTokenEndpoint.ts

@@ -1,6 +1,6 @@
 import type { OpenId4VcIssuanceRequest } from './requestContext'
 import type { AgentContext } from '@credo-ts/core'
-import type { JWTSignerCallback } from '@sphereon/oid4vci-common'
+import type { AccessTokenRequest, JWTSignerCallback } from '@sphereon/oid4vci-common'
 import type { NextFunction, Response, Router } from 'express'
 
 import { getJwkFromKey, CredoError, JwsService, JwtPayload, getJwkClassFromKeyType, Key } from '@credo-ts/core'
@@ -86,7 +86,7 @@ function getJwtSignerCallback(
     const jwk = getJwkFromKey(signerPublicKey)
     const signedJwt = await jwsService.createJwsCompact(agentContext, {
       protectedHeaderOptions: { ...jwt.header, jwk, alg },
-      payload: new JwtPayload(jwt.payload),
+      payload: JwtPayload.fromJson(jwt.payload),
       key: signerPublicKey,
     })
 
@@ -103,11 +103,15 @@ export function handleTokenRequest(config: OpenId4VciAccessTokenEndpointConfig)
     const requestContext = getRequestContext(request)
     const { agentContext, issuer } = requestContext
 
-    if (request.body.grant_type !== GrantTypes.PRE_AUTHORIZED_CODE) {
-      return response.status(400).json({
-        error: TokenErrorResponse.invalid_request,
-        error_description: PRE_AUTHORIZED_CODE_REQUIRED_ERROR,
-      })
+    const body = request.body as AccessTokenRequest
+    if (body.grant_type !== GrantTypes.PRE_AUTHORIZED_CODE) {
+      return sendErrorResponse(
+        response,
+        agentContext.config.logger,
+        400,
+        TokenErrorResponse.invalid_request,
+        PRE_AUTHORIZED_CODE_REQUIRED_ERROR
+      )
     }
 
     const openId4VcIssuerService = agentContext.dependencyManager.resolve(OpenId4VcIssuerService)

packages/openid4vc/src/openid4vc-issuer/router/credentialEndpoint.ts

@@ -3,8 +3,6 @@ import type { OpenId4VciCredentialRequest } from '../../shared'
 import type { OpenId4VciCredentialRequestToCredentialMapper } from '../OpenId4VcIssuerServiceOptions'
 import type { Router, Response } from 'express'
 
-import { CredoError, JwsService, Jwt } from '@credo-ts/core'
-
 import { getRequestContext, sendErrorResponse } from '../../shared/router'
 import { OpenId4VcIssuerService } from '../OpenId4VcIssuerService'
 import { getCNonceFromCredentialRequest } from '../util/credentialRequest'
@@ -31,9 +29,12 @@ export function configureCredentialEndpoint(router: Router, config: OpenId4VciCr
     const { agentContext, issuer } = getRequestContext(request)
     const openId4VcIssuerService = agentContext.dependencyManager.resolve(OpenId4VcIssuerService)
 
+    let preAuthorizedCode: string
+
     // Verify the access token (should at some point be moved to a middleware function or something)
     try {
-      await verifyAccessToken(agentContext, issuer, request.headers.authorization)
+      preAuthorizedCode = (await verifyAccessToken(agentContext, issuer, request.headers.authorization))
+        .preAuthorizedCode
     } catch (error) {
       return sendErrorResponse(response, agentContext.config.logger, 401, 'unauthorized', error)
     }
@@ -46,6 +47,19 @@ export function configureCredentialEndpoint(router: Router, config: OpenId4VciCr
         credentialRequest,
       })
 
+      if (issuanceSession?.preAuthorizedCode !== preAuthorizedCode) {
+        agentContext.config.logger.warn(
+          `Credential request used access token with for credential offer with different pre-authorized code than was used for the issuance session ${issuanceSession?.id}`
+        )
+        return sendErrorResponse(
+          response,
+          agentContext.config.logger,
+          401,
+          'unauthorized',
+          'Access token is not valid for this credential request'
+        )
+      }
+
       if (!issuanceSession) {
         const cNonce = getCNonceFromCredentialRequest(credentialRequest)
         agentContext.config.logger.warn(

packages/openid4vc/src/openid4vc-issuer/router/verifyAccessToken.ts

@@ -41,4 +41,12 @@ export async function verifyAccessToken(
   if (accessToken.payload.iss !== issuerMetadata.issuerUrl) {
     throw new CredoError('Access token was not issued by the expected issuer')
   }
+
+  if (typeof accessToken.payload.additionalClaims.preAuthorizedCode !== 'string') {
+    throw new CredoError('No preAuthorizedCode present in access token')
+  }
+
+  return {
+    preAuthorizedCode: accessToken.payload.additionalClaims.preAuthorizedCode,
+  }
 }