Introduced ReceivedRequest abstraction to accommodate single and multi-signed authorization requests.

vafeini · vafeini · commit 9efad0adeab7 · 2025-05-20T13:42:19.000+03:00
diff --git a/src/main/kotlin/eu/europa/ec/eudi/openid4vp/internal/request/DefaultAuthorizationRequestResolver.kt b/src/main/kotlin/eu/europa/ec/eudi/openid4vp/internal/request/DefaultAuthorizationRequestResolver.kt
@@ -16,6 +16,10 @@
 package eu.europa.ec.eudi.openid4vp.internal.request
 
 import com.eygraber.uri.Uri
+import com.nimbusds.jose.JWSObject
+import com.nimbusds.jose.JWSObjectJSON
+import com.nimbusds.jose.util.Base64URL
+import com.nimbusds.jose.util.JSONObjectUtils
 import com.nimbusds.jwt.JWTClaimsSet
 import com.nimbusds.jwt.SignedJWT
 import eu.europa.ec.eudi.openid4vp.*
@@ -171,6 +175,85 @@ internal sealed interface FetchedRequest {
     data class JwtSecured(val clientId: String, val jwt: SignedJWT) : FetchedRequest
 }
 
+internal sealed interface ReceivedRequest {
+
+    data class Unsigned(val requestObject: UnvalidatedRequestObject) : ReceivedRequest
+
+    data class Signed(
+        val payload: Base64URL,
+        val signatures: List<RequestSignature>,
+    ) : ReceivedRequest {
+
+        init {
+            require(!signatures.isEmpty()) { "At least one signature is required" }
+        }
+
+        companion object {
+
+            /**
+             * Decomposes a Nimbus [SignedJWT] into a [ReceivedRequest.Signed] request.
+             */
+            fun from(signedJwt: SignedJWT): Result<Signed> = runCatching {
+                require(signedJwt.state == JWSObject.State.SIGNED) { "JWS is not signed" }
+                val header = signedJwt.header.toBase64URL()
+                val payload = signedJwt.payload.toBase64URL()
+                val signature = signedJwt.signature
+
+                val signatures = listOf(RequestSignature(Header(header), signature))
+                Signed(payload, signatures)
+            }
+
+            /**
+             * Parses an input [JsonObject] representing a JWS in JSON serialization into a [ReceivedRequest.Signed] request.
+             */
+            fun from(jwsJsonObject: JsonObject): Result<Signed> = runCatching {
+                require(jwsJsonObject.containsKey("payload")) { "No payload found for the passed request" }
+                require(jwsJsonObject.containsKey("signatures") || jwsJsonObject.containsKey("signature")) {
+                    "No signatures found for the passed request"
+                }
+                val parsed = JWSObjectJSON.parse(jwsJsonObject)
+                val signatures = parsed.getSignatures()
+                val requestSignatures = signatures?.map {
+                    val unprotectedHeader = it.unprotectedHeader?.let {
+                        val str = JSONObjectUtils.toJSONString(it.toJSONObject())
+                        jsonSupport.decodeFromString<JsonObject>(str)
+                    }
+                    RequestSignature(
+                        header = Header(it.header.toBase64URL(), unprotectedHeader),
+                        signature = it.signature,
+                    )
+                }
+                require(requestSignatures != null) { "No signatures found for the passed request" }
+
+                Signed(parsed.payload.toBase64URL(), requestSignatures)
+            }
+        }
+    }
+}
+
+internal data class RequestSignature(
+    val header: Header,
+    val signature: Signature,
+)
+
+internal data class Header(
+    val protected: Base64URL,
+    val unProtected: JsonObject? = null,
+)
+
+internal typealias Signature = Base64URL
+
+internal fun ReceivedRequest.Signed.toSignedJwts(): List<SignedJWT> =
+    signatures.map {
+        SignedJWT.parse("${it.header.protected}.$payload.${it.signature}")
+    }
+
+internal fun FetchedRequest.toReceivedRequest(): ReceivedRequest =
+    when (this) {
+        is FetchedRequest.Plain -> ReceivedRequest.Unsigned(requestObject)
+        is FetchedRequest.JwtSecured -> ReceivedRequest.Signed.from(jwt).getOrThrow()
+    }
+
 internal class DefaultAuthorizationRequestResolver(
     private val siopOpenId4VPConfig: SiopOpenId4VPConfig,
     private val httpKtorHttpClientFactory: KtorHttpClientFactory,
@@ -193,7 +276,7 @@ internal class DefaultAuthorizationRequestResolver(
 
         val authenticatedRequest =
             try {
-                authenticateRequest(fetchedRequest)
+                authenticateRequest(fetchedRequest.toReceivedRequest())
             } catch (e: AuthorizationRequestException) {
                 val dispatchDetails =
                     when (siopOpenId4VPConfig.errorDispatchPolicy) {
@@ -225,9 +308,9 @@ internal class DefaultAuthorizationRequestResolver(
         return requestFetcher.fetchRequest(unvalidatedRequest)
     }
 
-    private suspend fun HttpClient.authenticateRequest(fetchedRequest: FetchedRequest): AuthenticatedRequest {
+    private suspend fun HttpClient.authenticateRequest(receivedRequest: ReceivedRequest): AuthenticatedRequest {
         val requestAuthenticator = RequestAuthenticator(siopOpenId4VPConfig, this)
-        return requestAuthenticator.authenticate(fetchedRequest)
+        return requestAuthenticator.authenticate(receivedRequest)
     }
 }
 
diff --git a/src/main/kotlin/eu/europa/ec/eudi/openid4vp/internal/request/RequestAuthenticator.kt b/src/main/kotlin/eu/europa/ec/eudi/openid4vp/internal/request/RequestAuthenticator.kt
@@ -73,34 +73,37 @@ internal class RequestAuthenticator(siopOpenId4VPConfig: SiopOpenId4VPConfig, ht
     private val clientAuthenticator = ClientAuthenticator(siopOpenId4VPConfig)
     private val signatureVerifier = JarJwtSignatureVerifier(siopOpenId4VPConfig, httpClient)
 
-    suspend fun authenticate(request: FetchedRequest): AuthenticatedRequest = coroutineScope {
+    suspend fun authenticate(request: ReceivedRequest): AuthenticatedRequest = coroutineScope {
         val client = clientAuthenticator.authenticateClient(request)
         when (request) {
-            is FetchedRequest.Plain -> {
+            is ReceivedRequest.Unsigned -> {
                 AuthenticatedRequest(client, request.requestObject)
             }
 
-            is FetchedRequest.JwtSecured -> {
-                with(signatureVerifier) { verifySignature(client, request.jwt) }
-                AuthenticatedRequest(client, request.jwt.requestObject())
+            is ReceivedRequest.Signed -> {
+                val signedJwt = request.ensureSingleSignedRequest()
+                with(signatureVerifier) { verifySignature(client, signedJwt) }
+                AuthenticatedRequest(client, signedJwt.requestObject())
             }
         }
     }
 }
 
 internal class ClientAuthenticator(private val siopOpenId4VPConfig: SiopOpenId4VPConfig) {
-    suspend fun authenticateClient(request: FetchedRequest): AuthenticatedClient {
+    suspend fun authenticateClient(request: ReceivedRequest): AuthenticatedClient {
         val requestObject = when (request) {
-            is FetchedRequest.JwtSecured -> request.jwt.requestObject()
-            is FetchedRequest.Plain -> request.requestObject
+            is ReceivedRequest.Signed -> {
+                request.ensureSingleSignedRequest().requestObject()
+            }
+            is ReceivedRequest.Unsigned -> request.requestObject
         }
 
         val (originalClientId, clientIdScheme) = originalClientIdAndScheme(requestObject)
         return when (clientIdScheme) {
             is Preregistered -> {
                 val registeredClient = clientIdScheme.clients[originalClientId]
                 ensureNotNull(registeredClient) { RequestValidationError.InvalidClientId.asException() }
-                if (request is FetchedRequest.JwtSecured) {
+                if (request is ReceivedRequest.Signed) {
                     ensureNotNull(registeredClient.jarConfig) {
                         invalidScheme("$registeredClient cannot place signed request")
                     }
@@ -109,7 +112,7 @@ internal class ClientAuthenticator(private val siopOpenId4VPConfig: SiopOpenId4V
             }
 
             SupportedClientIdScheme.RedirectUri -> {
-                ensure(request is FetchedRequest.Plain) {
+                ensure(request is ReceivedRequest.Unsigned) {
                     invalidScheme("${clientIdScheme.scheme()} cannot be used in signed request")
                 }
                 val originalClientIdAsUri =
@@ -118,7 +121,7 @@ internal class ClientAuthenticator(private val siopOpenId4VPConfig: SiopOpenId4V
             }
 
             is SupportedClientIdScheme.X509SanDns -> {
-                ensure(request is FetchedRequest.JwtSecured) {
+                ensure(request is ReceivedRequest.Signed) {
                     invalidScheme("${clientIdScheme.scheme()} cannot be used in unsigned request")
                 }
                 val chain = x5c(originalClientId, request, clientIdScheme.trust) {
@@ -129,7 +132,7 @@ internal class ClientAuthenticator(private val siopOpenId4VPConfig: SiopOpenId4V
             }
 
             is SupportedClientIdScheme.X509SanUri -> {
-                ensure(request is FetchedRequest.JwtSecured) {
+                ensure(request is ReceivedRequest.Signed) {
                     invalidScheme("${clientIdScheme.scheme()} cannot be used in unsigned request")
                 }
                 val chain = x5c(originalClientId, request, clientIdScheme.trust) {
@@ -142,7 +145,7 @@ internal class ClientAuthenticator(private val siopOpenId4VPConfig: SiopOpenId4V
             }
 
             is SupportedClientIdScheme.DID -> {
-                ensure(request is FetchedRequest.JwtSecured) {
+                ensure(request is ReceivedRequest.Signed) {
                     invalidScheme("${clientIdScheme.scheme()} cannot be used in unsigned request")
                 }
                 val originalClientIdAsDID = ensureNotNull(DID.parse(originalClientId).getOrNull()) {
@@ -153,7 +156,7 @@ internal class ClientAuthenticator(private val siopOpenId4VPConfig: SiopOpenId4V
             }
 
             is SupportedClientIdScheme.VerifierAttestation -> {
-                ensure(request is FetchedRequest.JwtSecured) {
+                ensure(request is ReceivedRequest.Signed) {
                     invalidScheme("${clientIdScheme.scheme()} cannot be used in unsigned request")
                 }
                 val attestedClaims =
@@ -174,11 +177,12 @@ internal class ClientAuthenticator(private val siopOpenId4VPConfig: SiopOpenId4V
 
     private fun x5c(
         originalClientId: OriginalClientId,
-        request: FetchedRequest.JwtSecured,
+        request: ReceivedRequest.Signed,
         trust: X509CertificateTrust,
         subjectAlternativeNames: X509Certificate.() -> List<String>,
     ): List<X509Certificate> {
-        val x5c = request.jwt.header?.x509CertChain
+        val jwt = request.ensureSingleSignedRequest()
+        val x5c = jwt.header?.x509CertChain
         ensureNotNull(x5c) { invalidJarJwt("Missing x5c") }
         val pubCertChain = x5c.mapNotNull { runCatching { X509CertUtils.parse(it.decode()) }.getOrNull() }
         ensure(pubCertChain.isNotEmpty()) { invalidJarJwt("Invalid x5c") }
@@ -192,13 +196,21 @@ internal class ClientAuthenticator(private val siopOpenId4VPConfig: SiopOpenId4V
     }
 }
 
+private fun ReceivedRequest.Signed.ensureSingleSignedRequest(): SignedJWT {
+    val signedJwts = toSignedJwts()
+    return ensure(signedJwts.size == 1) {
+        invalidJarJwt("Multi-signed authorization requests are not yet supported")
+    }.let { signedJwts[0] }
+}
+
 private suspend fun lookupKeyByDID(
-    request: FetchedRequest.JwtSecured,
+    request: ReceivedRequest.Signed,
     clientId: DID,
     lookupPublicKeyByDIDUrl: LookupPublicKeyByDIDUrl,
 ): PublicKey = withContext(Dispatchers.IO) {
     val keyUrl: AbsoluteDIDUrl = run {
-        val kid = ensureNotNull(request.jwt.header?.keyID) {
+        val jwt = request.ensureSingleSignedRequest()
+        val kid = ensureNotNull(jwt.header?.keyID) {
             invalidJarJwt("Missing kid for client_id $clientId")
         }
         ensureNotNull(AbsoluteDIDUrl.parse(kid).getOrNull()) {
@@ -217,15 +229,16 @@ private suspend fun lookupKeyByDID(
 private fun verifierAttestation(
     clock: Clock,
     supportedScheme: SupportedClientIdScheme.VerifierAttestation,
-    request: FetchedRequest.JwtSecured,
+    request: ReceivedRequest.Signed,
     originalClientId: OriginalClientId,
 ): VerifierAttestationClaims {
     val (trust, skew) = supportedScheme
     fun invalidVerifierAttestationJwt(cause: String?) =
         invalidJarJwt("Invalid VerifierAttestation JWT. Details: $cause")
 
     val verifierAttestationJwt = run {
-        val jwtString = request.jwt.header.customParams["jwt"]
+        val jwt = request.ensureSingleSignedRequest()
+        val jwtString = jwt.header.customParams["jwt"]
         ensureNotNull(jwtString) { invalidJarJwt("Missing jwt JOSE Header") }
         ensure(jwtString is String) { invalidJarJwt("jwt JOSE Header doesn't contain a JWT") }
 
diff --git a/src/test/kotlin/eu/europa/ec/eudi/openid4vp/Example.kt b/src/test/kotlin/eu/europa/ec/eudi/openid4vp/Example.kt
@@ -51,7 +51,8 @@ import eu.europa.ec.eudi.openid4vp.dcql.DCQL as DCQLQuery
  * https://github.com/eu-digital-identity-wallet/eudi-srv-web-verifier-endpoint-23220-4-kt
  */
 fun main(): Unit = runBlocking {
-    val verifierApi = URL("https://dev.verifier-backend.eudiw.dev")
+//    val verifierApi = URL("https://dev.verifier-backend.eudiw.dev")
+    val verifierApi = URL("http://localhost:8080")
     val walletKeyPair = SiopIdTokenBuilder.randomKey()
     val wallet = Wallet(
         walletKeyPair = walletKeyPair,
@@ -193,7 +194,7 @@ class Verifier private constructor(
                         put("dcql_query", jsonSupport.encodeToJsonElement(presentationQuery.query))
                 }
                 put("response_mode", "direct_post.jwt")
-                put("presentation_definition_mode", "by_reference")
+                put("presentation_definition_mode", "by_value")
                 put("jar_mode", "by_reference")
                 put("wallet_response_redirect_uri_template", "https://foo?response_code={RESPONSE_CODE}")
                 if (!transactionData.isNullOrEmpty()) {
diff --git a/src/test/kotlin/eu/europa/ec/eudi/openid4vp/internal/request/RequestAuthenticatorTest.kt b/src/test/kotlin/eu/europa/ec/eudi/openid4vp/internal/request/RequestAuthenticatorTest.kt
@@ -60,7 +60,7 @@ class ClientAuthenticatorTest {
 
         @Test
         fun `if client_id is missing, authentication fails`() = runTest {
-            val request = UnvalidatedRequestObject(clientId = null).plain()
+            val request = UnvalidatedRequestObject(clientId = null).unsigned()
             assertFailsWithError<RequestValidationError.MissingClientId> {
                 clientAuthenticator.authenticateClient(request)
             }
@@ -71,7 +71,7 @@ class ClientAuthenticatorTest {
             val request = UnvalidatedRequestObject(
                 clientId = "bar:foo",
                 responseMode = "bar",
-            ).plain()
+            ).unsigned()
 
             assertFailsWithError<RequestValidationError.InvalidClientIdScheme> {
                 clientAuthenticator.authenticateClient(request)
@@ -98,7 +98,7 @@ class ClientAuthenticatorTest {
             runTest {
                 val request = UnvalidatedRequestObject(
                     clientId = "redirect_uri:$clientId",
-                ).plain()
+                ).unsigned()
 
                 val client = clientAuthenticator.authenticateClient(request)
                 assertEquals(AuthenticatedClient.RedirectUri(clientId), client)
@@ -142,7 +142,7 @@ class ClientAuthenticatorTest {
 
         @Test
         fun `if request is not signed, authentication fails`() = runTest {
-            val request = requestObject.plain()
+            val request = requestObject.unsigned()
 
             val error = assertFailsWithError<RequestValidationError.InvalidClientIdScheme> {
                 clientAuthenticator.authenticateClient(request)
@@ -248,7 +248,7 @@ class ClientAuthenticatorTest {
 
         @Test
         fun `if request is unsigned, authentication fails`() = runTest {
-            val request = requestObject.plain()
+            val request = requestObject.unsigned()
 
             val error = assertFailsWithError<RequestValidationError.InvalidClientIdScheme> {
                 clientAuthenticator.authenticateClient(request)
@@ -336,36 +336,34 @@ private inline fun <reified E : AuthorizationRequestError> assertFailsWithError(
     return assertIs<E>(exception.error)
 }
 
-private fun UnvalidatedRequestObject.plain(): FetchedRequest.Plain =
-    FetchedRequest.Plain(this)
+private fun UnvalidatedRequestObject.unsigned(): ReceivedRequest.Unsigned =
+    ReceivedRequest.Unsigned(this)
 
 private fun UnvalidatedRequestObject.signedWithAttestation(
     alg: JWSAlgorithm,
     key: JWK,
     attestation: SignedJWT,
-): FetchedRequest.JwtSecured = signed(alg, key) {
+): ReceivedRequest.Signed = signed(alg, key) {
     this.customParam("jwt", attestation.serialize())
 }
 
 private fun UnvalidatedRequestObject.signed(
     alg: JWSAlgorithm,
     key: JWK,
     headerCustomization: (JWSHeader.Builder).() -> Unit = {},
-): FetchedRequest.JwtSecured = FetchedRequest.JwtSecured(
-    clientId = checkNotNull(clientId),
-    jwt = run {
-        val header = with(JWSHeader.Builder(alg)) {
-            type(JOSEObjectType(OpenId4VPSpec.AUTHORIZATION_REQUEST_OBJECT_TYPE))
-            headerCustomization()
-            build()
-        }
-        val claimsSet = toJWTClaimSet()
-        SignedJWT(header, claimsSet).apply {
-            val signer = DefaultJWSSignerFactory().createJWSSigner(key, alg)
-            sign(signer)
-        }
-    },
-)
+): ReceivedRequest.Signed {
+    val header = with(JWSHeader.Builder(alg)) {
+        type(JOSEObjectType(OpenId4VPSpec.AUTHORIZATION_REQUEST_OBJECT_TYPE))
+        headerCustomization()
+        build()
+    }
+    val claimsSet = toJWTClaimSet()
+    val jwt = SignedJWT(header, claimsSet).apply {
+        val signer = DefaultJWSSignerFactory().createJWSSigner(key, alg)
+        sign(signer)
+    }
+    return ReceivedRequest.Signed.from(jwt).getOrThrow()
+}
 
 private fun UnvalidatedRequestObject.toJWTClaimSet(): JWTClaimsSet {
     val json = Json.encodeToString(this)
