Add nonce endpoint to OID4VCI exchanges.

CHANGELOG.md

@@ -1,5 +1,10 @@
 # bedrock-vc-delivery ChangeLog
 
+## 6.4.0 - 2024-11-dd
+
+### Added
+- Add `nonce` endpoint to OID4VCI exchanges.
+
 ## 6.3.1 - 2024-11-07
 
 ### Fixed

lib/oid4/http.js

@@ -60,6 +60,7 @@ export async function createRoutes({
     batchCredential: `${openIdRoute}/batch_credential`,
     credential: `${openIdRoute}/credential`,
     credentialOffer: `${openIdRoute}/credential-offer`,
+    nonce: `${openIdRoute}/nonce`,
     token: `${openIdRoute}/token`,
     jwks: `${openIdRoute}/jwks`,
     // OID4VP routes
@@ -264,6 +265,20 @@ export async function createRoutes({
       res.json(result);
     }));
 
+  // a credential delivery server endpoint
+  // serves a nonce to be used in OID4VCI proofs (if required)
+  app.options(routes.nonce, cors());
+  app.post(
+    routes.nonce,
+    cors(),
+    getExchange,
+    asyncHandler(async (req, res) => {
+      // serve exchange ID as nonce
+      const exchangeRecord = await req.getExchange();
+      const {exchange} = exchangeRecord;
+      res.json({c_nonce: exchange.id});
+    }));
+
   // a batch credential delivery server endpoint
   // receives N credential requests and returns N VCs
   app.options(routes.batchCredential, cors());

lib/oid4/oid4vci.js

@@ -36,14 +36,15 @@ export async function getCredentialIssuerConfig({req}) {
 
   const exchangeId = `${workflow.id}/exchanges/${exchange.id}`;
   return {
+    batch_credential_endpoint: `${exchangeId}/openid/batch_credential`,
+    credential_configurations_supported,
+    credential_endpoint: `${exchangeId}/openid/credential`,
     credential_issuer: exchangeId,
     issuer: exchangeId,
     jwks_uri: `${exchangeId}/openid/jwks`,
-    token_endpoint: `${exchangeId}/openid/token`,
-    credential_endpoint: `${exchangeId}/openid/credential`,
-    batch_credential_endpoint: `${exchangeId}/openid/batch_credential`,
     'pre-authorized_grant_anonymous_access_supported': true,
-    credential_configurations_supported
+    nonce_endpoint: `${exchangeId}/openid/nonce`,
+    token_endpoint: `${exchangeId}/openid/token`
   };
 }