chore: update jwt handling and client assertion logic per RFC 7521/7523 adjustments

Author: nklomp

packages/client/lib/AccessTokenClient.ts

@@ -131,6 +131,10 @@ export class AccessTokenClient {
     }
     const credentialIssuer = opts.credentialIssuer ?? credentialOfferRequest?.credential_offer?.credential_issuer ?? opts.metadata?.issuer
     await createJwtBearerClientAssertion(request, { ...opts, credentialIssuer })
+    // Per RFC 7521, client_id is not needed when client_assertion conveys the client identity
+    if (request.client_assertion) {
+      delete request.client_id
+    }
 
     // Prefer AUTHORIZATION_CODE over PRE_AUTHORIZED_CODE_FLOW
     if (!credentialOfferRequest || credentialOfferRequest.supportedFlows.includes(AuthzFlowType.AUTHORIZATION_CODE_FLOW)) {
@@ -147,8 +151,12 @@ export class AccessTokenClient {
 
     if (credentialOfferRequest?.supportedFlows.includes(AuthzFlowType.PRE_AUTHORIZED_CODE_FLOW)) {
       this.assertAlphanumericPin(opts.pinMetadata, pin)
-      request.user_pin = pin
-      request.tx_code = pin
+      // OID4VCI 1.0 uses tx_code, older drafts used user_pin
+      if (opts.pinMetadata?.txCode) {
+        request.tx_code = pin
+      } else {
+        request.user_pin = pin
+      }
 
       request.grant_type = GrantTypes.PRE_AUTHORIZED_CODE
       // we actually know it is there because of the isPreAuthCode call

packages/client/lib/functions/AccessTokenUtil.ts

@@ -9,7 +9,7 @@ export const createJwtBearerClientAssertion = async (
     version?: OpenId4VCIVersion
   },
 ): Promise<void> => {
-  const { asOpts, credentialIssuer } = opts
+  const { asOpts, credentialIssuer, metadata } = opts
   if (asOpts?.clientOpts?.clientAssertionType === 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer') {
     const { clientId = request.client_id, signCallbacks, alg } = asOpts.clientOpts
     let { kid } = asOpts.clientOpts
@@ -25,6 +25,8 @@ export const createJwtBearerClientAssertion = async (
     if (clientId.startsWith('http') && kid.includes('#')) {
       kid = kid.split('#')[1]
     }
+    // Per RFC 7523, aud should identify the authorization server (token endpoint or issuer)
+    const aud = metadata?.token_endpoint ?? asOpts?.tokenEndpoint ?? credentialIssuer
     const jwt: Jwt = {
       header: {
         typ: 'JWT',
@@ -34,10 +36,10 @@ export const createJwtBearerClientAssertion = async (
       payload: {
         iss: clientId,
         sub: clientId,
-        aud: credentialIssuer,
+        aud,
         jti: uuidv4(),
-        exp: Math.floor(Date.now()) / 1000 + 60,
-        iat: Math.floor(Date.now()) / 1000 - 60,
+        exp: Math.floor(Date.now() / 1000) + 60,
+        iat: Math.floor(Date.now() / 1000) - 60,
       },
     }
     const pop = await ProofOfPossessionBuilder.fromJwt({