fix: Do not send client id in pre-auth when no other form of client auth is used

Author: nklomp

packages/client/lib/AccessTokenClient.ts

@@ -162,6 +162,13 @@ export class AccessTokenClient {
       // we actually know it is there because of the isPreAuthCode call
       request[PRE_AUTH_CODE_LITERAL] = credentialOfferRequest?.credential_offer.grants?.[PRE_AUTH_GRANT_LITERAL]?.[PRE_AUTH_CODE_LITERAL]
 
+      // OID4VCI 1.0 (Token Request): for the pre-authorized code grant client authentication is OPTIONAL and client_id
+      // "is only needed when a form of Client Authentication that relies on the parameter is used", so omit it unless
+      // such a method is in play (client_assertion was handled above) or it was explicitly passed as additional param
+      if (request.client_id && !request.client_secret && opts.additionalParams?.client_id === undefined) {
+        delete request.client_id
+      }
+
       return request as AccessTokenRequest
     }
 

packages/client/lib/__tests__/AccessTokenClient.spec.ts

@@ -235,4 +235,77 @@ describe('AccessTokenClient should', () => {
       }),
     ).toThrow(Error('Cannot determine token URL if no issuer, metadata and no Authorization Server values are present'))
   })
+
+  it(
+    'not include client_id in a pre-authorized code token request when no client authentication is used',
+    async () => {
+      const accessTokenClient: AccessTokenClient = new AccessTokenClient()
+
+      const accessTokenRequest = await accessTokenClient.createAccessTokenRequest({
+        credentialOffer: INITIATION_TEST,
+        pin: '1234',
+        pinMetadata: { isPinRequired: true, txCode: INITIATION_TEST.txCode },
+        asOpts: { clientOpts: { clientId: 'https://sphereon.com/ssi-wallet' } },
+      })
+
+      expect(accessTokenRequest.grant_type).toEqual(GrantTypes.PRE_AUTHORIZED_CODE)
+      expect(accessTokenRequest.client_id).toBeUndefined()
+    },
+    UNIT_TEST_TIMEOUT,
+  )
+
+  it(
+    'include client_id in a pre-authorized code token request when client authentication relying on it is used',
+    async () => {
+      const accessTokenClient: AccessTokenClient = new AccessTokenClient()
+
+      const accessTokenRequest = await accessTokenClient.createAccessTokenRequest({
+        credentialOffer: INITIATION_TEST,
+        pin: '1234',
+        pinMetadata: { isPinRequired: true, txCode: INITIATION_TEST.txCode },
+        asOpts: { clientOpts: { clientId: 'my-client' } },
+        additionalParams: { client_secret: 'my-secret' },
+      })
+
+      expect(accessTokenRequest.grant_type).toEqual(GrantTypes.PRE_AUTHORIZED_CODE)
+      expect(accessTokenRequest.client_id).toEqual('my-client')
+      expect(accessTokenRequest.client_secret).toEqual('my-secret')
+    },
+    UNIT_TEST_TIMEOUT,
+  )
+
+  it(
+    'include client_id in a pre-authorized code token request when explicitly provided as additional param',
+    async () => {
+      const accessTokenClient: AccessTokenClient = new AccessTokenClient()
+
+      const accessTokenRequest = await accessTokenClient.createAccessTokenRequest({
+        credentialOffer: INITIATION_TEST,
+        pin: '1234',
+        pinMetadata: { isPinRequired: true, txCode: INITIATION_TEST.txCode },
+        additionalParams: { client_id: 'forced-client-id' },
+      })
+
+      expect(accessTokenRequest.grant_type).toEqual(GrantTypes.PRE_AUTHORIZED_CODE)
+      expect(accessTokenRequest.client_id).toEqual('forced-client-id')
+    },
+    UNIT_TEST_TIMEOUT,
+  )
+
+  it(
+    'include client_id in an authorization code token request for a public client without client authentication',
+    async () => {
+      const accessTokenClient: AccessTokenClient = new AccessTokenClient()
+
+      const accessTokenRequest = await accessTokenClient.createAccessTokenRequest({
+        code: '9mq3kwIuNZ88czRjJ2-UDxtaNXulOfxHSXo-kM01MLV',
+        redirectUri: 'http://test.com/cb',
+        asOpts: { clientOpts: { clientId: 'test-client' } },
+      })
+
+      expect(accessTokenRequest.grant_type).toEqual(GrantTypes.AUTHORIZATION_CODE)
+      expect(accessTokenRequest.client_id).toEqual('test-client')
+    },
+    UNIT_TEST_TIMEOUT,
+  )
 })