w

auth/api/iam/api.go

@@ -113,6 +113,8 @@ func (r Wrapper) Routes(router core.EchoRouter) {
 
 // HandleTokenRequest handles calls to the token endpoint for exchanging a grant (e.g authorization code or pre-authorized code) for an access token.
 func (r Wrapper) HandleTokenRequest(ctx context.Context, request HandleTokenRequestRequestObject) (HandleTokenRequestResponseObject, error) {
+	ownDID := idToDID(request.Id)
+
 	switch request.Body.GrantType {
 	case "authorization_code":
 		// Options:
@@ -124,6 +126,9 @@ func (r Wrapper) HandleTokenRequest(ctx context.Context, request HandleTokenRequ
 	case "urn:ietf:params:oauth:grant-type:pre-authorized_code":
 		// Options:
 		// - OpenID4VCI
+	case "vp_token-bearer":
+		// Nuts RFC021 vp_token bearer flow
+		return r.handleS2STokenRequest(ownDID, request.Body.AdditionalProperties)
 	default:
 		// TODO: Don't use openid4vci package for errors
 		return nil, openid4vci.Error{

auth/api/iam/s2s_vptoken.go

@@ -46,22 +46,21 @@ func (s serviceToService) Routes(router core.EchoRouter) {
 	})
 }
 
-func (s serviceToService) validateVPToken(params map[string]string) (string, error) {
+func (r Wrapper) handleS2STokenRequest(ownDID did.DID, params map[string]string) (HandleTokenRequestResponseObject, error) {
 	submission := params["presentation_submission"]
 	scope := params["scope"]
 	vp_token := params["vp_token"]
 	if submission == "" || scope == "" || vp_token == "" {
 		// TODO: right error response
-		return "", errors.New("missing required parameters")
+		return nil, errors.New("missing required parameters")
 	}
 	// TODO: https://github.com/nuts-foundation/nuts-node/issues/2418
 	// TODO: verify parameters
 	return scope, nil
 }
 
-func (s serviceToService) handleAuthzRequest(_ map[string]string, _ *Session) (*authzResponse, error) {
-	// Protocol does not support authorization code flow
-	return nil, nil
+func (s serviceToService) validateVPToken(params map[string]string) (string, error) {
+
 }
 
 func (r Wrapper) RequestAccessToken(ctx context.Context, request RequestAccessTokenRequestObject) (RequestAccessTokenResponseObject, error) {