feat(openid4vc-client): openid authorization flow

[karimStekelenburg]

This PR contains the logic for the OpenID For Verifiable Credentials Issuance authorization flow.

Funded by the Ontario Government

[TimoGlastra]

Nice! Mostly some small stylistic suggestions

[TimoGlastra]

Seems DCO is failing BTW

[codecov-commenter]

Codecov Report

Merging #1384 (24003e2) into main (d6e2ea2) will increase coverage by 0.00%.
The diff coverage is 86.00%.

@@           Coverage Diff           @@
##             main    #1384   +/-   ##
=======================================
  Coverage   81.84%   81.85%           
=======================================
  Files         788      788           
  Lines       19408    19445   +37     
  Branches     3151     3162   +11     
=======================================
+ Hits        15884    15916   +32     
- Misses       3517     3522    +5     
  Partials        7        7           

Impacted Files	Coverage Δ
...ckages/core/src/modules/vc/W3cCredentialService.ts	79.41% <66.66%> (+0.15%)	⬆️
...ges/openid4vc-client/src/OpenId4VcClientService.ts	82.52% <84.61%> (+0.57%)	⬆️
...ackages/openid4vc-client/src/OpenId4VcClientApi.ts	100.00% <100.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[karimStekelenburg]

Thanks, @TimoGlastra. I've processed your comments.

You were right, the two implementations had huge overlaps, and I've merged them together in the service. I did create two separate methods in the API. I figured that is a clearer API than optional values depending on the flow type.

Regarding the code_verifier stuff, does the following description resolve your questions?

In OpenID Connect (OIDC) with Proof Key for Code Exchange (PKCE), the code_verifier is a random string used as a cryptographic challenge when requesting an authorization code from the authorization server.

PKCE is a security mechanism designed to prevent certain types of attacks that can occur when using the Authorization Code flow in OAuth 2.0. Specifically, PKCE is intended to protect against code injection attacks where an attacker intercepts the authorization code and uses it to obtain access tokens without the user's knowledge.

The PKCE flow involves creating a random code_verifier string, calculating a hash of this string, and then sending both the code_verifier and the hash (called the code_challenge) to the authorization server when requesting an authorization code. Later, when the client exchanges the authorization code for an access token, it must again send the code_verifier to the authorization server, which will use it to verify that the code_challenge matches the original code_verifier.

By requiring the code_verifier in addition to the code_challenge, PKCE ensures that only the client that initiated the authorization request can obtain an access token, even if an attacker is able to intercept the authorization code.

[TimoGlastra]

Some final nits for consistency, but LGTM!!

[TimoGlastra]

Nice !!