Multi creds credential endpoint

CHANGELOG.md

@@ -1,5 +1,12 @@
 # bedrock-vc-delivery ChangeLog
 
+## 5.4.0 - 2024-09-dd
+
+### Added
+- Allow multiple credentials (if they are of the same type) to be returned
+  from a single OID4VCI exchange using the `credential` endpoint (not the
+  batch endpoint).
+
 ## 5.3.5 - 2024-08-27
 
 ### Fixed

lib/oid4/http.js

@@ -203,28 +203,33 @@ export async function createRoutes({
         return;
       }
 
-      /* Note: The `/credential` route only supports sending a single VC;
-      assume here that this workflow is configured for a single VC and an
-      error code would have been sent to the client to use the batch
-      endpoint if there was more than one VC to deliver. */
-      const {response, format} = result;
-      const {verifiablePresentation: {verifiableCredential: [vc]}} = response;
+      // send VC(s)
+      const {
+        response: {verifiablePresentation: {verifiableCredential}},
+        format
+      } = result;
+      // FIXME: "format" doesn't seem to be in the spec anymore (draft 14+)...
+      const credentials = verifiableCredential.map(vc => {
+        // parse any enveloped VC
+        let credential;
+        if(vc.type === 'EnvelopedVerifiableCredential' &&
+          vc.id?.startsWith('data:application/jwt,')) {
+          credential = vc.id.slice('data:application/jwt,'.length);
+        } else {
+          credential = vc;
+        }
+        return credential;
+      });
 
-      // parse any enveloped VC
-      let credential;
-      if(vc.type === 'EnvelopedVerifiableCredential' &&
-        vc.id?.startsWith('data:application/jwt,')) {
-        credential = vc.id.slice('data:application/jwt,'.length);
-      } else {
-        credential = vc;
-      }
+      /* Note: The `/credential` route only supports sending VCs of the same
+      type, but there can be more than one of them. The above `isBatchRequest`
+      check will ensure that the workflow used here only allows a single
+      credential request, indicating a single type. */
 
       // send OID4VCI response
-      res.json({
-        // FIXME: this doesn't seem to be in the spec anymore (draft 14+)...
-        format,
-        credential
-      });
+      const response = credentials.length === 1 ?
+        {format, credential: credentials[0]} : {format, credentials};
+      res.json(response);
     }));
 
   // a credential delivery server endpoint

test/mocha/20-vcapi.js

@@ -278,7 +278,7 @@ describe('exchange w/ VC-API delivery', () => {
         // wait for exchange to expire
         now = new Date();
         await new Promise(
-          r => setTimeout(r, expires.getTime() - now.getTime()));
+          r => setTimeout(r, expires.getTime() - now.getTime() + 1));
       } catch(error) {
         err = error;
       }