Feat: add zod for object validation

[cre8]

Using zod could help to validate objects before dealing with them. This should be implemented for all packages where required

[lukasjhan]

Can you tell me what examples there are?

[cre8]

It would help to validate variables. So instead of

if(jwk.exp && typeof jwk.exp === number) {

}

you could go with

const schema = z.number();
schema.parse(jwk.exp)

While I think ZOD is nice, I do not see so many values that we need to type check for validation (Timo brought the topic up in one of the issues)

[TimoGlastra]

Wanted to mention that I still think this would be useful. I was looking at the VCT fetching implementation and it seems the resolved VCT metadata is not validated, although the type would suggest it has a certain strucutre.

Would you be open to a pattern as we use in our oid4vc-ts implementation?

Basically all types are defined as zod structures, from which a type can be inferred. Whenever you deal with untrusted data (like fetching a status, resolving type metadata, verifying a JWT) you will first verify the payload, ensuring the TypeScript type match the runtime data?

We have built quite a nice abstraction with a zod fetcher: https://github.com/openwallet-foundation-labs/oid4vc-ts/blob/main/packages/oauth2/src/metadata/fetch-jwks-uri.ts#L14

You pass the schema and it will automatically verify the response structure, and it's either an error or you have a typed object.

If we're not fetching external data but want to verify input/output of the library, we use parseWithErrorHandling: https://github.com/openwallet-foundation-labs/oid4vc-ts/blob/fb8bf7999a8dddcdc572efcb30a8729e720d9a40/packages/oauth2/src/access-token/create-access-token-response.ts#L43-L55.

With .loose() you can allow additional parameters, so it's mostly to ensure the base typing is correct

We have caught a lot of interoperability issues due to this robust type checking approach.

[cre8]

Extending the fetch option to pass an optional zod object to allow verification sounds like a good idea.

Especially now that the specs are stable so we can even go with "allow only defined" ones that will not suddenly break something..