feat: add nonce check

generator/nextjs/template/src/components/NavBar.tsx

@@ -64,14 +64,14 @@ const NavBar: FC = () => {
             className="py-4 font-medium transition-colors hover:text-blue-500"
             prefetch={false}
           >
-            Receive Credentials
+            Receive Credentials (WS)
           </Link>
           <Link
             href="/iota-redirect"
             className="py-4 font-medium transition-colors hover:text-blue-500"
             prefetch={false}
           >
-            Redirect flow
+            Receive Credentials (Redirect)
           </Link>
         </nav>
         {session && (

generator/nextjs/template/src/components/iota/RedirectFlowCallbackPage.tsx

@@ -25,6 +25,7 @@ export default function IotaCallbackPage() {
   const responseCode = searchParams.get("response_code");
 
   const iotaRedirectString = localStorage.getItem("iotaRedirect") || "";
+  const iotaRedirect = JSON.parse(iotaRedirectString);
 
   const iotaResponseQuery = useQuery({
     queryKey: ["queryOptions", iotaRedirectString],
@@ -42,7 +43,8 @@ export default function IotaCallbackPage() {
   return (
     <div>
       <h1>Data Loaded:</h1>
-      <pre>{JSON.stringify(iotaResponseQuery.data, null, 2)}</pre>
+      <pre>Nonce matched: {iotaRedirect.nonce === iotaResponseQuery.data.nonce ? '✅' : '❌'}</pre>
+      <pre>Full response: {JSON.stringify(iotaResponseQuery.data, null, 2)}</pre>
     </div>
   );
 }

generator/nextjs/template/src/components/iota/RedirectFlowPage.tsx

@@ -64,24 +64,25 @@ export default function IotaRedirectFlowPage({
 
   async function handleRedirectFlowShare(queryId: string) {
     setIsFormDisabled(true);
-
+    const nonce = uuidv4().slice(0, 10);
     const response = await fetch("/api/iota/init-share", {
       method: "POST",
       body: JSON.stringify({
         configurationId: selectedConfigId,
         queryId,
         redirectUri: selectedRedirectUri,
-        nonce: uuidv4().slice(0, 10),
+        nonce: nonce,
       }),
       headers: {
         "Content-Type": "application/json",
-        "Accept": "application/json",
+        Accept: "application/json",
       },
     });
 
     const data = await response.json();
 
     const toStore = {
+      nonce,
       configurationId: selectedConfigId,
       correlationId: data.correlationId,
       transactionId: data.transactionId,

generator/nextjs/template/src/lib/clients/iota.ts

@@ -100,5 +100,5 @@ export async function fetchIotaVpResponse(
   });
 
   const vp = JSON.parse((iotaVpResponse.data as any).vpToken);
-  return vp;
+  return { vp: vp, nonce: iotaVpResponse.data.nonce };
 }