Ensure workflow step w/only issuanceRequests can execute.

CHANGELOG.md

@@ -1,5 +1,11 @@
 # bedrock-vc-delivery ChangeLog
 
+## 6.4.1 - 2025-01-dd
+
+### Fixed
+- Ensure a workflow step that includes `issuanceRequests` and no other
+  properties can be executed.
+
 ## 6.4.0 - 2024-11-10
 
 ### Added

lib/vcapi.js

@@ -223,9 +223,20 @@ export async function processExchange({req, res, workflow, exchangeRecord}) {
           break;
         }
 
+        // FIXME: remove this once the other FIXME below is implemented
+        // and provides support for issuance in non-last step
+        if(step.issueRequests?.length > 0) {
+          throw new BedrockError(
+            'Invalid step detected; continuing exchanges currently must ' +
+            'only issue in the final step.', {
+              name: 'DataError',
+              details: {httpStatusCode: 500, public: true}
+            });
+        }
+
         // update the exchange to go to the next step, then loop to send
         // next VPR
-        currentStep = exchange.step = step.nextStep;
+        exchange.step = step.nextStep;
         // ensure exchange state is active
         if(exchange.state === 'pending') {
           exchange.state = 'active';
@@ -249,6 +260,7 @@ export async function processExchange({req, res, workflow, exchangeRecord}) {
             details: {httpStatusCode: 500, public: true}
           });
       }
+      currentStep = step.nextStep;
     }
 
     // mark exchange complete