@pagopa/io-react-native-wallet 0.12.0 → 0.13.0

package/lib/module/credential/issuance/03-start-credential-issuance.js

@@ -0,0 +1,276 @@
+import uuid from "react-native-uuid";
+import { makeParRequest } from "../../utils/par";
+import { SignJWT } from "@pagopa/io-react-native-jwt";
+import { generateRandomAlphaNumericString, hasStatus, until } from "../../utils/misc";
+import { ASSERTION_TYPE } from "./const";
+import parseUrl from "parse-url";
+import { AuthorizationError, AuthorizationIdpError, ValidationFailed } from "../../utils/errors";
+import { AuthorizationErrorShape, AuthorizationResultShape } from "../../utils/auth";
+import { withEphemeralKey } from "../../utils/crypto";
+import { createDPopToken } from "../../utils/dpop";
+import { createPopToken } from "../../utils/pop";
+import { CredentialResponse, TokenResponse } from "./types";
+import * as WalletInstanceAttestation from "../../wallet-instance-attestation";
+import { Linking } from "react-native";
+
+/**
+ * Ensures that the credential type requested is supported by the issuer and contained in the
+ * issuer configuration.
+ * @param issuerConf The issuer configuration
+ * @param credentialType The type of the credential to be requested
+ * @returns The credential definition to be used in the request which includes the format and the type and its type
+ */
+const selectCredentialDefinition = (issuerConf, credentialType) => {
+  const credential_configurations_supported = issuerConf.openid_credential_issuer.credential_configurations_supported;
+  const [result] = Object.keys(credential_configurations_supported).filter(e => e.includes(credentialType)).map(e => ({
+    credential_configuration_id: credentialType,
+    format: credential_configurations_supported[e].format,
+    type: "openid_credential"
+  }));
+  if (!result) {
+    throw new Error(`No credential support the type '${credentialType}'`);
+  }
+  return result;
+};
+
+/**
+ * Ensures that the response mode requested is supported by the issuer and contained in the issuer configuration.
+ * @param issuerConf The issuer configuration
+ * @param credentialType The type of the credential to be requested
+ * @returns The response mode to be used in the request, "query" for PersonIdentificationData and "form_post.jwt" for all other types.
+ */
+const selectResponseMode = (issuerConf, credentialType) => {
+  const responseModeSupported = issuerConf.oauth_authorization_server.response_modes_supported;
+  const responseMode = credentialType === "PersonIdentificationData" ? "query" : "form_post.jwt";
+  if (!responseModeSupported.includes(responseMode)) {
+    throw new Error(`No response mode support the type '${credentialType}'`);
+  }
+  return responseMode;
+};
+/**
+ * Starts the credential issuance flow to obtain a credential from the issuer.
+ * @param issuerConf The Issuer configuration
+ * @param credentialType The type of the credential to be requested
+ * @param context.wiaCryptoContext The context to access the key associated with the Wallet Instance Attestation
+ * @param context.credentialCryptoContext The context to access the key to associat with credential
+ * @param context.walletInstanceAttestation The Wallet Instance Attestation token
+ * @param context.authorizationContext The context to identify the user which will be used to start the authorization. It's needed only when requesting a PersonalIdentificationData credential. The implementantion should open an in-app browser capable of catching the redirectSchema. If not specified, the default browser is used.
+ * @param context.redirectUri The internal URL to which to redirect has passed the in-app browser login phase. If you don't use authorizationContext remember to register this URL as customUrl or deepLink. See https://reactnative.dev/docs/linking
+ * @param context.idphint Unique identifier of the SPID IDP
+ * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
+ * @throws {AuthorizationError} When the response from the authorization response is not parsable
+ * @returns The credential obtained
+ */
+
+export const startCredentialIssuance = async (issuerConf, credentialType, ctx) => {
+  const {
+    wiaCryptoContext,
+    credentialCryptoContext,
+    walletInstanceAttestation,
+    authorizationContext,
+    redirectUri,
+    idphint,
+    appFetch = fetch
+  } = ctx;
+
+  /**
+   * Creates and sends a PAR request to the /as/par endpoint of the authroization server.
+   * This starts the authentication flow to obtain an access token.
+   * This token enables the Wallet Instance to request a digital credential from the Credential Endpoint of the Credential Issuer.
+   * This is an HTTP POST request containing the Wallet Instance identifier (client id), the code challenge and challenge method as specified by PKCE according to RFC 9126
+   * along with the WTE and its proof of possession (WTE-PoP).
+   * Additionally, it includes a request object, which is a signed JWT encapsulating the type of digital credential requested (authorization_details),
+   * the application session identifier on the Wallet Instance side (state),
+   * the method (query or form_post.jwt) by which the Authorization Server
+   * should transmit the Authorization Response containing the authorization code issued upon the end user's authentication (response_mode)
+   * to the Wallet Instance's Token Endpoint to obtain the Access Token, and the redirect_uri of the Wallet Instance where the Authorization Response
+   * should be delivered. The redirect is achived by using a custom URL scheme that the Wallet Instance is registered to handle.
+   */
+  const clientId = await wiaCryptoContext.getPublicKey().then(_ => _.kid);
+  const codeVerifier = generateRandomAlphaNumericString(64);
+  const parEndpoint = issuerConf.oauth_authorization_server.pushed_authorization_request_endpoint;
+  const parUrl = new URL(parEndpoint);
+  const aud = `${parUrl.protocol}//${parUrl.hostname}`;
+  const iss = WalletInstanceAttestation.decode(walletInstanceAttestation).payload.cnf.jwk.kid;
+  const credentialDefinition = selectCredentialDefinition(issuerConf, credentialType);
+  const responseMode = selectResponseMode(issuerConf, credentialType);
+  const getPar = makeParRequest({
+    wiaCryptoContext,
+    appFetch
+  });
+  const issuerRequestUri = await getPar(clientId, codeVerifier, redirectUri, responseMode, parEndpoint, walletInstanceAttestation, [credentialDefinition], ASSERTION_TYPE);
+
+  /**
+   * Starts the authorization flow which dependes on the response mode and the request credential.
+   * If the response mode is "query" the authorization flow is handled differently via the authorization context which opens an in-app browser capable of catching the redirectSchema.
+   * The form_post.jwt mode is not currently supported.
+   */
+  const authorizeFlowResult = await (async () => {
+    const authzRequestEndpoint = issuerConf.oauth_authorization_server.authorization_endpoint;
+    if (responseMode === "query") {
+      const params = new URLSearchParams({
+        client_id: clientId,
+        request_uri: issuerRequestUri,
+        idphint
+      });
+
+      /**
+       * Starts the authorization flow to obtain an authorization code by performing a GET request to the /authorize endpoint of the authorization server.
+       */
+      return await authorizeUserWithQueryMode(authzRequestEndpoint, params, redirectUri, authorizationContext);
+    } else {
+      throw new AuthorizationError("Response mode not supported for this type of credential");
+    }
+  })();
+
+  /**
+   * Creates and sends the DPoP Proof JWT to be presented with the authorization code to the /token endpoint of the authorization server
+   * for requesting the issuance of an access token bound to the public key of the Wallet Instance contained within the DPoP.
+   * This enables the Wallet Instance to request a digital credential.
+   * The DPoP Proof JWT is generated according to the section 4.3 of the DPoP RFC 9449 specification.
+   */
+
+  const {
+    code
+  } = authorizeFlowResult;
+  const tokenUrl = issuerConf.oauth_authorization_server.token_endpoint;
+  // Use an ephemeral key to be destroyed after use
+  const tokenRequestSignedDPop = await withEphemeralKey(async ephimeralContext => {
+    return await createDPopToken({
+      htm: "POST",
+      htu: tokenUrl,
+      jti: `${uuid.v4()}`
+    }, ephimeralContext);
+  });
+  const signedWiaPoP = await createPopToken({
+    jti: `${uuid.v4()}`,
+    aud,
+    iss
+  }, wiaCryptoContext);
+  const requestBody = {
+    grant_type: "authorization_code",
+    client_id: clientId,
+    code,
+    redirect_uri: redirectUri,
+    code_verifier: codeVerifier,
+    client_assertion_type: ASSERTION_TYPE,
+    client_assertion: walletInstanceAttestation + "~" + signedWiaPoP
+  };
+  const authorizationRequestFormBody = new URLSearchParams(requestBody);
+  const tokenRes = await appFetch(tokenUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      DPoP: tokenRequestSignedDPop
+    },
+    body: authorizationRequestFormBody.toString()
+  }).then(hasStatus(200)).then(res => res.json()).then(body => TokenResponse.safeParse(body));
+  if (!tokenRes.success) {
+    throw new ValidationFailed(tokenRes.error.message);
+  }
+
+  /**
+   * Validates the token response and extracts the access token, c_nonce and c_nonce_expires_in.
+   */
+  const accessTokenResponse = tokenRes.data;
+  const credentialUrl = issuerConf.openid_credential_issuer.credential_endpoint;
+
+  /**
+   * JWT proof token to bind the request nonce to the key that will bind the holder User with the Credential
+   * This is presented along with the access token to the Credential Endpoint as proof of possession of the private key used to sign the Access Token.
+   * @see https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-proof-types
+   */
+  const signedNonceProof = await createNonceProof(accessTokenResponse.c_nonce, clientId, credentialUrl, credentialCryptoContext);
+
+  // Validation of accessTokenResponse.authorization_details if contain credentialDefinition
+  const constainsCredentialDefinition = accessTokenResponse.authorization_details.some(c => c.credential_configuration_id === credentialDefinition.credential_configuration_id && c.format === credentialDefinition.format && c.type === credentialDefinition.type);
+  if (!constainsCredentialDefinition) {
+    throw new ValidationFailed("The access token response does not contain the requested credential");
+  }
+
+  /** The credential request body */
+  const credentialRequestFormBody = {
+    credential_definition: {
+      type: [credentialDefinition.credential_configuration_id]
+    },
+    format: credentialDefinition.format,
+    proof: {
+      jwt: signedNonceProof,
+      proof_type: "jwt"
+    }
+  };
+  const credentialRes = await appFetch(credentialUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      DPoP: tokenRequestSignedDPop,
+      Authorization: `${accessTokenResponse.token_type} ${accessTokenResponse.access_token}`
+    },
+    body: JSON.stringify(credentialRequestFormBody)
+  }).then(hasStatus(200)).then(res => res.json()).then(body => CredentialResponse.safeParse(body));
+  if (!credentialRes.success) {
+    throw new ValidationFailed(credentialRes.error.message);
+  }
+  return credentialRes.data;
+};
+
+/**
+ * Authorizes the user using the query mode and the authorization context.
+ * @param authzRequestEndpoint The authorization endpoint of the authorization server
+ * @param params The query parameters to be used in the request
+ * @param redirectUri The URL to which the redirect is made is usually a custom URL or deeplink
+ * @param authorizationContext The AuthorizationContext to manage the internal webview. If not specified, the default browser is used
+ * @returns The authrozation result containing the authorization code, state and issuer
+ */
+export const authorizeUserWithQueryMode = async (authzRequestEndpoint, params, redirectUri, authorizationContext) => {
+  const authUrl = `${authzRequestEndpoint}?${params}`;
+  var authRedirectUrl;
+  if (authorizationContext) {
+    const redirectSchema = new URL(redirectUri).protocol.replace(":", "");
+    authRedirectUrl = await authorizationContext.authorize(authUrl, redirectSchema).catch(e => {
+      throw new AuthorizationError(e.message);
+    });
+  } else {
+    // handler for redirectUri
+    Linking.addEventListener("url", _ref => {
+      let {
+        url
+      } = _ref;
+      if (url.includes(redirectUri)) {
+        authRedirectUrl = url;
+      }
+    });
+    const openAuthUrlInBrowser = Linking.openURL(authUrl);
+
+    /*
+     * Waits for 120 seconds for the identificationRedirectUrl variable to be set
+     * by the custom url handler. If the timeout is exceeded, throw an exception
+     */
+    const unitAuthRedirectIsNotUndefined = until(() => authRedirectUrl !== undefined, 120);
+    await Promise.all([openAuthUrlInBrowser, unitAuthRedirectIsNotUndefined]);
+    if (authRedirectUrl === undefined) {
+      throw new AuthorizationError("Invalid authentication redirect url");
+    }
+  }
+  const urlParse = parseUrl(authRedirectUrl);
+  const authRes = AuthorizationResultShape.safeParse(urlParse.query);
+  if (!authRes.success) {
+    const authErr = AuthorizationErrorShape.safeParse(urlParse.query);
+    if (!authErr.success) {
+      throw new AuthorizationError(authRes.error.message); // an error occured while parsing the result and the error
+    }
+
+    throw new AuthorizationIdpError(authErr.data.error, authErr.data.error_description);
+  }
+  return authRes.data;
+};
+export const createNonceProof = async (nonce, issuer, audience, ctx) => {
+  const jwk = await ctx.getPublicKey();
+  return new SignJWT(ctx).setPayload({
+    nonce
+  }).setProtectedHeader({
+    typ: "openid4vci-proof+jwt",
+    jwk
+  }).setAudience(audience).setIssuer(issuer).setIssuedAt().setExpirationTime("5min").sign();
+};
+//# sourceMappingURL=03-start-credential-issuance.js.map

package/lib/module/credential/issuance/03-start-credential-issuance.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["uuid","makeParRequest","SignJWT","generateRandomAlphaNumericString","hasStatus","until","ASSERTION_TYPE","parseUrl","AuthorizationError","AuthorizationIdpError","ValidationFailed","AuthorizationErrorShape","AuthorizationResultShape","withEphemeralKey","createDPopToken","createPopToken","CredentialResponse","TokenResponse","WalletInstanceAttestation","Linking","selectCredentialDefinition","issuerConf","credentialType","credential_configurations_supported","openid_credential_issuer","result","Object","keys","filter","e","includes","map","credential_configuration_id","format","type","Error","selectResponseMode","responseModeSupported","oauth_authorization_server","response_modes_supported","responseMode","startCredentialIssuance","ctx","wiaCryptoContext","credentialCryptoContext","walletInstanceAttestation","authorizationContext","redirectUri","idphint","appFetch","fetch","clientId","getPublicKey","then","_","kid","codeVerifier","parEndpoint","pushed_authorization_request_endpoint","parUrl","URL","aud","protocol","hostname","iss","decode","payload","cnf","jwk","credentialDefinition","getPar","issuerRequestUri","authorizeFlowResult","authzRequestEndpoint","authorization_endpoint","params","URLSearchParams","client_id","request_uri","authorizeUserWithQueryMode","code","tokenUrl","token_endpoint","tokenRequestSignedDPop","ephimeralContext","htm","htu","jti","v4","signedWiaPoP","requestBody","grant_type","redirect_uri","code_verifier","client_assertion_type","client_assertion","authorizationRequestFormBody","tokenRes","method","headers","DPoP","body","toString","res","json","safeParse","success","error","message","accessTokenResponse","data","credentialUrl","credential_endpoint","signedNonceProof","createNonceProof","c_nonce","constainsCredentialDefinition","authorization_details","some","c","credentialRequestFormBody","credential_definition","proof","jwt","proof_type","credentialRes","Authorization","token_type","access_token","JSON","stringify","authUrl","authRedirectUrl","redirectSchema","replace","authorize","catch","addEventListener","_ref","url","openAuthUrlInBrowser","openURL","unitAuthRedirectIsNotUndefined","undefined","Promise","all","urlParse","authRes","query","authErr","error_description","nonce","issuer","audience","setPayload","setProtectedHeader","typ","setAudience","setIssuer","setIssuedAt","setExpirationTime","sign"],"sourceRoot":"../../../../src","sources":["credential/issuance/03-start-credential-issuance.ts"],"mappings":"AAAA,OAAOA,IAAI,MAAM,mBAAmB;AACpC,SAA8BC,cAAc,QAAQ,iBAAiB;AACrE,SAASC,OAAO,QAA4B,6BAA6B;AACzE,SACEC,gCAAgC,EAChCC,SAAS,EACTC,KAAK,QAEA,kBAAkB;AAGzB,SAASC,cAAc,QAAQ,SAAS;AACxC,OAAOC,QAAQ,MAAM,WAAW;AAChC,SACEC,kBAAkB,EAClBC,qBAAqB,EACrBC,gBAAgB,QACX,oBAAoB;AAC3B,SACEC,uBAAuB,EACvBC,wBAAwB,QAGnB,kBAAkB;AACzB,SAASC,gBAAgB,QAAQ,oBAAoB;AACrD,SAASC,eAAe,QAAQ,kBAAkB;AAClD,SAASC,cAAc,QAAQ,iBAAiB;AAChD,SAASC,kBAAkB,EAAEC,aAAa,QAA2B,SAAS;AAC9E,OAAO,KAAKC,yBAAyB,MAAM,mCAAmC;AAC9E,SAASC,OAAO,QAAQ,cAAc;;AAEtC;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,0BAA0B,GAAGA,CACjCC,UAAkD,EAClDC,cAAgD,KACxB;EACxB,MAAMC,mCAAmC,GACvCF,UAAU,CAACG,wBAAwB,CAACD,mCAAmC;EAEzE,MAAM,CAACE,MAAM,CAAC,GAAGC,MAAM,CAACC,IAAI,CAACJ,mCAAmC,CAAC,CAC9DK,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,QAAQ,CAACR,cAAc,CAAC,CAAC,CACzCS,GAAG,CAAEF,CAAC,KAAM;IACXG,2BAA2B,EAAEV,cAAc;IAC3CW,MAAM,EAAEV,mCAAmC,CAACM,CAAC,CAAC,CAAEI,MAAM;IACtDC,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACT,MAAM,EAAE;IACX,MAAM,IAAIU,KAAK,CAAE,mCAAkCb,cAAe,GAAE,CAAC;EACvE;EACA,OAAOG,MAAM;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA,MAAMW,kBAAkB,GAAGA,CACzBf,UAAkD,EAClDC,cAAgD,KAC/B;EACjB,MAAMe,qBAAqB,GACzBhB,UAAU,CAACiB,0BAA0B,CAACC,wBAAwB;EAEhE,MAAMC,YAAY,GAChBlB,cAAc,KAAK,0BAA0B,GAAG,OAAO,GAAG,eAAe;EAE3E,IAAI,CAACe,qBAAqB,CAACP,QAAQ,CAACU,YAAY,CAAC,EAAE;IACjD,MAAM,IAAIL,KAAK,CAAE,sCAAqCb,cAAe,GAAE,CAAC;EAC1E;EAEA,OAAOkB,YAAY;AACrB,CAAC;AAgBD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAO,MAAMC,uBAAgD,GAAG,MAAAA,CAC9DpB,UAAU,EACVC,cAAc,EACdoB,GAAG,KACA;EACH,MAAM;IACJC,gBAAgB;IAChBC,uBAAuB;IACvBC,yBAAyB;IACzBC,oBAAoB;IACpBC,WAAW;IACXC,OAAO;IACPC,QAAQ,GAAGC;EACb,CAAC,GAAGR,GAAG;;EAEP;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAMS,QAAQ,GAAG,MAAMR,gBAAgB,CAACS,YAAY,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,GAAG,CAAC;EACzE,MAAMC,YAAY,GAAGrD,gCAAgC,CAAC,EAAE,CAAC;EACzD,MAAMsD,WAAW,GACfpC,UAAU,CAACiB,0BAA0B,CAACoB,qCAAqC;EAC7E,MAAMC,MAAM,GAAG,IAAIC,GAAG,CAACH,WAAW,CAAC;EACnC,MAAMI,GAAG,GAAI,GAAEF,MAAM,CAACG,QAAS,KAAIH,MAAM,CAACI,QAAS,EAAC;EACpD,MAAMC,GAAG,GAAG9C,yBAAyB,CAAC+C,MAAM,CAACpB,yBAAyB,CAAC,CACpEqB,OAAO,CAACC,GAAG,CAACC,GAAG,CAACb,GAAG;EACtB,MAAMc,oBAAoB,GAAGjD,0BAA0B,CACrDC,UAAU,EACVC,cACF,CAAC;EACD,MAAMkB,YAAY,GAAGJ,kBAAkB,CAACf,UAAU,EAAEC,cAAc,CAAC;EAEnE,MAAMgD,MAAM,GAAGrE,cAAc,CAAC;IAAE0C,gBAAgB;IAAEM;EAAS,CAAC,CAAC;EAC7D,MAAMsB,gBAAgB,GAAG,MAAMD,MAAM,CACnCnB,QAAQ,EACRK,YAAY,EACZT,WAAW,EACXP,YAAY,EACZiB,WAAW,EACXZ,yBAAyB,EACzB,CAACwB,oBAAoB,CAAC,EACtB/D,cACF,CAAC;;EAED;AACF;AACA;AACA;AACA;EACE,MAAMkE,mBAAmB,GAAG,MAAM,CAAC,YAAY;IAC7C,MAAMC,oBAAoB,GACxBpD,UAAU,CAACiB,0BAA0B,CAACoC,sBAAsB;IAC9D,IAAIlC,YAAY,KAAK,OAAO,EAAE;MAC5B,MAAMmC,MAAM,GAAG,IAAIC,eAAe,CAAC;QACjCC,SAAS,EAAE1B,QAAQ;QACnB2B,WAAW,EAAEP,gBAAgB;QAC7BvB;MACF,CAAC,CAAC;;MAEF;AACN;AACA;MACM,OAAO,MAAM+B,0BAA0B,CACrCN,oBAAoB,EACpBE,MAAM,EACN5B,WAAW,EACXD,oBACF,CAAC;IACH,CAAC,MAAM;MACL,MAAM,IAAItC,kBAAkB,CAC1B,yDACF,CAAC;IACH;EACF,CAAC,EAAE,CAAC;;EAEJ;AACF;AACA;AACA;AACA;AACA;;EAEE,MAAM;IAAEwE;EAAK,CAAC,GAAGR,mBAAmB;EACpC,MAAMS,QAAQ,GAAG5D,UAAU,CAACiB,0BAA0B,CAAC4C,cAAc;EACrE;EACA,MAAMC,sBAAsB,GAAG,MAAMtE,gBAAgB,CACnD,MAAOuE,gBAAgB,IAAK;IAC1B,OAAO,MAAMtE,eAAe,CAC1B;MACEuE,GAAG,EAAE,MAAM;MACXC,GAAG,EAAEL,QAAQ;MACbM,GAAG,EAAG,GAAEvF,IAAI,CAACwF,EAAE,CAAC,CAAE;IACpB,CAAC,EACDJ,gBACF,CAAC;EACH,CACF,CAAC;EAED,MAAMK,YAAY,GAAG,MAAM1E,cAAc,CACvC;IACEwE,GAAG,EAAG,GAAEvF,IAAI,CAACwF,EAAE,CAAC,CAAE,EAAC;IACnB3B,GAAG;IACHG;EACF,CAAC,EACDrB,gBACF,CAAC;EAED,MAAM+C,WAAW,GAAG;IAClBC,UAAU,EAAE,oBAAoB;IAChCd,SAAS,EAAE1B,QAAQ;IACnB6B,IAAI;IACJY,YAAY,EAAE7C,WAAW;IACzB8C,aAAa,EAAErC,YAAY;IAC3BsC,qBAAqB,EAAExF,cAAc;IACrCyF,gBAAgB,EAAElD,yBAAyB,GAAG,GAAG,GAAG4C;EACtD,CAAC;EAED,MAAMO,4BAA4B,GAAG,IAAIpB,eAAe,CAACc,WAAW,CAAC;EACrE,MAAMO,QAAQ,GAAG,MAAMhD,QAAQ,CAACgC,QAAQ,EAAE;IACxCiB,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,mCAAmC;MACnDC,IAAI,EAAEjB;IACR,CAAC;IACDkB,IAAI,EAAEL,4BAA4B,CAACM,QAAQ,CAAC;EAC9C,CAAC,CAAC,CACCjD,IAAI,CAACjD,SAAS,CAAC,GAAG,CAAC,CAAC,CACpBiD,IAAI,CAAEkD,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBnD,IAAI,CAAEgD,IAAI,IAAKpF,aAAa,CAACwF,SAAS,CAACJ,IAAI,CAAC,CAAC;EAEhD,IAAI,CAACJ,QAAQ,CAACS,OAAO,EAAE;IACrB,MAAM,IAAIhG,gBAAgB,CAACuF,QAAQ,CAACU,KAAK,CAACC,OAAO,CAAC;EACpD;;EAEA;AACF;AACA;EACE,MAAMC,mBAAmB,GAAGZ,QAAQ,CAACa,IAAI;EACzC,MAAMC,aAAa,GAAG1F,UAAU,CAACG,wBAAwB,CAACwF,mBAAmB;;EAE7E;AACF;AACA;AACA;AACA;EACE,MAAMC,gBAAgB,GAAG,MAAMC,gBAAgB,CAC7CL,mBAAmB,CAACM,OAAO,EAC3BhE,QAAQ,EACR4D,aAAa,EACbnE,uBACF,CAAC;;EAED;EACA,MAAMwE,6BAA6B,GACjCP,mBAAmB,CAACQ,qBAAqB,CAACC,IAAI,CAC3CC,CAAC,IACAA,CAAC,CAACvF,2BAA2B,KAC3BqC,oBAAoB,CAACrC,2BAA2B,IAClDuF,CAAC,CAACtF,MAAM,KAAKoC,oBAAoB,CAACpC,MAAM,IACxCsF,CAAC,CAACrF,IAAI,KAAKmC,oBAAoB,CAACnC,IACpC,CAAC;EAEH,IAAI,CAACkF,6BAA6B,EAAE;IAClC,MAAM,IAAI1G,gBAAgB,CACxB,qEACF,CAAC;EACH;;EAEA;EACA,MAAM8G,yBAAyB,GAAG;IAChCC,qBAAqB,EAAE;MACrBvF,IAAI,EAAE,CAACmC,oBAAoB,CAACrC,2BAA2B;IACzD,CAAC;IACDC,MAAM,EAAEoC,oBAAoB,CAACpC,MAAM;IACnCyF,KAAK,EAAE;MACLC,GAAG,EAAEV,gBAAgB;MACrBW,UAAU,EAAE;IACd;EACF,CAAC;EAED,MAAMC,aAAa,GAAG,MAAM5E,QAAQ,CAAC8D,aAAa,EAAE;IAClDb,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,kBAAkB;MAClCC,IAAI,EAAEjB,sBAAsB;MAC5B2C,aAAa,EAAG,GAAEjB,mBAAmB,CAACkB,UAAW,IAAGlB,mBAAmB,CAACmB,YAAa;IACvF,CAAC;IACD3B,IAAI,EAAE4B,IAAI,CAACC,SAAS,CAACV,yBAAyB;EAChD,CAAC,CAAC,CACCnE,IAAI,CAACjD,SAAS,CAAC,GAAG,CAAC,CAAC,CACpBiD,IAAI,CAAEkD,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBnD,IAAI,CAAEgD,IAAI,IAAKrF,kBAAkB,CAACyF,SAAS,CAACJ,IAAI,CAAC,CAAC;EAErD,IAAI,CAACwB,aAAa,CAACnB,OAAO,EAAE;IAC1B,MAAM,IAAIhG,gBAAgB,CAACmH,aAAa,CAAClB,KAAK,CAACC,OAAO,CAAC;EACzD;EAEA,OAAOiB,aAAa,CAACf,IAAI;AAC3B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAM/B,0BAA0B,GAAG,MAAAA,CACxCN,oBAA4B,EAC5BE,MAAuB,EACvB5B,WAAmB,EACnBD,oBAA2C,KACV;EACjC,MAAMqF,OAAO,GAAI,GAAE1D,oBAAqB,IAAGE,MAAO,EAAC;EACnD,IAAIyD,eAAmC;EAEvC,IAAItF,oBAAoB,EAAE;IACxB,MAAMuF,cAAc,GAAG,IAAIzE,GAAG,CAACb,WAAW,CAAC,CAACe,QAAQ,CAACwE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;IACrEF,eAAe,GAAG,MAAMtF,oBAAoB,CACzCyF,SAAS,CAACJ,OAAO,EAAEE,cAAc,CAAC,CAClCG,KAAK,CAAE3G,CAAC,IAAK;MACZ,MAAM,IAAIrB,kBAAkB,CAACqB,CAAC,CAAC+E,OAAO,CAAC;IACzC,CAAC,CAAC;EACN,CAAC,MAAM;IACL;IACAzF,OAAO,CAACsH,gBAAgB,CAAC,KAAK,EAAEC,IAAA,IAAa;MAAA,IAAZ;QAAEC;MAAI,CAAC,GAAAD,IAAA;MACtC,IAAIC,GAAG,CAAC7G,QAAQ,CAACiB,WAAW,CAAC,EAAE;QAC7BqF,eAAe,GAAGO,GAAG;MACvB;IACF,CAAC,CAAC;IAEF,MAAMC,oBAAoB,GAAGzH,OAAO,CAAC0H,OAAO,CAACV,OAAO,CAAC;;IAErD;AACJ;AACA;AACA;IACI,MAAMW,8BAA8B,GAAGzI,KAAK,CAC1C,MAAM+H,eAAe,KAAKW,SAAS,EACnC,GACF,CAAC;IAED,MAAMC,OAAO,CAACC,GAAG,CAAC,CAACL,oBAAoB,EAAEE,8BAA8B,CAAC,CAAC;IAEzE,IAAIV,eAAe,KAAKW,SAAS,EAAE;MACjC,MAAM,IAAIvI,kBAAkB,CAAC,qCAAqC,CAAC;IACrE;EACF;EAEA,MAAM0I,QAAQ,GAAG3I,QAAQ,CAAC6H,eAAe,CAAC;EAC1C,MAAMe,OAAO,GAAGvI,wBAAwB,CAAC6F,SAAS,CAACyC,QAAQ,CAACE,KAAK,CAAC;EAClE,IAAI,CAACD,OAAO,CAACzC,OAAO,EAAE;IACpB,MAAM2C,OAAO,GAAG1I,uBAAuB,CAAC8F,SAAS,CAACyC,QAAQ,CAACE,KAAK,CAAC;IACjE,IAAI,CAACC,OAAO,CAAC3C,OAAO,EAAE;MACpB,MAAM,IAAIlG,kBAAkB,CAAC2I,OAAO,CAACxC,KAAK,CAACC,OAAO,CAAC,CAAC,CAAC;IACvD;;IACA,MAAM,IAAInG,qBAAqB,CAC7B4I,OAAO,CAACvC,IAAI,CAACH,KAAK,EAClB0C,OAAO,CAACvC,IAAI,CAACwC,iBACf,CAAC;EACH;EACA,OAAOH,OAAO,CAACrC,IAAI;AACrB,CAAC;AAED,OAAO,MAAMI,gBAAgB,GAAG,MAAAA,CAC9BqC,KAAa,EACbC,MAAc,EACdC,QAAgB,EAChB/G,GAAkB,KACE;EACpB,MAAM0B,GAAG,GAAG,MAAM1B,GAAG,CAACU,YAAY,CAAC,CAAC;EACpC,OAAO,IAAIlD,OAAO,CAACwC,GAAG,CAAC,CACpBgH,UAAU,CAAC;IACVH;EACF,CAAC,CAAC,CACDI,kBAAkB,CAAC;IAClBC,GAAG,EAAE,sBAAsB;IAC3BxF;EACF,CAAC,CAAC,CACDyF,WAAW,CAACJ,QAAQ,CAAC,CACrBK,SAAS,CAACN,MAAM,CAAC,CACjBO,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,MAAM,CAAC,CACzBC,IAAI,CAAC,CAAC;AACX,CAAC"}

package/lib/module/credential/issuance/03-start-user-authorization.js

@@ -1,18 +1,22 @@
-import * as z from "zod";
-import uuid from "react-native-uuid";
-import { makeParRequest } from "../../utils/par";
-import { getJwtFromFormPost } from "../../utils/decoder";
-import { hasStatus } from "../../utils/misc";
+import { generateRandomAlphaNumericString } from "../../../src/utils/misc";
+import { makeParRequest } from "../../../src/utils/par";
 import { ASSERTION_TYPE } from "./const";
+/**
+ * Ensures that the credential type requested is supported by the issuer and contained in the
+ * issuer configuration.
+ * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
+ * @param credentialType The type of the credential to be requested returned by {@link startFlow}
+ * @param context.wiaCryptoContext The Wallet Instance's crypto context
+ * @param context.walletInstanceAttestation The Wallet Instance's attestation
+ * @param context.redirectUri The redirect URI which is the custom URL scheme that the Wallet Instance is registered to handle
+ * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
+ * @returns The credential definition to be used in the request which includes the format and the type and its type
+ */
 const selectCredentialDefinition = (issuerConf, credentialType) => {
-  const {
-    credentials_supported
-  } = issuerConf.openid_credential_issuer;
-  const [result] = credentials_supported.filter(e => e.credential_definition.type.includes(credentialType)).map(e => ({
-    credential_definition: {
-      type: credentialType
-    },
-    format: e.format,
+  const credential_configurations_supported = issuerConf.openid_credential_issuer.credential_configurations_supported;
+  const [result] = Object.keys(credential_configurations_supported).filter(e => e.includes(credentialType)).map(e => ({
+    credential_configuration_id: credentialType,
+    format: credential_configurations_supported[e].format,
     type: "openid_credential"
   }));
   if (!result) {
@@ -20,90 +24,62 @@ const selectCredentialDefinition = (issuerConf, credentialType) => {
   }
   return result;
 };
-const decodeAuthorizationResponse = async raw => {
-  const {
-    decodedJwt: {
-      payload
-    }
-  } = await getJwtFromFormPost(raw);
 
-  /**
-   * FIXME: [SIW-628] This step must not make any difference on the credential
-   * we are authorizing for, being a PID or any other (Q)EAA.
-   *
-   * Currently, PID issuer is implemented to skip the CompleteUserAuthorization step
-   * thus returning a stubbed (code, state) pair.
-   *
-   * This is a workaround to proceeed the flow anyway.
-   * If the response does not map what expected (CorrectShape),
-   * we try parse into (code, state) to check if we are in the PID scenario.
-   * In that case, a stub value is returned (will not be evaluated anyway).
-   *
-   * This workaround will be obsolete once the PID issuer fixes its implementation
-   */
-  const CorrectShape = z.object({
-    request_uri: z.string()
-  });
-  const WrongShapeForPID = z.object({
-    code: z.string(),
-    state: z.string()
-  });
-  const [correct, wrong] = [CorrectShape.safeParse(payload), WrongShapeForPID.safeParse(payload)];
-  if (correct.success) {
-    return correct.data;
-  } else if (wrong.success) {
-    return {
-      request_uri: "https://fake-request-uri"
-    };
+/**
+ * Ensures that the response mode requested is supported by the issuer and contained in the issuer configuration.
+ * @param issuerConf The issuer configuration
+ * @param credentialType The type of the credential to be requested
+ * @returns The response mode to be used in the request, "query" for PersonIdentificationData and "form_post.jwt" for all other types.
+ */
+const selectResponseMode = (issuerConf, credentialType) => {
+  const responseModeSupported = issuerConf.oauth_authorization_server.response_modes_supported;
+  const responseMode = credentialType === "PersonIdentificationData" ? "query" : "form_post.jwt";
+  if (!responseModeSupported.includes(responseMode)) {
+    throw new Error(`No response mode support the type '${credentialType}'`);
   }
-  throw correct.error;
+  return responseMode;
 };
+
 /**
- * Start the User authorization phase.
- * Perform the Pushed Authorization Request as defined in OAuth 2.0 protocol.
- *
- * @param issuerConf The Issuer configuration
- * @param credentialType The type of the credential to be requested
- * @param context.wiaCryptoContext The context to access the key associated with the Wallet Instance Attestation
- * @param context.walletInstanceAttestation The Wallet Instance Attestation token
- * @param context.walletProviderBaseUrl The base url of the Wallet Provider
- * @param context.additionalParams Hash set of parameters to be passed to the authorization endpoint
- * (used as a temporary fix until we have a proper User identity in the PID token provider)
- * TODO: [SIW-630]
- * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
- * @returns The request uri to continue the authorization to
+ * WARNING: This function must be called after {@link evaluateIssuerTrust} and {@link startFlow}. The next steam is {@link compeUserAuthorizationWithQueryMode} or {@link compeUserAuthorizationWithFormPostJwtMode}
+ * Creates and sends a PAR request to the /as/par endpoint of the authroization server.
+ * This starts the authentication flow to obtain an access token.
+ * This token enables the Wallet Instance to request a digital credential from the Credential Endpoint of the Credential Issuer.
+ * This is an HTTP POST request containing the Wallet Instance identifier (client id), the code challenge and challenge method as specified by PKCE according to RFC 9126
+ * along with the WTE and its proof of possession (WTE-PoP).
+ * Additionally, it includes a request object, which is a signed JWT encapsulating the type of digital credential requested (authorization_details),
+ * the application session identifier on the Wallet Instance side (state),
+ * the method (query or form_post.jwt) by which the Authorization Server
+ * should transmit the Authorization Response containing the authorization code issued upon the end user's authentication (response_mode)
+ * to the Wallet Instance's Token Endpoint to obtain the Access Token, and the redirect_uri of the Wallet Instance where the Authorization Response
+ * should be delivered. The redirect is achived by using a custom URL scheme that the Wallet Instance is registered to handle.
+ * @param issuerConf The issuer configuration
+ * @param credentialType The type of the credential to be requested returned by {@link selectCredentialDefinition}
+ * @param ctx The context object containing the Wallet Instance's cryptographic context, the Wallet Instance's attestation, the redirect URI and the fetch implementation
+ * @returns The URI to which the end user should be redirected to start the authentication flow, along with the client id, the code verifier and the credential definition
  */
 export const startUserAuthorization = async (issuerConf, credentialType, ctx) => {
   const {
     wiaCryptoContext,
     walletInstanceAttestation,
-    walletProviderBaseUrl,
-    additionalParams = {},
+    redirectUri,
     appFetch = fetch
   } = ctx;
   const clientId = await wiaCryptoContext.getPublicKey().then(_ => _.kid);
-  const codeVerifier = `${uuid.v4()}`;
-  // Make a PAR request to the credential issuer and return the response url
-  const parUrl = issuerConf.openid_credential_issuer.pushed_authorization_request_endpoint;
+  const codeVerifier = generateRandomAlphaNumericString(64);
+  const parEndpoint = issuerConf.oauth_authorization_server.pushed_authorization_request_endpoint;
+  const credentialDefinition = selectCredentialDefinition(issuerConf, credentialType);
+  const responseMode = selectResponseMode(issuerConf, credentialType);
   const getPar = makeParRequest({
     wiaCryptoContext,
     appFetch
   });
-  const issuerRequestUri = await getPar(clientId, codeVerifier, walletProviderBaseUrl, parUrl, walletInstanceAttestation, [selectCredentialDefinition(issuerConf, credentialType)], ASSERTION_TYPE);
-
-  // Initialize authorization by requesting the authz request uri
-  const authzRequestEndpoint = issuerConf.openid_credential_issuer.authorization_endpoint;
-  const params = new URLSearchParams({
-    client_id: clientId,
-    request_uri: issuerRequestUri,
-    ...additionalParams
-  });
-  const {
-    request_uri
-  } = await appFetch(`${authzRequestEndpoint}?${params}`).then(hasStatus(200)).then(res => res.text()).then(decodeAuthorizationResponse);
+  const issuerRequestUri = await getPar(clientId, codeVerifier, redirectUri, responseMode, parEndpoint, walletInstanceAttestation, [credentialDefinition], ASSERTION_TYPE);
   return {
-    requestUri: request_uri,
-    clientId
+    issuerRequestUri,
+    clientId,
+    codeVerifier,
+    credentialDefinition
   };
 };
 //# sourceMappingURL=03-start-user-authorization.js.map

package/lib/module/credential/issuance/03-start-user-authorization.js.map

@@ -1 +1 @@
-{"version":3,"names":["z","uuid","makeParRequest","getJwtFromFormPost","hasStatus","ASSERTION_TYPE","selectCredentialDefinition","issuerConf","credentialType","credentials_supported","openid_credential_issuer","result","filter","e","credential_definition","type","includes","map","format","Error","decodeAuthorizationResponse","raw","decodedJwt","payload","CorrectShape","object","request_uri","string","WrongShapeForPID","code","state","correct","wrong","safeParse","success","data","error","startUserAuthorization","ctx","wiaCryptoContext","walletInstanceAttestation","walletProviderBaseUrl","additionalParams","appFetch","fetch","clientId","getPublicKey","then","_","kid","codeVerifier","v4","parUrl","pushed_authorization_request_endpoint","getPar","issuerRequestUri","authzRequestEndpoint","authorization_endpoint","params","URLSearchParams","client_id","res","text","requestUri"],"sourceRoot":"../../../../src","sources":["credential/issuance/03-start-user-authorization.ts"],"mappings":"AAAA,OAAO,KAAKA,CAAC,MAAM,KAAK;AACxB,OAAOC,IAAI,MAAM,mBAAmB;AACpC,SAA8BC,cAAc,QAAQ,iBAAiB;AAErE,SAASC,kBAAkB,QAAQ,qBAAqB;AACxD,SAASC,SAAS,QAAkB,kBAAkB;AAGtD,SAASC,cAAc,QAAQ,SAAS;AAExC,MAAMC,0BAA0B,GAAGA,CACjCC,UAAkD,EAClDC,cAAgD,KACxB;EACxB,MAAM;IAAEC;EAAsB,CAAC,GAAGF,UAAU,CAACG,wBAAwB;EAErE,MAAM,CAACC,MAAM,CAAC,GAAGF,qBAAqB,CACnCG,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,qBAAqB,CAACC,IAAI,CAACC,QAAQ,CAACR,cAAc,CAAC,CAAC,CACpES,GAAG,CAAEJ,CAAC,KAAM;IACXC,qBAAqB,EAAE;MAAEC,IAAI,EAAEP;IAAe,CAAC;IAC/CU,MAAM,EAAEL,CAAC,CAACK,MAAM;IAChBH,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACJ,MAAM,EAAE;IACX,MAAM,IAAIQ,KAAK,CAAE,mCAAkCX,cAAe,GAAE,CAAC;EACvE;EACA,OAAOG,MAAM;AACf,CAAC;AAED,MAAMS,2BAA2B,GAAG,MAClCC,GAAW,IAC0B;EACrC,MAAM;IACJC,UAAU,EAAE;MAAEC;IAAQ;EACxB,CAAC,GAAG,MAAMpB,kBAAkB,CAACkB,GAAG,CAAC;;EAEjC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAMG,YAAY,GAAGxB,CAAC,CAACyB,MAAM,CAAC;IAAEC,WAAW,EAAE1B,CAAC,CAAC2B,MAAM,CAAC;EAAE,CAAC,CAAC;EAC1D,MAAMC,gBAAgB,GAAG5B,CAAC,CAACyB,MAAM,CAAC;IAAEI,IAAI,EAAE7B,CAAC,CAAC2B,MAAM,CAAC,CAAC;IAAEG,KAAK,EAAE9B,CAAC,CAAC2B,MAAM,CAAC;EAAE,CAAC,CAAC;EAE1E,MAAM,CAACI,OAAO,EAAEC,KAAK,CAAC,GAAG,CACvBR,YAAY,CAACS,SAAS,CAACV,OAAO,CAAC,EAC/BK,gBAAgB,CAACK,SAAS,CAACV,OAAO,CAAC,CACpC;EAED,IAAIQ,OAAO,CAACG,OAAO,EAAE;IACnB,OAAOH,OAAO,CAACI,IAAI;EACrB,CAAC,MAAM,IAAIH,KAAK,CAACE,OAAO,EAAE;IACxB,OAAO;MAAER,WAAW,EAAE;IAA2B,CAAC;EACpD;EACA,MAAMK,OAAO,CAACK,KAAK;AACrB,CAAC;AAcD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,sBAA8C,GAAG,MAAAA,CAC5D9B,UAAU,EACVC,cAAc,EACd8B,GAAG,KACA;EACH,MAAM;IACJC,gBAAgB;IAChBC,yBAAyB;IACzBC,qBAAqB;IACrBC,gBAAgB,GAAG,CAAC,CAAC;IACrBC,QAAQ,GAAGC;EACb,CAAC,GAAGN,GAAG;EACP,MAAMO,QAAQ,GAAG,MAAMN,gBAAgB,CAACO,YAAY,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,GAAG,CAAC;EACzE,MAAMC,YAAY,GAAI,GAAEjD,IAAI,CAACkD,EAAE,CAAC,CAAE,EAAC;EACnC;EACA,MAAMC,MAAM,GACV7C,UAAU,CAACG,wBAAwB,CAAC2C,qCAAqC;EAC3E,MAAMC,MAAM,GAAGpD,cAAc,CAAC;IAAEqC,gBAAgB;IAAEI;EAAS,CAAC,CAAC;EAC7D,MAAMY,gBAAgB,GAAG,MAAMD,MAAM,CACnCT,QAAQ,EACRK,YAAY,EACZT,qBAAqB,EACrBW,MAAM,EACNZ,yBAAyB,EACzB,CAAClC,0BAA0B,CAACC,UAAU,EAAEC,cAAc,CAAC,CAAC,EACxDH,cACF,CAAC;;EAED;EACA,MAAMmD,oBAAoB,GACxBjD,UAAU,CAACG,wBAAwB,CAAC+C,sBAAsB;EAC5D,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCC,SAAS,EAAEf,QAAQ;IACnBnB,WAAW,EAAE6B,gBAAgB;IAC7B,GAAGb;EACL,CAAC,CAAC;EAEF,MAAM;IAAEhB;EAAY,CAAC,GAAG,MAAMiB,QAAQ,CAAE,GAAEa,oBAAqB,IAAGE,MAAO,EAAC,CAAC,CACxEX,IAAI,CAAC3C,SAAS,CAAC,GAAG,CAAC,CAAC,CACpB2C,IAAI,CAAEc,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBf,IAAI,CAAC3B,2BAA2B,CAAC;EAEpC,OAAO;IAAE2C,UAAU,EAAErC,WAAW;IAAEmB;EAAS,CAAC;AAC9C,CAAC"}
+{"version":3,"names":["generateRandomAlphaNumericString","makeParRequest","ASSERTION_TYPE","selectCredentialDefinition","issuerConf","credentialType","credential_configurations_supported","openid_credential_issuer","result","Object","keys","filter","e","includes","map","credential_configuration_id","format","type","Error","selectResponseMode","responseModeSupported","oauth_authorization_server","response_modes_supported","responseMode","startUserAuthorization","ctx","wiaCryptoContext","walletInstanceAttestation","redirectUri","appFetch","fetch","clientId","getPublicKey","then","_","kid","codeVerifier","parEndpoint","pushed_authorization_request_endpoint","credentialDefinition","getPar","issuerRequestUri"],"sourceRoot":"../../../../src","sources":["credential/issuance/03-start-user-authorization.ts"],"mappings":"AAEA,SACEA,gCAAgC,QAE3B,yBAAyB;AAIhC,SAA8BC,cAAc,QAAQ,wBAAwB;AAC5E,SAASC,cAAc,QAAQ,SAAS;AAkBxC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,0BAA0B,GAAGA,CACjCC,UAAkD,EAClDC,cAAgD,KACxB;EACxB,MAAMC,mCAAmC,GACvCF,UAAU,CAACG,wBAAwB,CAACD,mCAAmC;EAEzE,MAAM,CAACE,MAAM,CAAC,GAAGC,MAAM,CAACC,IAAI,CAACJ,mCAAmC,CAAC,CAC9DK,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,QAAQ,CAACR,cAAc,CAAC,CAAC,CACzCS,GAAG,CAAEF,CAAC,KAAM;IACXG,2BAA2B,EAAEV,cAAc;IAC3CW,MAAM,EAAEV,mCAAmC,CAACM,CAAC,CAAC,CAAEI,MAAM;IACtDC,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACT,MAAM,EAAE;IACX,MAAM,IAAIU,KAAK,CAAE,mCAAkCb,cAAe,GAAE,CAAC;EACvE;EACA,OAAOG,MAAM;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA,MAAMW,kBAAkB,GAAGA,CACzBf,UAAkD,EAClDC,cAAgD,KAC/B;EACjB,MAAMe,qBAAqB,GACzBhB,UAAU,CAACiB,0BAA0B,CAACC,wBAAwB;EAEhE,MAAMC,YAAY,GAChBlB,cAAc,KAAK,0BAA0B,GAAG,OAAO,GAAG,eAAe;EAE3E,IAAI,CAACe,qBAAqB,CAACP,QAAQ,CAACU,YAAY,CAAC,EAAE;IACjD,MAAM,IAAIL,KAAK,CAAE,sCAAqCb,cAAe,GAAE,CAAC;EAC1E;EAEA,OAAOkB,YAAY;AACrB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,sBAA8C,GAAG,MAAAA,CAC5DpB,UAAU,EACVC,cAAc,EACdoB,GAAG,KACA;EACH,MAAM;IACJC,gBAAgB;IAChBC,yBAAyB;IACzBC,WAAW;IACXC,QAAQ,GAAGC;EACb,CAAC,GAAGL,GAAG;EAEP,MAAMM,QAAQ,GAAG,MAAML,gBAAgB,CAACM,YAAY,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,GAAG,CAAC;EACzE,MAAMC,YAAY,GAAGpC,gCAAgC,CAAC,EAAE,CAAC;EACzD,MAAMqC,WAAW,GACfjC,UAAU,CAACiB,0BAA0B,CAACiB,qCAAqC;EAC7E,MAAMC,oBAAoB,GAAGpC,0BAA0B,CACrDC,UAAU,EACVC,cACF,CAAC;EACD,MAAMkB,YAAY,GAAGJ,kBAAkB,CAACf,UAAU,EAAEC,cAAc,CAAC;EAEnE,MAAMmC,MAAM,GAAGvC,cAAc,CAAC;IAAEyB,gBAAgB;IAAEG;EAAS,CAAC,CAAC;EAC7D,MAAMY,gBAAgB,GAAG,MAAMD,MAAM,CACnCT,QAAQ,EACRK,YAAY,EACZR,WAAW,EACXL,YAAY,EACZc,WAAW,EACXV,yBAAyB,EACzB,CAACY,oBAAoB,CAAC,EACtBrC,cACF,CAAC;EAED,OAAO;IAAEuC,gBAAgB;IAAEV,QAAQ;IAAEK,YAAY;IAAEG;EAAqB,CAAC;AAC3E,CAAC"}

package/lib/module/credential/issuance/04-complete-user-authorization.js

@@ -1,2 +1,86 @@
-export {};
+import { AuthorizationErrorShape, AuthorizationResultShape } from "../../../src/utils/auth";
+import { until } from "../../utils/misc";
+import parseUrl from "parse-url";
+import { AuthorizationError, AuthorizationIdpError } from "../../utils/errors";
+import { Linking } from "react-native";
+
+/**
+ * The interface of the phase to complete User authorization via strong identification when the response mode is "query" and the request credential is a PersonIdentificationData.
+ */
+
+/**
+ * WARNING: This function must be called after {@link startUserAuthorization}. The next function to be called is {@link authorizeAccess}.
+ * The interface of the phase to complete User authorization via strong identification when the response mode is "query" and the request credential is a PersonIdentificationData.
+ * It is used to complete the user authorization by catching the redirectSchema from the authorization server which then contains the authorization response.
+ * This function utilizes the authorization context to open an in-app browser capable of catching the redirectSchema to perform a get request to the authorization endpoint.
+ * If the 302 redirect happens and the redirectSchema is caught, the function will return the authorization response after parsing it from the query string.
+ * @param issuerRequestUri the URI of the issuer where the request is sent
+ * @param clientId Identifies the current client across all the requests of the issuing flow returned by {@link startUserAuthorization}
+ * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
+ * @param authorizationContext The context to identify the user which will be used to start the authorization. It's needed only when requesting a PersonalIdentificationData credential. The implementantion should open an in-app browser capable of catching the redirectSchema.
+ * If not specified, the default browser is used
+ * @param idphint Unique identifier of the SPID IDP selected by the user
+ * @param redirectUri The url to reach to complete the user authorization which is the custom URL scheme that the Wallet Instance is registered to handle, usually a custom URL or deeplink
+ * @throws {AuthorizationError} if an error occurs during the authorization process
+ * @throws {AuthorizationIdpError} if an error occurs during the authorization process and the error is related to the IDP
+ * @returns the authorization response which contains code, state and iss
+ */
+export const completeUserAuthorizationWithQueryMode = async (issuerRequestUri, clientId, issuerConf, idpHint, redirectUri, authorizationContext) => {
+  /**
+   * Starts the authorization flow which dependes on the response mode and the request credential.
+   * If the response mode is "query" the authorization flow is handled differently via the authorization context which opens an in-app browser capable of catching the redirectSchema.
+   * The form_post.jwt mode is not currently supported.
+   */
+  const authzRequestEndpoint = issuerConf.oauth_authorization_server.authorization_endpoint;
+  const params = new URLSearchParams({
+    client_id: clientId,
+    request_uri: issuerRequestUri,
+    idphint: idpHint
+  });
+  const authUrl = `${authzRequestEndpoint}?${params}`;
+  var authRedirectUrl;
+  if (authorizationContext) {
+    const redirectSchema = new URL(redirectUri).protocol.replace(":", "");
+    authRedirectUrl = await authorizationContext.authorize(authUrl, redirectSchema).catch(e => {
+      throw new AuthorizationError(e.message);
+    });
+  } else {
+    // handler for redirectUri
+    Linking.addEventListener("url", _ref => {
+      let {
+        url
+      } = _ref;
+      if (url.includes(redirectUri)) {
+        authRedirectUrl = url;
+      }
+    });
+    const openAuthUrlInBrowser = Linking.openURL(authUrl);
+
+    /*
+     * Waits for 120 seconds for the identificationRedirectUrl variable to be set
+     * by the custom url handler. If the timeout is exceeded, throw an exception
+     */
+    const unitAuthRedirectIsNotUndefined = until(() => authRedirectUrl !== undefined, 120);
+    await Promise.all([openAuthUrlInBrowser, unitAuthRedirectIsNotUndefined]);
+    if (authRedirectUrl === undefined) {
+      throw new AuthorizationError("Invalid authentication redirect url");
+    }
+  }
+  const urlParse = parseUrl(authRedirectUrl);
+  const authRes = AuthorizationResultShape.safeParse(urlParse.query);
+  if (!authRes.success) {
+    const authErr = AuthorizationErrorShape.safeParse(urlParse.query);
+    if (!authErr.success) {
+      throw new AuthorizationError(authRes.error.message); // an error occured while parsing the result and the error
+    }
+
+    throw new AuthorizationIdpError(authErr.data.error, authErr.data.error_description);
+  }
+  return authRes.data;
+};
+
+// TODO: SIW-1120 implement generic credential issuance flow
+export const completeUserAuthorizationWithFormPostJwtMode = () => {
+  throw new Error("Not implemented");
+};
 //# sourceMappingURL=04-complete-user-authorization.js.map

package/lib/module/credential/issuance/04-complete-user-authorization.js.map

@@ -1 +1 @@
-{"version":3,"names":[],"sourceRoot":"../../../../src","sources":["credential/issuance/04-complete-user-authorization.ts"],"mappings":""}
+{"version":3,"names":["AuthorizationErrorShape","AuthorizationResultShape","until","parseUrl","AuthorizationError","AuthorizationIdpError","Linking","completeUserAuthorizationWithQueryMode","issuerRequestUri","clientId","issuerConf","idpHint","redirectUri","authorizationContext","authzRequestEndpoint","oauth_authorization_server","authorization_endpoint","params","URLSearchParams","client_id","request_uri","idphint","authUrl","authRedirectUrl","redirectSchema","URL","protocol","replace","authorize","catch","e","message","addEventListener","_ref","url","includes","openAuthUrlInBrowser","openURL","unitAuthRedirectIsNotUndefined","undefined","Promise","all","urlParse","authRes","safeParse","query","success","authErr","error","data","error_description","completeUserAuthorizationWithFormPostJwtMode","Error"],"sourceRoot":"../../../../src","sources":["credential/issuance/04-complete-user-authorization.ts"],"mappings":"AAAA,SACEA,uBAAuB,EACvBC,wBAAwB,QAGnB,yBAAyB;AAChC,SAASC,KAAK,QAAkB,kBAAkB;AAElD,OAAOC,QAAQ,MAAM,WAAW;AAChC,SAASC,kBAAkB,EAAEC,qBAAqB,QAAQ,oBAAoB;AAE9E,SAASC,OAAO,QAAQ,cAAc;;AAEtC;AACA;AACA;;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,sCAA8E,GACzF,MAAAA,CACEC,gBAAgB,EAChBC,QAAQ,EACRC,UAAU,EACVC,OAAO,EACPC,WAAW,EACXC,oBAAoB,KACjB;EACH;AACJ;AACA;AACA;AACA;EACI,MAAMC,oBAAoB,GACxBJ,UAAU,CAACK,0BAA0B,CAACC,sBAAsB;EAC9D,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCC,SAAS,EAAEV,QAAQ;IACnBW,WAAW,EAAEZ,gBAAgB;IAC7Ba,OAAO,EAAEV;EACX,CAAC,CAAC;EACF,MAAMW,OAAO,GAAI,GAAER,oBAAqB,IAAGG,MAAO,EAAC;EACnD,IAAIM,eAAmC;EAEvC,IAAIV,oBAAoB,EAAE;IACxB,MAAMW,cAAc,GAAG,IAAIC,GAAG,CAACb,WAAW,CAAC,CAACc,QAAQ,CAACC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;IACrEJ,eAAe,GAAG,MAAMV,oBAAoB,CACzCe,SAAS,CAACN,OAAO,EAAEE,cAAc,CAAC,CAClCK,KAAK,CAAEC,CAAC,IAAK;MACZ,MAAM,IAAI1B,kBAAkB,CAAC0B,CAAC,CAACC,OAAO,CAAC;IACzC,CAAC,CAAC;EACN,CAAC,MAAM;IACL;IACAzB,OAAO,CAAC0B,gBAAgB,CAAC,KAAK,EAAEC,IAAA,IAAa;MAAA,IAAZ;QAAEC;MAAI,CAAC,GAAAD,IAAA;MACtC,IAAIC,GAAG,CAACC,QAAQ,CAACvB,WAAW,CAAC,EAAE;QAC7BW,eAAe,GAAGW,GAAG;MACvB;IACF,CAAC,CAAC;IAEF,MAAME,oBAAoB,GAAG9B,OAAO,CAAC+B,OAAO,CAACf,OAAO,CAAC;;IAErD;AACN;AACA;AACA;IACM,MAAMgB,8BAA8B,GAAGpC,KAAK,CAC1C,MAAMqB,eAAe,KAAKgB,SAAS,EACnC,GACF,CAAC;IAED,MAAMC,OAAO,CAACC,GAAG,CAAC,CAACL,oBAAoB,EAAEE,8BAA8B,CAAC,CAAC;IAEzE,IAAIf,eAAe,KAAKgB,SAAS,EAAE;MACjC,MAAM,IAAInC,kBAAkB,CAAC,qCAAqC,CAAC;IACrE;EACF;EAEA,MAAMsC,QAAQ,GAAGvC,QAAQ,CAACoB,eAAe,CAAC;EAC1C,MAAMoB,OAAO,GAAG1C,wBAAwB,CAAC2C,SAAS,CAACF,QAAQ,CAACG,KAAK,CAAC;EAClE,IAAI,CAACF,OAAO,CAACG,OAAO,EAAE;IACpB,MAAMC,OAAO,GAAG/C,uBAAuB,CAAC4C,SAAS,CAACF,QAAQ,CAACG,KAAK,CAAC;IACjE,IAAI,CAACE,OAAO,CAACD,OAAO,EAAE;MACpB,MAAM,IAAI1C,kBAAkB,CAACuC,OAAO,CAACK,KAAK,CAACjB,OAAO,CAAC,CAAC,CAAC;IACvD;;IACA,MAAM,IAAI1B,qBAAqB,CAC7B0C,OAAO,CAACE,IAAI,CAACD,KAAK,EAClBD,OAAO,CAACE,IAAI,CAACC,iBACf,CAAC;EACH;EACA,OAAOP,OAAO,CAACM,IAAI;AACrB,CAAC;;AAEH;AACA,OAAO,MAAME,4CAA4C,GAAGA,CAAA,KAAM;EAChE,MAAM,IAAIC,KAAK,CAAC,iBAAiB,CAAC;AACpC,CAAC"}