@pagopa/io-react-native-wallet 0.15.3 → 0.15.4

package/lib/commonjs/credential/issuance/05-authorize-access.js

@@ -13,6 +13,7 @@ var WalletInstanceAttestation = _interopRequireWildcard(require("../../wallet-in
 var _const = require("./const");
 var _types = require("./types");
 var _errors = require("../../utils/errors");
+var _ioReactNativeCrypto = require("@pagopa/io-react-native-crypto");
 function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
 function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
@@ -43,14 +44,17 @@ const authorizeAccess = async (issuerConf, code, clientId, redirectUri, codeVeri
   const aud = `${parUrl.protocol}//${parUrl.hostname}`;
   const iss = WalletInstanceAttestation.decode(walletInstanceAttestation).payload.cnf.jwk.kid;
   const tokenUrl = issuerConf.oauth_authorization_server.token_endpoint;
-  // Use an ephemeral key to be destroyed after use
-  const tokenRequestSignedDPop = await (0, _crypto.withEphemeralKey)(async ephimeralContext => {
-    return await (0, _dpop.createDPopToken)({
-      htm: "POST",
-      htu: tokenUrl,
-      jti: `${_reactNativeUuid.default.v4()}`
-    }, ephimeralContext);
-  });
+  try {
+    await (0, _ioReactNativeCrypto.generate)(_const.DPOP_KET_TAG);
+  } catch {
+    console.log("DPoP key already exist");
+  }
+  const dPoPContext = (0, _crypto.createCryptoContextFor)(_const.DPOP_KET_TAG);
+  const tokenRequestSignedDPop = await (0, _dpop.createDPopToken)({
+    htm: "POST",
+    htu: tokenUrl,
+    jti: `${_reactNativeUuid.default.v4()}`
+  }, dPoPContext);
   const signedWiaPoP = await (0, _pop.createPopToken)({
     jti: `${_reactNativeUuid.default.v4()}`,
     aud,
@@ -79,7 +83,7 @@ const authorizeAccess = async (issuerConf, code, clientId, redirectUri, codeVeri
   }
   return {
     accessToken: tokenRes.data,
-    tokenRequestSignedDPop
+    dPoPContext
   };
 };
 exports.authorizeAccess = authorizeAccess;

package/lib/commonjs/credential/issuance/05-authorize-access.js.map

@@ -1 +1 @@
-{"version":3,"names":["_misc","require","_crypto","_dpop","_reactNativeUuid","_interopRequireDefault","_pop","WalletInstanceAttestation","_interopRequireWildcard","_const","_types","_errors","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","authorizeAccess","issuerConf","code","clientId","redirectUri","codeVerifier","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","parEndpoint","oauth_authorization_server","pushed_authorization_request_endpoint","parUrl","URL","aud","protocol","hostname","iss","decode","payload","cnf","jwk","kid","tokenUrl","token_endpoint","tokenRequestSignedDPop","withEphemeralKey","ephimeralContext","createDPopToken","htm","htu","jti","uuid","v4","signedWiaPoP","createPopToken","requestBody","grant_type","client_id","redirect_uri","code_verifier","client_assertion_type","ASSERTION_TYPE","client_assertion","authorizationRequestFormBody","URLSearchParams","tokenRes","method","headers","DPoP","body","toString","then","hasStatus","res","json","TokenResponse","safeParse","success","ValidationFailed","error","message","accessToken","data","exports"],"sourceRoot":"../../../../src","sources":["credential/issuance/05-authorize-access.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAGA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,gBAAA,GAAAC,sBAAA,CAAAJ,OAAA;AACA,IAAAK,IAAA,GAAAL,OAAA;AACA,IAAAM,yBAAA,GAAAC,uBAAA,CAAAP,OAAA;AAEA,IAAAQ,MAAA,GAAAR,OAAA;AACA,IAAAS,MAAA,GAAAT,OAAA;AACA,IAAAU,OAAA,GAAAV,OAAA;AAAsD,SAAAW,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAL,wBAAAS,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAAA,SAAAlB,uBAAAY,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAgBtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMiB,eAAgC,GAAG,MAAAA,CAC9CC,UAAU,EACVC,IAAI,EACJC,QAAQ,EACRC,WAAW,EACXC,YAAY,EACZC,OAAO,KACJ;EACH,MAAM;IACJC,QAAQ,GAAGC,KAAK;IAChBC,yBAAyB;IACzBC;EACF,CAAC,GAAGJ,OAAO;EAEX,MAAMK,WAAW,GACfV,UAAU,CAACW,0BAA0B,CAACC,qCAAqC;EAC7E,MAAMC,MAAM,GAAG,IAAIC,GAAG,CAACJ,WAAW,CAAC;EACnC,MAAMK,GAAG,GAAI,GAAEF,MAAM,CAACG,QAAS,KAAIH,MAAM,CAACI,QAAS,EAAC;EACpD,MAAMC,GAAG,GAAG9C,yBAAyB,CAAC+C,MAAM,CAACX,yBAAyB,CAAC,CACpEY,OAAO,CAACC,GAAG,CAACC,GAAG,CAACC,GAAG;EAEtB,MAAMC,QAAQ,GAAGxB,UAAU,CAACW,0BAA0B,CAACc,cAAc;EACrE;EACA,MAAMC,sBAAsB,GAAG,MAAM,IAAAC,wBAAgB,EACnD,MAAOC,gBAAgB,IAAK;IAC1B,OAAO,MAAM,IAAAC,qBAAe,EAC1B;MACEC,GAAG,EAAE,MAAM;MACXC,GAAG,EAAEP,QAAQ;MACbQ,GAAG,EAAG,GAAEC,wBAAI,CAACC,EAAE,CAAC,CAAE;IACpB,CAAC,EACDN,gBACF,CAAC;EACH,CACF,CAAC;EAED,MAAMO,YAAY,GAAG,MAAM,IAAAC,mBAAc,EACvC;IACEJ,GAAG,EAAG,GAAEC,wBAAI,CAACC,EAAE,CAAC,CAAE,EAAC;IACnBnB,GAAG;IACHG;EACF,CAAC,EACDT,gBACF,CAAC;EAED,MAAM4B,WAAW,GAAG;IAClBC,UAAU,EAAE,oBAAoB;IAChCC,SAAS,EAAErC,QAAQ;IACnBD,IAAI;IACJuC,YAAY,EAAErC,WAAW;IACzBsC,aAAa,EAAErC,YAAY;IAC3BsC,qBAAqB,EAAEC,qBAAc;IACrCC,gBAAgB,EAAEpC,yBAAyB,GAAG,GAAG,GAAG2B;EACtD,CAAC;EAED,MAAMU,4BAA4B,GAAG,IAAIC,eAAe,CAACT,WAAW,CAAC;EACrE,MAAMU,QAAQ,GAAG,MAAMzC,QAAQ,CAACkB,QAAQ,EAAE;IACxCwB,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,mCAAmC;MACnDC,IAAI,EAAExB;IACR,CAAC;IACDyB,IAAI,EAAEN,4BAA4B,CAACO,QAAQ,CAAC;EAC9C,CAAC,CAAC,CACCC,IAAI,CAAC,IAAAC,eAAS,EAAC,GAAG,CAAC,CAAC,CACpBD,IAAI,CAAEE,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBH,IAAI,CAAEF,IAAI,IAAKM,oBAAa,CAACC,SAAS,CAACP,IAAI,CAAC,CAAC;EAEhD,IAAI,CAACJ,QAAQ,CAACY,OAAO,EAAE;IACrB,MAAM,IAAIC,wBAAgB,CAACb,QAAQ,CAACc,KAAK,CAACC,OAAO,CAAC;EACpD;EAEA,OAAO;IAAEC,WAAW,EAAEhB,QAAQ,CAACiB,IAAI;IAAEtC;EAAuB,CAAC;AAC/D,CAAC;AAACuC,OAAA,CAAAlE,eAAA,GAAAA,eAAA"}
+{"version":3,"names":["_misc","require","_crypto","_dpop","_reactNativeUuid","_interopRequireDefault","_pop","WalletInstanceAttestation","_interopRequireWildcard","_const","_types","_errors","_ioReactNativeCrypto","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","authorizeAccess","issuerConf","code","clientId","redirectUri","codeVerifier","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","parEndpoint","oauth_authorization_server","pushed_authorization_request_endpoint","parUrl","URL","aud","protocol","hostname","iss","decode","payload","cnf","jwk","kid","tokenUrl","token_endpoint","generate","DPOP_KET_TAG","console","log","dPoPContext","createCryptoContextFor","tokenRequestSignedDPop","createDPopToken","htm","htu","jti","uuid","v4","signedWiaPoP","createPopToken","requestBody","grant_type","client_id","redirect_uri","code_verifier","client_assertion_type","ASSERTION_TYPE","client_assertion","authorizationRequestFormBody","URLSearchParams","tokenRes","method","headers","DPoP","body","toString","then","hasStatus","res","json","TokenResponse","safeParse","success","ValidationFailed","error","message","accessToken","data","exports"],"sourceRoot":"../../../../src","sources":["credential/issuance/05-authorize-access.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAGA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,gBAAA,GAAAC,sBAAA,CAAAJ,OAAA;AACA,IAAAK,IAAA,GAAAL,OAAA;AACA,IAAAM,yBAAA,GAAAC,uBAAA,CAAAP,OAAA;AAEA,IAAAQ,MAAA,GAAAR,OAAA;AACA,IAAAS,MAAA,GAAAT,OAAA;AACA,IAAAU,OAAA,GAAAV,OAAA;AAEA,IAAAW,oBAAA,GAAAX,OAAA;AAA0D,SAAAY,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAN,wBAAAU,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAAA,SAAAnB,uBAAAa,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAe1D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMiB,eAAgC,GAAG,MAAAA,CAC9CC,UAAU,EACVC,IAAI,EACJC,QAAQ,EACRC,WAAW,EACXC,YAAY,EACZC,OAAO,KACJ;EACH,MAAM;IACJC,QAAQ,GAAGC,KAAK;IAChBC,yBAAyB;IACzBC;EACF,CAAC,GAAGJ,OAAO;EAEX,MAAMK,WAAW,GACfV,UAAU,CAACW,0BAA0B,CAACC,qCAAqC;EAC7E,MAAMC,MAAM,GAAG,IAAIC,GAAG,CAACJ,WAAW,CAAC;EACnC,MAAMK,GAAG,GAAI,GAAEF,MAAM,CAACG,QAAS,KAAIH,MAAM,CAACI,QAAS,EAAC;EACpD,MAAMC,GAAG,GAAG/C,yBAAyB,CAACgD,MAAM,CAACX,yBAAyB,CAAC,CACpEY,OAAO,CAACC,GAAG,CAACC,GAAG,CAACC,GAAG;EAEtB,MAAMC,QAAQ,GAAGxB,UAAU,CAACW,0BAA0B,CAACc,cAAc;EAErE,IAAI;IACF,MAAM,IAAAC,6BAAQ,EAACC,mBAAY,CAAC;EAC9B,CAAC,CAAC,MAAM;IACNC,OAAO,CAACC,GAAG,CAAC,wBAAwB,CAAC;EACvC;EAEA,MAAMC,WAAW,GAAG,IAAAC,8BAAsB,EAACJ,mBAAY,CAAC;EAExD,MAAMK,sBAAsB,GAAG,MAAM,IAAAC,qBAAe,EAClD;IACEC,GAAG,EAAE,MAAM;IACXC,GAAG,EAAEX,QAAQ;IACbY,GAAG,EAAG,GAAEC,wBAAI,CAACC,EAAE,CAAC,CAAE;EACpB,CAAC,EACDR,WACF,CAAC;EAED,MAAMS,YAAY,GAAG,MAAM,IAAAC,mBAAc,EACvC;IACEJ,GAAG,EAAG,GAAEC,wBAAI,CAACC,EAAE,CAAC,CAAE,EAAC;IACnBvB,GAAG;IACHG;EACF,CAAC,EACDT,gBACF,CAAC;EAED,MAAMgC,WAAW,GAAG;IAClBC,UAAU,EAAE,oBAAoB;IAChCC,SAAS,EAAEzC,QAAQ;IACnBD,IAAI;IACJ2C,YAAY,EAAEzC,WAAW;IACzB0C,aAAa,EAAEzC,YAAY;IAC3B0C,qBAAqB,EAAEC,qBAAc;IACrCC,gBAAgB,EAAExC,yBAAyB,GAAG,GAAG,GAAG+B;EACtD,CAAC;EAED,MAAMU,4BAA4B,GAAG,IAAIC,eAAe,CAACT,WAAW,CAAC;EACrE,MAAMU,QAAQ,GAAG,MAAM7C,QAAQ,CAACkB,QAAQ,EAAE;IACxC4B,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,mCAAmC;MACnDC,IAAI,EAAEtB;IACR,CAAC;IACDuB,IAAI,EAAEN,4BAA4B,CAACO,QAAQ,CAAC;EAC9C,CAAC,CAAC,CACCC,IAAI,CAAC,IAAAC,eAAS,EAAC,GAAG,CAAC,CAAC,CACpBD,IAAI,CAAEE,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBH,IAAI,CAAEF,IAAI,IAAKM,oBAAa,CAACC,SAAS,CAACP,IAAI,CAAC,CAAC;EAEhD,IAAI,CAACJ,QAAQ,CAACY,OAAO,EAAE;IACrB,MAAM,IAAIC,wBAAgB,CAACb,QAAQ,CAACc,KAAK,CAACC,OAAO,CAAC;EACpD;EAEA,OAAO;IAAEC,WAAW,EAAEhB,QAAQ,CAACiB,IAAI;IAAEtC;EAAY,CAAC;AACpD,CAAC;AAACuC,OAAA,CAAAtE,eAAA,GAAAA,eAAA"}

package/lib/commonjs/credential/issuance/06-obtain-credential.js

@@ -8,6 +8,11 @@ var _ioReactNativeJwt = require("@pagopa/io-react-native-jwt");
 var _misc = require("../../utils/misc");
 var _errors = require("../../utils/errors");
 var _types = require("./types");
+var _dpop = require("../../utils/dpop");
+var _reactNativeUuid = _interopRequireDefault(require("react-native-uuid"));
+var _ioReactNativeCrypto = require("@pagopa/io-react-native-crypto");
+var _const = require("./const");
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 const createNonceProof = async (nonce, issuer, audience, ctx) => {
   const jwk = await ctx.getPublicKey();
   return new _ioReactNativeJwt.SignJWT(ctx).setPayload({
@@ -34,7 +39,7 @@ const createNonceProof = async (nonce, issuer, audience, ctx) => {
  * @returns The credential response containing the credential
  */
 exports.createNonceProof = createNonceProof;
-const obtainCredential = async (issuerConf, accessToken, clientId, credentialDefinition, tokenRequestSignedDPop, context) => {
+const obtainCredential = async (issuerConf, accessToken, clientId, credentialDefinition, dPoPContext, context) => {
   const {
     credentialCryptoContext,
     appFetch = fetch
@@ -65,6 +70,13 @@ const obtainCredential = async (issuerConf, accessToken, clientId, credentialDef
       proof_type: "jwt"
     }
   };
+  const tokenRequestSignedDPop = await await (0, _dpop.createDPopToken)({
+    htm: "POST",
+    htu: credentialUrl,
+    jti: `${_reactNativeUuid.default.v4()}`,
+    ath: await (0, _ioReactNativeJwt.sha256ToBase64)(accessToken.access_token)
+  }, dPoPContext);
+  await (0, _ioReactNativeCrypto.deleteKey)(_const.DPOP_KET_TAG);
   const credentialRes = await appFetch(credentialUrl, {
     method: "POST",
     headers: {

package/lib/commonjs/credential/issuance/06-obtain-credential.js.map

@@ -1 +1 @@
-{"version":3,"names":["_ioReactNativeJwt","require","_misc","_errors","_types","createNonceProof","nonce","issuer","audience","ctx","jwk","getPublicKey","SignJWT","setPayload","setProtectedHeader","typ","setAudience","setIssuer","setIssuedAt","setExpirationTime","sign","exports","obtainCredential","issuerConf","accessToken","clientId","credentialDefinition","tokenRequestSignedDPop","context","credentialCryptoContext","appFetch","fetch","credentialUrl","openid_credential_issuer","credential_endpoint","signedNonceProof","c_nonce","constainsCredentialDefinition","authorization_details","some","c","credential_configuration_id","format","type","ValidationFailed","credentialRequestFormBody","credential_definition","proof","jwt","proof_type","credentialRes","method","headers","DPoP","Authorization","token_type","access_token","body","JSON","stringify","then","hasStatus","res","json","CredentialResponse","safeParse","success","error","message","data"],"sourceRoot":"../../../../src","sources":["credential/issuance/06-obtain-credential.ts"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AAcO,MAAMI,gBAAgB,GAAG,MAAAA,CAC9BC,KAAa,EACbC,MAAc,EACdC,QAAgB,EAChBC,GAAkB,KACE;EACpB,MAAMC,GAAG,GAAG,MAAMD,GAAG,CAACE,YAAY,CAAC,CAAC;EACpC,OAAO,IAAIC,yBAAO,CAACH,GAAG,CAAC,CACpBI,UAAU,CAAC;IACVP;EACF,CAAC,CAAC,CACDQ,kBAAkB,CAAC;IAClBC,GAAG,EAAE,sBAAsB;IAC3BL;EACF,CAAC,CAAC,CACDM,WAAW,CAACR,QAAQ,CAAC,CACrBS,SAAS,CAACV,MAAM,CAAC,CACjBW,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,MAAM,CAAC,CACzBC,IAAI,CAAC,CAAC;AACX,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAdAC,OAAA,CAAAhB,gBAAA,GAAAA,gBAAA;AAeO,MAAMiB,gBAAkC,GAAG,MAAAA,CAChDC,UAAU,EACVC,WAAW,EACXC,QAAQ,EACRC,oBAAoB,EACpBC,sBAAsB,EACtBC,OAAO,KACJ;EACH,MAAM;IAAEC,uBAAuB;IAAEC,QAAQ,GAAGC;EAAM,CAAC,GAAGH,OAAO;EAE7D,MAAMI,aAAa,GAAGT,UAAU,CAACU,wBAAwB,CAACC,mBAAmB;;EAE7E;AACF;AACA;AACA;AACA;EACE,MAAMC,gBAAgB,GAAG,MAAM9B,gBAAgB,CAC7CmB,WAAW,CAACY,OAAO,EACnBX,QAAQ,EACRO,aAAa,EACbH,uBACF,CAAC;;EAED;EACA,MAAMQ,6BAA6B,GAAGb,WAAW,CAACc,qBAAqB,CAACC,IAAI,CACzEC,CAAC,IACAA,CAAC,CAACC,2BAA2B,KAC3Bf,oBAAoB,CAACe,2BAA2B,IAClDD,CAAC,CAACE,MAAM,KAAKhB,oBAAoB,CAACgB,MAAM,IACxCF,CAAC,CAACG,IAAI,KAAKjB,oBAAoB,CAACiB,IACpC,CAAC;EAED,IAAI,CAACN,6BAA6B,EAAE;IAClC,MAAM,IAAIO,wBAAgB,CACxB,qEACF,CAAC;EACH;;EAEA;EACA,MAAMC,yBAAyB,GAAG;IAChCC,qBAAqB,EAAE;MACrBH,IAAI,EAAE,CAACjB,oBAAoB,CAACe,2BAA2B;IACzD,CAAC;IACDC,MAAM,EAAEhB,oBAAoB,CAACgB,MAAM;IACnCK,KAAK,EAAE;MACLC,GAAG,EAAEb,gBAAgB;MACrBc,UAAU,EAAE;IACd;EACF,CAAC;EAED,MAAMC,aAAa,GAAG,MAAMpB,QAAQ,CAACE,aAAa,EAAE;IAClDmB,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,kBAAkB;MAClCC,IAAI,EAAE1B,sBAAsB;MAC5B2B,aAAa,EAAG,GAAE9B,WAAW,CAAC+B,UAAW,IAAG/B,WAAW,CAACgC,YAAa;IACvE,CAAC;IACDC,IAAI,EAAEC,IAAI,CAACC,SAAS,CAACd,yBAAyB;EAChD,CAAC,CAAC,CACCe,IAAI,CAAC,IAAAC,eAAS,EAAC,GAAG,CAAC,CAAC,CACpBD,IAAI,CAAEE,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBH,IAAI,CAAEH,IAAI,IAAKO,yBAAkB,CAACC,SAAS,CAACR,IAAI,CAAC,CAAC;EAErD,IAAI,CAACP,aAAa,CAACgB,OAAO,EAAE;IAC1B,MAAM,IAAItB,wBAAgB,CAACM,aAAa,CAACiB,KAAK,CAACC,OAAO,CAAC;EACzD;EAEA,OAAOlB,aAAa,CAACmB,IAAI;AAC3B,CAAC;AAAChD,OAAA,CAAAC,gBAAA,GAAAA,gBAAA"}
+{"version":3,"names":["_ioReactNativeJwt","require","_misc","_errors","_types","_dpop","_reactNativeUuid","_interopRequireDefault","_ioReactNativeCrypto","_const","obj","__esModule","default","createNonceProof","nonce","issuer","audience","ctx","jwk","getPublicKey","SignJWT","setPayload","setProtectedHeader","typ","setAudience","setIssuer","setIssuedAt","setExpirationTime","sign","exports","obtainCredential","issuerConf","accessToken","clientId","credentialDefinition","dPoPContext","context","credentialCryptoContext","appFetch","fetch","credentialUrl","openid_credential_issuer","credential_endpoint","signedNonceProof","c_nonce","constainsCredentialDefinition","authorization_details","some","c","credential_configuration_id","format","type","ValidationFailed","credentialRequestFormBody","credential_definition","proof","jwt","proof_type","tokenRequestSignedDPop","createDPopToken","htm","htu","jti","uuid","v4","ath","sha256ToBase64","access_token","deleteKey","DPOP_KET_TAG","credentialRes","method","headers","DPoP","Authorization","token_type","body","JSON","stringify","then","hasStatus","res","json","CredentialResponse","safeParse","success","error","message","data"],"sourceRoot":"../../../../src","sources":["credential/issuance/06-obtain-credential.ts"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AAOA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AAEA,IAAAI,KAAA,GAAAJ,OAAA;AACA,IAAAK,gBAAA,GAAAC,sBAAA,CAAAN,OAAA;AACA,IAAAO,oBAAA,GAAAP,OAAA;AACA,IAAAQ,MAAA,GAAAR,OAAA;AAAuC,SAAAM,uBAAAG,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAchC,MAAMG,gBAAgB,GAAG,MAAAA,CAC9BC,KAAa,EACbC,MAAc,EACdC,QAAgB,EAChBC,GAAkB,KACE;EACpB,MAAMC,GAAG,GAAG,MAAMD,GAAG,CAACE,YAAY,CAAC,CAAC;EACpC,OAAO,IAAIC,yBAAO,CAACH,GAAG,CAAC,CACpBI,UAAU,CAAC;IACVP;EACF,CAAC,CAAC,CACDQ,kBAAkB,CAAC;IAClBC,GAAG,EAAE,sBAAsB;IAC3BL;EACF,CAAC,CAAC,CACDM,WAAW,CAACR,QAAQ,CAAC,CACrBS,SAAS,CAACV,MAAM,CAAC,CACjBW,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,MAAM,CAAC,CACzBC,IAAI,CAAC,CAAC;AACX,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAdAC,OAAA,CAAAhB,gBAAA,GAAAA,gBAAA;AAeO,MAAMiB,gBAAkC,GAAG,MAAAA,CAChDC,UAAU,EACVC,WAAW,EACXC,QAAQ,EACRC,oBAAoB,EACpBC,WAAW,EACXC,OAAO,KACJ;EACH,MAAM;IAAEC,uBAAuB;IAAEC,QAAQ,GAAGC;EAAM,CAAC,GAAGH,OAAO;EAE7D,MAAMI,aAAa,GAAGT,UAAU,CAACU,wBAAwB,CAACC,mBAAmB;;EAE7E;AACF;AACA;AACA;AACA;EACE,MAAMC,gBAAgB,GAAG,MAAM9B,gBAAgB,CAC7CmB,WAAW,CAACY,OAAO,EACnBX,QAAQ,EACRO,aAAa,EACbH,uBACF,CAAC;;EAED;EACA,MAAMQ,6BAA6B,GAAGb,WAAW,CAACc,qBAAqB,CAACC,IAAI,CACzEC,CAAC,IACAA,CAAC,CAACC,2BAA2B,KAC3Bf,oBAAoB,CAACe,2BAA2B,IAClDD,CAAC,CAACE,MAAM,KAAKhB,oBAAoB,CAACgB,MAAM,IACxCF,CAAC,CAACG,IAAI,KAAKjB,oBAAoB,CAACiB,IACpC,CAAC;EAED,IAAI,CAACN,6BAA6B,EAAE;IAClC,MAAM,IAAIO,wBAAgB,CACxB,qEACF,CAAC;EACH;;EAEA;EACA,MAAMC,yBAAyB,GAAG;IAChCC,qBAAqB,EAAE;MACrBH,IAAI,EAAE,CAACjB,oBAAoB,CAACe,2BAA2B;IACzD,CAAC;IACDC,MAAM,EAAEhB,oBAAoB,CAACgB,MAAM;IACnCK,KAAK,EAAE;MACLC,GAAG,EAAEb,gBAAgB;MACrBc,UAAU,EAAE;IACd;EACF,CAAC;EAED,MAAMC,sBAAsB,GAAG,MAAM,MAAM,IAAAC,qBAAe,EACxD;IACEC,GAAG,EAAE,MAAM;IACXC,GAAG,EAAErB,aAAa;IAClBsB,GAAG,EAAG,GAAEC,wBAAI,CAACC,EAAE,CAAC,CAAE,EAAC;IACnBC,GAAG,EAAE,MAAM,IAAAC,gCAAc,EAAClC,WAAW,CAACmC,YAAY;EACpD,CAAC,EACDhC,WACF,CAAC;EAED,MAAM,IAAAiC,8BAAS,EAACC,mBAAY,CAAC;EAC7B,MAAMC,aAAa,GAAG,MAAMhC,QAAQ,CAACE,aAAa,EAAE;IAClD+B,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,kBAAkB;MAClCC,IAAI,EAAEf,sBAAsB;MAC5BgB,aAAa,EAAG,GAAE1C,WAAW,CAAC2C,UAAW,IAAG3C,WAAW,CAACmC,YAAa;IACvE,CAAC;IACDS,IAAI,EAAEC,IAAI,CAACC,SAAS,CAACzB,yBAAyB;EAChD,CAAC,CAAC,CACC0B,IAAI,CAAC,IAAAC,eAAS,EAAC,GAAG,CAAC,CAAC,CACpBD,IAAI,CAAEE,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBH,IAAI,CAAEH,IAAI,IAAKO,yBAAkB,CAACC,SAAS,CAACR,IAAI,CAAC,CAAC;EAErD,IAAI,CAACN,aAAa,CAACe,OAAO,EAAE;IAC1B,MAAM,IAAIjC,wBAAgB,CAACkB,aAAa,CAACgB,KAAK,CAACC,OAAO,CAAC;EACzD;EAEA,OAAOjB,aAAa,CAACkB,IAAI;AAC3B,CAAC;AAAC3D,OAAA,CAAAC,gBAAA,GAAAA,gBAAA"}

package/lib/commonjs/credential/issuance/const.js

@@ -3,12 +3,14 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.SupportedCredentialFormat = exports.ASSERTION_TYPE = void 0;
+exports.SupportedCredentialFormat = exports.DPOP_KET_TAG = exports.ASSERTION_TYPE = void 0;
 var z = _interopRequireWildcard(require("zod"));
 function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
 function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
 const ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-client-attestation";
 exports.ASSERTION_TYPE = ASSERTION_TYPE;
+const DPOP_KET_TAG = `dpop`;
+exports.DPOP_KET_TAG = DPOP_KET_TAG;
 const SupportedCredentialFormat = z.union([z.literal("vc+sd-jwt"), z.literal("vc+mdoc-cbor")]);
 exports.SupportedCredentialFormat = SupportedCredentialFormat;
 //# sourceMappingURL=const.js.map

package/lib/commonjs/credential/issuance/const.js.map

@@ -1 +1 @@
-{"version":3,"names":["z","_interopRequireWildcard","require","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","ASSERTION_TYPE","exports","SupportedCredentialFormat","union","literal"],"sourceRoot":"../../../../src","sources":["credential/issuance/const.ts"],"mappings":";;;;;;AAAA,IAAAA,CAAA,GAAAC,uBAAA,CAAAC,OAAA;AAAyB,SAAAC,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAH,wBAAAO,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAClB,MAAMW,cAAc,GACzB,oEAAoE;AAACC,OAAA,CAAAD,cAAA,GAAAA,cAAA;AAKhE,MAAME,yBAAyB,GAAG3B,CAAC,CAAC4B,KAAK,CAAC,CAC/C5B,CAAC,CAAC6B,OAAO,CAAC,WAAW,CAAC,EACtB7B,CAAC,CAAC6B,OAAO,CAAC,cAAc,CAAC,CAC1B,CAAC;AAACH,OAAA,CAAAC,yBAAA,GAAAA,yBAAA"}
+{"version":3,"names":["z","_interopRequireWildcard","require","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","ASSERTION_TYPE","exports","DPOP_KET_TAG","SupportedCredentialFormat","union","literal"],"sourceRoot":"../../../../src","sources":["credential/issuance/const.ts"],"mappings":";;;;;;AAAA,IAAAA,CAAA,GAAAC,uBAAA,CAAAC,OAAA;AAAyB,SAAAC,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAH,wBAAAO,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAClB,MAAMW,cAAc,GACzB,oEAAoE;AAACC,OAAA,CAAAD,cAAA,GAAAA,cAAA;AAEhE,MAAME,YAAY,GAAI,MAAK;AAACD,OAAA,CAAAC,YAAA,GAAAA,YAAA;AAK5B,MAAMC,yBAAyB,GAAG5B,CAAC,CAAC6B,KAAK,CAAC,CAC/C7B,CAAC,CAAC8B,OAAO,CAAC,WAAW,CAAC,EACtB9B,CAAC,CAAC8B,OAAO,CAAC,cAAc,CAAC,CAC1B,CAAC;AAACJ,OAAA,CAAAE,yBAAA,GAAAA,yBAAA"}

package/lib/module/credential/issuance/05-authorize-access.js

@@ -1,12 +1,13 @@
 import { hasStatus } from "../../utils/misc";
-import { withEphemeralKey } from "../../utils/crypto";
+import { createCryptoContextFor } from "../../utils/crypto";
 import { createDPopToken } from "../../utils/dpop";
 import uuid from "react-native-uuid";
 import { createPopToken } from "../../utils/pop";
 import * as WalletInstanceAttestation from "../../wallet-instance-attestation";
-import { ASSERTION_TYPE } from "./const";
+import { ASSERTION_TYPE, DPOP_KET_TAG } from "./const";
 import { TokenResponse } from "./types";
 import { ValidationFailed } from "../../utils/errors";
+import { generate } from "@pagopa/io-react-native-crypto";
 /**
  * Creates and sends the DPoP Proof JWT to be presented with the authorization code to the /token endpoint of the authorization server
  * for requesting the issuance of an access token bound to the public key of the Wallet Instance contained within the DPoP.
@@ -34,14 +35,17 @@ export const authorizeAccess = async (issuerConf, code, clientId, redirectUri, c
   const aud = `${parUrl.protocol}//${parUrl.hostname}`;
   const iss = WalletInstanceAttestation.decode(walletInstanceAttestation).payload.cnf.jwk.kid;
   const tokenUrl = issuerConf.oauth_authorization_server.token_endpoint;
-  // Use an ephemeral key to be destroyed after use
-  const tokenRequestSignedDPop = await withEphemeralKey(async ephimeralContext => {
-    return await createDPopToken({
-      htm: "POST",
-      htu: tokenUrl,
-      jti: `${uuid.v4()}`
-    }, ephimeralContext);
-  });
+  try {
+    await generate(DPOP_KET_TAG);
+  } catch {
+    console.log("DPoP key already exist");
+  }
+  const dPoPContext = createCryptoContextFor(DPOP_KET_TAG);
+  const tokenRequestSignedDPop = await createDPopToken({
+    htm: "POST",
+    htu: tokenUrl,
+    jti: `${uuid.v4()}`
+  }, dPoPContext);
   const signedWiaPoP = await createPopToken({
     jti: `${uuid.v4()}`,
     aud,
@@ -70,7 +74,7 @@ export const authorizeAccess = async (issuerConf, code, clientId, redirectUri, c
   }
   return {
     accessToken: tokenRes.data,
-    tokenRequestSignedDPop
+    dPoPContext
   };
 };
 //# sourceMappingURL=05-authorize-access.js.map

package/lib/module/credential/issuance/05-authorize-access.js.map

@@ -1 +1 @@
-{"version":3,"names":["hasStatus","withEphemeralKey","createDPopToken","uuid","createPopToken","WalletInstanceAttestation","ASSERTION_TYPE","TokenResponse","ValidationFailed","authorizeAccess","issuerConf","code","clientId","redirectUri","codeVerifier","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","parEndpoint","oauth_authorization_server","pushed_authorization_request_endpoint","parUrl","URL","aud","protocol","hostname","iss","decode","payload","cnf","jwk","kid","tokenUrl","token_endpoint","tokenRequestSignedDPop","ephimeralContext","htm","htu","jti","v4","signedWiaPoP","requestBody","grant_type","client_id","redirect_uri","code_verifier","client_assertion_type","client_assertion","authorizationRequestFormBody","URLSearchParams","tokenRes","method","headers","DPoP","body","toString","then","res","json","safeParse","success","error","message","accessToken","data"],"sourceRoot":"../../../../src","sources":["credential/issuance/05-authorize-access.ts"],"mappings":"AAAA,SAASA,SAAS,QAAkB,kBAAkB;AAGtD,SAASC,gBAAgB,QAAQ,oBAAoB;AACrD,SAASC,eAAe,QAAQ,kBAAkB;AAClD,OAAOC,IAAI,MAAM,mBAAmB;AACpC,SAASC,cAAc,QAAQ,iBAAiB;AAChD,OAAO,KAAKC,yBAAyB,MAAM,mCAAmC;AAE9E,SAASC,cAAc,QAAQ,SAAS;AACxC,SAASC,aAAa,QAAQ,SAAS;AACvC,SAASC,gBAAgB,QAAQ,oBAAoB;AAgBrD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,eAAgC,GAAG,MAAAA,CAC9CC,UAAU,EACVC,IAAI,EACJC,QAAQ,EACRC,WAAW,EACXC,YAAY,EACZC,OAAO,KACJ;EACH,MAAM;IACJC,QAAQ,GAAGC,KAAK;IAChBC,yBAAyB;IACzBC;EACF,CAAC,GAAGJ,OAAO;EAEX,MAAMK,WAAW,GACfV,UAAU,CAACW,0BAA0B,CAACC,qCAAqC;EAC7E,MAAMC,MAAM,GAAG,IAAIC,GAAG,CAACJ,WAAW,CAAC;EACnC,MAAMK,GAAG,GAAI,GAAEF,MAAM,CAACG,QAAS,KAAIH,MAAM,CAACI,QAAS,EAAC;EACpD,MAAMC,GAAG,GAAGvB,yBAAyB,CAACwB,MAAM,CAACX,yBAAyB,CAAC,CACpEY,OAAO,CAACC,GAAG,CAACC,GAAG,CAACC,GAAG;EAEtB,MAAMC,QAAQ,GAAGxB,UAAU,CAACW,0BAA0B,CAACc,cAAc;EACrE;EACA,MAAMC,sBAAsB,GAAG,MAAMnC,gBAAgB,CACnD,MAAOoC,gBAAgB,IAAK;IAC1B,OAAO,MAAMnC,eAAe,CAC1B;MACEoC,GAAG,EAAE,MAAM;MACXC,GAAG,EAAEL,QAAQ;MACbM,GAAG,EAAG,GAAErC,IAAI,CAACsC,EAAE,CAAC,CAAE;IACpB,CAAC,EACDJ,gBACF,CAAC;EACH,CACF,CAAC;EAED,MAAMK,YAAY,GAAG,MAAMtC,cAAc,CACvC;IACEoC,GAAG,EAAG,GAAErC,IAAI,CAACsC,EAAE,CAAC,CAAE,EAAC;IACnBhB,GAAG;IACHG;EACF,CAAC,EACDT,gBACF,CAAC;EAED,MAAMwB,WAAW,GAAG;IAClBC,UAAU,EAAE,oBAAoB;IAChCC,SAAS,EAAEjC,QAAQ;IACnBD,IAAI;IACJmC,YAAY,EAAEjC,WAAW;IACzBkC,aAAa,EAAEjC,YAAY;IAC3BkC,qBAAqB,EAAE1C,cAAc;IACrC2C,gBAAgB,EAAE/B,yBAAyB,GAAG,GAAG,GAAGwB;EACtD,CAAC;EAED,MAAMQ,4BAA4B,GAAG,IAAIC,eAAe,CAACR,WAAW,CAAC;EACrE,MAAMS,QAAQ,GAAG,MAAMpC,QAAQ,CAACkB,QAAQ,EAAE;IACxCmB,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,mCAAmC;MACnDC,IAAI,EAAEnB;IACR,CAAC;IACDoB,IAAI,EAAEN,4BAA4B,CAACO,QAAQ,CAAC;EAC9C,CAAC,CAAC,CACCC,IAAI,CAAC1D,SAAS,CAAC,GAAG,CAAC,CAAC,CACpB0D,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBF,IAAI,CAAEF,IAAI,IAAKjD,aAAa,CAACsD,SAAS,CAACL,IAAI,CAAC,CAAC;EAEhD,IAAI,CAACJ,QAAQ,CAACU,OAAO,EAAE;IACrB,MAAM,IAAItD,gBAAgB,CAAC4C,QAAQ,CAACW,KAAK,CAACC,OAAO,CAAC;EACpD;EAEA,OAAO;IAAEC,WAAW,EAAEb,QAAQ,CAACc,IAAI;IAAE9B;EAAuB,CAAC;AAC/D,CAAC"}
+{"version":3,"names":["hasStatus","createCryptoContextFor","createDPopToken","uuid","createPopToken","WalletInstanceAttestation","ASSERTION_TYPE","DPOP_KET_TAG","TokenResponse","ValidationFailed","generate","authorizeAccess","issuerConf","code","clientId","redirectUri","codeVerifier","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","parEndpoint","oauth_authorization_server","pushed_authorization_request_endpoint","parUrl","URL","aud","protocol","hostname","iss","decode","payload","cnf","jwk","kid","tokenUrl","token_endpoint","console","log","dPoPContext","tokenRequestSignedDPop","htm","htu","jti","v4","signedWiaPoP","requestBody","grant_type","client_id","redirect_uri","code_verifier","client_assertion_type","client_assertion","authorizationRequestFormBody","URLSearchParams","tokenRes","method","headers","DPoP","body","toString","then","res","json","safeParse","success","error","message","accessToken","data"],"sourceRoot":"../../../../src","sources":["credential/issuance/05-authorize-access.ts"],"mappings":"AAAA,SAASA,SAAS,QAAkB,kBAAkB;AAGtD,SAASC,sBAAsB,QAAQ,oBAAoB;AAC3D,SAASC,eAAe,QAAQ,kBAAkB;AAClD,OAAOC,IAAI,MAAM,mBAAmB;AACpC,SAASC,cAAc,QAAQ,iBAAiB;AAChD,OAAO,KAAKC,yBAAyB,MAAM,mCAAmC;AAE9E,SAASC,cAAc,EAAEC,YAAY,QAAQ,SAAS;AACtD,SAASC,aAAa,QAAQ,SAAS;AACvC,SAASC,gBAAgB,QAAQ,oBAAoB;AAErD,SAASC,QAAQ,QAAQ,gCAAgC;AAezD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,eAAgC,GAAG,MAAAA,CAC9CC,UAAU,EACVC,IAAI,EACJC,QAAQ,EACRC,WAAW,EACXC,YAAY,EACZC,OAAO,KACJ;EACH,MAAM;IACJC,QAAQ,GAAGC,KAAK;IAChBC,yBAAyB;IACzBC;EACF,CAAC,GAAGJ,OAAO;EAEX,MAAMK,WAAW,GACfV,UAAU,CAACW,0BAA0B,CAACC,qCAAqC;EAC7E,MAAMC,MAAM,GAAG,IAAIC,GAAG,CAACJ,WAAW,CAAC;EACnC,MAAMK,GAAG,GAAI,GAAEF,MAAM,CAACG,QAAS,KAAIH,MAAM,CAACI,QAAS,EAAC;EACpD,MAAMC,GAAG,GAAGzB,yBAAyB,CAAC0B,MAAM,CAACX,yBAAyB,CAAC,CACpEY,OAAO,CAACC,GAAG,CAACC,GAAG,CAACC,GAAG;EAEtB,MAAMC,QAAQ,GAAGxB,UAAU,CAACW,0BAA0B,CAACc,cAAc;EAErE,IAAI;IACF,MAAM3B,QAAQ,CAACH,YAAY,CAAC;EAC9B,CAAC,CAAC,MAAM;IACN+B,OAAO,CAACC,GAAG,CAAC,wBAAwB,CAAC;EACvC;EAEA,MAAMC,WAAW,GAAGvC,sBAAsB,CAACM,YAAY,CAAC;EAExD,MAAMkC,sBAAsB,GAAG,MAAMvC,eAAe,CAClD;IACEwC,GAAG,EAAE,MAAM;IACXC,GAAG,EAAEP,QAAQ;IACbQ,GAAG,EAAG,GAAEzC,IAAI,CAAC0C,EAAE,CAAC,CAAE;EACpB,CAAC,EACDL,WACF,CAAC;EAED,MAAMM,YAAY,GAAG,MAAM1C,cAAc,CACvC;IACEwC,GAAG,EAAG,GAAEzC,IAAI,CAAC0C,EAAE,CAAC,CAAE,EAAC;IACnBlB,GAAG;IACHG;EACF,CAAC,EACDT,gBACF,CAAC;EAED,MAAM0B,WAAW,GAAG;IAClBC,UAAU,EAAE,oBAAoB;IAChCC,SAAS,EAAEnC,QAAQ;IACnBD,IAAI;IACJqC,YAAY,EAAEnC,WAAW;IACzBoC,aAAa,EAAEnC,YAAY;IAC3BoC,qBAAqB,EAAE9C,cAAc;IACrC+C,gBAAgB,EAAEjC,yBAAyB,GAAG,GAAG,GAAG0B;EACtD,CAAC;EAED,MAAMQ,4BAA4B,GAAG,IAAIC,eAAe,CAACR,WAAW,CAAC;EACrE,MAAMS,QAAQ,GAAG,MAAMtC,QAAQ,CAACkB,QAAQ,EAAE;IACxCqB,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,mCAAmC;MACnDC,IAAI,EAAElB;IACR,CAAC;IACDmB,IAAI,EAAEN,4BAA4B,CAACO,QAAQ,CAAC;EAC9C,CAAC,CAAC,CACCC,IAAI,CAAC9D,SAAS,CAAC,GAAG,CAAC,CAAC,CACpB8D,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBF,IAAI,CAAEF,IAAI,IAAKpD,aAAa,CAACyD,SAAS,CAACL,IAAI,CAAC,CAAC;EAEhD,IAAI,CAACJ,QAAQ,CAACU,OAAO,EAAE;IACrB,MAAM,IAAIzD,gBAAgB,CAAC+C,QAAQ,CAACW,KAAK,CAACC,OAAO,CAAC;EACpD;EAEA,OAAO;IAAEC,WAAW,EAAEb,QAAQ,CAACc,IAAI;IAAE9B;EAAY,CAAC;AACpD,CAAC"}

package/lib/module/credential/issuance/06-obtain-credential.js

@@ -1,7 +1,11 @@
-import { SignJWT } from "@pagopa/io-react-native-jwt";
+import { sha256ToBase64, SignJWT } from "@pagopa/io-react-native-jwt";
 import { hasStatus } from "../../utils/misc";
 import { ValidationFailed } from "../../utils/errors";
 import { CredentialResponse } from "./types";
+import { createDPopToken } from "../../utils/dpop";
+import uuid from "react-native-uuid";
+import { deleteKey } from "@pagopa/io-react-native-crypto";
+import { DPOP_KET_TAG } from "./const";
 export const createNonceProof = async (nonce, issuer, audience, ctx) => {
   const jwk = await ctx.getPublicKey();
   return new SignJWT(ctx).setPayload({
@@ -27,7 +31,7 @@ export const createNonceProof = async (nonce, issuer, audience, ctx) => {
  * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
  * @returns The credential response containing the credential
  */
-export const obtainCredential = async (issuerConf, accessToken, clientId, credentialDefinition, tokenRequestSignedDPop, context) => {
+export const obtainCredential = async (issuerConf, accessToken, clientId, credentialDefinition, dPoPContext, context) => {
   const {
     credentialCryptoContext,
     appFetch = fetch
@@ -58,6 +62,13 @@ export const obtainCredential = async (issuerConf, accessToken, clientId, creden
       proof_type: "jwt"
     }
   };
+  const tokenRequestSignedDPop = await await createDPopToken({
+    htm: "POST",
+    htu: credentialUrl,
+    jti: `${uuid.v4()}`,
+    ath: await sha256ToBase64(accessToken.access_token)
+  }, dPoPContext);
+  await deleteKey(DPOP_KET_TAG);
   const credentialRes = await appFetch(credentialUrl, {
     method: "POST",
     headers: {

package/lib/module/credential/issuance/06-obtain-credential.js.map

@@ -1 +1 @@
-{"version":3,"names":["SignJWT","hasStatus","ValidationFailed","CredentialResponse","createNonceProof","nonce","issuer","audience","ctx","jwk","getPublicKey","setPayload","setProtectedHeader","typ","setAudience","setIssuer","setIssuedAt","setExpirationTime","sign","obtainCredential","issuerConf","accessToken","clientId","credentialDefinition","tokenRequestSignedDPop","context","credentialCryptoContext","appFetch","fetch","credentialUrl","openid_credential_issuer","credential_endpoint","signedNonceProof","c_nonce","constainsCredentialDefinition","authorization_details","some","c","credential_configuration_id","format","type","credentialRequestFormBody","credential_definition","proof","jwt","proof_type","credentialRes","method","headers","DPoP","Authorization","token_type","access_token","body","JSON","stringify","then","res","json","safeParse","success","error","message","data"],"sourceRoot":"../../../../src","sources":["credential/issuance/06-obtain-credential.ts"],"mappings":"AAAA,SAASA,OAAO,QAA4B,6BAA6B;AAGzE,SAASC,SAAS,QAAkB,kBAAkB;AAEtD,SAASC,gBAAgB,QAAQ,oBAAoB;AACrD,SAASC,kBAAkB,QAAQ,SAAS;AAc5C,OAAO,MAAMC,gBAAgB,GAAG,MAAAA,CAC9BC,KAAa,EACbC,MAAc,EACdC,QAAgB,EAChBC,GAAkB,KACE;EACpB,MAAMC,GAAG,GAAG,MAAMD,GAAG,CAACE,YAAY,CAAC,CAAC;EACpC,OAAO,IAAIV,OAAO,CAACQ,GAAG,CAAC,CACpBG,UAAU,CAAC;IACVN;EACF,CAAC,CAAC,CACDO,kBAAkB,CAAC;IAClBC,GAAG,EAAE,sBAAsB;IAC3BJ;EACF,CAAC,CAAC,CACDK,WAAW,CAACP,QAAQ,CAAC,CACrBQ,SAAS,CAACT,MAAM,CAAC,CACjBU,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,MAAM,CAAC,CACzBC,IAAI,CAAC,CAAC;AACX,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,gBAAkC,GAAG,MAAAA,CAChDC,UAAU,EACVC,WAAW,EACXC,QAAQ,EACRC,oBAAoB,EACpBC,sBAAsB,EACtBC,OAAO,KACJ;EACH,MAAM;IAAEC,uBAAuB;IAAEC,QAAQ,GAAGC;EAAM,CAAC,GAAGH,OAAO;EAE7D,MAAMI,aAAa,GAAGT,UAAU,CAACU,wBAAwB,CAACC,mBAAmB;;EAE7E;AACF;AACA;AACA;AACA;EACE,MAAMC,gBAAgB,GAAG,MAAM5B,gBAAgB,CAC7CiB,WAAW,CAACY,OAAO,EACnBX,QAAQ,EACRO,aAAa,EACbH,uBACF,CAAC;;EAED;EACA,MAAMQ,6BAA6B,GAAGb,WAAW,CAACc,qBAAqB,CAACC,IAAI,CACzEC,CAAC,IACAA,CAAC,CAACC,2BAA2B,KAC3Bf,oBAAoB,CAACe,2BAA2B,IAClDD,CAAC,CAACE,MAAM,KAAKhB,oBAAoB,CAACgB,MAAM,IACxCF,CAAC,CAACG,IAAI,KAAKjB,oBAAoB,CAACiB,IACpC,CAAC;EAED,IAAI,CAACN,6BAA6B,EAAE;IAClC,MAAM,IAAIhC,gBAAgB,CACxB,qEACF,CAAC;EACH;;EAEA;EACA,MAAMuC,yBAAyB,GAAG;IAChCC,qBAAqB,EAAE;MACrBF,IAAI,EAAE,CAACjB,oBAAoB,CAACe,2BAA2B;IACzD,CAAC;IACDC,MAAM,EAAEhB,oBAAoB,CAACgB,MAAM;IACnCI,KAAK,EAAE;MACLC,GAAG,EAAEZ,gBAAgB;MACrBa,UAAU,EAAE;IACd;EACF,CAAC;EAED,MAAMC,aAAa,GAAG,MAAMnB,QAAQ,CAACE,aAAa,EAAE;IAClDkB,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,kBAAkB;MAClCC,IAAI,EAAEzB,sBAAsB;MAC5B0B,aAAa,EAAG,GAAE7B,WAAW,CAAC8B,UAAW,IAAG9B,WAAW,CAAC+B,YAAa;IACvE,CAAC;IACDC,IAAI,EAAEC,IAAI,CAACC,SAAS,CAACd,yBAAyB;EAChD,CAAC,CAAC,CACCe,IAAI,CAACvD,SAAS,CAAC,GAAG,CAAC,CAAC,CACpBuD,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBF,IAAI,CAAEH,IAAI,IAAKlD,kBAAkB,CAACwD,SAAS,CAACN,IAAI,CAAC,CAAC;EAErD,IAAI,CAACP,aAAa,CAACc,OAAO,EAAE;IAC1B,MAAM,IAAI1D,gBAAgB,CAAC4C,aAAa,CAACe,KAAK,CAACC,OAAO,CAAC;EACzD;EAEA,OAAOhB,aAAa,CAACiB,IAAI;AAC3B,CAAC"}
+{"version":3,"names":["sha256ToBase64","SignJWT","hasStatus","ValidationFailed","CredentialResponse","createDPopToken","uuid","deleteKey","DPOP_KET_TAG","createNonceProof","nonce","issuer","audience","ctx","jwk","getPublicKey","setPayload","setProtectedHeader","typ","setAudience","setIssuer","setIssuedAt","setExpirationTime","sign","obtainCredential","issuerConf","accessToken","clientId","credentialDefinition","dPoPContext","context","credentialCryptoContext","appFetch","fetch","credentialUrl","openid_credential_issuer","credential_endpoint","signedNonceProof","c_nonce","constainsCredentialDefinition","authorization_details","some","c","credential_configuration_id","format","type","credentialRequestFormBody","credential_definition","proof","jwt","proof_type","tokenRequestSignedDPop","htm","htu","jti","v4","ath","access_token","credentialRes","method","headers","DPoP","Authorization","token_type","body","JSON","stringify","then","res","json","safeParse","success","error","message","data"],"sourceRoot":"../../../../src","sources":["credential/issuance/06-obtain-credential.ts"],"mappings":"AAAA,SACEA,cAAc,EACdC,OAAO,QAEF,6BAA6B;AAGpC,SAASC,SAAS,QAAkB,kBAAkB;AAEtD,SAASC,gBAAgB,QAAQ,oBAAoB;AACrD,SAASC,kBAAkB,QAAQ,SAAS;AAE5C,SAASC,eAAe,QAAQ,kBAAkB;AAClD,OAAOC,IAAI,MAAM,mBAAmB;AACpC,SAASC,SAAS,QAAQ,gCAAgC;AAC1D,SAASC,YAAY,QAAQ,SAAS;AActC,OAAO,MAAMC,gBAAgB,GAAG,MAAAA,CAC9BC,KAAa,EACbC,MAAc,EACdC,QAAgB,EAChBC,GAAkB,KACE;EACpB,MAAMC,GAAG,GAAG,MAAMD,GAAG,CAACE,YAAY,CAAC,CAAC;EACpC,OAAO,IAAId,OAAO,CAACY,GAAG,CAAC,CACpBG,UAAU,CAAC;IACVN;EACF,CAAC,CAAC,CACDO,kBAAkB,CAAC;IAClBC,GAAG,EAAE,sBAAsB;IAC3BJ;EACF,CAAC,CAAC,CACDK,WAAW,CAACP,QAAQ,CAAC,CACrBQ,SAAS,CAACT,MAAM,CAAC,CACjBU,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,MAAM,CAAC,CACzBC,IAAI,CAAC,CAAC;AACX,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,gBAAkC,GAAG,MAAAA,CAChDC,UAAU,EACVC,WAAW,EACXC,QAAQ,EACRC,oBAAoB,EACpBC,WAAW,EACXC,OAAO,KACJ;EACH,MAAM;IAAEC,uBAAuB;IAAEC,QAAQ,GAAGC;EAAM,CAAC,GAAGH,OAAO;EAE7D,MAAMI,aAAa,GAAGT,UAAU,CAACU,wBAAwB,CAACC,mBAAmB;;EAE7E;AACF;AACA;AACA;AACA;EACE,MAAMC,gBAAgB,GAAG,MAAM5B,gBAAgB,CAC7CiB,WAAW,CAACY,OAAO,EACnBX,QAAQ,EACRO,aAAa,EACbH,uBACF,CAAC;;EAED;EACA,MAAMQ,6BAA6B,GAAGb,WAAW,CAACc,qBAAqB,CAACC,IAAI,CACzEC,CAAC,IACAA,CAAC,CAACC,2BAA2B,KAC3Bf,oBAAoB,CAACe,2BAA2B,IAClDD,CAAC,CAACE,MAAM,KAAKhB,oBAAoB,CAACgB,MAAM,IACxCF,CAAC,CAACG,IAAI,KAAKjB,oBAAoB,CAACiB,IACpC,CAAC;EAED,IAAI,CAACN,6BAA6B,EAAE;IAClC,MAAM,IAAIpC,gBAAgB,CACxB,qEACF,CAAC;EACH;;EAEA;EACA,MAAM2C,yBAAyB,GAAG;IAChCC,qBAAqB,EAAE;MACrBF,IAAI,EAAE,CAACjB,oBAAoB,CAACe,2BAA2B;IACzD,CAAC;IACDC,MAAM,EAAEhB,oBAAoB,CAACgB,MAAM;IACnCI,KAAK,EAAE;MACLC,GAAG,EAAEZ,gBAAgB;MACrBa,UAAU,EAAE;IACd;EACF,CAAC;EAED,MAAMC,sBAAsB,GAAG,MAAM,MAAM9C,eAAe,CACxD;IACE+C,GAAG,EAAE,MAAM;IACXC,GAAG,EAAEnB,aAAa;IAClBoB,GAAG,EAAG,GAAEhD,IAAI,CAACiD,EAAE,CAAC,CAAE,EAAC;IACnBC,GAAG,EAAE,MAAMxD,cAAc,CAAC0B,WAAW,CAAC+B,YAAY;EACpD,CAAC,EACD5B,WACF,CAAC;EAED,MAAMtB,SAAS,CAACC,YAAY,CAAC;EAC7B,MAAMkD,aAAa,GAAG,MAAM1B,QAAQ,CAACE,aAAa,EAAE;IAClDyB,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,kBAAkB;MAClCC,IAAI,EAAEV,sBAAsB;MAC5BW,aAAa,EAAG,GAAEpC,WAAW,CAACqC,UAAW,IAAGrC,WAAW,CAAC+B,YAAa;IACvE,CAAC;IACDO,IAAI,EAAEC,IAAI,CAACC,SAAS,CAACpB,yBAAyB;EAChD,CAAC,CAAC,CACCqB,IAAI,CAACjE,SAAS,CAAC,GAAG,CAAC,CAAC,CACpBiE,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBF,IAAI,CAAEH,IAAI,IAAK5D,kBAAkB,CAACkE,SAAS,CAACN,IAAI,CAAC,CAAC;EAErD,IAAI,CAACN,aAAa,CAACa,OAAO,EAAE;IAC1B,MAAM,IAAIpE,gBAAgB,CAACuD,aAAa,CAACc,KAAK,CAACC,OAAO,CAAC;EACzD;EAEA,OAAOf,aAAa,CAACgB,IAAI;AAC3B,CAAC"}

package/lib/module/credential/issuance/const.js

@@ -1,4 +1,5 @@
 import * as z from "zod";
 export const ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-client-attestation";
+export const DPOP_KET_TAG = `dpop`;
 export const SupportedCredentialFormat = z.union([z.literal("vc+sd-jwt"), z.literal("vc+mdoc-cbor")]);
 //# sourceMappingURL=const.js.map

package/lib/module/credential/issuance/const.js.map

@@ -1 +1 @@
-{"version":3,"names":["z","ASSERTION_TYPE","SupportedCredentialFormat","union","literal"],"sourceRoot":"../../../../src","sources":["credential/issuance/const.ts"],"mappings":"AAAA,OAAO,KAAKA,CAAC,MAAM,KAAK;AACxB,OAAO,MAAMC,cAAc,GACzB,oEAAoE;AAKtE,OAAO,MAAMC,yBAAyB,GAAGF,CAAC,CAACG,KAAK,CAAC,CAC/CH,CAAC,CAACI,OAAO,CAAC,WAAW,CAAC,EACtBJ,CAAC,CAACI,OAAO,CAAC,cAAc,CAAC,CAC1B,CAAC"}
+{"version":3,"names":["z","ASSERTION_TYPE","DPOP_KET_TAG","SupportedCredentialFormat","union","literal"],"sourceRoot":"../../../../src","sources":["credential/issuance/const.ts"],"mappings":"AAAA,OAAO,KAAKA,CAAC,MAAM,KAAK;AACxB,OAAO,MAAMC,cAAc,GACzB,oEAAoE;AAEtE,OAAO,MAAMC,YAAY,GAAI,MAAK;AAKlC,OAAO,MAAMC,yBAAyB,GAAGH,CAAC,CAACI,KAAK,CAAC,CAC/CJ,CAAC,CAACK,OAAO,CAAC,WAAW,CAAC,EACtBL,CAAC,CAACK,OAAO,CAAC,cAAc,CAAC,CAC1B,CAAC"}

package/lib/typescript/credential/issuance/05-authorize-access.d.ts

@@ -10,7 +10,7 @@ export type AuthorizeAccess = (issuerConf: Out<EvaluateIssuerTrust>["issuerConf"
     wiaCryptoContext: CryptoContext;
 }) => Promise<{
     accessToken: TokenResponse;
-    tokenRequestSignedDPop: string;
+    dPoPContext: CryptoContext;
 }>;
 /**
  * Creates and sends the DPoP Proof JWT to be presented with the authorization code to the /token endpoint of the authorization server

package/lib/typescript/credential/issuance/05-authorize-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"05-authorize-access.d.ts","sourceRoot":"","sources":["../../../../src/credential/issuance/05-authorize-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAM5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,kCAAkC,CAAC;AAE/F,MAAM,MAAM,eAAe,GAAG,CAC5B,UAAU,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,EAClD,IAAI,EAAE,GAAG,CAAC,sCAAsC,CAAC,CAAC,MAAM,CAAC,EACzD,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC,UAAU,CAAC,EACjD,YAAY,EAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC,cAAc,CAAC,EACzD,OAAO,EAAE;IACP,yBAAyB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAChC,gBAAgB,EAAE,aAAa,CAAC;CACjC,KACE,OAAO,CAAC;IAAE,WAAW,EAAE,aAAa,CAAC;IAAC,sBAAsB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,eAAe,EAAE,eAyE7B,CAAC"}
+{"version":3,"file":"05-authorize-access.d.ts","sourceRoot":"","sources":["../../../../src/credential/issuance/05-authorize-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAM5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,kCAAkC,CAAC;AAG/F,MAAM,MAAM,eAAe,GAAG,CAC5B,UAAU,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,EAClD,IAAI,EAAE,GAAG,CAAC,sCAAsC,CAAC,CAAC,MAAM,CAAC,EACzD,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC,UAAU,CAAC,EACjD,YAAY,EAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC,cAAc,CAAC,EACzD,OAAO,EAAE;IACP,yBAAyB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAChC,gBAAgB,EAAE,aAAa,CAAC;CACjC,KACE,OAAO,CAAC;IAAE,WAAW,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,aAAa,CAAA;CAAE,CAAC,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,eAAe,EAAE,eA6E7B,CAAC"}

package/lib/typescript/credential/issuance/06-obtain-credential.d.ts

@@ -4,7 +4,7 @@ import type { EvaluateIssuerTrust } from "./02-evaluate-issuer-trust";
 import { type Out } from "../../utils/misc";
 import type { StartUserAuthorization } from "./03-start-user-authorization";
 import { CredentialResponse } from "./types";
-export type ObtainCredential = (issuerConf: Out<EvaluateIssuerTrust>["issuerConf"], accessToken: Out<AuthorizeAccess>["accessToken"], clientId: Out<StartUserAuthorization>["clientId"], credentialDefinition: Out<StartUserAuthorization>["credentialDefinition"], tokenRequestSignedDPop: Out<AuthorizeAccess>["tokenRequestSignedDPop"], context: {
+export type ObtainCredential = (issuerConf: Out<EvaluateIssuerTrust>["issuerConf"], accessToken: Out<AuthorizeAccess>["accessToken"], clientId: Out<StartUserAuthorization>["clientId"], credentialDefinition: Out<StartUserAuthorization>["credentialDefinition"], dPoPContext: CryptoContext, context: {
     credentialCryptoContext: CryptoContext;
     appFetch?: GlobalFetch["fetch"];
 }) => Promise<CredentialResponse>;

package/lib/typescript/credential/issuance/06-obtain-credential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"06-obtain-credential.d.ts","sourceRoot":"","sources":["../../../../src/credential/issuance/06-obtain-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAa,KAAK,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAE7C,MAAM,MAAM,gBAAgB,GAAG,CAC7B,UAAU,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,EAClD,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,aAAa,CAAC,EAChD,QAAQ,EAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC,UAAU,CAAC,EACjD,oBAAoB,EAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC,sBAAsB,CAAC,EACzE,sBAAsB,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,wBAAwB,CAAC,EACtE,OAAO,EAAE;IACP,uBAAuB,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;CACjC,KACE,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEjC,eAAO,MAAM,gBAAgB,UACpB,MAAM,UACL,MAAM,YACJ,MAAM,OACX,aAAa,KACjB,QAAQ,MAAM,CAehB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,EAAE,gBAqE9B,CAAC"}
+{"version":3,"file":"06-obtain-credential.d.ts","sourceRoot":"","sources":["../../../../src/credential/issuance/06-obtain-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAa,KAAK,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAO7C,MAAM,MAAM,gBAAgB,GAAG,CAC7B,UAAU,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,YAAY,CAAC,EAClD,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,aAAa,CAAC,EAChD,QAAQ,EAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC,UAAU,CAAC,EACjD,oBAAoB,EAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC,sBAAsB,CAAC,EACzE,WAAW,EAAE,aAAa,EAC1B,OAAO,EAAE;IACP,uBAAuB,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;CACjC,KACE,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEjC,eAAO,MAAM,gBAAgB,UACpB,MAAM,UACL,MAAM,YACJ,MAAM,OACX,aAAa,KACjB,QAAQ,MAAM,CAehB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,EAAE,gBAgF9B,CAAC"}

package/lib/typescript/credential/issuance/const.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
 export declare const ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-client-attestation";
+export declare const DPOP_KET_TAG = "dpop";
 export type SupportedCredentialFormat = z.infer<typeof SupportedCredentialFormat>;
 export declare const SupportedCredentialFormat: z.ZodUnion<[z.ZodLiteral<"vc+sd-jwt">, z.ZodLiteral<"vc+mdoc-cbor">]>;
 //# sourceMappingURL=const.d.ts.map

package/lib/typescript/credential/issuance/const.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"const.d.ts","sourceRoot":"","sources":["../../../../src/credential/issuance/const.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,eAAO,MAAM,cAAc,uEAC2C,CAAC;AAEvE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,yBAAyB,CACjC,CAAC;AACF,eAAO,MAAM,yBAAyB,uEAGpC,CAAC"}
+{"version":3,"file":"const.d.ts","sourceRoot":"","sources":["../../../../src/credential/issuance/const.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,eAAO,MAAM,cAAc,uEAC2C,CAAC;AAEvE,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,yBAAyB,CACjC,CAAC;AACF,eAAO,MAAM,yBAAyB,uEAGpC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/io-react-native-wallet",
-  "version": "0.15.3",
+  "version": "0.15.4",
   "description": "Provide data structures, helpers and API for IO Wallet",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",

package/src/credential/issuance/05-authorize-access.ts

@@ -1,16 +1,17 @@
 import { hasStatus, type Out } from "../../utils/misc";
 import type { EvaluateIssuerTrust } from "./02-evaluate-issuer-trust";
 import type { StartUserAuthorization } from "./03-start-user-authorization";
-import { withEphemeralKey } from "../../utils/crypto";
+import { createCryptoContextFor } from "../../utils/crypto";
 import { createDPopToken } from "../../utils/dpop";
 import uuid from "react-native-uuid";
 import { createPopToken } from "../../utils/pop";
 import * as WalletInstanceAttestation from "../../wallet-instance-attestation";
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
-import { ASSERTION_TYPE } from "./const";
+import { ASSERTION_TYPE, DPOP_KET_TAG } from "./const";
 import { TokenResponse } from "./types";
 import { ValidationFailed } from "../../utils/errors";
 import type { CompleteUserAuthorizationWithQueryMode } from "./04-complete-user-authorization";
+import { generate } from "@pagopa/io-react-native-crypto";
 
 export type AuthorizeAccess = (
   issuerConf: Out<EvaluateIssuerTrust>["issuerConf"],
@@ -23,7 +24,7 @@ export type AuthorizeAccess = (
     appFetch?: GlobalFetch["fetch"];
     wiaCryptoContext: CryptoContext;
   }
-) => Promise<{ accessToken: TokenResponse; tokenRequestSignedDPop: string }>;
+) => Promise<{ accessToken: TokenResponse; dPoPContext: CryptoContext }>;
 
 /**
  * Creates and sends the DPoP Proof JWT to be presented with the authorization code to the /token endpoint of the authorization server
@@ -63,18 +64,22 @@ export const authorizeAccess: AuthorizeAccess = async (
     .payload.cnf.jwk.kid;
 
   const tokenUrl = issuerConf.oauth_authorization_server.token_endpoint;
-  // Use an ephemeral key to be destroyed after use
-  const tokenRequestSignedDPop = await withEphemeralKey(
-    async (ephimeralContext) => {
-      return await createDPopToken(
-        {
-          htm: "POST",
-          htu: tokenUrl,
-          jti: `${uuid.v4()}`,
-        },
-        ephimeralContext
-      );
-    }
+
+  try {
+    await generate(DPOP_KET_TAG);
+  } catch {
+    console.log("DPoP key already exist");
+  }
+
+  const dPoPContext = createCryptoContextFor(DPOP_KET_TAG);
+
+  const tokenRequestSignedDPop = await createDPopToken(
+    {
+      htm: "POST",
+      htu: tokenUrl,
+      jti: `${uuid.v4()}`,
+    },
+    dPoPContext
   );
 
   const signedWiaPoP = await createPopToken(
@@ -113,5 +118,5 @@ export const authorizeAccess: AuthorizeAccess = async (
     throw new ValidationFailed(tokenRes.error.message);
   }
 
-  return { accessToken: tokenRes.data, tokenRequestSignedDPop };
+  return { accessToken: tokenRes.data, dPoPContext };
 };

package/src/credential/issuance/06-obtain-credential.ts

@@ -1,4 +1,8 @@
-import { SignJWT, type CryptoContext } from "@pagopa/io-react-native-jwt";
+import {
+  sha256ToBase64,
+  SignJWT,
+  type CryptoContext,
+} from "@pagopa/io-react-native-jwt";
 import type { AuthorizeAccess } from "./05-authorize-access";
 import type { EvaluateIssuerTrust } from "./02-evaluate-issuer-trust";
 import { hasStatus, type Out } from "../../utils/misc";
@@ -6,12 +10,17 @@ import type { StartUserAuthorization } from "./03-start-user-authorization";
 import { ValidationFailed } from "../../utils/errors";
 import { CredentialResponse } from "./types";
 
+import { createDPopToken } from "../../utils/dpop";
+import uuid from "react-native-uuid";
+import { deleteKey } from "@pagopa/io-react-native-crypto";
+import { DPOP_KET_TAG } from "./const";
+
 export type ObtainCredential = (
   issuerConf: Out<EvaluateIssuerTrust>["issuerConf"],
   accessToken: Out<AuthorizeAccess>["accessToken"],
   clientId: Out<StartUserAuthorization>["clientId"],
   credentialDefinition: Out<StartUserAuthorization>["credentialDefinition"],
-  tokenRequestSignedDPop: Out<AuthorizeAccess>["tokenRequestSignedDPop"],
+  dPoPContext: CryptoContext,
   context: {
     credentialCryptoContext: CryptoContext;
     appFetch?: GlobalFetch["fetch"];
@@ -60,7 +69,7 @@ export const obtainCredential: ObtainCredential = async (
   accessToken,
   clientId,
   credentialDefinition,
-  tokenRequestSignedDPop,
+  dPoPContext,
   context
 ) => {
   const { credentialCryptoContext, appFetch = fetch } = context;
@@ -106,6 +115,17 @@ export const obtainCredential: ObtainCredential = async (
     },
   };
 
+  const tokenRequestSignedDPop = await await createDPopToken(
+    {
+      htm: "POST",
+      htu: credentialUrl,
+      jti: `${uuid.v4()}`,
+      ath: await sha256ToBase64(accessToken.access_token),
+    },
+    dPoPContext
+  );
+
+  await deleteKey(DPOP_KET_TAG);
   const credentialRes = await appFetch(credentialUrl, {
     method: "POST",
     headers: {

package/src/credential/issuance/const.ts

@@ -2,6 +2,8 @@ import * as z from "zod";
 export const ASSERTION_TYPE =
   "urn:ietf:params:oauth:client-assertion-type:jwt-client-attestation";
 
+export const DPOP_KET_TAG = `dpop`;
+
 export type SupportedCredentialFormat = z.infer<
   typeof SupportedCredentialFormat
 >;