@pagopa/io-react-native-wallet 0.2.8 → 0.3.0

package/src/rp/types.ts

@@ -5,7 +5,8 @@ import * as z from "zod";
 export type RequestObject = z.infer<typeof RequestObject>;
 export const RequestObject = z.object({
   header: z.object({
-    typ: z.literal("JWT"),
+    // FIXME: SIW-421 type field must be either required or omitted, optional isn't useful
+    typ: z.literal("JWT").optional(),
     alg: z.string(),
     kid: z.string(),
     trust_chain: z.array(z.string()),
@@ -46,18 +47,18 @@ export const RpEntityConfiguration = z.object({
         application_type: z.string(),
         client_id: z.string(),
         client_name: z.string(),
-        jwks: z.object({
-          keys: z.array(JWK),
-        }),
+        jwks: z.array(JWK),
         contacts: z.array(z.string()),
       }),
-      federation_entity: z.object({
+      // FIXME: SIW-422 require federation_metadata field
+      // Actual RP implementation does not comply with the spec
+      /* federation_entity: z.object({
         organization_name: z.string(),
         homepage_uri: z.string(),
         policy_uri: z.string(),
         logo_uri: z.string(),
         contacts: z.array(z.string()),
-      }),
+      }), */
     }),
     authority_hints: z.array(z.string()),
   }),
@@ -65,7 +66,7 @@ export const RpEntityConfiguration = z.object({
 
 export type QRCodePayload = z.infer<typeof QRCodePayload>;
 export const QRCodePayload = z.object({
-  protocol: z.literal("eudiw:"),
+  protocol: z.string(),
   resource: z.string(), // TODO: refine to known paths using literals
   clientId: z.string(),
   requestURI: z.string(),

package/src/utils/jwk.ts

@@ -1,3 +1,4 @@
+import { removePadding } from "@pagopa/io-react-native-jwt";
 import { z } from "zod";
 
 export type JWK = z.infer<typeof JWK>;
@@ -37,3 +38,23 @@ export const JWK = z.object({
   /** JWK "x5u" (X.509 URL) Parameter. */
   x5u: z.string().optional(),
 });
+
+/**
+ * Ensure key values are encoded using base64url and not just base64, as defined in https://datatracker.ietf.org/doc/html/rfc7517
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7517
+ *
+ * @param key The key to fix
+ * @returns THe same input key with fixed values
+ */
+export function fixBase64EncodingOnKey(key: JWK): JWK {
+  const { x, y, e, n, ...pk } = key;
+
+  return {
+    ...pk,
+    ...(x ? { x: removePadding(x) } : {}),
+    ...(y ? { y: removePadding(y) } : {}),
+    ...(e ? { e: removePadding(e) } : {}),
+    ...(n ? { n: removePadding(n) } : {}),
+  };
+}

package/src/wallet-instance-attestation/issuing.ts

@@ -1,7 +1,7 @@
 import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
 import { verify as verifyJwt } from "@pagopa/io-react-native-jwt";
 import { SignJWT, thumbprint } from "@pagopa/io-react-native-jwt";
-import { JWK } from "../utils/jwk";
+import { JWK, fixBase64EncodingOnKey } from "../utils/jwk";
 import { WalletInstanceAttestationRequestJwt } from "./types";
 import uuid from "react-native-uuid";
 import { WalletInstanceAttestationIssuingError } from "../utils/errors";
@@ -38,7 +38,7 @@ export class Issuing {
       jti: `${uuid.v4()}`,
       type: "WalletInstanceAttestationRequest",
       cnf: {
-        jwk: publicKey,
+        jwk: fixBase64EncodingOnKey(publicKey),
       },
     })
       .setProtectedHeader({
@@ -74,6 +74,7 @@ export class Issuing {
       attestationRequest,
       signature
     );
+
     const decodedRequest = decodeJwt(signedAttestationRequest);
     const parsedRequest = WalletInstanceAttestationRequestJwt.parse({
       payload: decodedRequest.payload,

package/src/wallet-instance-attestation/types.ts

@@ -18,7 +18,11 @@ const Jwt = z.object({
     iat: UnixTime,
     exp: UnixTime,
     cnf: z.object({
-      jwk: JWK,
+      jwk: z.intersection(
+        JWK,
+        // this key requires a kis because it must be referenced for DPoP
+        z.object({ kid: z.string() })
+      ),
     }),
   }),
 });
@@ -60,7 +64,7 @@ export const WalletInstanceAttestationJwt = z.object({
       tos_uri: z.string().url(),
       logo_uri: z.string().url(),
       asc: z.string(),
-      authorization_endpoint: z.string().url(),
+      authorization_endpoint: z.string(),
       response_types_supported: z.array(z.string()),
       vp_formats_supported: z.object({
         jwt_vp_json: z.object({