@pagopa/io-react-native-wallet 0.3.0 → 0.4.0

package/lib/typescript/trust/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/trust/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,eAAO,MAAM,SAAS;;;;;;;;;EAAuD,CAAC;AAC9E,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC9D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc1B,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB9B,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAClD,OAAO,8BAA8B,CACtC,CAAC;AACF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAsB,CAAC"}

package/lib/typescript/wallet-instance-attestation/types.d.ts

@@ -20,15 +20,14 @@ export declare const WalletInstanceAttestationRequestJwt: z.ZodObject<{
         x5c?: string[] | undefined;
         trust_chain?: string[] | undefined;
     }>, z.ZodObject<{
-        typ: z.ZodLiteral<"var+jwt">;
+        typ: z.ZodLiteral<"wiar+jwt">;
     }, "strip", z.ZodTypeAny, {
-        typ: "var+jwt";
+        typ: "wiar+jwt";
     }, {
-        typ: "var+jwt";
+        typ: "wiar+jwt";
     }>>;
     payload: z.ZodIntersection<z.ZodObject<{
         iss: z.ZodString;
-        sub: z.ZodString;
         iat: z.ZodNumber;
         exp: z.ZodNumber;
         cnf: z.ZodObject<{
@@ -165,7 +164,6 @@ export declare const WalletInstanceAttestationRequestJwt: z.ZodObject<{
         }>;
     }, "strip", z.ZodTypeAny, {
         iss: string;
-        sub: string;
         iat: number;
         exp: number;
         cnf: {
@@ -198,7 +196,6 @@ export declare const WalletInstanceAttestationRequestJwt: z.ZodObject<{
         };
     }, {
         iss: string;
-        sub: string;
         iat: number;
         exp: number;
         cnf: {
@@ -230,14 +227,17 @@ export declare const WalletInstanceAttestationRequestJwt: z.ZodObject<{
             };
         };
     }>, z.ZodObject<{
+        aud: z.ZodString;
         jti: z.ZodString;
-        type: z.ZodLiteral<"WalletInstanceAttestationRequest">;
+        nonce: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        type: "WalletInstanceAttestationRequest";
         jti: string;
+        nonce: string;
+        aud: string;
     }, {
-        type: "WalletInstanceAttestationRequest";
         jti: string;
+        nonce: string;
+        aud: string;
     }>>;
 }, "strip", z.ZodTypeAny, {
     header: {
@@ -247,11 +247,10 @@ export declare const WalletInstanceAttestationRequestJwt: z.ZodObject<{
         x5c?: string[] | undefined;
         trust_chain?: string[] | undefined;
     } & {
-        typ: "var+jwt";
+        typ: "wiar+jwt";
     };
     payload: {
         iss: string;
-        sub: string;
         iat: number;
         exp: number;
         cnf: {
@@ -283,8 +282,9 @@ export declare const WalletInstanceAttestationRequestJwt: z.ZodObject<{
             };
         };
     } & {
-        type: "WalletInstanceAttestationRequest";
         jti: string;
+        nonce: string;
+        aud: string;
     };
 }, {
     header: {
@@ -294,11 +294,10 @@ export declare const WalletInstanceAttestationRequestJwt: z.ZodObject<{
         x5c?: string[] | undefined;
         trust_chain?: string[] | undefined;
     } & {
-        typ: "var+jwt";
+        typ: "wiar+jwt";
     };
     payload: {
         iss: string;
-        sub: string;
         iat: number;
         exp: number;
         cnf: {
@@ -330,8 +329,9 @@ export declare const WalletInstanceAttestationRequestJwt: z.ZodObject<{
             };
         };
     } & {
-        type: "WalletInstanceAttestationRequest";
         jti: string;
+        nonce: string;
+        aud: string;
     };
 }>;
 export type WalletInstanceAttestationJwt = z.infer<typeof WalletInstanceAttestationJwt>;
@@ -355,15 +355,14 @@ export declare const WalletInstanceAttestationJwt: z.ZodObject<{
         x5c?: string[] | undefined;
         trust_chain?: string[] | undefined;
     }>, z.ZodObject<{
-        typ: z.ZodLiteral<"va+jwt">;
+        typ: z.ZodLiteral<"wallet-attestation+jwt">;
     }, "strip", z.ZodTypeAny, {
-        typ: "va+jwt";
+        typ: "wallet-attestation+jwt";
     }, {
-        typ: "va+jwt";
+        typ: "wallet-attestation+jwt";
     }>>;
     payload: z.ZodIntersection<z.ZodObject<{
         iss: z.ZodString;
-        sub: z.ZodString;
         iat: z.ZodNumber;
         exp: z.ZodNumber;
         cnf: z.ZodObject<{
@@ -500,7 +499,6 @@ export declare const WalletInstanceAttestationJwt: z.ZodObject<{
         }>;
     }, "strip", z.ZodTypeAny, {
         iss: string;
-        sub: string;
         iat: number;
         exp: number;
         cnf: {
@@ -533,7 +531,6 @@ export declare const WalletInstanceAttestationJwt: z.ZodObject<{
         };
     }, {
         iss: string;
-        sub: string;
         iat: number;
         exp: number;
         cnf: {
@@ -565,11 +562,8 @@ export declare const WalletInstanceAttestationJwt: z.ZodObject<{
             };
         };
     }>, z.ZodObject<{
-        type: z.ZodLiteral<"WalletInstanceAttestation">;
-        policy_uri: z.ZodString;
-        tos_uri: z.ZodString;
-        logo_uri: z.ZodString;
-        asc: z.ZodString;
+        sub: z.ZodString;
+        attested_security_context: z.ZodString;
         authorization_endpoint: z.ZodString;
         response_types_supported: z.ZodArray<z.ZodString, "many">;
         vp_formats_supported: z.ZodObject<{
@@ -605,12 +599,9 @@ export declare const WalletInstanceAttestationJwt: z.ZodObject<{
         request_object_signing_alg_values_supported: z.ZodArray<z.ZodString, "many">;
         presentation_definition_uri_supported: z.ZodBoolean;
     }, "strip", z.ZodTypeAny, {
-        type: "WalletInstanceAttestation";
+        sub: string;
         authorization_endpoint: string;
-        policy_uri: string;
-        tos_uri: string;
-        logo_uri: string;
-        asc: string;
+        attested_security_context: string;
         response_types_supported: string[];
         vp_formats_supported: {
             jwt_vp_json: {
@@ -623,12 +614,9 @@ export declare const WalletInstanceAttestationJwt: z.ZodObject<{
         request_object_signing_alg_values_supported: string[];
         presentation_definition_uri_supported: boolean;
     }, {
-        type: "WalletInstanceAttestation";
+        sub: string;
         authorization_endpoint: string;
-        policy_uri: string;
-        tos_uri: string;
-        logo_uri: string;
-        asc: string;
+        attested_security_context: string;
         response_types_supported: string[];
         vp_formats_supported: {
             jwt_vp_json: {
@@ -649,11 +637,10 @@ export declare const WalletInstanceAttestationJwt: z.ZodObject<{
         x5c?: string[] | undefined;
         trust_chain?: string[] | undefined;
     } & {
-        typ: "va+jwt";
+        typ: "wallet-attestation+jwt";
     };
     payload: {
         iss: string;
-        sub: string;
         iat: number;
         exp: number;
         cnf: {
@@ -685,12 +672,9 @@ export declare const WalletInstanceAttestationJwt: z.ZodObject<{
             };
         };
     } & {
-        type: "WalletInstanceAttestation";
+        sub: string;
         authorization_endpoint: string;
-        policy_uri: string;
-        tos_uri: string;
-        logo_uri: string;
-        asc: string;
+        attested_security_context: string;
         response_types_supported: string[];
         vp_formats_supported: {
             jwt_vp_json: {
@@ -711,11 +695,10 @@ export declare const WalletInstanceAttestationJwt: z.ZodObject<{
         x5c?: string[] | undefined;
         trust_chain?: string[] | undefined;
     } & {
-        typ: "va+jwt";
+        typ: "wallet-attestation+jwt";
     };
     payload: {
         iss: string;
-        sub: string;
         iat: number;
         exp: number;
         cnf: {
@@ -747,12 +730,9 @@ export declare const WalletInstanceAttestationJwt: z.ZodObject<{
             };
         };
     } & {
-        type: "WalletInstanceAttestation";
+        sub: string;
         authorization_endpoint: string;
-        policy_uri: string;
-        tos_uri: string;
-        logo_uri: string;
-        asc: string;
+        attested_security_context: string;
         response_types_supported: string[];
         vp_formats_supported: {
             jwt_vp_json: {

package/lib/typescript/wallet-instance-attestation/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/wallet-instance-attestation/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AA4BzB,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CACvD,OAAO,mCAAmC,CAC3C,CAAC;AACF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc9C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,4BAA4B,CACpC,CAAC;AACF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BvC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/wallet-instance-attestation/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AA2BzB,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CACvD,OAAO,mCAAmC,CAC3C,CAAC;AACF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe9C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,4BAA4B,CACpC,CAAC;AACF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0BvC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/io-react-native-wallet",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Provide data structures, helpers and API for IO Wallet",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",

package/src/index.ts

@@ -8,6 +8,7 @@ import * as Errors from "./utils/errors";
 import * as WalletInstanceAttestation from "./wallet-instance-attestation";
 import { getUnsignedDPop } from "./utils/dpop";
 import { RelyingPartySolution } from "./rp";
+import { verifyTrustChain, getEntityConfiguration } from "./trust";
 
 export {
   PID,
@@ -16,4 +17,6 @@ export {
   Errors,
   getUnsignedDPop,
   RelyingPartySolution,
+  verifyTrustChain,
+  getEntityConfiguration,
 };

package/src/rp/__test__/index.test.ts

@@ -20,7 +20,7 @@ describe("decodeAuthRequestQR", () => {
 });
 
 describe("RpEntityConfiguration", () => {
-  it("should parse a valid confdsfashdhasd", async () => {
+  it("should parse a valid conf", async () => {
     const pp = {
       header: {
         alg: "RS256",
@@ -43,6 +43,13 @@ describe("RpEntityConfiguration", () => {
           ],
         },
         metadata: {
+          federation_entity: {
+            organization_name: "wallet-provider",
+            homepage_uri: "https://wallet-provider.example",
+            policy_uri: "https://wallet-provider.example",
+            logo_uri: "https://wallet-provider.example",
+            contacts: ["https://wallet-provider.example"],
+          },
           wallet_relying_party: {
             application_type: "web",
             authorization_encrypted_response_alg: [

package/src/rp/index.ts

@@ -21,6 +21,7 @@ import {
 import uuid from "react-native-uuid";
 import type { JWK } from "@pagopa/io-react-native-jwt/lib/typescript/types";
 import { disclose } from "../sd-jwt";
+import { getEntityConfiguration } from "../trust";
 
 export class RelyingPartySolution {
   relyingPartyBaseUrl: string;
@@ -264,7 +265,7 @@ export class RelyingPartySolution {
     });
 
     if (response.status === 200) {
-      return await response.text();
+      return await response.json();
     }
 
     throw new IoWalletError(
@@ -301,24 +302,8 @@ export class RelyingPartySolution {
    * Obtain the relying party entity configuration.
    */
   async getEntityConfiguration(): Promise<RpEntityConfiguration> {
-    const wellKnownUrl =
-      this.relyingPartyBaseUrl + "/.well-known/openid-federation";
-
-    const response = await this.appFetch(wellKnownUrl, {
-      method: "GET",
-    });
-
-    if (response.status === 200) {
-      const responseText = await response.text();
-      const responseJwt = await decodeJwt(responseText);
-      return RpEntityConfiguration.parse({
-        header: responseJwt.protectedHeader,
-        payload: responseJwt.payload,
-      });
-    }
-
-    throw new IoWalletError(
-      `Unable to obtain RP Entity Configuration. Response code: ${response.status}`
-    );
+    return getEntityConfiguration(this.relyingPartyBaseUrl, {
+      appFetch: this.appFetch,
+    }).then(RpEntityConfiguration.parse);
   }
 }

package/src/rp/types.ts

@@ -1,6 +1,7 @@
 import { JWK } from "../utils/jwk";
 import { UnixTime } from "../sd-jwt/types";
 import * as z from "zod";
+import { EntityConfiguration } from "../trust/types";
 
 export type RequestObject = z.infer<typeof RequestObject>;
 export const RequestObject = z.object({
@@ -26,43 +27,25 @@ export const RequestObject = z.object({
   }),
 });
 
-// TODO: This types is WIP in technical rules
+/**
+ * EntityConfiguration plus the metadata specific for a Relying Party entity.
+ */
 export type RpEntityConfiguration = z.infer<typeof RpEntityConfiguration>;
-export const RpEntityConfiguration = z.object({
-  header: z.object({
-    typ: z.literal("entity-statement+jwt"),
-    alg: z.string(),
-    kid: z.string(),
-  }),
-  payload: z.object({
-    exp: UnixTime,
-    iat: UnixTime,
-    iss: z.string(),
-    sub: z.string(),
-    jwks: z.object({
-      keys: z.array(JWK),
-    }),
-    metadata: z.object({
-      wallet_relying_party: z.object({
-        application_type: z.string(),
-        client_id: z.string(),
-        client_name: z.string(),
-        jwks: z.array(JWK),
-        contacts: z.array(z.string()),
+export const RpEntityConfiguration = EntityConfiguration.and(
+  z.object({
+    payload: z.object({
+      metadata: z.object({
+        wallet_relying_party: z.object({
+          application_type: z.string(),
+          client_id: z.string(),
+          client_name: z.string(),
+          jwks: z.array(JWK),
+          contacts: z.array(z.string()),
+        }),
       }),
-      // FIXME: SIW-422 require federation_metadata field
-      // Actual RP implementation does not comply with the spec
-      /* federation_entity: z.object({
-        organization_name: z.string(),
-        homepage_uri: z.string(),
-        policy_uri: z.string(),
-        logo_uri: z.string(),
-        contacts: z.array(z.string()),
-      }), */
     }),
-    authority_hints: z.array(z.string()),
-  }),
-});
+  })
+);
 
 export type QRCodePayload = z.infer<typeof QRCodePayload>;
 export const QRCodePayload = z.object({

package/src/trust/chain.ts

@@ -0,0 +1,109 @@
+import {
+  decode as decodeJwt,
+  verify as verifyJwt,
+} from "@pagopa/io-react-native-jwt";
+import {
+  EntityConfiguration,
+  EntityStatement,
+  TrustAnchorEntityConfiguration,
+} from "./types";
+import { JWK } from "../utils/jwk";
+import { IoWalletError } from "../utils/errors";
+import * as z from "zod";
+import type { JWTDecodeResult } from "@pagopa/io-react-native-jwt/lib/typescript/types";
+
+type ParsedToken = {
+  header: JWTDecodeResult["protectedHeader"];
+  payload: JWTDecodeResult["payload"];
+};
+
+// Verify a token signature
+// The kid is extracted from the token header
+const verify = async (
+  token: string,
+  kid: string,
+  jwks: JWK[]
+): Promise<ParsedToken> => {
+  const jwk = jwks.find((k) => k.kid === kid);
+  if (!jwk) {
+    throw new Error(`Invalid kid: ${kid}, token: ${token}`);
+  }
+  const { protectedHeader: header, payload } = await verifyJwt(token, jwk);
+  return { header, payload };
+};
+
+const decode = (token: string) => {
+  const { protectedHeader: header, payload } = decodeJwt(token);
+  return { header, payload };
+};
+
+// The first element of the chain is supposed to be the Entity Configuration for the document issuer
+const FirstElementShape = EntityConfiguration;
+// Each element but the first is supposed to be an Entity Statement
+const MiddleElementShape = EntityStatement;
+// The last element of the chain can either be an Entity Statement
+//  or the Entity Configuration for the known Trust Anchor
+const LastElementShape = z.union([
+  EntityStatement,
+  TrustAnchorEntityConfiguration,
+]);
+
+/**
+ * Validates a provided trust chain against a known trust
+ *
+ * @param trustAnchorEntity
+ * @param chain
+ * @returns The list of parsed token representing the chain
+ * @throws {IoWalletError} If the chain is not valid
+ */
+export async function verifyTrustChain(
+  trustAnchorEntity: TrustAnchorEntityConfiguration,
+  chain: string[]
+): Promise<ParsedToken[]> {
+  // If the chain is empty, fail
+  if (chain.length === 0) {
+    throw new IoWalletError("Cannot verify empty trust chain");
+  }
+
+  // Select the expected token shape
+  const selectTokenShape = (elementIndex: number) =>
+    elementIndex === 0
+      ? FirstElementShape
+      : elementIndex === chain.length - 1
+      ? LastElementShape
+      : MiddleElementShape;
+
+  // select the kid from the current index
+  const selectKid = (currentIndex: number): string => {
+    const token = chain[currentIndex];
+    if (!token) {
+      throw new IoWalletError(`Cannot select kid: empty token`);
+    }
+    const shape = selectTokenShape(currentIndex);
+    return shape.parse(decode(token)).header.kid;
+  };
+
+  // select keys from the next token
+  // if the current token is the last, keys fro  trust anchor will be used
+  const selectKeys = (currentIndex: number): JWK[] => {
+    if (currentIndex === chain.length - 1) {
+      return trustAnchorEntity.payload.jwks.keys;
+    }
+
+    const nextIndex = currentIndex + 1;
+    const nextToken = chain[nextIndex];
+    if (!nextToken) {
+      throw new IoWalletError(`Cannot select keys: empty nextToken`);
+    }
+    const shape = selectTokenShape(nextIndex);
+    return shape.parse(decode(nextToken)).payload.jwks.keys;
+  };
+
+  // Iterate the chain and validate each element's signature against the public keys of its next
+  // If there is no next, hence it's the end of the chain and it must be verified by the Trust Anchor
+  return Promise.all(
+    chain
+      .map((token, i) => [token, selectKid(i), selectKeys(i)] as const)
+      .map((args) => verify(...args))
+  );
+}

package/src/trust/index.ts

@@ -0,0 +1,43 @@
+import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
+import { EntityConfiguration } from "./types";
+import { IoWalletError } from "../utils/errors";
+import { verifyTrustChain } from "./chain";
+
+export { verifyTrustChain };
+
+/**
+ * Fetch and parse teh entity configuration document for a given federation entity
+ *
+ * @param entityBaseUrl The base url of the entity.
+ * @param options.appFetch An optional instance of the http client to be used.
+ * @returns The parsed entity configuration object
+ * @throws {IoWalletError} If the http request fails
+ * @throws Parse error if the document is not in the expected shape.
+ */
+export async function getEntityConfiguration(
+  entityBaseUrl: string,
+  {
+    appFetch = fetch,
+  }: {
+    appFetch?: GlobalFetch["fetch"];
+  } = {}
+): Promise<EntityConfiguration> {
+  const wellKnownUrl = `${entityBaseUrl}/.well-known/openid-federation`;
+
+  const response = await appFetch(wellKnownUrl, {
+    method: "GET",
+  });
+
+  if (response.status === 200) {
+    const responseText = await response.text();
+    const responseJwt = decodeJwt(responseText);
+    return EntityConfiguration.parse({
+      header: responseJwt.protectedHeader,
+      payload: responseJwt.payload,
+    });
+  }
+
+  throw new IoWalletError(
+    `Unable to obtain Entity Configuration at ${wellKnownUrl}. Response code: ${response.status}`
+  );
+}

package/src/trust/types.ts

@@ -0,0 +1,56 @@
+import { UnixTime } from "../sd-jwt/types";
+import { JWK } from "../utils/jwk";
+import * as z from "zod";
+
+export const TrustMark = z.object({ id: z.string(), trust_mark: z.string() });
+export type TrustMark = z.infer<typeof TrustMark>;
+
+export type EntityStatement = z.infer<typeof EntityStatement>;
+export const EntityStatement = z.object({
+  header: z.object({
+    typ: z.literal("entity-statement+jwt"),
+    alg: z.string(),
+    kid: z.string(),
+  }),
+  payload: z.object({
+    iss: z.string(),
+    sub: z.string(),
+    jwks: z.object({ keys: z.array(JWK) }),
+    trust_marks: z.array(TrustMark),
+    iat: z.number(),
+    exp: z.number(),
+  }),
+});
+
+export type EntityConfiguration = z.infer<typeof EntityConfiguration>;
+export const EntityConfiguration = z.object({
+  header: z.object({
+    typ: z.literal("entity-statement+jwt"),
+    alg: z.string(),
+    kid: z.string(),
+  }),
+  payload: z.object({
+    exp: UnixTime,
+    iat: UnixTime,
+    iss: z.string(),
+    sub: z.string(),
+    jwks: z.object({
+      keys: z.array(JWK),
+    }),
+    metadata: z.object({
+      federation_entity: z.object({
+        organization_name: z.string(),
+        homepage_uri: z.string(),
+        policy_uri: z.string(),
+        logo_uri: z.string(),
+        contacts: z.array(z.string()),
+      }),
+    }),
+    authority_hints: z.array(z.string()),
+  }),
+});
+
+export type TrustAnchorEntityConfiguration = z.infer<
+  typeof TrustAnchorEntityConfiguration
+>;
+export const TrustAnchorEntityConfiguration = EntityConfiguration;

package/src/wallet-instance-attestation/issuing.ts

@@ -34,9 +34,9 @@ export class Issuing {
 
     const walletInstanceAttestationRequest = new SignJWT({
       iss: keyThumbprint,
-      sub: this.walletProviderBaseUrl,
+      aud: this.walletProviderBaseUrl,
       jti: `${uuid.v4()}`,
-      type: "WalletInstanceAttestationRequest",
+      nonce: `${uuid.v4()}`,
       cnf: {
         jwk: fixBase64EncodingOnKey(publicKey),
       },
@@ -44,7 +44,7 @@ export class Issuing {
       .setProtectedHeader({
         alg: "ES256",
         kid: publicKey.kid,
-        typ: "var+jwt",
+        typ: "wiar+jwt",
       })
       .setIssuedAt()
       .setExpirationTime("1h")
@@ -87,7 +87,7 @@ export class Issuing {
     const tokenUrl = new URL("token", this.walletProviderBaseUrl).href;
     const requestBody = {
       grant_type:
-        "urn:ietf:params:oauth:client-assertion-type:jwt-key-attestation",
+        "urn:ietf:params:oauth:client-assertion-type:jwt-client-attestation",
       assertion: signedAttestationRequest,
     };
     const response = await this.appFetch(tokenUrl, {