@pagopa/io-react-native-wallet 0.7.3 → 0.9.0

package/lib/module/credential/presentation/04-send-authorization-response.js

@@ -0,0 +1,128 @@
+import { EncryptJwe, SignJWT } from "@pagopa/io-react-native-jwt";
+import uuid from "react-native-uuid";
+import * as WalletInstanceAttestation from "../../wallet-instance-attestation";
+import { NoSuitableKeysFoundInEntityConfiguration } from "../../utils/errors";
+import { hasStatus } from "../../utils/misc";
+import { disclose } from "../../sd-jwt";
+import * as z from "zod";
+export const AuthorizationResponse = z.object({
+  status: z.string(),
+  response_code: z.string() /**
+                            FIXME: [SIW-627] we expect this value from every RP implementation
+                            Actually some RP does not return the value
+                            We make it optional to not break the flow.
+                            */.optional()
+});
+
+/**
+ * Choose an RSA public key from those offered by the RP for encryption.
+ *
+ * @param entity The RP entity configuration
+ * @returns A suitable public key with its compatible encryption algorithm
+ * @throws {NoSuitableKeysFoundInEntityConfiguration} If entity do not contain any public key suitable for encrypting
+ */
+const chooseRSAPublicKeyToEncrypt = entity => {
+  const [usingRsa256] = entity.wallet_relying_party.jwks.keys.filter(jwk => jwk.use === "enc" && jwk.kty === "RSA");
+  if (usingRsa256) {
+    return usingRsa256;
+  }
+
+  // No suitable key has been found
+  throw new NoSuitableKeysFoundInEntityConfiguration("Encrypt with RP public key");
+};
+
+/**
+ * Generate a Verified Presentation token for a received request object within the context of an authorization request flow.
+ * The presentation is created by revealing data from the provided credentials based on the requested claims.
+ * Each Verified Credential is accompanied by the claims that the user consents to disclose from it.
+ *
+ * @todo: Allow for handling more than one Verified Credential.
+ */
+const prepareVpToken = async (requestObject, walletInstanceAttestation, _ref) => {
+  let [vc, claims, cryptoCtx] = _ref;
+  // this throws if vc cannot satisfy all the requested claims
+  const {
+    token: vp,
+    paths
+  } = await disclose(vc, claims);
+
+  // obtain issuer from Wallet Instance
+  const {
+    payload: {
+      iss
+    }
+  } = WalletInstanceAttestation.decode(walletInstanceAttestation);
+  const pidKid = await cryptoCtx.getPublicKey().then(_ => _.kid);
+
+  // TODO: [SIW-359] check all requeste claims of the requestedObj are satisfied
+  const vp_token = await new SignJWT(cryptoCtx).setProtectedHeader({
+    typ: "JWT",
+    kid: pidKid
+  }).setPayload({
+    vp: vp,
+    jti: `${uuid.v4()}`,
+    iss,
+    nonce: requestObject.nonce
+  }).setAudience(requestObject.response_uri).setIssuedAt().setExpirationTime("1h").sign();
+  const vc_scope = requestObject.scope;
+  const presentation_submission = {
+    definition_id: `${uuid.v4()}`,
+    id: `${uuid.v4()}`,
+    descriptor_map: paths.map(p => ({
+      id: vc_scope,
+      path: `$.vp_token.${p.path}`,
+      format: "vc+sd-jwt"
+    }))
+  };
+  return {
+    vp_token,
+    presentation_submission
+  };
+};
+/**
+ * Complete the presentation flow by sending the authorization response to the Relying Party
+ *
+ * @param requestObject The Request Object that describes the presentation
+ * @param rpConf The Relying Party's configuration
+ * @param presentation The presentation tuple consisting in the signed credential,
+ * the list of claims to be disclosed, and the context to access the key that proves the holder binding
+ * @param context.walletInstanceAttestation The Wallet Instance Attestation token
+ * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
+ * @returns The result of the presentation flow
+ */
+export const sendAuthorizationResponse = async (requestObject, rpConf, presentation, _ref2) => {
+  let {
+    appFetch = fetch,
+    walletInstanceAttestation
+  } = _ref2;
+  // the request is an unsigned jws without iss, aud, exp
+  // https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-signed-and-encrypted-respon
+  const rsaPublicJwk = chooseRSAPublicKeyToEncrypt(rpConf);
+  const {
+    vp_token,
+    presentation_submission
+  } = await prepareVpToken(requestObject, walletInstanceAttestation, presentation);
+  const authzResponsePayload = JSON.stringify({
+    state: requestObject.state,
+    presentation_submission,
+    nonce: requestObject.nonce,
+    vp_token
+  });
+  const encrypted = await new EncryptJwe(authzResponsePayload, {
+    alg: "RSA-OAEP-256",
+    enc: "A256CBC-HS512",
+    kid: rsaPublicJwk.kid
+  }).encrypt(rsaPublicJwk);
+  const formBody = new URLSearchParams({
+    response: encrypted
+  });
+  const body = formBody.toString();
+  return appFetch(requestObject.response_uri, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body
+  }).then(hasStatus(200)).then(res => res.json()).then(AuthorizationResponse.parse);
+};
+//# sourceMappingURL=04-send-authorization-response.js.map

package/lib/module/credential/presentation/04-send-authorization-response.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["EncryptJwe","SignJWT","uuid","WalletInstanceAttestation","NoSuitableKeysFoundInEntityConfiguration","hasStatus","disclose","z","AuthorizationResponse","object","status","string","response_code","optional","chooseRSAPublicKeyToEncrypt","entity","usingRsa256","wallet_relying_party","jwks","keys","filter","jwk","use","kty","prepareVpToken","requestObject","walletInstanceAttestation","_ref","vc","claims","cryptoCtx","token","vp","paths","payload","iss","decode","pidKid","getPublicKey","then","_","kid","vp_token","setProtectedHeader","typ","setPayload","jti","v4","nonce","setAudience","response_uri","setIssuedAt","setExpirationTime","sign","vc_scope","scope","presentation_submission","definition_id","id","descriptor_map","map","p","path","format","sendAuthorizationResponse","rpConf","presentation","_ref2","appFetch","fetch","rsaPublicJwk","authzResponsePayload","JSON","stringify","state","encrypted","alg","enc","encrypt","formBody","URLSearchParams","response","body","toString","method","headers","res","json","parse"],"sourceRoot":"../../../../src","sources":["credential/presentation/04-send-authorization-response.ts"],"mappings":"AAAA,SAASA,UAAU,EAAEC,OAAO,QAAQ,6BAA6B;AACjE,OAAOC,IAAI,MAAM,mBAAmB;AACpC,OAAO,KAAKC,yBAAyB,MAAM,mCAAmC;AAE9E,SAASC,wCAAwC,QAAQ,oBAAoB;AAC7E,SAASC,SAAS,QAAkB,kBAAkB;AAEtD,SAASC,QAAQ,QAAQ,cAAc;AAGvC,OAAO,KAAKC,CAAC,MAAM,KAAK;AAGxB,OAAO,MAAMC,qBAAqB,GAAGD,CAAC,CAACE,MAAM,CAAC;EAC5CC,MAAM,EAAEH,CAAC,CAACI,MAAM,CAAC,CAAC;EAClBC,aAAa,EAAEL,CAAC,CACbI,MAAM,CAAC,CAAC,CAAC;AACd;AACA;AACA;AACA,8BAJc,CAKTE,QAAQ,CAAC;AACd,CAAC,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,2BAA2B,GAC/BC,MAAgD,IACxC;EACR,MAAM,CAACC,WAAW,CAAC,GAAGD,MAAM,CAACE,oBAAoB,CAACC,IAAI,CAACC,IAAI,CAACC,MAAM,CAC/DC,GAAG,IAAKA,GAAG,CAACC,GAAG,KAAK,KAAK,IAAID,GAAG,CAACE,GAAG,KAAK,KAC5C,CAAC;EAED,IAAIP,WAAW,EAAE;IACf,OAAOA,WAAW;EACpB;;EAEA;EACA,MAAM,IAAIZ,wCAAwC,CAChD,4BACF,CAAC;AACH,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMoB,cAAc,GAAG,MAAAA,CACrBC,aAAqD,EACrDC,yBAAiC,EAAAC,IAAA,KAK7B;EAAA,IAJJ,CAACC,EAAE,EAAEC,MAAM,EAAEC,SAAS,CAAe,GAAAH,IAAA;EAKrC;EACA,MAAM;IAAEI,KAAK,EAAEC,EAAE;IAAEC;EAAM,CAAC,GAAG,MAAM3B,QAAQ,CAACsB,EAAE,EAAEC,MAAM,CAAC;;EAEvD;EACA,MAAM;IACJK,OAAO,EAAE;MAAEC;IAAI;EACjB,CAAC,GAAGhC,yBAAyB,CAACiC,MAAM,CAACV,yBAAyB,CAAC;EAE/D,MAAMW,MAAM,GAAG,MAAMP,SAAS,CAACQ,YAAY,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,GAAG,CAAC;;EAEhE;EACA,MAAMC,QAAQ,GAAG,MAAM,IAAIzC,OAAO,CAAC6B,SAAS,CAAC,CAC1Ca,kBAAkB,CAAC;IAClBC,GAAG,EAAE,KAAK;IACVH,GAAG,EAAEJ;EACP,CAAC,CAAC,CACDQ,UAAU,CAAC;IACVb,EAAE,EAAEA,EAAE;IACNc,GAAG,EAAG,GAAE5C,IAAI,CAAC6C,EAAE,CAAC,CAAE,EAAC;IACnBZ,GAAG;IACHa,KAAK,EAAEvB,aAAa,CAACuB;EACvB,CAAC,CAAC,CACDC,WAAW,CAACxB,aAAa,CAACyB,YAAY,CAAC,CACvCC,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,IAAI,CAAC,CACvBC,IAAI,CAAC,CAAC;EAET,MAAMC,QAAQ,GAAG7B,aAAa,CAAC8B,KAAK;EACpC,MAAMC,uBAAuB,GAAG;IAC9BC,aAAa,EAAG,GAAEvD,IAAI,CAAC6C,EAAE,CAAC,CAAE,EAAC;IAC7BW,EAAE,EAAG,GAAExD,IAAI,CAAC6C,EAAE,CAAC,CAAE,EAAC;IAClBY,cAAc,EAAE1B,KAAK,CAAC2B,GAAG,CAAEC,CAAC,KAAM;MAChCH,EAAE,EAAEJ,QAAQ;MACZQ,IAAI,EAAG,cAAaD,CAAC,CAACC,IAAK,EAAC;MAC5BC,MAAM,EAAE;IACV,CAAC,CAAC;EACJ,CAAC;EAED,OAAO;IAAErB,QAAQ;IAAEc;EAAwB,CAAC;AAC9C,CAAC;AAYD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMQ,yBAAoD,GAAG,MAAAA,CAClEvC,aAAa,EACbwC,MAAM,EACNC,YAAY,EAAAC,KAAA,KAEuB;EAAA,IADnC;IAAEC,QAAQ,GAAGC,KAAK;IAAE3C;EAA0B,CAAC,GAAAyC,KAAA;EAE/C;EACA;EACA,MAAMG,YAAY,GAAGxD,2BAA2B,CAACmD,MAAM,CAAC;EAExD,MAAM;IAAEvB,QAAQ;IAAEc;EAAwB,CAAC,GAAG,MAAMhC,cAAc,CAChEC,aAAa,EACbC,yBAAyB,EACzBwC,YACF,CAAC;EAED,MAAMK,oBAAoB,GAAGC,IAAI,CAACC,SAAS,CAAC;IAC1CC,KAAK,EAAEjD,aAAa,CAACiD,KAAK;IAC1BlB,uBAAuB;IACvBR,KAAK,EAAEvB,aAAa,CAACuB,KAAK;IAC1BN;EACF,CAAC,CAAC;EAEF,MAAMiC,SAAS,GAAG,MAAM,IAAI3E,UAAU,CAACuE,oBAAoB,EAAE;IAC3DK,GAAG,EAAE,cAAc;IACnBC,GAAG,EAAE,eAAe;IACpBpC,GAAG,EAAE6B,YAAY,CAAC7B;EACpB,CAAC,CAAC,CAACqC,OAAO,CAACR,YAAY,CAAC;EAExB,MAAMS,QAAQ,GAAG,IAAIC,eAAe,CAAC;IAAEC,QAAQ,EAAEN;EAAU,CAAC,CAAC;EAC7D,MAAMO,IAAI,GAAGH,QAAQ,CAACI,QAAQ,CAAC,CAAC;EAEhC,OAAOf,QAAQ,CAAC3C,aAAa,CAACyB,YAAY,EAAE;IAC1CkC,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE;IAClB,CAAC;IACDH;EACF,CAAC,CAAC,CACC3C,IAAI,CAAClC,SAAS,CAAC,GAAG,CAAC,CAAC,CACpBkC,IAAI,CAAE+C,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBhD,IAAI,CAAC/B,qBAAqB,CAACgF,KAAK,CAAC;AACtC,CAAC"}

package/lib/module/credential/presentation/index.js

@@ -0,0 +1,6 @@
+import { startFlowFromQR } from "./01-start-flow";
+import { evaluateRelyingPartyTrust } from "./02-evaluate-rp-trust";
+import { getRequestObject } from "./03-get-request-object";
+import { sendAuthorizationResponse } from "./04-send-authorization-response";
+export { startFlowFromQR, evaluateRelyingPartyTrust, getRequestObject, sendAuthorizationResponse };
+//# sourceMappingURL=index.js.map

package/lib/module/credential/presentation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["startFlowFromQR","evaluateRelyingPartyTrust","getRequestObject","sendAuthorizationResponse"],"sourceRoot":"../../../../src","sources":["credential/presentation/index.ts"],"mappings":"AAAA,SAASA,eAAe,QAAwB,iBAAiB;AACjE,SACEC,yBAAyB,QAEpB,wBAAwB;AAC/B,SACEC,gBAAgB,QAEX,yBAAyB;AAChC,SACEC,yBAAyB,QAEpB,kCAAkC;AAEzC,SACEH,eAAe,EACfC,yBAAyB,EACzBC,gBAAgB,EAChBC,yBAAyB"}

package/lib/module/credential/presentation/types.js

@@ -0,0 +1,21 @@
+import { UnixTime } from "../../sd-jwt/types";
+import * as z from "zod";
+
+/**
+ * A pair that associate a tokenized Verified Credential with the claims presented or requested to present.
+ */
+
+export const RequestObject = z.object({
+  iss: z.string(),
+  iat: UnixTime,
+  exp: UnixTime,
+  state: z.string(),
+  nonce: z.string(),
+  response_uri: z.string(),
+  response_type: z.literal("vp_token"),
+  response_mode: z.literal("direct_post.jwt"),
+  client_id: z.string(),
+  client_id_scheme: z.literal("entity_id"),
+  scope: z.string()
+});
+//# sourceMappingURL=types.js.map

package/lib/module/credential/presentation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["UnixTime","z","RequestObject","object","iss","string","iat","exp","state","nonce","response_uri","response_type","literal","response_mode","client_id","client_id_scheme","scope"],"sourceRoot":"../../../../src","sources":["credential/presentation/types.ts"],"mappings":"AACA,SAASA,QAAQ,QAAQ,oBAAoB;AAC7C,OAAO,KAAKC,CAAC,MAAM,KAAK;;AAExB;AACA;AACA;;AAQA,OAAO,MAAMC,aAAa,GAAGD,CAAC,CAACE,MAAM,CAAC;EACpCC,GAAG,EAAEH,CAAC,CAACI,MAAM,CAAC,CAAC;EACfC,GAAG,EAAEN,QAAQ;EACbO,GAAG,EAAEP,QAAQ;EACbQ,KAAK,EAAEP,CAAC,CAACI,MAAM,CAAC,CAAC;EACjBI,KAAK,EAAER,CAAC,CAACI,MAAM,CAAC,CAAC;EACjBK,YAAY,EAAET,CAAC,CAACI,MAAM,CAAC,CAAC;EACxBM,aAAa,EAAEV,CAAC,CAACW,OAAO,CAAC,UAAU,CAAC;EACpCC,aAAa,EAAEZ,CAAC,CAACW,OAAO,CAAC,iBAAiB,CAAC;EAC3CE,SAAS,EAAEb,CAAC,CAACI,MAAM,CAAC,CAAC;EACrBU,gBAAgB,EAAEd,CAAC,CAACW,OAAO,CAAC,WAAW,CAAC;EACxCI,KAAK,EAAEf,CAAC,CAACI,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/lib/module/index.js

@@ -1,13 +1,12 @@
 // polyfill due to known bugs on URL implementation for react native
 // https://github.com/facebook/react-native/issues/24428
 import "react-native-url-polyfill/auto";
+import * as Credential from "./credential";
 import * as PID from "./pid";
-import * as RP from "./rp";
 import * as Errors from "./utils/errors";
 import * as WalletInstanceAttestation from "./wallet-instance-attestation";
-import * as RelyingPartySolution from "./rp";
-import { verifyTrustChain, getEntityConfiguration, getCredentialIssuerEntityConfiguration, getRelyingPartyEntityConfiguration, getTrustAnchorEntityConfiguration, getWalletProviderEntityConfiguration } from "./trust";
-import { RelyingPartyEntityConfiguration, WalletProviderEntityConfiguration, TrustAnchorEntityConfiguration, CredentialIssuerEntityConfiguration } from "./trust/types";
+import * as Trust from "./trust";
+import { AuthorizationDetail, AuthorizationDetails } from "./utils/par";
 import { createCryptoContextFor } from "./utils/crypto";
-export { PID, RP, WalletInstanceAttestation, Errors, RelyingPartySolution, verifyTrustChain, getEntityConfiguration, getCredentialIssuerEntityConfiguration, getRelyingPartyEntityConfiguration, getTrustAnchorEntityConfiguration, getWalletProviderEntityConfiguration, createCryptoContextFor, RelyingPartyEntityConfiguration, WalletProviderEntityConfiguration, TrustAnchorEntityConfiguration, CredentialIssuerEntityConfiguration };
+export { PID, Credential, WalletInstanceAttestation, Errors, Trust, createCryptoContextFor, AuthorizationDetail, AuthorizationDetails };
 //# sourceMappingURL=index.js.map

package/lib/module/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["PID","RP","Errors","WalletInstanceAttestation","RelyingPartySolution","verifyTrustChain","getEntityConfiguration","getCredentialIssuerEntityConfiguration","getRelyingPartyEntityConfiguration","getTrustAnchorEntityConfiguration","getWalletProviderEntityConfiguration","RelyingPartyEntityConfiguration","WalletProviderEntityConfiguration","TrustAnchorEntityConfiguration","CredentialIssuerEntityConfiguration","createCryptoContextFor"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":"AAAA;AACA;AACA,OAAO,gCAAgC;AAEvC,OAAO,KAAKA,GAAG,MAAM,OAAO;AAC5B,OAAO,KAAKC,EAAE,MAAM,MAAM;AAC1B,OAAO,KAAKC,MAAM,MAAM,gBAAgB;AACxC,OAAO,KAAKC,yBAAyB,MAAM,+BAA+B;AAC1E,OAAO,KAAKC,oBAAoB,MAAM,MAAM;AAC5C,SACEC,gBAAgB,EAChBC,sBAAsB,EACtBC,sCAAsC,EACtCC,kCAAkC,EAClCC,iCAAiC,EACjCC,oCAAoC,QAC/B,SAAS;AAChB,SACEC,+BAA+B,EAC/BC,iCAAiC,EACjCC,8BAA8B,EAC9BC,mCAAmC,QAC9B,eAAe;AACtB,SAASC,sBAAsB,QAAQ,gBAAgB;AAEvD,SACEf,GAAG,EACHC,EAAE,EACFE,yBAAyB,EACzBD,MAAM,EACNE,oBAAoB,EACpBC,gBAAgB,EAChBC,sBAAsB,EACtBC,sCAAsC,EACtCC,kCAAkC,EAClCC,iCAAiC,EACjCC,oCAAoC,EACpCK,sBAAsB,EACtBJ,+BAA+B,EAC/BC,iCAAiC,EACjCC,8BAA8B,EAC9BC,mCAAmC"}
+{"version":3,"names":["Credential","PID","Errors","WalletInstanceAttestation","Trust","AuthorizationDetail","AuthorizationDetails","createCryptoContextFor"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":"AAAA;AACA;AACA,OAAO,gCAAgC;AAEvC,OAAO,KAAKA,UAAU,MAAM,cAAc;AAC1C,OAAO,KAAKC,GAAG,MAAM,OAAO;AAC5B,OAAO,KAAKC,MAAM,MAAM,gBAAgB;AACxC,OAAO,KAAKC,yBAAyB,MAAM,+BAA+B;AAC1E,OAAO,KAAKC,KAAK,MAAM,SAAS;AAChC,SAASC,mBAAmB,EAAEC,oBAAoB,QAAQ,aAAa;AACvE,SAASC,sBAAsB,QAAQ,gBAAgB;AAEvD,SACEN,GAAG,EACHD,UAAU,EACVG,yBAAyB,EACzBD,MAAM,EACNE,KAAK,EACLG,sBAAsB,EACtBF,mBAAmB,EACnBC,oBAAoB"}

package/lib/module/pid/index.js

@@ -1,4 +1,3 @@
 import * as SdJwt from "./sd-jwt";
-import * as Issuing from "./issuing";
-export { SdJwt, Issuing };
+export { SdJwt };
 //# sourceMappingURL=index.js.map

package/lib/module/pid/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["SdJwt","Issuing"],"sourceRoot":"../../../src","sources":["pid/index.ts"],"mappings":"AAAA,OAAO,KAAKA,KAAK,MAAM,UAAU;AACjC,OAAO,KAAKC,OAAO,MAAM,WAAW;AACpC,SAASD,KAAK,EAAEC,OAAO"}
+{"version":3,"names":["SdJwt"],"sourceRoot":"../../../src","sources":["pid/index.ts"],"mappings":"AAAA,OAAO,KAAKA,KAAK,MAAM,UAAU;AACjC,SAASA,KAAK"}

package/lib/module/sd-jwt/index.js

@@ -129,7 +129,7 @@ export const disclose = async (token, claims) => {
  *
  *
  * @param token The encoded token that represents a valid sd-jwt for verifiable credentials
- * @param publicKey The public key to validate the signature
+ * @param publicKey The single public key or an array of public keys to validate the signature.
  * @param schema Schema to use to parse the SD-JWT
  *
  * @returns The parsed SD-JWT token and the parsed disclosures

package/lib/module/sd-jwt/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["decode","decodeJwt","verify","verifyJwt","sha256ToBase64","decodeBase64","Disclosure","SdJwt4VC","verifyDisclosure","ClaimsNotFoundBetweenDislosures","ClaimsNotFoundInToken","decodeDisclosure","encoded","decoded","parse","JSON","token","schema","slice","rawSdJwt","rawDisclosures","split","decodedJwt","sdJwt","header","protectedHeader","payload","disclosures","map","disclose","claims","paths","Promise","all","claim","disclosure","find","_ref","name","hash","verified_claims","_sd","includes","index","indexOf","path","verification","filteredDisclosures","filter","d","disclosedToken","join","publicKey"],"sourceRoot":"../../../src","sources":["sd-jwt/index.ts"],"mappings":"AAEA,SAASA,MAAM,IAAIC,SAAS,QAAQ,6BAA6B;AACjE,SAASC,MAAM,IAAIC,SAAS,QAAQ,6BAA6B;AACjE,SAASC,cAAc,QAAQ,6BAA6B;AAE5D,SAASC,YAAY,QAAQ,6BAA6B;AAC1D,SAASC,UAAU,EAAEC,QAAQ,QAAoC,SAAS;AAC1E,SAASC,gBAAgB,QAAQ,YAAY;AAE7C,SACEC,+BAA+B,EAC/BC,qBAAqB,QAChB,iBAAiB;AAExB,MAAMC,gBAAgB,GAAIC,OAAe,IAA4B;EACnE,MAAMC,OAAO,GAAGP,UAAU,CAACQ,KAAK,CAACC,IAAI,CAACD,KAAK,CAACT,YAAY,CAACO,OAAO,CAAC,CAAC,CAAC;EACnE,OAAO;IAAEC,OAAO;IAAED;EAAQ,CAAC;AAC7B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMZ,MAAM,GAAGA,CACpBgB,KAAa,EACbC,MAAS,KAIN;EACH;EACA,IAAID,KAAK,CAACE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE;IAC3BF,KAAK,GAAGA,KAAK,CAACE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;EAC5B;EACA,MAAM,CAACC,QAAQ,GAAG,EAAE,EAAE,GAAGC,cAAc,CAAC,GAAGJ,KAAK,CAACK,KAAK,CAAC,GAAG,CAAC;;EAE3D;EACA;EACA,MAAMC,UAAU,GAAGrB,SAAS,CAACkB,QAAQ,CAAC;EACtC,MAAMI,KAAK,GAAGN,MAAM,CAACH,KAAK,CAAC;IACzBU,MAAM,EAAEF,UAAU,CAACG,eAAe;IAClCC,OAAO,EAAEJ,UAAU,CAACI;EACtB,CAAC,CAAC;;EAEF;EACA;EACA;EACA,MAAMC,WAAW,GAAGP,cAAc,CAACQ,GAAG,CAACjB,gBAAgB,CAAC;EAExD,OAAO;IAAEY,KAAK;IAAEI;EAAY,CAAC;AAC/B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAME,QAAQ,GAAG,MAAAA,CACtBb,KAAa,EACbc,MAAgB,KACyD;EACzE,MAAM,CAACX,QAAQ,EAAE,GAAGC,cAAc,CAAC,GAAGJ,KAAK,CAACK,KAAK,CAAC,GAAG,CAAC;EACtD,MAAM;IAAEE,KAAK;IAAEI;EAAY,CAAC,GAAG3B,MAAM,CAACgB,KAAK,EAAET,QAAQ,CAAC;;EAEtD;EACA,MAAMwB,KAAK,GAAG,MAAMC,OAAO,CAACC,GAAG,CAC7BH,MAAM,CAACF,GAAG,CAAC,MAAOM,KAAK,IAAK;IAC1B,MAAMC,UAAU,GAAGR,WAAW,CAACS,IAAI,CACjCC,IAAA;MAAA,IAAC;QAAExB,OAAO,EAAE,GAAGyB,IAAI;MAAE,CAAC,GAAAD,IAAA;MAAA,OAAKC,IAAI,KAAKJ,KAAK;IAAA,CAC3C,CAAC;;IAED;IACA,IAAI,CAACC,UAAU,EAAE;MACf,MAAM,IAAI1B,+BAA+B,CAACyB,KAAK,CAAC;IAClD;IAEA,MAAMK,IAAI,GAAG,MAAMnC,cAAc,CAAC+B,UAAU,CAACvB,OAAO,CAAC;;IAErD;IACA;IACA,IAAIW,KAAK,CAACG,OAAO,CAACc,eAAe,CAACV,MAAM,CAACW,GAAG,CAACC,QAAQ,CAACH,IAAI,CAAC,EAAE;MAC3D,MAAMI,KAAK,GAAGpB,KAAK,CAACG,OAAO,CAACc,eAAe,CAACV,MAAM,CAACW,GAAG,CAACG,OAAO,CAACL,IAAI,CAAC;MACpE,OAAO;QAAEL,KAAK;QAAEW,IAAI,EAAG,8BAA6BF,KAAM;MAAG,CAAC;IAChE,CAAC,MAAM,IACLpB,KAAK,CAACG,OAAO,CAACc,eAAe,CAACM,YAAY,CAACL,GAAG,CAACC,QAAQ,CAACH,IAAI,CAAC,EAC7D;MACA,MAAMI,KAAK,GACTpB,KAAK,CAACG,OAAO,CAACc,eAAe,CAACM,YAAY,CAACL,GAAG,CAACG,OAAO,CAACL,IAAI,CAAC;MAC9D,OAAO;QAAEL,KAAK;QAAEW,IAAI,EAAG,oCAAmCF,KAAM;MAAG,CAAC;IACtE;IAEA,MAAM,IAAIjC,qBAAqB,CAACwB,KAAK,CAAC;EACxC,CAAC,CACH,CAAC;EAED,MAAMa,mBAAmB,GAAG3B,cAAc,CAAC4B,MAAM,CAAEC,CAAC,IAAK;IACvD,MAAM;MACJpC,OAAO,EAAE,GAAGyB,IAAI;IAClB,CAAC,GAAG3B,gBAAgB,CAACsC,CAAC,CAAC;IACvB,OAAOnB,MAAM,CAACY,QAAQ,CAACJ,IAAI,CAAC;EAC9B,CAAC,CAAC;;EAEF;EACA,MAAMY,cAAc,GAAG,CAAC/B,QAAQ,EAAE,GAAG4B,mBAAmB,CAAC,CAACI,IAAI,CAAC,GAAG,CAAC;EAEnE,OAAO;IAAEnC,KAAK,EAAEkC,cAAc;IAAEnB;EAAM,CAAC;AACzC,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAM7B,MAAM,GAAG,MAAAA,CACpBc,KAAa,EACboC,SAAc,EACdnC,MAAS,KACqD;EAC9D;EACA,MAAM,CAACE,QAAQ,GAAG,EAAE,CAAC,GAAGH,KAAK,CAACK,KAAK,CAAC,GAAG,CAAC;EACxC,MAAMR,OAAO,GAAGb,MAAM,CAACgB,KAAK,EAAEC,MAAM,CAAC;;EAErC;EACA,MAAMd,SAAS,CAACgB,QAAQ,EAAEiC,SAAS,CAAC;;EAEpC;EACA,MAAMtB,MAAM,GAAG,CACb,GAAGjB,OAAO,CAACU,KAAK,CAACG,OAAO,CAACc,eAAe,CAACM,YAAY,CAACL,GAAG,EACzD,GAAG5B,OAAO,CAACU,KAAK,CAACG,OAAO,CAACc,eAAe,CAACV,MAAM,CAACW,GAAG,CACpD;EAED,MAAMT,OAAO,CAACC,GAAG,CACfpB,OAAO,CAACc,WAAW,CAACC,GAAG,CACrB,MAAOO,UAAU,IAAK,MAAM3B,gBAAgB,CAAC2B,UAAU,EAAEL,MAAM,CACjE,CACF,CAAC;EAED,OAAO;IACLP,KAAK,EAAEV,OAAO,CAACU,KAAK;IACpBI,WAAW,EAAEd,OAAO,CAACc,WAAW,CAACC,GAAG,CAAEqB,CAAC,IAAKA,CAAC,CAACpC,OAAO;EACvD,CAAC;AACH,CAAC"}
+{"version":3,"names":["decode","decodeJwt","verify","verifyJwt","sha256ToBase64","decodeBase64","Disclosure","SdJwt4VC","verifyDisclosure","ClaimsNotFoundBetweenDislosures","ClaimsNotFoundInToken","decodeDisclosure","encoded","decoded","parse","JSON","token","schema","slice","rawSdJwt","rawDisclosures","split","decodedJwt","sdJwt","header","protectedHeader","payload","disclosures","map","disclose","claims","paths","Promise","all","claim","disclosure","find","_ref","name","hash","verified_claims","_sd","includes","index","indexOf","path","verification","filteredDisclosures","filter","d","disclosedToken","join","publicKey"],"sourceRoot":"../../../src","sources":["sd-jwt/index.ts"],"mappings":"AAEA,SAASA,MAAM,IAAIC,SAAS,QAAQ,6BAA6B;AACjE,SAASC,MAAM,IAAIC,SAAS,QAAQ,6BAA6B;AACjE,SAASC,cAAc,QAAQ,6BAA6B;AAE5D,SAASC,YAAY,QAAQ,6BAA6B;AAC1D,SAASC,UAAU,EAAEC,QAAQ,QAAoC,SAAS;AAC1E,SAASC,gBAAgB,QAAQ,YAAY;AAE7C,SACEC,+BAA+B,EAC/BC,qBAAqB,QAChB,iBAAiB;AAExB,MAAMC,gBAAgB,GAAIC,OAAe,IAA4B;EACnE,MAAMC,OAAO,GAAGP,UAAU,CAACQ,KAAK,CAACC,IAAI,CAACD,KAAK,CAACT,YAAY,CAACO,OAAO,CAAC,CAAC,CAAC;EACnE,OAAO;IAAEC,OAAO;IAAED;EAAQ,CAAC;AAC7B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMZ,MAAM,GAAGA,CACpBgB,KAAa,EACbC,MAAS,KAIN;EACH;EACA,IAAID,KAAK,CAACE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE;IAC3BF,KAAK,GAAGA,KAAK,CAACE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;EAC5B;EACA,MAAM,CAACC,QAAQ,GAAG,EAAE,EAAE,GAAGC,cAAc,CAAC,GAAGJ,KAAK,CAACK,KAAK,CAAC,GAAG,CAAC;;EAE3D;EACA;EACA,MAAMC,UAAU,GAAGrB,SAAS,CAACkB,QAAQ,CAAC;EACtC,MAAMI,KAAK,GAAGN,MAAM,CAACH,KAAK,CAAC;IACzBU,MAAM,EAAEF,UAAU,CAACG,eAAe;IAClCC,OAAO,EAAEJ,UAAU,CAACI;EACtB,CAAC,CAAC;;EAEF;EACA;EACA;EACA,MAAMC,WAAW,GAAGP,cAAc,CAACQ,GAAG,CAACjB,gBAAgB,CAAC;EAExD,OAAO;IAAEY,KAAK;IAAEI;EAAY,CAAC;AAC/B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAME,QAAQ,GAAG,MAAAA,CACtBb,KAAa,EACbc,MAAgB,KACyD;EACzE,MAAM,CAACX,QAAQ,EAAE,GAAGC,cAAc,CAAC,GAAGJ,KAAK,CAACK,KAAK,CAAC,GAAG,CAAC;EACtD,MAAM;IAAEE,KAAK;IAAEI;EAAY,CAAC,GAAG3B,MAAM,CAACgB,KAAK,EAAET,QAAQ,CAAC;;EAEtD;EACA,MAAMwB,KAAK,GAAG,MAAMC,OAAO,CAACC,GAAG,CAC7BH,MAAM,CAACF,GAAG,CAAC,MAAOM,KAAK,IAAK;IAC1B,MAAMC,UAAU,GAAGR,WAAW,CAACS,IAAI,CACjCC,IAAA;MAAA,IAAC;QAAExB,OAAO,EAAE,GAAGyB,IAAI;MAAE,CAAC,GAAAD,IAAA;MAAA,OAAKC,IAAI,KAAKJ,KAAK;IAAA,CAC3C,CAAC;;IAED;IACA,IAAI,CAACC,UAAU,EAAE;MACf,MAAM,IAAI1B,+BAA+B,CAACyB,KAAK,CAAC;IAClD;IAEA,MAAMK,IAAI,GAAG,MAAMnC,cAAc,CAAC+B,UAAU,CAACvB,OAAO,CAAC;;IAErD;IACA;IACA,IAAIW,KAAK,CAACG,OAAO,CAACc,eAAe,CAACV,MAAM,CAACW,GAAG,CAACC,QAAQ,CAACH,IAAI,CAAC,EAAE;MAC3D,MAAMI,KAAK,GAAGpB,KAAK,CAACG,OAAO,CAACc,eAAe,CAACV,MAAM,CAACW,GAAG,CAACG,OAAO,CAACL,IAAI,CAAC;MACpE,OAAO;QAAEL,KAAK;QAAEW,IAAI,EAAG,8BAA6BF,KAAM;MAAG,CAAC;IAChE,CAAC,MAAM,IACLpB,KAAK,CAACG,OAAO,CAACc,eAAe,CAACM,YAAY,CAACL,GAAG,CAACC,QAAQ,CAACH,IAAI,CAAC,EAC7D;MACA,MAAMI,KAAK,GACTpB,KAAK,CAACG,OAAO,CAACc,eAAe,CAACM,YAAY,CAACL,GAAG,CAACG,OAAO,CAACL,IAAI,CAAC;MAC9D,OAAO;QAAEL,KAAK;QAAEW,IAAI,EAAG,oCAAmCF,KAAM;MAAG,CAAC;IACtE;IAEA,MAAM,IAAIjC,qBAAqB,CAACwB,KAAK,CAAC;EACxC,CAAC,CACH,CAAC;EAED,MAAMa,mBAAmB,GAAG3B,cAAc,CAAC4B,MAAM,CAAEC,CAAC,IAAK;IACvD,MAAM;MACJpC,OAAO,EAAE,GAAGyB,IAAI;IAClB,CAAC,GAAG3B,gBAAgB,CAACsC,CAAC,CAAC;IACvB,OAAOnB,MAAM,CAACY,QAAQ,CAACJ,IAAI,CAAC;EAC9B,CAAC,CAAC;;EAEF;EACA,MAAMY,cAAc,GAAG,CAAC/B,QAAQ,EAAE,GAAG4B,mBAAmB,CAAC,CAACI,IAAI,CAAC,GAAG,CAAC;EAEnE,OAAO;IAAEnC,KAAK,EAAEkC,cAAc;IAAEnB;EAAM,CAAC;AACzC,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAM7B,MAAM,GAAG,MAAAA,CACpBc,KAAa,EACboC,SAAsB,EACtBnC,MAAS,KACqD;EAC9D;EACA,MAAM,CAACE,QAAQ,GAAG,EAAE,CAAC,GAAGH,KAAK,CAACK,KAAK,CAAC,GAAG,CAAC;EACxC,MAAMR,OAAO,GAAGb,MAAM,CAACgB,KAAK,EAAEC,MAAM,CAAC;;EAErC;EACA,MAAMd,SAAS,CAACgB,QAAQ,EAAEiC,SAAS,CAAC;;EAEpC;EACA,MAAMtB,MAAM,GAAG,CACb,GAAGjB,OAAO,CAACU,KAAK,CAACG,OAAO,CAACc,eAAe,CAACM,YAAY,CAACL,GAAG,EACzD,GAAG5B,OAAO,CAACU,KAAK,CAACG,OAAO,CAACc,eAAe,CAACV,MAAM,CAACW,GAAG,CACpD;EAED,MAAMT,OAAO,CAACC,GAAG,CACfpB,OAAO,CAACc,WAAW,CAACC,GAAG,CACrB,MAAOO,UAAU,IAAK,MAAM3B,gBAAgB,CAAC2B,UAAU,EAAEL,MAAM,CACjE,CACF,CAAC;EAED,OAAO;IACLP,KAAK,EAAEV,OAAO,CAACU,KAAK;IACpBI,WAAW,EAAEd,OAAO,CAACc,WAAW,CAACC,GAAG,CAAEqB,CAAC,IAAKA,CAAC,CAACpC,OAAO;EACvD,CAAC;AACH,CAAC"}

package/lib/module/sd-jwt/types.js

@@ -40,7 +40,7 @@ export const SdJwt4VC = z.object({
     cnf: z.object({
       jwk: JWK
     }),
-    type: z.literal("PersonIdentificationData"),
+    type: z.string(),
     verified_claims: z.object({
       verification: z.intersection(z.object({
         trust_framework: z.literal("eidas"),

package/lib/module/sd-jwt/types.js.map

@@ -1 +1 @@
-{"version":3,"names":["JWK","z","UnixTime","number","min","max","ObfuscatedDisclosures","object","_sd","array","string","Disclosure","tuple","unknown","SdJwt4VC","header","typ","literal","alg","kid","optional","trust_chain","payload","iss","sub","jti","iat","exp","status","cnf","jwk","type","verified_claims","verification","intersection","trust_framework","assurance_level","claims","_sd_alg"],"sourceRoot":"../../../src","sources":["sd-jwt/types.ts"],"mappings":"AAAA,SAASA,GAAG,QAAQ,cAAc;AAClC,SAASC,CAAC,QAAQ,KAAK;AAEvB,OAAO,MAAMC,QAAQ,GAAGD,CAAC,CAACE,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAAC,CAACC,GAAG,CAAC,aAAa,CAAC;AAI5D,OAAO,MAAMC,qBAAqB,GAAGL,CAAC,CAACM,MAAM,CAAC;EAAEC,GAAG,EAAEP,CAAC,CAACQ,KAAK,CAACR,CAAC,CAACS,MAAM,CAAC,CAAC;AAAE,CAAC,CAAC;;AAE3E;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAO,MAAMC,UAAU,GAAGV,CAAC,CAACW,KAAK,CAAC,CAChC,UAAWX,CAAC,CAACS,MAAM,CAAC,CAAC,EACrB,gBAAiBT,CAAC,CAACS,MAAM,CAAC,CAAC,EAC3B,iBAAkBT,CAAC,CAACY,OAAO,CAAC,CAAC,CAC9B,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA,OAAO,MAAMC,QAAQ,GAAGb,CAAC,CAACM,MAAM,CAAC;EAC/BQ,MAAM,EAAEd,CAAC,CAACM,MAAM,CAAC;IACfS,GAAG,EAAEf,CAAC,CAACgB,OAAO,CAAC,WAAW,CAAC;IAC3BC,GAAG,EAAEjB,CAAC,CAACS,MAAM,CAAC,CAAC;IACfS,GAAG,EAAElB,CAAC,CAACS,MAAM,CAAC,CAAC,CAACU,QAAQ,CAAC,CAAC;IAC1BC,WAAW,EAAEpB,CAAC,CAACQ,KAAK,CAACR,CAAC,CAACS,MAAM,CAAC,CAAC;EACjC,CAAC,CAAC;EACFY,OAAO,EAAErB,CAAC,CAACM,MAAM,CAAC;IAChBgB,GAAG,EAAEtB,CAAC,CAACS,MAAM,CAAC,CAAC;IACfc,GAAG,EAAEvB,CAAC,CAACS,MAAM,CAAC,CAAC;IACfe,GAAG,EAAExB,CAAC,CAACS,MAAM,CAAC,CAAC;IACfgB,GAAG,EAAExB,QAAQ;IACbyB,GAAG,EAAEzB,QAAQ;IACb0B,MAAM,EAAE3B,CAAC,CAACS,MAAM,CAAC,CAAC;IAClBmB,GAAG,EAAE5B,CAAC,CAACM,MAAM,CAAC;MACZuB,GAAG,EAAE9B;IACP,CAAC,CAAC;IACF+B,IAAI,EAAE9B,CAAC,CAACgB,OAAO,CAAC,0BAA0B,CAAC;IAC3Ce,eAAe,EAAE/B,CAAC,CAACM,MAAM,CAAC;MACxB0B,YAAY,EAAEhC,CAAC,CAACiC,YAAY,CAC1BjC,CAAC,CAACM,MAAM,CAAC;QACP4B,eAAe,EAAElC,CAAC,CAACgB,OAAO,CAAC,OAAO,CAAC;QACnCmB,eAAe,EAAEnC,CAAC,CAACS,MAAM,CAAC;MAC5B,CAAC,CAAC,EACFJ,qBACF,CAAC;MACD+B,MAAM,EAAE/B;IACV,CAAC,CAAC;IACFgC,OAAO,EAAErC,CAAC,CAACgB,OAAO,CAAC,SAAS;EAC9B,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"names":["JWK","z","UnixTime","number","min","max","ObfuscatedDisclosures","object","_sd","array","string","Disclosure","tuple","unknown","SdJwt4VC","header","typ","literal","alg","kid","optional","trust_chain","payload","iss","sub","jti","iat","exp","status","cnf","jwk","type","verified_claims","verification","intersection","trust_framework","assurance_level","claims","_sd_alg"],"sourceRoot":"../../../src","sources":["sd-jwt/types.ts"],"mappings":"AAAA,SAASA,GAAG,QAAQ,cAAc;AAClC,SAASC,CAAC,QAAQ,KAAK;AAEvB,OAAO,MAAMC,QAAQ,GAAGD,CAAC,CAACE,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAAC,CAACC,GAAG,CAAC,aAAa,CAAC;AAI5D,OAAO,MAAMC,qBAAqB,GAAGL,CAAC,CAACM,MAAM,CAAC;EAAEC,GAAG,EAAEP,CAAC,CAACQ,KAAK,CAACR,CAAC,CAACS,MAAM,CAAC,CAAC;AAAE,CAAC,CAAC;;AAE3E;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAO,MAAMC,UAAU,GAAGV,CAAC,CAACW,KAAK,CAAC,CAChC,UAAWX,CAAC,CAACS,MAAM,CAAC,CAAC,EACrB,gBAAiBT,CAAC,CAACS,MAAM,CAAC,CAAC,EAC3B,iBAAkBT,CAAC,CAACY,OAAO,CAAC,CAAC,CAC9B,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA,OAAO,MAAMC,QAAQ,GAAGb,CAAC,CAACM,MAAM,CAAC;EAC/BQ,MAAM,EAAEd,CAAC,CAACM,MAAM,CAAC;IACfS,GAAG,EAAEf,CAAC,CAACgB,OAAO,CAAC,WAAW,CAAC;IAC3BC,GAAG,EAAEjB,CAAC,CAACS,MAAM,CAAC,CAAC;IACfS,GAAG,EAAElB,CAAC,CAACS,MAAM,CAAC,CAAC,CAACU,QAAQ,CAAC,CAAC;IAC1BC,WAAW,EAAEpB,CAAC,CAACQ,KAAK,CAACR,CAAC,CAACS,MAAM,CAAC,CAAC;EACjC,CAAC,CAAC;EACFY,OAAO,EAAErB,CAAC,CAACM,MAAM,CAAC;IAChBgB,GAAG,EAAEtB,CAAC,CAACS,MAAM,CAAC,CAAC;IACfc,GAAG,EAAEvB,CAAC,CAACS,MAAM,CAAC,CAAC;IACfe,GAAG,EAAExB,CAAC,CAACS,MAAM,CAAC,CAAC;IACfgB,GAAG,EAAExB,QAAQ;IACbyB,GAAG,EAAEzB,QAAQ;IACb0B,MAAM,EAAE3B,CAAC,CAACS,MAAM,CAAC,CAAC;IAClBmB,GAAG,EAAE5B,CAAC,CAACM,MAAM,CAAC;MACZuB,GAAG,EAAE9B;IACP,CAAC,CAAC;IACF+B,IAAI,EAAE9B,CAAC,CAACS,MAAM,CAAC,CAAC;IAChBsB,eAAe,EAAE/B,CAAC,CAACM,MAAM,CAAC;MACxB0B,YAAY,EAAEhC,CAAC,CAACiC,YAAY,CAC1BjC,CAAC,CAACM,MAAM,CAAC;QACP4B,eAAe,EAAElC,CAAC,CAACgB,OAAO,CAAC,OAAO,CAAC;QACnCmB,eAAe,EAAEnC,CAAC,CAACS,MAAM,CAAC;MAC5B,CAAC,CAAC,EACFJ,qBACF,CAAC;MACD+B,MAAM,EAAE/B;IACV,CAAC,CAAC;IACFgC,OAAO,EAAErC,CAAC,CAACgB,OAAO,CAAC,SAAS;EAC9B,CAAC;AACH,CAAC,CAAC"}

package/lib/module/trust/chain.js

@@ -2,6 +2,7 @@ import { decode as decodeJwt, verify as verifyJwt } from "@pagopa/io-react-nativ
 import { EntityConfiguration, EntityStatement, TrustAnchorEntityConfiguration } from "./types";
 import { IoWalletError } from "../utils/errors";
 import * as z from "zod";
+import { getSignedEntityConfiguration, getSignedEntityStatement } from ".";
 // Verify a token signature
 // The kid is extracted from the token header
 const verify = async (token, kid, jwks) => {
@@ -40,12 +41,12 @@ const LastElementShape = z.union([EntityStatement, TrustAnchorEntityConfiguratio
 /**
  * Validates a provided trust chain against a known trust
  *
- * @param trustAnchorEntity
- * @param chain
+ * @param trustAnchorEntity The entity configuration of the known trust anchor
+ * @param chain The chain of statements to be validate
  * @returns The list of parsed token representing the chain
  * @throws {IoWalletError} If the chain is not valid
  */
-export async function verifyTrustChain(trustAnchorEntity, chain) {
+export async function validateTrustChain(trustAnchorEntity, chain) {
   // If the chain is empty, fail
   if (chain.length === 0) {
     throw new IoWalletError("Cannot verify empty trust chain");
@@ -83,4 +84,30 @@ export async function verifyTrustChain(trustAnchorEntity, chain) {
   // If there is no next, hence it's the end of the chain and it must be verified by the Trust Anchor
   return Promise.all(chain.map((token, i) => [token, selectKid(i), selectKeys(i)]).map(args => verify(...args)));
 }
+
+/**
+ * Given a trust chain, obtain a new trust chain by fetching each element's fresh version
+ *
+ * @param chain The original chain
+ * @param appFetch (optional) fetch api implementation
+ * @returns A list of signed token that reprensent the trust chain, in the same order of the provided chain
+ * @throws When an element of the chain fails to parse
+ */
+export function renewTrustChain(chain) {
+  let appFetch = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : fetch;
+  return Promise.all(chain
+  // Decode each item to determine its shape
+  .map(decode).map(e => [EntityStatement.safeParse(e), EntityConfiguration.safeParse(e)])
+  // fetch the element according to its shape
+  .map((_ref, i) => {
+    let [es, ec] = _ref;
+    return ec.success ? getSignedEntityConfiguration(ec.data.payload.iss, {
+      appFetch
+    }) : es.success ? getSignedEntityStatement(es.data.payload.iss, es.data.payload.sub, {
+      appFetch
+    }) :
+    // if the element fail to parse in both EntityStatement and EntityConfiguration, raise an error
+    Promise.reject(new IoWalletError(`Cannot renew trust chain because the element #${i} failed to be parsed.`));
+  }));
+}
 //# sourceMappingURL=chain.js.map

package/lib/module/trust/chain.js.map

@@ -1 +1 @@
-{"version":3,"names":["decode","decodeJwt","verify","verifyJwt","EntityConfiguration","EntityStatement","TrustAnchorEntityConfiguration","IoWalletError","z","token","kid","jwks","jwk","find","k","Error","protectedHeader","header","payload","FirstElementShape","MiddleElementShape","LastElementShape","union","verifyTrustChain","trustAnchorEntity","chain","length","selectTokenShape","elementIndex","selectKid","currentIndex","shape","parse","selectKeys","keys","nextIndex","nextToken","Promise","all","map","i","args"],"sourceRoot":"../../../src","sources":["trust/chain.ts"],"mappings":"AAAA,SACEA,MAAM,IAAIC,SAAS,EACnBC,MAAM,IAAIC,SAAS,QACd,6BAA6B;AACpC,SACEC,mBAAmB,EACnBC,eAAe,EACfC,8BAA8B,QACzB,SAAS;AAEhB,SAASC,aAAa,QAAQ,iBAAiB;AAC/C,OAAO,KAAKC,CAAC,MAAM,KAAK;AAQxB;AACA;AACA,MAAMN,MAAM,GAAG,MAAAA,CACbO,KAAa,EACbC,GAAW,EACXC,IAAW,KACc;EACzB,MAAMC,GAAG,GAAGD,IAAI,CAACE,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACJ,GAAG,KAAKA,GAAG,CAAC;EAC3C,IAAI,CAACE,GAAG,EAAE;IACR,MAAM,IAAIG,KAAK,CAAE,gBAAeL,GAAI,YAAWD,KAAM,EAAC,CAAC;EACzD;EACA,MAAM;IAAEO,eAAe,EAAEC,MAAM;IAAEC;EAAQ,CAAC,GAAG,MAAMf,SAAS,CAACM,KAAK,EAAEG,GAAG,CAAC;EACxE,OAAO;IAAEK,MAAM;IAAEC;EAAQ,CAAC;AAC5B,CAAC;AAED,MAAMlB,MAAM,GAAIS,KAAa,IAAK;EAChC,MAAM;IAAEO,eAAe,EAAEC,MAAM;IAAEC;EAAQ,CAAC,GAAGjB,SAAS,CAACQ,KAAK,CAAC;EAC7D,OAAO;IAAEQ,MAAM;IAAEC;EAAQ,CAAC;AAC5B,CAAC;;AAED;AACA,MAAMC,iBAAiB,GAAGf,mBAAmB;AAC7C;AACA,MAAMgB,kBAAkB,GAAGf,eAAe;AAC1C;AACA;AACA,MAAMgB,gBAAgB,GAAGb,CAAC,CAACc,KAAK,CAAC,CAC/BjB,eAAe,EACfC,8BAA8B,CAC/B,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeiB,gBAAgBA,CACpCC,iBAAiD,EACjDC,KAAe,EACS;EACxB;EACA,IAAIA,KAAK,CAACC,MAAM,KAAK,CAAC,EAAE;IACtB,MAAM,IAAInB,aAAa,CAAC,iCAAiC,CAAC;EAC5D;;EAEA;EACA,MAAMoB,gBAAgB,GAAIC,YAAoB,IAC5CA,YAAY,KAAK,CAAC,GACdT,iBAAiB,GACjBS,YAAY,KAAKH,KAAK,CAACC,MAAM,GAAG,CAAC,GACjCL,gBAAgB,GAChBD,kBAAkB;;EAExB;EACA,MAAMS,SAAS,GAAIC,YAAoB,IAAa;IAClD,MAAMrB,KAAK,GAAGgB,KAAK,CAACK,YAAY,CAAC;IACjC,IAAI,CAACrB,KAAK,EAAE;MACV,MAAM,IAAIF,aAAa,CAAE,gCAA+B,CAAC;IAC3D;IACA,MAAMwB,KAAK,GAAGJ,gBAAgB,CAACG,YAAY,CAAC;IAC5C,OAAOC,KAAK,CAACC,KAAK,CAAChC,MAAM,CAACS,KAAK,CAAC,CAAC,CAACQ,MAAM,CAACP,GAAG;EAC9C,CAAC;;EAED;EACA;EACA,MAAMuB,UAAU,GAAIH,YAAoB,IAAY;IAClD,IAAIA,YAAY,KAAKL,KAAK,CAACC,MAAM,GAAG,CAAC,EAAE;MACrC,OAAOF,iBAAiB,CAACN,OAAO,CAACP,IAAI,CAACuB,IAAI;IAC5C;IAEA,MAAMC,SAAS,GAAGL,YAAY,GAAG,CAAC;IAClC,MAAMM,SAAS,GAAGX,KAAK,CAACU,SAAS,CAAC;IAClC,IAAI,CAACC,SAAS,EAAE;MACd,MAAM,IAAI7B,aAAa,CAAE,qCAAoC,CAAC;IAChE;IACA,MAAMwB,KAAK,GAAGJ,gBAAgB,CAACQ,SAAS,CAAC;IACzC,OAAOJ,KAAK,CAACC,KAAK,CAAChC,MAAM,CAACoC,SAAS,CAAC,CAAC,CAAClB,OAAO,CAACP,IAAI,CAACuB,IAAI;EACzD,CAAC;;EAED;EACA;EACA,OAAOG,OAAO,CAACC,GAAG,CAChBb,KAAK,CACFc,GAAG,CAAC,CAAC9B,KAAK,EAAE+B,CAAC,KAAK,CAAC/B,KAAK,EAAEoB,SAAS,CAACW,CAAC,CAAC,EAAEP,UAAU,CAACO,CAAC,CAAC,CAAU,CAAC,CAChED,GAAG,CAAEE,IAAI,IAAKvC,MAAM,CAAC,GAAGuC,IAAI,CAAC,CAClC,CAAC;AACH"}
+{"version":3,"names":["decode","decodeJwt","verify","verifyJwt","EntityConfiguration","EntityStatement","TrustAnchorEntityConfiguration","IoWalletError","z","getSignedEntityConfiguration","getSignedEntityStatement","token","kid","jwks","jwk","find","k","Error","protectedHeader","header","payload","FirstElementShape","MiddleElementShape","LastElementShape","union","validateTrustChain","trustAnchorEntity","chain","length","selectTokenShape","elementIndex","selectKid","currentIndex","shape","parse","selectKeys","keys","nextIndex","nextToken","Promise","all","map","i","args","renewTrustChain","appFetch","arguments","undefined","fetch","e","safeParse","_ref","es","ec","success","data","iss","sub","reject"],"sourceRoot":"../../../src","sources":["trust/chain.ts"],"mappings":"AAAA,SACEA,MAAM,IAAIC,SAAS,EACnBC,MAAM,IAAIC,SAAS,QACd,6BAA6B;AACpC,SACEC,mBAAmB,EACnBC,eAAe,EACfC,8BAA8B,QACzB,SAAS;AAEhB,SAASC,aAAa,QAAQ,iBAAiB;AAC/C,OAAO,KAAKC,CAAC,MAAM,KAAK;AAExB,SAASC,4BAA4B,EAAEC,wBAAwB,QAAQ,GAAG;AAO1E;AACA;AACA,MAAMR,MAAM,GAAG,MAAAA,CACbS,KAAa,EACbC,GAAW,EACXC,IAAW,KACc;EACzB,MAAMC,GAAG,GAAGD,IAAI,CAACE,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACJ,GAAG,KAAKA,GAAG,CAAC;EAC3C,IAAI,CAACE,GAAG,EAAE;IACR,MAAM,IAAIG,KAAK,CAAE,gBAAeL,GAAI,YAAWD,KAAM,EAAC,CAAC;EACzD;EACA,MAAM;IAAEO,eAAe,EAAEC,MAAM;IAAEC;EAAQ,CAAC,GAAG,MAAMjB,SAAS,CAACQ,KAAK,EAAEG,GAAG,CAAC;EACxE,OAAO;IAAEK,MAAM;IAAEC;EAAQ,CAAC;AAC5B,CAAC;AAED,MAAMpB,MAAM,GAAIW,KAAa,IAAK;EAChC,MAAM;IAAEO,eAAe,EAAEC,MAAM;IAAEC;EAAQ,CAAC,GAAGnB,SAAS,CAACU,KAAK,CAAC;EAC7D,OAAO;IAAEQ,MAAM;IAAEC;EAAQ,CAAC;AAC5B,CAAC;;AAED;AACA,MAAMC,iBAAiB,GAAGjB,mBAAmB;AAC7C;AACA,MAAMkB,kBAAkB,GAAGjB,eAAe;AAC1C;AACA;AACA,MAAMkB,gBAAgB,GAAGf,CAAC,CAACgB,KAAK,CAAC,CAC/BnB,eAAe,EACfC,8BAA8B,CAC/B,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAemB,kBAAkBA,CACtCC,iBAAiD,EACjDC,KAAe,EACS;EACxB;EACA,IAAIA,KAAK,CAACC,MAAM,KAAK,CAAC,EAAE;IACtB,MAAM,IAAIrB,aAAa,CAAC,iCAAiC,CAAC;EAC5D;;EAEA;EACA,MAAMsB,gBAAgB,GAAIC,YAAoB,IAC5CA,YAAY,KAAK,CAAC,GACdT,iBAAiB,GACjBS,YAAY,KAAKH,KAAK,CAACC,MAAM,GAAG,CAAC,GACjCL,gBAAgB,GAChBD,kBAAkB;;EAExB;EACA,MAAMS,SAAS,GAAIC,YAAoB,IAAa;IAClD,MAAMrB,KAAK,GAAGgB,KAAK,CAACK,YAAY,CAAC;IACjC,IAAI,CAACrB,KAAK,EAAE;MACV,MAAM,IAAIJ,aAAa,CAAE,gCAA+B,CAAC;IAC3D;IACA,MAAM0B,KAAK,GAAGJ,gBAAgB,CAACG,YAAY,CAAC;IAC5C,OAAOC,KAAK,CAACC,KAAK,CAAClC,MAAM,CAACW,KAAK,CAAC,CAAC,CAACQ,MAAM,CAACP,GAAG;EAC9C,CAAC;;EAED;EACA;EACA,MAAMuB,UAAU,GAAIH,YAAoB,IAAY;IAClD,IAAIA,YAAY,KAAKL,KAAK,CAACC,MAAM,GAAG,CAAC,EAAE;MACrC,OAAOF,iBAAiB,CAACN,OAAO,CAACP,IAAI,CAACuB,IAAI;IAC5C;IAEA,MAAMC,SAAS,GAAGL,YAAY,GAAG,CAAC;IAClC,MAAMM,SAAS,GAAGX,KAAK,CAACU,SAAS,CAAC;IAClC,IAAI,CAACC,SAAS,EAAE;MACd,MAAM,IAAI/B,aAAa,CAAE,qCAAoC,CAAC;IAChE;IACA,MAAM0B,KAAK,GAAGJ,gBAAgB,CAACQ,SAAS,CAAC;IACzC,OAAOJ,KAAK,CAACC,KAAK,CAAClC,MAAM,CAACsC,SAAS,CAAC,CAAC,CAAClB,OAAO,CAACP,IAAI,CAACuB,IAAI;EACzD,CAAC;;EAED;EACA;EACA,OAAOG,OAAO,CAACC,GAAG,CAChBb,KAAK,CACFc,GAAG,CAAC,CAAC9B,KAAK,EAAE+B,CAAC,KAAK,CAAC/B,KAAK,EAAEoB,SAAS,CAACW,CAAC,CAAC,EAAEP,UAAU,CAACO,CAAC,CAAC,CAAU,CAAC,CAChED,GAAG,CAAEE,IAAI,IAAKzC,MAAM,CAAC,GAAGyC,IAAI,CAAC,CAClC,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,eAAeA,CAC7BjB,KAAe,EAEf;EAAA,IADAkB,QAA8B,GAAAC,SAAA,CAAAlB,MAAA,QAAAkB,SAAA,QAAAC,SAAA,GAAAD,SAAA,MAAGE,KAAK;EAEtC,OAAOT,OAAO,CAACC,GAAG,CAChBb;EACE;EAAA,CACCc,GAAG,CAACzC,MAAM,CAAC,CACXyC,GAAG,CACDQ,CAAC,IACA,CACE5C,eAAe,CAAC6C,SAAS,CAACD,CAAC,CAAC,EAC5B7C,mBAAmB,CAAC8C,SAAS,CAACD,CAAC,CAAC,CAEtC;EACA;EAAA,CACCR,GAAG,CAAC,CAAAU,IAAA,EAAWT,CAAC;IAAA,IAAX,CAACU,EAAE,EAAEC,EAAE,CAAC,GAAAF,IAAA;IAAA,OACZE,EAAE,CAACC,OAAO,GACN7C,4BAA4B,CAAC4C,EAAE,CAACE,IAAI,CAACnC,OAAO,CAACoC,GAAG,EAAE;MAAEX;IAAS,CAAC,CAAC,GAC/DO,EAAE,CAACE,OAAO,GACV5C,wBAAwB,CAAC0C,EAAE,CAACG,IAAI,CAACnC,OAAO,CAACoC,GAAG,EAAEJ,EAAE,CAACG,IAAI,CAACnC,OAAO,CAACqC,GAAG,EAAE;MACjEZ;IACF,CAAC,CAAC;IACF;IACAN,OAAO,CAACmB,MAAM,CACZ,IAAInD,aAAa,CACd,iDAAgDmC,CAAE,uBACrD,CACF,CAAC;EAAA,CACP,CACJ,CAAC;AACH"}

package/lib/module/trust/index.js

@@ -1,8 +1,51 @@
 import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
-import { WalletProviderEntityConfiguration, TrustAnchorEntityConfiguration, CredentialIssuerEntityConfiguration, RelyingPartyEntityConfiguration, EntityConfiguration } from "./types";
-import { IoWalletError } from "../utils/errors";
-import { verifyTrustChain } from "./chain";
-export { verifyTrustChain };
+import { WalletProviderEntityConfiguration, TrustAnchorEntityConfiguration, CredentialIssuerEntityConfiguration, RelyingPartyEntityConfiguration, EntityConfiguration, EntityStatement } from "./types";
+import { validateTrustChain, renewTrustChain } from "./chain";
+import { hasStatus } from "../utils/misc";
+/**
+ * Verify a given trust chain is actually valid.
+ * It can handle fast chain renewal, which means we try to fetch a fresh version of each statement.
+ *
+ * @param trustAnchorEntity The entity configuration of the known trust anchor
+ * @param chain The chain of statements to be validate
+ * @param options.renewOnFail Whether to renew the provided chain if the validation fails at first. Default: true
+ * @param options.appFetch Fetch api implementation. Default: the built-in implementation
+ * @returns The result of the chain validation
+ * @throws {IoWalletError} When either validation or renewal fail
+ */
+export async function verifyTrustChain(trustAnchorEntity, chain) {
+  let {
+    appFetch = fetch,
+    renewOnFail = true
+  } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
+  try {
+    return validateTrustChain(trustAnchorEntity, chain);
+  } catch (error) {
+    if (renewOnFail) {
+      const renewedChain = await renewTrustChain(chain, appFetch);
+      return validateTrustChain(trustAnchorEntity, renewedChain);
+    } else {
+      throw error;
+    }
+  }
+}
+
+/**
+ * Fetch the signed entity configuration token for an entity
+ *
+ * @param entityBaseUrl The url of the entity to fetch
+ * @param param.appFetch (optional) fetch api implemention
+ * @returns The signed Entity Configuration token
+ */
+export async function getSignedEntityConfiguration(entityBaseUrl) {
+  let {
+    appFetch = fetch
+  } = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  const wellKnownUrl = `${entityBaseUrl}/.well-known/openid-federation`;
+  return await appFetch(wellKnownUrl, {
+    method: "GET"
+  }).then(hasStatus(200)).then(res => res.text());
+}
 
 /**
  * Fetch and parse the entity configuration document for a given federation entity.
@@ -26,23 +69,63 @@ async function fetchAndParseEntityConfiguration(entityBaseUrl, schema) {
   let {
     appFetch = fetch
   } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
-  const wellKnownUrl = `${entityBaseUrl}/.well-known/openid-federation`;
-  const response = await appFetch(wellKnownUrl, {
-    method: "GET"
+  const responseText = await getSignedEntityConfiguration(entityBaseUrl, {
+    appFetch
+  });
+  const responseJwt = decodeJwt(responseText);
+  return schema.parse({
+    header: responseJwt.protectedHeader,
+    payload: responseJwt.payload
   });
-  if (response.status === 200) {
-    const responseText = await response.text();
-    const responseJwt = decodeJwt(responseText);
-    return schema.parse({
-      header: responseJwt.protectedHeader,
-      payload: responseJwt.payload
-    });
-  }
-  throw new IoWalletError(`Unable to obtain Entity Configuration at ${wellKnownUrl}. Response code: ${response.status}`);
 }
 export const getWalletProviderEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, WalletProviderEntityConfiguration, options);
 export const getCredentialIssuerEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, CredentialIssuerEntityConfiguration, options);
 export const getTrustAnchorEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, TrustAnchorEntityConfiguration, options);
 export const getRelyingPartyEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, RelyingPartyEntityConfiguration, options);
 export const getEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, EntityConfiguration, options);
+
+/**
+ * Fetch and parse the entity statement document for a given federation entity.
+ *
+ * @param accreditationBodyBaseUrl The base url of the accreditaion body which holds and signs the required entity statement
+ * @param subordinatedEntityBaseUrl The url that identifies the subordinate entity
+ * @param options.appFetch An optional instance of the http client to be used.
+ * @returns The parsed entity configuration object
+ * @throws {IoWalletError} If the http request fails
+ * @throws Parse error if the document is not in the expected shape.
+ */
+export async function getEntityStatement(accreditationBodyBaseUrl, subordinatedEntityBaseUrl) {
+  let {
+    appFetch = fetch
+  } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
+  const responseText = await getSignedEntityStatement(accreditationBodyBaseUrl, subordinatedEntityBaseUrl, {
+    appFetch
+  });
+  const responseJwt = decodeJwt(responseText);
+  return EntityStatement.parse({
+    header: responseJwt.protectedHeader,
+    payload: responseJwt.payload
+  });
+}
+
+/**
+ * Fetch the entity statement document for a given federation entity.
+ *
+ * @param accreditationBodyBaseUrl The base url of the accreditaion body which holds and signs the required entity statement
+ * @param subordinatedEntityBaseUrl The url that identifies the subordinate entity
+ * @param options.appFetch An optional instance of the http client to be used.
+ * @returns The signed entity statement token
+ * @throws {IoWalletError} If the http request fails
+ */
+export async function getSignedEntityStatement(accreditationBodyBaseUrl, subordinatedEntityBaseUrl) {
+  let {
+    appFetch = fetch
+  } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
+  const url = `${accreditationBodyBaseUrl}/fetch?${new URLSearchParams({
+    sub: subordinatedEntityBaseUrl
+  })}`;
+  return await appFetch(url, {
+    method: "GET"
+  }).then(hasStatus(200)).then(res => res.text());
+}
 //# sourceMappingURL=index.js.map

package/lib/module/trust/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["decode","decodeJwt","WalletProviderEntityConfiguration","TrustAnchorEntityConfiguration","CredentialIssuerEntityConfiguration","RelyingPartyEntityConfiguration","EntityConfiguration","IoWalletError","verifyTrustChain","fetchAndParseEntityConfiguration","entityBaseUrl","schema","appFetch","fetch","arguments","length","undefined","wellKnownUrl","response","method","status","responseText","text","responseJwt","parse","header","protectedHeader","payload","getWalletProviderEntityConfiguration","options","getCredentialIssuerEntityConfiguration","getTrustAnchorEntityConfiguration","getRelyingPartyEntityConfiguration","getEntityConfiguration"],"sourceRoot":"../../../src","sources":["trust/index.ts"],"mappings":"AAAA,SAASA,MAAM,IAAIC,SAAS,QAAQ,6BAA6B;AACjE,SACEC,iCAAiC,EACjCC,8BAA8B,EAC9BC,mCAAmC,EACnCC,+BAA+B,EAC/BC,mBAAmB,QACd,SAAS;AAChB,SAASC,aAAa,QAAQ,iBAAiB;AAC/C,SAASC,gBAAgB,QAAQ,SAAS;AAE1C,SAASA,gBAAgB;;AAEzB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoCA,eAAeC,gCAAgCA,CAC7CC,aAAqB,EACrBC,MAK8B,EAM9B;EAAA,IALA;IACEC,QAAQ,GAAGC;EAGb,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMG,YAAY,GAAI,GAAEP,aAAc,gCAA+B;EAErE,MAAMQ,QAAQ,GAAG,MAAMN,QAAQ,CAACK,YAAY,EAAE;IAC5CE,MAAM,EAAE;EACV,CAAC,CAAC;EAEF,IAAID,QAAQ,CAACE,MAAM,KAAK,GAAG,EAAE;IAC3B,MAAMC,YAAY,GAAG,MAAMH,QAAQ,CAACI,IAAI,CAAC,CAAC;IAC1C,MAAMC,WAAW,GAAGtB,SAAS,CAACoB,YAAY,CAAC;IAC3C,OAAOV,MAAM,CAACa,KAAK,CAAC;MAClBC,MAAM,EAAEF,WAAW,CAACG,eAAe;MACnCC,OAAO,EAAEJ,WAAW,CAACI;IACvB,CAAC,CAAC;EACJ;EAEA,MAAM,IAAIpB,aAAa,CACpB,4CAA2CU,YAAa,oBAAmBC,QAAQ,CAACE,MAAO,EAC9F,CAAC;AACH;AAEA,OAAO,MAAMQ,oCAAoC,GAAGA,CAClDlB,aAAqE,EACrEmB,OAAgE,KAEhEpB,gCAAgC,CAC9BC,aAAa,EACbR,iCAAiC,EACjC2B,OACF,CAAC;AAEH,OAAO,MAAMC,sCAAsC,GAAGA,CACpDpB,aAAqE,EACrEmB,OAAgE,KAEhEpB,gCAAgC,CAC9BC,aAAa,EACbN,mCAAmC,EACnCyB,OACF,CAAC;AAEH,OAAO,MAAME,iCAAiC,GAAGA,CAC/CrB,aAAqE,EACrEmB,OAAgE,KAEhEpB,gCAAgC,CAC9BC,aAAa,EACbP,8BAA8B,EAC9B0B,OACF,CAAC;AAEH,OAAO,MAAMG,kCAAkC,GAAGA,CAChDtB,aAAqE,EACrEmB,OAAgE,KAEhEpB,gCAAgC,CAC9BC,aAAa,EACbL,+BAA+B,EAC/BwB,OACF,CAAC;AAEH,OAAO,MAAMI,sBAAsB,GAAGA,CACpCvB,aAAqE,EACrEmB,OAAgE,KAEhEpB,gCAAgC,CAACC,aAAa,EAAEJ,mBAAmB,EAAEuB,OAAO,CAAC"}
+{"version":3,"names":["decode","decodeJwt","WalletProviderEntityConfiguration","TrustAnchorEntityConfiguration","CredentialIssuerEntityConfiguration","RelyingPartyEntityConfiguration","EntityConfiguration","EntityStatement","validateTrustChain","renewTrustChain","hasStatus","verifyTrustChain","trustAnchorEntity","chain","appFetch","fetch","renewOnFail","arguments","length","undefined","error","renewedChain","getSignedEntityConfiguration","entityBaseUrl","wellKnownUrl","method","then","res","text","fetchAndParseEntityConfiguration","schema","responseText","responseJwt","parse","header","protectedHeader","payload","getWalletProviderEntityConfiguration","options","getCredentialIssuerEntityConfiguration","getTrustAnchorEntityConfiguration","getRelyingPartyEntityConfiguration","getEntityConfiguration","getEntityStatement","accreditationBodyBaseUrl","subordinatedEntityBaseUrl","getSignedEntityStatement","url","URLSearchParams","sub"],"sourceRoot":"../../../src","sources":["trust/index.ts"],"mappings":"AAAA,SAASA,MAAM,IAAIC,SAAS,QAAQ,6BAA6B;AACjE,SACEC,iCAAiC,EACjCC,8BAA8B,EAC9BC,mCAAmC,EACnCC,+BAA+B,EAC/BC,mBAAmB,EACnBC,eAAe,QACV,SAAS;AAChB,SAASC,kBAAkB,EAAEC,eAAe,QAAQ,SAAS;AAC7D,SAASC,SAAS,QAAQ,eAAe;AAWzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,gBAAgBA,CACpCC,iBAAiD,EACjDC,KAAe,EAKiC;EAAA,IAJhD;IACEC,QAAQ,GAAGC,KAAK;IAChBC,WAAW,GAAG;EAC4C,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAElE,IAAI;IACF,OAAOT,kBAAkB,CAACI,iBAAiB,EAAEC,KAAK,CAAC;EACrD,CAAC,CAAC,OAAOO,KAAK,EAAE;IACd,IAAIJ,WAAW,EAAE;MACf,MAAMK,YAAY,GAAG,MAAMZ,eAAe,CAACI,KAAK,EAAEC,QAAQ,CAAC;MAC3D,OAAON,kBAAkB,CAACI,iBAAiB,EAAES,YAAY,CAAC;IAC5D,CAAC,MAAM;MACL,MAAMD,KAAK;IACb;EACF;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeE,4BAA4BA,CAChDC,aAAqB,EAMJ;EAAA,IALjB;IACET,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMO,YAAY,GAAI,GAAED,aAAc,gCAA+B;EAErE,OAAO,MAAMT,QAAQ,CAACU,YAAY,EAAE;IAClCC,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAAChB,SAAS,CAAC,GAAG,CAAC,CAAC,CACpBgB,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoCA,eAAeC,gCAAgCA,CAC7CN,aAAqB,EACrBO,MAK8B,EAM9B;EAAA,IALA;IACEhB,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMc,YAAY,GAAG,MAAMT,4BAA4B,CAACC,aAAa,EAAE;IACrET;EACF,CAAC,CAAC;EAEF,MAAMkB,WAAW,GAAG/B,SAAS,CAAC8B,YAAY,CAAC;EAC3C,OAAOD,MAAM,CAACG,KAAK,CAAC;IAClBC,MAAM,EAAEF,WAAW,CAACG,eAAe;IACnCC,OAAO,EAAEJ,WAAW,CAACI;EACvB,CAAC,CAAC;AACJ;AAEA,OAAO,MAAMC,oCAAoC,GAAGA,CAClDd,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAC9BN,aAAa,EACbrB,iCAAiC,EACjCoC,OACF,CAAC;AAEH,OAAO,MAAMC,sCAAsC,GAAGA,CACpDhB,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAC9BN,aAAa,EACbnB,mCAAmC,EACnCkC,OACF,CAAC;AAEH,OAAO,MAAME,iCAAiC,GAAGA,CAC/CjB,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAC9BN,aAAa,EACbpB,8BAA8B,EAC9BmC,OACF,CAAC;AAEH,OAAO,MAAMG,kCAAkC,GAAGA,CAChDlB,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAC9BN,aAAa,EACblB,+BAA+B,EAC/BiC,OACF,CAAC;AAEH,OAAO,MAAMI,sBAAsB,GAAGA,CACpCnB,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAACN,aAAa,EAAEjB,mBAAmB,EAAEgC,OAAO,CAAC;;AAE/E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeK,kBAAkBA,CACtCC,wBAAgC,EAChCC,yBAAiC,EAMjC;EAAA,IALA;IACE/B,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMc,YAAY,GAAG,MAAMe,wBAAwB,CACjDF,wBAAwB,EACxBC,yBAAyB,EACzB;IACE/B;EACF,CACF,CAAC;EAED,MAAMkB,WAAW,GAAG/B,SAAS,CAAC8B,YAAY,CAAC;EAC3C,OAAOxB,eAAe,CAAC0B,KAAK,CAAC;IAC3BC,MAAM,EAAEF,WAAW,CAACG,eAAe;IACnCC,OAAO,EAAEJ,WAAW,CAACI;EACvB,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeU,wBAAwBA,CAC5CF,wBAAgC,EAChCC,yBAAiC,EAMjC;EAAA,IALA;IACE/B,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAM8B,GAAG,GAAI,GAAEH,wBAAyB,UAAS,IAAII,eAAe,CAAC;IACnEC,GAAG,EAAEJ;EACP,CAAC,CAAE,EAAC;EAEJ,OAAO,MAAM/B,QAAQ,CAACiC,GAAG,EAAE;IACzBtB,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAAChB,SAAS,CAAC,GAAG,CAAC,CAAC,CACpBgB,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;AAC9B"}

package/lib/module/trust/types.js

@@ -5,6 +5,16 @@ export const TrustMark = z.object({
   id: z.string(),
   trust_mark: z.string()
 });
+const RelyingPartyMetadata = z.object({
+  application_type: z.string().optional(),
+  client_id: z.string().optional(),
+  client_name: z.string().optional(),
+  jwks: z.object({
+    keys: z.array(JWK)
+  }),
+  contacts: z.array(z.string()).optional()
+});
+//.passthrough();
 
 // Display metadata for a credential, used by the issuer to
 // instruct the Wallet Solution on how to render the credential correctly
@@ -18,14 +28,26 @@ const CredentialDisplayMetadata = z.object({
   background_color: z.string(),
   text_color: z.string()
 });
+const CredentialDefinitionMetadata = z.object({
+  type: z.array(z.string()),
+  credentialSubject: z.record(z.object({
+    mandatory: z.boolean(),
+    display: z.array(z.object({
+      name: z.string(),
+      locale: z.string()
+    }))
+  }))
+});
 
 // Metadata for a credentia which i supported by a Issuer
 
 const SupportedCredentialMetadata = z.object({
+  id: z.string(),
   format: z.literal("vc+sd-jwt"),
   cryptographic_binding_methods_supported: z.array(z.string()),
   cryptographic_suites_supported: z.array(z.string()),
-  display: z.array(CredentialDisplayMetadata)
+  display: z.array(CredentialDisplayMetadata),
+  credential_definition: CredentialDefinitionMetadata
 });
 export const EntityStatement = z.object({
   header: z.object({
@@ -49,6 +71,17 @@ export const EntityConfigurationHeader = z.object({
   alg: z.string(),
   kid: z.string()
 });
+const FederationEntityMetadata = z.object({
+  federation_fetch_endpoint: z.string().optional(),
+  federation_list_endpoint: z.string().optional(),
+  federation_resolve_endpoint: z.string().optional(),
+  federation_trust_mark_status_endpoint: z.string().optional(),
+  federation_trust_mark_list_endpoint: z.string().optional(),
+  homepage_uri: z.string().optional(),
+  policy_uri: z.string().optional(),
+  logo_uri: z.string().optional(),
+  contacts: z.array(z.string()).optional()
+}).passthrough();
 
 // Structuire common to every Entity Configuration document
 const BaseEntityConfiguration = z.object({
@@ -62,17 +95,7 @@ const BaseEntityConfiguration = z.object({
       keys: z.array(JWK)
     }),
     metadata: z.object({
-      federation_entity: z.object({
-        federation_fetch_endpoint: z.string().optional(),
-        federation_list_endpoint: z.string().optional(),
-        federation_resolve_endpoint: z.string().optional(),
-        federation_trust_mark_status_endpoint: z.string().optional(),
-        federation_trust_mark_list_endpoint: z.string().optional(),
-        homepage_uri: z.string().optional(),
-        policy_uri: z.string().optional(),
-        logo_uri: z.string().optional(),
-        contacts: z.array(z.string()).optional()
-      }).passthrough()
+      federation_entity: FederationEntityMetadata
     }).passthrough(),
     authority_hints: z.array(z.string()).optional()
   }).passthrough()
@@ -101,7 +124,21 @@ export const CredentialIssuerEntityConfiguration = BaseEntityConfiguration.and(z
         jwks: z.object({
           keys: z.array(JWK)
         })
-      })
+      }),
+      /** Credential Issuers act as Relying Party 
+          when they require the presentation of other credentials.
+          This does not apply for PID issuance, which requires CIE authz. */
+      wallet_relying_party: RelyingPartyMetadata.optional()
+    })
+  })
+}));
+
+// Entity configuration for a Relying Party
+
+export const RelyingPartyEntityConfiguration = BaseEntityConfiguration.and(z.object({
+  payload: z.object({
+    metadata: z.object({
+      wallet_relying_party: RelyingPartyMetadata
     })
   })
 }));
@@ -125,24 +162,6 @@ export const WalletProviderEntityConfiguration = BaseEntityConfiguration.and(z.o
   })
 }));
 
-// Entity configuration for a Relying Party
-
-export const RelyingPartyEntityConfiguration = BaseEntityConfiguration.and(z.object({
-  payload: z.object({
-    metadata: z.object({
-      wallet_relying_party: z.object({
-        application_type: z.string().optional(),
-        client_id: z.string().optional(),
-        client_name: z.string().optional(),
-        jwks: z.object({
-          keys: z.array(JWK)
-        }),
-        contacts: z.array(z.string()).optional()
-      }).passthrough()
-    })
-  })
-}));
-
 // Maps any entity configuration by the union of every possible shapes
 
 export const EntityConfiguration = z.union([WalletProviderEntityConfiguration, CredentialIssuerEntityConfiguration, TrustAnchorEntityConfiguration, RelyingPartyEntityConfiguration], {