@pagopa/io-react-native-wallet 0.7.4 → 0.9.0

package/README.md

@@ -46,43 +46,24 @@ This package is compatibile with any http client which implements [Fetch API](ht
 
 </details>
 
-### PID
+### Credential
 
-#### Issuing
+Credential Issuance and Presentation flows are defined in under `src/credential/issuance` and `src/credential/presentation`.
+Each flow exposes in the public API a function definition for each step. Some step also has an implementation; for those that have no implementation, the App is expected to fullfil.
+
+#### Issuance
 
 ```ts
-import {
-  PID,
-  createCryptoContextFor,
-  getCredentialIssuerEntityConfiguration,
-} from "@pagopa/io-react-native-wallet";
+import { Credential } from "@pagopa/io-react-native-wallet";
+
+// Retrieve Issuer configuration and evaluate trust
+const { issuerConf } = await Credential.Issuance.evaluateIssuerTrust(...);
+
+// Obtain the directions to perform user authorization
+const { clientId, requestUri } = await Credential.Issuance.startUserAuthorization(...);
 
-// Obtain PID metadata
-const pidEntityConfiguration = await getCredentialIssuerEntityConfiguration(
-  "https://pid-provider.example"
-);
 
-// Auth Token request
-const authRequest = PID.Issuing.authorizeIssuing({ wiaCryptoContext });
-const authConf = await authRequest(
-  /* signed instance attestation */ instanceAttestation,
-  /* the relative wallet provided */ walletProviderBaseUrl,
-  pidEntityConfiguration
-);
 
-// Credential request
-const credentialRequest = PID.Issuing.getCredential({ pidCryptoContext });
-const pid = await credentialRequest(
-  authConf,
-  pidEntityConfiguration,
-  /* Some personal data */
-  {
-    birthDate: "01/01/1990",
-    fiscalCode: "AAABBB00A00A000A",
-    name: "NAME",
-    surname: "SURNAME",
-  }
-);
 ```
 
 #### Encode and Decode
@@ -175,6 +156,43 @@ const result = await sendAuthorizationResponse(requestObj, [
 ]);
 ```
 
+### Trust Model
+
+#### Fetch federation entity statements
+
+```ts
+import {
+  // generic statement
+  getEntityStatement,
+  getEntityConfiguration,
+  // statement with shape parsing
+  getCredentialIssuerEntityConfiguration,
+  getRelyingPartyEntityConfiguration,
+  getTrustAnchorEntityConfiguration,
+  getWalletProviderEntityConfiguration,
+} from "@pagopa/io-react-native-wallet";
+```
+
+#### Validate trust
+
+```ts
+import {
+  verifyTrustChain,
+  getTrustAnchorEntityConfiguration,
+} from "@pagopa/io-react-native-wallet";
+
+const trustChain = ["ejJ0eX...", "eyG5eX...", "erU9eX..."];
+const trustChainEC = await getTrustAnchorEntityConfiguration(
+  "https://trust-anchor.example"
+);
+
+// Validate a given trust chain offline (no renewal on failures)
+await verifyTrustChain(trustChainEC, trustChain);
+
+// Validate a given trust chain online (try to renew on failures)
+await verifyTrustChain(trustChainEC, trustChain, { renewOnFail: true });
+```
+
 ## Example
 
 ### NodeJS and Ruby

package/lib/commonjs/credential/index.js

@@ -0,0 +1,13 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.Presentation = exports.Issuance = void 0;
+var Issuance = _interopRequireWildcard(require("./issuance"));
+exports.Issuance = Issuance;
+var Presentation = _interopRequireWildcard(require("./presentation"));
+exports.Presentation = Presentation;
+function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
+function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
+//# sourceMappingURL=index.js.map

package/lib/commonjs/credential/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["Issuance","_interopRequireWildcard","require","exports","Presentation","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set"],"sourceRoot":"../../../src","sources":["credential/index.ts"],"mappings":";;;;;;AAAA,IAAAA,QAAA,GAAAC,uBAAA,CAAAC,OAAA;AAAuCC,OAAA,CAAAH,QAAA,GAAAA,QAAA;AACvC,IAAAI,YAAA,GAAAH,uBAAA,CAAAC,OAAA;AAA+CC,OAAA,CAAAC,YAAA,GAAAA,YAAA;AAAA,SAAAC,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAL,wBAAAS,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA"}

package/lib/commonjs/credential/issuance/01-start-flow.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=01-start-flow.js.map

package/lib/commonjs/credential/issuance/01-start-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sourceRoot":"../../../../src","sources":["credential/issuance/01-start-flow.ts"],"mappings":""}

package/lib/commonjs/credential/issuance/02-evaluate-issuer-trust.js

@@ -0,0 +1,26 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.evaluateIssuerTrust = void 0;
+var _trust = require("../../trust");
+/**
+ * The Issuer trust evaluation phase.
+ * Fetch the Issuer's configuration and verify trust.
+ *
+ * @param issuerUrl The base url of the Issuer
+ * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
+ * @returns The Issuer's configuration
+ */
+const evaluateIssuerTrust = async function (issuerUrl) {
+  let context = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  const issuerConf = await (0, _trust.getCredentialIssuerEntityConfiguration)(issuerUrl, {
+    appFetch: context.appFetch
+  }).then(_ => _.payload.metadata);
+  return {
+    issuerConf
+  };
+};
+exports.evaluateIssuerTrust = evaluateIssuerTrust;
+//# sourceMappingURL=02-evaluate-issuer-trust.js.map

package/lib/commonjs/credential/issuance/02-evaluate-issuer-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_trust","require","evaluateIssuerTrust","issuerUrl","context","arguments","length","undefined","issuerConf","getCredentialIssuerEntityConfiguration","appFetch","then","_","payload","metadata","exports"],"sourceRoot":"../../../../src","sources":["credential/issuance/02-evaluate-issuer-trust.ts"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAcA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,mBAAwC,GAAG,eAAAA,CACtDC,SAAS,EAEN;EAAA,IADHC,OAAO,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEZ,MAAMG,UAAU,GAAG,MAAM,IAAAC,6CAAsC,EAACN,SAAS,EAAE;IACzEO,QAAQ,EAAEN,OAAO,CAACM;EACpB,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,OAAO,CAACC,QAAQ,CAAC;EAClC,OAAO;IAAEN;EAAW,CAAC;AACvB,CAAC;AAACO,OAAA,CAAAb,mBAAA,GAAAA,mBAAA"}

package/lib/commonjs/credential/issuance/03-start-user-authorization.js

@@ -0,0 +1,119 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.startUserAuthorization = void 0;
+var z = _interopRequireWildcard(require("zod"));
+var _reactNativeUuid = _interopRequireDefault(require("react-native-uuid"));
+var _par = require("../../utils/par");
+var _decoder = require("../../utils/decoder");
+var _misc = require("../../utils/misc");
+var _const = require("./const");
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
+function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
+const selectCredentialDefinition = (issuerConf, credentialType) => {
+  const {
+    credentials_supported
+  } = issuerConf.openid_credential_issuer;
+  const [result] = credentials_supported.filter(e => e.credential_definition.type.includes(credentialType)).map(e => ({
+    credential_definition: {
+      type: credentialType
+    },
+    format: e.format,
+    type: "openid_credential"
+  }));
+  if (!result) {
+    throw new Error(`No credential support the type '${credentialType}'`);
+  }
+  return result;
+};
+const decodeAuthorizationResponse = async raw => {
+  const {
+    decodedJwt: {
+      payload
+    }
+  } = await (0, _decoder.getJwtFromFormPost)(raw);
+
+  /**
+   * FIXME: [SIW-628] This step must not make any difference on the credential
+   * we are authorizing for, being a PID or any other (Q)EAA.
+   *
+   * Currently, PID issuer is implemented to skip the CompleteUserAuthorization step
+   * thus returning a stubbed (code, state) pair.
+   *
+   * This is a workaround to proceeed the flow anyway.
+   * If the response does not map what expected (CorrectShape),
+   * we try parse into (code, state) to check if we are in the PID scenario.
+   * In that case, a stub value is returned (will not be evaluated anyway).
+   *
+   * This workaround will be obsolete once the PID issuer fixes its implementation
+   */
+  const CorrectShape = z.object({
+    request_uri: z.string()
+  });
+  const WrongShapeForPID = z.object({
+    code: z.string(),
+    state: z.string()
+  });
+  const [correct, wrong] = [CorrectShape.safeParse(payload), WrongShapeForPID.safeParse(payload)];
+  if (correct.success) {
+    return correct.data;
+  } else if (wrong.success) {
+    return {
+      request_uri: "https://fake-request-uri"
+    };
+  }
+  throw correct.error;
+};
+/**
+ * Start the User authorization phase.
+ * Perform the Pushed Authorization Request as defined in OAuth 2.0 protocol.
+ *
+ * @param issuerConf The Issuer configuration
+ * @param credentialType The type of the credential to be requested
+ * @param context.wiaCryptoContext The context to access the key associated with the Wallet Instance Attestation
+ * @param context.walletInstanceAttestation The Wallet Instance Attestation token
+ * @param context.walletProviderBaseUrl The base url of the Wallet Provider
+ * @param context.additionalParams Hash set of parameters to be passed to the authorization endpoint
+ * (used as a temporary fix until we have a proper User identity in the PID token provider)
+ * TODO: [SIW-630]
+ * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
+ * @returns The request uri to continue the authorization to
+ */
+const startUserAuthorization = async (issuerConf, credentialType, ctx) => {
+  const {
+    wiaCryptoContext,
+    walletInstanceAttestation,
+    walletProviderBaseUrl,
+    additionalParams = {},
+    appFetch = fetch
+  } = ctx;
+  const clientId = await wiaCryptoContext.getPublicKey().then(_ => _.kid);
+  const codeVerifier = `${_reactNativeUuid.default.v4()}`;
+  // Make a PAR request to the credential issuer and return the response url
+  const parUrl = issuerConf.openid_credential_issuer.pushed_authorization_request_endpoint;
+  const getPar = (0, _par.makeParRequest)({
+    wiaCryptoContext,
+    appFetch
+  });
+  const issuerRequestUri = await getPar(clientId, codeVerifier, walletProviderBaseUrl, parUrl, walletInstanceAttestation, [selectCredentialDefinition(issuerConf, credentialType)], _const.ASSERTION_TYPE);
+
+  // Initialize authorization by requesting the authz request uri
+  const authzRequestEndpoint = issuerConf.openid_credential_issuer.authorization_endpoint;
+  const params = new URLSearchParams({
+    client_id: clientId,
+    request_uri: issuerRequestUri,
+    ...additionalParams
+  });
+  const {
+    request_uri
+  } = await appFetch(`${authzRequestEndpoint}?${params}`).then((0, _misc.hasStatus)(200)).then(res => res.text()).then(decodeAuthorizationResponse);
+  return {
+    requestUri: request_uri,
+    clientId
+  };
+};
+exports.startUserAuthorization = startUserAuthorization;
+//# sourceMappingURL=03-start-user-authorization.js.map

package/lib/commonjs/credential/issuance/03-start-user-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["z","_interopRequireWildcard","require","_reactNativeUuid","_interopRequireDefault","_par","_decoder","_misc","_const","obj","__esModule","default","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","selectCredentialDefinition","issuerConf","credentialType","credentials_supported","openid_credential_issuer","result","filter","e","credential_definition","type","includes","map","format","Error","decodeAuthorizationResponse","raw","decodedJwt","payload","getJwtFromFormPost","CorrectShape","object","request_uri","string","WrongShapeForPID","code","state","correct","wrong","safeParse","success","data","error","startUserAuthorization","ctx","wiaCryptoContext","walletInstanceAttestation","walletProviderBaseUrl","additionalParams","appFetch","fetch","clientId","getPublicKey","then","_","kid","codeVerifier","uuid","v4","parUrl","pushed_authorization_request_endpoint","getPar","makeParRequest","issuerRequestUri","ASSERTION_TYPE","authzRequestEndpoint","authorization_endpoint","params","URLSearchParams","client_id","hasStatus","res","text","requestUri","exports"],"sourceRoot":"../../../../src","sources":["credential/issuance/03-start-user-authorization.ts"],"mappings":";;;;;;AAAA,IAAAA,CAAA,GAAAC,uBAAA,CAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAC,sBAAA,CAAAF,OAAA;AACA,IAAAG,IAAA,GAAAH,OAAA;AAEA,IAAAI,QAAA,GAAAJ,OAAA;AACA,IAAAK,KAAA,GAAAL,OAAA;AAGA,IAAAM,MAAA,GAAAN,OAAA;AAAyC,SAAAE,uBAAAK,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAAA,SAAAG,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAZ,wBAAAQ,GAAA,EAAAI,WAAA,SAAAA,WAAA,IAAAJ,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAQ,KAAA,GAAAL,wBAAA,CAAAC,WAAA,OAAAI,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAT,GAAA,YAAAQ,KAAA,CAAAE,GAAA,CAAAV,GAAA,SAAAW,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAhB,GAAA,QAAAgB,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAnB,GAAA,EAAAgB,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAf,GAAA,EAAAgB,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAhB,GAAA,CAAAgB,GAAA,SAAAL,MAAA,CAAAT,OAAA,GAAAF,GAAA,MAAAQ,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAArB,GAAA,EAAAW,MAAA,YAAAA,MAAA;AAEzC,MAAMW,0BAA0B,GAAGA,CACjCC,UAAkD,EAClDC,cAAgD,KACxB;EACxB,MAAM;IAAEC;EAAsB,CAAC,GAAGF,UAAU,CAACG,wBAAwB;EAErE,MAAM,CAACC,MAAM,CAAC,GAAGF,qBAAqB,CACnCG,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,qBAAqB,CAACC,IAAI,CAACC,QAAQ,CAACR,cAAc,CAAC,CAAC,CACpES,GAAG,CAAEJ,CAAC,KAAM;IACXC,qBAAqB,EAAE;MAAEC,IAAI,EAAEP;IAAe,CAAC;IAC/CU,MAAM,EAAEL,CAAC,CAACK,MAAM;IAChBH,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACJ,MAAM,EAAE;IACX,MAAM,IAAIQ,KAAK,CAAE,mCAAkCX,cAAe,GAAE,CAAC;EACvE;EACA,OAAOG,MAAM;AACf,CAAC;AAED,MAAMS,2BAA2B,GAAG,MAClCC,GAAW,IAC0B;EACrC,MAAM;IACJC,UAAU,EAAE;MAAEC;IAAQ;EACxB,CAAC,GAAG,MAAM,IAAAC,2BAAkB,EAACH,GAAG,CAAC;;EAEjC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAMI,YAAY,GAAGlD,CAAC,CAACmD,MAAM,CAAC;IAAEC,WAAW,EAAEpD,CAAC,CAACqD,MAAM,CAAC;EAAE,CAAC,CAAC;EAC1D,MAAMC,gBAAgB,GAAGtD,CAAC,CAACmD,MAAM,CAAC;IAAEI,IAAI,EAAEvD,CAAC,CAACqD,MAAM,CAAC,CAAC;IAAEG,KAAK,EAAExD,CAAC,CAACqD,MAAM,CAAC;EAAE,CAAC,CAAC;EAE1E,MAAM,CAACI,OAAO,EAAEC,KAAK,CAAC,GAAG,CACvBR,YAAY,CAACS,SAAS,CAACX,OAAO,CAAC,EAC/BM,gBAAgB,CAACK,SAAS,CAACX,OAAO,CAAC,CACpC;EAED,IAAIS,OAAO,CAACG,OAAO,EAAE;IACnB,OAAOH,OAAO,CAACI,IAAI;EACrB,CAAC,MAAM,IAAIH,KAAK,CAACE,OAAO,EAAE;IACxB,OAAO;MAAER,WAAW,EAAE;IAA2B,CAAC;EACpD;EACA,MAAMK,OAAO,CAACK,KAAK;AACrB,CAAC;AAcD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,sBAA8C,GAAG,MAAAA,CAC5D/B,UAAU,EACVC,cAAc,EACd+B,GAAG,KACA;EACH,MAAM;IACJC,gBAAgB;IAChBC,yBAAyB;IACzBC,qBAAqB;IACrBC,gBAAgB,GAAG,CAAC,CAAC;IACrBC,QAAQ,GAAGC;EACb,CAAC,GAAGN,GAAG;EACP,MAAMO,QAAQ,GAAG,MAAMN,gBAAgB,CAACO,YAAY,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,GAAG,CAAC;EACzE,MAAMC,YAAY,GAAI,GAAEC,wBAAI,CAACC,EAAE,CAAC,CAAE,EAAC;EACnC;EACA,MAAMC,MAAM,GACV/C,UAAU,CAACG,wBAAwB,CAAC6C,qCAAqC;EAC3E,MAAMC,MAAM,GAAG,IAAAC,mBAAc,EAAC;IAAEjB,gBAAgB;IAAEI;EAAS,CAAC,CAAC;EAC7D,MAAMc,gBAAgB,GAAG,MAAMF,MAAM,CACnCV,QAAQ,EACRK,YAAY,EACZT,qBAAqB,EACrBY,MAAM,EACNb,yBAAyB,EACzB,CAACnC,0BAA0B,CAACC,UAAU,EAAEC,cAAc,CAAC,CAAC,EACxDmD,qBACF,CAAC;;EAED;EACA,MAAMC,oBAAoB,GACxBrD,UAAU,CAACG,wBAAwB,CAACmD,sBAAsB;EAC5D,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCC,SAAS,EAAElB,QAAQ;IACnBnB,WAAW,EAAE+B,gBAAgB;IAC7B,GAAGf;EACL,CAAC,CAAC;EAEF,MAAM;IAAEhB;EAAY,CAAC,GAAG,MAAMiB,QAAQ,CAAE,GAAEgB,oBAAqB,IAAGE,MAAO,EAAC,CAAC,CACxEd,IAAI,CAAC,IAAAiB,eAAS,EAAC,GAAG,CAAC,CAAC,CACpBjB,IAAI,CAAEkB,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBnB,IAAI,CAAC5B,2BAA2B,CAAC;EAEpC,OAAO;IAAEgD,UAAU,EAAEzC,WAAW;IAAEmB;EAAS,CAAC;AAC9C,CAAC;AAACuB,OAAA,CAAA/B,sBAAA,GAAAA,sBAAA"}

package/lib/commonjs/credential/issuance/04-complete-user-authorization.js

@@ -0,0 +1,6 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+//# sourceMappingURL=04-complete-user-authorization.js.map

package/lib/commonjs/credential/issuance/04-complete-user-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sourceRoot":"../../../../src","sources":["credential/issuance/04-complete-user-authorization.ts"],"mappings":""}

package/lib/commonjs/credential/issuance/05-authorize-access.js

@@ -0,0 +1,63 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.authorizeAccess = void 0;
+var _reactNativeUuid = _interopRequireDefault(require("react-native-uuid"));
+var _crypto = require("../../utils/crypto");
+var _dpop = require("../../utils/dpop");
+var _misc = require("../../utils/misc");
+var _const = require("./const");
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+/**
+ * Obtain the access token to finally request the credential
+ *
+ * @param issuerConf The Issuer configuration
+ * @param code The access code from the User authorization phase
+ * @param clientId Identifies the current client across all the requests of the issuing flow
+ * @param context.walletInstanceAttestation The Wallet Instance Attestation token
+ * @param context.walletProviderBaseUrl The base url of the Wallet Provider
+ * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
+ * @returns
+ */
+const authorizeAccess = async (issuerConf, code, clientId, context) => {
+  const {
+    appFetch = fetch,
+    walletInstanceAttestation,
+    walletProviderBaseUrl
+  } = context;
+  const tokenUrl = issuerConf.openid_credential_issuer.token_endpoint;
+
+  // Use an ephemeral key to be destroyed after use
+  const signedDPop = await (0, _crypto.withEphemeralKey)(ephemeralContext => (0, _dpop.createDPopToken)({
+    htm: "POST",
+    htu: tokenUrl,
+    jti: `${_reactNativeUuid.default.v4()}`
+  }, ephemeralContext));
+  const codeVerifier = `${_reactNativeUuid.default.v4()}`;
+  const requestBody = {
+    grant_type: "authorization code",
+    client_id: clientId,
+    code,
+    code_verifier: codeVerifier,
+    client_assertion_type: _const.ASSERTION_TYPE,
+    client_assertion: walletInstanceAttestation,
+    redirect_uri: walletProviderBaseUrl
+  };
+  var formBody = new URLSearchParams(requestBody);
+  return appFetch(tokenUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      DPoP: signedDPop
+    },
+    body: formBody.toString()
+  }).then((0, _misc.hasStatus)(200)).then(res => res.json()).then(body => ({
+    accessToken: body.access_token,
+    nonce: body.c_nonce,
+    clientId
+  }));
+};
+exports.authorizeAccess = authorizeAccess;
+//# sourceMappingURL=05-authorize-access.js.map

package/lib/commonjs/credential/issuance/05-authorize-access.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_reactNativeUuid","_interopRequireDefault","require","_crypto","_dpop","_misc","_const","obj","__esModule","default","authorizeAccess","issuerConf","code","clientId","context","appFetch","fetch","walletInstanceAttestation","walletProviderBaseUrl","tokenUrl","openid_credential_issuer","token_endpoint","signedDPop","withEphemeralKey","ephemeralContext","createDPopToken","htm","htu","jti","uuid","v4","codeVerifier","requestBody","grant_type","client_id","code_verifier","client_assertion_type","ASSERTION_TYPE","client_assertion","redirect_uri","formBody","URLSearchParams","method","headers","DPoP","body","toString","then","hasStatus","res","json","accessToken","access_token","nonce","c_nonce","exports"],"sourceRoot":"../../../../src","sources":["credential/issuance/05-authorize-access.ts"],"mappings":";;;;;;AAAA,IAAAA,gBAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,KAAA,GAAAF,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AAEA,IAAAI,MAAA,GAAAJ,OAAA;AAAyC,SAAAD,uBAAAM,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAqBzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMG,eAAgC,GAAG,MAAAA,CAC9CC,UAAU,EACVC,IAAI,EACJC,QAAQ,EACRC,OAAO,KAC+D;EACtE,MAAM;IACJC,QAAQ,GAAGC,KAAK;IAChBC,yBAAyB;IACzBC;EACF,CAAC,GAAGJ,OAAO;EAEX,MAAMK,QAAQ,GAAGR,UAAU,CAACS,wBAAwB,CAACC,cAAc;;EAEnE;EACA,MAAMC,UAAU,GAAG,MAAM,IAAAC,wBAAgB,EAAEC,gBAAgB,IACzD,IAAAC,qBAAe,EACb;IACEC,GAAG,EAAE,MAAM;IACXC,GAAG,EAAER,QAAQ;IACbS,GAAG,EAAG,GAAEC,wBAAI,CAACC,EAAE,CAAC,CAAE;EACpB,CAAC,EACDN,gBACF,CACF,CAAC;EAED,MAAMO,YAAY,GAAI,GAAEF,wBAAI,CAACC,EAAE,CAAC,CAAE,EAAC;EACnC,MAAME,WAAW,GAAG;IAClBC,UAAU,EAAE,oBAAoB;IAChCC,SAAS,EAAErB,QAAQ;IACnBD,IAAI;IACJuB,aAAa,EAAEJ,YAAY;IAC3BK,qBAAqB,EAAEC,qBAAc;IACrCC,gBAAgB,EAAErB,yBAAyB;IAC3CsB,YAAY,EAAErB;EAChB,CAAC;EACD,IAAIsB,QAAQ,GAAG,IAAIC,eAAe,CAACT,WAAW,CAAC;EAE/C,OAAOjB,QAAQ,CAACI,QAAQ,EAAE;IACxBuB,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,mCAAmC;MACnDC,IAAI,EAAEtB;IACR,CAAC;IACDuB,IAAI,EAAEL,QAAQ,CAACM,QAAQ,CAAC;EAC1B,CAAC,CAAC,CACCC,IAAI,CAAC,IAAAC,eAAS,EAAC,GAAG,CAAC,CAAC,CACpBD,IAAI,CAAEE,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBH,IAAI,CAAEF,IAAI,KAAM;IACfM,WAAW,EAAEN,IAAI,CAACO,YAAY;IAC9BC,KAAK,EAAER,IAAI,CAACS,OAAO;IACnBzC;EACF,CAAC,CAAC,CAAC;AACP,CAAC;AAAC0C,OAAA,CAAA7C,eAAA,GAAAA,eAAA"}

package/lib/commonjs/credential/issuance/06-obtain-credential.js

@@ -0,0 +1,128 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.obtainCredential = exports.createNonceProof = void 0;
+var z = _interopRequireWildcard(require("zod"));
+var _reactNativeUuid = _interopRequireDefault(require("react-native-uuid"));
+var _ioReactNativeJwt = require("@pagopa/io-react-native-jwt");
+var _sdJwt = require("../../sd-jwt");
+var _dpop = require("../../utils/dpop");
+var _misc = require("../../utils/misc");
+var _types = require("../../sd-jwt/types");
+var _errors = require("../../utils/errors");
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
+function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
+/**
+ * Return the signed jwt for nonce proof of possession
+ */
+const createNonceProof = async (nonce, issuer, audience, ctx) => {
+  return new _ioReactNativeJwt.SignJWT(ctx).setPayload({
+    nonce,
+    jwk: await ctx.getPublicKey()
+  }).setProtectedHeader({
+    type: "openid4vci-proof+jwt"
+  }).setAudience(audience).setIssuer(issuer).setIssuedAt().setExpirationTime("1h").sign();
+};
+
+/**
+ * Given a credential, verify it's in the supported format
+ * and the credential is correctly signed
+ * and it's bound to the given key
+ *
+ * @param rawCredential The received credential
+ * @param issuerKeys The set of public keys of the issuer,
+ * which will be used to verify the signature
+ * @param holderBindingContext The access to the holder's key
+ *
+ * @throws If the signature verification fails
+ * @throws If the credential is not in the SdJwt4VC format
+ * @throws If the holder binding is not properly configured
+ *
+ */
+exports.createNonceProof = createNonceProof;
+async function verifyCredential(rawCredential, issuerKeys, holderBindingContext) {
+  const [{
+    sdJwt
+  }, holderBindingKey] =
+  // parallel for optimization
+  await Promise.all([(0, _sdJwt.verify)(rawCredential, issuerKeys, _types.SdJwt4VC), holderBindingContext.getPublicKey()]);
+  if (!sdJwt.payload.cnf.jwk.kid || sdJwt.payload.cnf.jwk.kid !== holderBindingKey.kid) {
+    throw new _errors.IoWalletError(`Failed to verify holder binding, expected kid: ${holderBindingKey.kid}, got: ${sdJwt.payload.cnf.jwk.kid}`);
+  }
+}
+const CredentialEndpointResponse = z.object({
+  credential: z.string(),
+  format: z.literal("vc+sd-jwt")
+});
+/**
+ * Fetch a credential from the issuer
+ *
+ * @param issuerConf The Issuer configuration
+ * @param accessToken The access token to grant access to the credential, obtained with the access authorization step
+ * @param nonce The nonce value to prevent reply attacks, obtained with the access authorization step
+ * @param clientId Identifies the current client across all the requests of the issuing flow
+ * @param credentialType The type of the credential to be requested
+ * @param context.credentialCryptoContext The context to access the key the Credential will be bound to
+ * @param context.walletProviderBaseUrl The base url of the Wallet Provider
+ * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
+ * @returns The signed credential token
+ */
+const obtainCredential = async (issuerConf, accessToken, nonce, clientId, credentialType, context) => {
+  const {
+    credentialCryptoContext,
+    walletProviderBaseUrl,
+    appFetch = fetch
+  } = context;
+  const credentialUrl = issuerConf.openid_credential_issuer.credential_endpoint;
+
+  /** DPoP token for demonstating the possession
+      of the key that will bind the holder User with the Credential
+      @see https://datatracker.ietf.org/doc/html/rfc9449 */
+  const signedDPopForPid = await (0, _dpop.createDPopToken)({
+    htm: "POST",
+    htu: credentialUrl,
+    jti: `${_reactNativeUuid.default.v4()}`
+  }, credentialCryptoContext);
+
+  /** JWT proof token to bind the request nonce
+      to the key that will bind the holder User with the Credential
+      @see https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-proof-types */
+  const signedNonceProof = await createNonceProof(nonce, clientId, walletProviderBaseUrl, credentialCryptoContext);
+
+  /** The credential request body */
+  const formBody = new URLSearchParams({
+    credential_definition: JSON.stringify({
+      type: [credentialType]
+    }),
+    format: "vc+sd-jwt",
+    proof: JSON.stringify({
+      jwt: signedNonceProof,
+      proof_type: "jwt"
+    })
+  });
+  const {
+    credential,
+    format
+  } = await appFetch(credentialUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      DPoP: signedDPopForPid,
+      Authorization: accessToken
+    },
+    body: formBody.toString()
+  }).then((0, _misc.hasStatus)(200)).then(res => res.json()).then(CredentialEndpointResponse.parse);
+
+  /** validate the received credential signature
+      is correct and refers to the public keys of the issuer */
+  await verifyCredential(credential, issuerConf.openid_credential_issuer.jwks.keys, credentialCryptoContext);
+  return {
+    credential,
+    format
+  };
+};
+exports.obtainCredential = obtainCredential;
+//# sourceMappingURL=06-obtain-credential.js.map

package/lib/commonjs/credential/issuance/06-obtain-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["z","_interopRequireWildcard","require","_reactNativeUuid","_interopRequireDefault","_ioReactNativeJwt","_sdJwt","_dpop","_misc","_types","_errors","obj","__esModule","default","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","createNonceProof","nonce","issuer","audience","ctx","SignJWT","setPayload","jwk","getPublicKey","setProtectedHeader","type","setAudience","setIssuer","setIssuedAt","setExpirationTime","sign","exports","verifyCredential","rawCredential","issuerKeys","holderBindingContext","sdJwt","holderBindingKey","Promise","all","verifySdJwt","SdJwt4VC","payload","cnf","kid","IoWalletError","CredentialEndpointResponse","object","credential","string","format","literal","obtainCredential","issuerConf","accessToken","clientId","credentialType","context","credentialCryptoContext","walletProviderBaseUrl","appFetch","fetch","credentialUrl","openid_credential_issuer","credential_endpoint","signedDPopForPid","createDPopToken","htm","htu","jti","uuid","v4","signedNonceProof","formBody","URLSearchParams","credential_definition","JSON","stringify","proof","jwt","proof_type","method","headers","DPoP","Authorization","body","toString","then","hasStatus","res","json","parse","jwks","keys"],"sourceRoot":"../../../../src","sources":["credential/issuance/06-obtain-credential.ts"],"mappings":";;;;;;AAAA,IAAAA,CAAA,GAAAC,uBAAA,CAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAC,sBAAA,CAAAF,OAAA;AACA,IAAAG,iBAAA,GAAAH,OAAA;AACA,IAAAI,MAAA,GAAAJ,OAAA;AACA,IAAAK,KAAA,GAAAL,OAAA;AAGA,IAAAM,KAAA,GAAAN,OAAA;AAGA,IAAAO,MAAA,GAAAP,OAAA;AACA,IAAAQ,OAAA,GAAAR,OAAA;AAAmD,SAAAE,uBAAAO,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAAA,SAAAG,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAd,wBAAAU,GAAA,EAAAI,WAAA,SAAAA,WAAA,IAAAJ,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAQ,KAAA,GAAAL,wBAAA,CAAAC,WAAA,OAAAI,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAT,GAAA,YAAAQ,KAAA,CAAAE,GAAA,CAAAV,GAAA,SAAAW,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAhB,GAAA,QAAAgB,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAnB,GAAA,EAAAgB,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAf,GAAA,EAAAgB,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAhB,GAAA,CAAAgB,GAAA,SAAAL,MAAA,CAAAT,OAAA,GAAAF,GAAA,MAAAQ,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAArB,GAAA,EAAAW,MAAA,YAAAA,MAAA;AAGnD;AACA;AACA;AACO,MAAMW,gBAAgB,GAAG,MAAAA,CAC9BC,KAAa,EACbC,MAAc,EACdC,QAAgB,EAChBC,GAAkB,KACE;EACpB,OAAO,IAAIC,yBAAO,CAACD,GAAG,CAAC,CACpBE,UAAU,CAAC;IACVL,KAAK;IACLM,GAAG,EAAE,MAAMH,GAAG,CAACI,YAAY,CAAC;EAC9B,CAAC,CAAC,CACDC,kBAAkB,CAAC;IAClBC,IAAI,EAAE;EACR,CAAC,CAAC,CACDC,WAAW,CAACR,QAAQ,CAAC,CACrBS,SAAS,CAACV,MAAM,CAAC,CACjBW,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,IAAI,CAAC,CACvBC,IAAI,CAAC,CAAC;AACX,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAdAC,OAAA,CAAAhB,gBAAA,GAAAA,gBAAA;AAeA,eAAeiB,gBAAgBA,CAC7BC,aAAqB,EACrBC,UAAiB,EACjBC,oBAAmC,EACpB;EACf,MAAM,CAAC;IAAEC;EAAM,CAAC,EAAEC,gBAAgB,CAAC;EACjC;EACA,MAAMC,OAAO,CAACC,GAAG,CAAC,CAChB,IAAAC,aAAW,EAACP,aAAa,EAAEC,UAAU,EAAEO,eAAQ,CAAC,EAChDN,oBAAoB,CAACZ,YAAY,CAAC,CAAC,CACpC,CAAC;EAEJ,IACE,CAACa,KAAK,CAACM,OAAO,CAACC,GAAG,CAACrB,GAAG,CAACsB,GAAG,IAC1BR,KAAK,CAACM,OAAO,CAACC,GAAG,CAACrB,GAAG,CAACsB,GAAG,KAAKP,gBAAgB,CAACO,GAAG,EAClD;IACA,MAAM,IAAIC,qBAAa,CACpB,kDAAiDR,gBAAgB,CAACO,GAAI,UAASR,KAAK,CAACM,OAAO,CAACC,GAAG,CAACrB,GAAG,CAACsB,GAAI,EAC5G,CAAC;EACH;AACF;AAEA,MAAME,0BAA0B,GAAGhE,CAAC,CAACiE,MAAM,CAAC;EAC1CC,UAAU,EAAElE,CAAC,CAACmE,MAAM,CAAC,CAAC;EACtBC,MAAM,EAAEpE,CAAC,CAACqE,OAAO,CAAC,WAAW;AAC/B,CAAC,CAAC;AAeF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,gBAAkC,GAAG,MAAAA,CAChDC,UAAU,EACVC,WAAW,EACXtC,KAAK,EACLuC,QAAQ,EACRC,cAAc,EACdC,OAAO,KACJ;EACH,MAAM;IACJC,uBAAuB;IACvBC,qBAAqB;IACrBC,QAAQ,GAAGC;EACb,CAAC,GAAGJ,OAAO;EAEX,MAAMK,aAAa,GAAGT,UAAU,CAACU,wBAAwB,CAACC,mBAAmB;;EAE7E;AACF;AACA;EACE,MAAMC,gBAAgB,GAAG,MAAM,IAAAC,qBAAe,EAC5C;IACEC,GAAG,EAAE,MAAM;IACXC,GAAG,EAAEN,aAAa;IAClBO,GAAG,EAAG,GAAEC,wBAAI,CAACC,EAAE,CAAC,CAAE;EACpB,CAAC,EACDb,uBACF,CAAC;;EAED;AACF;AACA;EACE,MAAMc,gBAAgB,GAAG,MAAMzD,gBAAgB,CAC7CC,KAAK,EACLuC,QAAQ,EACRI,qBAAqB,EACrBD,uBACF,CAAC;;EAED;EACA,MAAMe,QAAQ,GAAG,IAAIC,eAAe,CAAC;IACnCC,qBAAqB,EAAEC,IAAI,CAACC,SAAS,CAAC;MACpCpD,IAAI,EAAE,CAAC+B,cAAc;IACvB,CAAC,CAAC;IACFN,MAAM,EAAE,WAAW;IACnB4B,KAAK,EAAEF,IAAI,CAACC,SAAS,CAAC;MACpBE,GAAG,EAAEP,gBAAgB;MACrBQ,UAAU,EAAE;IACd,CAAC;EACH,CAAC,CAAC;EAEF,MAAM;IAAEhC,UAAU;IAAEE;EAAO,CAAC,GAAG,MAAMU,QAAQ,CAACE,aAAa,EAAE;IAC3DmB,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,mCAAmC;MACnDC,IAAI,EAAElB,gBAAgB;MACtBmB,aAAa,EAAE9B;IACjB,CAAC;IACD+B,IAAI,EAAEZ,QAAQ,CAACa,QAAQ,CAAC;EAC1B,CAAC,CAAC,CACCC,IAAI,CAAC,IAAAC,eAAS,EAAC,GAAG,CAAC,CAAC,CACpBD,IAAI,CAAEE,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBH,IAAI,CAACzC,0BAA0B,CAAC6C,KAAK,CAAC;;EAEzC;AACF;EACE,MAAM3D,gBAAgB,CACpBgB,UAAU,EACVK,UAAU,CAACU,wBAAwB,CAAC6B,IAAI,CAACC,IAAI,EAC7CnC,uBACF,CAAC;EAED,OAAO;IAAEV,UAAU;IAAEE;EAAO,CAAC;AAC/B,CAAC;AAACnB,OAAA,CAAAqB,gBAAA,GAAAA,gBAAA"}

package/lib/commonjs/credential/issuance/07-confirm-credential.js

@@ -0,0 +1,6 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+//# sourceMappingURL=07-confirm-credential.js.map

package/lib/commonjs/credential/issuance/07-confirm-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sourceRoot":"../../../../src","sources":["credential/issuance/07-confirm-credential.ts"],"mappings":""}

package/lib/commonjs/credential/issuance/const.js

@@ -0,0 +1,9 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.ASSERTION_TYPE = void 0;
+const ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-client-attestation";
+exports.ASSERTION_TYPE = ASSERTION_TYPE;
+//# sourceMappingURL=const.js.map

package/lib/commonjs/credential/issuance/const.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ASSERTION_TYPE","exports"],"sourceRoot":"../../../../src","sources":["credential/issuance/const.ts"],"mappings":";;;;;;AAAO,MAAMA,cAAc,GACzB,oEAAoE;AAACC,OAAA,CAAAD,cAAA,GAAAA,cAAA"}

package/lib/commonjs/credential/issuance/index.js

@@ -0,0 +1,34 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+Object.defineProperty(exports, "authorizeAccess", {
+  enumerable: true,
+  get: function () {
+    return _authorizeAccess.authorizeAccess;
+  }
+});
+Object.defineProperty(exports, "evaluateIssuerTrust", {
+  enumerable: true,
+  get: function () {
+    return _evaluateIssuerTrust.evaluateIssuerTrust;
+  }
+});
+Object.defineProperty(exports, "obtainCredential", {
+  enumerable: true,
+  get: function () {
+    return _obtainCredential.obtainCredential;
+  }
+});
+Object.defineProperty(exports, "startUserAuthorization", {
+  enumerable: true,
+  get: function () {
+    return _startUserAuthorization.startUserAuthorization;
+  }
+});
+var _evaluateIssuerTrust = require("./02-evaluate-issuer-trust");
+var _startUserAuthorization = require("./03-start-user-authorization");
+var _authorizeAccess = require("./05-authorize-access");
+var _obtainCredential = require("./06-obtain-credential");
+//# sourceMappingURL=index.js.map

package/lib/commonjs/credential/issuance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_evaluateIssuerTrust","require","_startUserAuthorization","_authorizeAccess","_obtainCredential"],"sourceRoot":"../../../../src","sources":["credential/issuance/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,IAAAA,oBAAA,GAAAC,OAAA;AAIA,IAAAC,uBAAA,GAAAD,OAAA;AAKA,IAAAE,gBAAA,GAAAF,OAAA;AACA,IAAAG,iBAAA,GAAAH,OAAA"}

package/lib/commonjs/credential/presentation/01-start-flow.js

@@ -0,0 +1,55 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.startFlowFromQR = void 0;
+var z = _interopRequireWildcard(require("zod"));
+var _ioReactNativeJwt = require("@pagopa/io-react-native-jwt");
+var _errors = require("../../utils/errors");
+function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
+function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
+const QRCodePayload = z.object({
+  protocol: z.string(),
+  resource: z.string(),
+  // TODO: refine to known paths using literals
+  clientId: z.string(),
+  requestURI: z.string()
+});
+
+/**
+ * The beginning of the presentation flow.
+ * To be implemented accordind to the user touchpoint
+ *
+ * @param Optional parameters, depending on the starting touchoint
+ * @returns The url for the Relying Party to connect with
+ */
+
+/**
+ * Start a presentation flow by decoding an incoming QR-code
+ *
+ * @param qrcode The encoded QR-code content
+ * @returns The url for the Relying Party to connect with
+ * @throws If the provided qr code fails to be decoded
+ */
+const startFlowFromQR = async qrcode => {
+  const decoded = (0, _ioReactNativeJwt.decodeBase64)(qrcode);
+  const decodedUrl = new URL(decoded);
+  const protocol = decodedUrl.protocol;
+  const resource = decodedUrl.hostname;
+  const requestURI = decodedUrl.searchParams.get("request_uri");
+  const clientId = decodedUrl.searchParams.get("client_id");
+  const result = QRCodePayload.safeParse({
+    protocol,
+    resource,
+    requestURI,
+    clientId
+  });
+  if (result.success) {
+    return result.data;
+  } else {
+    throw new _errors.AuthRequestDecodeError(result.error.message, `${decodedUrl}`);
+  }
+};
+exports.startFlowFromQR = startFlowFromQR;
+//# sourceMappingURL=01-start-flow.js.map