@pagopa/io-react-native-wallet 1.7.1 → 2.0.0-next.1

package/src/credential/presentation/03-get-request-object.ts

@@ -1,30 +1,58 @@
-import { hasStatusOrThrow, type Out } from "../../utils/misc";
-import type { StartFlow } from "./01-start-flow";
+import { RelyingPartyResponseError } from "../../utils/errors";
+import { hasStatusOrThrow } from "../../utils/misc";
+import { RequestObjectWalletCapabilities } from "./types";
 
 export type GetRequestObject = (
-  requestUri: Out<StartFlow>["requestUri"],
+  requestUri: string,
   context?: {
     appFetch?: GlobalFetch["fetch"];
+    walletCapabilities?: RequestObjectWalletCapabilities;
   }
 ) => Promise<{ requestObjectEncodedJwt: string }>;
 
 /**
- * Obtain the Request Object for RP authentication
+ * Obtain the Request Object for RP authentication. Both the GET and POST `request_uri_method` are supported.
  * @see https://italia.github.io/eudi-wallet-it-docs/versione-corrente/en/relying-party-solution.html
  *
- * @param requestUri The request uri of the Relying Party
+ * @param requestUri The url for the Relying Party to connect with
+ * @param rpConf The Relying Party's configuration * @param context.walletInstanceAttestation The Wallet Instance Attestation token
+ * @param context.walletCapabilities (optional) An object containing the wallet technical capabilities that will be sent with a POST request
  * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
  * @returns The Request Object that describes the presentation
  */
 export const getRequestObject: GetRequestObject = async (
   requestUri,
-  context = {}
+  { appFetch = fetch, walletCapabilities } = {}
 ) => {
-  const { appFetch = fetch } = context;
+  if (walletCapabilities) {
+    // Validate external input
+    const { wallet_metadata, wallet_nonce } =
+      RequestObjectWalletCapabilities.parse(walletCapabilities);
+
+    const formUrlEncodedBody = new URLSearchParams({
+      wallet_metadata: JSON.stringify(wallet_metadata),
+      ...(wallet_nonce && { wallet_nonce }),
+    });
+
+    const requestObjectEncodedJwt = await appFetch(requestUri, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+      body: formUrlEncodedBody.toString(),
+    })
+      .then(hasStatusOrThrow(200, RelyingPartyResponseError))
+      .then((res) => res.text());
+
+    return {
+      requestObjectEncodedJwt,
+    };
+  }
+
   const requestObjectEncodedJwt = await appFetch(requestUri, {
     method: "GET",
   })
-    .then(hasStatusOrThrow(200))
+    .then(hasStatusOrThrow(200, RelyingPartyResponseError))
     .then((res) => res.text());
 
   return {

package/src/credential/presentation/04-retrieve-rp-jwks.ts

@@ -1,14 +1,5 @@
-import { JWKS, JWK } from "../../utils/jwk";
-import { hasStatusOrThrow } from "../../utils/misc";
-import { RelyingPartyEntityConfiguration } from "../../entity/trust/types";
-import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
-import { NoSuitableKeysFoundInEntityConfiguration } from "./errors";
-import { RequestObject } from "./types";
-import {
-  convertCertToPem,
-  parsePublicKey,
-  getSigningJwk,
-} from "../../utils/crypto";
+import { JWK } from "../../utils/jwk";
+import { RelyingPartyEntityConfiguration } from "../../trust/types";
 
 /**
  * Defines the signature for a function that retrieves JSON Web Key Sets (JWKS) from a client.
@@ -17,141 +8,8 @@ import {
  * @param args - The arguments passed to the function.
  * @returns A promise resolving to an object containing an array of JWKs.
  */
-export type FetchJwks<T extends Array<unknown> = []> = (...args: T) => Promise<{
+export type FetchJwks<T extends Array<unknown> = []> = (...args: T) => {
   keys: JWK[];
-}>;
-
-/**
- * Fetches and parses JWKS from a given URI.
- *
- * @param jwksUri - The JWKS URI.
- * @param fetchFn - The fetch function to use.
- * @returns An array of JWKs.
- */
-const fetchJwksFromUri = async (
-  jwksUri: string,
-  appFetch: GlobalFetch["fetch"]
-): Promise<JWK[]> => {
-  const jwks = await appFetch(jwksUri, {
-    method: "GET",
-  })
-    .then(hasStatusOrThrow(200))
-    .then((raw) => raw.json())
-    .then((json) => (json.jwks ? JWKS.parse(json.jwks) : JWKS.parse(json)));
-  return jwks.keys;
-};
-
-/**
- * Retrieves JWKS when the client ID scheme includes x509 SAN DNS.
- *
- * @param decodedJwt - The decoded JWT.
- * @param fetchFn - The fetch function to use.
- * @returns An array of JWKs.
- * @throws Will throw an error if no suitable keys are found.
- */
-const getJwksFromX509Cert = async (certChain: string[]): Promise<JWK[]> => {
-  if (!Array.isArray(certChain) || certChain.length === 0 || !certChain[0]) {
-    throw new NoSuitableKeysFoundInEntityConfiguration(
-      "No RP encrypt key found!"
-    );
-  }
-
-  const pemCert = convertCertToPem(certChain[0]);
-  const publicKey = parsePublicKey(pemCert);
-  if (!publicKey) {
-    throw new NoSuitableKeysFoundInEntityConfiguration(
-      "Unsupported public key type."
-    );
-  }
-  const signingJwk = getSigningJwk(publicKey);
-
-  return [signingJwk];
-};
-
-/**
- * Constructs the well-known JWKS URL based on the issuer claim.
- *
- * @param issuer - The issuer URL.
- * @returns The well-known JWKS URL.
- */
-const constructWellKnownJwksUrl = (issuer: string): string => {
-  const issuerUrl = new URL(issuer);
-  return new URL(
-    `/.well-known/jar-issuer${issuerUrl.pathname}`,
-    `${issuerUrl.protocol}//${issuerUrl.host}`
-  ).toString();
-};
-
-/**
- * Fetches the JSON Web Key Set (JWKS) based on the provided Request Object encoded as a JWT.
- * The retrieval process follows these steps in order:
- *
- * 1. **Direct JWK Retrieval**: If the JWT's protected header contains a `jwk` attribute, it uses this key directly.
- * 2. **X.509 Certificate Retrieval**: If the protected header includes an `x5c` attribute, it extracts the JWKs from the provided X.509 certificate chain.
- * 3. **Issuer's Well-Known Endpoint**: If neither `jwk` nor `x5c` are present, it constructs the JWKS URL using the issuer (`iss`) claim and fetches the keys from the issuer's well-known JWKS endpoint.
- *
- * The JWKS URL is constructed in the format `{issUrl.base}/.well-known/jar-issuer${issUrl.path}`,
- * as detailed in the SD-JWT VC issuer metadata specification.
- *
- * @param requestObjectEncodedJwt - The Request Object encoded as a JWT.
- * @param options - Optional parameters for fetching the JWKS.
- * @param options.context - Optional context providing a custom fetch implementation.
- * @param options.context.appFetch - A custom fetch function to replace the global `fetch` if provided.
- * @returns A promise that resolves to an object containing an array of JSON Web Keys (JWKs).
- * @throws {NoSuitableKeysFoundInEntityConfiguration} Throws an error if JWKS retrieval or key extraction fails.
- */
-export const fetchJwksFromRequestObject: FetchJwks<
-  [string, { context?: { appFetch?: GlobalFetch["fetch"] } }?]
-> = async (requestObjectEncodedJwt, { context = {} } = {}) => {
-  const { appFetch = fetch } = context;
-  const requestObjectJwt = decodeJwt(requestObjectEncodedJwt);
-  const jwks: JWK[] = [];
-
-  // 1. check if request object jwt contains the 'jwk' attribute
-  if (requestObjectJwt.protectedHeader?.jwk) {
-    const keys = [JWK.parse(requestObjectJwt.protectedHeader.jwk)];
-    jwks.push(...keys);
-  }
-
-  // 2. check if request object jwt contains the 'x5c' attribute
-  if (requestObjectJwt.protectedHeader.x5c) {
-    const keys = await getJwksFromX509Cert(
-      requestObjectJwt.protectedHeader.x5c
-    );
-    jwks.push(...keys);
-  }
-
-  // 3. check if client_metadata contains the 'jwks' or 'jwks_uri' attribute
-  const requestObject = RequestObject.parse(requestObjectJwt.payload);
-  const { client_metadata } = requestObject;
-
-  if (client_metadata?.jwks_uri) {
-    const fetchedJwks = await fetchJwksFromUri(
-      new URL(client_metadata.jwks_uri).toString(),
-      appFetch
-    );
-    jwks.push(...fetchedJwks);
-  }
-
-  if (client_metadata?.jwks) {
-    jwks.push(...client_metadata.jwks.keys);
-  }
-
-  // 3. According to Potential profile, retrieve from RP endpoint using iss claim
-  const issuer = requestObjectJwt.payload?.iss;
-  if (jwks.length === 0 && typeof issuer === "string") {
-    const wellKnownJwksUrl = constructWellKnownJwksUrl(issuer);
-    const jwksKeys = await fetchJwksFromUri(wellKnownJwksUrl, appFetch);
-    jwks.push(...jwksKeys);
-  }
-
-  if (jwks.length === 0) {
-    throw new NoSuitableKeysFoundInEntityConfiguration(
-      "Request Object signature verification"
-    );
-  }
-
-  return { keys: jwks };
 };
 
 /**
@@ -161,10 +19,10 @@ export const fetchJwksFromRequestObject: FetchJwks<
  * @returns An object containing an array of JWKs.
  * @throws Will throw an error if the configuration is invalid or if JWKS is not found.
  */
-export const fetchJwksFromConfig: FetchJwks<
+export const getJwksFromConfig: FetchJwks<
   [RelyingPartyEntityConfiguration["payload"]["metadata"]]
-> = async (rpConfig) => {
-  const jwks = rpConfig.wallet_relying_party.jwks;
+> = (rpConfig) => {
+  const jwks = rpConfig.openid_credential_verifier.jwks;
 
   if (!jwks || !Array.isArray(jwks.keys)) {
     throw new Error("JWKS not found in Relying Party configuration.");

package/src/credential/presentation/05-verify-request-object.ts

@@ -1,36 +1,121 @@
-import { UnverifiedEntityError } from "./errors";
-
 import { decode as decodeJwt, verify } from "@pagopa/io-react-native-jwt";
+import type { RelyingPartyEntityConfiguration } from "../../trust";
+import { InvalidRequestObjectError } from "./errors";
 import { RequestObject } from "./types";
-import type { FetchJwks } from "./04-retrieve-rp-jwks";
-import { type Out } from "../../utils/misc";
+import { getJwksFromConfig } from "./04-retrieve-rp-jwks";
 
-export type VerifyRequestObjectSignature = (
+export type VerifyRequestObject = (
   requestObjectEncodedJwt: string,
-  jwkKeys?: Out<FetchJwks>["keys"]
+  context: {
+    clientId: string;
+    rpConf: RelyingPartyEntityConfiguration["payload"]["metadata"];
+    rpSubject: string;
+    state?: string;
+  }
 ) => Promise<{ requestObject: RequestObject }>;
 
-export const verifyRequestObjectSignature: VerifyRequestObjectSignature =
-  async (requestObjectEncodedJwt, jwkKeys) => {
-    const requestObjectJwt = decodeJwt(requestObjectEncodedJwt);
-
-    // verify token signature to ensure the request object is authentic
-    const pubKey =
-      jwkKeys?.find(
-        ({ kid }) => kid === requestObjectJwt.protectedHeader.kid
-      ) || jwkKeys?.find(({ use }) => use === "sig");
-
-    if (!pubKey) {
-      throw new UnverifiedEntityError("Request Object signature verification!");
-    }
-    await verify(requestObjectEncodedJwt, pubKey);
-
-    const requestObject = RequestObject.parse(requestObjectJwt.payload);
-    // Check if exp exists and is expired
-    // exp is typically in seconds since epoch, Get current time in seconds
-    if (requestObject.exp && requestObject.exp <= Date.now() / 1000) {
-      throw new UnverifiedEntityError("Request Object is expired!");
-    }
-
-    return { requestObject };
-  };
+/**
+ * Function to verify the Request Object's validity, from the signature to the required properties.
+ * @param requestObjectEncodedJwt The Request Object in JWT format
+ * @param context.clientId The client ID to verify
+ * @param context.rpConf The Entity Configuration of the Relying Party
+ * @param context.state Optional state
+ * @returns The verified Request Object
+ * @throws {InvalidRequestObjectError} if the Request Object cannot be validated
+ */
+export const verifyRequestObject: VerifyRequestObject = async (
+  requestObjectEncodedJwt,
+  { clientId, rpConf, rpSubject, state }
+) => {
+  const requestObjectJwt = decodeJwt(requestObjectEncodedJwt);
+
+  const pubKey = getSigPublicKey(rpConf, requestObjectJwt.protectedHeader.kid);
+
+  try {
+    // Standard claims are verified within `verify`
+    await verify(requestObjectEncodedJwt, pubKey, { issuer: clientId });
+  } catch (_) {
+    throw new InvalidRequestObjectError(
+      "The Request Object signature verification failed"
+    );
+  }
+
+  const requestObject = validateRequestObjectShape(requestObjectJwt.payload);
+
+  const isClientIdMatch =
+    clientId === requestObject.client_id && clientId === rpSubject;
+
+  if (!isClientIdMatch) {
+    throw new InvalidRequestObjectError(
+      "Client ID does not match Request Object or Entity Configuration"
+    );
+  }
+
+  const isStateMatch =
+    state && requestObject.state ? state === requestObject.state : true;
+
+  if (!isStateMatch) {
+    throw new InvalidRequestObjectError(
+      "The provided state does not match the Request Object's"
+    );
+  }
+
+  return { requestObject };
+};
+
+/**
+ * Validate the shape of the Request Object to ensure all required properties are present and are of the expected type.
+ *
+ * @param payload The Request Object to validate
+ * @returns A valid Request Object
+ * @throws {InvalidRequestObjectError} when the Request Object cannot be parsed
+ */
+const validateRequestObjectShape = (payload: unknown): RequestObject => {
+  const requestObjectParse = RequestObject.safeParse(payload);
+
+  if (requestObjectParse.success) {
+    return requestObjectParse.data;
+  }
+
+  throw new InvalidRequestObjectError(
+    "The Request Object cannot be parsed successfully",
+    formatFlattenedZodErrors(requestObjectParse.error.flatten())
+  );
+};
+
+/**
+ * Get the public key to verify the Request Object's signature from the Relying Party's EC.
+ *
+ * @param rpConf The Relying Party's EC
+ * @param kid The identifier of the key to find
+ * @returns The corresponding public key to verify the signature
+ * @throws {InvalidRequestObjectError} when the key cannot be found
+ */
+const getSigPublicKey = (
+  rpConf: RelyingPartyEntityConfiguration["payload"]["metadata"],
+  kid: string | undefined
+) => {
+  try {
+    const { keys } = getJwksFromConfig(rpConf);
+
+    const pubKey = keys.find((k) => k.kid === kid);
+
+    if (!pubKey) throw new Error();
+
+    return pubKey;
+  } catch (_) {
+    throw new InvalidRequestObjectError(
+      `The public key for signature verification (${kid}) cannot be found in the Entity Configuration`
+    );
+  }
+};
+
+/**
+ * Utility to format flattened Zod errors into a simplified string `key1: key1_error, key2: key2_error`
+ */
+const formatFlattenedZodErrors = (
+  errors: Zod.typeToFlattenedError<RequestObject>
+): string =>
+  Object.entries(errors.fieldErrors)
+    .map(([key, error]) => `${key}: ${error[0]}`)
+    .join(", ");

package/src/credential/presentation/06-fetch-presentation-definition.ts

@@ -1,12 +1,8 @@
 import { PresentationDefinition, RequestObject } from "./types";
-import { RelyingPartyEntityConfiguration } from "../../entity/trust/types";
-import { hasStatusOrThrow } from "../../utils/misc";
+import { RelyingPartyEntityConfiguration } from "../../trust/types";
 
 export type FetchPresentationDefinition = (
   requestObject: RequestObject,
-  context?: {
-    appFetch?: GlobalFetch["fetch"];
-  },
   rpConf?: RelyingPartyEntityConfiguration["payload"]["metadata"]
 ) => Promise<{
   presentationDefinition: PresentationDefinition;
@@ -17,21 +13,17 @@ export type FetchPresentationDefinition = (
  *
  * The method attempts the following strategies in order:
  * 1. Checks if `presentation_definition` is directly available in the request object.
- * 2. Fetches the `presentation_definition` from the URI provided in the relying party configuration.
- * 3. Uses a pre-configured `presentation_definition` from the relying party configuration if the `scope` is present in the request object.
+ * 2. Uses a pre-configured `presentation_definition` from the relying party configuration if the `scope` is present in the request object.
  *
- * If none of the above conditions are met, the function throws an error indicating the definition could not be found.
+ * If none of the above conditions are met, the function throws an error indicating the definition could not be found. Note that `presentation_definition_uri` is not supported in 0.9.x.
  *
  * @param {RequestObject} requestObject - The request object containing the presentation definition or references to it.
  * @param {RelyingPartyEntityConfiguration["payload"]["metadata"]} [rpConf] - Optional relying party configuration.
- * @param {Object} [context] - Optional context for providing a custom fetch implementation.
- * @param {GlobalFetch["fetch"]} [context.appFetch] - Custom fetch function, defaults to global `fetch`.
  * @returns {Promise<{ presentationDefinition: PresentationDefinition }>} - Resolves with the presentation definition.
  * @throws {Error} - Throws if the presentation definition cannot be found or fetched.
  */
 export const fetchPresentDefinition: FetchPresentationDefinition = async (
   requestObject,
-  { appFetch = fetch } = {},
   rpConf
 ) => {
   // Check if `presentation_definition` is directly available in the request object
@@ -41,36 +33,14 @@ export const fetchPresentDefinition: FetchPresentationDefinition = async (
     };
   }
 
-  // Check if `presentation_definition_uri` is provided in the relying party configuration
-  if (rpConf?.wallet_relying_party?.presentation_definition_uri) {
-    try {
-      // Fetch the presentation definition from the provided URI
-      const presentationDefinition = await appFetch(
-        rpConf?.wallet_relying_party.presentation_definition_uri,
-        {
-          method: "GET",
-        }
-      )
-        .then(hasStatusOrThrow(200))
-        .then((raw) => raw.json())
-        .then((json) => PresentationDefinition.parse(json));
-
-      return {
-        presentationDefinition,
-      };
-    } catch (error) {
-      throw new Error(`Failed to fetch presentation definition: ${error}`);
-    }
-  }
-
   // Check if `scope` is present in the request object and a pre-configured presentation definition exists
   if (
     requestObject.scope &&
-    rpConf?.wallet_relying_party?.presentation_definition
+    rpConf?.openid_credential_verifier?.presentation_definition
   ) {
     return {
       presentationDefinition:
-        rpConf.wallet_relying_party.presentation_definition,
+        rpConf.openid_credential_verifier.presentation_definition,
     };
   }