@pagopa/io-react-native-wallet 2.0.0-next.0 → 2.0.0-next.1

package/lib/module/trust/chain.js

@@ -1,8 +1,9 @@
 import { EntityConfiguration, EntityStatement, TrustAnchorEntityConfiguration } from "./types";
 import * as z from "zod";
 import { getSignedEntityConfiguration, getSignedEntityStatement } from ".";
-import { decode, verify } from "./utils";
-import { MissingFederationFetchEndpointError, TrustChainEmptyError, TrustChainRenewalError, TrustChainTokenMissingError } from "./errors";
+import { decode, getTrustAnchorX509Certificate, verify } from "./utils";
+import { FederationError, MissingFederationFetchEndpointError, MissingX509CertsError, TrustChainEmptyError, TrustChainRenewalError, TrustChainTokenMissingError, X509ValidationError } from "./errors";
+import { verifyCertificateChain } from "@pagopa/io-react-native-crypto";
 
 // The first element of the chain is supposed to be the Entity Configuration for the document issuer
 const FirstElementShape = EntityConfiguration;
@@ -13,14 +14,15 @@ const MiddleElementShape = EntityStatement;
 const LastElementShape = z.union([EntityStatement, TrustAnchorEntityConfiguration]);
 
 /**
- * Validates a provided trust chain against a known trust
+ * Validates a provided trust chain against a known trust anchor, including X.509 certificate checks.
  *
- * @param trustAnchorEntity The entity configuration of the known trust anchor
- * @param chain The chain of statements to be validated
- * @returns The list of parsed token representing the chain
- * @throws {FederationError} If the chain is not valid
+ * @param trustAnchorEntity The entity configuration of the known trust anchor (for JWT validation).
+ * @param chain The chain of statements to be validated.
+ * @param x509Options Options for X.509 certificate validation.
+ * @returns The list of parsed tokens representing the chain.
+ * @throws {FederationError} If the chain is not valid (JWT or X.509). Specific errors like TrustChainEmptyError, X509ValidationError may be thrown.
  */
-export async function validateTrustChain(trustAnchorEntity, chain) {
+export async function validateTrustChain(trustAnchorEntity, chain, x509Options) {
   // If the chain is empty, fail
   if (chain.length === 0) {
     throw new TrustChainEmptyError("Cannot verify empty trust chain.");
@@ -29,7 +31,7 @@ export async function validateTrustChain(trustAnchorEntity, chain) {
   // Select the expected token shape
   const selectTokenShape = elementIndex => elementIndex === 0 ? FirstElementShape : elementIndex === chain.length - 1 ? LastElementShape : MiddleElementShape;
 
-  // select the kid from the current index
+  // Select the kid from the current index
   const selectKid = currentIndex => {
     const token = chain[currentIndex];
     if (!token) {
@@ -41,8 +43,8 @@ export async function validateTrustChain(trustAnchorEntity, chain) {
     return shape.parse(decode(token)).header.kid;
   };
 
-  // select keys from the next token
-  // if the current token is the last, keys from trust anchor will be used
+  // Select keys from the next token
+  // If the current token is the last, keys from trust anchor will be used
   const selectKeys = currentIndex => {
     if (currentIndex === chain.length - 1) {
       return trustAnchorEntity.payload.jwks.keys;
@@ -57,10 +59,45 @@ export async function validateTrustChain(trustAnchorEntity, chain) {
     const shape = selectTokenShape(nextIndex);
     return shape.parse(decode(nextToken)).payload.jwks.keys;
   };
+  const x509TrustAnchorCertBase64 = getTrustAnchorX509Certificate(trustAnchorEntity);
 
   // Iterate the chain and validate each element's signature against the public keys of its next
   // If there is no next, hence it's the end of the chain, and it must be verified by the Trust Anchor
-  return Promise.all(chain.map((token, i) => [token, selectKid(i), selectKeys(i)]).map(args => verify(...args)));
+  const validationPromises = chain.map(async (tokenString, i) => {
+    const kidFromTokenHeader = selectKid(i);
+    const signerJwks = selectKeys(i);
+
+    // Step 1: Verify JWT signature
+    const parsedToken = await verify(tokenString, kidFromTokenHeader, signerJwks);
+
+    // Step 2: X.509 Certificate Chain Validation
+    const jwkUsedForVerification = signerJwks.find(k => k.kid === kidFromTokenHeader);
+    if (!jwkUsedForVerification) {
+      throw new FederationError(`JWK with kid '${kidFromTokenHeader}' was not found in signer's JWKS for token at index ${i}, though JWT verification passed.`, {
+        tokenIndex: i,
+        kid: kidFromTokenHeader
+      });
+    }
+    if (!jwkUsedForVerification.x5c || jwkUsedForVerification.x5c.length === 0) {
+      throw new MissingX509CertsError(`JWK with kid '${kidFromTokenHeader}' does not contain an X.509 certificate chain (x5c) for token at index ${i}.`);
+    }
+
+    // If the chain has more than one certificate AND
+    // the last certificate in the x5c chain is the same as the trust anchor,
+    // remove the anchor from the chain being passed, as it's supplied separately.
+    const certChainBase64 = jwkUsedForVerification.x5c.length > 1 && jwkUsedForVerification.x5c.at(-1) === x509TrustAnchorCertBase64 ? jwkUsedForVerification.x5c.slice(0, -1) : jwkUsedForVerification.x5c;
+    const x509ValidationResult = await verifyCertificateChain(certChainBase64, x509TrustAnchorCertBase64, x509Options);
+    if (!x509ValidationResult.isValid) {
+      throw new X509ValidationError(`X.509 certificate chain validation failed for token at index ${i} (kid: ${kidFromTokenHeader}). Status: ${x509ValidationResult.validationStatus}. Error: ${x509ValidationResult.errorMessage}`, {
+        tokenIndex: i,
+        kid: kidFromTokenHeader,
+        x509ValidationStatus: x509ValidationResult.validationStatus,
+        x509ErrorMessage: x509ValidationResult.errorMessage
+      });
+    }
+    return parsedToken;
+  });
+  return Promise.all(validationPromises);
 }
 
 /**

package/lib/module/trust/chain.js.map

@@ -1 +1 @@
-{"version":3,"names":["EntityConfiguration","EntityStatement","TrustAnchorEntityConfiguration","z","getSignedEntityConfiguration","getSignedEntityStatement","decode","verify","MissingFederationFetchEndpointError","TrustChainEmptyError","TrustChainRenewalError","TrustChainTokenMissingError","FirstElementShape","MiddleElementShape","LastElementShape","union","validateTrustChain","trustAnchorEntity","chain","length","selectTokenShape","elementIndex","selectKid","currentIndex","token","index","shape","parse","header","kid","selectKeys","payload","jwks","keys","nextIndex","nextToken","Promise","all","map","i","args","renewTrustChain","appFetch","arguments","undefined","fetch","decoded","entityStatementResult","safeParse","entityConfigurationResult","success","data","iss","entityStatement","parentBaseUrl","parentECJwt","parentEC","federationFetchEndpoint","metadata","federation_entity","federation_fetch_endpoint","sub","entityBaseUrl","missingInEntityUrl","originalChain"],"sourceRoot":"../../../src","sources":["trust/chain.ts"],"mappings":"AAAA,SACEA,mBAAmB,EACnBC,eAAe,EACfC,8BAA8B,QACzB,SAAS;AAEhB,OAAO,KAAKC,CAAC,MAAM,KAAK;AACxB,SAASC,4BAA4B,EAAEC,wBAAwB,QAAQ,GAAG;AAC1E,SAASC,MAAM,EAAoBC,MAAM,QAAQ,SAAS;AAC1D,SACEC,mCAAmC,EACnCC,oBAAoB,EACpBC,sBAAsB,EACtBC,2BAA2B,QACtB,UAAU;;AAEjB;AACA,MAAMC,iBAAiB,GAAGZ,mBAAmB;AAC7C;AACA,MAAMa,kBAAkB,GAAGZ,eAAe;AAC1C;AACA;AACA,MAAMa,gBAAgB,GAAGX,CAAC,CAACY,KAAK,CAAC,CAC/Bd,eAAe,EACfC,8BAA8B,CAC/B,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAec,kBAAkBA,CACtCC,iBAAiD,EACjDC,KAAe,EACS;EACxB;EACA,IAAIA,KAAK,CAACC,MAAM,KAAK,CAAC,EAAE;IACtB,MAAM,IAAIV,oBAAoB,CAAC,kCAAkC,CAAC;EACpE;;EAEA;EACA,MAAMW,gBAAgB,GAAIC,YAAoB,IAC5CA,YAAY,KAAK,CAAC,GACdT,iBAAiB,GACjBS,YAAY,KAAKH,KAAK,CAACC,MAAM,GAAG,CAAC,GAC/BL,gBAAgB,GAChBD,kBAAkB;;EAE1B;EACA,MAAMS,SAAS,GAAIC,YAAoB,IAAa;IAClD,MAAMC,KAAK,GAAGN,KAAK,CAACK,YAAY,CAAC;IACjC,IAAI,CAACC,KAAK,EAAE;MACV,MAAM,IAAIb,2BAA2B,CAClC,0BAAyBY,YAAa,kBAAiB,EACxD;QAAEE,KAAK,EAAEF;MAAa,CACxB,CAAC;IACH;IACA,MAAMG,KAAK,GAAGN,gBAAgB,CAACG,YAAY,CAAC;IAC5C,OAAOG,KAAK,CAACC,KAAK,CAACrB,MAAM,CAACkB,KAAK,CAAC,CAAC,CAACI,MAAM,CAACC,GAAG;EAC9C,CAAC;;EAED;EACA;EACA,MAAMC,UAAU,GAAIP,YAAoB,IAAY;IAClD,IAAIA,YAAY,KAAKL,KAAK,CAACC,MAAM,GAAG,CAAC,EAAE;MACrC,OAAOF,iBAAiB,CAACc,OAAO,CAACC,IAAI,CAACC,IAAI;IAC5C;IAEA,MAAMC,SAAS,GAAGX,YAAY,GAAG,CAAC;IAClC,MAAMY,SAAS,GAAGjB,KAAK,CAACgB,SAAS,CAAC;IAClC,IAAI,CAACC,SAAS,EAAE;MACd,MAAM,IAAIxB,2BAA2B,CAClC,+BAA8BuB,SAAU,kCAAiCX,YAAa,IAAG,EAC1F;QAAEE,KAAK,EAAES;MAAU,CACrB,CAAC;IACH;IACA,MAAMR,KAAK,GAAGN,gBAAgB,CAACc,SAAS,CAAC;IACzC,OAAOR,KAAK,CAACC,KAAK,CAACrB,MAAM,CAAC6B,SAAS,CAAC,CAAC,CAACJ,OAAO,CAACC,IAAI,CAACC,IAAI;EACzD,CAAC;;EAED;EACA;EACA,OAAOG,OAAO,CAACC,GAAG,CAChBnB,KAAK,CACFoB,GAAG,CAAC,CAACd,KAAK,EAAEe,CAAC,KAAK,CAACf,KAAK,EAAEF,SAAS,CAACiB,CAAC,CAAC,EAAET,UAAU,CAACS,CAAC,CAAC,CAAU,CAAC,CAChED,GAAG,CAAEE,IAAI,IAAKjC,MAAM,CAAC,GAAGiC,IAAI,CAAC,CAClC,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,eAAeA,CACnCvB,KAAe,EAEI;EAAA,IADnBwB,QAA8B,GAAAC,SAAA,CAAAxB,MAAA,QAAAwB,SAAA,QAAAC,SAAA,GAAAD,SAAA,MAAGE,KAAK;EAEtC,OAAOT,OAAO,CAACC,GAAG,CAChBnB,KAAK,CAACoB,GAAG,CAAC,OAAOd,KAAK,EAAEC,KAAK,KAAK;IAChC,MAAMqB,OAAO,GAAGxC,MAAM,CAACkB,KAAK,CAAC;IAE7B,MAAMuB,qBAAqB,GAAG9C,eAAe,CAAC+C,SAAS,CAACF,OAAO,CAAC;IAChE,MAAMG,yBAAyB,GAAGjD,mBAAmB,CAACgD,SAAS,CAACF,OAAO,CAAC;IAExE,IAAIG,yBAAyB,CAACC,OAAO,EAAE;MACrC,OAAO9C,4BAA4B,CACjC6C,yBAAyB,CAACE,IAAI,CAACpB,OAAO,CAACqB,GAAG,EAC1C;QAAEV;MAAS,CACb,CAAC;IACH;IACA,IAAIK,qBAAqB,CAACG,OAAO,EAAE;MACjC,MAAMG,eAAe,GAAGN,qBAAqB,CAACI,IAAI;MAElD,MAAMG,aAAa,GAAGD,eAAe,CAACtB,OAAO,CAACqB,GAAG;MACjD,MAAMG,WAAW,GAAG,MAAMnD,4BAA4B,CAACkD,aAAa,EAAE;QACpEZ;MACF,CAAC,CAAC;MACF,MAAMc,QAAQ,GAAGxD,mBAAmB,CAAC2B,KAAK,CAACrB,MAAM,CAACiD,WAAW,CAAC,CAAC;MAE/D,MAAME,uBAAuB,GAC3BD,QAAQ,CAACzB,OAAO,CAAC2B,QAAQ,CAACC,iBAAiB,CAACC,yBAAyB;MACvE,IAAI,CAACH,uBAAuB,EAAE;QAC5B,MAAM,IAAIjD,mCAAmC,CAC1C,gBAAe8C,aAAc,8DAA6DD,eAAe,CAACtB,OAAO,CAAC8B,GAAI,GAAE,EACzH;UACEC,aAAa,EAAET,eAAe,CAACtB,OAAO,CAAC8B,GAAG;UAC1CE,kBAAkB,EAAET;QACtB,CACF,CAAC;MACH;MACA,OAAOjD,wBAAwB,CAC7BoD,uBAAuB,EACvBJ,eAAe,CAACtB,OAAO,CAAC8B,GAAG,EAC3B;QAAEnB;MAAS,CACb,CAAC;IACH;IACA,MAAM,IAAIhC,sBAAsB,CAC7B,iDAAgDe,KAAM,mBAAkB,EACzE;MAAEuC,aAAa,EAAE9C;IAAM,CACzB,CAAC;EACH,CAAC,CACH,CAAC;AACH"}
+{"version":3,"names":["EntityConfiguration","EntityStatement","TrustAnchorEntityConfiguration","z","getSignedEntityConfiguration","getSignedEntityStatement","decode","getTrustAnchorX509Certificate","verify","FederationError","MissingFederationFetchEndpointError","MissingX509CertsError","TrustChainEmptyError","TrustChainRenewalError","TrustChainTokenMissingError","X509ValidationError","verifyCertificateChain","FirstElementShape","MiddleElementShape","LastElementShape","union","validateTrustChain","trustAnchorEntity","chain","x509Options","length","selectTokenShape","elementIndex","selectKid","currentIndex","token","index","shape","parse","header","kid","selectKeys","payload","jwks","keys","nextIndex","nextToken","x509TrustAnchorCertBase64","validationPromises","map","tokenString","i","kidFromTokenHeader","signerJwks","parsedToken","jwkUsedForVerification","find","k","tokenIndex","x5c","certChainBase64","at","slice","x509ValidationResult","isValid","validationStatus","errorMessage","x509ValidationStatus","x509ErrorMessage","Promise","all","renewTrustChain","appFetch","arguments","undefined","fetch","decoded","entityStatementResult","safeParse","entityConfigurationResult","success","data","iss","entityStatement","parentBaseUrl","parentECJwt","parentEC","federationFetchEndpoint","metadata","federation_entity","federation_fetch_endpoint","sub","entityBaseUrl","missingInEntityUrl","originalChain"],"sourceRoot":"../../../src","sources":["trust/chain.ts"],"mappings":"AAAA,SACEA,mBAAmB,EACnBC,eAAe,EACfC,8BAA8B,QACzB,SAAS;AAEhB,OAAO,KAAKC,CAAC,MAAM,KAAK;AACxB,SAASC,4BAA4B,EAAEC,wBAAwB,QAAQ,GAAG;AAC1E,SACEC,MAAM,EACNC,6BAA6B,EAE7BC,MAAM,QACD,SAAS;AAChB,SACEC,eAAe,EACfC,mCAAmC,EACnCC,qBAAqB,EACrBC,oBAAoB,EACpBC,sBAAsB,EACtBC,2BAA2B,EAC3BC,mBAAmB,QACd,UAAU;AACjB,SAEEC,sBAAsB,QAEjB,gCAAgC;;AAEvC;AACA,MAAMC,iBAAiB,GAAGjB,mBAAmB;AAC7C;AACA,MAAMkB,kBAAkB,GAAGjB,eAAe;AAC1C;AACA;AACA,MAAMkB,gBAAgB,GAAGhB,CAAC,CAACiB,KAAK,CAAC,CAC/BnB,eAAe,EACfC,8BAA8B,CAC/B,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAemB,kBAAkBA,CACtCC,iBAAiD,EACjDC,KAAe,EACfC,WAAmC,EACX;EACxB;EACA,IAAID,KAAK,CAACE,MAAM,KAAK,CAAC,EAAE;IACtB,MAAM,IAAIb,oBAAoB,CAAC,kCAAkC,CAAC;EACpE;;EAEA;EACA,MAAMc,gBAAgB,GAAIC,YAAoB,IAC5CA,YAAY,KAAK,CAAC,GACdV,iBAAiB,GACjBU,YAAY,KAAKJ,KAAK,CAACE,MAAM,GAAG,CAAC,GAC/BN,gBAAgB,GAChBD,kBAAkB;;EAE1B;EACA,MAAMU,SAAS,GAAIC,YAAoB,IAAa;IAClD,MAAMC,KAAK,GAAGP,KAAK,CAACM,YAAY,CAAC;IACjC,IAAI,CAACC,KAAK,EAAE;MACV,MAAM,IAAIhB,2BAA2B,CAClC,0BAAyBe,YAAa,kBAAiB,EACxD;QAAEE,KAAK,EAAEF;MAAa,CACxB,CAAC;IACH;IACA,MAAMG,KAAK,GAAGN,gBAAgB,CAACG,YAAY,CAAC;IAC5C,OAAOG,KAAK,CAACC,KAAK,CAAC3B,MAAM,CAACwB,KAAK,CAAC,CAAC,CAACI,MAAM,CAACC,GAAG;EAC9C,CAAC;;EAED;EACA;EACA,MAAMC,UAAU,GAAIP,YAAoB,IAAY;IAClD,IAAIA,YAAY,KAAKN,KAAK,CAACE,MAAM,GAAG,CAAC,EAAE;MACrC,OAAOH,iBAAiB,CAACe,OAAO,CAACC,IAAI,CAACC,IAAI;IAC5C;IAEA,MAAMC,SAAS,GAAGX,YAAY,GAAG,CAAC;IAClC,MAAMY,SAAS,GAAGlB,KAAK,CAACiB,SAAS,CAAC;IAClC,IAAI,CAACC,SAAS,EAAE;MACd,MAAM,IAAI3B,2BAA2B,CAClC,+BAA8B0B,SAAU,kCAAiCX,YAAa,IAAG,EAC1F;QAAEE,KAAK,EAAES;MAAU,CACrB,CAAC;IACH;IACA,MAAMR,KAAK,GAAGN,gBAAgB,CAACc,SAAS,CAAC;IACzC,OAAOR,KAAK,CAACC,KAAK,CAAC3B,MAAM,CAACmC,SAAS,CAAC,CAAC,CAACJ,OAAO,CAACC,IAAI,CAACC,IAAI;EACzD,CAAC;EAED,MAAMG,yBAAyB,GAC7BnC,6BAA6B,CAACe,iBAAiB,CAAC;;EAElD;EACA;EACA,MAAMqB,kBAAkB,GAAGpB,KAAK,CAACqB,GAAG,CAAC,OAAOC,WAAW,EAAEC,CAAC,KAAK;IAC7D,MAAMC,kBAAkB,GAAGnB,SAAS,CAACkB,CAAC,CAAC;IACvC,MAAME,UAAU,GAAGZ,UAAU,CAACU,CAAC,CAAC;;IAEhC;IACA,MAAMG,WAAW,GAAG,MAAMzC,MAAM,CAC9BqC,WAAW,EACXE,kBAAkB,EAClBC,UACF,CAAC;;IAED;IACA,MAAME,sBAAsB,GAAGF,UAAU,CAACG,IAAI,CAC3CC,CAAC,IAAKA,CAAC,CAACjB,GAAG,KAAKY,kBACnB,CAAC;IAED,IAAI,CAACG,sBAAsB,EAAE;MAC3B,MAAM,IAAIzC,eAAe,CACtB,iBAAgBsC,kBAAmB,uDAAsDD,CAAE,mCAAkC,EAC9H;QAAEO,UAAU,EAAEP,CAAC;QAAEX,GAAG,EAAEY;MAAmB,CAC3C,CAAC;IACH;IAEA,IACE,CAACG,sBAAsB,CAACI,GAAG,IAC3BJ,sBAAsB,CAACI,GAAG,CAAC7B,MAAM,KAAK,CAAC,EACvC;MACA,MAAM,IAAId,qBAAqB,CAC5B,iBAAgBoC,kBAAmB,0EAAyED,CAAE,GACjH,CAAC;IACH;;IAEA;IACA;IACA;IACA,MAAMS,eAAe,GACnBL,sBAAsB,CAACI,GAAG,CAAC7B,MAAM,GAAG,CAAC,IACrCyB,sBAAsB,CAACI,GAAG,CAACE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAKd,yBAAyB,GAC3DQ,sBAAsB,CAACI,GAAG,CAACG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACvCP,sBAAsB,CAACI,GAAG;IAEhC,MAAMI,oBAAiD,GACrD,MAAM1C,sBAAsB,CAC1BuC,eAAe,EACfb,yBAAyB,EACzBlB,WACF,CAAC;IAEH,IAAI,CAACkC,oBAAoB,CAACC,OAAO,EAAE;MACjC,MAAM,IAAI5C,mBAAmB,CAC1B,gEAA+D+B,CAAE,UAASC,kBAAmB,cAAaW,oBAAoB,CAACE,gBAAiB,YAAWF,oBAAoB,CAACG,YAAa,EAAC,EAC/L;QACER,UAAU,EAAEP,CAAC;QACbX,GAAG,EAAEY,kBAAkB;QACvBe,oBAAoB,EAAEJ,oBAAoB,CAACE,gBAAgB;QAC3DG,gBAAgB,EAAEL,oBAAoB,CAACG;MACzC,CACF,CAAC;IACH;IACA,OAAOZ,WAAW;EACpB,CAAC,CAAC;EAEF,OAAOe,OAAO,CAACC,GAAG,CAACtB,kBAAkB,CAAC;AACxC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeuB,eAAeA,CACnC3C,KAAe,EAEI;EAAA,IADnB4C,QAA8B,GAAAC,SAAA,CAAA3C,MAAA,QAAA2C,SAAA,QAAAC,SAAA,GAAAD,SAAA,MAAGE,KAAK;EAEtC,OAAON,OAAO,CAACC,GAAG,CAChB1C,KAAK,CAACqB,GAAG,CAAC,OAAOd,KAAK,EAAEC,KAAK,KAAK;IAChC,MAAMwC,OAAO,GAAGjE,MAAM,CAACwB,KAAK,CAAC;IAE7B,MAAM0C,qBAAqB,GAAGvE,eAAe,CAACwE,SAAS,CAACF,OAAO,CAAC;IAChE,MAAMG,yBAAyB,GAAG1E,mBAAmB,CAACyE,SAAS,CAACF,OAAO,CAAC;IAExE,IAAIG,yBAAyB,CAACC,OAAO,EAAE;MACrC,OAAOvE,4BAA4B,CACjCsE,yBAAyB,CAACE,IAAI,CAACvC,OAAO,CAACwC,GAAG,EAC1C;QAAEV;MAAS,CACb,CAAC;IACH;IACA,IAAIK,qBAAqB,CAACG,OAAO,EAAE;MACjC,MAAMG,eAAe,GAAGN,qBAAqB,CAACI,IAAI;MAElD,MAAMG,aAAa,GAAGD,eAAe,CAACzC,OAAO,CAACwC,GAAG;MACjD,MAAMG,WAAW,GAAG,MAAM5E,4BAA4B,CAAC2E,aAAa,EAAE;QACpEZ;MACF,CAAC,CAAC;MACF,MAAMc,QAAQ,GAAGjF,mBAAmB,CAACiC,KAAK,CAAC3B,MAAM,CAAC0E,WAAW,CAAC,CAAC;MAE/D,MAAME,uBAAuB,GAC3BD,QAAQ,CAAC5C,OAAO,CAAC8C,QAAQ,CAACC,iBAAiB,CAACC,yBAAyB;MACvE,IAAI,CAACH,uBAAuB,EAAE;QAC5B,MAAM,IAAIxE,mCAAmC,CAC1C,gBAAeqE,aAAc,8DAA6DD,eAAe,CAACzC,OAAO,CAACiD,GAAI,GAAE,EACzH;UACEC,aAAa,EAAET,eAAe,CAACzC,OAAO,CAACiD,GAAG;UAC1CE,kBAAkB,EAAET;QACtB,CACF,CAAC;MACH;MACA,OAAO1E,wBAAwB,CAC7B6E,uBAAuB,EACvBJ,eAAe,CAACzC,OAAO,CAACiD,GAAG,EAC3B;QAAEnB;MAAS,CACb,CAAC;IACH;IACA,MAAM,IAAItD,sBAAsB,CAC7B,iDAAgDkB,KAAM,mBAAkB,EACzE;MAAE0D,aAAa,EAAElE;IAAM,CACzB,CAAC;EACH,CAAC,CACH,CAAC;AACH"}

package/lib/module/trust/errors.js

@@ -1,5 +1,5 @@
-import { IoWalletError, serializeAttrs } from "../utils/errors"; // Ensure this path is correct
-
+import { IoWalletError, serializeAttrs } from "../utils/errors";
+// Ensure this path is correct
 /**
  * Base class for all federation-specific errors.
  */
@@ -91,4 +91,25 @@ export class MissingFederationFetchEndpointError extends FederationError {
     super(message, details);
   }
 }
+
+/**
+ * Error thrown when the X.509 certificate chain is missing in an entity's configuration.
+ */
+export class MissingX509CertsError extends FederationError {
+  code = "ERR_FED_MISSING_X509_CERTS";
+  constructor(message) {
+    super(message, undefined);
+  }
+}
+
+/**
+ * Error thrown when an X.509 certificate validation fails.
+ * This is used to indicate issues with the certificate chain or signature verification.
+ */
+export class X509ValidationError extends FederationError {
+  code = "ERR_FED_X509_VALIDATION_FAILED";
+  constructor(message, details) {
+    super(message, details);
+  }
+}
 //# sourceMappingURL=errors.js.map

package/lib/module/trust/errors.js.map

@@ -1 +1 @@
-{"version":3,"names":["IoWalletError","serializeAttrs","FederationError","constructor","message","details","name","TrustChainEmptyError","code","arguments","length","undefined","TrustChainTokenMissingError","TrustChainRenewalError","FederationListParseError","BuildTrustChainError","TrustAnchorKidMissingError","RelyingPartyNotAuthorizedError","MissingFederationFetchEndpointError"],"sourceRoot":"../../../src","sources":["trust/errors.ts"],"mappings":"AAAA,SAASA,aAAa,EAAEC,cAAc,QAAQ,iBAAiB,CAAC,CAAC;;AAEjE;AACA;AACA;AACA,OAAO,MAAMC,eAAe,SAASF,aAAa,CAAC;EACjDG,WAAWA,CAACC,OAAe,EAAEC,OAAiC,EAAE;IAC9D,KAAK,CAACA,OAAO,GAAGJ,cAAc,CAAC;MAAEG,OAAO;MAAE,GAAGC;IAAQ,CAAC,CAAC,GAAGD,OAAO,CAAC;IAClE,IAAI,CAACE,IAAI,GAAG,IAAI,CAACH,WAAW,CAACG,IAAI;EACnC;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMC,oBAAoB,SAASL,eAAe,CAAC;EACxDM,IAAI,GAAG,2BAA2B;EAClCL,WAAWA,CAAA,EAA2C;IAAA,IAA1CC,OAAO,GAAAK,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,8BAA8B;IAClD,KAAK,CAACL,OAAO,EAAEO,SAAS,CAAC;EAC3B;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMC,2BAA2B,SAASV,eAAe,CAAC;EAC/DM,IAAI,GAAG,mCAAmC;EAC1CL,WAAWA,CAACC,OAAe,EAAEC,OAA4B,EAAE;IACzD,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAMQ,sBAAsB,SAASX,eAAe,CAAC;EAC1DM,IAAI,GAAG,oCAAoC;EAC3CL,WAAWA,CACTC,OAAe,EACfC,OAA8D,EAC9D;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;AAEA,OAAO,MAAMS,wBAAwB,SAASZ,eAAe,CAAC;EAC5DM,IAAI,GAAG,sCAAsC;EAC7CL,WAAWA,CAACC,OAAe,EAAEC,OAA6C,EAAE;IAC1E,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMU,oBAAoB,SAASb,eAAe,CAAC;EACxDM,IAAI,GAAG,kCAAkC;EACzCL,WAAWA,CACTC,OAAe,EACfC,OAIC,EACD;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMW,0BAA0B,SAASd,eAAe,CAAC;EAC9DM,IAAI,GAAG,kCAAkC;EACzCL,WAAWA,CAAA,EAA0D;IAAA,IAAzDC,OAAO,GAAAK,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,6CAA6C;IACjE,KAAK,CAACL,OAAO,EAAEO,SAAS,CAAC;EAC3B;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMM,8BAA8B,SAASf,eAAe,CAAC;EAClEM,IAAI,GAAG,sCAAsC;EAC7CL,WAAWA,CACTC,OAAe,EACfC,OAAqE,EACrE;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMa,mCAAmC,SAAShB,eAAe,CAAC;EACvEM,IAAI,GAAG,2CAA2C;EAClDL,WAAWA,CACTC,OAAe,EACfC,OAA8D,EAC9D;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF"}
+{"version":3,"names":["IoWalletError","serializeAttrs","FederationError","constructor","message","details","name","TrustChainEmptyError","code","arguments","length","undefined","TrustChainTokenMissingError","TrustChainRenewalError","FederationListParseError","BuildTrustChainError","TrustAnchorKidMissingError","RelyingPartyNotAuthorizedError","MissingFederationFetchEndpointError","MissingX509CertsError","X509ValidationError"],"sourceRoot":"../../../src","sources":["trust/errors.ts"],"mappings":"AAAA,SAASA,aAAa,EAAEC,cAAc,QAAQ,iBAAiB;AACoB;AAEnF;AACA;AACA;AACA,OAAO,MAAMC,eAAe,SAASF,aAAa,CAAC;EACjDG,WAAWA,CAACC,OAAe,EAAEC,OAAiC,EAAE;IAC9D,KAAK,CAACA,OAAO,GAAGJ,cAAc,CAAC;MAAEG,OAAO;MAAE,GAAGC;IAAQ,CAAC,CAAC,GAAGD,OAAO,CAAC;IAClE,IAAI,CAACE,IAAI,GAAG,IAAI,CAACH,WAAW,CAACG,IAAI;EACnC;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMC,oBAAoB,SAASL,eAAe,CAAC;EACxDM,IAAI,GAAG,2BAA2B;EAClCL,WAAWA,CAAA,EAA2C;IAAA,IAA1CC,OAAO,GAAAK,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,8BAA8B;IAClD,KAAK,CAACL,OAAO,EAAEO,SAAS,CAAC;EAC3B;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMC,2BAA2B,SAASV,eAAe,CAAC;EAC/DM,IAAI,GAAG,mCAAmC;EAC1CL,WAAWA,CAACC,OAAe,EAAEC,OAA4B,EAAE;IACzD,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAMQ,sBAAsB,SAASX,eAAe,CAAC;EAC1DM,IAAI,GAAG,oCAAoC;EAC3CL,WAAWA,CACTC,OAAe,EACfC,OAA8D,EAC9D;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;AAEA,OAAO,MAAMS,wBAAwB,SAASZ,eAAe,CAAC;EAC5DM,IAAI,GAAG,sCAAsC;EAC7CL,WAAWA,CAACC,OAAe,EAAEC,OAA6C,EAAE;IAC1E,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMU,oBAAoB,SAASb,eAAe,CAAC;EACxDM,IAAI,GAAG,kCAAkC;EACzCL,WAAWA,CACTC,OAAe,EACfC,OAIC,EACD;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMW,0BAA0B,SAASd,eAAe,CAAC;EAC9DM,IAAI,GAAG,kCAAkC;EACzCL,WAAWA,CAAA,EAA0D;IAAA,IAAzDC,OAAO,GAAAK,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,6CAA6C;IACjE,KAAK,CAACL,OAAO,EAAEO,SAAS,CAAC;EAC3B;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMM,8BAA8B,SAASf,eAAe,CAAC;EAClEM,IAAI,GAAG,sCAAsC;EAC7CL,WAAWA,CACTC,OAAe,EACfC,OAAqE,EACrE;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMa,mCAAmC,SAAShB,eAAe,CAAC;EACvEM,IAAI,GAAG,2CAA2C;EAClDL,WAAWA,CACTC,OAAe,EACfC,OAA8D,EAC9D;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMc,qBAAqB,SAASjB,eAAe,CAAC;EACzDM,IAAI,GAAG,4BAA4B;EACnCL,WAAWA,CAACC,OAAe,EAAE;IAC3B,KAAK,CAACA,OAAO,EAAEO,SAAS,CAAC;EAC3B;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAMS,mBAAmB,SAASlB,eAAe,CAAC;EACvDM,IAAI,GAAG,gCAAgC;EACvCL,WAAWA,CACTC,OAAe,EACfC,OAMC,EACD;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF"}

package/lib/module/trust/index.js

@@ -10,22 +10,28 @@ import { BuildTrustChainError, FederationListParseError, MissingFederationFetchE
  *
  * @param trustAnchorEntity The entity configuration of the known trust anchor
  * @param chain The chain of statements to be validated
- * @param renewOnFail Whether to renew the provided chain if the validation fails at first. Default: true
- * @param appFetch Fetch api implementation. Default: the built-in implementation
+ * @param x509Options Options for the verification process
+ * @param appFetch (optional) fetch api implementation
+ * @param renewOnFail Whether to attempt to renew the trust chain if the initial validation fails
  * @returns The result of the chain validation
  * @throws {FederationError} If the chain is not valid
  */
 export async function verifyTrustChain(trustAnchorEntity, chain) {
+  let x509Options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {
+    connectTimeout: 10000,
+    readTimeout: 10000,
+    requireCrl: true
+  };
   let {
     appFetch = fetch,
     renewOnFail = true
-  } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
+  } = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : {};
   try {
-    return validateTrustChain(trustAnchorEntity, chain);
+    return validateTrustChain(trustAnchorEntity, chain, x509Options);
   } catch (error) {
     if (renewOnFail) {
       const renewedChain = await renewTrustChain(chain, appFetch);
-      return validateTrustChain(trustAnchorEntity, renewedChain);
+      return validateTrustChain(trustAnchorEntity, renewedChain, x509Options);
     } else {
       throw error;
     }

package/lib/module/trust/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["decode","verify","decodeJwt","CredentialIssuerEntityConfiguration","EntityConfiguration","EntityStatement","FederationListResponse","RelyingPartyEntityConfiguration","TrustAnchorEntityConfiguration","WalletProviderEntityConfiguration","renewTrustChain","validateTrustChain","hasStatusOrThrow","BuildTrustChainError","FederationListParseError","MissingFederationFetchEndpointError","RelyingPartyNotAuthorizedError","TrustAnchorKidMissingError","verifyTrustChain","trustAnchorEntity","chain","appFetch","fetch","renewOnFail","arguments","length","undefined","error","renewedChain","getSignedEntityConfiguration","entityBaseUrl","wellKnownUrl","method","then","res","text","fetchAndParseEntityConfiguration","schema","responseText","responseJwt","parse","header","protectedHeader","payload","getWalletProviderEntityConfiguration","options","getCredentialIssuerEntityConfiguration","getTrustAnchorEntityConfiguration","getRelyingPartyEntityConfiguration","getEntityConfiguration","getEntityStatement","accreditationBodyBaseUrl","subordinatedEntityBaseUrl","getSignedEntityStatement","federationFetchEndpoint","url","URL","searchParams","set","toString","getFederationList","federationListEndpoint","json","result","safeParse","success","message","parseError","data","buildTrustChain","relyingPartyEntityBaseUrl","trustAnchorKey","trustChain","gatherTrustChain","trustAnchorJwt","relyingPartyUrl","kid","trustAnchorConfig","metadata","federation_entity","federation_list_endpoint","federationList","includes","isLeaf","entityECJwt","entityEC","push","authorityHints","authority_hints","parentEntityBaseUrl","parentECJwt","parentEC","federation_fetch_endpoint","missingInEntityUrl","entityStatementJwt","parentChain","concat"],"sourceRoot":"../../../src","sources":["trust/index.ts"],"mappings":"AAAA,SAASA,MAAM,EAAEC,MAAM,QAAQ,SAAS;AACxC,SAASD,MAAM,IAAIE,SAAS,QAAQ,6BAA6B;AACjE,SACEC,mCAAmC,EACnCC,mBAAmB,EACnBC,eAAe,EACfC,sBAAsB,EACtBC,+BAA+B,EAC/BC,8BAA8B,EAC9BC,iCAAiC,QAC5B,SAAS;AAChB,SAASC,eAAe,EAAEC,kBAAkB,QAAQ,SAAS;AAC7D,SAASC,gBAAgB,QAAQ,eAAe;AAEhD,SACEC,oBAAoB,EACpBC,wBAAwB,EACxBC,mCAAmC,EACnCC,8BAA8B,EAC9BC,0BAA0B,QACrB,UAAU;AAWjB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,gBAAgBA,CACpCC,iBAAiD,EACjDC,KAAe,EAKiC;EAAA,IAJhD;IACEC,QAAQ,GAAGC,KAAK;IAChBC,WAAW,GAAG;EAC4C,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAElE,IAAI;IACF,OAAOb,kBAAkB,CAACQ,iBAAiB,EAAEC,KAAK,CAAC;EACrD,CAAC,CAAC,OAAOO,KAAK,EAAE;IACd,IAAIJ,WAAW,EAAE;MACf,MAAMK,YAAY,GAAG,MAAMlB,eAAe,CAACU,KAAK,EAAEC,QAAQ,CAAC;MAC3D,OAAOV,kBAAkB,CAACQ,iBAAiB,EAAES,YAAY,CAAC;IAC5D,CAAC,MAAM;MACL,MAAMD,KAAK;IACb;EACF;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeE,4BAA4BA,CAChDC,aAAqB,EAMJ;EAAA,IALjB;IACET,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMO,YAAY,GAAI,GAAED,aAAc,gCAA+B;EAErE,OAAO,MAAMT,QAAQ,CAACU,YAAY,EAAE;IAClCC,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAACrB,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3BqB,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoCA,eAAeC,gCAAgCA,CAC7CN,aAAqB,EACrBO,MAK8B,EAM9B;EAAA,IALA;IACEhB,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMc,YAAY,GAAG,MAAMT,4BAA4B,CAACC,aAAa,EAAE;IACrET;EACF,CAAC,CAAC;EAEF,MAAMkB,WAAW,GAAGrC,SAAS,CAACoC,YAAY,CAAC;EAC3C,OAAOD,MAAM,CAACG,KAAK,CAAC;IAClBC,MAAM,EAAEF,WAAW,CAACG,eAAe;IACnCC,OAAO,EAAEJ,WAAW,CAACI;EACvB,CAAC,CAAC;AACJ;AAEA,OAAO,MAAMC,oCAAoC,GAAGA,CAClDd,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAC9BN,aAAa,EACbrB,iCAAiC,EACjCoC,OACF,CAAC;AAEH,OAAO,MAAMC,sCAAsC,GAAGA,CACpDhB,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAC9BN,aAAa,EACb3B,mCAAmC,EACnC0C,OACF,CAAC;AAEH,OAAO,MAAME,iCAAiC,GAAGA,CAC/CjB,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAC9BN,aAAa,EACbtB,8BAA8B,EAC9BqC,OACF,CAAC;AAEH,OAAO,MAAMG,kCAAkC,GAAGA,CAChDlB,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAC9BN,aAAa,EACbvB,+BAA+B,EAC/BsC,OACF,CAAC;AAEH,OAAO,MAAMI,sBAAsB,GAAGA,CACpCnB,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAACN,aAAa,EAAE1B,mBAAmB,EAAEyC,OAAO,CAAC;;AAE/E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeK,kBAAkBA,CACtCC,wBAAgC,EAChCC,yBAAiC,EAMjC;EAAA,IALA;IACE/B,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMc,YAAY,GAAG,MAAMe,wBAAwB,CACjDF,wBAAwB,EACxBC,yBAAyB,EACzB;IACE/B;EACF,CACF,CAAC;EAED,MAAMkB,WAAW,GAAGrC,SAAS,CAACoC,YAAY,CAAC;EAC3C,OAAOjC,eAAe,CAACmC,KAAK,CAAC;IAC3BC,MAAM,EAAEF,WAAW,CAACG,eAAe;IACnCC,OAAO,EAAEJ,WAAW,CAACI;EACvB,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeU,wBAAwBA,CAC5CC,uBAA+B,EAC/BF,yBAAiC,EAMjC;EAAA,IALA;IACE/B,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAM+B,GAAG,GAAG,IAAIC,GAAG,CAACF,uBAAuB,CAAC;EAC5CC,GAAG,CAACE,YAAY,CAACC,GAAG,CAAC,KAAK,EAAEN,yBAAyB,CAAC;EAEtD,OAAO,MAAM/B,QAAQ,CAACkC,GAAG,CAACI,QAAQ,CAAC,CAAC,EAAE;IACpC3B,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAACrB,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3BqB,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeyB,iBAAiBA,CACrCC,sBAA8B,EAMX;EAAA,IALnB;IACExC,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,OAAO,MAAMH,QAAQ,CAACwC,sBAAsB,EAAE;IAC5C7B,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAACrB,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3BqB,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAAC4B,IAAI,CAAC,CAAC,CAAC,CACzB7B,IAAI,CAAE6B,IAAI,IAAK;IACd,MAAMC,MAAM,GAAGzD,sBAAsB,CAAC0D,SAAS,CAACF,IAAI,CAAC;IACrD,IAAI,CAACC,MAAM,CAACE,OAAO,EAAE;MACnB,MAAM,IAAInD,wBAAwB,CAC/B,gDAA+C+C,sBAAuB,YAAWE,MAAM,CAACpC,KAAK,CAACuC,OAAQ,EAAC,EACxG;QAAEX,GAAG,EAAEM,sBAAsB;QAAEM,UAAU,EAAEJ,MAAM,CAACpC,KAAK,CAACgC,QAAQ,CAAC;MAAE,CACrE,CAAC;IACH;IACA,OAAOI,MAAM,CAACK,IAAI;EACpB,CAAC,CAAC;AACN;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,eAAeA,CACnCC,yBAAiC,EACjCC,cAAmB,EAEA;EAAA,IADnBlD,QAA8B,GAAAG,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAGF,KAAK;EAEtC;EACA,MAAMkD,UAAU,GAAG,MAAMC,gBAAgB,CACvCH,yBAAyB,EACzBjD,QACF,CAAC;;EAED;EACA,MAAMqD,cAAc,GAAGF,UAAU,CAACA,UAAU,CAAC/C,MAAM,GAAG,CAAC,CAAC;EACxD,IAAI,CAACiD,cAAc,EAAE;IACnB,MAAM,IAAI7D,oBAAoB,CAC5B,6EAA6E,EAC7E;MAAE8D,eAAe,EAAEL;IAA0B,CAC/C,CAAC;EACH;EAEA,IAAI,CAACC,cAAc,CAACK,GAAG,EAAE;IACvB,MAAM,IAAI3D,0BAA0B,CAAC,CAAC;EACxC;EAEA,MAAMhB,MAAM,CAACyE,cAAc,EAAEH,cAAc,CAACK,GAAG,EAAE,CAACL,cAAc,CAAC,CAAC;;EAElE;EACA,MAAMM,iBAAiB,GAAGzE,mBAAmB,CAACoC,KAAK,CAACxC,MAAM,CAAC0E,cAAc,CAAC,CAAC;EAC3E,MAAMb,sBAAsB,GAC1BgB,iBAAiB,CAAClC,OAAO,CAACmC,QAAQ,CAACC,iBAAiB,CACjDC,wBAAwB;EAE7B,IAAInB,sBAAsB,EAAE;IAC1B,MAAMoB,cAAc,GAAG,MAAMrB,iBAAiB,CAACC,sBAAsB,EAAE;MACrExC;IACF,CAAC,CAAC;IAEF,IAAI,CAAC4D,cAAc,CAACC,QAAQ,CAACZ,yBAAyB,CAAC,EAAE;MACvD,MAAM,IAAItD,8BAA8B,CACtC,wFAAwF,EACxF;QAAE2D,eAAe,EAAEL,yBAAyB;QAAET;MAAuB,CACvE,CAAC;IACH;EACF;EAEA,OAAOW,UAAU;AACnB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,gBAAgBA,CAC7B3C,aAAqB,EACrBT,QAA8B,EAEX;EAAA,IADnB8D,MAAe,GAAA3D,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,IAAI;EAEtB,MAAMJ,KAAe,GAAG,EAAE;;EAE1B;EACA,MAAMgE,WAAW,GAAG,MAAMvD,4BAA4B,CAACC,aAAa,EAAE;IACpET;EACF,CAAC,CAAC;EACF,MAAMgE,QAAQ,GAAGjF,mBAAmB,CAACoC,KAAK,CAACxC,MAAM,CAACoF,WAAW,CAAC,CAAC;EAE/D,IAAID,MAAM,EAAE;IACV;IACA/D,KAAK,CAACkE,IAAI,CAACF,WAAW,CAAC;EACzB;;EAEA;EACA,MAAMG,cAAc,GAAGF,QAAQ,CAAC1C,OAAO,CAAC6C,eAAe,IAAI,EAAE;EAC7D,IAAID,cAAc,CAAC9D,MAAM,KAAK,CAAC,EAAE;IAC/B;IACA,IAAI,CAAC0D,MAAM,EAAE;MACX/D,KAAK,CAACkE,IAAI,CAACF,WAAW,CAAC;IACzB;IACA,OAAOhE,KAAK;EACd;EAEA,MAAMqE,mBAAmB,GAAGF,cAAc,CAAC,CAAC,CAAE;;EAE9C;EACA,MAAMG,WAAW,GAAG,MAAM7D,4BAA4B,CAAC4D,mBAAmB,EAAE;IAC1EpE;EACF,CAAC,CAAC;EACF,MAAMsE,QAAQ,GAAGvF,mBAAmB,CAACoC,KAAK,CAACxC,MAAM,CAAC0F,WAAW,CAAC,CAAC;;EAE/D;EACA,MAAMpC,uBAAuB,GAC3BqC,QAAQ,CAAChD,OAAO,CAACmC,QAAQ,CAACC,iBAAiB,CAACa,yBAAyB;EACvE,IAAI,CAACtC,uBAAuB,EAAE;IAC5B,MAAM,IAAIvC,mCAAmC,CAC1C,kDAAiD0E,mBAAoB,4CAA2C3D,aAAc,GAAE,EACjI;MAAEA,aAAa;MAAE+D,kBAAkB,EAAEJ;IAAoB,CAC3D,CAAC;EACH;EAEA,MAAMK,kBAAkB,GAAG,MAAMzC,wBAAwB,CACvDC,uBAAuB,EACvBxB,aAAa,EACb;IAAET;EAAS,CACb,CAAC;EACD;EACAhB,eAAe,CAACmC,KAAK,CAACxC,MAAM,CAAC8F,kBAAkB,CAAC,CAAC;;EAEjD;EACA1E,KAAK,CAACkE,IAAI,CAACQ,kBAAkB,CAAC;;EAE9B;EACA,MAAMC,WAAW,GAAG,MAAMtB,gBAAgB,CACxCgB,mBAAmB,EACnBpE,QAAQ,EACR,KACF,CAAC;EAED,OAAOD,KAAK,CAAC4E,MAAM,CAACD,WAAW,CAAC;AAClC"}
+{"version":3,"names":["decode","verify","decodeJwt","CredentialIssuerEntityConfiguration","EntityConfiguration","EntityStatement","FederationListResponse","RelyingPartyEntityConfiguration","TrustAnchorEntityConfiguration","WalletProviderEntityConfiguration","renewTrustChain","validateTrustChain","hasStatusOrThrow","BuildTrustChainError","FederationListParseError","MissingFederationFetchEndpointError","RelyingPartyNotAuthorizedError","TrustAnchorKidMissingError","verifyTrustChain","trustAnchorEntity","chain","x509Options","arguments","length","undefined","connectTimeout","readTimeout","requireCrl","appFetch","fetch","renewOnFail","error","renewedChain","getSignedEntityConfiguration","entityBaseUrl","wellKnownUrl","method","then","res","text","fetchAndParseEntityConfiguration","schema","responseText","responseJwt","parse","header","protectedHeader","payload","getWalletProviderEntityConfiguration","options","getCredentialIssuerEntityConfiguration","getTrustAnchorEntityConfiguration","getRelyingPartyEntityConfiguration","getEntityConfiguration","getEntityStatement","accreditationBodyBaseUrl","subordinatedEntityBaseUrl","getSignedEntityStatement","federationFetchEndpoint","url","URL","searchParams","set","toString","getFederationList","federationListEndpoint","json","result","safeParse","success","message","parseError","data","buildTrustChain","relyingPartyEntityBaseUrl","trustAnchorKey","trustChain","gatherTrustChain","trustAnchorJwt","relyingPartyUrl","kid","trustAnchorConfig","metadata","federation_entity","federation_list_endpoint","federationList","includes","isLeaf","entityECJwt","entityEC","push","authorityHints","authority_hints","parentEntityBaseUrl","parentECJwt","parentEC","federation_fetch_endpoint","missingInEntityUrl","entityStatementJwt","parentChain","concat"],"sourceRoot":"../../../src","sources":["trust/index.ts"],"mappings":"AAAA,SAASA,MAAM,EAAEC,MAAM,QAAQ,SAAS;AACxC,SAASD,MAAM,IAAIE,SAAS,QAAQ,6BAA6B;AACjE,SACEC,mCAAmC,EACnCC,mBAAmB,EACnBC,eAAe,EACfC,sBAAsB,EACtBC,+BAA+B,EAC/BC,8BAA8B,EAC9BC,iCAAiC,QAC5B,SAAS;AAChB,SAASC,eAAe,EAAEC,kBAAkB,QAAQ,SAAS;AAC7D,SAASC,gBAAgB,QAAQ,eAAe;AAEhD,SACEC,oBAAoB,EACpBC,wBAAwB,EACxBC,mCAAmC,EACnCC,8BAA8B,EAC9BC,0BAA0B,QACrB,UAAU;AAYjB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,gBAAgBA,CACpCC,iBAAiD,EACjDC,KAAe,EAUiC;EAAA,IAThDC,WAAmC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG;IACpCG,cAAc,EAAE,KAAK;IACrBC,WAAW,EAAE,KAAK;IAClBC,UAAU,EAAE;EACd,CAAC;EAAA,IACD;IACEC,QAAQ,GAAGC,KAAK;IAChBC,WAAW,GAAG;EAC4C,CAAC,GAAAR,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAElE,IAAI;IACF,OAAOX,kBAAkB,CAACQ,iBAAiB,EAAEC,KAAK,EAAEC,WAAW,CAAC;EAClE,CAAC,CAAC,OAAOU,KAAK,EAAE;IACd,IAAID,WAAW,EAAE;MACf,MAAME,YAAY,GAAG,MAAMtB,eAAe,CAACU,KAAK,EAAEQ,QAAQ,CAAC;MAC3D,OAAOjB,kBAAkB,CAACQ,iBAAiB,EAAEa,YAAY,EAAEX,WAAW,CAAC;IACzE,CAAC,MAAM;MACL,MAAMU,KAAK;IACb;EACF;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeE,4BAA4BA,CAChDC,aAAqB,EAMJ;EAAA,IALjB;IACEN,QAAQ,GAAGC;EAGb,CAAC,GAAAP,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMa,YAAY,GAAI,GAAED,aAAc,gCAA+B;EAErE,OAAO,MAAMN,QAAQ,CAACO,YAAY,EAAE;IAClCC,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAACzB,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3ByB,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoCA,eAAeC,gCAAgCA,CAC7CN,aAAqB,EACrBO,MAK8B,EAM9B;EAAA,IALA;IACEb,QAAQ,GAAGC;EAGb,CAAC,GAAAP,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMoB,YAAY,GAAG,MAAMT,4BAA4B,CAACC,aAAa,EAAE;IACrEN;EACF,CAAC,CAAC;EAEF,MAAMe,WAAW,GAAGzC,SAAS,CAACwC,YAAY,CAAC;EAC3C,OAAOD,MAAM,CAACG,KAAK,CAAC;IAClBC,MAAM,EAAEF,WAAW,CAACG,eAAe;IACnCC,OAAO,EAAEJ,WAAW,CAACI;EACvB,CAAC,CAAC;AACJ;AAEA,OAAO,MAAMC,oCAAoC,GAAGA,CAClDd,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAC9BN,aAAa,EACbzB,iCAAiC,EACjCwC,OACF,CAAC;AAEH,OAAO,MAAMC,sCAAsC,GAAGA,CACpDhB,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAC9BN,aAAa,EACb/B,mCAAmC,EACnC8C,OACF,CAAC;AAEH,OAAO,MAAME,iCAAiC,GAAGA,CAC/CjB,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAC9BN,aAAa,EACb1B,8BAA8B,EAC9ByC,OACF,CAAC;AAEH,OAAO,MAAMG,kCAAkC,GAAGA,CAChDlB,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAC9BN,aAAa,EACb3B,+BAA+B,EAC/B0C,OACF,CAAC;AAEH,OAAO,MAAMI,sBAAsB,GAAGA,CACpCnB,aAAqE,EACrEe,OAAgE,KAEhET,gCAAgC,CAACN,aAAa,EAAE9B,mBAAmB,EAAE6C,OAAO,CAAC;;AAE/E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeK,kBAAkBA,CACtCC,wBAAgC,EAChCC,yBAAiC,EAMjC;EAAA,IALA;IACE5B,QAAQ,GAAGC;EAGb,CAAC,GAAAP,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMoB,YAAY,GAAG,MAAMe,wBAAwB,CACjDF,wBAAwB,EACxBC,yBAAyB,EACzB;IACE5B;EACF,CACF,CAAC;EAED,MAAMe,WAAW,GAAGzC,SAAS,CAACwC,YAAY,CAAC;EAC3C,OAAOrC,eAAe,CAACuC,KAAK,CAAC;IAC3BC,MAAM,EAAEF,WAAW,CAACG,eAAe;IACnCC,OAAO,EAAEJ,WAAW,CAACI;EACvB,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeU,wBAAwBA,CAC5CC,uBAA+B,EAC/BF,yBAAiC,EAMjC;EAAA,IALA;IACE5B,QAAQ,GAAGC;EAGb,CAAC,GAAAP,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMqC,GAAG,GAAG,IAAIC,GAAG,CAACF,uBAAuB,CAAC;EAC5CC,GAAG,CAACE,YAAY,CAACC,GAAG,CAAC,KAAK,EAAEN,yBAAyB,CAAC;EAEtD,OAAO,MAAM5B,QAAQ,CAAC+B,GAAG,CAACI,QAAQ,CAAC,CAAC,EAAE;IACpC3B,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAACzB,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3ByB,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeyB,iBAAiBA,CACrCC,sBAA8B,EAMX;EAAA,IALnB;IACErC,QAAQ,GAAGC;EAGb,CAAC,GAAAP,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,OAAO,MAAMM,QAAQ,CAACqC,sBAAsB,EAAE;IAC5C7B,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAACzB,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3ByB,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAAC4B,IAAI,CAAC,CAAC,CAAC,CACzB7B,IAAI,CAAE6B,IAAI,IAAK;IACd,MAAMC,MAAM,GAAG7D,sBAAsB,CAAC8D,SAAS,CAACF,IAAI,CAAC;IACrD,IAAI,CAACC,MAAM,CAACE,OAAO,EAAE;MACnB,MAAM,IAAIvD,wBAAwB,CAC/B,gDAA+CmD,sBAAuB,YAAWE,MAAM,CAACpC,KAAK,CAACuC,OAAQ,EAAC,EACxG;QAAEX,GAAG,EAAEM,sBAAsB;QAAEM,UAAU,EAAEJ,MAAM,CAACpC,KAAK,CAACgC,QAAQ,CAAC;MAAE,CACrE,CAAC;IACH;IACA,OAAOI,MAAM,CAACK,IAAI;EACpB,CAAC,CAAC;AACN;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,eAAeA,CACnCC,yBAAiC,EACjCC,cAAmB,EAEA;EAAA,IADnB/C,QAA8B,GAAAN,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAGO,KAAK;EAEtC;EACA,MAAM+C,UAAU,GAAG,MAAMC,gBAAgB,CACvCH,yBAAyB,EACzB9C,QACF,CAAC;;EAED;EACA,MAAMkD,cAAc,GAAGF,UAAU,CAACA,UAAU,CAACrD,MAAM,GAAG,CAAC,CAAC;EACxD,IAAI,CAACuD,cAAc,EAAE;IACnB,MAAM,IAAIjE,oBAAoB,CAC5B,6EAA6E,EAC7E;MAAEkE,eAAe,EAAEL;IAA0B,CAC/C,CAAC;EACH;EAEA,IAAI,CAACC,cAAc,CAACK,GAAG,EAAE;IACvB,MAAM,IAAI/D,0BAA0B,CAAC,CAAC;EACxC;EAEA,MAAMhB,MAAM,CAAC6E,cAAc,EAAEH,cAAc,CAACK,GAAG,EAAE,CAACL,cAAc,CAAC,CAAC;;EAElE;EACA,MAAMM,iBAAiB,GAAG7E,mBAAmB,CAACwC,KAAK,CAAC5C,MAAM,CAAC8E,cAAc,CAAC,CAAC;EAC3E,MAAMb,sBAAsB,GAC1BgB,iBAAiB,CAAClC,OAAO,CAACmC,QAAQ,CAACC,iBAAiB,CACjDC,wBAAwB;EAE7B,IAAInB,sBAAsB,EAAE;IAC1B,MAAMoB,cAAc,GAAG,MAAMrB,iBAAiB,CAACC,sBAAsB,EAAE;MACrErC;IACF,CAAC,CAAC;IAEF,IAAI,CAACyD,cAAc,CAACC,QAAQ,CAACZ,yBAAyB,CAAC,EAAE;MACvD,MAAM,IAAI1D,8BAA8B,CACtC,wFAAwF,EACxF;QAAE+D,eAAe,EAAEL,yBAAyB;QAAET;MAAuB,CACvE,CAAC;IACH;EACF;EAEA,OAAOW,UAAU;AACnB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,gBAAgBA,CAC7B3C,aAAqB,EACrBN,QAA8B,EAEX;EAAA,IADnB2D,MAAe,GAAAjE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,IAAI;EAEtB,MAAMF,KAAe,GAAG,EAAE;;EAE1B;EACA,MAAMoE,WAAW,GAAG,MAAMvD,4BAA4B,CAACC,aAAa,EAAE;IACpEN;EACF,CAAC,CAAC;EACF,MAAM6D,QAAQ,GAAGrF,mBAAmB,CAACwC,KAAK,CAAC5C,MAAM,CAACwF,WAAW,CAAC,CAAC;EAE/D,IAAID,MAAM,EAAE;IACV;IACAnE,KAAK,CAACsE,IAAI,CAACF,WAAW,CAAC;EACzB;;EAEA;EACA,MAAMG,cAAc,GAAGF,QAAQ,CAAC1C,OAAO,CAAC6C,eAAe,IAAI,EAAE;EAC7D,IAAID,cAAc,CAACpE,MAAM,KAAK,CAAC,EAAE;IAC/B;IACA,IAAI,CAACgE,MAAM,EAAE;MACXnE,KAAK,CAACsE,IAAI,CAACF,WAAW,CAAC;IACzB;IACA,OAAOpE,KAAK;EACd;EAEA,MAAMyE,mBAAmB,GAAGF,cAAc,CAAC,CAAC,CAAE;;EAE9C;EACA,MAAMG,WAAW,GAAG,MAAM7D,4BAA4B,CAAC4D,mBAAmB,EAAE;IAC1EjE;EACF,CAAC,CAAC;EACF,MAAMmE,QAAQ,GAAG3F,mBAAmB,CAACwC,KAAK,CAAC5C,MAAM,CAAC8F,WAAW,CAAC,CAAC;;EAE/D;EACA,MAAMpC,uBAAuB,GAC3BqC,QAAQ,CAAChD,OAAO,CAACmC,QAAQ,CAACC,iBAAiB,CAACa,yBAAyB;EACvE,IAAI,CAACtC,uBAAuB,EAAE;IAC5B,MAAM,IAAI3C,mCAAmC,CAC1C,kDAAiD8E,mBAAoB,4CAA2C3D,aAAc,GAAE,EACjI;MAAEA,aAAa;MAAE+D,kBAAkB,EAAEJ;IAAoB,CAC3D,CAAC;EACH;EAEA,MAAMK,kBAAkB,GAAG,MAAMzC,wBAAwB,CACvDC,uBAAuB,EACvBxB,aAAa,EACb;IAAEN;EAAS,CACb,CAAC;EACD;EACAvB,eAAe,CAACuC,KAAK,CAAC5C,MAAM,CAACkG,kBAAkB,CAAC,CAAC;;EAEjD;EACA9E,KAAK,CAACsE,IAAI,CAACQ,kBAAkB,CAAC;;EAE9B;EACA,MAAMC,WAAW,GAAG,MAAMtB,gBAAgB,CACxCgB,mBAAmB,EACnBjE,QAAQ,EACR,KACF,CAAC;EAED,OAAOR,KAAK,CAACgF,MAAM,CAACD,WAAW,CAAC;AAClC"}

package/lib/module/trust/utils.js

@@ -1,4 +1,5 @@
 import { decode as decodeJwt, verify as verifyJwt } from "@pagopa/io-react-native-jwt";
+import { FederationError } from "./errors";
 // Verify a token signature
 // The kid is extracted from the token header
 export const verify = async (token, kid, jwks) => {
@@ -30,4 +31,30 @@ export const decode = token => {
     payload
   };
 };
+
+/**
+ * Extracts the X.509 Trust Anchor certificate (Base64 encoded) from the
+ * Trust Anchor's Entity Configuration.
+ *
+ * @param trustAnchorEntity The entity configuration of the known trust anchor.
+ * @returns The Base64 encoded X.509 certificate string.
+ * @throws {FederationError} If the certificate cannot be derived.
+ */
+export function getTrustAnchorX509Certificate(trustAnchorEntity) {
+  const taHeaderKid = trustAnchorEntity.header.kid;
+  const taSigningJwk = trustAnchorEntity.payload.jwks.keys.find(key => key.kid === taHeaderKid);
+  if (!taSigningJwk) {
+    throw new FederationError(`Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' not found in Trust Anchor's JWKS.`, {
+      trustAnchorKid: taHeaderKid,
+      reason: "JWK not found for header kid"
+    });
+  }
+  if (taSigningJwk.x5c && taSigningJwk.x5c.length > 0 && taSigningJwk.x5c[0]) {
+    return taSigningJwk.x5c[0];
+  }
+  throw new FederationError(`Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' does not contain a valid 'x5c' certificate array.`, {
+    trustAnchorKid: taHeaderKid,
+    reason: "Missing or empty x5c in JWK"
+  });
+}
 //# sourceMappingURL=utils.js.map

package/lib/module/trust/utils.js.map

@@ -1 +1 @@
-{"version":3,"names":["decode","decodeJwt","verify","verifyJwt","token","kid","jwks","jwk","find","k","Error","protectedHeader","header","payload"],"sourceRoot":"../../../src","sources":["trust/utils.ts"],"mappings":"AAAA,SACEA,MAAM,IAAIC,SAAS,EACnBC,MAAM,IAAIC,SAAS,QACd,6BAA6B;AASpC;AACA;AACA,OAAO,MAAMD,MAAM,GAAG,MAAAA,CACpBE,KAAa,EACbC,GAAW,EACXC,IAAW,KACc;EACzB,MAAMC,GAAG,GAAGD,IAAI,CAACE,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACJ,GAAG,KAAKA,GAAG,CAAC;EAC3C,IAAI,CAACE,GAAG,EAAE;IACR,MAAM,IAAIG,KAAK,CAAE,gBAAeL,GAAI,YAAWD,KAAM,EAAC,CAAC;EACzD;EACA,MAAM;IAAEO,eAAe,EAAEC,MAAM;IAAEC;EAAQ,CAAC,GAAG,MAAMV,SAAS,CAACC,KAAK,EAAEG,GAAG,CAAC;EACxE,OAAO;IAAEK,MAAM;IAAEC;EAAQ,CAAC;AAC5B,CAAC;;AAED;AACA;AACA;AACA;AACA,OAAO,MAAMb,MAAM,GAAII,KAAa,IAAkB;EACpD,MAAM;IAAEO,eAAe,EAAEC,MAAM;IAAEC;EAAQ,CAAC,GAAGZ,SAAS,CAACG,KAAK,CAAC;EAC7D,OAAO;IAAEQ,MAAM;IAAEC;EAAQ,CAAC;AAC5B,CAAC"}
+{"version":3,"names":["decode","decodeJwt","verify","verifyJwt","FederationError","token","kid","jwks","jwk","find","k","Error","protectedHeader","header","payload","getTrustAnchorX509Certificate","trustAnchorEntity","taHeaderKid","taSigningJwk","keys","key","trustAnchorKid","reason","x5c","length"],"sourceRoot":"../../../src","sources":["trust/utils.ts"],"mappings":"AAAA,SACEA,MAAM,IAAIC,SAAS,EACnBC,MAAM,IAAIC,SAAS,QACd,6BAA6B;AAGpC,SAASC,eAAe,QAAQ,UAAU;AAQ1C;AACA;AACA,OAAO,MAAMF,MAAM,GAAG,MAAAA,CACpBG,KAAa,EACbC,GAAW,EACXC,IAAW,KACc;EACzB,MAAMC,GAAG,GAAGD,IAAI,CAACE,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACJ,GAAG,KAAKA,GAAG,CAAC;EAC3C,IAAI,CAACE,GAAG,EAAE;IACR,MAAM,IAAIG,KAAK,CAAE,gBAAeL,GAAI,YAAWD,KAAM,EAAC,CAAC;EACzD;EACA,MAAM;IAAEO,eAAe,EAAEC,MAAM;IAAEC;EAAQ,CAAC,GAAG,MAAMX,SAAS,CAACE,KAAK,EAAEG,GAAG,CAAC;EACxE,OAAO;IAAEK,MAAM;IAAEC;EAAQ,CAAC;AAC5B,CAAC;;AAED;AACA;AACA;AACA;AACA,OAAO,MAAMd,MAAM,GAAIK,KAAa,IAAkB;EACpD,MAAM;IAAEO,eAAe,EAAEC,MAAM;IAAEC;EAAQ,CAAC,GAAGb,SAAS,CAACI,KAAK,CAAC;EAC7D,OAAO;IAAEQ,MAAM;IAAEC;EAAQ,CAAC;AAC5B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,6BAA6BA,CAC3CC,iBAAiD,EACzC;EACR,MAAMC,WAAW,GAAGD,iBAAiB,CAACH,MAAM,CAACP,GAAG;EAChD,MAAMY,YAAY,GAAGF,iBAAiB,CAACF,OAAO,CAACP,IAAI,CAACY,IAAI,CAACV,IAAI,CAC1DW,GAAG,IAAKA,GAAG,CAACd,GAAG,KAAKW,WACvB,CAAC;EAED,IAAI,CAACC,YAAY,EAAE;IACjB,MAAM,IAAId,eAAe,CACtB,+DAA8Da,WAAY,qCAAoC,EAC/G;MAAEI,cAAc,EAAEJ,WAAW;MAAEK,MAAM,EAAE;IAA+B,CACxE,CAAC;EACH;EAEA,IAAIJ,YAAY,CAACK,GAAG,IAAIL,YAAY,CAACK,GAAG,CAACC,MAAM,GAAG,CAAC,IAAIN,YAAY,CAACK,GAAG,CAAC,CAAC,CAAC,EAAE;IAC1E,OAAOL,YAAY,CAACK,GAAG,CAAC,CAAC,CAAC;EAC5B;EAEA,MAAM,IAAInB,eAAe,CACtB,+DAA8Da,WAAY,qDAAoD,EAC/H;IAAEI,cAAc,EAAEJ,WAAW;IAAEK,MAAM,EAAE;EAA8B,CACvE,CAAC;AACH"}

package/lib/typescript/client/generated/wallet-provider.d.ts

@@ -21,21 +21,21 @@ export declare const WalletAttestationsView: z.ZodObject<{
         format: z.ZodUnion<[z.ZodLiteral<"jwt">, z.ZodLiteral<"dc+sd-jwt">]>;
         wallet_attestation: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        format: "jwt" | "dc+sd-jwt";
         wallet_attestation: string;
-    }, {
         format: "jwt" | "dc+sd-jwt";
+    }, {
         wallet_attestation: string;
+        format: "jwt" | "dc+sd-jwt";
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     wallet_attestations: {
-        format: "jwt" | "dc+sd-jwt";
         wallet_attestation: string;
+        format: "jwt" | "dc+sd-jwt";
     }[];
 }, {
     wallet_attestations: {
-        format: "jwt" | "dc+sd-jwt";
         wallet_attestation: string;
+        format: "jwt" | "dc+sd-jwt";
     }[];
 }>;
 export type CreateWalletInstanceBody = z.infer<typeof CreateWalletInstanceBody>;
@@ -221,21 +221,21 @@ export declare const post_CreateWalletAttestationV2: {
             format: z.ZodUnion<[z.ZodLiteral<"jwt">, z.ZodLiteral<"dc+sd-jwt">]>;
             wallet_attestation: z.ZodString;
         }, "strip", z.ZodTypeAny, {
-            format: "jwt" | "dc+sd-jwt";
             wallet_attestation: string;
-        }, {
             format: "jwt" | "dc+sd-jwt";
+        }, {
             wallet_attestation: string;
+            format: "jwt" | "dc+sd-jwt";
         }>, "many">;
     }, "strip", z.ZodTypeAny, {
         wallet_attestations: {
-            format: "jwt" | "dc+sd-jwt";
             wallet_attestation: string;
+            format: "jwt" | "dc+sd-jwt";
         }[];
     }, {
         wallet_attestations: {
-            format: "jwt" | "dc+sd-jwt";
             wallet_attestation: string;
+            format: "jwt" | "dc+sd-jwt";
         }[];
     }>;
 };
@@ -487,21 +487,21 @@ export declare const EndpointByMethod: {
                     format: z.ZodUnion<[z.ZodLiteral<"jwt">, z.ZodLiteral<"dc+sd-jwt">]>;
                     wallet_attestation: z.ZodString;
                 }, "strip", z.ZodTypeAny, {
-                    format: "jwt" | "dc+sd-jwt";
                     wallet_attestation: string;
-                }, {
                     format: "jwt" | "dc+sd-jwt";
+                }, {
                     wallet_attestation: string;
+                    format: "jwt" | "dc+sd-jwt";
                 }>, "many">;
             }, "strip", z.ZodTypeAny, {
                 wallet_attestations: {
-                    format: "jwt" | "dc+sd-jwt";
                     wallet_attestation: string;
+                    format: "jwt" | "dc+sd-jwt";
                 }[];
             }, {
                 wallet_attestations: {
-                    format: "jwt" | "dc+sd-jwt";
                     wallet_attestation: string;
+                    format: "jwt" | "dc+sd-jwt";
                 }[];
             }>;
         };

package/lib/typescript/credential/presentation/types.d.ts

@@ -574,13 +574,13 @@ export declare const RequestObject: z.ZodObject<{
     }>>;
 }, "strip", z.ZodTypeAny, {
     iss: string;
+    nonce: string;
     iat: number;
     exp: number;
-    nonce: string;
+    client_id: string;
     response_uri: string;
     response_type: "vp_token";
     response_mode: "direct_post.jwt";
-    client_id: string;
     state?: string | undefined;
     response_uri_method?: string | undefined;
     dcql_query?: Record<string, any> | undefined;
@@ -624,13 +624,13 @@ export declare const RequestObject: z.ZodObject<{
     } | undefined;
 }, {
     iss: string;
+    nonce: string;
     iat: number;
     exp: number;
-    nonce: string;
+    client_id: string;
     response_uri: string;
     response_type: "vp_token";
     response_mode: "direct_post.jwt";
-    client_id: string;
     state?: string | undefined;
     response_uri_method?: string | undefined;
     dcql_query?: Record<string, any> | undefined;

package/lib/typescript/credential/status/types.d.ts

@@ -226,6 +226,11 @@ export declare const ParsedStatusAttestation: z.ZodObject<{
         credential_hash: string;
     }>;
 }, "strip", z.ZodTypeAny, {
+    header: {
+        alg: string;
+        typ: "status-attestation+jwt";
+        kid?: string | undefined;
+    };
     payload: {
         iat: number;
         exp: number;
@@ -258,12 +263,12 @@ export declare const ParsedStatusAttestation: z.ZodObject<{
         };
         credential_hash: string;
     };
+}, {
     header: {
         alg: string;
         typ: "status-attestation+jwt";
         kid?: string | undefined;
     };
-}, {
     payload: {
         iat: number;
         exp: number;
@@ -296,10 +301,5 @@ export declare const ParsedStatusAttestation: z.ZodObject<{
         };
         credential_hash: string;
     };
-    header: {
-        alg: string;
-        typ: "status-attestation+jwt";
-        kid?: string | undefined;
-    };
 }>;
 //# sourceMappingURL=types.d.ts.map

package/lib/typescript/sd-jwt/index.d.ts

@@ -18,6 +18,11 @@ import { type Presentation } from "../credential/presentation/types";
  *
  */
 export declare const decode: <S extends z.ZodType<{
+    header: {
+        alg: string;
+        typ: "vc+sd-jwt";
+        kid?: string | undefined;
+    };
     payload: {
         iss: string;
         status: {
@@ -59,12 +64,12 @@ export declare const decode: <S extends z.ZodType<{
     } & {
         _sd: string[];
     };
+}, z.ZodTypeDef, {
     header: {
         alg: string;
         typ: "vc+sd-jwt";
         kid?: string | undefined;
     };
-}, z.ZodTypeDef, {
     payload: {
         iss: string;
         status: {
@@ -106,11 +111,6 @@ export declare const decode: <S extends z.ZodType<{
     } & {
         _sd: string[];
     };
-    header: {
-        alg: string;
-        typ: "vc+sd-jwt";
-        kid?: string | undefined;
-    };
 }>>(token: string, customSchema?: S | undefined) => {
     sdJwt: z.TypeOf<S>;
     disclosures: DisclosureWithEncoded[];
@@ -152,6 +152,11 @@ export declare const disclose: (token: string, claims: string[]) => Promise<{
  *
  */
 export declare const verify: <S extends z.ZodType<{
+    header: {
+        alg: string;
+        typ: "vc+sd-jwt";
+        kid?: string | undefined;
+    };
     payload: {
         iss: string;
         status: {
@@ -193,12 +198,12 @@ export declare const verify: <S extends z.ZodType<{
     } & {
         _sd: string[];
     };
+}, z.ZodTypeDef, {
     header: {
         alg: string;
         typ: "vc+sd-jwt";
         kid?: string | undefined;
     };
-}, z.ZodTypeDef, {
     payload: {
         iss: string;
         status: {
@@ -240,11 +245,6 @@ export declare const verify: <S extends z.ZodType<{
     } & {
         _sd: string[];
     };
-    header: {
-        alg: string;
-        typ: "vc+sd-jwt";
-        kid?: string | undefined;
-    };
 }>>(token: string, publicKey: JWK | JWK[], customSchema?: S | undefined) => Promise<{
     sdJwt: z.TypeOf<S>;
     disclosures: Disclosure[];

package/lib/typescript/sd-jwt/types.d.ts

@@ -274,6 +274,11 @@ export declare const SdJwt4VC: z.ZodObject<{
         _sd: string[];
     }>>;
 }, "strip", z.ZodTypeAny, {
+    header: {
+        alg: string;
+        typ: "vc+sd-jwt";
+        kid?: string | undefined;
+    };
     payload: {
         iss: string;
         status: {
@@ -315,12 +320,12 @@ export declare const SdJwt4VC: z.ZodObject<{
     } & {
         _sd: string[];
     };
+}, {
     header: {
         alg: string;
         typ: "vc+sd-jwt";
         kid?: string | undefined;
     };
-}, {
     payload: {
         iss: string;
         status: {
@@ -362,10 +367,5 @@ export declare const SdJwt4VC: z.ZodObject<{
     } & {
         _sd: string[];
     };
-    header: {
-        alg: string;
-        typ: "vc+sd-jwt";
-        kid?: string | undefined;
-    };
 }>;
 //# sourceMappingURL=types.d.ts.map

package/lib/typescript/trust/chain.d.ts

@@ -1,14 +1,16 @@
 import { TrustAnchorEntityConfiguration } from "./types";
 import { type ParsedToken } from "./utils";
+import { type X509CertificateOptions } from "@pagopa/io-react-native-crypto";
 /**
- * Validates a provided trust chain against a known trust
+ * Validates a provided trust chain against a known trust anchor, including X.509 certificate checks.
  *
- * @param trustAnchorEntity The entity configuration of the known trust anchor
- * @param chain The chain of statements to be validated
- * @returns The list of parsed token representing the chain
- * @throws {FederationError} If the chain is not valid
+ * @param trustAnchorEntity The entity configuration of the known trust anchor (for JWT validation).
+ * @param chain The chain of statements to be validated.
+ * @param x509Options Options for X.509 certificate validation.
+ * @returns The list of parsed tokens representing the chain.
+ * @throws {FederationError} If the chain is not valid (JWT or X.509). Specific errors like TrustChainEmptyError, X509ValidationError may be thrown.
  */
-export declare function validateTrustChain(trustAnchorEntity: TrustAnchorEntityConfiguration, chain: string[]): Promise<ParsedToken[]>;
+export declare function validateTrustChain(trustAnchorEntity: TrustAnchorEntityConfiguration, chain: string[], x509Options: X509CertificateOptions): Promise<ParsedToken[]>;
 /**
  * Given a trust chain, obtain a new trust chain by fetching each element's fresh version
  *

package/lib/typescript/trust/chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../../src/trust/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,8BAA8B,EAC/B,MAAM,SAAS,CAAC;AAIjB,OAAO,EAAU,KAAK,WAAW,EAAU,MAAM,SAAS,CAAC;AAmB3D;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,iBAAiB,EAAE,8BAA8B,EACjD,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,WAAW,EAAE,CAAC,CAqDxB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,GAAE,WAAW,CAAC,OAAO,CAAS,GACrC,OAAO,CAAC,MAAM,EAAE,CAAC,CA8CnB"}
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../../src/trust/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,8BAA8B,EAC/B,MAAM,SAAS,CAAC;AAIjB,OAAO,EAGL,KAAK,WAAW,EAEjB,MAAM,SAAS,CAAC;AAUjB,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,gCAAgC,CAAC;AAaxC;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,iBAAiB,EAAE,8BAA8B,EACjD,KAAK,EAAE,MAAM,EAAE,EACf,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,WAAW,EAAE,CAAC,CAkHxB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,GAAE,WAAW,CAAC,OAAO,CAAS,GACrC,OAAO,CAAC,MAAM,EAAE,CAAC,CA8CnB"}

package/lib/typescript/trust/errors.d.ts

@@ -1,4 +1,5 @@
 import { IoWalletError } from "../utils/errors";
+import type { CertificateValidationStatus } from "@pagopa/io-react-native-crypto";
 /**
  * Base class for all federation-specific errors.
  */
@@ -77,4 +78,25 @@ export declare class MissingFederationFetchEndpointError extends FederationError
         missingInEntityUrl: string;
     });
 }
+/**
+ * Error thrown when the X.509 certificate chain is missing in an entity's configuration.
+ */
+export declare class MissingX509CertsError extends FederationError {
+    code: string;
+    constructor(message: string);
+}
+/**
+ * Error thrown when an X.509 certificate validation fails.
+ * This is used to indicate issues with the certificate chain or signature verification.
+ */
+export declare class X509ValidationError extends FederationError {
+    code: string;
+    constructor(message: string, details?: {
+        tokenIndex?: number;
+        kid?: string;
+        x509ValidationStatus?: CertificateValidationStatus;
+        x509ErrorMessage?: string;
+        [key: string]: unknown;
+    });
+}
 //# sourceMappingURL=errors.d.ts.map