@pagopa/io-react-native-wallet 2.0.0-next.0 → 2.0.0-next.2

package/lib/commonjs/trust/index.js

@@ -3,280 +3,15 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.buildTrustChain = buildTrustChain;
-exports.getEntityConfiguration = exports.getCredentialIssuerEntityConfiguration = void 0;
-exports.getEntityStatement = getEntityStatement;
-exports.getFederationList = getFederationList;
-exports.getRelyingPartyEntityConfiguration = void 0;
-exports.getSignedEntityConfiguration = getSignedEntityConfiguration;
-exports.getSignedEntityStatement = getSignedEntityStatement;
-exports.getWalletProviderEntityConfiguration = exports.getTrustAnchorEntityConfiguration = void 0;
-exports.verifyTrustChain = verifyTrustChain;
-var _utils = require("./utils");
-var _ioReactNativeJwt = require("@pagopa/io-react-native-jwt");
-var _types = require("./types");
-var _chain = require("./chain");
-var _misc = require("../utils/misc");
-var _errors = require("./errors");
-/**
- * Verify a given trust chain is actually valid.
- * It can handle fast chain renewal, which means we try to fetch a fresh version of each statement.
- *
- * @param trustAnchorEntity The entity configuration of the known trust anchor
- * @param chain The chain of statements to be validated
- * @param renewOnFail Whether to renew the provided chain if the validation fails at first. Default: true
- * @param appFetch Fetch api implementation. Default: the built-in implementation
- * @returns The result of the chain validation
- * @throws {FederationError} If the chain is not valid
- */
-async function verifyTrustChain(trustAnchorEntity, chain) {
-  let {
-    appFetch = fetch,
-    renewOnFail = true
-  } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
-  try {
-    return (0, _chain.validateTrustChain)(trustAnchorEntity, chain);
-  } catch (error) {
-    if (renewOnFail) {
-      const renewedChain = await (0, _chain.renewTrustChain)(chain, appFetch);
-      return (0, _chain.validateTrustChain)(trustAnchorEntity, renewedChain);
-    } else {
-      throw error;
-    }
-  }
-}
-
-/**
- * Fetch the signed entity configuration token for an entity
- *
- * @param entityBaseUrl The url of the entity to fetch
- * @param appFetch (optional) fetch api implementation
- * @returns The signed Entity Configuration token
- */
-async function getSignedEntityConfiguration(entityBaseUrl) {
-  let {
-    appFetch = fetch
-  } = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
-  const wellKnownUrl = `${entityBaseUrl}/.well-known/openid-federation`;
-  return await appFetch(wellKnownUrl, {
-    method: "GET"
-  }).then((0, _misc.hasStatusOrThrow)(200)).then(res => res.text());
-}
-
-/**
- * Fetch and parse the entity configuration document for a given federation entity.
- * This is an inner method to serve public interfaces.
- *
- * To add another entity configuration type (example: Foo entity type):
- *  - create its zod schema and type by inherit from the base type (example: FooEntityConfiguration = BaseEntityConfiguration.and(...))
- *  - add such type to EntityConfiguration union
- *  - add an overload to this function
- *  - create a public function which use such type (example: getFooEntityConfiguration = (url, options) => Promise<FooEntityConfiguration>)
- *
- * @param entityBaseUrl The base url of the entity.
- * @param schema The expected schema of the entity configuration, according to the kind of entity we are fetching from.
- * @param options An optional object with additional options.
- * @param options.appFetch An optional instance of the http client to be used.
- * @returns The parsed entity configuration object
- * @throws {IoWalletError} If the http request fails
- * @throws Parse error if the document is not in the expected shape.
- */
-
-async function fetchAndParseEntityConfiguration(entityBaseUrl, schema) {
-  let {
-    appFetch = fetch
-  } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
-  const responseText = await getSignedEntityConfiguration(entityBaseUrl, {
-    appFetch
-  });
-  const responseJwt = (0, _ioReactNativeJwt.decode)(responseText);
-  return schema.parse({
-    header: responseJwt.protectedHeader,
-    payload: responseJwt.payload
-  });
-}
-const getWalletProviderEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, _types.WalletProviderEntityConfiguration, options);
-exports.getWalletProviderEntityConfiguration = getWalletProviderEntityConfiguration;
-const getCredentialIssuerEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, _types.CredentialIssuerEntityConfiguration, options);
-exports.getCredentialIssuerEntityConfiguration = getCredentialIssuerEntityConfiguration;
-const getTrustAnchorEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, _types.TrustAnchorEntityConfiguration, options);
-exports.getTrustAnchorEntityConfiguration = getTrustAnchorEntityConfiguration;
-const getRelyingPartyEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, _types.RelyingPartyEntityConfiguration, options);
-exports.getRelyingPartyEntityConfiguration = getRelyingPartyEntityConfiguration;
-const getEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, _types.EntityConfiguration, options);
-
-/**
- * Fetch and parse the entity statement document for a given federation entity.
- *
- * @param accreditationBodyBaseUrl The base url of the accreditation body which holds and signs the required entity statement
- * @param subordinatedEntityBaseUrl The url that identifies the subordinate entity
- * @param appFetch An optional instance of the http client to be used.
- * @returns The parsed entity configuration object
- * @throws {IoWalletError} If the http request fails
- */
-exports.getEntityConfiguration = getEntityConfiguration;
-async function getEntityStatement(accreditationBodyBaseUrl, subordinatedEntityBaseUrl) {
-  let {
-    appFetch = fetch
-  } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
-  const responseText = await getSignedEntityStatement(accreditationBodyBaseUrl, subordinatedEntityBaseUrl, {
-    appFetch
-  });
-  const responseJwt = (0, _ioReactNativeJwt.decode)(responseText);
-  return _types.EntityStatement.parse({
-    header: responseJwt.protectedHeader,
-    payload: responseJwt.payload
-  });
-}
-
-/**
- * Fetch the entity statement document for a given federation entity.
- *
- * @param federationFetchEndpoint The exact endpoint provided by the parent EC's metadata.
- * @param subordinatedEntityBaseUrl The url that identifies the subordinate entity.
- * @param appFetch An optional instance of the http client to be used.
- * @returns The signed entity statement token.
- * @throws {IoWalletError} If the http request fails.
- */
-async function getSignedEntityStatement(federationFetchEndpoint, subordinatedEntityBaseUrl) {
-  let {
-    appFetch = fetch
-  } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
-  const url = new URL(federationFetchEndpoint);
-  url.searchParams.set("sub", subordinatedEntityBaseUrl);
-  return await appFetch(url.toString(), {
-    method: "GET"
-  }).then((0, _misc.hasStatusOrThrow)(200)).then(res => res.text());
-}
-
-/**
- * Fetch the federation list document from a given endpoint.
- *
- * @param federationListEndpoint The URL of the federation list endpoint.
- * @param appFetch An optional instance of the http client to be used.
- * @returns The federation list as an array of strings.
- * @throws {IoWalletError} If the HTTP request fails.
- * @throws {FederationError} If the result is not in the expected format.
- */
-async function getFederationList(federationListEndpoint) {
-  let {
-    appFetch = fetch
-  } = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
-  return await appFetch(federationListEndpoint, {
-    method: "GET"
-  }).then((0, _misc.hasStatusOrThrow)(200)).then(res => res.json()).then(json => {
-    const result = _types.FederationListResponse.safeParse(json);
-    if (!result.success) {
-      throw new _errors.FederationListParseError(`Invalid federation list format received from ${federationListEndpoint}. Error: ${result.error.message}`, {
-        url: federationListEndpoint,
-        parseError: result.error.toString()
-      });
-    }
-    return result.data;
-  });
-}
-
-/**
- * Build a not-verified trust chain for a given Relying Party (RP) entity.
- *
- * @param relyingPartyEntityBaseUrl The base URL of the RP entity
- * @param trustAnchorKey The public key of the Trust Anchor (TA) entity
- * @param appFetch An optional instance of the http client to be used.
- * @returns A list of signed tokens that represent the trust chain, in the order of the chain (from the RP to the Trust Anchor)
- * @throws {FederationError} When an element of the chain fails to parse or other build steps fail.
- */
-async function buildTrustChain(relyingPartyEntityBaseUrl, trustAnchorKey) {
-  let appFetch = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : fetch;
-  // 1: Recursively gather the trust chain from the RP up to the Trust Anchor
-  const trustChain = await gatherTrustChain(relyingPartyEntityBaseUrl, appFetch);
-
-  // 2: Trust Anchor signature verification
-  const trustAnchorJwt = trustChain[trustChain.length - 1];
-  if (!trustAnchorJwt) {
-    throw new _errors.BuildTrustChainError("Cannot verify trust anchor: missing entity configuration in gathered chain.", {
-      relyingPartyUrl: relyingPartyEntityBaseUrl
-    });
-  }
-  if (!trustAnchorKey.kid) {
-    throw new _errors.TrustAnchorKidMissingError();
-  }
-  await (0, _utils.verify)(trustAnchorJwt, trustAnchorKey.kid, [trustAnchorKey]);
-
-  // 3: Check the federation list
-  const trustAnchorConfig = _types.EntityConfiguration.parse((0, _utils.decode)(trustAnchorJwt));
-  const federationListEndpoint = trustAnchorConfig.payload.metadata.federation_entity.federation_list_endpoint;
-  if (federationListEndpoint) {
-    const federationList = await getFederationList(federationListEndpoint, {
-      appFetch
-    });
-    if (!federationList.includes(relyingPartyEntityBaseUrl)) {
-      throw new _errors.RelyingPartyNotAuthorizedError("Relying Party entity base URL is not authorized by the Trust Anchor's federation list.", {
-        relyingPartyUrl: relyingPartyEntityBaseUrl,
-        federationListEndpoint
-      });
-    }
-  }
-  return trustChain;
-}
-
-/**
- * Recursively gather the trust chain for an entity and all its superiors.
- * @param entityBaseUrl The base URL of the entity for which to gather the chain.
- * @param appFetch An optional instance of the http client to be used.
- * @param isLeaf Whether the current entity is the leaf of the chain.
- * @returns A full ordered list of JWTs (ECs and ESs) forming the trust chain.
- * @throws {FederationError} If any of the fetched documents fail to parse or other errors occur during the gathering process.
- */
-async function gatherTrustChain(entityBaseUrl, appFetch) {
-  let isLeaf = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : true;
-  const chain = [];
-
-  // Fetch self-signed EC (only needed for the leaf)
-  const entityECJwt = await getSignedEntityConfiguration(entityBaseUrl, {
-    appFetch
-  });
-  const entityEC = _types.EntityConfiguration.parse((0, _utils.decode)(entityECJwt));
-  if (isLeaf) {
-    // Only push EC for the leaf
-    chain.push(entityECJwt);
-  }
-
-  // Find authority_hints (parent, if any)
-  const authorityHints = entityEC.payload.authority_hints ?? [];
-  if (authorityHints.length === 0) {
-    // This is the Trust Anchor (no parent)
-    if (!isLeaf) {
-      chain.push(entityECJwt);
-    }
-    return chain;
-  }
-  const parentEntityBaseUrl = authorityHints[0];
-
-  // Fetch parent EC
-  const parentECJwt = await getSignedEntityConfiguration(parentEntityBaseUrl, {
-    appFetch
-  });
-  const parentEC = _types.EntityConfiguration.parse((0, _utils.decode)(parentECJwt));
-
-  // Fetch ES
-  const federationFetchEndpoint = parentEC.payload.metadata.federation_entity.federation_fetch_endpoint;
-  if (!federationFetchEndpoint) {
-    throw new _errors.MissingFederationFetchEndpointError(`Missing federation_fetch_endpoint in parent's (${parentEntityBaseUrl}) configuration when gathering chain for ${entityBaseUrl}.`, {
-      entityBaseUrl,
-      missingInEntityUrl: parentEntityBaseUrl
-    });
-  }
-  const entityStatementJwt = await getSignedEntityStatement(federationFetchEndpoint, entityBaseUrl, {
-    appFetch
-  });
-  // Validate the ES
-  _types.EntityStatement.parse((0, _utils.decode)(entityStatementJwt));
-
-  // Push this ES into the chain
-  chain.push(entityStatementJwt);
-
-  // Recurse into the parent
-  const parentChain = await gatherTrustChain(parentEntityBaseUrl, appFetch, false);
-  return chain.concat(parentChain);
-}
+exports.Verify = exports.Types = exports.Errors = exports.Build = void 0;
+var Build = _interopRequireWildcard(require("./build-chain"));
+exports.Build = Build;
+var Verify = _interopRequireWildcard(require("./verify-chain"));
+exports.Verify = Verify;
+var Errors = _interopRequireWildcard(require("./errors"));
+exports.Errors = Errors;
+var Types = _interopRequireWildcard(require("./types"));
+exports.Types = Types;
+function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
+function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
 //# sourceMappingURL=index.js.map

package/lib/commonjs/trust/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_utils","require","_ioReactNativeJwt","_types","_chain","_misc","_errors","verifyTrustChain","trustAnchorEntity","chain","appFetch","fetch","renewOnFail","arguments","length","undefined","validateTrustChain","error","renewedChain","renewTrustChain","getSignedEntityConfiguration","entityBaseUrl","wellKnownUrl","method","then","hasStatusOrThrow","res","text","fetchAndParseEntityConfiguration","schema","responseText","responseJwt","decodeJwt","parse","header","protectedHeader","payload","getWalletProviderEntityConfiguration","options","WalletProviderEntityConfiguration","exports","getCredentialIssuerEntityConfiguration","CredentialIssuerEntityConfiguration","getTrustAnchorEntityConfiguration","TrustAnchorEntityConfiguration","getRelyingPartyEntityConfiguration","RelyingPartyEntityConfiguration","getEntityConfiguration","EntityConfiguration","getEntityStatement","accreditationBodyBaseUrl","subordinatedEntityBaseUrl","getSignedEntityStatement","EntityStatement","federationFetchEndpoint","url","URL","searchParams","set","toString","getFederationList","federationListEndpoint","json","result","FederationListResponse","safeParse","success","FederationListParseError","message","parseError","data","buildTrustChain","relyingPartyEntityBaseUrl","trustAnchorKey","trustChain","gatherTrustChain","trustAnchorJwt","BuildTrustChainError","relyingPartyUrl","kid","TrustAnchorKidMissingError","verify","trustAnchorConfig","decode","metadata","federation_entity","federation_list_endpoint","federationList","includes","RelyingPartyNotAuthorizedError","isLeaf","entityECJwt","entityEC","push","authorityHints","authority_hints","parentEntityBaseUrl","parentECJwt","parentEC","federation_fetch_endpoint","MissingFederationFetchEndpointError","missingInEntityUrl","entityStatementJwt","parentChain","concat"],"sourceRoot":"../../../src","sources":["trust/index.ts"],"mappings":";;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,iBAAA,GAAAD,OAAA;AACA,IAAAE,MAAA,GAAAF,OAAA;AASA,IAAAG,MAAA,GAAAH,OAAA;AACA,IAAAI,KAAA,GAAAJ,OAAA;AAEA,IAAAK,OAAA,GAAAL,OAAA;AAiBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeM,gBAAgBA,CACpCC,iBAAiD,EACjDC,KAAe,EAKiC;EAAA,IAJhD;IACEC,QAAQ,GAAGC,KAAK;IAChBC,WAAW,GAAG;EAC4C,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAElE,IAAI;IACF,OAAO,IAAAG,yBAAkB,EAACR,iBAAiB,EAAEC,KAAK,CAAC;EACrD,CAAC,CAAC,OAAOQ,KAAK,EAAE;IACd,IAAIL,WAAW,EAAE;MACf,MAAMM,YAAY,GAAG,MAAM,IAAAC,sBAAe,EAACV,KAAK,EAAEC,QAAQ,CAAC;MAC3D,OAAO,IAAAM,yBAAkB,EAACR,iBAAiB,EAAEU,YAAY,CAAC;IAC5D,CAAC,MAAM;MACL,MAAMD,KAAK;IACb;EACF;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeG,4BAA4BA,CAChDC,aAAqB,EAMJ;EAAA,IALjB;IACEX,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMS,YAAY,GAAI,GAAED,aAAc,gCAA+B;EAErE,OAAO,MAAMX,QAAQ,CAACY,YAAY,EAAE;IAClCC,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,CAAC,CAAC,CAC3BD,IAAI,CAAEE,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoCA,eAAeC,gCAAgCA,CAC7CP,aAAqB,EACrBQ,MAK8B,EAM9B;EAAA,IALA;IACEnB,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMiB,YAAY,GAAG,MAAMV,4BAA4B,CAACC,aAAa,EAAE;IACrEX;EACF,CAAC,CAAC;EAEF,MAAMqB,WAAW,GAAG,IAAAC,wBAAS,EAACF,YAAY,CAAC;EAC3C,OAAOD,MAAM,CAACI,KAAK,CAAC;IAClBC,MAAM,EAAEH,WAAW,CAACI,eAAe;IACnCC,OAAO,EAAEL,WAAW,CAACK;EACvB,CAAC,CAAC;AACJ;AAEO,MAAMC,oCAAoC,GAAGA,CAClDhB,aAAqE,EACrEiB,OAAgE,KAEhEV,gCAAgC,CAC9BP,aAAa,EACbkB,wCAAiC,EACjCD,OACF,CAAC;AAACE,OAAA,CAAAH,oCAAA,GAAAA,oCAAA;AAEG,MAAMI,sCAAsC,GAAGA,CACpDpB,aAAqE,EACrEiB,OAAgE,KAEhEV,gCAAgC,CAC9BP,aAAa,EACbqB,0CAAmC,EACnCJ,OACF,CAAC;AAACE,OAAA,CAAAC,sCAAA,GAAAA,sCAAA;AAEG,MAAME,iCAAiC,GAAGA,CAC/CtB,aAAqE,EACrEiB,OAAgE,KAEhEV,gCAAgC,CAC9BP,aAAa,EACbuB,qCAA8B,EAC9BN,OACF,CAAC;AAACE,OAAA,CAAAG,iCAAA,GAAAA,iCAAA;AAEG,MAAME,kCAAkC,GAAGA,CAChDxB,aAAqE,EACrEiB,OAAgE,KAEhEV,gCAAgC,CAC9BP,aAAa,EACbyB,sCAA+B,EAC/BR,OACF,CAAC;AAACE,OAAA,CAAAK,kCAAA,GAAAA,kCAAA;AAEG,MAAME,sBAAsB,GAAGA,CACpC1B,aAAqE,EACrEiB,OAAgE,KAEhEV,gCAAgC,CAACP,aAAa,EAAE2B,0BAAmB,EAAEV,OAAO,CAAC;;AAE/E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AARAE,OAAA,CAAAO,sBAAA,GAAAA,sBAAA;AASO,eAAeE,kBAAkBA,CACtCC,wBAAgC,EAChCC,yBAAiC,EAMjC;EAAA,IALA;IACEzC,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMiB,YAAY,GAAG,MAAMsB,wBAAwB,CACjDF,wBAAwB,EACxBC,yBAAyB,EACzB;IACEzC;EACF,CACF,CAAC;EAED,MAAMqB,WAAW,GAAG,IAAAC,wBAAS,EAACF,YAAY,CAAC;EAC3C,OAAOuB,sBAAe,CAACpB,KAAK,CAAC;IAC3BC,MAAM,EAAEH,WAAW,CAACI,eAAe;IACnCC,OAAO,EAAEL,WAAW,CAACK;EACvB,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAegB,wBAAwBA,CAC5CE,uBAA+B,EAC/BH,yBAAiC,EAMjC;EAAA,IALA;IACEzC,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAM0C,GAAG,GAAG,IAAIC,GAAG,CAACF,uBAAuB,CAAC;EAC5CC,GAAG,CAACE,YAAY,CAACC,GAAG,CAAC,KAAK,EAAEP,yBAAyB,CAAC;EAEtD,OAAO,MAAMzC,QAAQ,CAAC6C,GAAG,CAACI,QAAQ,CAAC,CAAC,EAAE;IACpCpC,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,CAAC,CAAC,CAC3BD,IAAI,CAAEE,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeiC,iBAAiBA,CACrCC,sBAA8B,EAMX;EAAA,IALnB;IACEnD,QAAQ,GAAGC;EAGb,CAAC,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,OAAO,MAAMH,QAAQ,CAACmD,sBAAsB,EAAE;IAC5CtC,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,CAAC,CAAC,CAC3BD,IAAI,CAAEE,GAAG,IAAKA,GAAG,CAACoC,IAAI,CAAC,CAAC,CAAC,CACzBtC,IAAI,CAAEsC,IAAI,IAAK;IACd,MAAMC,MAAM,GAAGC,6BAAsB,CAACC,SAAS,CAACH,IAAI,CAAC;IACrD,IAAI,CAACC,MAAM,CAACG,OAAO,EAAE;MACnB,MAAM,IAAIC,gCAAwB,CAC/B,gDAA+CN,sBAAuB,YAAWE,MAAM,CAAC9C,KAAK,CAACmD,OAAQ,EAAC,EACxG;QAAEb,GAAG,EAAEM,sBAAsB;QAAEQ,UAAU,EAAEN,MAAM,CAAC9C,KAAK,CAAC0C,QAAQ,CAAC;MAAE,CACrE,CAAC;IACH;IACA,OAAOI,MAAM,CAACO,IAAI;EACpB,CAAC,CAAC;AACN;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,eAAeA,CACnCC,yBAAiC,EACjCC,cAAmB,EAEA;EAAA,IADnB/D,QAA8B,GAAAG,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAGF,KAAK;EAEtC;EACA,MAAM+D,UAAU,GAAG,MAAMC,gBAAgB,CACvCH,yBAAyB,EACzB9D,QACF,CAAC;;EAED;EACA,MAAMkE,cAAc,GAAGF,UAAU,CAACA,UAAU,CAAC5D,MAAM,GAAG,CAAC,CAAC;EACxD,IAAI,CAAC8D,cAAc,EAAE;IACnB,MAAM,IAAIC,4BAAoB,CAC5B,6EAA6E,EAC7E;MAAEC,eAAe,EAAEN;IAA0B,CAC/C,CAAC;EACH;EAEA,IAAI,CAACC,cAAc,CAACM,GAAG,EAAE;IACvB,MAAM,IAAIC,kCAA0B,CAAC,CAAC;EACxC;EAEA,MAAM,IAAAC,aAAM,EAACL,cAAc,EAAEH,cAAc,CAACM,GAAG,EAAE,CAACN,cAAc,CAAC,CAAC;;EAElE;EACA,MAAMS,iBAAiB,GAAGlC,0BAAmB,CAACf,KAAK,CAAC,IAAAkD,aAAM,EAACP,cAAc,CAAC,CAAC;EAC3E,MAAMf,sBAAsB,GAC1BqB,iBAAiB,CAAC9C,OAAO,CAACgD,QAAQ,CAACC,iBAAiB,CACjDC,wBAAwB;EAE7B,IAAIzB,sBAAsB,EAAE;IAC1B,MAAM0B,cAAc,GAAG,MAAM3B,iBAAiB,CAACC,sBAAsB,EAAE;MACrEnD;IACF,CAAC,CAAC;IAEF,IAAI,CAAC6E,cAAc,CAACC,QAAQ,CAAChB,yBAAyB,CAAC,EAAE;MACvD,MAAM,IAAIiB,sCAA8B,CACtC,wFAAwF,EACxF;QAAEX,eAAe,EAAEN,yBAAyB;QAAEX;MAAuB,CACvE,CAAC;IACH;EACF;EAEA,OAAOa,UAAU;AACnB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,gBAAgBA,CAC7BtD,aAAqB,EACrBX,QAA8B,EAEX;EAAA,IADnBgF,MAAe,GAAA7E,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,IAAI;EAEtB,MAAMJ,KAAe,GAAG,EAAE;;EAE1B;EACA,MAAMkF,WAAW,GAAG,MAAMvE,4BAA4B,CAACC,aAAa,EAAE;IACpEX;EACF,CAAC,CAAC;EACF,MAAMkF,QAAQ,GAAG5C,0BAAmB,CAACf,KAAK,CAAC,IAAAkD,aAAM,EAACQ,WAAW,CAAC,CAAC;EAE/D,IAAID,MAAM,EAAE;IACV;IACAjF,KAAK,CAACoF,IAAI,CAACF,WAAW,CAAC;EACzB;;EAEA;EACA,MAAMG,cAAc,GAAGF,QAAQ,CAACxD,OAAO,CAAC2D,eAAe,IAAI,EAAE;EAC7D,IAAID,cAAc,CAAChF,MAAM,KAAK,CAAC,EAAE;IAC/B;IACA,IAAI,CAAC4E,MAAM,EAAE;MACXjF,KAAK,CAACoF,IAAI,CAACF,WAAW,CAAC;IACzB;IACA,OAAOlF,KAAK;EACd;EAEA,MAAMuF,mBAAmB,GAAGF,cAAc,CAAC,CAAC,CAAE;;EAE9C;EACA,MAAMG,WAAW,GAAG,MAAM7E,4BAA4B,CAAC4E,mBAAmB,EAAE;IAC1EtF;EACF,CAAC,CAAC;EACF,MAAMwF,QAAQ,GAAGlD,0BAAmB,CAACf,KAAK,CAAC,IAAAkD,aAAM,EAACc,WAAW,CAAC,CAAC;;EAE/D;EACA,MAAM3C,uBAAuB,GAC3B4C,QAAQ,CAAC9D,OAAO,CAACgD,QAAQ,CAACC,iBAAiB,CAACc,yBAAyB;EACvE,IAAI,CAAC7C,uBAAuB,EAAE;IAC5B,MAAM,IAAI8C,2CAAmC,CAC1C,kDAAiDJ,mBAAoB,4CAA2C3E,aAAc,GAAE,EACjI;MAAEA,aAAa;MAAEgF,kBAAkB,EAAEL;IAAoB,CAC3D,CAAC;EACH;EAEA,MAAMM,kBAAkB,GAAG,MAAMlD,wBAAwB,CACvDE,uBAAuB,EACvBjC,aAAa,EACb;IAAEX;EAAS,CACb,CAAC;EACD;EACA2C,sBAAe,CAACpB,KAAK,CAAC,IAAAkD,aAAM,EAACmB,kBAAkB,CAAC,CAAC;;EAEjD;EACA7F,KAAK,CAACoF,IAAI,CAACS,kBAAkB,CAAC;;EAE9B;EACA,MAAMC,WAAW,GAAG,MAAM5B,gBAAgB,CACxCqB,mBAAmB,EACnBtF,QAAQ,EACR,KACF,CAAC;EAED,OAAOD,KAAK,CAAC+F,MAAM,CAACD,WAAW,CAAC;AAClC"}
+{"version":3,"names":["Build","_interopRequireWildcard","require","exports","Verify","Errors","Types","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set"],"sourceRoot":"../../../src","sources":["trust/index.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,uBAAA,CAAAC,OAAA;AAAuCC,OAAA,CAAAH,KAAA,GAAAA,KAAA;AACvC,IAAAI,MAAA,GAAAH,uBAAA,CAAAC,OAAA;AAAyCC,OAAA,CAAAC,MAAA,GAAAA,MAAA;AACzC,IAAAC,MAAA,GAAAJ,uBAAA,CAAAC,OAAA;AAAmCC,OAAA,CAAAE,MAAA,GAAAA,MAAA;AACnC,IAAAC,KAAA,GAAAL,uBAAA,CAAAC,OAAA;AAAiCC,OAAA,CAAAG,KAAA,GAAAA,KAAA;AAAA,SAAAC,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAP,wBAAAW,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA"}

package/lib/commonjs/trust/utils.js

@@ -3,8 +3,11 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.verify = exports.decode = void 0;
+exports.decode = void 0;
+exports.getTrustAnchorX509Certificate = getTrustAnchorX509Certificate;
+exports.verify = void 0;
 var _ioReactNativeJwt = require("@pagopa/io-react-native-jwt");
+var _errors = require("./errors");
 // Verify a token signature
 // The kid is extracted from the token header
 const verify = async (token, kid, jwks) => {
@@ -37,5 +40,31 @@ const decode = token => {
     payload
   };
 };
+
+/**
+ * Extracts the X.509 Trust Anchor certificate (Base64 encoded) from the
+ * Trust Anchor's Entity Configuration.
+ *
+ * @param trustAnchorEntity The entity configuration of the known trust anchor.
+ * @returns The Base64 encoded X.509 certificate string.
+ * @throws {FederationError} If the certificate cannot be derived.
+ */
 exports.decode = decode;
+function getTrustAnchorX509Certificate(trustAnchorEntity) {
+  const taHeaderKid = trustAnchorEntity.header.kid;
+  const taSigningJwk = trustAnchorEntity.payload.jwks.keys.find(key => key.kid === taHeaderKid);
+  if (!taSigningJwk) {
+    throw new _errors.FederationError(`Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' not found in Trust Anchor's JWKS.`, {
+      trustAnchorKid: taHeaderKid,
+      reason: "JWK not found for header kid"
+    });
+  }
+  if (taSigningJwk.x5c && taSigningJwk.x5c.length > 0 && taSigningJwk.x5c[0]) {
+    return taSigningJwk.x5c[0];
+  }
+  throw new _errors.FederationError(`Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' does not contain a valid 'x5c' certificate array.`, {
+    trustAnchorKid: taHeaderKid,
+    reason: "Missing or empty x5c in JWK"
+  });
+}
 //# sourceMappingURL=utils.js.map

package/lib/commonjs/trust/utils.js.map

@@ -1 +1 @@
-{"version":3,"names":["_ioReactNativeJwt","require","verify","token","kid","jwks","jwk","find","k","Error","protectedHeader","header","payload","verifyJwt","exports","decode","decodeJwt"],"sourceRoot":"../../../src","sources":["trust/utils.ts"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AAYA;AACA;AACO,MAAMC,MAAM,GAAG,MAAAA,CACpBC,KAAa,EACbC,GAAW,EACXC,IAAW,KACc;EACzB,MAAMC,GAAG,GAAGD,IAAI,CAACE,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACJ,GAAG,KAAKA,GAAG,CAAC;EAC3C,IAAI,CAACE,GAAG,EAAE;IACR,MAAM,IAAIG,KAAK,CAAE,gBAAeL,GAAI,YAAWD,KAAM,EAAC,CAAC;EACzD;EACA,MAAM;IAAEO,eAAe,EAAEC,MAAM;IAAEC;EAAQ,CAAC,GAAG,MAAM,IAAAC,wBAAS,EAACV,KAAK,EAAEG,GAAG,CAAC;EACxE,OAAO;IAAEK,MAAM;IAAEC;EAAQ,CAAC;AAC5B,CAAC;;AAED;AACA;AACA;AACA;AAHAE,OAAA,CAAAZ,MAAA,GAAAA,MAAA;AAIO,MAAMa,MAAM,GAAIZ,KAAa,IAAkB;EACpD,MAAM;IAAEO,eAAe,EAAEC,MAAM;IAAEC;EAAQ,CAAC,GAAG,IAAAI,wBAAS,EAACb,KAAK,CAAC;EAC7D,OAAO;IAAEQ,MAAM;IAAEC;EAAQ,CAAC;AAC5B,CAAC;AAACE,OAAA,CAAAC,MAAA,GAAAA,MAAA"}
+{"version":3,"names":["_ioReactNativeJwt","require","_errors","verify","token","kid","jwks","jwk","find","k","Error","protectedHeader","header","payload","verifyJwt","exports","decode","decodeJwt","getTrustAnchorX509Certificate","trustAnchorEntity","taHeaderKid","taSigningJwk","keys","key","FederationError","trustAnchorKid","reason","x5c","length"],"sourceRoot":"../../../src","sources":["trust/utils.ts"],"mappings":";;;;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AAMA,IAAAC,OAAA,GAAAD,OAAA;AAQA;AACA;AACO,MAAME,MAAM,GAAG,MAAAA,CACpBC,KAAa,EACbC,GAAW,EACXC,IAAW,KACc;EACzB,MAAMC,GAAG,GAAGD,IAAI,CAACE,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACJ,GAAG,KAAKA,GAAG,CAAC;EAC3C,IAAI,CAACE,GAAG,EAAE;IACR,MAAM,IAAIG,KAAK,CAAE,gBAAeL,GAAI,YAAWD,KAAM,EAAC,CAAC;EACzD;EACA,MAAM;IAAEO,eAAe,EAAEC,MAAM;IAAEC;EAAQ,CAAC,GAAG,MAAM,IAAAC,wBAAS,EAACV,KAAK,EAAEG,GAAG,CAAC;EACxE,OAAO;IAAEK,MAAM;IAAEC;EAAQ,CAAC;AAC5B,CAAC;;AAED;AACA;AACA;AACA;AAHAE,OAAA,CAAAZ,MAAA,GAAAA,MAAA;AAIO,MAAMa,MAAM,GAAIZ,KAAa,IAAkB;EACpD,MAAM;IAAEO,eAAe,EAAEC,MAAM;IAAEC;EAAQ,CAAC,GAAG,IAAAI,wBAAS,EAACb,KAAK,CAAC;EAC7D,OAAO;IAAEQ,MAAM;IAAEC;EAAQ,CAAC;AAC5B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAPAE,OAAA,CAAAC,MAAA,GAAAA,MAAA;AAQO,SAASE,6BAA6BA,CAC3CC,iBAAiD,EACzC;EACR,MAAMC,WAAW,GAAGD,iBAAiB,CAACP,MAAM,CAACP,GAAG;EAChD,MAAMgB,YAAY,GAAGF,iBAAiB,CAACN,OAAO,CAACP,IAAI,CAACgB,IAAI,CAACd,IAAI,CAC1De,GAAG,IAAKA,GAAG,CAAClB,GAAG,KAAKe,WACvB,CAAC;EAED,IAAI,CAACC,YAAY,EAAE;IACjB,MAAM,IAAIG,uBAAe,CACtB,+DAA8DJ,WAAY,qCAAoC,EAC/G;MAAEK,cAAc,EAAEL,WAAW;MAAEM,MAAM,EAAE;IAA+B,CACxE,CAAC;EACH;EAEA,IAAIL,YAAY,CAACM,GAAG,IAAIN,YAAY,CAACM,GAAG,CAACC,MAAM,GAAG,CAAC,IAAIP,YAAY,CAACM,GAAG,CAAC,CAAC,CAAC,EAAE;IAC1E,OAAON,YAAY,CAACM,GAAG,CAAC,CAAC,CAAC;EAC5B;EAEA,MAAM,IAAIH,uBAAe,CACtB,+DAA8DJ,WAAY,qDAAoD,EAC/H;IAAEK,cAAc,EAAEL,WAAW;IAAEM,MAAM,EAAE;EAA8B,CACvE,CAAC;AACH"}

package/lib/commonjs/trust/{chain.js → verify-chain.js}

@@ -5,11 +5,13 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.renewTrustChain = renewTrustChain;
 exports.validateTrustChain = validateTrustChain;
+exports.verifyTrustChain = verifyTrustChain;
 var _types = require("./types");
 var z = _interopRequireWildcard(require("zod"));
-var _ = require(".");
 var _utils = require("./utils");
 var _errors = require("./errors");
+var _ioReactNativeCrypto = require("@pagopa/io-react-native-crypto");
+var _buildChain = require("./build-chain");
 function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
 function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
 // The first element of the chain is supposed to be the Entity Configuration for the document issuer
@@ -21,14 +23,15 @@ const MiddleElementShape = _types.EntityStatement;
 const LastElementShape = z.union([_types.EntityStatement, _types.TrustAnchorEntityConfiguration]);
 
 /**
- * Validates a provided trust chain against a known trust
+ * Validates a provided trust chain against a known trust anchor, including X.509 certificate checks.
  *
- * @param trustAnchorEntity The entity configuration of the known trust anchor
- * @param chain The chain of statements to be validated
- * @returns The list of parsed token representing the chain
- * @throws {FederationError} If the chain is not valid
+ * @param trustAnchorEntity The entity configuration of the known trust anchor (for JWT validation).
+ * @param chain The chain of statements to be validated.
+ * @param x509Options Options for X.509 certificate validation.
+ * @returns The list of parsed tokens representing the chain.
+ * @throws {FederationError} If the chain is not valid (JWT or X.509). Specific errors like TrustChainEmptyError, X509ValidationError may be thrown.
  */
-async function validateTrustChain(trustAnchorEntity, chain) {
+async function validateTrustChain(trustAnchorEntity, chain, x509Options) {
   // If the chain is empty, fail
   if (chain.length === 0) {
     throw new _errors.TrustChainEmptyError("Cannot verify empty trust chain.");
@@ -37,7 +40,7 @@ async function validateTrustChain(trustAnchorEntity, chain) {
   // Select the expected token shape
   const selectTokenShape = elementIndex => elementIndex === 0 ? FirstElementShape : elementIndex === chain.length - 1 ? LastElementShape : MiddleElementShape;
 
-  // select the kid from the current index
+  // Select the kid from the current index
   const selectKid = currentIndex => {
     const token = chain[currentIndex];
     if (!token) {
@@ -49,8 +52,8 @@ async function validateTrustChain(trustAnchorEntity, chain) {
     return shape.parse((0, _utils.decode)(token)).header.kid;
   };
 
-  // select keys from the next token
-  // if the current token is the last, keys from trust anchor will be used
+  // Select keys from the next token
+  // If the current token is the last, keys from trust anchor will be used
   const selectKeys = currentIndex => {
     if (currentIndex === chain.length - 1) {
       return trustAnchorEntity.payload.jwks.keys;
@@ -65,10 +68,45 @@ async function validateTrustChain(trustAnchorEntity, chain) {
     const shape = selectTokenShape(nextIndex);
     return shape.parse((0, _utils.decode)(nextToken)).payload.jwks.keys;
   };
+  const x509TrustAnchorCertBase64 = (0, _utils.getTrustAnchorX509Certificate)(trustAnchorEntity);
 
   // Iterate the chain and validate each element's signature against the public keys of its next
   // If there is no next, hence it's the end of the chain, and it must be verified by the Trust Anchor
-  return Promise.all(chain.map((token, i) => [token, selectKid(i), selectKeys(i)]).map(args => (0, _utils.verify)(...args)));
+  const validationPromises = chain.map(async (tokenString, i) => {
+    const kidFromTokenHeader = selectKid(i);
+    const signerJwks = selectKeys(i);
+
+    // Step 1: Verify JWT signature
+    const parsedToken = await (0, _utils.verify)(tokenString, kidFromTokenHeader, signerJwks);
+
+    // Step 2: X.509 Certificate Chain Validation
+    const jwkUsedForVerification = signerJwks.find(k => k.kid === kidFromTokenHeader);
+    if (!jwkUsedForVerification) {
+      throw new _errors.FederationError(`JWK with kid '${kidFromTokenHeader}' was not found in signer's JWKS for token at index ${i}, though JWT verification passed.`, {
+        tokenIndex: i,
+        kid: kidFromTokenHeader
+      });
+    }
+    if (!jwkUsedForVerification.x5c || jwkUsedForVerification.x5c.length === 0) {
+      throw new _errors.MissingX509CertsError(`JWK with kid '${kidFromTokenHeader}' does not contain an X.509 certificate chain (x5c) for token at index ${i}.`);
+    }
+
+    // If the chain has more than one certificate AND
+    // the last certificate in the x5c chain is the same as the trust anchor,
+    // remove the anchor from the chain being passed, as it's supplied separately.
+    const certChainBase64 = jwkUsedForVerification.x5c.length > 1 && jwkUsedForVerification.x5c.at(-1) === x509TrustAnchorCertBase64 ? jwkUsedForVerification.x5c.slice(0, -1) : jwkUsedForVerification.x5c;
+    const x509ValidationResult = await (0, _ioReactNativeCrypto.verifyCertificateChain)(certChainBase64, x509TrustAnchorCertBase64, x509Options);
+    if (!x509ValidationResult.isValid) {
+      throw new _errors.X509ValidationError(`X.509 certificate chain validation failed for token at index ${i} (kid: ${kidFromTokenHeader}). Status: ${x509ValidationResult.validationStatus}. Error: ${x509ValidationResult.errorMessage}`, {
+        tokenIndex: i,
+        kid: kidFromTokenHeader,
+        x509ValidationStatus: x509ValidationResult.validationStatus,
+        x509ErrorMessage: x509ValidationResult.errorMessage
+      });
+    }
+    return parsedToken;
+  });
+  return Promise.all(validationPromises);
 }
 
 /**
@@ -86,14 +124,14 @@ async function renewTrustChain(chain) {
     const entityStatementResult = _types.EntityStatement.safeParse(decoded);
     const entityConfigurationResult = _types.EntityConfiguration.safeParse(decoded);
     if (entityConfigurationResult.success) {
-      return (0, _.getSignedEntityConfiguration)(entityConfigurationResult.data.payload.iss, {
+      return (0, _buildChain.getSignedEntityConfiguration)(entityConfigurationResult.data.payload.iss, {
         appFetch
       });
     }
     if (entityStatementResult.success) {
       const entityStatement = entityStatementResult.data;
       const parentBaseUrl = entityStatement.payload.iss;
-      const parentECJwt = await (0, _.getSignedEntityConfiguration)(parentBaseUrl, {
+      const parentECJwt = await (0, _buildChain.getSignedEntityConfiguration)(parentBaseUrl, {
         appFetch
       });
       const parentEC = _types.EntityConfiguration.parse((0, _utils.decode)(parentECJwt));
@@ -104,7 +142,7 @@ async function renewTrustChain(chain) {
           missingInEntityUrl: parentBaseUrl
         });
       }
-      return (0, _.getSignedEntityStatement)(federationFetchEndpoint, entityStatement.payload.sub, {
+      return (0, _buildChain.getSignedEntityStatement)(federationFetchEndpoint, entityStatement.payload.sub, {
         appFetch
       });
     }
@@ -113,4 +151,38 @@ async function renewTrustChain(chain) {
     });
   }));
 }
-//# sourceMappingURL=chain.js.map
+
+/**
+ * Verify a given trust chain is actually valid.
+ * It can handle fast chain renewal, which means we try to fetch a fresh version of each statement.
+ *
+ * @param trustAnchorEntity The entity configuration of the known trust anchor
+ * @param chain The chain of statements to be validated
+ * @param x509Options Options for the verification process
+ * @param appFetch (optional) fetch api implementation
+ * @param renewOnFail Whether to attempt to renew the trust chain if the initial validation fails
+ * @returns The result of the chain validation
+ * @throws {FederationError} If the chain is not valid
+ */
+async function verifyTrustChain(trustAnchorEntity, chain) {
+  let x509Options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {
+    connectTimeout: 10000,
+    readTimeout: 10000,
+    requireCrl: true
+  };
+  let {
+    appFetch = fetch,
+    renewOnFail = true
+  } = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : {};
+  try {
+    return validateTrustChain(trustAnchorEntity, chain, x509Options);
+  } catch (error) {
+    if (renewOnFail) {
+      const renewedChain = await renewTrustChain(chain, appFetch);
+      return validateTrustChain(trustAnchorEntity, renewedChain, x509Options);
+    } else {
+      throw error;
+    }
+  }
+}
+//# sourceMappingURL=verify-chain.js.map

package/lib/commonjs/trust/verify-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_types","require","z","_interopRequireWildcard","_utils","_errors","_ioReactNativeCrypto","_buildChain","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","FirstElementShape","EntityConfiguration","MiddleElementShape","EntityStatement","LastElementShape","union","TrustAnchorEntityConfiguration","validateTrustChain","trustAnchorEntity","chain","x509Options","length","TrustChainEmptyError","selectTokenShape","elementIndex","selectKid","currentIndex","token","TrustChainTokenMissingError","index","shape","parse","decode","header","kid","selectKeys","payload","jwks","keys","nextIndex","nextToken","x509TrustAnchorCertBase64","getTrustAnchorX509Certificate","validationPromises","map","tokenString","i","kidFromTokenHeader","signerJwks","parsedToken","verify","jwkUsedForVerification","find","k","FederationError","tokenIndex","x5c","MissingX509CertsError","certChainBase64","at","slice","x509ValidationResult","verifyCertificateChain","isValid","X509ValidationError","validationStatus","errorMessage","x509ValidationStatus","x509ErrorMessage","Promise","all","renewTrustChain","appFetch","arguments","undefined","fetch","decoded","entityStatementResult","safeParse","entityConfigurationResult","success","getSignedEntityConfiguration","data","iss","entityStatement","parentBaseUrl","parentECJwt","parentEC","federationFetchEndpoint","metadata","federation_entity","federation_fetch_endpoint","MissingFederationFetchEndpointError","sub","entityBaseUrl","missingInEntityUrl","getSignedEntityStatement","TrustChainRenewalError","originalChain","verifyTrustChain","connectTimeout","readTimeout","requireCrl","renewOnFail","error","renewedChain"],"sourceRoot":"../../../src","sources":["trust/verify-chain.ts"],"mappings":";;;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAMA,IAAAC,CAAA,GAAAC,uBAAA,CAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AAMA,IAAAI,OAAA,GAAAJ,OAAA;AASA,IAAAK,oBAAA,GAAAL,OAAA;AAKA,IAAAM,WAAA,GAAAN,OAAA;AAGuB,SAAAO,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAN,wBAAAU,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAEvB;AACA,MAAMW,iBAAiB,GAAGC,0BAAmB;AAC7C;AACA,MAAMC,kBAAkB,GAAGC,sBAAe;AAC1C;AACA;AACA,MAAMC,gBAAgB,GAAGhC,CAAC,CAACiC,KAAK,CAAC,CAC/BF,sBAAe,EACfG,qCAA8B,CAC/B,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,kBAAkBA,CACtCC,iBAAiD,EACjDC,KAAe,EACfC,WAAmC,EACX;EACxB;EACA,IAAID,KAAK,CAACE,MAAM,KAAK,CAAC,EAAE;IACtB,MAAM,IAAIC,4BAAoB,CAAC,kCAAkC,CAAC;EACpE;;EAEA;EACA,MAAMC,gBAAgB,GAAIC,YAAoB,IAC5CA,YAAY,KAAK,CAAC,GACdd,iBAAiB,GACjBc,YAAY,KAAKL,KAAK,CAACE,MAAM,GAAG,CAAC,GAC/BP,gBAAgB,GAChBF,kBAAkB;;EAE1B;EACA,MAAMa,SAAS,GAAIC,YAAoB,IAAa;IAClD,MAAMC,KAAK,GAAGR,KAAK,CAACO,YAAY,CAAC;IACjC,IAAI,CAACC,KAAK,EAAE;MACV,MAAM,IAAIC,mCAA2B,CAClC,0BAAyBF,YAAa,kBAAiB,EACxD;QAAEG,KAAK,EAAEH;MAAa,CACxB,CAAC;IACH;IACA,MAAMI,KAAK,GAAGP,gBAAgB,CAACG,YAAY,CAAC;IAC5C,OAAOI,KAAK,CAACC,KAAK,CAAC,IAAAC,aAAM,EAACL,KAAK,CAAC,CAAC,CAACM,MAAM,CAACC,GAAG;EAC9C,CAAC;;EAED;EACA;EACA,MAAMC,UAAU,GAAIT,YAAoB,IAAY;IAClD,IAAIA,YAAY,KAAKP,KAAK,CAACE,MAAM,GAAG,CAAC,EAAE;MACrC,OAAOH,iBAAiB,CAACkB,OAAO,CAACC,IAAI,CAACC,IAAI;IAC5C;IAEA,MAAMC,SAAS,GAAGb,YAAY,GAAG,CAAC;IAClC,MAAMc,SAAS,GAAGrB,KAAK,CAACoB,SAAS,CAAC;IAClC,IAAI,CAACC,SAAS,EAAE;MACd,MAAM,IAAIZ,mCAA2B,CAClC,+BAA8BW,SAAU,kCAAiCb,YAAa,IAAG,EAC1F;QAAEG,KAAK,EAAEU;MAAU,CACrB,CAAC;IACH;IACA,MAAMT,KAAK,GAAGP,gBAAgB,CAACgB,SAAS,CAAC;IACzC,OAAOT,KAAK,CAACC,KAAK,CAAC,IAAAC,aAAM,EAACQ,SAAS,CAAC,CAAC,CAACJ,OAAO,CAACC,IAAI,CAACC,IAAI;EACzD,CAAC;EAED,MAAMG,yBAAyB,GAC7B,IAAAC,oCAA6B,EAACxB,iBAAiB,CAAC;;EAElD;EACA;EACA,MAAMyB,kBAAkB,GAAGxB,KAAK,CAACyB,GAAG,CAAC,OAAOC,WAAW,EAAEC,CAAC,KAAK;IAC7D,MAAMC,kBAAkB,GAAGtB,SAAS,CAACqB,CAAC,CAAC;IACvC,MAAME,UAAU,GAAGb,UAAU,CAACW,CAAC,CAAC;;IAEhC;IACA,MAAMG,WAAW,GAAG,MAAM,IAAAC,aAAM,EAC9BL,WAAW,EACXE,kBAAkB,EAClBC,UACF,CAAC;;IAED;IACA,MAAMG,sBAAsB,GAAGH,UAAU,CAACI,IAAI,CAC3CC,CAAC,IAAKA,CAAC,CAACnB,GAAG,KAAKa,kBACnB,CAAC;IAED,IAAI,CAACI,sBAAsB,EAAE;MAC3B,MAAM,IAAIG,uBAAe,CACtB,iBAAgBP,kBAAmB,uDAAsDD,CAAE,mCAAkC,EAC9H;QAAES,UAAU,EAAET,CAAC;QAAEZ,GAAG,EAAEa;MAAmB,CAC3C,CAAC;IACH;IAEA,IACE,CAACI,sBAAsB,CAACK,GAAG,IAC3BL,sBAAsB,CAACK,GAAG,CAACnC,MAAM,KAAK,CAAC,EACvC;MACA,MAAM,IAAIoC,6BAAqB,CAC5B,iBAAgBV,kBAAmB,0EAAyED,CAAE,GACjH,CAAC;IACH;;IAEA;IACA;IACA;IACA,MAAMY,eAAe,GACnBP,sBAAsB,CAACK,GAAG,CAACnC,MAAM,GAAG,CAAC,IACrC8B,sBAAsB,CAACK,GAAG,CAACG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAKlB,yBAAyB,GAC3DU,sBAAsB,CAACK,GAAG,CAACI,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACvCT,sBAAsB,CAACK,GAAG;IAEhC,MAAMK,oBAAiD,GACrD,MAAM,IAAAC,2CAAsB,EAC1BJ,eAAe,EACfjB,yBAAyB,EACzBrB,WACF,CAAC;IAEH,IAAI,CAACyC,oBAAoB,CAACE,OAAO,EAAE;MACjC,MAAM,IAAIC,2BAAmB,CAC1B,gEAA+DlB,CAAE,UAASC,kBAAmB,cAAac,oBAAoB,CAACI,gBAAiB,YAAWJ,oBAAoB,CAACK,YAAa,EAAC,EAC/L;QACEX,UAAU,EAAET,CAAC;QACbZ,GAAG,EAAEa,kBAAkB;QACvBoB,oBAAoB,EAAEN,oBAAoB,CAACI,gBAAgB;QAC3DG,gBAAgB,EAAEP,oBAAoB,CAACK;MACzC,CACF,CAAC;IACH;IACA,OAAOjB,WAAW;EACpB,CAAC,CAAC;EAEF,OAAOoB,OAAO,CAACC,GAAG,CAAC3B,kBAAkB,CAAC;AACxC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe4B,eAAeA,CACnCpD,KAAe,EAEI;EAAA,IADnBqD,QAA8B,GAAAC,SAAA,CAAApD,MAAA,QAAAoD,SAAA,QAAAC,SAAA,GAAAD,SAAA,MAAGE,KAAK;EAEtC,OAAON,OAAO,CAACC,GAAG,CAChBnD,KAAK,CAACyB,GAAG,CAAC,OAAOjB,KAAK,EAAEE,KAAK,KAAK;IAChC,MAAM+C,OAAO,GAAG,IAAA5C,aAAM,EAACL,KAAK,CAAC;IAE7B,MAAMkD,qBAAqB,GAAGhE,sBAAe,CAACiE,SAAS,CAACF,OAAO,CAAC;IAChE,MAAMG,yBAAyB,GAAGpE,0BAAmB,CAACmE,SAAS,CAACF,OAAO,CAAC;IAExE,IAAIG,yBAAyB,CAACC,OAAO,EAAE;MACrC,OAAO,IAAAC,wCAA4B,EACjCF,yBAAyB,CAACG,IAAI,CAAC9C,OAAO,CAAC+C,GAAG,EAC1C;QAAEX;MAAS,CACb,CAAC;IACH;IACA,IAAIK,qBAAqB,CAACG,OAAO,EAAE;MACjC,MAAMI,eAAe,GAAGP,qBAAqB,CAACK,IAAI;MAElD,MAAMG,aAAa,GAAGD,eAAe,CAAChD,OAAO,CAAC+C,GAAG;MACjD,MAAMG,WAAW,GAAG,MAAM,IAAAL,wCAA4B,EAACI,aAAa,EAAE;QACpEb;MACF,CAAC,CAAC;MACF,MAAMe,QAAQ,GAAG5E,0BAAmB,CAACoB,KAAK,CAAC,IAAAC,aAAM,EAACsD,WAAW,CAAC,CAAC;MAE/D,MAAME,uBAAuB,GAC3BD,QAAQ,CAACnD,OAAO,CAACqD,QAAQ,CAACC,iBAAiB,CAACC,yBAAyB;MACvE,IAAI,CAACH,uBAAuB,EAAE;QAC5B,MAAM,IAAII,2CAAmC,CAC1C,gBAAeP,aAAc,8DAA6DD,eAAe,CAAChD,OAAO,CAACyD,GAAI,GAAE,EACzH;UACEC,aAAa,EAAEV,eAAe,CAAChD,OAAO,CAACyD,GAAG;UAC1CE,kBAAkB,EAAEV;QACtB,CACF,CAAC;MACH;MACA,OAAO,IAAAW,oCAAwB,EAC7BR,uBAAuB,EACvBJ,eAAe,CAAChD,OAAO,CAACyD,GAAG,EAC3B;QAAErB;MAAS,CACb,CAAC;IACH;IACA,MAAM,IAAIyB,8BAAsB,CAC7B,iDAAgDpE,KAAM,mBAAkB,EACzE;MAAEqE,aAAa,EAAE/E;IAAM,CACzB,CAAC;EACH,CAAC,CACH,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAegF,gBAAgBA,CACpCjF,iBAAiD,EACjDC,KAAe,EAUiC;EAAA,IAThDC,WAAmC,GAAAqD,SAAA,CAAApD,MAAA,QAAAoD,SAAA,QAAAC,SAAA,GAAAD,SAAA,MAAG;IACpC2B,cAAc,EAAE,KAAK;IACrBC,WAAW,EAAE,KAAK;IAClBC,UAAU,EAAE;EACd,CAAC;EAAA,IACD;IACE9B,QAAQ,GAAGG,KAAK;IAChB4B,WAAW,GAAG;EAC4C,CAAC,GAAA9B,SAAA,CAAApD,MAAA,QAAAoD,SAAA,QAAAC,SAAA,GAAAD,SAAA,MAAG,CAAC,CAAC;EAElE,IAAI;IACF,OAAOxD,kBAAkB,CAACC,iBAAiB,EAAEC,KAAK,EAAEC,WAAW,CAAC;EAClE,CAAC,CAAC,OAAOoF,KAAK,EAAE;IACd,IAAID,WAAW,EAAE;MACf,MAAME,YAAY,GAAG,MAAMlC,eAAe,CAACpD,KAAK,EAAEqD,QAAQ,CAAC;MAC3D,OAAOvD,kBAAkB,CAACC,iBAAiB,EAAEuF,YAAY,EAAErF,WAAW,CAAC;IACzE,CAAC,MAAM;MACL,MAAMoF,KAAK;IACb;EACF;AACF"}

package/lib/commonjs/utils/errors.js.map

@@ -1 +1 @@
-{"version":3,"names":["_errorCodes","require","serializeAttrs","attrs","Object","entries","filter","_ref","v","undefined","map","_ref2","k","Array","isArray","join","JSON","stringify","_","exports","IoWalletError","Error","code","constructor","message","name","ValidationFailed","_ref3","claim","reason","UnexpectedStatusCodeError","_ref4","statusCode","IssuerResponseError","params","IssuerResponseErrorCodes","IssuerGenericError","WalletProviderResponseError","WalletProviderResponseErrorCodes","WalletProviderGenericError","RelyingPartyResponseError","RelyingPartyResponseErrorCodes","RelyingPartyGenericError","extractErrorMessageFromIssuerConf","errorCode","_ref5","issuerConf","credentialType","credentialConfiguration","openid_credential_issuer","credential_configurations_supported","issuance_errors_supported","localesList","display","reduce","acc","_ref6","locale","rest","makeErrorTypeGuard","ErrorClass","error","isIssuerResponseError","isWalletProviderResponseError","isRelyingPartyResponseError","ResponseErrorBuilder","errorCases","handle","status","buildFrom","originalError"],"sourceRoot":"../../../src","sources":["utils/errors.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,IAAAA,WAAA,GAAAC,OAAA;AAeA;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,cAAc,GACzBC,KAA8E,IAE9EC,MAAM,CAACC,OAAO,CAACF,KAAK,CAAC,CAClBG,MAAM,CAACC,IAAA;EAAA,IAAC,GAAGC,CAAC,CAAC,GAAAD,IAAA;EAAA,OAAKC,CAAC,KAAKC,SAAS;AAAA,EAAC,CAClCC,GAAG,CAACC,KAAA,IAAY;EAAA,IAAX,CAACC,CAAC,EAAEJ,CAAC,CAAC,GAAAG,KAAA;EACV,IAAIE,KAAK,CAACC,OAAO,CAACN,CAAC,CAAC,EAAE,OAAO,CAACI,CAAC,EAAG,IAAGJ,CAAC,CAACO,IAAI,CAAC,IAAI,CAAE,GAAE,CAAC;EACrD,IAAI,OAAOP,CAAC,KAAK,QAAQ,EAAE,OAAO,CAACI,CAAC,EAAEI,IAAI,CAACC,SAAS,CAACT,CAAC,CAAC,CAAC;EACxD,OAAO,CAACI,CAAC,EAAEJ,CAAC,CAAC;AACf,CAAC,CAAC,CACDE,GAAG,CAAEQ,CAAC,IAAKA,CAAC,CAACH,IAAI,CAAC,GAAG,CAAC,CAAC,CACvBA,IAAI,CAAC,GAAG,CAAC;;AAEd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAVAI,OAAA,CAAAjB,cAAA,GAAAA,cAAA;AAWO,MAAMkB,aAAa,SAASC,KAAK,CAAC;EACvC;EACAC,IAAI,GAAW,uBAAuB;EAEtCC,WAAWA,CAACC,OAAgB,EAAE;IAC5B,KAAK,CAACA,OAAO,CAAC;IACd,IAAI,CAACC,IAAI,GAAG,IAAI,CAACF,WAAW,CAACE,IAAI;EACnC;AACF;;AAEA;AACA;AACA;AACA;AAHAN,OAAA,CAAAC,aAAA,GAAAA,aAAA;AAIO,MAAMM,gBAAgB,SAASN,aAAa,CAAC;EAClDE,IAAI,GAAG,iCAAiC;;EAExC;;EAGA;;EAGAC,WAAWA,CAAAI,KAAA,EAQR;IAAA,IARS;MACVH,OAAO;MACPI,KAAK,GAAG,aAAa;MACrBC,MAAM,GAAG;IAKX,CAAC,GAAAF,KAAA;IACC,KAAK,CAACzB,cAAc,CAAC;MAAEsB,OAAO;MAAEI,KAAK;MAAEC;IAAO,CAAC,CAAC,CAAC;IACjD,IAAI,CAACD,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACC,MAAM,GAAGA,MAAM;EACtB;AACF;;AAEA;AACA;AACA;AAFAV,OAAA,CAAAO,gBAAA,GAAAA,gBAAA;AAGO,MAAMI,yBAAyB,SAASV,aAAa,CAAC;EAC3DE,IAAI,GAAW,4BAA4B;EAI3CC,WAAWA,CAAAQ,KAAA,EAQR;IAAA,IARS;MACVP,OAAO;MACPK,MAAM;MACNG;IAKF,CAAC,GAAAD,KAAA;IACC,KAAK,CAAC7B,cAAc,CAAC;MAAEsB,OAAO;MAAEK,MAAM;MAAEG;IAAW,CAAC,CAAC,CAAC;IACtD,IAAI,CAACH,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACG,UAAU,GAAGA,UAAU;EAC9B;AACF;;AAEA;AACA;AACA;AACA;AAHAb,OAAA,CAAAW,yBAAA,GAAAA,yBAAA;AAIO,MAAMG,mBAAmB,SAASH,yBAAyB,CAAC;EAGjEP,WAAWA,CAACW,MAKX,EAAE;IACD,KAAK,CAACA,MAAM,CAAC;IACb,IAAI,CAACZ,IAAI,GAAGY,MAAM,CAACZ,IAAI,IAAIa,oCAAwB,CAACC,kBAAkB;EACxE;AACF;;AAEA;AACA;AACA;AACA;AAHAjB,OAAA,CAAAc,mBAAA,GAAAA,mBAAA;AAIO,MAAMI,2BAA2B,SAASP,yBAAyB,CAAC;EAIzEP,WAAWA,CAACW,MAKX,EAAE;IACD,KAAK,CAACA,MAAM,CAAC;IACb,IAAI,CAACL,MAAM,GAAGK,MAAM,CAACL,MAAM;IAC3B,IAAI,CAACP,IAAI,GACPY,MAAM,CAACZ,IAAI,IACXgB,4CAAgC,CAACC,0BAA0B;EAC/D;AACF;;AAEA;AACA;AACA;AACA;AAHApB,OAAA,CAAAkB,2BAAA,GAAAA,2BAAA;AAIO,MAAMG,yBAAyB,SAASV,yBAAyB,CAAC;EAGvEP,WAAWA,CAACW,MAKX,EAAE;IACD,KAAK,CAACA,MAAM,CAAC;IACb,IAAI,CAACZ,IAAI,GACPY,MAAM,CAACZ,IAAI,IAAImB,0CAA8B,CAACC,wBAAwB;EAC1E;AACF;AAACvB,OAAA,CAAAqB,yBAAA,GAAAA,yBAAA;AASD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,iCAAiCA,CAC/CC,SAAiB,EAAAC,KAAA,EAQmB;EAAA,IAPpC;IACEC,UAAU;IACVC;EAIF,CAAC,GAAAF,KAAA;EAED,MAAMG,uBAAuB,GAC3BF,UAAU,CAACG,wBAAwB,CAACC,mCAAmC,CACrEH,cAAc,CACf;EAEH,IAAI,CAACC,uBAAuB,EAAE;IAC5B,MAAM,IAAI5B,aAAa,CACpB,8BAA6B2B,cAAe,qBAC/C,CAAC;EACH;EAEA,MAAM;IAAEI;EAA0B,CAAC,GAAGH,uBAAuB;EAE7D,IAAI,EAACG,yBAAyB,aAAzBA,yBAAyB,eAAzBA,yBAAyB,CAAGP,SAAS,CAAC,GAAE;IAC3C,OAAOnC,SAAS;EAClB;EAEA,MAAM2C,WAAW,GAAGD,yBAAyB,CAACP,SAAS,CAAC,CAAES,OAAO;EAEjE,OAAOD,WAAW,CAACE,MAAM,CACvB,CAACC,GAAG,EAAAC,KAAA;IAAA,IAAE;MAAEC,MAAM;MAAE,GAAGC;IAAK,CAAC,GAAAF,KAAA;IAAA,OAAM;MAAE,GAAGD,GAAG;MAAE,CAACE,MAAM,GAAGC;IAAK,CAAC;EAAA,CAAC,EAC1D,CAAC,CACH,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,kBAAkB,GACuBC,UAAa,IAC1D,CAACC,KAAc,EAAEvC,IAA0B,KACzCuC,KAAK,YAAYD,UAAU,IAAIC,KAAK,CAACvC,IAAI,MAAMA,IAAI,IAAIuC,KAAK,CAACvC,IAAI,CAAC;AAE/D,MAAMwC,qBAAqB,GAAGH,kBAAkB,CAAC1B,mBAAmB,CAAC;AAACd,OAAA,CAAA2C,qBAAA,GAAAA,qBAAA;AACtE,MAAMC,6BAA6B,GAAGJ,kBAAkB,CAC7DtB,2BACF,CAAC;AAAClB,OAAA,CAAA4C,6BAAA,GAAAA,6BAAA;AACK,MAAMC,2BAA2B,GAAGL,kBAAkB,CAC3DnB,yBACF,CAAC;;AAED;AAAArB,OAAA,CAAA6C,2BAAA,GAAAA,2BAAA;AAuBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,oBAAoB,CAA6C;EACpEC,UAAU,GAEd,CAAC,CAAC;EAEN3C,WAAWA,CAASqC,UAAa,EAAE;IAAA,KAAfA,UAAa,GAAbA,UAAa;EAAG;EAEpCO,MAAMA,CAACC,MAAoB,EAAElC,MAAoB,EAAE;IACjD,IAAI,CAACgC,UAAU,CAACE,MAAM,CAAC,GAAGlC,MAAM;IAChC,OAAO,IAAI;EACb;EAEAmC,SAASA,CAACC,aAAwC,EAAE;IAClD,MAAMpC,MAAM,GACV,IAAI,CAACgC,UAAU,CAACI,aAAa,CAACtC,UAAU,CAAC,IAAI,IAAI,CAACkC,UAAU,CAAC,GAAG,CAAC;IAEnE,IAAIhC,MAAM,EAAE;MACV,OAAO,IAAI,IAAI,CAAC0B,UAAU,CAAC;QAAE,GAAGU,aAAa;QAAE,GAAGpC;MAAO,CAAC,CAAC;IAC7D;IAEA,OAAOoC,aAAa;EACtB;AACF;AAACnD,OAAA,CAAA8C,oBAAA,GAAAA,oBAAA"}
+{"version":3,"names":["_errorCodes","require","serializeAttrs","attrs","Object","entries","filter","_ref","v","undefined","map","_ref2","k","Array","isArray","join","JSON","stringify","_","exports","IoWalletError","Error","code","constructor","message","name","ValidationFailed","_ref3","claim","reason","UnexpectedStatusCodeError","_ref4","statusCode","IssuerResponseError","params","IssuerResponseErrorCodes","IssuerGenericError","WalletProviderResponseError","WalletProviderResponseErrorCodes","WalletProviderGenericError","RelyingPartyResponseError","RelyingPartyResponseErrorCodes","RelyingPartyGenericError","extractErrorMessageFromIssuerConf","errorCode","_ref5","issuerConf","credentialType","credentialConfiguration","openid_credential_issuer","credential_configurations_supported","issuance_errors_supported","localesList","display","reduce","acc","_ref6","locale","rest","makeErrorTypeGuard","ErrorClass","error","isIssuerResponseError","isWalletProviderResponseError","isRelyingPartyResponseError","ResponseErrorBuilder","errorCases","handle","status","buildFrom","originalError"],"sourceRoot":"../../../src","sources":["utils/errors.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,IAAAA,WAAA,GAAAC,OAAA;AAgBA;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,cAAc,GACzBC,KAA8E,IAE9EC,MAAM,CAACC,OAAO,CAACF,KAAK,CAAC,CAClBG,MAAM,CAACC,IAAA;EAAA,IAAC,GAAGC,CAAC,CAAC,GAAAD,IAAA;EAAA,OAAKC,CAAC,KAAKC,SAAS;AAAA,EAAC,CAClCC,GAAG,CAACC,KAAA,IAAY;EAAA,IAAX,CAACC,CAAC,EAAEJ,CAAC,CAAC,GAAAG,KAAA;EACV,IAAIE,KAAK,CAACC,OAAO,CAACN,CAAC,CAAC,EAAE,OAAO,CAACI,CAAC,EAAG,IAAGJ,CAAC,CAACO,IAAI,CAAC,IAAI,CAAE,GAAE,CAAC;EACrD,IAAI,OAAOP,CAAC,KAAK,QAAQ,EAAE,OAAO,CAACI,CAAC,EAAEI,IAAI,CAACC,SAAS,CAACT,CAAC,CAAC,CAAC;EACxD,OAAO,CAACI,CAAC,EAAEJ,CAAC,CAAC;AACf,CAAC,CAAC,CACDE,GAAG,CAAEQ,CAAC,IAAKA,CAAC,CAACH,IAAI,CAAC,GAAG,CAAC,CAAC,CACvBA,IAAI,CAAC,GAAG,CAAC;;AAEd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAVAI,OAAA,CAAAjB,cAAA,GAAAA,cAAA;AAWO,MAAMkB,aAAa,SAASC,KAAK,CAAC;EACvC;EACAC,IAAI,GAAW,uBAAuB;EAEtCC,WAAWA,CAACC,OAAgB,EAAE;IAC5B,KAAK,CAACA,OAAO,CAAC;IACd,IAAI,CAACC,IAAI,GAAG,IAAI,CAACF,WAAW,CAACE,IAAI;EACnC;AACF;;AAEA;AACA;AACA;AACA;AAHAN,OAAA,CAAAC,aAAA,GAAAA,aAAA;AAIO,MAAMM,gBAAgB,SAASN,aAAa,CAAC;EAClDE,IAAI,GAAG,iCAAiC;;EAExC;;EAGA;;EAGAC,WAAWA,CAAAI,KAAA,EAQR;IAAA,IARS;MACVH,OAAO;MACPI,KAAK,GAAG,aAAa;MACrBC,MAAM,GAAG;IAKX,CAAC,GAAAF,KAAA;IACC,KAAK,CAACzB,cAAc,CAAC;MAAEsB,OAAO;MAAEI,KAAK;MAAEC;IAAO,CAAC,CAAC,CAAC;IACjD,IAAI,CAACD,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACC,MAAM,GAAGA,MAAM;EACtB;AACF;;AAEA;AACA;AACA;AAFAV,OAAA,CAAAO,gBAAA,GAAAA,gBAAA;AAGO,MAAMI,yBAAyB,SAASV,aAAa,CAAC;EAC3DE,IAAI,GAAW,4BAA4B;EAI3CC,WAAWA,CAAAQ,KAAA,EAQR;IAAA,IARS;MACVP,OAAO;MACPK,MAAM;MACNG;IAKF,CAAC,GAAAD,KAAA;IACC,KAAK,CAAC7B,cAAc,CAAC;MAAEsB,OAAO;MAAEK,MAAM;MAAEG;IAAW,CAAC,CAAC,CAAC;IACtD,IAAI,CAACH,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACG,UAAU,GAAGA,UAAU;EAC9B;AACF;;AAEA;AACA;AACA;AACA;AAHAb,OAAA,CAAAW,yBAAA,GAAAA,yBAAA;AAIO,MAAMG,mBAAmB,SAASH,yBAAyB,CAAC;EAGjEP,WAAWA,CAACW,MAKX,EAAE;IACD,KAAK,CAACA,MAAM,CAAC;IACb,IAAI,CAACZ,IAAI,GAAGY,MAAM,CAACZ,IAAI,IAAIa,oCAAwB,CAACC,kBAAkB;EACxE;AACF;;AAEA;AACA;AACA;AACA;AAHAjB,OAAA,CAAAc,mBAAA,GAAAA,mBAAA;AAIO,MAAMI,2BAA2B,SAASP,yBAAyB,CAAC;EAIzEP,WAAWA,CAACW,MAKX,EAAE;IACD,KAAK,CAACA,MAAM,CAAC;IACb,IAAI,CAACL,MAAM,GAAGK,MAAM,CAACL,MAAM;IAC3B,IAAI,CAACP,IAAI,GACPY,MAAM,CAACZ,IAAI,IACXgB,4CAAgC,CAACC,0BAA0B;EAC/D;AACF;;AAEA;AACA;AACA;AACA;AAHApB,OAAA,CAAAkB,2BAAA,GAAAA,2BAAA;AAIO,MAAMG,yBAAyB,SAASV,yBAAyB,CAAC;EAGvEP,WAAWA,CAACW,MAKX,EAAE;IACD,KAAK,CAACA,MAAM,CAAC;IACb,IAAI,CAACZ,IAAI,GACPY,MAAM,CAACZ,IAAI,IAAImB,0CAA8B,CAACC,wBAAwB;EAC1E;AACF;AAACvB,OAAA,CAAAqB,yBAAA,GAAAA,yBAAA;AASD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,iCAAiCA,CAC/CC,SAAiB,EAAAC,KAAA,EAQmB;EAAA,IAPpC;IACEC,UAAU;IACVC;EAIF,CAAC,GAAAF,KAAA;EAED,MAAMG,uBAAuB,GAC3BF,UAAU,CAACG,wBAAwB,CAACC,mCAAmC,CACrEH,cAAc,CACf;EAEH,IAAI,CAACC,uBAAuB,EAAE;IAC5B,MAAM,IAAI5B,aAAa,CACpB,8BAA6B2B,cAAe,qBAC/C,CAAC;EACH;EAEA,MAAM;IAAEI;EAA0B,CAAC,GAAGH,uBAAuB;EAE7D,IAAI,EAACG,yBAAyB,aAAzBA,yBAAyB,eAAzBA,yBAAyB,CAAGP,SAAS,CAAC,GAAE;IAC3C,OAAOnC,SAAS;EAClB;EAEA,MAAM2C,WAAW,GAAGD,yBAAyB,CAACP,SAAS,CAAC,CAAES,OAAO;EAEjE,OAAOD,WAAW,CAACE,MAAM,CACvB,CAACC,GAAG,EAAAC,KAAA;IAAA,IAAE;MAAEC,MAAM;MAAE,GAAGC;IAAK,CAAC,GAAAF,KAAA;IAAA,OAAM;MAAE,GAAGD,GAAG;MAAE,CAACE,MAAM,GAAGC;IAAK,CAAC;EAAA,CAAC,EAC1D,CAAC,CACH,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,kBAAkB,GACuBC,UAAa,IAC1D,CAACC,KAAc,EAAEvC,IAA0B,KACzCuC,KAAK,YAAYD,UAAU,IAAIC,KAAK,CAACvC,IAAI,MAAMA,IAAI,IAAIuC,KAAK,CAACvC,IAAI,CAAC;AAE/D,MAAMwC,qBAAqB,GAAGH,kBAAkB,CAAC1B,mBAAmB,CAAC;AAACd,OAAA,CAAA2C,qBAAA,GAAAA,qBAAA;AACtE,MAAMC,6BAA6B,GAAGJ,kBAAkB,CAC7DtB,2BACF,CAAC;AAAClB,OAAA,CAAA4C,6BAAA,GAAAA,6BAAA;AACK,MAAMC,2BAA2B,GAAGL,kBAAkB,CAC3DnB,yBACF,CAAC;;AAED;AAAArB,OAAA,CAAA6C,2BAAA,GAAAA,2BAAA;AAuBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,oBAAoB,CAA6C;EACpEC,UAAU,GAEd,CAAC,CAAC;EAEN3C,WAAWA,CAASqC,UAAa,EAAE;IAAA,KAAfA,UAAa,GAAbA,UAAa;EAAG;EAEpCO,MAAMA,CAACC,MAAoB,EAAElC,MAAoB,EAAE;IACjD,IAAI,CAACgC,UAAU,CAACE,MAAM,CAAC,GAAGlC,MAAM;IAChC,OAAO,IAAI;EACb;EAEAmC,SAASA,CAACC,aAAwC,EAAE;IAClD,MAAMpC,MAAM,GACV,IAAI,CAACgC,UAAU,CAACI,aAAa,CAACtC,UAAU,CAAC,IAAI,IAAI,CAACkC,UAAU,CAAC,GAAG,CAAC;IAEnE,IAAIhC,MAAM,EAAE;MACV,OAAO,IAAI,IAAI,CAAC0B,UAAU,CAAC;QAAE,GAAGU,aAAa;QAAE,GAAGpC;MAAO,CAAC,CAAC;IAC7D;IAEA,OAAOoC,aAAa;EACtB;AACF;AAACnD,OAAA,CAAA8C,oBAAA,GAAAA,oBAAA"}

package/lib/module/credential/issuance/02-evaluate-issuer-trust.js

@@ -1,4 +1,4 @@
-import { getCredentialIssuerEntityConfiguration } from "../../trust";
+import { getCredentialIssuerEntityConfiguration } from "../../trust/build-chain";
 /**
  * WARNING: This function must be called after {@link startFlow}. The next function to be called is {@link startUserAuthorization}.
  * The Issuer trust evaluation phase.

package/lib/module/credential/issuance/02-evaluate-issuer-trust.js.map

@@ -1 +1 @@
-{"version":3,"names":["getCredentialIssuerEntityConfiguration","evaluateIssuerTrust","issuerUrl","context","arguments","length","undefined","issuerConf","appFetch","then","_","payload","metadata"],"sourceRoot":"../../../../src","sources":["credential/issuance/02-evaluate-issuer-trust.ts"],"mappings":"AAAA,SAASA,sCAAsC,QAAQ,aAAa;AAcpE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,mBAAwC,GAAG,eAAAA,CACtDC,SAAS,EAEN;EAAA,IADHC,OAAO,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEZ,MAAMG,UAAU,GAAG,MAAMP,sCAAsC,CAACE,SAAS,EAAE;IACzEM,QAAQ,EAAEL,OAAO,CAACK;EACpB,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,OAAO,CAACC,QAAQ,CAAC;EAClC,OAAO;IAAEL;EAAW,CAAC;AACvB,CAAC"}
+{"version":3,"names":["getCredentialIssuerEntityConfiguration","evaluateIssuerTrust","issuerUrl","context","arguments","length","undefined","issuerConf","appFetch","then","_","payload","metadata"],"sourceRoot":"../../../../src","sources":["credential/issuance/02-evaluate-issuer-trust.ts"],"mappings":"AAGA,SAASA,sCAAsC,QAAQ,yBAAyB;AAWhF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,mBAAwC,GAAG,eAAAA,CACtDC,SAAS,EAEN;EAAA,IADHC,OAAO,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEZ,MAAMG,UAAU,GAAG,MAAMP,sCAAsC,CAACE,SAAS,EAAE;IACzEM,QAAQ,EAAEL,OAAO,CAACK;EACpB,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,OAAO,CAACC,QAAQ,CAAC;EAClC,OAAO;IAAEL;EAAW,CAAC;AACvB,CAAC"}

package/lib/module/credential/presentation/02-evaluate-rp-trust.js

@@ -1,4 +1,4 @@
-import { getRelyingPartyEntityConfiguration } from "../../trust";
+import { getRelyingPartyEntityConfiguration } from "../../trust/build-chain";
 /**
  * The Relying Party trust evaluation phase.
  * Fetch the  Relying Party's configuration and verify trust.

package/lib/module/credential/presentation/02-evaluate-rp-trust.js.map

@@ -1 +1 @@
-{"version":3,"names":["getRelyingPartyEntityConfiguration","evaluateRelyingPartyTrust","rpUrl","appFetch","fetch","arguments","length","undefined","payload","metadata","rpConf","sub","subject"],"sourceRoot":"../../../../src","sources":["credential/presentation/02-evaluate-rp-trust.ts"],"mappings":"AAAA,SAASA,kCAAkC,QAAQ,aAAa;AAehE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,yBAAoD,GAAG,eAAAA,CAClEC,KAAK,EAEF;EAAA,IADH;IAAEC,QAAQ,GAAGC;EAAM,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEzB,MAAM;IACJG,OAAO,EAAE;MAAEC,QAAQ,EAAEC,MAAM;MAAEC;IAAI;EACnC,CAAC,GAAG,MAAMX,kCAAkC,CAACE,KAAK,EAAE;IAClDC;EACF,CAAC,CAAC;EACF,OAAO;IAAEO,MAAM;IAAEE,OAAO,EAAED;EAAI,CAAC;AACjC,CAAC"}
+{"version":3,"names":["getRelyingPartyEntityConfiguration","evaluateRelyingPartyTrust","rpUrl","appFetch","fetch","arguments","length","undefined","payload","metadata","rpConf","sub","subject"],"sourceRoot":"../../../../src","sources":["credential/presentation/02-evaluate-rp-trust.ts"],"mappings":"AAGA,SAASA,kCAAkC,QAAQ,yBAAyB;AAY5E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,yBAAoD,GAAG,eAAAA,CAClEC,KAAK,EAEF;EAAA,IADH;IAAEC,QAAQ,GAAGC;EAAM,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEzB,MAAM;IACJG,OAAO,EAAE;MAAEC,QAAQ,EAAEC,MAAM;MAAEC;IAAI;EACnC,CAAC,GAAG,MAAMX,kCAAkC,CAACE,KAAK,EAAE;IAClDC;EACF,CAAC,CAAC;EACF,OAAO;IAAEO,MAAM;IAAEE,OAAO,EAAED;EAAI,CAAC;AACjC,CAAC"}