@pagopa/io-react-native-wallet 2.0.0-next.0 → 2.0.0-next.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/commonjs/credential/issuance/02-evaluate-issuer-trust.js +2 -2
- package/lib/commonjs/credential/issuance/02-evaluate-issuer-trust.js.map +1 -1
- package/lib/commonjs/credential/presentation/02-evaluate-rp-trust.js +2 -2
- package/lib/commonjs/credential/presentation/02-evaluate-rp-trust.js.map +1 -1
- package/lib/commonjs/credential/presentation/05-verify-request-object.js.map +1 -1
- package/lib/commonjs/credential/presentation/08-send-authorization-response.js.map +1 -1
- package/lib/commonjs/trust/README.md +147 -0
- package/lib/commonjs/trust/build-chain.js +252 -0
- package/lib/commonjs/trust/build-chain.js.map +1 -0
- package/lib/commonjs/trust/errors.js +24 -1
- package/lib/commonjs/trust/errors.js.map +1 -1
- package/lib/commonjs/trust/index.js +11 -276
- package/lib/commonjs/trust/index.js.map +1 -1
- package/lib/commonjs/trust/utils.js +30 -1
- package/lib/commonjs/trust/utils.js.map +1 -1
- package/lib/commonjs/trust/{chain.js → verify-chain.js} +87 -15
- package/lib/commonjs/trust/verify-chain.js.map +1 -0
- package/lib/commonjs/utils/errors.js.map +1 -1
- package/lib/module/credential/issuance/02-evaluate-issuer-trust.js +1 -1
- package/lib/module/credential/issuance/02-evaluate-issuer-trust.js.map +1 -1
- package/lib/module/credential/presentation/02-evaluate-rp-trust.js +1 -1
- package/lib/module/credential/presentation/02-evaluate-rp-trust.js.map +1 -1
- package/lib/module/credential/presentation/05-verify-request-object.js.map +1 -1
- package/lib/module/credential/presentation/08-send-authorization-response.js +1 -1
- package/lib/module/credential/presentation/08-send-authorization-response.js.map +1 -1
- package/lib/module/trust/README.md +147 -0
- package/lib/module/trust/build-chain.js +235 -0
- package/lib/module/trust/build-chain.js.map +1 -0
- package/lib/module/trust/errors.js +23 -2
- package/lib/module/trust/errors.js.map +1 -1
- package/lib/module/trust/index.js +5 -262
- package/lib/module/trust/index.js.map +1 -1
- package/lib/module/trust/utils.js +27 -0
- package/lib/module/trust/utils.js.map +1 -1
- package/lib/module/trust/{chain.js → verify-chain.js} +85 -14
- package/lib/module/trust/verify-chain.js.map +1 -0
- package/lib/module/utils/errors.js +1 -1
- package/lib/module/utils/errors.js.map +1 -1
- package/lib/typescript/credential/issuance/02-evaluate-issuer-trust.d.ts.map +1 -1
- package/lib/typescript/credential/presentation/02-evaluate-rp-trust.d.ts.map +1 -1
- package/lib/typescript/credential/presentation/05-verify-request-object.d.ts +1 -1
- package/lib/typescript/credential/presentation/05-verify-request-object.d.ts.map +1 -1
- package/lib/typescript/credential/presentation/08-send-authorization-response.d.ts +2 -2
- package/lib/typescript/credential/presentation/08-send-authorization-response.d.ts.map +1 -1
- package/lib/typescript/credential/status/types.d.ts +6 -6
- package/lib/typescript/sd-jwt/index.d.ts +12 -12
- package/lib/typescript/sd-jwt/types.d.ts +6 -6
- package/lib/typescript/trust/build-chain.d.ts +1284 -0
- package/lib/typescript/trust/build-chain.d.ts.map +1 -0
- package/lib/typescript/trust/errors.d.ts +22 -0
- package/lib/typescript/trust/errors.d.ts.map +1 -1
- package/lib/typescript/trust/index.d.ts +5 -1299
- package/lib/typescript/trust/index.d.ts.map +1 -1
- package/lib/typescript/trust/types.d.ts +54 -54
- package/lib/typescript/trust/utils.d.ts +10 -0
- package/lib/typescript/trust/utils.d.ts.map +1 -1
- package/lib/typescript/trust/verify-chain.d.ts +39 -0
- package/lib/typescript/trust/verify-chain.d.ts.map +1 -0
- package/lib/typescript/utils/errors.d.ts +2 -2
- package/lib/typescript/utils/errors.d.ts.map +1 -1
- package/lib/typescript/wallet-instance-attestation/types.d.ts +21 -21
- package/package.json +2 -2
- package/src/credential/issuance/02-evaluate-issuer-trust.ts +1 -1
- package/src/credential/presentation/02-evaluate-rp-trust.ts +1 -1
- package/src/credential/presentation/05-verify-request-object.ts +1 -1
- package/src/credential/presentation/08-send-authorization-response.ts +4 -4
- package/src/trust/README.md +147 -0
- package/src/trust/build-chain.ts +395 -0
- package/src/trust/errors.ts +32 -1
- package/src/trust/index.ts +5 -435
- package/src/trust/utils.ts +35 -0
- package/src/trust/{chain.ts → verify-chain.ts} +132 -16
- package/src/utils/errors.ts +4 -4
- package/lib/commonjs/trust/chain.js.map +0 -1
- package/lib/module/trust/chain.js.map +0 -1
- package/lib/typescript/trust/chain.d.ts +0 -21
- package/lib/typescript/trust/chain.d.ts.map +0 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["decode","decodeJwt","verify","InvalidRequestObjectError","RequestObject","getJwksFromConfig","verifyRequestObject","requestObjectEncodedJwt","_ref","clientId","rpConf","rpSubject","state","requestObjectJwt","pubKey","getSigPublicKey","protectedHeader","kid","issuer","_","requestObject","validateRequestObjectShape","payload","isClientIdMatch","client_id","isStateMatch","requestObjectParse","safeParse","success","data","formatFlattenedZodErrors","error","flatten","keys","find","k","Error","errors","Object","entries","fieldErrors","map","_ref2","key","join"],"sourceRoot":"../../../../src","sources":["credential/presentation/05-verify-request-object.ts"],"mappings":"AAAA,SAASA,MAAM,IAAIC,SAAS,EAAEC,MAAM,QAAQ,6BAA6B;
|
|
1
|
+
{"version":3,"names":["decode","decodeJwt","verify","InvalidRequestObjectError","RequestObject","getJwksFromConfig","verifyRequestObject","requestObjectEncodedJwt","_ref","clientId","rpConf","rpSubject","state","requestObjectJwt","pubKey","getSigPublicKey","protectedHeader","kid","issuer","_","requestObject","validateRequestObjectShape","payload","isClientIdMatch","client_id","isStateMatch","requestObjectParse","safeParse","success","data","formatFlattenedZodErrors","error","flatten","keys","find","k","Error","errors","Object","entries","fieldErrors","map","_ref2","key","join"],"sourceRoot":"../../../../src","sources":["credential/presentation/05-verify-request-object.ts"],"mappings":"AAAA,SAASA,MAAM,IAAIC,SAAS,EAAEC,MAAM,QAAQ,6BAA6B;AACzE,SAASC,yBAAyB,QAAQ,UAAU;AACpD,SAASC,aAAa,QAAQ,SAAS;AACvC,SAASC,iBAAiB,QAAQ,uBAAuB;AAazD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,mBAAwC,GAAG,MAAAA,CACtDC,uBAAuB,EAAAC,IAAA,KAEpB;EAAA,IADH;IAAEC,QAAQ;IAAEC,MAAM;IAAEC,SAAS;IAAEC;EAAM,CAAC,GAAAJ,IAAA;EAEtC,MAAMK,gBAAgB,GAAGZ,SAAS,CAACM,uBAAuB,CAAC;EAE3D,MAAMO,MAAM,GAAGC,eAAe,CAACL,MAAM,EAAEG,gBAAgB,CAACG,eAAe,CAACC,GAAG,CAAC;EAE5E,IAAI;IACF;IACA,MAAMf,MAAM,CAACK,uBAAuB,EAAEO,MAAM,EAAE;MAAEI,MAAM,EAAET;IAAS,CAAC,CAAC;EACrE,CAAC,CAAC,OAAOU,CAAC,EAAE;IACV,MAAM,IAAIhB,yBAAyB,CACjC,kDACF,CAAC;EACH;EAEA,MAAMiB,aAAa,GAAGC,0BAA0B,CAACR,gBAAgB,CAACS,OAAO,CAAC;EAE1E,MAAMC,eAAe,GACnBd,QAAQ,KAAKW,aAAa,CAACI,SAAS,IAAIf,QAAQ,KAAKE,SAAS;EAEhE,IAAI,CAACY,eAAe,EAAE;IACpB,MAAM,IAAIpB,yBAAyB,CACjC,iEACF,CAAC;EACH;EAEA,MAAMsB,YAAY,GAChBb,KAAK,IAAIQ,aAAa,CAACR,KAAK,GAAGA,KAAK,KAAKQ,aAAa,CAACR,KAAK,GAAG,IAAI;EAErE,IAAI,CAACa,YAAY,EAAE;IACjB,MAAM,IAAItB,yBAAyB,CACjC,wDACF,CAAC;EACH;EAEA,OAAO;IAAEiB;EAAc,CAAC;AAC1B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,0BAA0B,GAAIC,OAAgB,IAAoB;EACtE,MAAMI,kBAAkB,GAAGtB,aAAa,CAACuB,SAAS,CAACL,OAAO,CAAC;EAE3D,IAAII,kBAAkB,CAACE,OAAO,EAAE;IAC9B,OAAOF,kBAAkB,CAACG,IAAI;EAChC;EAEA,MAAM,IAAI1B,yBAAyB,CACjC,kDAAkD,EAClD2B,wBAAwB,CAACJ,kBAAkB,CAACK,KAAK,CAACC,OAAO,CAAC,CAAC,CAC7D,CAAC;AACH,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMjB,eAAe,GAAGA,CACtBL,MAA8D,EAC9DO,GAAuB,KACpB;EACH,IAAI;IACF,MAAM;MAAEgB;IAAK,CAAC,GAAG5B,iBAAiB,CAACK,MAAM,CAAC;IAE1C,MAAMI,MAAM,GAAGmB,IAAI,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAAClB,GAAG,KAAKA,GAAG,CAAC;IAE9C,IAAI,CAACH,MAAM,EAAE,MAAM,IAAIsB,KAAK,CAAC,CAAC;IAE9B,OAAOtB,MAAM;EACf,CAAC,CAAC,OAAOK,CAAC,EAAE;IACV,MAAM,IAAIhB,yBAAyB,CAChC,8CAA6Cc,GAAI,+CACpD,CAAC;EACH;AACF,CAAC;;AAED;AACA;AACA;AACA,MAAMa,wBAAwB,GAC5BO,MAA+C,IAE/CC,MAAM,CAACC,OAAO,CAACF,MAAM,CAACG,WAAW,CAAC,CAC/BC,GAAG,CAACC,KAAA;EAAA,IAAC,CAACC,GAAG,EAAEZ,KAAK,CAAC,GAAAW,KAAA;EAAA,OAAM,GAAEC,GAAI,KAAIZ,KAAK,CAAC,CAAC,CAAE,EAAC;AAAA,EAAC,CAC5Ca,IAAI,CAAC,IAAI,CAAC"}
|
|
@@ -4,7 +4,7 @@ import { getJwksFromConfig } from "./04-retrieve-rp-jwks";
|
|
|
4
4
|
import { NoSuitableKeysFoundInEntityConfiguration } from "./errors";
|
|
5
5
|
import { hasStatusOrThrow } from "../../utils/misc";
|
|
6
6
|
import * as z from "zod";
|
|
7
|
-
import { RelyingPartyResponseError, ResponseErrorBuilder, UnexpectedStatusCodeError
|
|
7
|
+
import { RelyingPartyResponseError, RelyingPartyResponseErrorCodes, ResponseErrorBuilder, UnexpectedStatusCodeError } from "../../utils/errors";
|
|
8
8
|
export const AuthorizationResponse = z.object({
|
|
9
9
|
status: z.string().optional(),
|
|
10
10
|
response_code: z.string() /**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["EncryptJwe","uuid","getJwksFromConfig","NoSuitableKeysFoundInEntityConfiguration","hasStatusOrThrow","z","RelyingPartyResponseError","
|
|
1
|
+
{"version":3,"names":["EncryptJwe","uuid","getJwksFromConfig","NoSuitableKeysFoundInEntityConfiguration","hasStatusOrThrow","z","RelyingPartyResponseError","RelyingPartyResponseErrorCodes","ResponseErrorBuilder","UnexpectedStatusCodeError","AuthorizationResponse","object","status","string","optional","response_code","redirect_uri","choosePublicKeyToEncrypt","rpJwkKeys","encKey","find","jwk","use","buildDirectPostJwtBody","requestObject","rpConf","payload","authzResponsePayload","JSON","stringify","state","keys","encPublicJwk","authorization_encrypted_response_alg","authorization_encrypted_response_enc","openid_credential_verifier","defaultAlg","kty","encryptedResponse","alg","enc","kid","encrypt","formBody","URLSearchParams","response","toString","buildDirectPostBody","formUrlEncodedBody","Object","entries","reduce","acc","_ref","key","value","Array","isArray","sendLegacyAuthorizationResponse","presentationDefinitionId","remotePresentations","_remotePresentations$","appFetch","fetch","arguments","length","undefined","vp_token","vpToken","map","remotePresentation","descriptor_map","index","id","inputDescriptor","path","format","presentation_submission","v4","definition_id","requestBody","response_uri","method","headers","body","then","res","json","parse","sendAuthorizationResponse","presentation","credentialId","catch","handleAuthorizationResponseError","sendAuthorizationErrorResponse","_ref2","error","errorDescription","error_description","e","handle","code","InvalidAuthorizationResponse","message","RelyingPartyGenericError","buildFrom"],"sourceRoot":"../../../../src","sources":["credential/presentation/08-send-authorization-response.ts"],"mappings":"AAAA,SAASA,UAAU,QAAQ,6BAA6B;AACxD,OAAOC,IAAI,MAAM,mBAAmB;AACpC,SAAyBC,iBAAiB,QAAQ,uBAAuB;AAEzE,SAASC,wCAAwC,QAAQ,UAAU;AACnE,SAASC,gBAAgB,QAAkB,kBAAkB;AAO7D,OAAO,KAAKC,CAAC,MAAM,KAAK;AAExB,SACEC,yBAAyB,EACzBC,8BAA8B,EAC9BC,oBAAoB,EACpBC,yBAAyB,QACpB,oBAAoB;AAI3B,OAAO,MAAMC,qBAAqB,GAAGL,CAAC,CAACM,MAAM,CAAC;EAC5CC,MAAM,EAAEP,CAAC,CAACQ,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC7BC,aAAa,EAAEV,CAAC,CACbQ,MAAM,CAAC,CAAC,CAAC;AACd;AACA;AACA;AACA,8BAJc,CAKTC,QAAQ,CAAC,CAAC;EACbE,YAAY,EAAEX,CAAC,CAACQ,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC;AACpC,CAAC,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMG,wBAAwB,GACnCC,SAAiC,IACzB;EACR,MAAMC,MAAM,GAAGD,SAAS,CAACE,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,GAAG,KAAK,KAAK,CAAC;EAEzD,IAAIH,MAAM,EAAE;IACV,OAAOA,MAAM;EACf;;EAEA;EACA,MAAM,IAAIhB,wCAAwC,CAChD,8CACF,CAAC;AACH,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMoB,sBAAsB,GAAG,MAAAA,CACpCC,aAAwD,EACxDC,MAA8D,EAC9DC,OAAuC,KACnB;EAGpB;EACA,MAAMC,oBAAoB,GAAGC,IAAI,CAACC,SAAS,CAAC;IAC1CC,KAAK,EAAEN,aAAa,CAACM,KAAK;IAC1B,GAAGJ;EACL,CAAC,CAAC;EACF;EACA,MAAM;IAAEK;EAAK,CAAC,GAAG7B,iBAAiB,CAACuB,MAAM,CAAC;EAC1C,MAAMO,YAAY,GAAGf,wBAAwB,CAACc,IAAI,CAAC;;EAEnD;EACA,MAAM;IACJE,oCAAoC;IACpCC;EACF,CAAC,GAAGT,MAAM,CAACU,0BAA0B;EAErC,MAAMC,UAAsB,GAC1BJ,YAAY,CAACK,GAAG,KAAK,IAAI,GAAG,SAAS,GAAG,cAAc;EAExD,MAAMC,iBAAiB,GAAG,MAAM,IAAItC,UAAU,CAAC2B,oBAAoB,EAAE;IACnEY,GAAG,EAAGN,oCAAoC,IAAmBG,UAAU;IACvEI,GAAG,EACAN,oCAAoC,IAAmB,eAAe;IACzEO,GAAG,EAAET,YAAY,CAACS;EACpB,CAAC,CAAC,CAACC,OAAO,CAACV,YAAY,CAAC;;EAExB;EACA,MAAMW,QAAQ,GAAG,IAAIC,eAAe,CAAC;IACnCC,QAAQ,EAAEP,iBAAiB;IAC3B,IAAId,aAAa,CAACM,KAAK,GAAG;MAAEA,KAAK,EAAEN,aAAa,CAACM;IAAM,CAAC,GAAG,CAAC,CAAC;EAC/D,CAAC,CAAC;EACF,OAAOa,QAAQ,CAACG,QAAQ,CAAC,CAAC;AAC5B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,mBAAmB,GAAG,MAAAA,CACjCvB,aAAwD,EACxDE,OAAuC,KACnB;EACpB,MAAMsB,kBAAkB,GAAG,IAAIJ,eAAe,CAAC;IAC7C,IAAIpB,aAAa,CAACM,KAAK,IAAI;MAAEA,KAAK,EAAEN,aAAa,CAACM;IAAM,CAAC,CAAC;IAC1D,GAAGmB,MAAM,CAACC,OAAO,CAACxB,OAAO,CAAC,CAACyB,MAAM,CAC/B,CAACC,GAAG,EAAAC,IAAA;MAAA,IAAE,CAACC,GAAG,EAAEC,KAAK,CAAC,GAAAF,IAAA;MAAA,OAAM;QACtB,GAAGD,GAAG;QACN,CAACE,GAAG,GACFE,KAAK,CAACC,OAAO,CAACF,KAAK,CAAC,IAAI,OAAOA,KAAK,KAAK,QAAQ,GAC7C3B,IAAI,CAACC,SAAS,CAAC0B,KAAK,CAAC,GACrBA;MACR,CAAC;IAAA,CAAC,EACF,CAAC,CACH;EACF,CAAC,CAAC;EAEF,OAAOP,kBAAkB,CAACF,QAAQ,CAAC,CAAC;AACtC,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;;AAWA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMY,+BAAgE,GAC3E,eAAAA,CACElC,aAAa,EACbmC,wBAAwB,EACxBC,mBAAmB,EACnBnC,MAAM,EAE6B;EAAA,IAAAoC,qBAAA;EAAA,IADnC;IAAEC,QAAQ,GAAGC;EAAM,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEzB;AACJ;AACA;AACA;AACA;EACI,MAAMG,QAAQ,GACZ,CAAAP,mBAAmB,aAAnBA,mBAAmB,uBAAnBA,mBAAmB,CAAEK,MAAM,MAAK,CAAC,IAAAJ,qBAAA,GAC7BD,mBAAmB,CAAC,CAAC,CAAC,cAAAC,qBAAA,uBAAtBA,qBAAA,CAAwBO,OAAO,GAC/BR,mBAAmB,CAACS,GAAG,CACpBC,kBAAkB,IAAKA,kBAAkB,CAACF,OAC7C,CAAC;EAEP,MAAMG,cAAc,GAAGX,mBAAmB,CAACS,GAAG,CAC5C,CAACC,kBAAkB,EAAEE,KAAK,MAAM;IAC9BC,EAAE,EAAEH,kBAAkB,CAACI,eAAe,CAACD,EAAE;IACzCE,IAAI,EAAEf,mBAAmB,CAACK,MAAM,KAAK,CAAC,GAAI,GAAE,GAAI,KAAIO,KAAM,GAAE;IAC5DI,MAAM,EAAEN,kBAAkB,CAACM;EAC7B,CAAC,CACH,CAAC;EAED,MAAMC,uBAAuB,GAAG;IAC9BJ,EAAE,EAAExE,IAAI,CAAC6E,EAAE,CAAC,CAAC;IACbC,aAAa,EAAEpB,wBAAwB;IACvCY;EACF,CAAC;EAED,MAAMS,WAAW,GAAG,MAAMzD,sBAAsB,CAACC,aAAa,EAAEC,MAAM,EAAE;IACtE0C,QAAQ;IACRU;EACF,CAAC,CAAC;;EAEF;EACA,OAAO,MAAMf,QAAQ,CAACtC,aAAa,CAACyD,YAAY,EAAE;IAChDC,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE;IAClB,CAAC;IACDC,IAAI,EAAEJ;EACR,CAAC,CAAC,CACCK,IAAI,CAACjF,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3BiF,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBF,IAAI,CAAC3E,qBAAqB,CAAC8E,KAAK,CAAC;AACtC,CAAC;;AAEH;AACA;AACA;AACA;AACA;;AAUA,OAAO,MAAMC,yBAAoD,GAAG,eAAAA,CAClEjE,aAAa,EACboC,mBAAmB,EACnBnC,MAAM,EAE6B;EAAA,IADnC;IAAEqC,QAAQ,GAAGC;EAAM,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEzB;EACA,MAAMgB,WAAW,GAAG,MAAMzD,sBAAsB,CAACC,aAAa,EAAEC,MAAM,EAAE;IACtE0C,QAAQ,EAAEP,mBAAmB,CAACT,MAAM,CAClC,CAACC,GAAG,EAAEsC,YAAY,MAAM;MACtB,GAAGtC,GAAG;MACN,CAACsC,YAAY,CAACC,YAAY,GAAGD,YAAY,CAACtB;IAC5C,CAAC,CAAC,EACF,CAAC,CACH;EACF,CAAC,CAAC;;EAEF;EACA,OAAO,MAAMN,QAAQ,CAACtC,aAAa,CAACyD,YAAY,EAAE;IAChDC,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE;IAClB,CAAC;IACDC,IAAI,EAAEJ;EACR,CAAC,CAAC,CACCK,IAAI,CAACjF,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3BiF,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBF,IAAI,CAAC3E,qBAAqB,CAAC8E,KAAK,CAAC,CACjCI,KAAK,CAACC,gCAAgC,CAAC;AAC5C,CAAC;;AAED;AACA;AACA;AACA;;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,8BAA8D,GACzE,eAAAA,CACEtE,aAAa,EAAAuE,KAAA,EAGsB;EAAA,IAFnC;IAAEC,KAAK;IAAEC;EAAiB,CAAC,GAAAF,KAAA;EAAA,IAC3B;IAAEjC,QAAQ,GAAGC;EAAM,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEzB,MAAMgB,WAAW,GAAG,MAAMjC,mBAAmB,CAACvB,aAAa,EAAE;IAC3DwE,KAAK;IACLE,iBAAiB,EAAED;EACrB,CAAC,CAAC;EAEF,OAAO,MAAMnC,QAAQ,CAACtC,aAAa,CAACyD,YAAY,EAAE;IAChDC,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE;IAClB,CAAC;IACDC,IAAI,EAAEJ;EACR,CAAC,CAAC,CACCK,IAAI,CAACjF,gBAAgB,CAAC,GAAG,EAAEE,yBAAyB,CAAC,CAAC,CACtD+E,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBF,IAAI,CAAC3E,qBAAqB,CAAC8E,KAAK,CAAC;AACtC,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA,MAAMK,gCAAgC,GAAIM,CAAU,IAAK;EACvD,IAAI,EAAEA,CAAC,YAAY1F,yBAAyB,CAAC,EAAE;IAC7C,MAAM0F,CAAC;EACT;EAEA,MAAM,IAAI3F,oBAAoB,CAACF,yBAAyB,CAAC,CACtD8F,MAAM,CAAC,GAAG,EAAE;IACXC,IAAI,EAAE9F,8BAA8B,CAAC+F,4BAA4B;IACjEC,OAAO,EACL;EACJ,CAAC,CAAC,CACDH,MAAM,CAAC,GAAG,EAAE;IACXC,IAAI,EAAE9F,8BAA8B,CAAC+F,4BAA4B;IACjEC,OAAO,EAAE;EACX,CAAC,CAAC,CACDH,MAAM,CAAC,GAAG,EAAE;IACXC,IAAI,EAAE9F,8BAA8B,CAACiG,wBAAwB;IAC7DD,OAAO,EAAE;EACX,CAAC,CAAC,CACDE,SAAS,CAACN,CAAC,CAAC;AACjB,CAAC"}
|
|
@@ -0,0 +1,147 @@
|
|
|
1
|
+
# Trust Chain Validation
|
|
2
|
+
|
|
3
|
+
This module implements **Trust Chain validation** for Entity Configurations and Entity Statements in line with the [IT Wallet Federation Specifications](https://italia.github.io/eid-wallet-it-docs/). It ensures that an entity's metadata is trusted by validating a chain of signed JWTs up to a known Trust Anchor.
|
|
4
|
+
|
|
5
|
+
The validation covers:
|
|
6
|
+
|
|
7
|
+
* JWT signature verification (using the next entity's JWKS)
|
|
8
|
+
* Trust chain ordering (leaf → parent → Trust Anchor)
|
|
9
|
+
* Optional X.509 CRL-based certificate validation
|
|
10
|
+
|
|
11
|
+
## Sequence Diagram
|
|
12
|
+
|
|
13
|
+
```mermaid
|
|
14
|
+
sequenceDiagram
|
|
15
|
+
autonumber
|
|
16
|
+
participant A as Leaf Entity
|
|
17
|
+
participant B as Intermediate (Federation Authority)
|
|
18
|
+
participant C as Trust Anchor
|
|
19
|
+
|
|
20
|
+
A->>A: Self-issued Entity Configuration (JWT)
|
|
21
|
+
B->>A: Signed Entity Statement (JWT)
|
|
22
|
+
C->>B: Signed Entity Statement (JWT or self-issued EC)
|
|
23
|
+
|
|
24
|
+
Note over A,C: Each JWT is validated with the next issuer's public keys
|
|
25
|
+
```
|
|
26
|
+
|
|
27
|
+
## Errors
|
|
28
|
+
|
|
29
|
+
| Error | Description |
|
|
30
|
+
| ----------------------------- | ------------------------------------------------------------------ |
|
|
31
|
+
| `TrustChainEmptyError` | The input chain is empty. |
|
|
32
|
+
| `TrustChainTokenMissingError` | One of the JWTs in the chain is missing. |
|
|
33
|
+
| `X509ValidationError` | X.509 certificate validation failed (e.g. revocation, expiration). |
|
|
34
|
+
| `FederationError` | Generic federation processing error. |
|
|
35
|
+
|
|
36
|
+
## Usage
|
|
37
|
+
|
|
38
|
+
### Validate a trust chain
|
|
39
|
+
|
|
40
|
+
```ts
|
|
41
|
+
import { validateTrustChain } from "./trust";
|
|
42
|
+
import { trustAnchorEntityConfiguration } from "./your-data";
|
|
43
|
+
import { chain } from "./your-data"; // array of JWTs, starting from leaf
|
|
44
|
+
|
|
45
|
+
const result = await validateTrustChain(trustAnchorEntityConfiguration, chain, {
|
|
46
|
+
connectTimeout: 3000,
|
|
47
|
+
readTimeout: 3000,
|
|
48
|
+
requireCrl: false,
|
|
49
|
+
});
|
|
50
|
+
```
|
|
51
|
+
|
|
52
|
+
* The `chain` must be an array of signed JWT strings.
|
|
53
|
+
* The first JWT must be a self-issued `EntityConfiguration`.
|
|
54
|
+
* The last JWT must be an `EntityStatement` or a self-issued Trust Anchor `EntityConfiguration`.
|
|
55
|
+
|
|
56
|
+
### Renew a trust chain
|
|
57
|
+
|
|
58
|
+
```ts
|
|
59
|
+
import { renewTrustChain } from "./trust";
|
|
60
|
+
|
|
61
|
+
const newChain = await renewTrustChain(chain);
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
This will fetch updated JWTs from each authority in the chain.
|
|
65
|
+
|
|
66
|
+
### Build a trust chain
|
|
67
|
+
|
|
68
|
+
```ts
|
|
69
|
+
import { buildTrustChain } from "./trust";
|
|
70
|
+
|
|
71
|
+
const chain = await buildTrustChain({
|
|
72
|
+
leaf: "https://example-leaf",
|
|
73
|
+
trustAnchor: trustAnchorEntityConfiguration,
|
|
74
|
+
});
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
* **leaf**: the entity URL of the subject to be trusted.
|
|
78
|
+
* **trustAnchor**: the known trust anchor configuration.
|
|
79
|
+
* Returns a list of JWT strings ordered from leaf to trust anchor.
|
|
80
|
+
|
|
81
|
+
|
|
82
|
+
## Trust Chain Structure
|
|
83
|
+
|
|
84
|
+
| Position | JWT Type | Requirements |
|
|
85
|
+
| -------- | ----------------------------------- |-------------------------------|
|
|
86
|
+
| First | Entity Configuration | `iss === sub` (self-issued) |
|
|
87
|
+
| Middle | Entity Statement | `iss ≠ sub`, signed by parent |
|
|
88
|
+
| Last | Entity Statement or Trust Anchor EC | Trust Anchor must be known |
|
|
89
|
+
|
|
90
|
+
### Build and Validate Example
|
|
91
|
+
|
|
92
|
+
```ts
|
|
93
|
+
import {
|
|
94
|
+
buildTrustChain,
|
|
95
|
+
validateTrustChain,
|
|
96
|
+
} from "./trust";
|
|
97
|
+
import { trustAnchorEntityConfiguration } from "./your-data";
|
|
98
|
+
|
|
99
|
+
const chain = await buildTrustChain({
|
|
100
|
+
leaf: "https://example-leaf",
|
|
101
|
+
trustAnchor: trustAnchorEntityConfiguration,
|
|
102
|
+
});
|
|
103
|
+
|
|
104
|
+
const result = await validateTrustChain(trustAnchorEntityConfiguration, chain, {
|
|
105
|
+
connectTimeout: 3000,
|
|
106
|
+
readTimeout: 3000,
|
|
107
|
+
requireCrl: true,
|
|
108
|
+
});
|
|
109
|
+
```
|
|
110
|
+
|
|
111
|
+
* This example fetches and builds the full trust chain dynamically, then validates it end-to-end.
|
|
112
|
+
|
|
113
|
+
## Example Trust Chain
|
|
114
|
+
|
|
115
|
+
```ts
|
|
116
|
+
[
|
|
117
|
+
{
|
|
118
|
+
header: { alg: "ES256", kid: "leaf-kid" },
|
|
119
|
+
payload: { iss: "https://leaf", sub: "https://leaf", jwks: { keys: [...] } }
|
|
120
|
+
},
|
|
121
|
+
{
|
|
122
|
+
header: { alg: "ES256", kid: "intermediate-kid" },
|
|
123
|
+
payload: { iss: "https://intermediate", sub: "https://leaf", jwks: { keys: [...] } }
|
|
124
|
+
},
|
|
125
|
+
{
|
|
126
|
+
header: { alg: "ES256", kid: "ta-kid" },
|
|
127
|
+
payload: { iss: "https://ta", sub: "https://ta", jwks: { keys: [...] } }
|
|
128
|
+
}
|
|
129
|
+
]
|
|
130
|
+
```
|
|
131
|
+
|
|
132
|
+
## Mocking in Tests
|
|
133
|
+
|
|
134
|
+
If you're testing in Node (not in React Native), you need to mock X.509 and crypto-native dependencies:
|
|
135
|
+
|
|
136
|
+
```ts
|
|
137
|
+
jest.mock("@pagopa/io-react-native-crypto", () => ({
|
|
138
|
+
verifyCertificateChain: jest.fn().mockResolvedValue({
|
|
139
|
+
isValid: true,
|
|
140
|
+
validationStatus: "VALID",
|
|
141
|
+
errorMessage: undefined,
|
|
142
|
+
}),
|
|
143
|
+
generate: jest.fn().mockResolvedValue({ ... }),
|
|
144
|
+
}));
|
|
145
|
+
```
|
|
146
|
+
|
|
147
|
+
Ensure mocked `JWK`s contain an `x5c` array to trigger certificate validation logic during tests.
|
|
@@ -0,0 +1,235 @@
|
|
|
1
|
+
import { BuildTrustChainError, FederationListParseError, MissingFederationFetchEndpointError, RelyingPartyNotAuthorizedError, TrustAnchorKidMissingError } from "./errors";
|
|
2
|
+
import { decode, verify } from "./utils";
|
|
3
|
+
import { CredentialIssuerEntityConfiguration, EntityConfiguration, EntityStatement, FederationListResponse, RelyingPartyEntityConfiguration, TrustAnchorEntityConfiguration, WalletProviderEntityConfiguration } from "./types";
|
|
4
|
+
import { hasStatusOrThrow } from "../utils/misc";
|
|
5
|
+
import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
|
|
6
|
+
|
|
7
|
+
/**
|
|
8
|
+
* Fetch and parse the entity configuration document for a given federation entity.
|
|
9
|
+
* This is an inner method to serve public interfaces.
|
|
10
|
+
*
|
|
11
|
+
* To add another entity configuration type (example: Foo entity type):
|
|
12
|
+
* - create its zod schema and type by inherit from the base type (example: FooEntityConfiguration = BaseEntityConfiguration.and(...))
|
|
13
|
+
* - add such type to EntityConfiguration union
|
|
14
|
+
* - add an overload to this function
|
|
15
|
+
* - create a public function which use such type (example: getFooEntityConfiguration = (url, options) => Promise<FooEntityConfiguration>)
|
|
16
|
+
*
|
|
17
|
+
* @param entityBaseUrl The base url of the entity.
|
|
18
|
+
* @param schema The expected schema of the entity configuration, according to the kind of entity we are fetching from.
|
|
19
|
+
* @param options An optional object with additional options.
|
|
20
|
+
* @param options.appFetch An optional instance of the http client to be used.
|
|
21
|
+
* @returns The parsed entity configuration object
|
|
22
|
+
* @throws {IoWalletError} If the http request fails
|
|
23
|
+
* @throws Parse error if the document is not in the expected shape.
|
|
24
|
+
*/
|
|
25
|
+
|
|
26
|
+
async function fetchAndParseEntityConfiguration(entityBaseUrl, schema) {
|
|
27
|
+
let {
|
|
28
|
+
appFetch = fetch
|
|
29
|
+
} = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
|
|
30
|
+
const responseText = await getSignedEntityConfiguration(entityBaseUrl, {
|
|
31
|
+
appFetch
|
|
32
|
+
});
|
|
33
|
+
const responseJwt = decodeJwt(responseText);
|
|
34
|
+
return schema.parse({
|
|
35
|
+
header: responseJwt.protectedHeader,
|
|
36
|
+
payload: responseJwt.payload
|
|
37
|
+
});
|
|
38
|
+
}
|
|
39
|
+
export const getWalletProviderEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, WalletProviderEntityConfiguration, options);
|
|
40
|
+
export const getCredentialIssuerEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, CredentialIssuerEntityConfiguration, options);
|
|
41
|
+
export const getTrustAnchorEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, TrustAnchorEntityConfiguration, options);
|
|
42
|
+
export const getRelyingPartyEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, RelyingPartyEntityConfiguration, options);
|
|
43
|
+
export const getEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, EntityConfiguration, options);
|
|
44
|
+
|
|
45
|
+
/**
|
|
46
|
+
* Fetch and parse the entity statement document for a given federation entity.
|
|
47
|
+
*
|
|
48
|
+
* @param accreditationBodyBaseUrl The base url of the accreditation body which holds and signs the required entity statement
|
|
49
|
+
* @param subordinatedEntityBaseUrl The url that identifies the subordinate entity
|
|
50
|
+
* @param appFetch An optional instance of the http client to be used.
|
|
51
|
+
* @returns The parsed entity configuration object
|
|
52
|
+
* @throws {IoWalletError} If the http request fails
|
|
53
|
+
*/
|
|
54
|
+
export async function getEntityStatement(accreditationBodyBaseUrl, subordinatedEntityBaseUrl) {
|
|
55
|
+
let {
|
|
56
|
+
appFetch = fetch
|
|
57
|
+
} = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
|
|
58
|
+
const responseText = await getSignedEntityStatement(accreditationBodyBaseUrl, subordinatedEntityBaseUrl, {
|
|
59
|
+
appFetch
|
|
60
|
+
});
|
|
61
|
+
const responseJwt = decodeJwt(responseText);
|
|
62
|
+
return EntityStatement.parse({
|
|
63
|
+
header: responseJwt.protectedHeader,
|
|
64
|
+
payload: responseJwt.payload
|
|
65
|
+
});
|
|
66
|
+
}
|
|
67
|
+
|
|
68
|
+
/**
|
|
69
|
+
* Fetch the signed entity configuration token for an entity
|
|
70
|
+
*
|
|
71
|
+
* @param entityBaseUrl The url of the entity to fetch
|
|
72
|
+
* @param appFetch (optional) fetch api implementation
|
|
73
|
+
* @returns The signed Entity Configuration token
|
|
74
|
+
*/
|
|
75
|
+
export async function getSignedEntityConfiguration(entityBaseUrl) {
|
|
76
|
+
let {
|
|
77
|
+
appFetch = fetch
|
|
78
|
+
} = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
|
|
79
|
+
const wellKnownUrl = `${entityBaseUrl}/.well-known/openid-federation`;
|
|
80
|
+
return await appFetch(wellKnownUrl, {
|
|
81
|
+
method: "GET"
|
|
82
|
+
}).then(hasStatusOrThrow(200)).then(res => res.text());
|
|
83
|
+
}
|
|
84
|
+
|
|
85
|
+
/**
|
|
86
|
+
* Fetch the entity statement document for a given federation entity.
|
|
87
|
+
*
|
|
88
|
+
* @param federationFetchEndpoint The exact endpoint provided by the parent EC's metadata.
|
|
89
|
+
* @param subordinatedEntityBaseUrl The url that identifies the subordinate entity.
|
|
90
|
+
* @param appFetch An optional instance of the http client to be used.
|
|
91
|
+
* @returns The signed entity statement token.
|
|
92
|
+
* @throws {IoWalletError} If the http request fails.
|
|
93
|
+
*/
|
|
94
|
+
export async function getSignedEntityStatement(federationFetchEndpoint, subordinatedEntityBaseUrl) {
|
|
95
|
+
let {
|
|
96
|
+
appFetch = fetch
|
|
97
|
+
} = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
|
|
98
|
+
const url = new URL(federationFetchEndpoint);
|
|
99
|
+
url.searchParams.set("sub", subordinatedEntityBaseUrl);
|
|
100
|
+
return await appFetch(url.toString(), {
|
|
101
|
+
method: "GET"
|
|
102
|
+
}).then(hasStatusOrThrow(200)).then(res => res.text());
|
|
103
|
+
}
|
|
104
|
+
|
|
105
|
+
/**
|
|
106
|
+
* Fetch the federation list document from a given endpoint.
|
|
107
|
+
*
|
|
108
|
+
* @param federationListEndpoint The URL of the federation list endpoint.
|
|
109
|
+
* @param appFetch An optional instance of the http client to be used.
|
|
110
|
+
* @returns The federation list as an array of strings.
|
|
111
|
+
* @throws {IoWalletError} If the HTTP request fails.
|
|
112
|
+
* @throws {FederationError} If the result is not in the expected format.
|
|
113
|
+
*/
|
|
114
|
+
export async function getFederationList(federationListEndpoint) {
|
|
115
|
+
let {
|
|
116
|
+
appFetch = fetch
|
|
117
|
+
} = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
|
|
118
|
+
return await appFetch(federationListEndpoint, {
|
|
119
|
+
method: "GET"
|
|
120
|
+
}).then(hasStatusOrThrow(200)).then(res => res.json()).then(json => {
|
|
121
|
+
const result = FederationListResponse.safeParse(json);
|
|
122
|
+
if (!result.success) {
|
|
123
|
+
throw new FederationListParseError(`Invalid federation list format received from ${federationListEndpoint}. Error: ${result.error.message}`, {
|
|
124
|
+
url: federationListEndpoint,
|
|
125
|
+
parseError: result.error.toString()
|
|
126
|
+
});
|
|
127
|
+
}
|
|
128
|
+
return result.data;
|
|
129
|
+
});
|
|
130
|
+
}
|
|
131
|
+
|
|
132
|
+
/**
|
|
133
|
+
* Build a not-verified trust chain for a given Relying Party (RP) entity.
|
|
134
|
+
*
|
|
135
|
+
* @param relyingPartyEntityBaseUrl The base URL of the RP entity
|
|
136
|
+
* @param trustAnchorKey The public key of the Trust Anchor (TA) entity
|
|
137
|
+
* @param appFetch An optional instance of the http client to be used.
|
|
138
|
+
* @returns A list of signed tokens that represent the trust chain, in the order of the chain (from the RP to the Trust Anchor)
|
|
139
|
+
* @throws {FederationError} When an element of the chain fails to parse or other build steps fail.
|
|
140
|
+
*/
|
|
141
|
+
export async function buildTrustChain(relyingPartyEntityBaseUrl, trustAnchorKey) {
|
|
142
|
+
let appFetch = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : fetch;
|
|
143
|
+
// 1: Recursively gather the trust chain from the RP up to the Trust Anchor
|
|
144
|
+
const trustChain = await gatherTrustChain(relyingPartyEntityBaseUrl, appFetch);
|
|
145
|
+
|
|
146
|
+
// 2: Trust Anchor signature verification
|
|
147
|
+
const trustAnchorJwt = trustChain[trustChain.length - 1];
|
|
148
|
+
if (!trustAnchorJwt) {
|
|
149
|
+
throw new BuildTrustChainError("Cannot verify trust anchor: missing entity configuration in gathered chain.", {
|
|
150
|
+
relyingPartyUrl: relyingPartyEntityBaseUrl
|
|
151
|
+
});
|
|
152
|
+
}
|
|
153
|
+
if (!trustAnchorKey.kid) {
|
|
154
|
+
throw new TrustAnchorKidMissingError();
|
|
155
|
+
}
|
|
156
|
+
await verify(trustAnchorJwt, trustAnchorKey.kid, [trustAnchorKey]);
|
|
157
|
+
|
|
158
|
+
// 3: Check the federation list
|
|
159
|
+
const trustAnchorConfig = EntityConfiguration.parse(decode(trustAnchorJwt));
|
|
160
|
+
const federationListEndpoint = trustAnchorConfig.payload.metadata.federation_entity.federation_list_endpoint;
|
|
161
|
+
if (federationListEndpoint) {
|
|
162
|
+
const federationList = await getFederationList(federationListEndpoint, {
|
|
163
|
+
appFetch
|
|
164
|
+
});
|
|
165
|
+
if (!federationList.includes(relyingPartyEntityBaseUrl)) {
|
|
166
|
+
throw new RelyingPartyNotAuthorizedError("Relying Party entity base URL is not authorized by the Trust Anchor's federation list.", {
|
|
167
|
+
relyingPartyUrl: relyingPartyEntityBaseUrl,
|
|
168
|
+
federationListEndpoint
|
|
169
|
+
});
|
|
170
|
+
}
|
|
171
|
+
}
|
|
172
|
+
return trustChain;
|
|
173
|
+
}
|
|
174
|
+
|
|
175
|
+
/**
|
|
176
|
+
* Recursively gather the trust chain for an entity and all its superiors.
|
|
177
|
+
* @param entityBaseUrl The base URL of the entity for which to gather the chain.
|
|
178
|
+
* @param appFetch An optional instance of the http client to be used.
|
|
179
|
+
* @param isLeaf Whether the current entity is the leaf of the chain.
|
|
180
|
+
* @returns A full ordered list of JWTs (ECs and ESs) forming the trust chain.
|
|
181
|
+
* @throws {FederationError} If any of the fetched documents fail to parse or other errors occur during the gathering process.
|
|
182
|
+
*/
|
|
183
|
+
async function gatherTrustChain(entityBaseUrl, appFetch) {
|
|
184
|
+
let isLeaf = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : true;
|
|
185
|
+
const chain = [];
|
|
186
|
+
|
|
187
|
+
// Fetch self-signed EC (only needed for the leaf)
|
|
188
|
+
const entityECJwt = await getSignedEntityConfiguration(entityBaseUrl, {
|
|
189
|
+
appFetch
|
|
190
|
+
});
|
|
191
|
+
const entityEC = EntityConfiguration.parse(decode(entityECJwt));
|
|
192
|
+
if (isLeaf) {
|
|
193
|
+
// Only push EC for the leaf
|
|
194
|
+
chain.push(entityECJwt);
|
|
195
|
+
}
|
|
196
|
+
|
|
197
|
+
// Find authority_hints (parent, if any)
|
|
198
|
+
const authorityHints = entityEC.payload.authority_hints ?? [];
|
|
199
|
+
if (authorityHints.length === 0) {
|
|
200
|
+
// This is the Trust Anchor (no parent)
|
|
201
|
+
if (!isLeaf) {
|
|
202
|
+
chain.push(entityECJwt);
|
|
203
|
+
}
|
|
204
|
+
return chain;
|
|
205
|
+
}
|
|
206
|
+
const parentEntityBaseUrl = authorityHints[0];
|
|
207
|
+
|
|
208
|
+
// Fetch parent EC
|
|
209
|
+
const parentECJwt = await getSignedEntityConfiguration(parentEntityBaseUrl, {
|
|
210
|
+
appFetch
|
|
211
|
+
});
|
|
212
|
+
const parentEC = EntityConfiguration.parse(decode(parentECJwt));
|
|
213
|
+
|
|
214
|
+
// Fetch ES
|
|
215
|
+
const federationFetchEndpoint = parentEC.payload.metadata.federation_entity.federation_fetch_endpoint;
|
|
216
|
+
if (!federationFetchEndpoint) {
|
|
217
|
+
throw new MissingFederationFetchEndpointError(`Missing federation_fetch_endpoint in parent's (${parentEntityBaseUrl}) configuration when gathering chain for ${entityBaseUrl}.`, {
|
|
218
|
+
entityBaseUrl,
|
|
219
|
+
missingInEntityUrl: parentEntityBaseUrl
|
|
220
|
+
});
|
|
221
|
+
}
|
|
222
|
+
const entityStatementJwt = await getSignedEntityStatement(federationFetchEndpoint, entityBaseUrl, {
|
|
223
|
+
appFetch
|
|
224
|
+
});
|
|
225
|
+
// Validate the ES
|
|
226
|
+
EntityStatement.parse(decode(entityStatementJwt));
|
|
227
|
+
|
|
228
|
+
// Push this ES into the chain
|
|
229
|
+
chain.push(entityStatementJwt);
|
|
230
|
+
|
|
231
|
+
// Recurse into the parent
|
|
232
|
+
const parentChain = await gatherTrustChain(parentEntityBaseUrl, appFetch, false);
|
|
233
|
+
return chain.concat(parentChain);
|
|
234
|
+
}
|
|
235
|
+
//# sourceMappingURL=build-chain.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"names":["BuildTrustChainError","FederationListParseError","MissingFederationFetchEndpointError","RelyingPartyNotAuthorizedError","TrustAnchorKidMissingError","decode","verify","CredentialIssuerEntityConfiguration","EntityConfiguration","EntityStatement","FederationListResponse","RelyingPartyEntityConfiguration","TrustAnchorEntityConfiguration","WalletProviderEntityConfiguration","hasStatusOrThrow","decodeJwt","fetchAndParseEntityConfiguration","entityBaseUrl","schema","appFetch","fetch","arguments","length","undefined","responseText","getSignedEntityConfiguration","responseJwt","parse","header","protectedHeader","payload","getWalletProviderEntityConfiguration","options","getCredentialIssuerEntityConfiguration","getTrustAnchorEntityConfiguration","getRelyingPartyEntityConfiguration","getEntityConfiguration","getEntityStatement","accreditationBodyBaseUrl","subordinatedEntityBaseUrl","getSignedEntityStatement","wellKnownUrl","method","then","res","text","federationFetchEndpoint","url","URL","searchParams","set","toString","getFederationList","federationListEndpoint","json","result","safeParse","success","error","message","parseError","data","buildTrustChain","relyingPartyEntityBaseUrl","trustAnchorKey","trustChain","gatherTrustChain","trustAnchorJwt","relyingPartyUrl","kid","trustAnchorConfig","metadata","federation_entity","federation_list_endpoint","federationList","includes","isLeaf","chain","entityECJwt","entityEC","push","authorityHints","authority_hints","parentEntityBaseUrl","parentECJwt","parentEC","federation_fetch_endpoint","missingInEntityUrl","entityStatementJwt","parentChain","concat"],"sourceRoot":"../../../src","sources":["trust/build-chain.ts"],"mappings":"AACA,SACEA,oBAAoB,EACpBC,wBAAwB,EACxBC,mCAAmC,EACnCC,8BAA8B,EAC9BC,0BAA0B,QACrB,UAAU;AACjB,SAASC,MAAM,EAAEC,MAAM,QAAQ,SAAS;AACxC,SACEC,mCAAmC,EACnCC,mBAAmB,EACnBC,eAAe,EACfC,sBAAsB,EACtBC,+BAA+B,EAC/BC,8BAA8B,EAC9BC,iCAAiC,QAC5B,SAAS;AAChB,SAASC,gBAAgB,QAAQ,eAAe;AAChD,SAAST,MAAM,IAAIU,SAAS,QAAQ,6BAA6B;;AAEjE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoCA,eAAeC,gCAAgCA,CAC7CC,aAAqB,EACrBC,MAK8B,EAM9B;EAAA,IALA;IACEC,QAAQ,GAAGC;EAGb,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMG,YAAY,GAAG,MAAMC,4BAA4B,CAACR,aAAa,EAAE;IACrEE;EACF,CAAC,CAAC;EAEF,MAAMO,WAAW,GAAGX,SAAS,CAACS,YAAY,CAAC;EAC3C,OAAON,MAAM,CAACS,KAAK,CAAC;IAClBC,MAAM,EAAEF,WAAW,CAACG,eAAe;IACnCC,OAAO,EAAEJ,WAAW,CAACI;EACvB,CAAC,CAAC;AACJ;AAEA,OAAO,MAAMC,oCAAoC,GAAGA,CAClDd,aAAqE,EACrEe,OAAgE,KAEhEhB,gCAAgC,CAC9BC,aAAa,EACbJ,iCAAiC,EACjCmB,OACF,CAAC;AAEH,OAAO,MAAMC,sCAAsC,GAAGA,CACpDhB,aAAqE,EACrEe,OAAgE,KAEhEhB,gCAAgC,CAC9BC,aAAa,EACbV,mCAAmC,EACnCyB,OACF,CAAC;AAEH,OAAO,MAAME,iCAAiC,GAAGA,CAC/CjB,aAAqE,EACrEe,OAAgE,KAEhEhB,gCAAgC,CAC9BC,aAAa,EACbL,8BAA8B,EAC9BoB,OACF,CAAC;AAEH,OAAO,MAAMG,kCAAkC,GAAGA,CAChDlB,aAAqE,EACrEe,OAAgE,KAEhEhB,gCAAgC,CAC9BC,aAAa,EACbN,+BAA+B,EAC/BqB,OACF,CAAC;AAEH,OAAO,MAAMI,sBAAsB,GAAGA,CACpCnB,aAAqE,EACrEe,OAAgE,KAEhEhB,gCAAgC,CAACC,aAAa,EAAET,mBAAmB,EAAEwB,OAAO,CAAC;;AAE/E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeK,kBAAkBA,CACtCC,wBAAgC,EAChCC,yBAAiC,EAMjC;EAAA,IALA;IACEpB,QAAQ,GAAGC;EAGb,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMG,YAAY,GAAG,MAAMgB,wBAAwB,CACjDF,wBAAwB,EACxBC,yBAAyB,EACzB;IACEpB;EACF,CACF,CAAC;EAED,MAAMO,WAAW,GAAGX,SAAS,CAACS,YAAY,CAAC;EAC3C,OAAOf,eAAe,CAACkB,KAAK,CAAC;IAC3BC,MAAM,EAAEF,WAAW,CAACG,eAAe;IACnCC,OAAO,EAAEJ,WAAW,CAACI;EACvB,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeL,4BAA4BA,CAChDR,aAAqB,EAMJ;EAAA,IALjB;IACEE,QAAQ,GAAGC;EAGb,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMoB,YAAY,GAAI,GAAExB,aAAc,gCAA+B;EAErE,OAAO,MAAME,QAAQ,CAACsB,YAAY,EAAE;IAClCC,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAAC7B,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3B6B,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeL,wBAAwBA,CAC5CM,uBAA+B,EAC/BP,yBAAiC,EAMjC;EAAA,IALA;IACEpB,QAAQ,GAAGC;EAGb,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAM0B,GAAG,GAAG,IAAIC,GAAG,CAACF,uBAAuB,CAAC;EAC5CC,GAAG,CAACE,YAAY,CAACC,GAAG,CAAC,KAAK,EAAEX,yBAAyB,CAAC;EAEtD,OAAO,MAAMpB,QAAQ,CAAC4B,GAAG,CAACI,QAAQ,CAAC,CAAC,EAAE;IACpCT,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAAC7B,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3B6B,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeO,iBAAiBA,CACrCC,sBAA8B,EAMX;EAAA,IALnB;IACElC,QAAQ,GAAGC;EAGb,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,OAAO,MAAMF,QAAQ,CAACkC,sBAAsB,EAAE;IAC5CX,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAAC7B,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3B6B,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACU,IAAI,CAAC,CAAC,CAAC,CACzBX,IAAI,CAAEW,IAAI,IAAK;IACd,MAAMC,MAAM,GAAG7C,sBAAsB,CAAC8C,SAAS,CAACF,IAAI,CAAC;IACrD,IAAI,CAACC,MAAM,CAACE,OAAO,EAAE;MACnB,MAAM,IAAIxD,wBAAwB,CAC/B,gDAA+CoD,sBAAuB,YAAWE,MAAM,CAACG,KAAK,CAACC,OAAQ,EAAC,EACxG;QAAEZ,GAAG,EAAEM,sBAAsB;QAAEO,UAAU,EAAEL,MAAM,CAACG,KAAK,CAACP,QAAQ,CAAC;MAAE,CACrE,CAAC;IACH;IACA,OAAOI,MAAM,CAACM,IAAI;EACpB,CAAC,CAAC;AACN;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,eAAeA,CACnCC,yBAAiC,EACjCC,cAAmB,EAEA;EAAA,IADnB7C,QAA8B,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAGD,KAAK;EAEtC;EACA,MAAM6C,UAAU,GAAG,MAAMC,gBAAgB,CACvCH,yBAAyB,EACzB5C,QACF,CAAC;;EAED;EACA,MAAMgD,cAAc,GAAGF,UAAU,CAACA,UAAU,CAAC3C,MAAM,GAAG,CAAC,CAAC;EACxD,IAAI,CAAC6C,cAAc,EAAE;IACnB,MAAM,IAAInE,oBAAoB,CAC5B,6EAA6E,EAC7E;MAAEoE,eAAe,EAAEL;IAA0B,CAC/C,CAAC;EACH;EAEA,IAAI,CAACC,cAAc,CAACK,GAAG,EAAE;IACvB,MAAM,IAAIjE,0BAA0B,CAAC,CAAC;EACxC;EAEA,MAAME,MAAM,CAAC6D,cAAc,EAAEH,cAAc,CAACK,GAAG,EAAE,CAACL,cAAc,CAAC,CAAC;;EAElE;EACA,MAAMM,iBAAiB,GAAG9D,mBAAmB,CAACmB,KAAK,CAACtB,MAAM,CAAC8D,cAAc,CAAC,CAAC;EAC3E,MAAMd,sBAAsB,GAC1BiB,iBAAiB,CAACxC,OAAO,CAACyC,QAAQ,CAACC,iBAAiB,CACjDC,wBAAwB;EAE7B,IAAIpB,sBAAsB,EAAE;IAC1B,MAAMqB,cAAc,GAAG,MAAMtB,iBAAiB,CAACC,sBAAsB,EAAE;MACrElC;IACF,CAAC,CAAC;IAEF,IAAI,CAACuD,cAAc,CAACC,QAAQ,CAACZ,yBAAyB,CAAC,EAAE;MACvD,MAAM,IAAI5D,8BAA8B,CACtC,wFAAwF,EACxF;QAAEiE,eAAe,EAAEL,yBAAyB;QAAEV;MAAuB,CACvE,CAAC;IACH;EACF;EAEA,OAAOY,UAAU;AACnB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,gBAAgBA,CAC7BjD,aAAqB,EACrBE,QAA8B,EAEX;EAAA,IADnByD,MAAe,GAAAvD,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,IAAI;EAEtB,MAAMwD,KAAe,GAAG,EAAE;;EAE1B;EACA,MAAMC,WAAW,GAAG,MAAMrD,4BAA4B,CAACR,aAAa,EAAE;IACpEE;EACF,CAAC,CAAC;EACF,MAAM4D,QAAQ,GAAGvE,mBAAmB,CAACmB,KAAK,CAACtB,MAAM,CAACyE,WAAW,CAAC,CAAC;EAE/D,IAAIF,MAAM,EAAE;IACV;IACAC,KAAK,CAACG,IAAI,CAACF,WAAW,CAAC;EACzB;;EAEA;EACA,MAAMG,cAAc,GAAGF,QAAQ,CAACjD,OAAO,CAACoD,eAAe,IAAI,EAAE;EAC7D,IAAID,cAAc,CAAC3D,MAAM,KAAK,CAAC,EAAE;IAC/B;IACA,IAAI,CAACsD,MAAM,EAAE;MACXC,KAAK,CAACG,IAAI,CAACF,WAAW,CAAC;IACzB;IACA,OAAOD,KAAK;EACd;EAEA,MAAMM,mBAAmB,GAAGF,cAAc,CAAC,CAAC,CAAE;;EAE9C;EACA,MAAMG,WAAW,GAAG,MAAM3D,4BAA4B,CAAC0D,mBAAmB,EAAE;IAC1EhE;EACF,CAAC,CAAC;EACF,MAAMkE,QAAQ,GAAG7E,mBAAmB,CAACmB,KAAK,CAACtB,MAAM,CAAC+E,WAAW,CAAC,CAAC;;EAE/D;EACA,MAAMtC,uBAAuB,GAC3BuC,QAAQ,CAACvD,OAAO,CAACyC,QAAQ,CAACC,iBAAiB,CAACc,yBAAyB;EACvE,IAAI,CAACxC,uBAAuB,EAAE;IAC5B,MAAM,IAAI5C,mCAAmC,CAC1C,kDAAiDiF,mBAAoB,4CAA2ClE,aAAc,GAAE,EACjI;MAAEA,aAAa;MAAEsE,kBAAkB,EAAEJ;IAAoB,CAC3D,CAAC;EACH;EAEA,MAAMK,kBAAkB,GAAG,MAAMhD,wBAAwB,CACvDM,uBAAuB,EACvB7B,aAAa,EACb;IAAEE;EAAS,CACb,CAAC;EACD;EACAV,eAAe,CAACkB,KAAK,CAACtB,MAAM,CAACmF,kBAAkB,CAAC,CAAC;;EAEjD;EACAX,KAAK,CAACG,IAAI,CAACQ,kBAAkB,CAAC;;EAE9B;EACA,MAAMC,WAAW,GAAG,MAAMvB,gBAAgB,CACxCiB,mBAAmB,EACnBhE,QAAQ,EACR,KACF,CAAC;EAED,OAAO0D,KAAK,CAACa,MAAM,CAACD,WAAW,CAAC;AAClC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import { IoWalletError, serializeAttrs } from "../utils/errors";
|
|
2
|
-
|
|
1
|
+
import { IoWalletError, serializeAttrs } from "../utils/errors";
|
|
2
|
+
// Ensure this path is correct
|
|
3
3
|
/**
|
|
4
4
|
* Base class for all federation-specific errors.
|
|
5
5
|
*/
|
|
@@ -91,4 +91,25 @@ export class MissingFederationFetchEndpointError extends FederationError {
|
|
|
91
91
|
super(message, details);
|
|
92
92
|
}
|
|
93
93
|
}
|
|
94
|
+
|
|
95
|
+
/**
|
|
96
|
+
* Error thrown when the X.509 certificate chain is missing in an entity's configuration.
|
|
97
|
+
*/
|
|
98
|
+
export class MissingX509CertsError extends FederationError {
|
|
99
|
+
code = "ERR_FED_MISSING_X509_CERTS";
|
|
100
|
+
constructor(message) {
|
|
101
|
+
super(message, undefined);
|
|
102
|
+
}
|
|
103
|
+
}
|
|
104
|
+
|
|
105
|
+
/**
|
|
106
|
+
* Error thrown when an X.509 certificate validation fails.
|
|
107
|
+
* This is used to indicate issues with the certificate chain or signature verification.
|
|
108
|
+
*/
|
|
109
|
+
export class X509ValidationError extends FederationError {
|
|
110
|
+
code = "ERR_FED_X509_VALIDATION_FAILED";
|
|
111
|
+
constructor(message, details) {
|
|
112
|
+
super(message, details);
|
|
113
|
+
}
|
|
114
|
+
}
|
|
94
115
|
//# sourceMappingURL=errors.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["IoWalletError","serializeAttrs","FederationError","constructor","message","details","name","TrustChainEmptyError","code","arguments","length","undefined","TrustChainTokenMissingError","TrustChainRenewalError","FederationListParseError","BuildTrustChainError","TrustAnchorKidMissingError","RelyingPartyNotAuthorizedError","MissingFederationFetchEndpointError"],"sourceRoot":"../../../src","sources":["trust/errors.ts"],"mappings":"AAAA,SAASA,aAAa,EAAEC,cAAc,QAAQ,iBAAiB
|
|
1
|
+
{"version":3,"names":["IoWalletError","serializeAttrs","FederationError","constructor","message","details","name","TrustChainEmptyError","code","arguments","length","undefined","TrustChainTokenMissingError","TrustChainRenewalError","FederationListParseError","BuildTrustChainError","TrustAnchorKidMissingError","RelyingPartyNotAuthorizedError","MissingFederationFetchEndpointError","MissingX509CertsError","X509ValidationError"],"sourceRoot":"../../../src","sources":["trust/errors.ts"],"mappings":"AAAA,SAASA,aAAa,EAAEC,cAAc,QAAQ,iBAAiB;AACoB;AAEnF;AACA;AACA;AACA,OAAO,MAAMC,eAAe,SAASF,aAAa,CAAC;EACjDG,WAAWA,CAACC,OAAe,EAAEC,OAAiC,EAAE;IAC9D,KAAK,CAACA,OAAO,GAAGJ,cAAc,CAAC;MAAEG,OAAO;MAAE,GAAGC;IAAQ,CAAC,CAAC,GAAGD,OAAO,CAAC;IAClE,IAAI,CAACE,IAAI,GAAG,IAAI,CAACH,WAAW,CAACG,IAAI;EACnC;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMC,oBAAoB,SAASL,eAAe,CAAC;EACxDM,IAAI,GAAG,2BAA2B;EAClCL,WAAWA,CAAA,EAA2C;IAAA,IAA1CC,OAAO,GAAAK,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,8BAA8B;IAClD,KAAK,CAACL,OAAO,EAAEO,SAAS,CAAC;EAC3B;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMC,2BAA2B,SAASV,eAAe,CAAC;EAC/DM,IAAI,GAAG,mCAAmC;EAC1CL,WAAWA,CAACC,OAAe,EAAEC,OAA4B,EAAE;IACzD,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAMQ,sBAAsB,SAASX,eAAe,CAAC;EAC1DM,IAAI,GAAG,oCAAoC;EAC3CL,WAAWA,CACTC,OAAe,EACfC,OAA8D,EAC9D;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;AAEA,OAAO,MAAMS,wBAAwB,SAASZ,eAAe,CAAC;EAC5DM,IAAI,GAAG,sCAAsC;EAC7CL,WAAWA,CAACC,OAAe,EAAEC,OAA6C,EAAE;IAC1E,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMU,oBAAoB,SAASb,eAAe,CAAC;EACxDM,IAAI,GAAG,kCAAkC;EACzCL,WAAWA,CACTC,OAAe,EACfC,OAIC,EACD;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMW,0BAA0B,SAASd,eAAe,CAAC;EAC9DM,IAAI,GAAG,kCAAkC;EACzCL,WAAWA,CAAA,EAA0D;IAAA,IAAzDC,OAAO,GAAAK,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,6CAA6C;IACjE,KAAK,CAACL,OAAO,EAAEO,SAAS,CAAC;EAC3B;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMM,8BAA8B,SAASf,eAAe,CAAC;EAClEM,IAAI,GAAG,sCAAsC;EAC7CL,WAAWA,CACTC,OAAe,EACfC,OAAqE,EACrE;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMa,mCAAmC,SAAShB,eAAe,CAAC;EACvEM,IAAI,GAAG,2CAA2C;EAClDL,WAAWA,CACTC,OAAe,EACfC,OAA8D,EAC9D;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMc,qBAAqB,SAASjB,eAAe,CAAC;EACzDM,IAAI,GAAG,4BAA4B;EACnCL,WAAWA,CAACC,OAAe,EAAE;IAC3B,KAAK,CAACA,OAAO,EAAEO,SAAS,CAAC;EAC3B;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAMS,mBAAmB,SAASlB,eAAe,CAAC;EACvDM,IAAI,GAAG,gCAAgC;EACvCL,WAAWA,CACTC,OAAe,EACfC,OAMC,EACD;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF"}
|