@pagopa/io-react-native-wallet 2.3.0 → 2.4.0

package/lib/commonjs/credential/issuance/03-start-user-authorization.js

@@ -62,19 +62,23 @@ const selectResponseMode = (issuerConf, credentialIds) => {
  * it is possible to use the same access token for the issuance of all requested credentials.
  * This is an HTTP POST request containing the Wallet Instance identifier (client id), the code challenge and challenge method as specified by PKCE according to RFC 9126
  * along with the WTE and its proof of possession (WTE-PoP).
- * Additionally, it includes a request object, which is a signed JWT encapsulating the type of digital credential requested (authorization_details),
- * the application session identifier on the Wallet Instance side (state),
+ * Additionally, it includes a request object, which is a signed JWT encapsulating the type of digital credential requested (authorization_details), challenge method and
+ * redirect URI for the document proof step (if L2 flow), the application session identifier on the Wallet Instance side (state),
  * the method (query or form_post.jwt) by which the Authorization Server
  * should transmit the Authorization Response containing the authorization code issued upon the end user's authentication (response_mode)
  * to the Wallet Instance's Token Endpoint to obtain the Access Token, and the redirectUri of the Wallet Instance where the Authorization Response
  * should be delivered. The redirect is achived by using a custom URL scheme that the Wallet Instance is registered to handle.
  * @param issuerConf The issuer configuration
  * @param credentialIds The credential configuration IDs to be requested
- * @param ctx The context object containing the Wallet Instance's cryptographic context, the Wallet Instance's attestation, the redirect URI and the fetch implementation
+ * @param proof The configuration for the proof to be used in the request: "none" for standard flows, "document" for L2+ with MRTD verification.
+ * @param ctx The context object containing;
+ *  - wiaCryptoContext: the Wallet Instance's cryptographic context
+ *  - walletInstanceAttestation: the Wallet Instance's attestation
+ *  - redirectUri: the redirect URI
+ *  - appFetch: (optional) the fetch implementation
  * @returns The URI to which the end user should be redirected to start the authentication flow, along with the client id, the code verifier and the credential definition(s)
  */
-
-const startUserAuthorization = async (issuerConf, credentialIds, ctx) => {
+const startUserAuthorization = async (issuerConf, credentialIds, proof, ctx) => {
   const {
     wiaCryptoContext,
     walletInstanceAttestation,
@@ -89,12 +93,26 @@ const startUserAuthorization = async (issuerConf, credentialIds, ctx) => {
   const codeVerifier = (0, _misc.generateRandomAlphaNumericString)(64);
   const parEndpoint = issuerConf.oauth_authorization_server.pushed_authorization_request_endpoint;
   const aud = issuerConf.openid_credential_issuer.credential_issuer;
-  const credentialDefinition = credentialIds.map(c => selectCredentialDefinition(issuerConf, c));
   const responseMode = selectResponseMode(issuerConf, credentialIds);
   const getPar = (0, _par.makeParRequest)({
     wiaCryptoContext,
     appFetch
   });
+  const credentialDefinition = [...credentialIds.map(c => selectCredentialDefinition(issuerConf, c))];
+  if (proof.proofType === "mrtd-pop") {
+    /**
+     * When we requests a PID using eID Substantial Authentication with MRTD Verification, we must include
+     * an additional Authorization Details Object in the authorization_details
+     *
+     * See https://italia.github.io/eid-wallet-it-docs/versione-corrente/en/credential-issuance-endpoint.html#pushed-authorization-request-endpoint
+     */
+    credentialDefinition.push({
+      type: "it_l2+document_proof",
+      idphinting: proof.idpHinting,
+      challenge_method: "mrtd+ias",
+      challenge_redirect_uri: redirectUri
+    });
+  }
   const issuerRequestUri = await getPar(parEndpoint, walletInstanceAttestation, {
     aud,
     clientId,

package/lib/commonjs/credential/issuance/03-start-user-authorization.js.map

@@ -1 +1 @@
-{"version":3,"names":["_misc","require","_par","_logging","selectCredentialDefinition","issuerConf","credentialId","credential_configurations_supported","openid_credential_issuer","result","Object","keys","filter","e","includes","map","credential_configuration_id","type","Logger","log","LogLevel","ERROR","JSON","stringify","Error","selectResponseMode","credentialIds","responseModeSupported","oauth_authorization_server","response_modes_supported","responseModeSet","Set","add","match","size","values","responseMode","DEBUG","startUserAuthorization","ctx","wiaCryptoContext","walletInstanceAttestation","redirectUri","appFetch","fetch","clientId","getPublicKey","then","_","kid","codeVerifier","generateRandomAlphaNumericString","parEndpoint","pushed_authorization_request_endpoint","aud","credential_issuer","credentialDefinition","c","getPar","makeParRequest","issuerRequestUri","authorizationDetails","exports"],"sourceRoot":"../../../../src","sources":["credential/issuance/03-start-user-authorization.ts"],"mappings":";;;;;;AAEA,IAAAA,KAAA,GAAAC,OAAA;AAGA,IAAAC,IAAA,GAAAD,OAAA;AACA,IAAAE,QAAA,GAAAF,OAAA;AAkBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMG,0BAA0B,GAAGA,CACjCC,UAAkD,EAClDC,YAA4C,KACpB;EACxB,MAAMC,mCAAmC,GACvCF,UAAU,CAACG,wBAAwB,CAACD,mCAAmC;EAEzE,MAAM,CAACE,MAAM,CAAC,GAAGC,MAAM,CAACC,IAAI,CAACJ,mCAAmC,CAAC,CAC9DK,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,QAAQ,CAACR,YAAY,CAAC,CAAC,CACvCS,GAAG,CAAC,OAAO;IACVC,2BAA2B,EAAEV,YAAY;IACzCW,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACR,MAAM,EAAE;IACXS,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,wBAAuBf,YAAa,kEAAiEgB,IAAI,CAACC,SAAS,CAAChB,mCAAmC,CAAE,EAC5J,CAAC;IACD,MAAM,IAAIiB,KAAK,CAAE,mCAAkClB,YAAa,GAAE,CAAC;EACrE;EACA,OAAOG,MAAM;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMgB,kBAAkB,GAAGA,CACzBpB,UAAkD,EAClDqB,aAAuB,KACN;EACjB,MAAMC,qBAAqB,GACzBtB,UAAU,CAACuB,0BAA0B,CAACC,wBAAwB;EAEhE,MAAMC,eAAe,GAAG,IAAIC,GAAG,CAAe,CAAC;EAE/C,KAAK,MAAMzB,YAAY,IAAIoB,aAAa,EAAE;IACxCI,eAAe,CAACE,GAAG,CACjB1B,YAAY,CAAC2B,KAAK,CAAC,2BAA2B,CAAC,GAC3C,OAAO,GACP,eACN,CAAC;EACH;EAEA,IAAIH,eAAe,CAACI,IAAI,KAAK,CAAC,EAAE;IAC9BhB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,GAAEK,aAAc,qCAAoC,CAAC,GAAGI,eAAe,CAACK,MAAM,CAAC,CAAC,CAAE,EACrF,CAAC;IACD,MAAM,IAAIX,KAAK,CACb,yGACF,CAAC;EACH;EAEA,MAAM,CAACY,YAAY,CAAC,GAAGN,eAAe,CAACK,MAAM,CAAC,CAAC;EAE/CjB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACiB,KAAK,EACb,0BAAyBD,YAAa,uBAAsBV,aAAc,EAC7E,CAAC;EAED,IAAI,CAACC,qBAAqB,CAACb,QAAQ,CAACsB,YAAa,CAAC,EAAE;IAClDlB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2BAA0Be,YAAa,kEAAiEd,IAAI,CAACC,SAAS,CAACI,qBAAqB,CAAE,EACjJ,CAAC;IACD,MAAM,IAAIH,KAAK,CAAE,qCAAoCE,aAAc,GAAE,CAAC;EACxE;EAEA,OAAOU,YAAY;AACrB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEO,MAAME,sBAA8C,GAAG,MAAAA,CAC5DjC,UAAU,EACVqB,aAAa,EACba,GAAG,KACA;EACH,MAAM;IACJC,gBAAgB;IAChBC,yBAAyB;IACzBC,WAAW;IACXC,QAAQ,GAAGC;EACb,CAAC,GAAGL,GAAG;EAEP,MAAMM,QAAQ,GAAG,MAAML,gBAAgB,CAACM,YAAY,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,GAAG,CAAC;EAEzE,IAAI,CAACJ,QAAQ,EAAE;IACb3B,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,kCAAiCwB,QAAS,0BAC7C,CAAC;IACD,MAAM,IAAIrB,KAAK,CAAC,qBAAqB,CAAC;EACxC;EACA,MAAM0B,YAAY,GAAG,IAAAC,sCAAgC,EAAC,EAAE,CAAC;EACzD,MAAMC,WAAW,GACf/C,UAAU,CAACuB,0BAA0B,CAACyB,qCAAqC;EAC7E,MAAMC,GAAG,GAAGjD,UAAU,CAACG,wBAAwB,CAAC+C,iBAAiB;EACjE,MAAMC,oBAAoB,GAAG9B,aAAa,CAACX,GAAG,CAAE0C,CAAC,IAC/CrD,0BAA0B,CAACC,UAAU,EAAEoD,CAAC,CAC1C,CAAC;EACD,MAAMrB,YAAY,GAAGX,kBAAkB,CAACpB,UAAU,EAAEqB,aAAa,CAAC;EAClE,MAAMgC,MAAM,GAAG,IAAAC,mBAAc,EAAC;IAAEnB,gBAAgB;IAAEG;EAAS,CAAC,CAAC;EAC7D,MAAMiB,gBAAgB,GAAG,MAAMF,MAAM,CACnCN,WAAW,EACXX,yBAAyB,EACzB;IACEa,GAAG;IACHT,QAAQ;IACRK,YAAY;IACZR,WAAW;IACXN,YAAY;IACZyB,oBAAoB,EAAEL;EACxB,CACF,CAAC;EAED,OAAO;IAAEI,gBAAgB;IAAEf,QAAQ;IAAEK,YAAY;IAAEM;EAAqB,CAAC;AAC3E,CAAC;AAACM,OAAA,CAAAxB,sBAAA,GAAAA,sBAAA"}
+{"version":3,"names":["_misc","require","_par","_logging","selectCredentialDefinition","issuerConf","credentialId","credential_configurations_supported","openid_credential_issuer","result","Object","keys","filter","e","includes","map","credential_configuration_id","type","Logger","log","LogLevel","ERROR","JSON","stringify","Error","selectResponseMode","credentialIds","responseModeSupported","oauth_authorization_server","response_modes_supported","responseModeSet","Set","add","match","size","values","responseMode","DEBUG","startUserAuthorization","proof","ctx","wiaCryptoContext","walletInstanceAttestation","redirectUri","appFetch","fetch","clientId","getPublicKey","then","_","kid","codeVerifier","generateRandomAlphaNumericString","parEndpoint","pushed_authorization_request_endpoint","aud","credential_issuer","getPar","makeParRequest","credentialDefinition","c","proofType","push","idphinting","idpHinting","challenge_method","challenge_redirect_uri","issuerRequestUri","authorizationDetails","exports"],"sourceRoot":"../../../../src","sources":["credential/issuance/03-start-user-authorization.ts"],"mappings":";;;;;;AAEA,IAAAA,KAAA,GAAAC,OAAA;AAGA,IAAAC,IAAA,GAAAD,OAAA;AACA,IAAAE,QAAA,GAAAF,OAAA;AAmBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMG,0BAA0B,GAAGA,CACjCC,UAAkD,EAClDC,YAA4C,KACpB;EACxB,MAAMC,mCAAmC,GACvCF,UAAU,CAACG,wBAAwB,CAACD,mCAAmC;EAEzE,MAAM,CAACE,MAAM,CAAC,GAAGC,MAAM,CAACC,IAAI,CAACJ,mCAAmC,CAAC,CAC9DK,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,QAAQ,CAACR,YAAY,CAAC,CAAC,CACvCS,GAAG,CAAC,OAAO;IACVC,2BAA2B,EAAEV,YAAY;IACzCW,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACR,MAAM,EAAE;IACXS,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,wBAAuBf,YAAa,kEAAiEgB,IAAI,CAACC,SAAS,CAAChB,mCAAmC,CAAE,EAC5J,CAAC;IACD,MAAM,IAAIiB,KAAK,CAAE,mCAAkClB,YAAa,GAAE,CAAC;EACrE;EACA,OAAOG,MAAM;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMgB,kBAAkB,GAAGA,CACzBpB,UAAkD,EAClDqB,aAAuB,KACN;EACjB,MAAMC,qBAAqB,GACzBtB,UAAU,CAACuB,0BAA0B,CAACC,wBAAwB;EAEhE,MAAMC,eAAe,GAAG,IAAIC,GAAG,CAAe,CAAC;EAE/C,KAAK,MAAMzB,YAAY,IAAIoB,aAAa,EAAE;IACxCI,eAAe,CAACE,GAAG,CACjB1B,YAAY,CAAC2B,KAAK,CAAC,2BAA2B,CAAC,GAC3C,OAAO,GACP,eACN,CAAC;EACH;EAEA,IAAIH,eAAe,CAACI,IAAI,KAAK,CAAC,EAAE;IAC9BhB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,GAAEK,aAAc,qCAAoC,CAAC,GAAGI,eAAe,CAACK,MAAM,CAAC,CAAC,CAAE,EACrF,CAAC;IACD,MAAM,IAAIX,KAAK,CACb,yGACF,CAAC;EACH;EAEA,MAAM,CAACY,YAAY,CAAC,GAAGN,eAAe,CAACK,MAAM,CAAC,CAAC;EAE/CjB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACiB,KAAK,EACb,0BAAyBD,YAAa,uBAAsBV,aAAc,EAC7E,CAAC;EAED,IAAI,CAACC,qBAAqB,CAACb,QAAQ,CAACsB,YAAa,CAAC,EAAE;IAClDlB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2BAA0Be,YAAa,kEAAiEd,IAAI,CAACC,SAAS,CAACI,qBAAqB,CAAE,EACjJ,CAAC;IACD,MAAM,IAAIH,KAAK,CAAE,qCAAoCE,aAAc,GAAE,CAAC;EACxE;EAEA,OAAOU,YAAY;AACrB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,sBAA8C,GAAG,MAAAA,CAC5DjC,UAAU,EACVqB,aAAa,EACba,KAAK,EACLC,GAAG,KACA;EACH,MAAM;IACJC,gBAAgB;IAChBC,yBAAyB;IACzBC,WAAW;IACXC,QAAQ,GAAGC;EACb,CAAC,GAAGL,GAAG;EAEP,MAAMM,QAAQ,GAAG,MAAML,gBAAgB,CAACM,YAAY,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,GAAG,CAAC;EAEzE,IAAI,CAACJ,QAAQ,EAAE;IACb5B,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,kCAAiCyB,QAAS,0BAC7C,CAAC;IACD,MAAM,IAAItB,KAAK,CAAC,qBAAqB,CAAC;EACxC;EACA,MAAM2B,YAAY,GAAG,IAAAC,sCAAgC,EAAC,EAAE,CAAC;EACzD,MAAMC,WAAW,GACfhD,UAAU,CAACuB,0BAA0B,CAAC0B,qCAAqC;EAC7E,MAAMC,GAAG,GAAGlD,UAAU,CAACG,wBAAwB,CAACgD,iBAAiB;EACjE,MAAMpB,YAAY,GAAGX,kBAAkB,CAACpB,UAAU,EAAEqB,aAAa,CAAC;EAClE,MAAM+B,MAAM,GAAG,IAAAC,mBAAc,EAAC;IAAEjB,gBAAgB;IAAEG;EAAS,CAAC,CAAC;EAE7D,MAAMe,oBAAoB,GAAG,CAC3B,GAAGjC,aAAa,CAACX,GAAG,CAAE6C,CAAC,IAAKxD,0BAA0B,CAACC,UAAU,EAAEuD,CAAC,CAAC,CAAC,CACvE;EAED,IAAIrB,KAAK,CAACsB,SAAS,KAAK,UAAU,EAAE;IAClC;AACJ;AACA;AACA;AACA;AACA;IACIF,oBAAoB,CAACG,IAAI,CAAC;MACxB7C,IAAI,EAAE,sBAAsB;MAC5B8C,UAAU,EAAExB,KAAK,CAACyB,UAAU;MAC5BC,gBAAgB,EAAE,UAAU;MAC5BC,sBAAsB,EAAEvB;IAC1B,CAAC,CAAC;EACJ;EAEA,MAAMwB,gBAAgB,GAAG,MAAMV,MAAM,CACnCJ,WAAW,EACXX,yBAAyB,EACzB;IACEa,GAAG;IACHT,QAAQ;IACRK,YAAY;IACZR,WAAW;IACXP,YAAY;IACZgC,oBAAoB,EAAET;EACxB,CACF,CAAC;EAED,OAAO;IAAEQ,gBAAgB;IAAErB,QAAQ;IAAEK,YAAY;IAAEQ;EAAqB,CAAC;AAC3E,CAAC;AAACU,OAAA,CAAA/B,sBAAA,GAAAA,sBAAA"}

package/lib/commonjs/credential/issuance/04-complete-user-authorization.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.parseAuthorizationResponse = exports.getRequestedCredentialToBePresented = exports.completeUserAuthorizationWithQueryMode = exports.completeUserAuthorizationWithFormPostJwtMode = exports.buildAuthorizationUrl = void 0;
+exports.parseAuthorizationResponse = exports.getRequestedCredentialToBePresented = exports.continueUserAuthorizationWithMRTDPoPChallenge = exports.completeUserAuthorizationWithQueryMode = exports.completeUserAuthorizationWithFormPostJwtMode = exports.buildAuthorizationUrl = void 0;
 var _auth = require("../../utils/auth");
 var _misc = require("../../utils/misc");
 var _parseUrl = _interopRequireDefault(require("parse-url"));
@@ -20,6 +20,29 @@ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { de
  * The interface of the phase to complete User authorization via strong identification when the response mode is "query" and the request credential is a PersonIdentificationData.
  */
 
+/**
+ * WARNING: this function must be called after obtaining the authorization redirect URL from the webviews (SPID and CIE L3) or browser for CIEID, and the PID
+ * issuance requires a MRTD PoP challenge.
+ * @param authRedirectUrl The URL to which the end user should be redirected to start the MRTD PoP validation flow
+ * @returns the authorization response which contains the challenge
+ */
+const continueUserAuthorizationWithMRTDPoPChallenge = async authRedirectUrl => {
+  _logging.Logger.log(_logging.LogLevel.DEBUG, `The requested credential is a PersonIdentificationData and requires MRTD PoP, starting MRTD PoP validation from auth redirect`);
+  const query = (0, _parseUrl.default)(authRedirectUrl).query;
+  const authResParsed = _auth.AuthorizationChallengeResultShape.safeParse(query);
+  if (!authResParsed.success) {
+    const authErr = _auth.AuthorizationErrorShape.safeParse(query);
+    if (!authErr.success) {
+      _logging.Logger.log(_logging.LogLevel.ERROR, `Error while parsing the authorization response: ${authResParsed.error.message}`);
+      throw new _errors2.AuthorizationError(authResParsed.error.message); // an error occured while parsing the result and the error
+    }
+
+    _logging.Logger.log(_logging.LogLevel.ERROR, `Error while authorizating with the idp: ${JSON.stringify(authErr)}`);
+    throw new _errors2.AuthorizationIdpError(authErr.data.error, authErr.data.error_description);
+  }
+  return authResParsed.data;
+};
+
 /**
  * WARNING: This function must be called after {@link startUserAuthorization}. The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
  * Builds the authorization URL to which the end user should be redirected to continue the authentication flow.
@@ -29,6 +52,7 @@ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { de
  * @param idpHint Unique identifier of the IDP selected by the user (optional)
  * @returns An object containing the authorization URL
  */
+exports.continueUserAuthorizationWithMRTDPoPChallenge = continueUserAuthorizationWithMRTDPoPChallenge;
 const buildAuthorizationUrl = async (issuerRequestUri, clientId, issuerConf, idpHint) => {
   const authzRequestEndpoint = issuerConf.oauth_authorization_server.authorization_endpoint;
   const params = new URLSearchParams({
@@ -53,7 +77,7 @@ const buildAuthorizationUrl = async (issuerRequestUri, clientId, issuerConf, idp
  */
 exports.buildAuthorizationUrl = buildAuthorizationUrl;
 const completeUserAuthorizationWithQueryMode = async authRedirectUrl => {
-  _logging.Logger.log(_logging.LogLevel.DEBUG, `The requeste credential is a PersonIdentificationData, completing the user authorization with query mode`);
+  _logging.Logger.log(_logging.LogLevel.DEBUG, `The requested credential is a PersonIdentificationData, completing the user authorization with query mode`);
   const query = (0, _parseUrl.default)(authRedirectUrl).query;
   return parseAuthorizationResponse(query);
 };

package/lib/commonjs/credential/issuance/04-complete-user-authorization.js.map

@@ -1 +1 @@
-{"version":3,"names":["_auth","require","_misc","_parseUrl","_interopRequireDefault","_errors","_ioReactNativeJwt","_types","_types2","_decoder","_errors2","_logging","_","obj","__esModule","default","buildAuthorizationUrl","issuerRequestUri","clientId","issuerConf","idpHint","authzRequestEndpoint","oauth_authorization_server","authorization_endpoint","params","URLSearchParams","client_id","request_uri","append","authUrl","exports","completeUserAuthorizationWithQueryMode","authRedirectUrl","Logger","log","LogLevel","DEBUG","query","parseUrl","parseAuthorizationResponse","getRequestedCredentialToBePresented","appFetch","arguments","length","undefined","fetch","toString","requestObject","method","then","hasStatusOrThrow","IssuerResponseError","res","text","jws","decode","reqObj","RequestObject","safeParse","payload","success","ERROR","error","message","ValidationFailed","reason","data","completeUserAuthorizationWithFormPostJwtMode","pid","_ref","wiaCryptoContext","pidCryptoContext","dcql_query","Error","dcqlQueryResult","Presentation","evaluateDcqlQuery","credentialsToPresent","map","_ref2","requiredDisclosures","rest","requestedClaims","_ref3","claimName","remotePresentations","prepareRemotePresentations","nonce","authzResponsePayload","createAuthzResponsePayload","state","body","response","resUriRes","response_uri","headers","reqUri","json","responseUri","ResponseUriResultShape","redirect_uri","getJwtFromFormPost","cbRes","decodedJwt","authRes","authResParsed","AuthorizationResultShape","authErr","AuthorizationErrorShape","AuthorizationError","JSON","stringify","AuthorizationIdpError","error_description","_ref4","kid","getPublicKey","SignJWT","setProtectedHeader","typ","setPayload","vp_token","reduce","_ref5","credentialId","vpToken","setIssuedAt","setExpirationTime","sign"],"sourceRoot":"../../../../src","sources":["credential/issuance/04-complete-user-authorization.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAKA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,SAAA,GAAAC,sBAAA,CAAAH,OAAA;AACA,IAAAI,OAAA,GAAAJ,OAAA;AAEA,IAAAK,iBAAA,GAAAL,OAAA;AAKA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,OAAA,GAAAP,OAAA;AACA,IAAAQ,QAAA,GAAAR,OAAA;AACA,IAAAS,QAAA,GAAAT,OAAA;AACA,IAAAU,QAAA,GAAAV,OAAA;AACA,IAAAW,CAAA,GAAAX,OAAA;AAAkC,SAAAG,uBAAAS,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAGlC;AACA;AACA;;AA+BA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMG,qBAA4C,GAAG,MAAAA,CAC1DC,gBAAgB,EAChBC,QAAQ,EACRC,UAAU,EACVC,OAAO,KACJ;EACH,MAAMC,oBAAoB,GACxBF,UAAU,CAACG,0BAA0B,CAACC,sBAAsB;EAE9D,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCC,SAAS,EAAER,QAAQ;IACnBS,WAAW,EAAEV;EACf,CAAC,CAAC;EAEF,IAAIG,OAAO,EAAE;IACXI,MAAM,CAACI,MAAM,CAAC,SAAS,EAAER,OAAO,CAAC;EACnC;EAEA,MAAMS,OAAO,GAAI,GAAER,oBAAqB,IAAGG,MAAO,EAAC;EAEnD,OAAO;IAAEK;EAAQ,CAAC;AACpB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AANAC,OAAA,CAAAd,qBAAA,GAAAA,qBAAA;AAOO,MAAMe,sCAA8E,GACzF,MAAOC,eAAe,IAAK;EACzBC,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,0GACH,CAAC;EACD,MAAMC,KAAK,GAAG,IAAAC,iBAAQ,EAACN,eAAe,CAAC,CAACK,KAAK;EAE7C,OAAOE,0BAA0B,CAACF,KAAK,CAAC;AAC1C,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAXAP,OAAA,CAAAC,sCAAA,GAAAA,sCAAA;AAYO,MAAMS,mCAAwE,GACnF,eAAAA,CAAOvB,gBAAgB,EAAEC,QAAQ,EAAEC,UAAU,EAAuB;EAAA,IAArBsB,QAAQ,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAGG,KAAK;EAC7DZ,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,sGACH,CAAC;EACD,MAAMf,oBAAoB,GACxBF,UAAU,CAACG,0BAA0B,CAACC,sBAAsB;EAC9D,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCC,SAAS,EAAER,QAAQ;IACnBS,WAAW,EAAEV;EACf,CAAC,CAAC;EAEFgB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,oCAAmCf,oBAAqB,IAAGG,MAAM,CAACsB,QAAQ,CAAC,CAAE,EAChF,CAAC;EAED,MAAMC,aAAa,GAAG,MAAMN,QAAQ,CACjC,GAAEpB,oBAAqB,IAAGG,MAAM,CAACsB,QAAQ,CAAC,CAAE,EAAC,EAC9C;IAAEE,MAAM,EAAE;EAAM,CAClB,CAAC,CACEC,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,EAAEC,2BAAmB,CAAC,CAAC,CAChDF,IAAI,CAAEG,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBJ,IAAI,CAAEK,GAAG,IAAK,IAAAC,wBAAM,EAACD,GAAG,CAAC,CAAC,CAC1BL,IAAI,CAAEO,MAAM,IAAKC,oBAAa,CAACC,SAAS,CAACF,MAAM,CAACG,OAAO,CAAC,CAAC;EAE5D,IAAI,CAACZ,aAAa,CAACa,OAAO,EAAE;IAC1B3B,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAAC0B,KAAK,EACb,+CAA8Cd,aAAa,CAACe,KAAK,CAACC,OAAQ,EAC7E,CAAC;IACD,MAAM,IAAIC,wBAAgB,CAAC;MACzBD,OAAO,EAAE,kCAAkC;MAC3CE,MAAM,EAAElB,aAAa,CAACe,KAAK,CAACC;IAC9B,CAAC,CAAC;EACJ;EACA,OAAOhB,aAAa,CAACmB,IAAI;AAC3B,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAVApC,OAAA,CAAAU,mCAAA,GAAAA,mCAAA;AAWO,MAAM2B,4CAA0F,GACrG,MAAAA,CACEpB,aAAa,EACbqB,GAAG,EAAAC,IAAA,KAEA;EAAA,IADH;IAAEC,gBAAgB;IAAEC,gBAAgB;IAAE9B,QAAQ,GAAGI;EAAM,CAAC,GAAAwB,IAAA;EAExDpC,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,sHACH,CAAC;EAED,IAAI,CAACW,aAAa,CAACyB,UAAU,EAAE;IAC7B,MAAM,IAAIC,KAAK,CAAC,wBAAwB,CAAC;EAC3C;EAEA,MAAMC,eAAe,GAAGC,cAAY,CAACC,iBAAiB,CACpD,CAAC,CAACL,gBAAgB,EAAEH,GAAG,CAAC,CAAC,EACzBrB,aAAa,CAACyB,UAChB,CAAC;EAED,MAAMK,oBAAoB,GAAGH,eAAe,CAACI,GAAG,CAC9CC,KAAA;IAAA,IAAC;MAAEC,mBAAmB;MAAE,GAAGC;IAAK,CAAC,GAAAF,KAAA;IAAA,OAAM;MACrC,GAAGE,IAAI;MACPC,eAAe,EAAEF,mBAAmB,CAACF,GAAG,CAACK,KAAA;QAAA,IAAC,GAAGC,SAAS,CAAC,GAAAD,KAAA;QAAA,OAAKC,SAAS;MAAA;IACvE,CAAC;EAAA,CACH,CAAC;EAED,MAAMC,mBAAmB,GAAG,MAAMV,cAAY,CAACW,0BAA0B,CACvET,oBAAoB,EACpB9B,aAAa,CAACwC,KAAK,EACnBxC,aAAa,CAACrB,SAChB,CAAC;EAED,MAAM8D,oBAAoB,GAAG,MAAMC,0BAA0B,CAAC;IAC5DC,KAAK,EAAE3C,aAAa,CAAC2C,KAAK;IAC1BL,mBAAmB;IACnBf;EACF,CAAC,CAAC;EAEFrC,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2BAA0BoD,oBAAqB,EAClD,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA,MAAMG,IAAI,GAAG,IAAIlE,eAAe,CAAC;IAC/BmE,QAAQ,EAAEJ;EACZ,CAAC,CAAC,CAAC1C,QAAQ,CAAC,CAAC;EAEb,MAAM+C,SAAS,GAAG,MAAMpD,QAAQ,CAACM,aAAa,CAAC+C,YAAY,EAAE;IAC3D9C,MAAM,EAAE,MAAM;IACd+C,OAAO,EAAE;MACP,cAAc,EAAE;IAClB,CAAC;IACDJ;EACF,CAAC,CAAC,CACC1C,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,EAAEC,2BAAmB,CAAC,CAAC,CAChDF,IAAI,CAAE+C,MAAM,IAAKA,MAAM,CAACC,IAAI,CAAC,CAAC,CAAC;EAElC,MAAMC,WAAW,GAAGC,8BAAsB,CAACzC,SAAS,CAACmC,SAAS,CAAC;EAC/D,IAAI,CAACK,WAAW,CAACtC,OAAO,EAAE;IACxB3B,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAAC0B,KAAK,EACb,4CAA2CqC,WAAW,CAACpC,KAAK,CAACC,OAAQ,EACxE,CAAC;IACD,MAAM,IAAIC,wBAAgB,CAAC;MACzBD,OAAO,EAAE,gCAAgC;MACzCE,MAAM,EAAEiC,WAAW,CAACpC,KAAK,CAACC;IAC5B,CAAC,CAAC;EACJ;EAEA,OAAO,MAAMtB,QAAQ,CAACyD,WAAW,CAAChC,IAAI,CAACkC,YAAY,CAAC,CACjDnD,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,EAAEC,2BAAmB,CAAC,CAAC,CAChDF,IAAI,CAAEG,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBJ,IAAI,CAACoD,2BAAkB,CAAC,CACxBpD,IAAI,CAAEqD,KAAK,IAAK/D,0BAA0B,CAAC+D,KAAK,CAACC,UAAU,CAAC5C,OAAO,CAAC,CAAC;AAC1E,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AANA7B,OAAA,CAAAqC,4CAAA,GAAAA,4CAAA;AAOO,MAAM5B,0BAA0B,GACrCiE,OAAgB,IACQ;EACxB,MAAMC,aAAa,GAAGC,8BAAwB,CAAChD,SAAS,CAAC8C,OAAO,CAAC;EACjE,IAAI,CAACC,aAAa,CAAC7C,OAAO,EAAE;IAC1B,MAAM+C,OAAO,GAAGC,6BAAuB,CAAClD,SAAS,CAAC8C,OAAO,CAAC;IAC1D,IAAI,CAACG,OAAO,CAAC/C,OAAO,EAAE;MACpB3B,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAAC0B,KAAK,EACb,mDAAkD4C,aAAa,CAAC3C,KAAK,CAACC,OAAQ,EACjF,CAAC;MACD,MAAM,IAAI8C,2BAAkB,CAACJ,aAAa,CAAC3C,KAAK,CAACC,OAAO,CAAC,CAAC,CAAC;IAC7D;;IACA9B,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAAC0B,KAAK,EACb,2CAA0CiD,IAAI,CAACC,SAAS,CAACJ,OAAO,CAAE,EACrE,CAAC;IACD,MAAM,IAAIK,8BAAqB,CAC7BL,OAAO,CAACzC,IAAI,CAACJ,KAAK,EAClB6C,OAAO,CAACzC,IAAI,CAAC+C,iBACf,CAAC;EACH;EACA,OAAOR,aAAa,CAACvC,IAAI;AAC3B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAPApC,OAAA,CAAAS,0BAAA,GAAAA,0BAAA;AAQA,MAAMkD,0BAA0B,GAAG,MAAAyB,KAAA,IAQZ;EAAA,IARmB;IACxCxB,KAAK;IACLL,mBAAmB;IACnBf;EAKF,CAAC,GAAA4C,KAAA;EACC,MAAM;IAAEC;EAAI,CAAC,GAAG,MAAM7C,gBAAgB,CAAC8C,YAAY,CAAC,CAAC;EAErD,OAAO,IAAIC,yBAAO,CAAC/C,gBAAgB,CAAC,CACjCgD,kBAAkB,CAAC;IAClBC,GAAG,EAAE,KAAK;IACVJ;EACF,CAAC,CAAC,CACDK,UAAU,CAAC;IACV;AACN;AACA;AACA;AACA;IACM,IAAI9B,KAAK,GAAG;MAAEA;IAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B+B,QAAQ,EAAEpC,mBAAmB,CAACqC,MAAM,CAClC,CAACD,QAAQ,EAAAE,KAAA;MAAA,IAAE;QAAEC,YAAY;QAAEC;MAAQ,CAAC,GAAAF,KAAA;MAAA,OAAM;QACxC,GAAGF,QAAQ;QACX,CAACG,YAAY,GAAGC;MAClB,CAAC;IAAA,CAAC,EACF,CAAC,CACH;EACF,CAAC,CAAC,CACDC,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,IAAI,CAAC,CACvBC,IAAI,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"names":["_auth","require","_misc","_parseUrl","_interopRequireDefault","_errors","_ioReactNativeJwt","_types","_types2","_decoder","_errors2","_logging","_","obj","__esModule","default","continueUserAuthorizationWithMRTDPoPChallenge","authRedirectUrl","Logger","log","LogLevel","DEBUG","query","parseUrl","authResParsed","AuthorizationChallengeResultShape","safeParse","success","authErr","AuthorizationErrorShape","ERROR","error","message","AuthorizationError","JSON","stringify","AuthorizationIdpError","data","error_description","exports","buildAuthorizationUrl","issuerRequestUri","clientId","issuerConf","idpHint","authzRequestEndpoint","oauth_authorization_server","authorization_endpoint","params","URLSearchParams","client_id","request_uri","append","authUrl","completeUserAuthorizationWithQueryMode","parseAuthorizationResponse","getRequestedCredentialToBePresented","appFetch","arguments","length","undefined","fetch","toString","requestObject","method","then","hasStatusOrThrow","IssuerResponseError","res","text","jws","decode","reqObj","RequestObject","payload","ValidationFailed","reason","completeUserAuthorizationWithFormPostJwtMode","pid","_ref","wiaCryptoContext","pidCryptoContext","dcql_query","Error","dcqlQueryResult","Presentation","evaluateDcqlQuery","credentialsToPresent","map","_ref2","requiredDisclosures","rest","requestedClaims","_ref3","claimName","remotePresentations","prepareRemotePresentations","nonce","authzResponsePayload","createAuthzResponsePayload","state","body","response","resUriRes","response_uri","headers","reqUri","json","responseUri","ResponseUriResultShape","redirect_uri","getJwtFromFormPost","cbRes","decodedJwt","authRes","AuthorizationResultShape","_ref4","kid","getPublicKey","SignJWT","setProtectedHeader","typ","setPayload","vp_token","reduce","_ref5","credentialId","vpToken","setIssuedAt","setExpirationTime","sign"],"sourceRoot":"../../../../src","sources":["credential/issuance/04-complete-user-authorization.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAOA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,SAAA,GAAAC,sBAAA,CAAAH,OAAA;AACA,IAAAI,OAAA,GAAAJ,OAAA;AAEA,IAAAK,iBAAA,GAAAL,OAAA;AAKA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,OAAA,GAAAP,OAAA;AACA,IAAAQ,QAAA,GAAAR,OAAA;AACA,IAAAS,QAAA,GAAAT,OAAA;AACA,IAAAU,QAAA,GAAAV,OAAA;AACA,IAAAW,CAAA,GAAAX,OAAA;AAAkC,SAAAG,uBAAAS,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAGlC;AACA;AACA;;AAmCA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMG,6CAA4F,GACvG,MAAOC,eAAe,IAAK;EACzBC,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,+HACH,CAAC;EACD,MAAMC,KAAK,GAAG,IAAAC,iBAAQ,EAACN,eAAe,CAAC,CAACK,KAAK;EAE7C,MAAME,aAAa,GAAGC,uCAAiC,CAACC,SAAS,CAACJ,KAAK,CAAC;EACxE,IAAI,CAACE,aAAa,CAACG,OAAO,EAAE;IAC1B,MAAMC,OAAO,GAAGC,6BAAuB,CAACH,SAAS,CAACJ,KAAK,CAAC;IACxD,IAAI,CAACM,OAAO,CAACD,OAAO,EAAE;MACpBT,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,mDAAkDN,aAAa,CAACO,KAAK,CAACC,OAAQ,EACjF,CAAC;MACD,MAAM,IAAIC,2BAAkB,CAACT,aAAa,CAACO,KAAK,CAACC,OAAO,CAAC,CAAC,CAAC;IAC7D;;IACAd,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,2CAA0CI,IAAI,CAACC,SAAS,CAACP,OAAO,CAAE,EACrE,CAAC;IACD,MAAM,IAAIQ,8BAAqB,CAC7BR,OAAO,CAACS,IAAI,CAACN,KAAK,EAClBH,OAAO,CAACS,IAAI,CAACC,iBACf,CAAC;EACH;EACA,OAAOd,aAAa,CAACa,IAAI;AAC3B,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AARAE,OAAA,CAAAvB,6CAAA,GAAAA,6CAAA;AASO,MAAMwB,qBAA4C,GAAG,MAAAA,CAC1DC,gBAAgB,EAChBC,QAAQ,EACRC,UAAU,EACVC,OAAO,KACJ;EACH,MAAMC,oBAAoB,GACxBF,UAAU,CAACG,0BAA0B,CAACC,sBAAsB;EAE9D,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCC,SAAS,EAAER,QAAQ;IACnBS,WAAW,EAAEV;EACf,CAAC,CAAC;EAEF,IAAIG,OAAO,EAAE;IACXI,MAAM,CAACI,MAAM,CAAC,SAAS,EAAER,OAAO,CAAC;EACnC;EAEA,MAAMS,OAAO,GAAI,GAAER,oBAAqB,IAAGG,MAAO,EAAC;EAEnD,OAAO;IAAEK;EAAQ,CAAC;AACpB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AANAd,OAAA,CAAAC,qBAAA,GAAAA,qBAAA;AAOO,MAAMc,sCAA8E,GACzF,MAAOrC,eAAe,IAAK;EACzBC,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2GACH,CAAC;EACD,MAAMC,KAAK,GAAG,IAAAC,iBAAQ,EAACN,eAAe,CAAC,CAACK,KAAK;EAE7C,OAAOiC,0BAA0B,CAACjC,KAAK,CAAC;AAC1C,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAXAiB,OAAA,CAAAe,sCAAA,GAAAA,sCAAA;AAYO,MAAME,mCAAwE,GACnF,eAAAA,CAAOf,gBAAgB,EAAEC,QAAQ,EAAEC,UAAU,EAAuB;EAAA,IAArBc,QAAQ,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAGG,KAAK;EAC7D3C,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,sGACH,CAAC;EACD,MAAMwB,oBAAoB,GACxBF,UAAU,CAACG,0BAA0B,CAACC,sBAAsB;EAC9D,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCC,SAAS,EAAER,QAAQ;IACnBS,WAAW,EAAEV;EACf,CAAC,CAAC;EAEFvB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,oCAAmCwB,oBAAqB,IAAGG,MAAM,CAACc,QAAQ,CAAC,CAAE,EAChF,CAAC;EAED,MAAMC,aAAa,GAAG,MAAMN,QAAQ,CACjC,GAAEZ,oBAAqB,IAAGG,MAAM,CAACc,QAAQ,CAAC,CAAE,EAAC,EAC9C;IAAEE,MAAM,EAAE;EAAM,CAClB,CAAC,CACEC,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,EAAEC,2BAAmB,CAAC,CAAC,CAChDF,IAAI,CAAEG,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBJ,IAAI,CAAEK,GAAG,IAAK,IAAAC,wBAAM,EAACD,GAAG,CAAC,CAAC,CAC1BL,IAAI,CAAEO,MAAM,IAAKC,oBAAa,CAAC/C,SAAS,CAAC8C,MAAM,CAACE,OAAO,CAAC,CAAC;EAE5D,IAAI,CAACX,aAAa,CAACpC,OAAO,EAAE;IAC1BT,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,+CAA8CiC,aAAa,CAAChC,KAAK,CAACC,OAAQ,EAC7E,CAAC;IACD,MAAM,IAAI2C,wBAAgB,CAAC;MACzB3C,OAAO,EAAE,kCAAkC;MAC3C4C,MAAM,EAAEb,aAAa,CAAChC,KAAK,CAACC;IAC9B,CAAC,CAAC;EACJ;EACA,OAAO+B,aAAa,CAAC1B,IAAI;AAC3B,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAVAE,OAAA,CAAAiB,mCAAA,GAAAA,mCAAA;AAWO,MAAMqB,4CAA0F,GACrG,MAAAA,CACEd,aAAa,EACbe,GAAG,EAAAC,IAAA,KAEA;EAAA,IADH;IAAEC,gBAAgB;IAAEC,gBAAgB;IAAExB,QAAQ,GAAGI;EAAM,CAAC,GAAAkB,IAAA;EAExD7D,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,sHACH,CAAC;EAED,IAAI,CAAC0C,aAAa,CAACmB,UAAU,EAAE;IAC7B,MAAM,IAAIC,KAAK,CAAC,wBAAwB,CAAC;EAC3C;EAEA,MAAMC,eAAe,GAAGC,cAAY,CAACC,iBAAiB,CACpD,CAAC,CAACL,gBAAgB,EAAEH,GAAG,CAAC,CAAC,EACzBf,aAAa,CAACmB,UAChB,CAAC;EAED,MAAMK,oBAAoB,GAAGH,eAAe,CAACI,GAAG,CAC9CC,KAAA;IAAA,IAAC;MAAEC,mBAAmB;MAAE,GAAGC;IAAK,CAAC,GAAAF,KAAA;IAAA,OAAM;MACrC,GAAGE,IAAI;MACPC,eAAe,EAAEF,mBAAmB,CAACF,GAAG,CAACK,KAAA;QAAA,IAAC,GAAGC,SAAS,CAAC,GAAAD,KAAA;QAAA,OAAKC,SAAS;MAAA;IACvE,CAAC;EAAA,CACH,CAAC;EAED,MAAMC,mBAAmB,GAAG,MAAMV,cAAY,CAACW,0BAA0B,CACvET,oBAAoB,EACpBxB,aAAa,CAACkC,KAAK,EACnBlC,aAAa,CAACb,SAChB,CAAC;EAED,MAAMgD,oBAAoB,GAAG,MAAMC,0BAA0B,CAAC;IAC5DC,KAAK,EAAErC,aAAa,CAACqC,KAAK;IAC1BL,mBAAmB;IACnBf;EACF,CAAC,CAAC;EAEF9D,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2BAA0B6E,oBAAqB,EAClD,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA,MAAMG,IAAI,GAAG,IAAIpD,eAAe,CAAC;IAC/BqD,QAAQ,EAAEJ;EACZ,CAAC,CAAC,CAACpC,QAAQ,CAAC,CAAC;EAEb,MAAMyC,SAAS,GAAG,MAAM9C,QAAQ,CAACM,aAAa,CAACyC,YAAY,EAAE;IAC3DxC,MAAM,EAAE,MAAM;IACdyC,OAAO,EAAE;MACP,cAAc,EAAE;IAClB,CAAC;IACDJ;EACF,CAAC,CAAC,CACCpC,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,EAAEC,2BAAmB,CAAC,CAAC,CAChDF,IAAI,CAAEyC,MAAM,IAAKA,MAAM,CAACC,IAAI,CAAC,CAAC,CAAC;EAElC,MAAMC,WAAW,GAAGC,8BAAsB,CAACnF,SAAS,CAAC6E,SAAS,CAAC;EAC/D,IAAI,CAACK,WAAW,CAACjF,OAAO,EAAE;IACxBT,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,4CAA2C8E,WAAW,CAAC7E,KAAK,CAACC,OAAQ,EACxE,CAAC;IACD,MAAM,IAAI2C,wBAAgB,CAAC;MACzB3C,OAAO,EAAE,gCAAgC;MACzC4C,MAAM,EAAEgC,WAAW,CAAC7E,KAAK,CAACC;IAC5B,CAAC,CAAC;EACJ;EAEA,OAAO,MAAMyB,QAAQ,CAACmD,WAAW,CAACvE,IAAI,CAACyE,YAAY,CAAC,CACjD7C,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,EAAEC,2BAAmB,CAAC,CAAC,CAChDF,IAAI,CAAEG,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBJ,IAAI,CAAC8C,2BAAkB,CAAC,CACxB9C,IAAI,CAAE+C,KAAK,IAAKzD,0BAA0B,CAACyD,KAAK,CAACC,UAAU,CAACvC,OAAO,CAAC,CAAC;AAC1E,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AANAnC,OAAA,CAAAsC,4CAAA,GAAAA,4CAAA;AAOO,MAAMtB,0BAA0B,GACrC2D,OAAgB,IACQ;EACxB,MAAM1F,aAAa,GAAG2F,8BAAwB,CAACzF,SAAS,CAACwF,OAAO,CAAC;EACjE,IAAI,CAAC1F,aAAa,CAACG,OAAO,EAAE;IAC1B,MAAMC,OAAO,GAAGC,6BAAuB,CAACH,SAAS,CAACwF,OAAO,CAAC;IAC1D,IAAI,CAACtF,OAAO,CAACD,OAAO,EAAE;MACpBT,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,mDAAkDN,aAAa,CAACO,KAAK,CAACC,OAAQ,EACjF,CAAC;MACD,MAAM,IAAIC,2BAAkB,CAACT,aAAa,CAACO,KAAK,CAACC,OAAO,CAAC,CAAC,CAAC;IAC7D;;IACAd,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,2CAA0CI,IAAI,CAACC,SAAS,CAACP,OAAO,CAAE,EACrE,CAAC;IACD,MAAM,IAAIQ,8BAAqB,CAC7BR,OAAO,CAACS,IAAI,CAACN,KAAK,EAClBH,OAAO,CAACS,IAAI,CAACC,iBACf,CAAC;EACH;EACA,OAAOd,aAAa,CAACa,IAAI;AAC3B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAPAE,OAAA,CAAAgB,0BAAA,GAAAA,0BAAA;AAQA,MAAM4C,0BAA0B,GAAG,MAAAiB,KAAA,IAQZ;EAAA,IARmB;IACxChB,KAAK;IACLL,mBAAmB;IACnBf;EAKF,CAAC,GAAAoC,KAAA;EACC,MAAM;IAAEC;EAAI,CAAC,GAAG,MAAMrC,gBAAgB,CAACsC,YAAY,CAAC,CAAC;EAErD,OAAO,IAAIC,yBAAO,CAACvC,gBAAgB,CAAC,CACjCwC,kBAAkB,CAAC;IAClBC,GAAG,EAAE,KAAK;IACVJ;EACF,CAAC,CAAC,CACDK,UAAU,CAAC;IACV;AACN;AACA;AACA;AACA;IACM,IAAItB,KAAK,GAAG;MAAEA;IAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3BuB,QAAQ,EAAE5B,mBAAmB,CAAC6B,MAAM,CAClC,CAACD,QAAQ,EAAAE,KAAA;MAAA,IAAE;QAAEC,YAAY;QAAEC;MAAQ,CAAC,GAAAF,KAAA;MAAA,OAAM;QACxC,GAAGF,QAAQ;QACX,CAACG,YAAY,GAAGC;MAClB,CAAC;IAAA,CAAC,EACF,CAAC,CACH;EACF,CAAC,CAAC,CACDC,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,IAAI,CAAC,CACvBC,IAAI,CAAC,CAAC;AACX,CAAC"}

package/lib/commonjs/credential/issuance/README.md

@@ -23,30 +23,45 @@ graph TD;
     6[obtainCredential]
     7[verifyAndParseCredential]
     credSel{Is credential an eID?}
+    proofSel{Requires MRTD PoP?}
+    M1[continueUserAuthorizationWithMRTDPoPChallenge]
+    subgraph MRTD PoP flow
+    M2[verifyAndParseChallengeInfo]
+    M3[initChallenge]
+    M4[validateChallenge]
+    end
 
     0 --> 1
     1 --> 2
     2 --> 3
     3 --> credSel
-    credSel -->|Yes| E4
+    credSel -->|Yes| proofSel
     credSel -->|No| C4
+    proofSel --> |Yes| M1
+    proofSel --> |No| E4
     C4 --> C4.1
     C4.1 --> 5
     E4 --> 5
     5 --> 6
     6 --> 7
+
+    M1 --> M2
+    M2 --> M3
+    M3 --> M4
+    M4 --> E4
+
 ```
 
 ## Mapped results
 
 The following errors are mapped to a `IssuerResponseError` with specific codes.
 
-|HTTP Status|Error Code|Description|
-|-----------|----------|-----------|
-|`201 Created`|`ERR_CREDENTIAL_ISSUING_NOT_SYNCHRONOUS`| This response is returned by the credential issuer when the request has been queued because the credential cannot be issued synchronously. The consumer should try to obtain the credential at a later time. Although `201 Created` is not considered an error, it is mapped as an error in this context in order to handle the case where the credential issuance is not synchronous. This allows keeping the flow consistent and handle the case where the credential is not immediately available.|
-|`403 Forbidden`|`ERR_CREDENTIAL_INVALID_STATUS`|This response is returned by the credential issuer when the requested credential has an invalid status. It might contain more details in the `reason` property.|
-|`404 Not Found`|`ERR_CREDENTIAL_INVALID_STATUS`| This response is returned by the credential issuer when the authenticated user is not entitled to receive the requested credential. It might contain more details in the `reason` property.|
-|`*`|`ERR_ISSUER_GENERIC_ERROR`|This is a generic error code to map unexpected errors that occurred when interacting with the Issuer.|
+| HTTP Status     | Error Code                               | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| --------------- | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `201 Created`   | `ERR_CREDENTIAL_ISSUING_NOT_SYNCHRONOUS` | This response is returned by the credential issuer when the request has been queued because the credential cannot be issued synchronously. The consumer should try to obtain the credential at a later time. Although `201 Created` is not considered an error, it is mapped as an error in this context in order to handle the case where the credential issuance is not synchronous. This allows keeping the flow consistent and handle the case where the credential is not immediately available. |
+| `403 Forbidden` | `ERR_CREDENTIAL_INVALID_STATUS`          | This response is returned by the credential issuer when the requested credential has an invalid status. It might contain more details in the `reason` property.                                                                                                                                                                                                                                                                                                                                       |
+| `404 Not Found` | `ERR_CREDENTIAL_INVALID_STATUS`          | This response is returned by the credential issuer when the authenticated user is not entitled to receive the requested credential. It might contain more details in the `reason` property.                                                                                                                                                                                                                                                                                                           |
+| `*`             | `ERR_ISSUER_GENERIC_ERROR`               | This is a generic error code to map unexpected errors that occurred when interacting with the Issuer.                                                                                                                                                                                                                                                                                                                                                                                                 |
 
 ## Strong authentication for eID issuance (Query Mode)
 
@@ -60,6 +75,17 @@ CIE+PIN(L3) requires a different flow due to the physical card presence. Helper
 
 The expected result from the authentication process is in provided in the query string as defined in the [JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)](https://openid.net/specs/oauth-v2-jarm.html#name-response-mode-queryjwt).
 
+#### eID Substantial Authentication (L2+) with MRTD Verification
+
+MRTD Verification is a sub-flow of the Issuance flow and is used when the requested eID requires **eID Substantial Authentication (LoA3) with MRTD (Machine Readable Travel Document) Verification**. This method provides an alternative to CIEid LoA High authentication, requiring two distinct steps to complete the authorization:
+
+1. **Primary Authentication**: LoA3 electronic identification (SPID or CIEid L2).
+2. **MRTD Proof of Possession (PoP)**: Electronic document reading and cryptographic verification.
+
+This process is initiated by the Authorization Server responding to the primary authentication step with a redirect that includes a challenge in the query string, which is handled by the `continueUserAuthorizationWithMRTDPoPChallenge` function. Once the MRTD PoP is completed, the user must continue the PID issuance flow with the `completeUserAuthorizationWithQueryMode` function.
+
+Complete documentation for the MRTD PoP flow can be found here: [mrtd-pop](./mrtd-pop/README.md)
+
 ## Authentication through credentials (Form Post JWT Mode)
 
 When the credential is different than an eID, the flow requires the user to present other credentials in order to obtain the requested one. This is done through the `getRequestedCredentialToBePresented` followed by the `completeUserAuthorizationWithFormPostJwtMode`.
@@ -122,8 +148,9 @@ const { issuerConf } = await Credential.Issuance.evaluateIssuerTrust(issuerUrl);
 // Start user authorization
 const { issuerRequestUri, clientId, codeVerifier } =
   await Credential.Issuance.startUserAuthorization(
-    issuerConf, 
-    [credentialId], 
+    issuerConf,
+    [credentialId],
+    { proofType: "none" },
     {
       walletInstanceAttestation,
       redirectUri: REDIRECT_URI,
@@ -199,10 +226,10 @@ const { parsedCredential } =
     issuerConf,
     credential,
     credential_configuration_id,
-    { 
-      credentialCryptoContext, 
+    {
+      credentialCryptoContext,
       ignoreMissingAttributes: true,
-      includeUndefinedAttributes: false 
+      includeUndefinedAttributes: false
     },
     mockX509CertRoot
   );
@@ -285,6 +312,7 @@ const { issuerRequestUri, clientId, codeVerifier, credentialDefinition } =
   await Credential.Issuance.startUserAuthorization(
     issuerConf,
     [credentialId], // Request authorization for one or more credentials
+    { proofType: "none" },
     {
       walletInstanceAttestation,
       redirectUri,
@@ -296,12 +324,7 @@ const { issuerRequestUri, clientId, codeVerifier, credentialDefinition } =
 // Complete the authorization process with query mode with the authorizationContext which opens the browser
 const { code } =
   await Credential.Issuance.completeUserAuthorizationWithQueryMode(
-    issuerRequestUri,
-    clientId,
-    issuerConf,
-    idpHint,
-    redirectUri,
-    authorizationContext
+    issuerRequestUri
   );
 
 // Create DPoP context which will be used for the whole issuance flow
@@ -372,3 +395,117 @@ return {
 The result of this flow is a raw credential and a parsed credential which must be stored securely in the wallet along with its crypto key.
 
 </details>
+
+<details>
+  <summary>eID issuance flow with MRTD PoP validation</summary>
+
+```ts
+/**
+ *
+ * Previous steps are the sames as the "eID issuance flow" example
+ *
+ */
+
+// Start user authorization indicating "mrtd-pop" as the proof type with the idpHint of the
+// chosen identification method
+const { issuerRequestUri, clientId, codeVerifier, credentialDefinition } =
+  await Credential.Issuance.startUserAuthorization(
+    issuerConf,
+    [credentialId],
+    { proofType: "mrtd-pop", idpHinting: idpHint },
+    {
+      walletInstanceAttestation,
+      redirectUri: redirectUri,
+      wiaCryptoContext,
+      appFetch,
+    }
+  );
+
+// Obtain the Authorization URL
+const { authUrl } = await Credential.Issuance.buildAuthorizationUrl(
+  issuerRequestUri,
+  clientId,
+  issuerConf,
+  idpHint
+);
+
+// Extract challenge info from the Authorization URL
+const { challenge_info } =
+  await Credential.Issuance.continueUserAuthorizationWithMRTDPoPChallenge(
+    authUrl
+  );
+
+// Verify and parse challenge info and extract challenge data: initialization url, session and nonce
+const {
+  htu: initUrl,
+  mrtd_auth_session,
+  mrtd_pop_jwt_nonce,
+} = await Credential.Issuance.MRTDPoP.verifyAndParseChallengeInfo(
+  issuerConf,
+  challenge_info,
+  { wiaCryptoContext }
+);
+
+// Initialize challenge and obtain the challenge text to sign the CIE PACE protocol and validation url
+const {
+  htu: validationUrl,
+  challenge,
+  mrtd_pop_nonce,
+} = await Credential.Issuance.MRTDPoP.initChallenge(
+  issuerConf,
+  initUrl,
+  mrtd_auth_session,
+  mrtd_pop_jwt_nonce,
+  {
+    walletInstanceAttestation,
+    wiaCryptoContext,
+    appFetch,
+  }
+);
+
+// CIE cryptographic interaction: you need to sign the challenge with the CIE through NFC interaction
+const { nis, mrtds } = /* NFC interactions functions */
+
+// Validate challenge
+const { mrtd_val_pop_nonce, redirect_uri } =
+  await Credential.Issuance.MRTDPoP.validateChallenge(
+    issuerConf,
+    validationUrl,
+    mrtd_auth_session,
+    mrtd_pop_nonce,
+    mrtd,
+    ias,
+    {
+      walletInstanceAttestation,
+      wiaCryptoContext,
+      appFetch,
+    }
+  );
+
+// Build the callback url
+const { callbackUrl } = await Credential.Issuance.buildChallengeCallbackUrl(
+  redirect_uri,
+  mrtd_val_pop_nonce,
+  mrtd_auth_session
+);
+
+// The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
+const authRedirectUrl = /* From a browser or webview redirect */
+
+// Complete the authorization process with query mode using the returned callback url
+const { code } =
+  await Credential.Issuance.completeUserAuthorizationWithQueryMode(
+    authRedirectUrl
+  );
+
+/**
+ *
+ * The next steps are the same as the "eID issuance flow" example
+ *
+ */
+};
+```
+
+The result of this flow is a raw credential and a parsed credential which must be stored securely in the wallet along with its crypto key.
+
+</details>

package/lib/commonjs/credential/issuance/index.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.Errors = void 0;
+exports.MRTDPoP = exports.Errors = void 0;
 Object.defineProperty(exports, "authorizeAccess", {
   enumerable: true,
   get: function () {
@@ -28,6 +28,12 @@ Object.defineProperty(exports, "completeUserAuthorizationWithQueryMode", {
     return _completeUserAuthorization.completeUserAuthorizationWithQueryMode;
   }
 });
+Object.defineProperty(exports, "continueUserAuthorizationWithMRTDPoPChallenge", {
+  enumerable: true,
+  get: function () {
+    return _completeUserAuthorization.continueUserAuthorizationWithMRTDPoPChallenge;
+  }
+});
 Object.defineProperty(exports, "evaluateIssuerTrust", {
   enumerable: true,
   get: function () {
@@ -72,6 +78,8 @@ var _obtainCredential = require("./06-obtain-credential");
 var _verifyAndParseCredential = require("./07-verify-and-parse-credential");
 var Errors = _interopRequireWildcard(require("./errors"));
 exports.Errors = Errors;
+var MRTDPoP = _interopRequireWildcard(require("./mrtd-pop"));
+exports.MRTDPoP = MRTDPoP;
 function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
 function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
 //# sourceMappingURL=index.js.map

package/lib/commonjs/credential/issuance/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_evaluateIssuerTrust","require","_startUserAuthorization","_completeUserAuthorization","_authorizeAccess","_obtainCredential","_verifyAndParseCredential","Errors","_interopRequireWildcard","exports","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set"],"sourceRoot":"../../../../src","sources":["credential/issuance/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,IAAAA,oBAAA,GAAAC,OAAA;AAIA,IAAAC,uBAAA,GAAAD,OAAA;AAIA,IAAAE,0BAAA,GAAAF,OAAA;AAWA,IAAAG,gBAAA,GAAAH,OAAA;AACA,IAAAI,iBAAA,GAAAJ,OAAA;AAIA,IAAAK,yBAAA,GAAAL,OAAA;AAIA,IAAAM,MAAA,GAAAC,uBAAA,CAAAP,OAAA;AAAmCQ,OAAA,CAAAF,MAAA,GAAAA,MAAA;AAAA,SAAAG,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAH,wBAAAO,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA"}
+{"version":3,"names":["_evaluateIssuerTrust","require","_startUserAuthorization","_completeUserAuthorization","_authorizeAccess","_obtainCredential","_verifyAndParseCredential","Errors","_interopRequireWildcard","exports","MRTDPoP","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set"],"sourceRoot":"../../../../src","sources":["credential/issuance/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,IAAAA,oBAAA,GAAAC,OAAA;AAIA,IAAAC,uBAAA,GAAAD,OAAA;AAIA,IAAAE,0BAAA,GAAAF,OAAA;AAaA,IAAAG,gBAAA,GAAAH,OAAA;AACA,IAAAI,iBAAA,GAAAJ,OAAA;AAIA,IAAAK,yBAAA,GAAAL,OAAA;AAIA,IAAAM,MAAA,GAAAC,uBAAA,CAAAP,OAAA;AAAmCQ,OAAA,CAAAF,MAAA,GAAAA,MAAA;AACnC,IAAAG,OAAA,GAAAF,uBAAA,CAAAP,OAAA;AAAsCQ,OAAA,CAAAC,OAAA,GAAAA,OAAA;AAAA,SAAAC,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAJ,wBAAAQ,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA"}

package/lib/commonjs/credential/issuance/mrtd-pop/01-verify-and-parse-challenge-info.js

@@ -0,0 +1,57 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.verifyAndParseChallengeInfo = void 0;
+var _ioReactNativeJwt = require("@pagopa/io-react-native-jwt");
+var _types = require("./types");
+var _errors = require("../../../utils/errors");
+/**
+ * Verifies and parses the payload of a MRTD Proof Challenge Info JWT obtained after the primary authentication.
+ *
+ * This function performs the following steps:
+ * 1. Validates the JWT signature using the issuer's JWKS.
+ * 2. Decodes the JWT and parses its structure according to the {@link MrtdProofChallengeInfo} schema.
+ * 3. Verifies that the `aud` claim matches the client's public key ID.
+ * 4. Checks that the JWT is not expired and was not issued in the future.
+ *
+ * @param issuerConf - The issuer configuration containing the JWKS for signature verification.
+ * @param challengeInfoJwt - The JWT string representing the MRTD Proof Challenge Info.
+ * @param context - The context containing the WIA crypto context used to retrieve the client public key.
+ * @returns The parsed payload of the MRTD Proof Challenge Info JWT.
+ * @throws {Error} If the JWT signature is invalid, the structure is malformed, the `aud` claim does not match,
+ * or the JWT is expired/not yet valid.
+ */
+const verifyAndParseChallengeInfo = async (issuerConf, challengeInfoJwt, _ref) => {
+  let {
+    wiaCryptoContext
+  } = _ref;
+  // Verify JWT signature
+  await (0, _ioReactNativeJwt.verify)(challengeInfoJwt, issuerConf.oauth_authorization_server.jwks.keys);
+
+  // Decode JWT
+  const challengeInfoDecoded = (0, _ioReactNativeJwt.decode)(challengeInfoJwt);
+
+  // Parse and validate structure
+  const challengeInfoParsed = _types.MrtdProofChallengeInfo.safeParse(challengeInfoDecoded);
+  if (!challengeInfoParsed.success) {
+    throw new _errors.IoWalletError("Malformed challenge info.");
+  }
+  const payload = challengeInfoParsed.data.payload;
+
+  // Verify aud claim
+  const clientId = await wiaCryptoContext.getPublicKey().then(_ => _.kid);
+  if (payload.aud !== clientId) {
+    throw new _errors.IoWalletError("aud claim does not match client_id.");
+  }
+
+  // Verify iat and exp
+  const now = Math.floor(Date.now() / 1000);
+  if (payload.iat > now || payload.exp < now) {
+    throw new _errors.IoWalletError("JWT is not valid (issued in future or expired).");
+  }
+  return payload;
+};
+exports.verifyAndParseChallengeInfo = verifyAndParseChallengeInfo;
+//# sourceMappingURL=01-verify-and-parse-challenge-info.js.map

package/lib/commonjs/credential/issuance/mrtd-pop/01-verify-and-parse-challenge-info.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_ioReactNativeJwt","require","_types","_errors","verifyAndParseChallengeInfo","issuerConf","challengeInfoJwt","_ref","wiaCryptoContext","verifyJwt","oauth_authorization_server","jwks","keys","challengeInfoDecoded","decodeJwt","challengeInfoParsed","MrtdProofChallengeInfo","safeParse","success","IoWalletError","payload","data","clientId","getPublicKey","then","_","kid","aud","now","Math","floor","Date","iat","exp","exports"],"sourceRoot":"../../../../../src","sources":["credential/issuance/mrtd-pop/01-verify-and-parse-challenge-info.ts"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AAKA,IAAAC,MAAA,GAAAD,OAAA;AAGA,IAAAE,OAAA,GAAAF,OAAA;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMG,2BAAwD,GAAG,MAAAA,CACtEC,UAAU,EACVC,gBAAwB,EAAAC,IAAA,KAErB;EAAA,IADH;IAAEC;EAAiB,CAAC,GAAAD,IAAA;EAEpB;EACA,MAAM,IAAAE,wBAAS,EACbH,gBAAgB,EAChBD,UAAU,CAACK,0BAA0B,CAACC,IAAI,CAACC,IAC7C,CAAC;;EAED;EACA,MAAMC,oBAAoB,GAAG,IAAAC,wBAAS,EAACR,gBAAgB,CAAC;;EAExD;EACA,MAAMS,mBAAmB,GACvBC,6BAAsB,CAACC,SAAS,CAACJ,oBAAoB,CAAC;EACxD,IAAI,CAACE,mBAAmB,CAACG,OAAO,EAAE;IAChC,MAAM,IAAIC,qBAAa,CAAC,2BAA2B,CAAC;EACtD;EACA,MAAMC,OAAO,GAAGL,mBAAmB,CAACM,IAAI,CAACD,OAAO;;EAEhD;EACA,MAAME,QAAQ,GAAG,MAAMd,gBAAgB,CAACe,YAAY,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,GAAG,CAAC;EACzE,IAAIN,OAAO,CAACO,GAAG,KAAKL,QAAQ,EAAE;IAC5B,MAAM,IAAIH,qBAAa,CAAC,qCAAqC,CAAC;EAChE;;EAEA;EACA,MAAMS,GAAG,GAAGC,IAAI,CAACC,KAAK,CAACC,IAAI,CAACH,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;EACzC,IAAIR,OAAO,CAACY,GAAG,GAAGJ,GAAG,IAAIR,OAAO,CAACa,GAAG,GAAGL,GAAG,EAAE;IAC1C,MAAM,IAAIT,qBAAa,CAAC,iDAAiD,CAAC;EAC5E;EAEA,OAAOC,OAAO;AAChB,CAAC;AAACc,OAAA,CAAA9B,2BAAA,GAAAA,2BAAA"}

package/lib/commonjs/credential/issuance/mrtd-pop/02-init-challenge.js

@@ -0,0 +1,61 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.initChallenge = void 0;
+var _misc = require("../../../utils/misc");
+var _uuid = require("uuid");
+var _pop = require("../../../utils/pop");
+var WalletInstanceAttestation = _interopRequireWildcard(require("../../../wallet-instance-attestation"));
+var _errors = require("../../../utils/errors");
+var _ioReactNativeJwt = require("@pagopa/io-react-native-jwt");
+var _types = require("./types");
+function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
+function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
+/**
+ * Initialaizes the MRTD challenge with the data received from the issuer after the primary authentication.
+ * This function must be called after {@link verifyAndParseChallengeInfo}.
+ *
+ * @param issuerConf - The issuer configuration containing the JWKS for signature verification.
+ * @param initUrl - The endpoint to call to initialize the challenge.
+ * @param mrtd_auth_session - Session identifier for session binding obtained from the MRTD Proof JWT.
+ * @param mrtd_pop_jwt_nonce - Nonce value obtained from the MRTD Proof JWT.
+ * @param context - The context containing the WIA crypto context used to retrieve the client public key,
+ * the wallet instance attestation and an optional fetch implementation.
+ * @returns The payload of the MRTD PoP Challenge JWT.
+ */
+const initChallenge = async (issuerConf, initUrl, mrtd_auth_session, mrtd_pop_jwt_nonce, context) => {
+  const {
+    appFetch = fetch,
+    walletInstanceAttestation,
+    wiaCryptoContext
+  } = context;
+  const aud = issuerConf.openid_credential_issuer.credential_issuer;
+  const iss = WalletInstanceAttestation.decode(walletInstanceAttestation).payload.cnf.jwk.kid;
+  const signedWiaPoP = await (0, _pop.createPopToken)({
+    jti: `${(0, _uuid.v4)()}`,
+    aud,
+    iss
+  }, wiaCryptoContext);
+  const requestBody = {
+    mrtd_auth_session,
+    mrtd_pop_jwt_nonce
+  };
+  const mrtdPoPChallengeJwt = await appFetch(initUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "OAuth-Client-Attestation": walletInstanceAttestation,
+      "OAuth-Client-Attestation-PoP": signedWiaPoP
+    },
+    body: JSON.stringify(requestBody)
+  }).then((0, _misc.hasStatusOrThrow)(202, _errors.IssuerResponseError)).then(res => res.text());
+  const mrtdPoPChallengeDecoded = (0, _ioReactNativeJwt.decode)(mrtdPoPChallengeJwt);
+  const {
+    payload
+  } = _types.MrtdPoPChallenge.parse(mrtdPoPChallengeDecoded);
+  return payload;
+};
+exports.initChallenge = initChallenge;
+//# sourceMappingURL=02-init-challenge.js.map

package/lib/commonjs/credential/issuance/mrtd-pop/02-init-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_misc","require","_uuid","_pop","WalletInstanceAttestation","_interopRequireWildcard","_errors","_ioReactNativeJwt","_types","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","initChallenge","issuerConf","initUrl","mrtd_auth_session","mrtd_pop_jwt_nonce","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","aud","openid_credential_issuer","credential_issuer","iss","decode","payload","cnf","jwk","kid","signedWiaPoP","createPopToken","jti","uuidv4","requestBody","mrtdPoPChallengeJwt","method","headers","body","JSON","stringify","then","hasStatusOrThrow","IssuerResponseError","res","text","mrtdPoPChallengeDecoded","decodeJwt","MrtdPoPChallenge","parse","exports"],"sourceRoot":"../../../../../src","sources":["credential/issuance/mrtd-pop/02-init-challenge.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,IAAA,GAAAF,OAAA;AACA,IAAAG,yBAAA,GAAAC,uBAAA,CAAAJ,OAAA;AAEA,IAAAK,OAAA,GAAAL,OAAA;AACA,IAAAM,iBAAA,GAAAN,OAAA;AACA,IAAAO,MAAA,GAAAP,OAAA;AAA2C,SAAAQ,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAL,wBAAAS,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAc3C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMW,aAA4B,GAAG,MAAAA,CAC1CC,UAAU,EACVC,OAAO,EACPC,iBAAiB,EACjBC,kBAAkB,EAClBC,OAAO,KACJ;EACH,MAAM;IACJC,QAAQ,GAAGC,KAAK;IAChBC,yBAAyB;IACzBC;EACF,CAAC,GAAGJ,OAAO;EAEX,MAAMK,GAAG,GAAGT,UAAU,CAACU,wBAAwB,CAACC,iBAAiB;EACjE,MAAMC,GAAG,GAAGxC,yBAAyB,CAACyC,MAAM,CAACN,yBAAyB,CAAC,CACpEO,OAAO,CAACC,GAAG,CAACC,GAAG,CAACC,GAAG;EAEtB,MAAMC,YAAY,GAAG,MAAM,IAAAC,mBAAc,EACvC;IACEC,GAAG,EAAG,GAAE,IAAAC,QAAM,EAAC,CAAE,EAAC;IAClBZ,GAAG;IACHG;EACF,CAAC,EACDJ,gBACF,CAAC;EAED,MAAMc,WAAW,GAAG;IAClBpB,iBAAiB;IACjBC;EACF,CAAC;EAED,MAAMoB,mBAAmB,GAAG,MAAMlB,QAAQ,CAACJ,OAAO,EAAE;IAClDuB,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,kBAAkB;MAClC,0BAA0B,EAAElB,yBAAyB;MACrD,8BAA8B,EAAEW;IAClC,CAAC;IACDQ,IAAI,EAAEC,IAAI,CAACC,SAAS,CAACN,WAAW;EAClC,CAAC,CAAC,CACCO,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,EAAEC,2BAAmB,CAAC,CAAC,CAChDF,IAAI,CAAEG,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;EAE5B,MAAMC,uBAAuB,GAAG,IAAAC,wBAAS,EAACZ,mBAAmB,CAAC;EAC9D,MAAM;IAAET;EAAQ,CAAC,GAAGsB,uBAAgB,CAACC,KAAK,CAACH,uBAAuB,CAAC;EAEnE,OAAOpB,OAAO;AAChB,CAAC;AAACwB,OAAA,CAAAvC,aAAA,GAAAA,aAAA"}