@pagopa/io-react-native-wallet 2.5.0 → 3.0.0

package/src/credential/presentation/08-send-authorization-response.ts

@@ -1,329 +0,0 @@
-import { EncryptJwe } from "@pagopa/io-react-native-jwt";
-import uuid from "react-native-uuid";
-import { type FetchJwks, getJwksFromConfig } from "./04-retrieve-rp-jwks";
-import type { VerifyRequestObject } from "./05-verify-request-object";
-import { NoSuitableKeysFoundInEntityConfiguration } from "./errors";
-import { hasStatusOrThrow, type Out } from "../../utils/misc";
-import {
-  DirectAuthorizationBodyPayload,
-  ErrorResponse,
-  type LegacyRemotePresentation,
-  type RemotePresentation,
-} from "./types";
-import * as z from "zod";
-import type { JWK } from "../../utils/jwk";
-import {
-  RelyingPartyResponseError,
-  RelyingPartyResponseErrorCodes,
-  ResponseErrorBuilder,
-  UnexpectedStatusCodeError,
-} from "../../utils/errors";
-import type { RelyingPartyEntityConfiguration } from "../../trust/types";
-
-export type AuthorizationResponse = z.infer<typeof AuthorizationResponse>;
-export const AuthorizationResponse = z.object({
-  status: z.string().optional(),
-  response_code: z
-    .string() /**
-      FIXME: [SIW-627] we expect this value from every RP implementation
-      Actually some RP does not return the value
-      We make it optional to not break the flow.
-    */
-    .optional(),
-  redirect_uri: z.string().optional(),
-});
-
-/**
- * Selects a public key (with `use = enc`) from the set of JWK keys
- * offered by the Relying Party (RP) for encryption.
- *
- * @param rpJwkKeys - The array of JWKs retrieved from the RP entity configuration.
- * @returns The first suitable public key found in the list.
- * @throws {NoSuitableKeysFoundInEntityConfiguration} If no suitable encryption key is found.
- */
-export const choosePublicKeyToEncrypt = (
-  rpJwkKeys: Out<FetchJwks>["keys"]
-): JWK => {
-  const encKey = rpJwkKeys.find((jwk) => jwk.use === "enc");
-
-  if (encKey) {
-    return encKey;
-  }
-
-  // No suitable key found
-  throw new NoSuitableKeysFoundInEntityConfiguration(
-    "No suitable public key found for encryption."
-  );
-};
-
-/**
- * Builds a URL-encoded form body for a direct POST response using JWT encryption.
- *
- * @param jwkKeys - Array of JWKs from the Relying Party for encryption.
- * @param requestObject - Contains state, nonce, and other relevant info.
- * @param payload - Object that contains the VP token to encrypt and the mapping of the credential disclosures
- * @returns A URL-encoded string for an `application/x-www-form-urlencoded` POST body, where `response` contains the encrypted JWE.
- */
-export const buildDirectPostJwtBody = async (
-  requestObject: Out<VerifyRequestObject>["requestObject"],
-  rpConf: RelyingPartyEntityConfiguration["payload"]["metadata"],
-  payload: DirectAuthorizationBodyPayload
-): Promise<string> => {
-  type Jwe = ConstructorParameters<typeof EncryptJwe>[1];
-
-  // Prepare the authorization response payload to be encrypted
-  const authzResponsePayload = JSON.stringify({
-    state: requestObject.state,
-    ...payload,
-  });
-  // Choose a suitable public key for encryption
-  const { keys } = getJwksFromConfig(rpConf);
-  const encPublicJwk = choosePublicKeyToEncrypt(keys);
-
-  // Encrypt the authorization payload
-  const {
-    authorization_encrypted_response_alg,
-    authorization_encrypted_response_enc,
-  } = rpConf.openid_credential_verifier;
-
-  const defaultAlg: Jwe["alg"] =
-    encPublicJwk.kty === "EC" ? "ECDH-ES" : "RSA-OAEP-256";
-
-  const encryptedResponse = await new EncryptJwe(authzResponsePayload, {
-    alg: (authorization_encrypted_response_alg as Jwe["alg"]) || defaultAlg,
-    enc:
-      (authorization_encrypted_response_enc as Jwe["enc"]) || "A256CBC-HS512",
-    kid: encPublicJwk.kid,
-  }).encrypt(encPublicJwk);
-
-  // Build the x-www-form-urlencoded form body
-  const formBody = new URLSearchParams({
-    response: encryptedResponse,
-    ...(requestObject.state ? { state: requestObject.state } : {}),
-  });
-  return formBody.toString();
-};
-
-/**
- * Builds a URL-encoded form body for a direct POST response without encryption.
- *
- * @param requestObject - Contains state, nonce, and other relevant info.
- * @param payload - Object that contains either the VP token to encrypt and the stringified mapping of the credential disclosures or the error code
- * @returns A URL-encoded string suitable for an `application/x-www-form-urlencoded` POST body.
- */
-export const buildDirectPostBody = async (
-  requestObject: Out<VerifyRequestObject>["requestObject"],
-  payload: DirectAuthorizationBodyPayload
-): Promise<string> => {
-  const formUrlEncodedBody = new URLSearchParams({
-    ...(requestObject.state && { state: requestObject.state }),
-    ...Object.entries(payload).reduce(
-      (acc, [key, value]) => ({
-        ...acc,
-        [key]:
-          Array.isArray(value) || typeof value === "object"
-            ? JSON.stringify(value)
-            : value,
-      }),
-      {} as Record<string, string>
-    ),
-  });
-
-  return formUrlEncodedBody.toString();
-};
-
-/**
- * Type definition for the function that sends the authorization response
- * to the Relying Party, completing the presentation flow.
- * Use with `presentation_definition`.
- * @deprecated Use `sendAuthorizationResponse`
- */
-export type SendLegacyAuthorizationResponse = (
-  requestObject: Out<VerifyRequestObject>["requestObject"],
-  presentationDefinitionId: string,
-  remotePresentations: LegacyRemotePresentation[],
-  rpConf: RelyingPartyEntityConfiguration["payload"]["metadata"],
-  context?: {
-    appFetch?: GlobalFetch["fetch"];
-  }
-) => Promise<AuthorizationResponse>;
-
-/**
- * Sends the authorization response to the Relying Party (RP) using the specified `response_mode`.
- * This function completes the presentation flow in an OpenID 4 Verifiable Presentations scenario.
- *
- * @param requestObject - The request details, including presentation requirements.
- * @param presentationDefinition - The definition of the expected presentation.
- * @param jwkKeys - Array of JWKs from the Relying Party for optional encryption.
- * @param presentation - Tuple with verifiable credential, claims, and crypto context.
- * @param context - Contains optional custom fetch implementation.
- * @returns Parsed and validated authorization response from the Relying Party.
- */
-export const sendLegacyAuthorizationResponse: SendLegacyAuthorizationResponse =
-  async (
-    requestObject,
-    presentationDefinitionId,
-    remotePresentations,
-    rpConf,
-    { appFetch = fetch } = {}
-  ): Promise<AuthorizationResponse> => {
-    /**
-     * 1. Prepare the VP token and presentation submission
-     * If there is only one credential, `vpToken` is a single string.
-     * If there are multiple credential, `vpToken` is an array of string.
-     **/
-    const vp_token =
-      remotePresentations?.length === 1
-        ? remotePresentations[0]?.vpToken
-        : remotePresentations.map(
-            (remotePresentation) => remotePresentation.vpToken
-          );
-
-    const descriptor_map = remotePresentations.map(
-      (remotePresentation, index) => ({
-        id: remotePresentation.inputDescriptor.id,
-        path: remotePresentations.length === 1 ? `$` : `$[${index}]`,
-        format: remotePresentation.format,
-      })
-    );
-
-    const presentation_submission = {
-      id: uuid.v4(),
-      definition_id: presentationDefinitionId,
-      descriptor_map,
-    };
-
-    const requestBody = await buildDirectPostJwtBody(requestObject, rpConf, {
-      vp_token,
-      presentation_submission,
-    });
-
-    // 3. Send the authorization response via HTTP POST and validate the response
-    return await appFetch(requestObject.response_uri, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-      },
-      body: requestBody,
-    })
-      .then(hasStatusOrThrow(200))
-      .then((res) => res.json())
-      .then(AuthorizationResponse.parse);
-  };
-
-/**
- * Type definition for the function that sends the authorization response
- * to the Relying Party, completing the presentation flow.
- * Use with DCQL queries.
- */
-export type SendAuthorizationResponse = (
-  requestObject: Out<VerifyRequestObject>["requestObject"],
-  remotePresentations: RemotePresentation[],
-  rpConf: RelyingPartyEntityConfiguration["payload"]["metadata"],
-  context?: {
-    appFetch?: GlobalFetch["fetch"];
-  }
-) => Promise<AuthorizationResponse>;
-
-export const sendAuthorizationResponse: SendAuthorizationResponse = async (
-  requestObject,
-  remotePresentations,
-  rpConf,
-  { appFetch = fetch } = {}
-): Promise<AuthorizationResponse> => {
-  // 1. Prepare the VP token as a JSON object with keys corresponding to the DCQL query credential IDs
-  const requestBody = await buildDirectPostJwtBody(requestObject, rpConf, {
-    vp_token: remotePresentations.reduce(
-      (acc, presentation) => ({
-        ...acc,
-        [presentation.credentialId]: presentation.vpToken,
-      }),
-      {} as Record<string, string>
-    ),
-  });
-
-  // 2. Send the authorization response via HTTP POST and validate the response
-  return await appFetch(requestObject.response_uri, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-    },
-    body: requestBody,
-  })
-    .then(hasStatusOrThrow(200))
-    .then((res) => res.json())
-    .then(AuthorizationResponse.parse)
-    .catch(handleAuthorizationResponseError);
-};
-
-/**
- * Type definition for the function that sends the authorization response
- * to the Relying Party, completing the presentation flow.
- */
-export type SendAuthorizationErrorResponse = (
-  requestObject: Out<VerifyRequestObject>["requestObject"],
-  error: { error: ErrorResponse; errorDescription: string },
-  context?: {
-    appFetch?: GlobalFetch["fetch"];
-  }
-) => Promise<AuthorizationResponse>;
-
-/**
- * Sends the authorization error response to the Relying Party (RP) using the specified `response_mode`.
- * This function completes the presentation flow in an OpenID 4 Verifiable Presentations scenario.
- *
- * @param requestObject - The request details, including presentation requirements.
- * @param error - The response error value, with description
- * @param context - Contains optional custom fetch implementation.
- * @returns Parsed and validated authorization response from the Relying Party.
- */
-export const sendAuthorizationErrorResponse: SendAuthorizationErrorResponse =
-  async (
-    requestObject,
-    { error, errorDescription },
-    { appFetch = fetch } = {}
-  ): Promise<AuthorizationResponse> => {
-    const requestBody = await buildDirectPostBody(requestObject, {
-      error,
-      error_description: errorDescription,
-    });
-
-    return await appFetch(requestObject.response_uri, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-      },
-      body: requestBody,
-    })
-      .then(hasStatusOrThrow(200, RelyingPartyResponseError))
-      .then((res) => res.json())
-      .then(AuthorizationResponse.parse);
-  };
-
-/**
- * Handle the the presentation error by mapping it to a custom exception.
- * If the error is not an instance of {@link UnexpectedStatusCodeError}, it is thrown as is.
- * @param e - The error to be handled
- * @throws {RelyingPartyResponseError} with a specific code for more context
- */
-const handleAuthorizationResponseError = (e: unknown) => {
-  if (!(e instanceof UnexpectedStatusCodeError)) {
-    throw e;
-  }
-
-  throw new ResponseErrorBuilder(RelyingPartyResponseError)
-    .handle(400, {
-      code: RelyingPartyResponseErrorCodes.InvalidAuthorizationResponse,
-      message:
-        "The Authorization Response contains invalid parameters or it is malformed",
-    })
-    .handle(403, {
-      code: RelyingPartyResponseErrorCodes.InvalidAuthorizationResponse,
-      message: "The Authorization Response was forbidden",
-    })
-    .handle("*", {
-      code: RelyingPartyResponseErrorCodes.RelyingPartyGenericError,
-      message: "Unable to successfully send the Authorization Response",
-    })
-    .buildFrom(e);
-};

package/src/credential/presentation/errors.ts

@@ -1,112 +0,0 @@
-import { IoWalletError, serializeAttrs } from "../../utils/errors";
-export { DcqlError } from "dcql";
-
-/**
- * An error subclass thrown when auth request decode fail
- *
- */
-export class AuthRequestDecodeError extends IoWalletError {
-  code = "ERR_IO_WALLET_AUTHENTICATION_REQUEST_DECODE_FAILED";
-
-  /** The Claim for which the validation failed. */
-  claim: string;
-
-  /** Reason code for the validation failure. */
-  reason: string;
-
-  constructor(
-    message: string,
-    claim: string = "unspecified",
-    reason: string = "unspecified"
-  ) {
-    super(serializeAttrs({ message, claim, reason }));
-    this.claim = claim;
-    this.reason = reason;
-  }
-}
-
-/**
- * When selecting a public key from an entity configuration, and no one meets the requirements for the scenario
- *
- */
-export class NoSuitableKeysFoundInEntityConfiguration extends IoWalletError {
-  code = "ERR_NO_SUITABLE_KEYS_NOT_FOUND";
-
-  /**
-   * @param scenario describe the scenario in which the error arise
-   */
-  constructor(scenario: string) {
-    const message = `Entity configuration do not provide any suitable keys (${scenario}).`;
-    super(message);
-  }
-}
-
-/**
- * When a QR code is not valid.
- *
- */
-export class InvalidQRCodeError extends IoWalletError {
-  code = "ERR_INVALID_QR_CODE";
-
-  /** Detailed reason for the QR code validation failure. */
-  reason: string;
-
-  constructor(reason: string) {
-    super("Invalid QR code");
-    this.reason = reason;
-  }
-}
-
-/**
- * When the Request Object sent by the Relying Party is not valid
- */
-export class InvalidRequestObjectError extends IoWalletError {
-  code = "ERR_INVALID_REQUEST_OBJECT";
-
-  /** Detailed reason for the Request Object validation failure. */
-  reason: string;
-
-  constructor(message: string, reason = "unspecified") {
-    super(message);
-    this.reason = reason;
-  }
-}
-
-/**
- * When some required data is missing to continue because certain attributes are not contained inside the wallet.
- *
- */
-export class MissingDataError extends IoWalletError {
-  code = "ERR_MISSING_DATA";
-
-  /**
-   * @param missingAttributes An array or description of the attributes that are missing.
-   */
-  constructor(missingAttributes: string) {
-    const message = `Some required data is missing: ${missingAttributes}.`;
-    super(message);
-  }
-}
-
-export type NotFoundDetail = {
-  id: string;
-  reason?: string;
-  vctValues?: string[];
-};
-
-/**
- * Error thrown when one or more credentials cannot be found in the wallet
- * and the presentation request cannot be satisfied.
- */
-export class CredentialsNotFoundError extends IoWalletError {
-  code = "ERR_CREDENTIALS_NOT_FOUND";
-  details: NotFoundDetail[];
-
-  /**
-   * @param details The details of the credentials that could not be found.
-   */
-  constructor(details: NotFoundDetail[]) {
-    super("One or more credentials cannot be found in the wallet");
-    this.details = details;
-  }
-}

package/src/credential/presentation/types.ts

@@ -1,169 +0,0 @@
-import type { CryptoContext } from "@pagopa/io-react-native-jwt";
-import { UnixTime } from "../../sd-jwt/types";
-import * as z from "zod";
-
-/**
- * A pair that associate a tokenized Verified Credential with the claims presented or requested to present.
- */
-export type Presentation = [
-  /* verified credential token */ string,
-  /* claims */ string[],
-  /* the context for the key associated to the credential */ CryptoContext,
-];
-
-/**
- * A object that associate the information needed to multiple remote presentation
- * Used with `presentation_definition`
- * @deprecated Use `RemotePresentation`
- */
-export type LegacyRemotePresentation = {
-  requestedClaims: string[];
-  inputDescriptor: InputDescriptor;
-  format: string;
-  vpToken: string;
-};
-
-/**
- * A object that associate the information needed to multiple remote presentation
- * Used with DCQL queries
- */
-export type RemotePresentation = {
-  requestedClaims: string[];
-  credentialId: string;
-  vpToken: string;
-};
-
-const Fields = z.object({
-  path: z.array(z.string().min(1)), // Array of JSONPath string expressions
-  id: z.string().optional(), // Unique string ID
-  purpose: z.string().optional(), // Purpose of the field
-  name: z.string().optional(), // Human-friendly name
-  filter: z.any().optional(), // JSON Schema descriptor for filtering
-  optional: z.boolean().optional(), // Boolean indicating if the field is optional
-  intent_to_retain: z.boolean().optional(), // Boolean indicating that the Verifier intends to retain the Claim's data being requested
-});
-
-// Define the Constraints Object Schema
-const Constraints = z.object({
-  fields: z.array(Fields).optional(), // Array of Field Objects
-  limit_disclosure: z.enum(["required", "preferred"]).optional(), // Limit disclosure property
-});
-
-// Define the Input Descriptor Object Schema
-export type InputDescriptor = z.infer<typeof InputDescriptor>;
-export const InputDescriptor = z.object({
-  id: z.string().min(1), // Mandatory unique string ID
-  name: z.string().optional(), // Human-friendly name
-  purpose: z.string().optional(), // Purpose of the schema
-  format: z.record(z.string(), z.any()).optional(), // Object with Claim Format Designations
-  constraints: Constraints, // Constraints Object (mandatory)
-  group: z.string().optional(), // Match one of the grouping strings listed in the "from" values of a Submission Requirement Rule
-});
-
-const SubmissionRequirement = z.object({
-  name: z.string().optional(),
-  purpose: z.string().optional(),
-  rule: z.string(), // "all": all group's rules must be present, or "pick": at least group's "count" rules must be present
-  from: z.string().optional(), // MUST contain either a "from" or "from_nested" property
-  from_nested: z
-    .array(
-      z.object({
-        name: z.string().optional(),
-        purpose: z.string().optional(),
-        rule: z.string(),
-        from: z.string(),
-      })
-    )
-    .optional(),
-  count: z.number().optional(),
-  //"count", "min", and "max" may be present with a "pick" rule
-});
-
-export type PresentationDefinition = z.infer<typeof PresentationDefinition>;
-export const PresentationDefinition = z.object({
-  id: z.string(),
-  name: z.string().optional(),
-  purpose: z.string().optional(),
-  input_descriptors: z.array(InputDescriptor),
-  submission_requirements: z.array(SubmissionRequirement).optional(),
-});
-
-export type RequestObject = z.infer<typeof RequestObject>;
-export const RequestObject = z.object({
-  iss: z.string(),
-  iat: UnixTime,
-  exp: UnixTime,
-  state: z.string().optional(),
-  nonce: z.string(),
-  response_uri: z.string(),
-  request_uri_method: z.string().optional(),
-  response_type: z.literal("vp_token"),
-  response_mode: z.literal("direct_post.jwt"),
-  client_id: z.string(),
-  dcql_query: z.record(z.string(), z.any()).optional(), // Validation happens within the `dcql` library, no need to duplicate it here
-  scope: z.string().optional(),
-  presentation_definition: PresentationDefinition.optional(),
-});
-
-export type WalletMetadata = z.infer<typeof WalletMetadata>;
-export const WalletMetadata = z.object({
-  presentation_definition_uri_supported: z.boolean().optional(),
-  client_id_schemes_supported: z.array(z.string()).optional(),
-  request_object_signing_alg_values_supported: z.array(z.string()).optional(),
-  vp_formats_supported: z.record(
-    z.string(), // TODO [SIW-2110]: use explicit credential format?
-    z.object({
-      "sd-jwt_alg_values": z.array(z.string()).optional(), // alg_values_supported?
-    })
-  ),
-  // TODO [SIW-2110]: include other metadata?
-});
-
-/**
- * Wallet capabilities that must be submitted to get the Request Object
- * via POST request when the `request_uri_method` is `post`.
- */
-export type RequestObjectWalletCapabilities = z.infer<
-  typeof RequestObjectWalletCapabilities
->;
-export const RequestObjectWalletCapabilities = z.object({
-  wallet_metadata: WalletMetadata,
-  wallet_nonce: z.string().optional(),
-});
-
-/**
- * This type models the possible error responses the OpenID4VP protocol allows for a presentation of a credential.
- * When the Wallet encounters one of these errors, it will notify the Relying Party through the `response_uri` endpoint.
- * See https://italia.github.io/eid-wallet-it-docs/versione-corrente/en/pid-eaa-presentation.html#authorization-response-errors for more information.
- */
-export type ErrorResponse = z.infer<typeof ErrorResponse>;
-export const ErrorResponse = z.enum([
-  "invalid_request_object",
-  "invalid_request_uri",
-  "vp_formats_not_supported",
-  "invalid_request",
-  "access_denied",
-  "invalid_client",
-]);
-
-/**
- * @deprecated Use `DirectAuthorizationBodyPayload`
- */
-const LegacyDirectAuthorizationBodyPayload = z.object({
-  vp_token: z.union([z.string(), z.array(z.string())]).optional(),
-  presentation_submission: z.record(z.string(), z.unknown()),
-});
-
-/**
- * Authorization Response payload sent to the Relying Party.
- */
-export type DirectAuthorizationBodyPayload = z.infer<
-  typeof DirectAuthorizationBodyPayload
->;
-export const DirectAuthorizationBodyPayload = z.union([
-  z.object({
-    vp_token: z.record(z.string(), z.string()),
-  }),
-  z.object({ error: ErrorResponse, error_description: z.string() }),
-  LegacyDirectAuthorizationBodyPayload,
-]);

package/src/credential/status/01-start-flow.ts

@@ -1,9 +0,0 @@
-/**
- * WARNING: This is the first function to be called in the status attestation flow. The next function to be called is {@link statusAttestation}.
- * The beginning of the status attestation flow.
- *
- * @returns The url of the credential issuer to be used in the next function.
- */
-export type StartFlow = () => {
-  issuerUrl: string;
-};