@pagopa/io-react-native-wallet 2.5.0 → 3.0.0

package/src/trust/types.ts

@@ -1,259 +0,0 @@
-import { UnixTime } from "../sd-jwt/types";
-import { JWK } from "../utils/jwk";
-import * as z from "zod";
-import { PresentationDefinition } from "../credential/presentation/types";
-
-export const TrustMark = z.object({ id: z.string(), trust_mark: z.string() });
-export type TrustMark = z.infer<typeof TrustMark>;
-
-const RelyingPartyMetadata = z.object({
-  application_type: z.string().optional(),
-  client_id: z.string().optional(),
-  client_name: z.string().optional(),
-  jwks: z.object({ keys: z.array(JWK) }),
-  contacts: z.array(z.string()).optional(),
-  presentation_definition: PresentationDefinition.optional(),
-  request_uris: z.array(z.string()).optional(),
-  authorization_signed_response_alg: z.string().optional(),
-  authorization_encrypted_response_alg: z.string().optional(),
-  authorization_encrypted_response_enc: z.string().optional(),
-});
-
-// Display metadata for a credential, used by the issuer to
-// instruct the Wallet Solution on how to render the credential correctly
-type CredentialDisplayMetadata = z.infer<typeof CredentialDisplayMetadata>;
-const CredentialDisplayMetadata = z.object({
-  name: z.string(),
-  locale: z.string(),
-});
-
-// Metadata for displaying issuer information
-type CredentialIssuerDisplayMetadata = z.infer<
-  typeof CredentialIssuerDisplayMetadata
->;
-const CredentialIssuerDisplayMetadata = z.object({
-  name: z.string(),
-  locale: z.string(),
-});
-
-type ClaimsMetadata = z.infer<typeof ClaimsMetadata>;
-const ClaimsMetadata = z.object({
-  path: z.array(z.union([z.string(), z.number(), z.null()])), // https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-15.html#name-claims-path-pointer
-  display: z.array(CredentialDisplayMetadata),
-});
-
-type IssuanceErrorSupported = z.infer<typeof IssuanceErrorSupported>;
-const IssuanceErrorSupported = z.object({
-  display: z.array(
-    z.object({
-      title: z.string(),
-      description: z.string(),
-      locale: z.string(),
-    })
-  ),
-});
-
-// Metadata for a credential which is supported by an Issuer
-type SupportedCredentialMetadata = z.infer<typeof SupportedCredentialMetadata>;
-const SupportedCredentialMetadata = z.intersection(
-  z.discriminatedUnion("format", [
-    z.object({ format: z.literal("dc+sd-jwt"), vct: z.string() }),
-    z.object({ format: z.literal("mso_mdoc"), doctype: z.string() }),
-  ]),
-  z.object({
-    scope: z.string(),
-    display: z.array(CredentialDisplayMetadata),
-    claims: z.array(ClaimsMetadata),
-    cryptographic_binding_methods_supported: z.array(z.string()),
-    credential_signing_alg_values_supported: z.array(z.string()),
-    authentic_source: z.string().optional(),
-    issuance_errors_supported: z.record(IssuanceErrorSupported).optional(),
-  })
-);
-
-/**
- * Supported formats for credentials issued by the Issuer API 1.0,
- * compliant with IT-Wallet technical specifications 1.0.
- */
-export type SupportedCredentialFormat = z.infer<
-  typeof SupportedCredentialMetadata
->["format"];
-
-export type EntityStatement = z.infer<typeof EntityStatement>;
-export const EntityStatement = z.object({
-  header: z.object({
-    typ: z.literal("entity-statement+jwt"),
-    alg: z.string(),
-    kid: z.string(),
-  }),
-  payload: z.object({
-    iss: z.string(),
-    sub: z.string(),
-    jwks: z.object({ keys: z.array(JWK) }),
-    trust_marks: z.array(TrustMark).optional(),
-    iat: z.number(),
-    exp: z.number(),
-  }),
-});
-
-export type EntityConfigurationHeader = z.infer<
-  typeof EntityConfigurationHeader
->;
-export const EntityConfigurationHeader = z.object({
-  typ: z.literal("entity-statement+jwt"),
-  alg: z.string(),
-  kid: z.string(),
-});
-
-/**
- * @see https://openid.net/specs/openid-federation-1_0-41.html
- */
-const FederationEntityMetadata = z
-  .object({
-    federation_fetch_endpoint: z.string().optional(),
-    federation_list_endpoint: z.string().optional(),
-    federation_resolve_endpoint: z.string().optional(),
-    federation_trust_mark_status_endpoint: z.string().optional(),
-    federation_trust_mark_list_endpoint: z.string().optional(),
-    federation_trust_mark_endpoint: z.string().optional(),
-    federation_historical_keys_endpoint: z.string().optional(),
-    endpoint_auth_signing_alg_values_supported: z.string().optional(),
-    organization_name: z.string().optional(),
-    homepage_uri: z.string().optional(),
-    policy_uri: z.string().optional(),
-    logo_uri: z.string().optional(),
-    contacts: z.array(z.string()).optional(),
-  })
-  .passthrough();
-
-// Structure common to every Entity Configuration document
-const BaseEntityConfiguration = z.object({
-  header: EntityConfigurationHeader,
-  payload: z
-    .object({
-      iss: z.string(),
-      sub: z.string(),
-      iat: UnixTime,
-      exp: UnixTime,
-      authority_hints: z.array(z.string()).optional(),
-      metadata: z
-        .object({
-          federation_entity: FederationEntityMetadata,
-        })
-        .passthrough(),
-      jwks: z.object({
-        keys: z.array(JWK),
-      }),
-    })
-    .passthrough(),
-});
-
-// Entity configuration for a Trust Anchor (it has no specific metadata section)
-export type TrustAnchorEntityConfiguration = z.infer<
-  typeof TrustAnchorEntityConfiguration
->;
-export const TrustAnchorEntityConfiguration = BaseEntityConfiguration;
-
-// Entity configuration for a Credential Issuer
-export type CredentialIssuerEntityConfiguration = z.infer<
-  typeof CredentialIssuerEntityConfiguration
->;
-export const CredentialIssuerEntityConfiguration = BaseEntityConfiguration.and(
-  z.object({
-    payload: z.object({
-      jwks: z.object({ keys: z.array(JWK) }),
-      metadata: z.object({
-        openid_credential_issuer: z.object({
-          credential_issuer: z.string(),
-          credential_endpoint: z.string(),
-          revocation_endpoint: z.string().optional(),
-          nonce_endpoint: z.string(),
-          status_attestation_endpoint: z.string(),
-          display: z.array(CredentialIssuerDisplayMetadata),
-          credential_configurations_supported: z.record(
-            SupportedCredentialMetadata
-          ),
-          jwks: z.object({ keys: z.array(JWK) }),
-          trust_frameworks_supported: z.array(z.string()),
-          evidence_supported: z.array(z.string()),
-        }),
-        oauth_authorization_server: z.object({
-          authorization_endpoint: z.string(),
-          pushed_authorization_request_endpoint: z.string(),
-          token_endpoint: z.string(),
-          client_registration_types_supported: z.array(z.string()),
-          code_challenge_methods_supported: z.array(z.string()),
-          acr_values_supported: z.array(z.string()),
-          grant_types_supported: z.array(z.string()),
-          issuer: z.string(),
-          jwks: z.object({ keys: z.array(JWK) }),
-          scopes_supported: z.array(z.string()),
-          response_modes_supported: z.array(z.string()),
-          token_endpoint_auth_methods_supported: z.array(z.string()),
-          token_endpoint_auth_signing_alg_values_supported: z.array(z.string()),
-          request_object_signing_alg_values_supported: z.array(z.string()),
-        }),
-        /**
-         * Credential Issuers act as Relying Party when they require the presentation of other credentials.
-         * This does not apply for PID issuance, which requires CIE authz.
-         */
-        openid_credential_verifier: RelyingPartyMetadata.optional(),
-      }),
-    }),
-  })
-);
-
-// Entity configuration for a Relying Party
-export type RelyingPartyEntityConfiguration = z.infer<
-  typeof RelyingPartyEntityConfiguration
->;
-export const RelyingPartyEntityConfiguration = BaseEntityConfiguration.and(
-  z.object({
-    payload: z.object({
-      metadata: z.object({
-        openid_credential_verifier: RelyingPartyMetadata,
-      }),
-    }),
-  })
-);
-
-// Entity configuration for a Wallet Provider
-export type WalletProviderEntityConfiguration = z.infer<
-  typeof WalletProviderEntityConfiguration
->;
-export const WalletProviderEntityConfiguration = BaseEntityConfiguration.and(
-  z.object({
-    payload: z.object({
-      metadata: z.object({
-        wallet_provider: z
-          .object({
-            token_endpoint: z.string(),
-            aal_values_supported: z.array(z.string()).optional(),
-            grant_types_supported: z.array(z.string()),
-            token_endpoint_auth_methods_supported: z.array(z.string()),
-            token_endpoint_auth_signing_alg_values_supported: z.array(
-              z.string()
-            ),
-            jwks: z.object({ keys: z.array(JWK) }),
-          })
-          .passthrough(),
-      }),
-    }),
-  })
-);
-
-// Maps any entity configuration by the union of every possible shapes
-export type EntityConfiguration = z.infer<typeof EntityConfiguration>;
-export const EntityConfiguration = z.union(
-  [
-    WalletProviderEntityConfiguration,
-    CredentialIssuerEntityConfiguration,
-    TrustAnchorEntityConfiguration,
-    RelyingPartyEntityConfiguration,
-  ],
-  {
-    description: "Any kind of Entity Configuration allowed in the ecosystem",
-  }
-);
-
-export const FederationListResponse = z.array(z.string());

package/src/trust/utils.ts

@@ -1,70 +0,0 @@
-import {
-  decode as decodeJwt,
-  verify as verifyJwt,
-} from "@pagopa/io-react-native-jwt";
-
-import type { JWK, JWTDecodeResult } from "../utils/jwk";
-import { FederationError } from "./errors";
-import type { TrustAnchorEntityConfiguration } from "./types";
-
-export type ParsedToken = {
-  header: JWTDecodeResult["protectedHeader"];
-  payload: JWTDecodeResult["payload"];
-};
-
-// Verify a token signature
-// The kid is extracted from the token header
-export const verify = async (
-  token: string,
-  kid: string,
-  jwks: JWK[]
-): Promise<ParsedToken> => {
-  const jwk = jwks.find((k) => k.kid === kid);
-  if (!jwk) {
-    throw new Error(`Invalid kid: ${kid}, token: ${token}`);
-  }
-  const { protectedHeader: header, payload } = await verifyJwt(token, jwk);
-  return { header, payload };
-};
-
-/**
- * Return type for this function is necessary to avoid an issue during the bob build process.
- * It seems like typescript can't correctly infer the return type of the function.
- */
-export const decode = (token: string): ParsedToken => {
-  const { protectedHeader: header, payload } = decodeJwt(token);
-  return { header, payload };
-};
-
-/**
- * Extracts the X.509 Trust Anchor certificate (Base64 encoded) from the
- * Trust Anchor's Entity Configuration.
- *
- * @param trustAnchorEntity The entity configuration of the known trust anchor.
- * @returns The Base64 encoded X.509 certificate string.
- * @throws {FederationError} If the certificate cannot be derived.
- */
-export function getTrustAnchorX509Certificate(
-  trustAnchorEntity: TrustAnchorEntityConfiguration
-): string {
-  const taHeaderKid = trustAnchorEntity.header.kid;
-  const taSigningJwk = trustAnchorEntity.payload.jwks.keys.find(
-    (key) => key.kid === taHeaderKid
-  );
-
-  if (!taSigningJwk) {
-    throw new FederationError(
-      `Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' not found in Trust Anchor's JWKS.`,
-      { trustAnchorKid: taHeaderKid, reason: "JWK not found for header kid" }
-    );
-  }
-
-  if (taSigningJwk.x5c && taSigningJwk.x5c.length > 0 && taSigningJwk.x5c[0]) {
-    return taSigningJwk.x5c[0];
-  }
-
-  throw new FederationError(
-    `Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' does not contain a valid 'x5c' certificate array.`,
-    { trustAnchorKid: taHeaderKid, reason: "Missing or empty x5c in JWK" }
-  );
-}

package/src/trust/verify-chain.ts

@@ -1,267 +0,0 @@
-import {
-  EntityConfiguration,
-  EntityStatement,
-  TrustAnchorEntityConfiguration,
-} from "./types";
-import { JWK } from "../utils/jwk";
-import * as z from "zod";
-import {
-  decode,
-  getTrustAnchorX509Certificate,
-  type ParsedToken,
-  verify,
-} from "./utils";
-import {
-  FederationError,
-  MissingFederationFetchEndpointError,
-  MissingX509CertsError,
-  TrustChainEmptyError,
-  TrustChainRenewalError,
-  TrustChainTokenMissingError,
-  X509ValidationError,
-} from "./errors";
-import {
-  type CertificateValidationResult,
-  verifyCertificateChain,
-  type X509CertificateOptions,
-} from "@pagopa/io-react-native-crypto";
-import {
-  getSignedEntityConfiguration,
-  getSignedEntityStatement,
-} from "./build-chain";
-
-// The first element of the chain is supposed to be the Entity Configuration for the document issuer
-const FirstElementShape = EntityConfiguration;
-// Each element but the first is supposed to be an Entity Statement
-const MiddleElementShape = EntityStatement;
-// The last element of the chain can either be an Entity Statement
-//  or the Entity Configuration for the known Trust Anchor
-const LastElementShape = z.union([
-  EntityStatement,
-  TrustAnchorEntityConfiguration,
-]);
-
-/**
- * Validates a provided trust chain against a known trust anchor, including X.509 certificate checks.
- *
- * @param trustAnchorEntity The entity configuration of the known trust anchor (for JWT validation).
- * @param chain The chain of statements to be validated.
- * @param x509Options Options for X.509 certificate validation.
- * @returns The list of parsed tokens representing the chain.
- * @throws {FederationError} If the chain is not valid (JWT or X.509). Specific errors like TrustChainEmptyError, X509ValidationError may be thrown.
- */
-export async function validateTrustChain(
-  trustAnchorEntity: TrustAnchorEntityConfiguration,
-  chain: string[],
-  x509Options: X509CertificateOptions
-): Promise<ParsedToken[]> {
-  // If the chain is empty, fail
-  if (chain.length === 0) {
-    throw new TrustChainEmptyError("Cannot verify empty trust chain.");
-  }
-
-  // Select the expected token shape
-  const selectTokenShape = (elementIndex: number) =>
-    elementIndex === 0
-      ? FirstElementShape
-      : elementIndex === chain.length - 1
-        ? LastElementShape
-        : MiddleElementShape;
-
-  // Select the kid from the current index
-  const selectKid = (currentIndex: number): string => {
-    const token = chain[currentIndex];
-    if (!token) {
-      throw new TrustChainTokenMissingError(
-        `Token missing at index ${currentIndex} in trust chain.`,
-        { index: currentIndex }
-      );
-    }
-    const shape = selectTokenShape(currentIndex);
-    return shape.parse(decode(token)).header.kid;
-  };
-
-  // Select keys from the next token
-  // If the current token is the last, keys from trust anchor will be used
-  const selectKeys = (currentIndex: number): JWK[] => {
-    if (currentIndex === chain.length - 1) {
-      return trustAnchorEntity.payload.jwks.keys;
-    }
-
-    const nextIndex = currentIndex + 1;
-    const nextToken = chain[nextIndex];
-    if (!nextToken) {
-      throw new TrustChainTokenMissingError(
-        `Next token missing at index ${nextIndex} (needed for keys for token at ${currentIndex}).`,
-        { index: nextIndex }
-      );
-    }
-    const shape = selectTokenShape(nextIndex);
-    return shape.parse(decode(nextToken)).payload.jwks.keys;
-  };
-
-  const x509TrustAnchorCertBase64 =
-    getTrustAnchorX509Certificate(trustAnchorEntity);
-
-  // Iterate the chain and validate each element's signature against the public keys of its next
-  // If there is no next, hence it's the end of the chain, and it must be verified by the Trust Anchor
-  const validationPromises = chain.map(async (tokenString, i) => {
-    const kidFromTokenHeader = selectKid(i);
-    const signerJwks = selectKeys(i);
-
-    // Step 1: Verify JWT signature
-    const parsedToken = await verify(
-      tokenString,
-      kidFromTokenHeader,
-      signerJwks
-    );
-
-    // Step 2: X.509 Certificate Chain Validation
-    const jwkUsedForVerification = signerJwks.find(
-      (k) => k.kid === kidFromTokenHeader
-    );
-
-    if (!jwkUsedForVerification) {
-      throw new FederationError(
-        `JWK with kid '${kidFromTokenHeader}' was not found in signer's JWKS for token at index ${i}, though JWT verification passed.`,
-        { tokenIndex: i, kid: kidFromTokenHeader }
-      );
-    }
-
-    if (
-      !jwkUsedForVerification.x5c ||
-      jwkUsedForVerification.x5c.length === 0
-    ) {
-      throw new MissingX509CertsError(
-        `JWK with kid '${kidFromTokenHeader}' does not contain an X.509 certificate chain (x5c) for token at index ${i}.`
-      );
-    }
-
-    // If the chain has more than one certificate AND
-    // the last certificate in the x5c chain is the same as the trust anchor,
-    // remove the anchor from the chain being passed, as it's supplied separately.
-    const certChainBase64 =
-      jwkUsedForVerification.x5c.length > 1 &&
-      jwkUsedForVerification.x5c.at(-1) === x509TrustAnchorCertBase64
-        ? jwkUsedForVerification.x5c.slice(0, -1)
-        : jwkUsedForVerification.x5c;
-
-    const x509ValidationResult: CertificateValidationResult =
-      await verifyCertificateChain(
-        certChainBase64,
-        x509TrustAnchorCertBase64,
-        x509Options
-      );
-
-    if (!x509ValidationResult.isValid) {
-      throw new X509ValidationError(
-        `X.509 certificate chain validation failed for token at index ${i} (kid: ${kidFromTokenHeader}). Status: ${x509ValidationResult.validationStatus}. Error: ${x509ValidationResult.errorMessage}`,
-        {
-          tokenIndex: i,
-          kid: kidFromTokenHeader,
-          x509ValidationStatus: x509ValidationResult.validationStatus,
-          x509ErrorMessage: x509ValidationResult.errorMessage,
-        }
-      );
-    }
-    return parsedToken;
-  });
-
-  return Promise.all(validationPromises);
-}
-
-/**
- * Given a trust chain, obtain a new trust chain by fetching each element's fresh version
- *
- * @param chain The original chain
- * @param appFetch (optional) fetch api implementation
- * @returns A list of signed token that represent the trust chain, in the same order of the provided chain
- * @throws {FederationError} If the chain is not valid
- */
-export async function renewTrustChain(
-  chain: string[],
-  appFetch: GlobalFetch["fetch"] = fetch
-): Promise<string[]> {
-  return Promise.all(
-    chain.map(async (token, index) => {
-      const decoded = decode(token);
-
-      const entityStatementResult = EntityStatement.safeParse(decoded);
-      const entityConfigurationResult = EntityConfiguration.safeParse(decoded);
-
-      if (entityConfigurationResult.success) {
-        return getSignedEntityConfiguration(
-          entityConfigurationResult.data.payload.iss,
-          { appFetch }
-        );
-      }
-      if (entityStatementResult.success) {
-        const entityStatement = entityStatementResult.data;
-
-        const parentBaseUrl = entityStatement.payload.iss;
-        const parentECJwt = await getSignedEntityConfiguration(parentBaseUrl, {
-          appFetch,
-        });
-        const parentEC = EntityConfiguration.parse(decode(parentECJwt));
-
-        const federationFetchEndpoint =
-          parentEC.payload.metadata.federation_entity.federation_fetch_endpoint;
-        if (!federationFetchEndpoint) {
-          throw new MissingFederationFetchEndpointError(
-            `Parent EC at ${parentBaseUrl} is missing federation_fetch_endpoint, cannot renew ES for ${entityStatement.payload.sub}.`,
-            {
-              entityBaseUrl: entityStatement.payload.sub,
-              missingInEntityUrl: parentBaseUrl,
-            }
-          );
-        }
-        return getSignedEntityStatement(
-          federationFetchEndpoint,
-          entityStatement.payload.sub,
-          { appFetch }
-        );
-      }
-      throw new TrustChainRenewalError(
-        `Failed to renew trust chain. Reason: element #${index} failed to parse.`,
-        { originalChain: chain }
-      );
-    })
-  );
-}
-
-/**
- * Verify a given trust chain is actually valid.
- * It can handle fast chain renewal, which means we try to fetch a fresh version of each statement.
- *
- * @param trustAnchorEntity The entity configuration of the known trust anchor
- * @param chain The chain of statements to be validated
- * @param x509Options Options for the verification process
- * @param appFetch (optional) fetch api implementation
- * @param renewOnFail Whether to attempt to renew the trust chain if the initial validation fails
- * @returns The result of the chain validation
- * @throws {FederationError} If the chain is not valid
- */
-export async function verifyTrustChain(
-  trustAnchorEntity: TrustAnchorEntityConfiguration,
-  chain: string[],
-  x509Options: X509CertificateOptions = {
-    connectTimeout: 10000,
-    readTimeout: 10000,
-    requireCrl: true,
-  },
-  {
-    appFetch = fetch,
-    renewOnFail = true,
-  }: { appFetch?: GlobalFetch["fetch"]; renewOnFail?: boolean } = {}
-): Promise<ReturnType<typeof validateTrustChain>> {
-  try {
-    return validateTrustChain(trustAnchorEntity, chain, x509Options);
-  } catch (error) {
-    if (renewOnFail) {
-      const renewedChain = await renewTrustChain(chain, appFetch);
-      return validateTrustChain(trustAnchorEntity, renewedChain, x509Options);
-    } else {
-      throw error;
-    }
-  }
-}