@pagopa/io-react-native-wallet 2.5.0 → 3.0.0

package/src/credential/issuance/mrtd-pop/01-verify-and-parse-challenge-info.ts

@@ -1,70 +1,25 @@
-import {
-  decode as decodeJwt,
-  verify as verifyJwt,
-  type CryptoContext,
-} from "@pagopa/io-react-native-jwt";
-import { MrtdProofChallengeInfo } from "./types";
-import type { EvaluateIssuerTrust } from "../../issuance";
-import type { Out } from "../../../utils/misc";
+import { verifyMrtdChallenge } from "@pagopa/io-wallet-oauth2";
 import { IoWalletError } from "../../../utils/errors";
+import { createVerifyJwtFromJwks } from "../../../utils/callbacks";
+import type { MRTDPoPApi } from "../api/mrtd-pop";
 
-export type VerifyAndParseChallengeInfo = (
-  issuerConf: Out<EvaluateIssuerTrust>["issuerConf"],
-  challengeInfoJwt: string,
-  context: {
-    wiaCryptoContext: CryptoContext;
-  }
-) => Promise<MrtdProofChallengeInfo["payload"]>;
+export const verifyAndParseChallengeInfo: MRTDPoPApi["verifyAndParseChallengeInfo"] =
+  async (issuerConf, challengeInfoJwt, { wiaCryptoContext }) => {
+    const clientId = await wiaCryptoContext.getPublicKey().then((x) => x.kid);
 
-/**
- * Verifies and parses the payload of a MRTD Proof Challenge Info JWT obtained after the primary authentication.
- *
- * This function performs the following steps:
- * 1. Validates the JWT signature using the issuer's JWKS.
- * 2. Decodes the JWT and parses its structure according to the {@link MrtdProofChallengeInfo} schema.
- * 3. Verifies that the `aud` claim matches the client's public key ID.
- * 4. Checks that the JWT is not expired and was not issued in the future.
- *
- * @param issuerConf - The issuer configuration containing the JWKS for signature verification.
- * @param challengeInfoJwt - The JWT string representing the MRTD Proof Challenge Info.
- * @param context - The context containing the WIA crypto context used to retrieve the client public key.
- * @returns The parsed payload of the MRTD Proof Challenge Info JWT.
- * @throws {Error} If the JWT signature is invalid, the structure is malformed, the `aud` claim does not match,
- * or the JWT is expired/not yet valid.
- */
-export const verifyAndParseChallengeInfo: VerifyAndParseChallengeInfo = async (
-  issuerConf,
-  challengeInfoJwt: string,
-  { wiaCryptoContext }
-) => {
-  // Verify JWT signature
-  await verifyJwt(
-    challengeInfoJwt,
-    issuerConf.oauth_authorization_server.jwks.keys
-  );
+    if (!clientId) {
+      throw new IoWalletError(
+        "Could not extract client_id from Wallet Attestation"
+      );
+    }
 
-  // Decode JWT
-  const challengeInfoDecoded = decodeJwt(challengeInfoJwt);
+    const verified = await verifyMrtdChallenge({
+      challengeJwt: challengeInfoJwt,
+      clientId,
+      callbacks: {
+        verifyJwt: createVerifyJwtFromJwks(issuerConf.keys),
+      },
+    });
 
-  // Parse and validate structure
-  const challengeInfoParsed =
-    MrtdProofChallengeInfo.safeParse(challengeInfoDecoded);
-  if (!challengeInfoParsed.success) {
-    throw new IoWalletError("Malformed challenge info.");
-  }
-  const payload = challengeInfoParsed.data.payload;
-
-  // Verify aud claim
-  const clientId = await wiaCryptoContext.getPublicKey().then((_) => _.kid);
-  if (payload.aud !== clientId) {
-    throw new IoWalletError("aud claim does not match client_id.");
-  }
-
-  // Verify iat and exp
-  const now = Math.floor(Date.now() / 1000);
-  if (payload.iat > now || payload.exp < now) {
-    throw new IoWalletError("JWT is not valid (issued in future or expired).");
-  }
-
-  return payload;
-};
+    return verified.payload;
+  };

package/src/credential/issuance/mrtd-pop/02-init-challenge.ts

@@ -1,44 +1,18 @@
-import { hasStatusOrThrow, type Out } from "../../../utils/misc";
-import type { CryptoContext } from "@pagopa/io-react-native-jwt";
 import { v4 as uuidv4 } from "uuid";
+import { fetchMrtdPopInit } from "@pagopa/io-wallet-oauth2";
+import { UnexpectedStatusCodeError as SdkUnexpectedStatusCodeError } from "@pagopa/io-wallet-utils";
 import { createPopToken } from "../../../utils/pop";
 import { Logger, LogLevel } from "../../../utils/logging";
-import * as WalletInstanceAttestation from "../../../wallet-instance-attestation";
-import type { EvaluateIssuerTrust } from "../../issuance";
+import * as WalletInstanceAttestation from "../../../wallet-instance-attestation/v1.0.0/utils"; // TODO: decouple from version 1.0.0
 import {
   IssuerResponseError,
   IssuerResponseErrorCodes,
   ResponseErrorBuilder,
-  UnexpectedStatusCodeError,
 } from "../../../utils/errors";
-import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
-import { MrtdPoPChallenge } from "./types";
+import type { MRTDPoPApi } from "../api/mrtd-pop";
+import { createVerifyJwtFromJwks } from "../../../utils/callbacks";
 
-export type InitChallenge = (
-  issuerConf: Out<EvaluateIssuerTrust>["issuerConf"],
-  initUrl: string,
-  mrtd_auth_session: string,
-  mrtd_pop_jwt_nonce: string,
-  context: {
-    wiaCryptoContext: CryptoContext;
-    walletInstanceAttestation: string;
-    appFetch?: GlobalFetch["fetch"];
-  }
-) => Promise<MrtdPoPChallenge["payload"]>;
-
-/**
- * Initialaizes the MRTD challenge with the data received from the issuer after the primary authentication.
- * This function must be called after {@link verifyAndParseChallengeInfo}.
- *
- * @param issuerConf - The issuer configuration containing the JWKS for signature verification.
- * @param initUrl - The endpoint to call to initialize the challenge.
- * @param mrtd_auth_session - Session identifier for session binding obtained from the MRTD Proof JWT.
- * @param mrtd_pop_jwt_nonce - Nonce value obtained from the MRTD Proof JWT.
- * @param context - The context containing the WIA crypto context used to retrieve the client public key,
- * the wallet instance attestation and an optional fetch implementation.
- * @returns The payload of the MRTD PoP Challenge JWT.
- */
-export const initChallenge: InitChallenge = async (
+export const initChallenge: MRTDPoPApi["initChallenge"] = async (
   issuerConf,
   initUrl,
   mrtd_auth_session,
@@ -51,47 +25,42 @@ export const initChallenge: InitChallenge = async (
     wiaCryptoContext,
   } = context;
 
-  const aud = issuerConf.openid_credential_issuer.credential_issuer;
   const iss = WalletInstanceAttestation.decode(walletInstanceAttestation)
     .payload.cnf.jwk.kid;
 
   const signedWiaPoP = await createPopToken(
     {
-      jti: `${uuidv4()}`,
-      aud,
+      jti: uuidv4(),
+      aud: issuerConf.credential_issuer,
       iss,
     },
     wiaCryptoContext
   );
 
-  const requestBody = {
-    mrtd_auth_session,
-    mrtd_pop_jwt_nonce,
-  };
-
-  const mrtdPoPChallengeJwt = await appFetch(initUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "OAuth-Client-Attestation": walletInstanceAttestation,
-      "OAuth-Client-Attestation-PoP": signedWiaPoP,
+  const initResult = await fetchMrtdPopInit({
+    popInitEndpoint: initUrl,
+    mrtdAuthSession: mrtd_auth_session,
+    mrtdPopJwtNonce: mrtd_pop_jwt_nonce,
+    walletAttestation: walletInstanceAttestation,
+    clientAttestationDPoP: signedWiaPoP,
+    callbacks: {
+      verifyJwt: createVerifyJwtFromJwks(issuerConf.keys),
+      fetch: appFetch,
     },
-    body: JSON.stringify(requestBody),
-  })
-    .then(hasStatusOrThrow(202))
-    .then((res) => res.text())
-    .catch(handleInitChallengeError);
-
-  const mrtdPoPChallengeDecoded = decodeJwt(mrtdPoPChallengeJwt);
-  const { payload } = MrtdPoPChallenge.parse(mrtdPoPChallengeDecoded);
+  }).catch(handleInitChallengeError);
 
-  return payload;
+  return {
+    challenge: initResult.challenge,
+    mrtd_pop_nonce: initResult.mrtdPopNonce,
+    pop_verify_endpoint: initResult.popVerifyEndpoint,
+    mrz: initResult.mrz,
+  };
 };
 
 const handleInitChallengeError = (e: unknown) => {
   Logger.log(LogLevel.ERROR, `Failed to get MRTD challenge: ${e}`);
 
-  if (!(e instanceof UnexpectedStatusCodeError)) {
+  if (!(e instanceof SdkUnexpectedStatusCodeError)) {
     throw e;
   }
 

package/src/credential/issuance/mrtd-pop/03-validate-challenge.ts

@@ -1,55 +1,13 @@
-import { SignJWT, type CryptoContext } from "@pagopa/io-react-native-jwt";
+import { SignJWT } from "@pagopa/io-react-native-jwt";
+import { fetchMrtdPopVerify } from "@pagopa/io-wallet-oauth2";
 import { v4 as uuidv4 } from "uuid";
-import { IssuerResponseError } from "../../../utils/errors";
-import { hasStatusOrThrow, type Out } from "../../../utils/misc";
 import { createPopToken } from "../../../utils/pop";
-import * as WalletInstanceAttestation from "../../../wallet-instance-attestation";
-import type { EvaluateIssuerTrust } from "../../issuance";
-import {
-  MrtdPopVerificationResult,
-  type IasPayload,
-  type MrtdPayload,
-} from "./types";
-import type { VerifyAndParseChallengeInfo } from "./01-verify-and-parse-challenge-info";
+import * as WalletInstanceAttestation from "../../../wallet-instance-attestation/v1.0.0/utils"; // TODO: decouple from 1.0.0 version
+import { sdkUnexpectedStatusCodeToIssuerError } from "../../../utils/errors";
+import { partialCallbacks } from "../../../utils/callbacks";
+import type { MRTDPoPApi } from "../api/mrtd-pop";
 
-export type ValidateChallenge = (
-  issuerConf: Out<EvaluateIssuerTrust>["issuerConf"],
-  verifyUrl: string,
-  mrtd_auth_session: string,
-  mrtd_pop_nonce: string,
-  mrtd: MrtdPayload,
-  ias: IasPayload,
-  context: {
-    wiaCryptoContext: CryptoContext;
-    walletInstanceAttestation: string;
-    appFetch?: GlobalFetch["fetch"];
-  }
-) => Promise<MrtdPopVerificationResult>;
-
-export type BuildChallengeCallbackUrl = (
-  redirectUri: Out<ValidateChallenge>["redirect_uri"],
-  valPopNonce: Out<ValidateChallenge>["mrtd_val_pop_nonce"],
-  authSession: Out<VerifyAndParseChallengeInfo>["mrtd_auth_session"]
-) => Promise<{
-  callbackUrl: string;
-}>;
-
-/**
- * Validates the MRTD signed challenge by sending the MRTD and IAS payloads to the issuer.
- * This function must be called after {@link initChallenge} and after obtaining the MRTD and IAS payloads
- * through the CIE PACE process.
- *
- * @param issuerConf - The issuer configuration containing the JWKS for signature verification.
- * @param verifyUrl - The endpoint to call to validate the challenge.
- * @param mrtd_auth_session - Session identifier for session binding obtained from the MRTD Proof JWT.
- * @param mrtd_pop_nonce - Nonce value obtained from the MRTD Proof JWT.
- * @param mrtd - MRTD validation data containing Data Groups and SOD.
- * @param ias - IAS validation data containing Anti-Cloning Public Key, and SOD.
- * @param context - The context containing the WIA crypto context used to retrieve the client public key,
- * the wallet instance attestation and an optional fetch implementation.
- * @returns The MRTD PoP Verification Result containing the validation nonce and redirect URI to complete the flow.
- */
-export const validateChallenge: ValidateChallenge = async (
+export const validateChallenge: MRTDPoPApi["validateChallenge"] = async (
   issuerConf,
   verifyUrl,
   mrtd_auth_session,
@@ -64,13 +22,13 @@ export const validateChallenge: ValidateChallenge = async (
     wiaCryptoContext,
   } = context;
 
-  const aud = issuerConf.openid_credential_issuer.credential_issuer;
+  const aud = issuerConf.credential_issuer;
   const iss = WalletInstanceAttestation.decode(walletInstanceAttestation)
     .payload.cnf.jwk.kid;
 
   const signedWiaPoP = await createPopToken(
     {
-      jti: `${uuidv4()}`,
+      jti: uuidv4(),
       aud,
       iss,
     },
@@ -79,7 +37,7 @@ export const validateChallenge: ValidateChallenge = async (
 
   const { kid } = await wiaCryptoContext.getPublicKey();
 
-  const mrtd_validation_jwt = await new SignJWT(wiaCryptoContext)
+  const mrtdValidationJwt = await new SignJWT(wiaCryptoContext)
     .setProtectedHeader({
       typ: "mrtd-ias+jwt",
       kid,
@@ -95,46 +53,32 @@ export const validateChallenge: ValidateChallenge = async (
     .setExpirationTime("5m")
     .sign();
 
-  const requestBody = {
-    mrtd_validation_jwt,
-    mrtd_auth_session,
-    mrtd_pop_nonce,
-  };
-
-  const verifyResult = await appFetch(verifyUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "OAuth-Client-Attestation": walletInstanceAttestation,
-      "OAuth-Client-Attestation-PoP": signedWiaPoP,
+  const verifyResult = await fetchMrtdPopVerify({
+    popVerifyEndpoint: verifyUrl,
+    mrtdAuthSession: mrtd_auth_session,
+    mrtdPopNonce: mrtd_pop_nonce,
+    clientAttestationDPoP: signedWiaPoP,
+    mrtdValidationJwt,
+    walletAttestation: walletInstanceAttestation,
+    callbacks: {
+      fetch: appFetch,
+      ...partialCallbacks,
     },
-    body: JSON.stringify(requestBody),
-  })
-    .then(hasStatusOrThrow(202, IssuerResponseError))
-    .then((res) => res.json());
+  }).catch(sdkUnexpectedStatusCodeToIssuerError);
 
-  const verifyResultParsed = MrtdPopVerificationResult.parse(verifyResult);
-  return verifyResultParsed;
+  return {
+    redirect_uri: verifyResult.redirectUri,
+    mrtd_val_pop_nonce: verifyResult.mrtdValPopNonce,
+  };
 };
 
-/**
- * WARNING: This function must be called after {@link validateChallenge}. The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
- * Builds the callback URL to which the end user should be redirected to continue the authentication flow after the MRTD challenge validation.
- * @param redirectUri - The redirect URI provided by the issuer after the challenge validation to continue the authentication flow.
- * @param valPopNonce - The MRTD validation PoP nonce obtained from the challenge validation response.
- * @param authSession - The MRTD authentication session identifier used for session binding.
- * @returns An object containing the callback URL
- */
-export const buildChallengeCallbackUrl: BuildChallengeCallbackUrl = async (
-  redirectUri,
-  valPopNonce,
-  authSession
-) => {
-  const params = new URLSearchParams({
-    mrtd_val_pop_nonce: valPopNonce,
-    mrtd_auth_session: authSession,
-  });
+export const buildChallengeCallbackUrl: MRTDPoPApi["buildChallengeCallbackUrl"] =
+  async (redirectUri, valPopNonce, authSession) => {
+    const params = new URLSearchParams({
+      mrtd_val_pop_nonce: valPopNonce,
+      mrtd_auth_session: authSession,
+    });
 
-  const callbackUrl = `${redirectUri}?${params}`;
-  return { callbackUrl };
-};
+    const callbackUrl = `${redirectUri}?${params}`;
+    return { callbackUrl };
+  };

package/src/credential/issuance/mrtd-pop/index.ts

@@ -1,27 +1,14 @@
-import {
-  verifyAndParseChallengeInfo,
-  type VerifyAndParseChallengeInfo,
-} from "./01-verify-and-parse-challenge-info";
-import { initChallenge, type InitChallenge } from "./02-init-challenge";
+import type { MRTDPoPApi } from "../api/mrtd-pop";
+import { verifyAndParseChallengeInfo } from "./01-verify-and-parse-challenge-info";
+import { initChallenge } from "./02-init-challenge";
 import {
   validateChallenge,
   buildChallengeCallbackUrl,
-  type ValidateChallenge,
-  type BuildChallengeCallbackUrl,
 } from "./03-validate-challenge";
-import type { MrtdPayload, IasPayload } from "./types";
 
-export {
+export const MRTDPoP: MRTDPoPApi = {
   verifyAndParseChallengeInfo,
   initChallenge,
   validateChallenge,
   buildChallengeCallbackUrl,
 };
-export type {
-  VerifyAndParseChallengeInfo,
-  InitChallenge,
-  ValidateChallenge,
-  BuildChallengeCallbackUrl,
-  MrtdPayload,
-  IasPayload,
-};

package/src/credential/issuance/v1.0.0/01-evaluate-issuer-trust.ts

@@ -0,0 +1,14 @@
+import { getCredentialIssuerEntityConfiguration } from "../../../trust/v1.0.0/entities";
+import type { IssuanceApi } from "../api";
+import { mapToIssuerConfig } from "./mappers";
+
+export const evaluateIssuerTrust: IssuanceApi["evaluateIssuerTrust"] = async (
+  issuerUrl,
+  context = {}
+) => {
+  const issuerConf = await getCredentialIssuerEntityConfiguration(issuerUrl, {
+    appFetch: context.appFetch,
+  });
+
+  return { issuerConf: mapToIssuerConfig(issuerConf) };
+};

package/src/credential/issuance/v1.0.0/02-start-user-authorization.ts

@@ -0,0 +1,68 @@
+import { generateRandomAlphaNumericString } from "../../../utils/misc";
+import { makeParRequest } from "../../../utils/par";
+import { LogLevel, Logger } from "../../../utils/logging";
+import { IoWalletError } from "../../../utils/errors";
+import type { IssuanceApi } from "../api";
+import {
+  selectCredentialDefinition,
+  selectResponseMode,
+} from "../common/authorization";
+
+export const startUserAuthorization: IssuanceApi["startUserAuthorization"] =
+  async (issuerConf, credentialIds, proof, ctx) => {
+    const {
+      wiaCryptoContext,
+      walletInstanceAttestation,
+      redirectUri,
+      appFetch = fetch,
+    } = ctx;
+
+    const clientId = await wiaCryptoContext.getPublicKey().then((_) => _.kid);
+
+    if (!clientId) {
+      Logger.log(
+        LogLevel.ERROR,
+        `Public key associated with kid ${clientId} not found in the device`
+      );
+      throw new IoWalletError("No public key found");
+    }
+    const codeVerifier = generateRandomAlphaNumericString(64);
+    const parEndpoint = issuerConf.pushed_authorization_request_endpoint;
+    const aud = issuerConf.credential_issuer;
+    const responseMode = selectResponseMode(issuerConf, credentialIds);
+    const getPar = makeParRequest({ wiaCryptoContext, appFetch });
+
+    const credentialDefinition = credentialIds.map((c) =>
+      selectCredentialDefinition(issuerConf, c)
+    );
+
+    if (proof.proofType === "mrtd-pop") {
+      /**
+       * When we requests a PID using eID Substantial Authentication with MRTD Verification, we must include
+       * an additional Authorization Details Object in the authorization_details
+       *
+       * See https://italia.github.io/eid-wallet-it-docs/versione-corrente/en/credential-issuance-endpoint.html#pushed-authorization-request-endpoint
+       */
+      credentialDefinition.push({
+        type: "it_l2+document_proof",
+        idphinting: proof.idpHinting,
+        challenge_method: "mrtd+ias",
+        challenge_redirect_uri: redirectUri,
+      });
+    }
+
+    const issuerRequestUri = await getPar(
+      parEndpoint,
+      walletInstanceAttestation,
+      {
+        aud,
+        clientId,
+        codeVerifier,
+        redirectUri,
+        responseMode,
+        authorizationDetails: credentialDefinition,
+      }
+    );
+
+    return { issuerRequestUri, clientId, codeVerifier, credentialDefinition };
+  };