@pagopa/io-react-native-wallet 2.5.0 → 3.0.0

package/src/wallet-instance/common/wallet-instance.ts

@@ -0,0 +1,96 @@
+import { getWalletProviderClient } from "../../client";
+import {
+  ResponseErrorBuilder,
+  WalletProviderResponseError,
+  WalletProviderResponseErrorCodes,
+} from "../../utils/errors";
+import { LogLevel, Logger } from "../../utils/logging";
+import type { WalletInstanceApi } from "../api";
+
+export const createWalletInstance: WalletInstanceApi["createWalletInstance"] =
+  async (context) => {
+    const { integrityContext, isRenewal } = context;
+    const api = getWalletProviderClient(context);
+
+    //1. Obtain nonce
+    const challenge = await api
+      .get("/nonce")
+      .then((response) => response.nonce);
+
+    Logger.log(
+      LogLevel.DEBUG,
+      `Challenge obtained from ${context.walletProviderBaseUrl}: ${challenge}`
+    );
+
+    const keyAttestation = await integrityContext.getAttestation(challenge);
+
+    const hardwareKeyTag = integrityContext.getHardwareKeyTag();
+
+    Logger.log(
+      LogLevel.DEBUG,
+      `Key attestation: ${keyAttestation}\nAssociated hardware key tag: ${hardwareKeyTag}`
+    );
+
+    //2. Create Wallet Instance
+    await api
+      .post("/wallet-instances", {
+        body: {
+          challenge,
+          key_attestation: keyAttestation,
+          hardware_key_tag: hardwareKeyTag,
+          is_renewal: isRenewal,
+        },
+      })
+      .catch(handleCreateWalletInstanceError);
+
+    return hardwareKeyTag;
+  };
+
+const handleCreateWalletInstanceError = (e: unknown) => {
+  Logger.log(
+    LogLevel.ERROR,
+    `An error occurred while calling /wallet-instances endpoint: ${e}`
+  );
+
+  if (!(e instanceof WalletProviderResponseError)) {
+    throw e;
+  }
+
+  throw new ResponseErrorBuilder(WalletProviderResponseError)
+    .handle(409, {
+      code: WalletProviderResponseErrorCodes.WalletInstanceIntegrityFailed,
+      message:
+        "Unable to create a wallet instance with a device that failed the integrity check",
+    })
+    .handle("*", {
+      code: WalletProviderResponseErrorCodes.WalletInstanceCreationFailed,
+      message: "Unable to create wallet instance",
+    })
+    .buildFrom(e);
+};
+
+export const revokeWalletInstance: WalletInstanceApi["revokeWalletInstance"] =
+  async (context) => {
+    const api = getWalletProviderClient(context);
+
+    await api.put("/wallet-instances/{id}/status", {
+      path: { id: context.id },
+      body: { status: "REVOKED" },
+    });
+  };
+
+export const getWalletInstanceStatus: WalletInstanceApi["getWalletInstanceStatus"] =
+  (context) => {
+    const api = getWalletProviderClient(context);
+
+    return api.get("/wallet-instances/{id}/status", {
+      path: { id: context.id },
+    });
+  };
+
+export const getCurrentWalletInstanceStatus: WalletInstanceApi["getCurrentWalletInstanceStatus"] =
+  (context) => {
+    const api = getWalletProviderClient(context);
+
+    return api.get("/wallet-instances/current/status");
+  };

package/src/wallet-instance/index.ts

@@ -1,118 +1,3 @@
-import { getWalletProviderClient } from "../client";
-import {
-  ResponseErrorBuilder,
-  WalletProviderResponseError,
-  WalletProviderResponseErrorCodes,
-} from "../utils/errors";
-import type { WalletInstanceData } from "../client/generated/wallet-provider";
-import type { IntegrityContext } from "..";
-import { LogLevel, Logger } from "../utils/logging";
-
-export async function createWalletInstance(context: {
-  integrityContext: IntegrityContext;
-  walletProviderBaseUrl: string;
-  appFetch?: GlobalFetch["fetch"];
-}) {
-  const { integrityContext } = context;
-  const api = getWalletProviderClient(context);
-
-  //1. Obtain nonce
-  const challenge = await api.get("/nonce").then((response) => response.nonce);
-
-  Logger.log(
-    LogLevel.DEBUG,
-    `Challenge obtained from ${context.walletProviderBaseUrl}: ${challenge}`
-  );
-
-  const keyAttestation = await integrityContext.getAttestation(challenge);
-
-  const hardwareKeyTag = integrityContext.getHardwareKeyTag();
-
-  Logger.log(
-    LogLevel.DEBUG,
-    `Key attestation: ${keyAttestation}\nAssociated hardware key tag: ${hardwareKeyTag}`
-  );
-
-  //2. Create Wallet Instance
-  await api
-    .post("/wallet-instances", {
-      body: {
-        challenge,
-        key_attestation: keyAttestation,
-        hardware_key_tag: hardwareKeyTag,
-      },
-    })
-    .catch(handleCreateWalletInstanceError);
-
-  return hardwareKeyTag;
-}
-
-const handleCreateWalletInstanceError = (e: unknown) => {
-  Logger.log(
-    LogLevel.ERROR,
-    `An error occurred while calling /wallet-instances endpoint: ${e}`
-  );
-
-  if (!(e instanceof WalletProviderResponseError)) {
-    throw e;
-  }
-
-  throw new ResponseErrorBuilder(WalletProviderResponseError)
-    .handle(409, {
-      code: WalletProviderResponseErrorCodes.WalletInstanceIntegrityFailed,
-      message:
-        "Unable to create a wallet instance with a device that failed the integrity check",
-    })
-    .handle("*", {
-      code: WalletProviderResponseErrorCodes.WalletInstanceCreationFailed,
-      message: "Unable to create wallet instance",
-    })
-    .buildFrom(e);
-};
-
-/**
- * Revoke a Wallet Instance by ID.
- * @param context.id The Wallet Instance ID. It matches the hardware key tag used for creation.
- */
-export async function revokeWalletInstance(context: {
-  id: string;
-  walletProviderBaseUrl: string;
-  appFetch?: GlobalFetch["fetch"];
-}): Promise<void> {
-  const api = getWalletProviderClient(context);
-
-  await api.put("/wallet-instances/{id}/status", {
-    path: { id: context.id },
-    body: { status: "REVOKED" },
-  });
-}
-
-/**
- * Get the status of a Wallet Instance by ID.
- * @param context.id The Wallet Instance ID. It matches the hardware key tag used for creation.
- * @returns Details on the status of the Wallet Instance
- */
-export async function getWalletInstanceStatus(context: {
-  id: string;
-  walletProviderBaseUrl: string;
-  appFetch?: GlobalFetch["fetch"];
-}): Promise<WalletInstanceData> {
-  const api = getWalletProviderClient(context);
-
-  return api.get("/wallet-instances/{id}/status", {
-    path: { id: context.id },
-  });
-}
-
-/**
- * Get the status of the current Wallet Instance.
- * @returns Details on the status of the current Wallet Instance
- */
-export async function getCurrentWalletInstanceStatus(context: {
-  walletProviderBaseUrl: string;
-  appFetch?: GlobalFetch["fetch"];
-}): Promise<WalletInstanceData> {
-  const api = getWalletProviderClient(context);
-
-  return api.get("/wallet-instances/current/status");
-}
+export type * from "./api";
+export { WalletInstance as V1_0_0 } from "./v1.0.0";
+export { WalletInstance as V1_3_3 } from "./v1.3.3";

package/src/wallet-instance/v1.0.0/index.ts

@@ -0,0 +1,14 @@
+import type { WalletInstanceApi } from "../api";
+import {
+  createWalletInstance,
+  revokeWalletInstance,
+  getWalletInstanceStatus,
+  getCurrentWalletInstanceStatus,
+} from "../common/wallet-instance";
+
+export const WalletInstance: WalletInstanceApi = {
+  createWalletInstance,
+  revokeWalletInstance,
+  getWalletInstanceStatus,
+  getCurrentWalletInstanceStatus,
+};

package/src/wallet-instance/v1.3.3/index.ts

@@ -0,0 +1,14 @@
+import type { WalletInstanceApi } from "../api";
+import {
+  createWalletInstance,
+  revokeWalletInstance,
+  getWalletInstanceStatus,
+  getCurrentWalletInstanceStatus,
+} from "../common/wallet-instance";
+
+export const WalletInstance: WalletInstanceApi = {
+  createWalletInstance,
+  revokeWalletInstance,
+  getWalletInstanceStatus,
+  getCurrentWalletInstanceStatus,
+};

package/src/wallet-instance-attestation/README.md

@@ -11,6 +11,8 @@ The wallet provider must implement its endpoints based on the OpenAPI specificat
 - `integrityContext` object that is used to verify the integrity of the device where the app is running. The key tag must be the same used when creating the Wallet Instance;
 
 ```ts
+import { IoWallet } from "@pagopa/io-react-native-wallet";
+
 // Retrieve the integrity key tag from the store and create its context
 const integrityKeyTag = "example"; // Let's assume this is the same key used when creating the Wallet Instance
 const integrityContext = getIntegrityContext(integrityKeyTag);
@@ -27,13 +29,17 @@ const { WALLET_PROVIDER_BASE_URL } = env; // Let's assume env is an object conta
  * Obtains a new Wallet Instance Attestation.
  * WARNING: The integrity context must be the same used when creating the Wallet Instance with the same keytag.
  */
-const issuedAttestation = await WalletInstanceAttestation.getAttestation({
+const wallet = new IoWallet({ version: "1.0.0" });
+const issuedAttestation = await wallet.WalletInstanceAttestation.getAttestation({
   wiaCryptoContext,
   integrityContext,
   walletProviderBaseUrl: WALLET_PROVIDER_BASE_URL,
   appFetch,
 });
-// [{ "format": "jwt", "wallet_attestation": "ey..." }, { "format": "dc+sd-jwt", "wallet_attestation": "ey..." }]
+// [
+//   { type: "wallet_instance_attestation", "format": "jwt", "attestation": "ey..." },
+//   { type: "wallet_instance_attestation", "format": "dc+sd-jwt", "attestation": "ey..." }
+// ]
 return issuedAttestation;
 ```
 

package/src/wallet-instance-attestation/api/index.ts

@@ -0,0 +1,48 @@
+import type { CryptoContext } from "@pagopa/io-react-native-jwt";
+import type { IntegrityContext } from "../../utils/integrity";
+import type { DecodedAttestationJwt, WalletAttestation } from "./types";
+
+export interface WalletInstanceAttestationApi {
+  /**
+   * Request a Wallet Instance Attestation (WIA) to the Wallet provider.
+   * The Wallet Attestation may be issued in different formats and components (Wallet App and Wallet Unit).
+   *
+   * @param params.wiaCryptoContext The key pair associated with the WIA. Will be use to prove the ownership of the attestation.
+   * @param params.appFetch (optional) Http client
+   * @param walletProviderBaseUrl Base url for the Wallet Provider
+   * @returns The retrieved Wallet Instance Attestation tokens
+   * @throws {WalletProviderResponseError} with a specific code for more context
+   */
+  getAttestation(ctx: {
+    wiaCryptoContext: CryptoContext;
+    integrityContext: IntegrityContext;
+    walletProviderBaseUrl: string;
+    appFetch?: GlobalFetch["fetch"];
+  }): Promise<WalletAttestation[]>;
+
+  /**
+   * Decode a given JWT to get the parsed Wallet Instance Attestation object they define.
+   * It ensures provided data is in a valid shape.
+   *
+   * It DOES NOT verify token signature nor check disclosures are correctly referenced by the JWT.
+   * Use {@link verify} instead
+   *
+   * @param token The encoded token that represents a valid jwt for Wallet Instance Attestation
+   * @returns The validated Wallet Instance Attestation object
+   * @throws A decoding error if the token doesn't resolve in a valid JWT
+   * @throws A validation error if the provided data doesn't result in a valid Wallet Instance Attestation
+   */
+  decode(token: string): DecodedAttestationJwt;
+
+  /**
+   * Verify a given JWT to get the parsed Wallet Instance Attestation object they define.
+   * Same as {@link decode} plus token signature verification
+   *
+   * @param token The encoded token that represents a valid jwt
+   * @returns {DecodedAttestationJwt} The validated Wallet Instance Attestation object
+   * @throws A decoding error if the token doesn't resolve in a valid JWT
+   * @throws A validation error if the provided data doesn't result in a valid Wallet Instance Attestation
+   * @throws Invalid signature error if the token signature is not valid
+   */
+  verify(token: string): Promise<DecodedAttestationJwt>;
+}

package/src/wallet-instance-attestation/api/types.ts

@@ -0,0 +1,25 @@
+import * as z from "zod";
+import { UnixTime } from "../../utils/zod";
+import { JWK } from "../../utils/jwk";
+
+/**
+ * Common Wallet Attestation shape. This object is
+ * an abstraction over the version-specific JWTs.
+ */
+export type DecodedAttestationJwt = z.infer<typeof DecodedAttestationJwt>;
+export const DecodedAttestationJwt = z.object({
+  iss: z.string(),
+  iat: UnixTime,
+  exp: UnixTime,
+  cnf: z.object({ jwk: JWK }),
+  sub: z.string(),
+  wallet_link: z.string().optional(),
+  wallet_name: z.string().optional(),
+  aal: z.string().optional(),
+});
+
+export type WalletAttestation = {
+  type: "wallet_instance_attestation" | "wallet_unit_attestation";
+  format: string;
+  attestation: string;
+};

package/src/wallet-instance-attestation/common/types.ts

@@ -0,0 +1,25 @@
+import * as z from "zod";
+import { UnixTime } from "../../utils/zod";
+import { JWK } from "../../utils/jwk";
+
+export const Jwt = z.object({
+  header: z.object({
+    alg: z.string(),
+    kid: z.string(),
+    typ: z.string(),
+    x5c: z.array(z.string()).optional(),
+    trust_chain: z.array(z.string()).optional(),
+  }),
+  payload: z.object({
+    iss: z.string(),
+    iat: UnixTime,
+    exp: UnixTime,
+    cnf: z.object({
+      jwk: z.intersection(
+        JWK,
+        // this key requires a kid because it must be referenced for DPoP
+        z.object({ kid: z.string() })
+      ),
+    }),
+  }),
+});

package/src/wallet-instance-attestation/index.ts

@@ -1,56 +1,3 @@
-import { WalletInstanceAttestationJwt } from "./types";
-import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
-import { verify as verifyJwt } from "@pagopa/io-react-native-jwt";
-
-export { getAttestation } from "./issuing";
-
-/**
- * Decode a given JWT to get the parsed Wallet Instance Attestation object they define.
- * It ensures provided data is in a valid shape.
- *
- * It DOES NOT verify token signature nor check disclosures are correctly referenced by the JWT.
- * Use {@link verify} instead
- *
- * @function
- * @param token The encoded token that represents a valid jwt for Wallet Instance Attestation
- *
- * @returns The validated Wallet Instance Attestation object
- * @throws A decoding error if the token doesn't resolve in a valid JWT
- * @throws A validation error if the provided data doesn't result in a valid Wallet Instance Attestation
- *
- */
-export function decode(token: string): WalletInstanceAttestationJwt {
-  // decode JWT parts
-  const decodedJwt = decodeJwt(token);
-  // parse JWT to ensure it has the shape of a WalletInstanceAttestationJwt
-  return WalletInstanceAttestationJwt.parse({
-    header: decodedJwt.protectedHeader,
-    payload: decodedJwt.payload,
-  });
-}
-
-/**
- * Verify a given JWT to get the parsed Wallet Instance Attestation object they define.
- * Same as {@link decode} plus token signature verification
- *
- * @async @function
- *
- *
- * @param token The encoded token that represents a valid jwt
- *
- * @returns {WalletInstanceAttestationJwt} The validated Wallet Instance Attestation object
- * @throws A decoding error if the token doesn't resolve in a valid JWT
- * @throws A validation error if the provided data doesn't result in a valid Wallet Instance Attestation
- * @throws Invalid signature error if the token signature is not valid
- *
- */
-export async function verify(
-  token: string
-): Promise<WalletInstanceAttestationJwt> {
-  const decoded = decode(token);
-  const pubKey = decoded.payload.cnf.jwk;
-
-  await verifyJwt(token, pubKey);
-
-  return decoded;
-}
+export type * from "./api";
+export { WalletInstanceAttestation as V1_0_0 } from "./v1.0.0";
+export { WalletInstanceAttestation as V1_3_3 } from "./v1.3.3";

package/src/wallet-instance-attestation/v1.0.0/index.ts

@@ -0,0 +1,11 @@
+import type { WalletInstanceAttestationApi } from "../api";
+import { withMapper, withMapperAsync } from "../../utils/mappers";
+import { getAttestation } from "./issuing";
+import { decode, verify } from "./utils";
+import { mapToDecodedAttestationJwt } from "./mappers";
+
+export const WalletInstanceAttestation: WalletInstanceAttestationApi = {
+  getAttestation,
+  decode: withMapper(mapToDecodedAttestationJwt, decode),
+  verify: withMapperAsync(mapToDecodedAttestationJwt, verify),
+};

package/src/wallet-instance-attestation/v1.0.0/issuing.ts

@@ -0,0 +1,154 @@
+import {
+  type CryptoContext,
+  SignJWT,
+  thumbprint,
+} from "@pagopa/io-react-native-jwt";
+import { fixBase64EncodingOnKey, JWK } from "../../utils/jwk";
+import { getWalletProviderClient } from "../../client";
+import type { IntegrityContext } from "../../utils/integrity";
+import { LogLevel, Logger } from "../../utils/logging";
+import {
+  ResponseErrorBuilder,
+  WalletProviderResponseError,
+  WalletProviderResponseErrorCodes,
+} from "../../utils/errors";
+import { WalletAttestationResponse } from "./types";
+import type { WalletInstanceAttestationApi } from "../api";
+import { mapToWalletAttestations } from "./mappers";
+
+/**
+ * Getter for an attestation request. The attestation request is a JWT that will be sent to the Wallet Provider to request a Wallet Instance Attestation.
+ *
+ * @param challenge - The nonce received from the Wallet Provider which is part of the signed clientData
+ * @param wiaCryptoContext - The key pair associated with the WIA. Will be use to prove the ownership of the attestation
+ * @param integrityContext - The integrity context which exposes a set of functions to interact with the device integrity service
+ * @param walletProviderBaseUrl - Base url for the Wallet Provider
+ * @returns A JWT containing the attestation request
+ */
+async function getAttestationRequest(
+  challenge: string,
+  wiaCryptoContext: CryptoContext,
+  integrityContext: IntegrityContext,
+  walletProviderBaseUrl: string
+): Promise<string> {
+  const jwk = await wiaCryptoContext.getPublicKey();
+  const parsedJwk = JWK.parse(jwk);
+  const keyThumbprint = await thumbprint(parsedJwk);
+  const publicKey = { ...parsedJwk, kid: keyThumbprint };
+
+  const clientData = {
+    challenge,
+    jwk_thumbprint: keyThumbprint,
+  };
+
+  const hardwareKeyTag = integrityContext.getHardwareKeyTag();
+  const { signature, authenticatorData } =
+    await integrityContext.getHardwareSignatureWithAuthData(
+      JSON.stringify(clientData)
+    );
+
+  return new SignJWT(wiaCryptoContext)
+    .setPayload({
+      iss: keyThumbprint,
+      aud: walletProviderBaseUrl,
+      nonce: challenge,
+      hardware_signature: signature,
+      integrity_assertion: authenticatorData,
+      hardware_key_tag: hardwareKeyTag,
+      cnf: {
+        jwk: fixBase64EncodingOnKey(publicKey),
+      },
+    })
+    .setProtectedHeader({
+      kid: publicKey.kid,
+      typ: "wp-war+jwt",
+    })
+    .setIssuedAt()
+    .setExpirationTime("1h")
+    .sign();
+}
+
+export const getAttestation: WalletInstanceAttestationApi["getAttestation"] =
+  async ({
+    wiaCryptoContext,
+    integrityContext,
+    walletProviderBaseUrl,
+    appFetch = fetch,
+  }) => {
+    const api = getWalletProviderClient({
+      walletProviderBaseUrl,
+      appFetch,
+    });
+
+    // 1. Get nonce from backend
+    const challenge = await api
+      .get("/nonce")
+      .then((response) => response.nonce);
+    Logger.log(
+      LogLevel.DEBUG,
+      `Challenge obtained from ${walletProviderBaseUrl}: ${challenge} `
+    );
+
+    // 2. Get a signed attestation request
+    const signedAttestationRequest = await getAttestationRequest(
+      challenge,
+      wiaCryptoContext,
+      integrityContext,
+      walletProviderBaseUrl
+    );
+    Logger.log(
+      LogLevel.DEBUG,
+      `Signed attestation request: ${signedAttestationRequest}`
+    );
+
+    // 3. Request WIA in multiple formats
+    const response = await api
+      .post("/wallet-attestations", {
+        body: {
+          assertion: signedAttestationRequest,
+        },
+      })
+      .then(WalletAttestationResponse.parse)
+      .catch(handleAttestationCreationError);
+
+    for (const attestation of response.wallet_attestations) {
+      Logger.log(
+        LogLevel.DEBUG,
+        `Obtained wallet attestation in ${attestation.format} format: ${attestation.wallet_attestation}`
+      );
+    }
+
+    return mapToWalletAttestations(response);
+  };
+
+const handleAttestationCreationError = (e: unknown) => {
+  Logger.log(
+    LogLevel.ERROR,
+    `An error occurred while calling /wallet-attestation endpoint: ${e}`
+  );
+
+  if (!(e instanceof WalletProviderResponseError)) {
+    throw e;
+  }
+
+  throw new ResponseErrorBuilder(WalletProviderResponseError)
+    .handle(403, {
+      code: WalletProviderResponseErrorCodes.WalletInstanceRevoked,
+      message: "Unable to get an attestation for a revoked Wallet Instance",
+    })
+    .handle(404, {
+      code: WalletProviderResponseErrorCodes.WalletInstanceNotFound,
+      message:
+        "Unable to get an attestation for a Wallet Instance that does not exist",
+    })
+    .handle(409, {
+      code: WalletProviderResponseErrorCodes.WalletInstanceIntegrityFailed,
+      message:
+        "Unable to get an attestation for a Wallet Instance that failed the integrity check",
+    })
+    .handle("*", {
+      code: WalletProviderResponseErrorCodes.WalletInstanceAttestationIssuingFailed,
+      message: "Unable to obtain wallet instance attestation",
+    })
+    .buildFrom(e);
+};

package/src/wallet-instance-attestation/v1.0.0/mappers.ts

@@ -0,0 +1,24 @@
+import { createMapper } from "../../utils/mappers";
+import { DecodedAttestationJwt, type WalletAttestation } from "../api/types";
+import {
+  WalletAttestationResponse,
+  WalletInstanceAttestationJwt,
+} from "./types";
+
+export const mapToDecodedAttestationJwt = createMapper<
+  WalletInstanceAttestationJwt,
+  DecodedAttestationJwt
+>((x) => x.payload, {
+  outputSchema: DecodedAttestationJwt,
+});
+
+export const mapToWalletAttestations = createMapper<
+  WalletAttestationResponse,
+  WalletAttestation[]
+>((x) =>
+  x.wallet_attestations.map((wa) => ({
+    type: "wallet_instance_attestation",
+    format: wa.format,
+    attestation: wa.wallet_attestation,
+  }))
+);

package/src/wallet-instance-attestation/v1.0.0/types.ts

@@ -0,0 +1,59 @@
+import * as z from "zod";
+import { Jwt } from "../common/types";
+
+export type WalletInstanceAttestationRequestJwt = z.infer<
+  typeof WalletInstanceAttestationRequestJwt
+>;
+export const WalletInstanceAttestationRequestJwt = z.object({
+  header: z.intersection(
+    Jwt.shape.header,
+    z.object({
+      typ: z.literal("wp-war+jwt"),
+    })
+  ),
+  payload: z.intersection(
+    Jwt.shape.payload,
+    z.object({
+      aud: z.string(),
+      nonce: z.string(),
+      hardware_signature: z.string(),
+      integrity_assertion: z.string(),
+      hardware_key_tag: z.string(),
+    })
+  ),
+});
+
+// TODO: [SIW-2089] add type for Wallet Attestation in SD-JWT and MDOC format
+// See https://italia.github.io/eid-wallet-it-docs/versione-corrente/en/wallet-solution.html#wallet-attestation-issuance step 18
+export type WalletInstanceAttestationJwt = z.infer<
+  typeof WalletInstanceAttestationJwt
+>;
+export const WalletInstanceAttestationJwt = z.object({
+  header: z.intersection(
+    Jwt.shape.header,
+    z.object({
+      typ: z.literal("oauth-client-attestation+jwt"),
+    })
+  ),
+  payload: z.intersection(
+    Jwt.shape.payload,
+    z.object({
+      sub: z.string(),
+      aal: z.string(),
+      wallet_link: z.string().optional(),
+      wallet_name: z.string().optional(),
+    })
+  ),
+});
+
+export type WalletAttestationResponse = z.infer<
+  typeof WalletAttestationResponse
+>;
+export const WalletAttestationResponse = z.object({
+  wallet_attestations: z.array(
+    z.object({
+      wallet_attestation: z.string(),
+      format: z.enum(["jwt", "dc+sd-jwt", "mso_mdoc"]),
+    })
+  ),
+});