@pagopa/io-react-native-wallet 2.5.1 → 3.0.0

package/src/credential/status/02-status-assertion.ts

@@ -1,115 +0,0 @@
-import {
-  getCredentialHashWithouDiscloures,
-  hasStatusOrThrow,
-  type Out,
-} from "../../utils/misc";
-import type { EvaluateIssuerTrust, ObtainCredential } from "../issuance";
-import { type CryptoContext, SignJWT } from "@pagopa/io-react-native-jwt";
-import { v4 as uuidv4 } from "uuid";
-import { StatusAssertionResponse } from "./types";
-import {
-  IssuerResponseError,
-  IssuerResponseErrorCodes,
-  ResponseErrorBuilder,
-  UnexpectedStatusCodeError,
-} from "../../utils/errors";
-import { Logger, LogLevel } from "../../utils/logging";
-import { extractJwkFromCredential } from "../../utils/credentials";
-import type { SupportedSdJwtLegacyFormat } from "../../sd-jwt/types";
-
-export type StatusAssertion = (
-  issuerConf: Out<EvaluateIssuerTrust>["issuerConf"],
-  credential: Out<ObtainCredential>["credential"],
-  format: Out<ObtainCredential>["format"] | SupportedSdJwtLegacyFormat,
-  context: {
-    credentialCryptoContext: CryptoContext;
-    wiaCryptoContext: CryptoContext;
-    appFetch?: GlobalFetch["fetch"];
-  }
-) => Promise<{
-  statusAssertion: string;
-}>;
-
-/**
- * Get the status assertion of a digital credential.
- * @param issuerConf - The issuer's configuration
- * @param credential - The credential to be verified
- * @param format - The format of the credential, e.g. "sd-jwt"
- * @param context.credentialCryptoContext - The credential's crypto context
- * @param context.wiaCryptoContext - The Wallet Attestation's crypto context
- * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
- * @throws {IssuerResponseError} with a specific code for more context
- * @returns The credential status assertion
- */
-export const statusAssertion: StatusAssertion = async (
-  issuerConf,
-  credential,
-  format,
-  ctx
-) => {
-  const { credentialCryptoContext, wiaCryptoContext, appFetch = fetch } = ctx;
-
-  const jwk = await extractJwkFromCredential(credential, format);
-  const issuerJwk = await wiaCryptoContext.getPublicKey();
-  const credentialHash = await getCredentialHashWithouDiscloures(credential);
-  const statusAttUrl =
-    issuerConf.openid_credential_issuer.status_attestation_endpoint;
-
-  const credentialPop = await new SignJWT(credentialCryptoContext)
-    .setPayload({
-      iss: issuerJwk.kid,
-      aud: statusAttUrl,
-      jti: uuidv4().toString(),
-      credential_hash: credentialHash,
-      credential_hash_alg: "sha-256",
-    })
-    .setProtectedHeader({
-      alg: "ES256",
-      typ: "status-assertion-request+jwt",
-      kid: jwk.kid,
-    })
-    .setIssuedAt()
-    .setExpirationTime("5m")
-    .sign();
-
-  const body = {
-    status_assertion_requests: [credentialPop],
-  };
-
-  Logger.log(LogLevel.DEBUG, `Credential pop: ${credentialPop}`);
-
-  const result = await appFetch(statusAttUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-    },
-    body: JSON.stringify(body),
-  })
-    .then(hasStatusOrThrow(200))
-    .then((raw) => raw.json())
-    .then((json) => StatusAssertionResponse.parse(json))
-    .catch(handleStatusAssertionError);
-
-  const [statusAttestationJwt] = result.status_assertion_responses;
-
-  return { statusAssertion: statusAttestationJwt! };
-};
-
-/**
- * Handle the status assertion error by mapping it to a custom exception.
- * If the error is not an instance of {@link UnexpectedStatusCodeError}, it is thrown as is.
- * @param e - The error to be handled
- * @throws {IssuerResponseError} with a specific code for more context
- */
-const handleStatusAssertionError = (e: unknown) => {
-  if (!(e instanceof UnexpectedStatusCodeError)) {
-    throw e;
-  }
-
-  throw new ResponseErrorBuilder(IssuerResponseError)
-    .handle("*", {
-      code: IssuerResponseErrorCodes.StatusAttestationRequestFailed,
-      message: `Unable to obtain the status assertion for the given credential`,
-    })
-    .buildFrom(e);
-};

package/src/credential/status/03-verify-and-parse-status-assertion.ts

@@ -1,110 +0,0 @@
-import type { Out } from "../../utils/misc";
-import {
-  IoWalletError,
-  IssuerResponseError,
-  IssuerResponseErrorCodes,
-} from "../../utils/errors";
-import { decode as decodeJwt, verify } from "@pagopa/io-react-native-jwt";
-import type { EvaluateIssuerTrust, StatusAssertion } from ".";
-import {
-  type InvalidStatusErrorReason,
-  ParsedStatusAssertion,
-  ParsedStatusAssertionError,
-  ParsedStatusAssertionResponse,
-  StatusType,
-} from "./types";
-import { Logger, LogLevel } from "../../utils/logging";
-import type { ObtainCredential } from "../issuance";
-import { extractJwkFromCredential } from "../../utils/credentials";
-import { isSameThumbprint } from "../../utils/jwk";
-import type { SupportedSdJwtLegacyFormat } from "../../sd-jwt/types";
-
-export type VerifyAndParseStatusAssertion = (
-  issuerConf: Out<EvaluateIssuerTrust>["issuerConf"],
-  statusAssertion: Out<StatusAssertion>,
-  credential: Out<ObtainCredential>["credential"],
-  format: Out<ObtainCredential>["format"] | SupportedSdJwtLegacyFormat
-) => Promise<{ parsedStatusAssertion: ParsedStatusAssertion }>;
-
-/**
- * Given a status assertion, verifies that:
- * - It's in the supported format;
- * - The assertion is correctly signed;
- * - It's bound to the given key.
- * @param issuerConf The Issuer configuration returned by {@link evaluateIssuerTrust}
- * @param statusAssertion The encoded status assertion returned by {@link statusAssertion}
- * @param context.credentialCryptoContext The crypto context used to obtain the credential in {@link obtainCredential}
- * @returns A parsed status assertion
- * @throws {IoWalletError} If the credential signature is not verified with the Issuer key set
- * @throws {IssuerResponseError} If the status assertion contains an error or the credential status is invalid
- */
-export const verifyAndParseStatusAssertion: VerifyAndParseStatusAssertion =
-  async (issuerConf, rawStatusAssertion, credential, format) => {
-    const { statusAssertion } = rawStatusAssertion;
-
-    await verify(
-      statusAssertion,
-      issuerConf.openid_credential_issuer.jwks.keys
-    );
-
-    const decodedJwt = decodeJwt(statusAssertion);
-    const parsedStatusAssertion = ParsedStatusAssertionResponse.parse({
-      header: decodedJwt.protectedHeader,
-      payload: decodedJwt.payload,
-    });
-
-    Logger.log(
-      LogLevel.DEBUG,
-      `Parsed status assertion: ${JSON.stringify(parsedStatusAssertion)}`
-    );
-
-    // Errors are transmitted in the JWT and use a 200 HTTP status code
-    if (isStatusAssertionError(parsedStatusAssertion)) {
-      throw new IssuerResponseError({
-        code: IssuerResponseErrorCodes.CredentialInvalidStatus,
-        message: "The status assertion contains an error",
-        statusCode: 200,
-        reason: buildErrorReason(parsedStatusAssertion),
-      });
-    }
-
-    const { cnf, credential_status_type } = parsedStatusAssertion.payload;
-    const holderBindingKey = await extractJwkFromCredential(credential, format);
-
-    if (!(await isSameThumbprint(cnf.jwk, holderBindingKey))) {
-      const errorMessage = `Failed to verify holder binding for status assertion: the thumbprints of keys ${cnf.jwk.kid} and ${holderBindingKey.kid} do not match`;
-      Logger.log(LogLevel.ERROR, errorMessage);
-      throw new IoWalletError(errorMessage);
-    }
-
-    if (credential_status_type !== StatusType.VALID) {
-      throw new IssuerResponseError({
-        code: IssuerResponseErrorCodes.CredentialInvalidStatus,
-        message: "Invalid status found for the given credential",
-        statusCode: 200,
-        reason: buildErrorReason(parsedStatusAssertion),
-      });
-    }
-
-    return { parsedStatusAssertion };
-  };
-
-const isStatusAssertionError = (
-  assertion: ParsedStatusAssertionResponse
-): assertion is ParsedStatusAssertionError =>
-  assertion.header.typ === "status-assertion-error+jwt";
-
-/**
- * Build an object containing the details on the error to use as the IssuerResponseError's reason
- * @param assertion The status assertion response, both success or failure
- * @returns The error's reason object
- */
-const buildErrorReason = ({
-  payload,
-}: ParsedStatusAssertionResponse): InvalidStatusErrorReason =>
-  "error" in payload
-    ? payload
-    : {
-        error: payload.credential_status_detail!.state,
-        error_description: payload.credential_status_detail!.description,
-      };

package/src/credential/status/types.ts

@@ -1,90 +0,0 @@
-import { UnixTime } from "../../sd-jwt/types";
-import { JWK } from "../../utils/jwk";
-import * as z from "zod";
-
-/**
- * Shape from parsing a status assertion response in case of 201.
- */
-export const StatusAssertionResponse = z.object({
-  status_assertion_responses: z.array(z.string()),
-});
-
-/**
- * Type from parsing a status assertion response in case of 201.
- * Inferred from {@link StatusAssertionResponse}.
- */
-export type StatusAssertionResponse = z.infer<typeof StatusAssertionResponse>;
-
-export type ParsedStatusAssertion = z.infer<typeof ParsedStatusAssertion>;
-
-/**
- * Shape for parsing a successful status assertion in a JWT.
- */
-export const ParsedStatusAssertion = z.object({
-  header: z.object({
-    typ: z.literal("status-assertion+jwt"),
-    alg: z.string(),
-    kid: z.string().optional(),
-  }),
-  payload: z.object({
-    iss: z.string(),
-    credential_status_type: z.string(),
-    credential_status_detail: z
-      .object({
-        state: z.string(),
-        description: z.string(),
-      })
-      .optional(),
-    credential_hash_alg: z.string(),
-    credential_hash: z.string(),
-    cnf: z.object({
-      jwk: JWK,
-    }),
-    exp: UnixTime,
-    iat: UnixTime,
-  }),
-});
-
-export type ParsedStatusAssertionError = z.infer<
-  typeof ParsedStatusAssertionError
->;
-
-/**
- * The JWT that contains the errors occurred for the status assertion request.
- * @see https://italia.github.io/eid-wallet-it-docs/versione-corrente/en/credential-revocation.html#http-status-assertion-response
- */
-export const ParsedStatusAssertionError = z.object({
-  header: z.object({
-    typ: z.literal("status-assertion-error+jwt"),
-    alg: z.string(),
-    kid: z.string().optional(),
-  }),
-  payload: z.object({
-    credential_hash_alg: z.string(),
-    credential_hash: z.string(),
-    error: z.string(),
-    error_description: z.string(),
-  }),
-});
-
-/**
- * The status assertion response that might include either a successful assertion or an error
- */
-export type ParsedStatusAssertionResponse = z.infer<
-  typeof ParsedStatusAssertionResponse
->;
-export const ParsedStatusAssertionResponse = z.union([
-  ParsedStatusAssertion,
-  ParsedStatusAssertionError,
-]);
-
-export enum StatusType {
-  VALID = "0x00",
-  INVALID = "0x01",
-  SUSPENDED = "0x02",
-}
-
-export type InvalidStatusErrorReason = {
-  error: string;
-  error_description: string;
-};

package/src/credential/trustmark/get-credential-trustmark.ts

@@ -1,139 +0,0 @@
-import {
-  SignJWT,
-  thumbprint,
-  type CryptoContext,
-  decode as decodeJwt,
-} from "@pagopa/io-react-native-jwt";
-import * as WalletInstanceAttestation from "../../wallet-instance-attestation";
-import { IoWalletError } from "../../utils/errors";
-import { obfuscateString } from "../../utils/string";
-import { LogLevel, Logger } from "../../utils/logging";
-
-export type GetCredentialTrustmarkJwt = (params: {
-  /**
-   * The Wallet Instance's attestation
-   */
-  walletInstanceAttestation: string;
-  /**
-   * The Wallet Instance's crypto context associated with the walletInstanceAttestation parameter
-   */
-  wiaCryptoContext: CryptoContext;
-  /**
-   * The type of credential for which the trustmark is generated
-   */
-  credentialType: string;
-  /**
-   * (Optional) Document number contained in the credential, if applicable
-   */
-  docNumber?: string;
-  /**
-   * (Optional) Expiration time for the trustmark, default is 2 minutes.
-   * If a number is provided, it is interpreted as a timestamp in seconds.
-   * If a string is provided, it is interpreted as a time span and added to the current timestamp.
-   */
-  expirationTime?: number | string;
-}) => Promise<{
-  /**
-   * The signed JWT
-   */
-  jwt: string;
-  /**
-   * The expiration time of the JWT in seconds
-   */
-  expirationTime: number;
-}>;
-
-/**
- * Generates a trustmark signed JWT, which is used to verify the authenticity of a credential.
- * The public key used to sign the trustmark must the same used for the Wallet Instance Attestation.
- *
- * @param walletInstanceAttestation the Wallet Instance's attestation
- * @param wiaCryptoContext The Wallet Instance's crypto context associated with the walletInstanceAttestation parameter
- * @param credentialType The type of credential for which the trustmark is generated
- * @param docNumber (Optional) Document number contained in the credential, if applicable
- * @param expirationTime (Optional) Expiration time for the trustmark, default is 2 minutes.
- *                        If a number is provided, it is interpreted as a timestamp in seconds.
- *                        If a string is provided, it is interpreted as a time span and added to the current timestamp.
- * @throws {IoWalletError} If the WIA is expired
- * @throws {IoWalletError} If the public key associated to the WIA is not the same for the CryptoContext
- * @throws {JWSSignatureVerificationFailed} If the WIA signature is not valid
- * @returns A promise containing the signed JWT and its expiration time in seconds
- */
-export const getCredentialTrustmark: GetCredentialTrustmarkJwt = async ({
-  walletInstanceAttestation,
-  wiaCryptoContext,
-  credentialType,
-  docNumber,
-  expirationTime = "2m",
-}) => {
-  /**
-   * Check that the public key used to sign the trustmark is the one used for the WIA
-   */
-  const holderBindingKey = await wiaCryptoContext.getPublicKey();
-  const decodedWia = WalletInstanceAttestation.decode(
-    walletInstanceAttestation
-  );
-
-  Logger.log(
-    LogLevel.DEBUG,
-    `Decoded wia ${JSON.stringify(decodedWia.payload)} with holder binding key ${JSON.stringify(holderBindingKey)}`
-  );
-
-  /**
-   * Check that the WIA is not expired
-   */
-  if (decodedWia.payload.exp * 1000 < Date.now()) {
-    Logger.log(
-      LogLevel.ERROR,
-      `Wallet Instance Attestation expired with exp: ${decodedWia.payload.exp}`
-    );
-    throw new IoWalletError("Wallet Instance Attestation expired");
-  }
-
-  /**
-   * Verify holder binding by comparing thumbprints of the WIA and the CryptoContext key
-   */
-  const wiaThumbprint = await thumbprint(decodedWia.payload.cnf.jwk);
-  const cryptoContextThumbprint = await thumbprint(holderBindingKey);
-
-  if (wiaThumbprint !== cryptoContextThumbprint) {
-    Logger.log(
-      LogLevel.ERROR,
-      `Failed to verify holder binding for status attestation, expected thumbprint: ${cryptoContextThumbprint}, got: ${wiaThumbprint}`
-    );
-    throw new IoWalletError(
-      `Failed to verify holder binding for status attestation, expected thumbprint: ${cryptoContextThumbprint}, got: ${wiaThumbprint}`
-    );
-  }
-
-  Logger.log(
-    LogLevel.DEBUG,
-    `Wia thumbprint: ${wiaThumbprint} CryptoContext thumbprint: ${cryptoContextThumbprint}`
-  );
-
-  /**
-   * Generate Trustmark signed JWT
-   */
-  const signedTrustmarkJwt = await new SignJWT(wiaCryptoContext)
-    .setProtectedHeader({
-      alg: "ES256",
-    })
-    .setPayload({
-      iss: walletInstanceAttestation,
-      /**
-       * If present, the document number is obfuscated before adding it to the payload
-       */
-      ...(docNumber ? { sub: obfuscateString(docNumber) } : {}),
-      subtyp: credentialType,
-    })
-    .setIssuedAt()
-    .setExpirationTime(expirationTime)
-    .sign();
-
-  const decodedTrustmark = decodeJwt(signedTrustmarkJwt);
-
-  return {
-    jwt: signedTrustmarkJwt,
-    expirationTime: decodedTrustmark.payload.exp ?? 0,
-  };
-};

package/src/credentials-catalogue/fetch-and-parse-catalogue.ts

@@ -1,54 +0,0 @@
-import { decode as decodeJwt, verify } from "@pagopa/io-react-native-jwt";
-import { hasStatusOrThrow } from "../utils/misc";
-import { IoWalletError } from "../utils/errors";
-import { DigitalCredentialsCatalogue } from "./types";
-import { getTrustAnchorEntityConfiguration } from "../trust/build-chain";
-
-type GetCatalogueContext = {
-  appFetch?: GlobalFetch["fetch"];
-};
-
-/**
- * Fetch and parse the Digital Credential Catalogue from the Trust Anchor.
- * The catalogue's JWT signature is verified against the Trust Anchor's JWKs.
- *
- * @param trustAnchorUrl Base URL of the Trust Anchor
- * @param context.appFetch (optional) fetch API implementation. Default: built-in fetch
- * @returns The Digital Credential Catalogue payload
- */
-export const fetchAndParseCatalogue = async (
-  trustAnchorBaseUrl: string,
-  { appFetch = fetch }: GetCatalogueContext = {}
-): Promise<DigitalCredentialsCatalogue["payload"]> => {
-  const trustAnchorConfig =
-    await getTrustAnchorEntityConfiguration(trustAnchorBaseUrl);
-
-  const responseText = await appFetch(
-    `${trustAnchorConfig.payload.sub}/.well-known/credential-catalogue`,
-    { method: "GET" }
-  )
-    .then(hasStatusOrThrow(200))
-    .then((res) => res.text());
-
-  const responseJwt = decodeJwt(responseText);
-  const catalogueKid = responseJwt.protectedHeader.kid;
-
-  const trustAnchorJwk = trustAnchorConfig.payload.jwks.keys.find(
-    (jwk) => jwk.kid === catalogueKid
-  );
-
-  if (!trustAnchorJwk) {
-    throw new IoWalletError(
-      `Could not find JWK with kid ${catalogueKid} in Trust Anchor's Entity Configuration`
-    );
-  }
-
-  await verify(responseText, trustAnchorJwk);
-
-  const parsedDigitalCredentialsCatalogue = DigitalCredentialsCatalogue.parse({
-    header: responseJwt.protectedHeader,
-    payload: responseJwt.payload,
-  });
-
-  return parsedDigitalCredentialsCatalogue.payload;
-};

package/src/credentials-catalogue/types.ts

@@ -1,97 +0,0 @@
-import * as z from "zod";
-import { UnixTime } from "../sd-jwt/types";
-
-const CredentialPurpose = z.object({
-  id: z.string(),
-  description: z.string(),
-  category: z.string(),
-  subcategory: z.string(),
-  claims_required: z.array(z.string()),
-  claim_recommended: z.array(z.string()),
-});
-
-const CredentialIssuer = z.object({
-  id: z.string(),
-  organization_name: z.string(),
-  organization_code: z.string(),
-  organization_country: z.string(),
-  contacts: z.array(z.string()).optional(),
-  homepage_uri: z.string().optional(),
-  logo_uri: z.string().optional(),
-  policy_uri: z.string().optional(),
-  tos_uri: z.string().optional(),
-});
-
-const AuthenticSource = z.object({
-  id: z.string(),
-  organization_name: z.string(),
-  organization_code: z.string(),
-  organization_country: z.string(),
-  source_type: z.enum(["public", "private"]),
-  contacts: z.array(z.string()).optional(),
-  homepage_uri: z.string().optional(),
-  logo_uri: z.string().optional(),
-  user_information: z.string().optional(),
-});
-
-const CredentialFormat = z.object({
-  configuration_id: z.string(),
-  format: z.enum(["dc+sd-jwt", "mso_mdoc"]),
-  vct: z.string().url().optional(),
-  docType: z.string().optional(),
-  schema_uri: z.string().url().optional(),
-  "schema_uri#integrity": z.string().optional(),
-});
-
-const Claim = z.object({
-  name: z.string(),
-  taxonomy_ref: z.string(),
-  display_name: z.string(),
-});
-
-export const DigitalCredential = z.object({
-  version: z.string(),
-  credential_type: z.string(),
-  legal_type: z.string(),
-  name: z.string(),
-  description: z.string(),
-  validity_info: z.object({
-    max_validity_days: z.number(),
-    status_methods: z.array(z.string()),
-    allowed_states: z.array(z.string()),
-  }),
-  authentication: z.object({
-    user_auth_required: z.boolean(),
-    min_loa: z.string(),
-    supported_eid_schemes: z.array(z.string()),
-  }),
-  purposes: z.array(CredentialPurpose),
-  issuers: z.array(CredentialIssuer),
-  authentic_sources: z.array(AuthenticSource),
-  formats: z.array(CredentialFormat),
-  claims: z.array(Claim),
-});
-
-/**
- * The Digital Credentials Catalogue published by the Trust Anchor
- *
- * @version 1.1.0
- * @see https://italia.github.io/eid-wallet-it-docs/releases/1.1.0/en/registry-catalogue.html
- */
-export const DigitalCredentialsCatalogue = z.object({
-  header: z.object({
-    typ: z.string(),
-    alg: z.string(),
-    kid: z.string(),
-  }),
-  payload: z.object({
-    catalog_version: z.string(),
-    taxonomy_uri: z.string().url(),
-    credentials: z.array(DigitalCredential),
-    iat: UnixTime,
-    exp: UnixTime,
-  }),
-});
-export type DigitalCredentialsCatalogue = z.infer<
-  typeof DigitalCredentialsCatalogue
->;

package/src/pid/index.ts

@@ -1,2 +0,0 @@
-import * as SdJwt from "./sd-jwt";
-export { SdJwt };

package/src/pid/sd-jwt/converters.ts

@@ -1,20 +0,0 @@
-import { getValueFromDisclosures } from "../../sd-jwt/converters";
-import type { Disclosure, SdJwt4VC } from "../../sd-jwt/types";
-import { PID } from "./types";
-
-export function pidFromToken(sdJwt: SdJwt4VC, disclosures: Disclosure[]): PID {
-  const placeOfBirth = getValueFromDisclosures(disclosures, "place_of_birth");
-  return PID.parse({
-    issuer: sdJwt.payload.iss,
-    issuedAt: new Date(getValueFromDisclosures(disclosures, "iat") * 1000),
-    expiration: new Date(sdJwt.payload.exp * 1000),
-    claims: {
-      uniqueId: getValueFromDisclosures(disclosures, "unique_id"),
-      givenName: getValueFromDisclosures(disclosures, "given_name"),
-      familyName: getValueFromDisclosures(disclosures, "family_name"),
-      birthDate: getValueFromDisclosures(disclosures, "birth_date"),
-      ...(placeOfBirth && placeOfBirth),
-      taxIdCode: getValueFromDisclosures(disclosures, "tax_id_code"),
-    },
-  });
-}