@pagopa/io-react-native-wallet 2.5.1 → 3.0.0

package/src/pid/sd-jwt/index.ts

@@ -1,74 +0,0 @@
-import { decode as decodeJwt, verify as verifyJwt } from "../../sd-jwt";
-import { PID } from "./types";
-import { pidFromToken } from "./converters";
-import { Disclosure, SdJwt4VC } from "../../sd-jwt/types";
-
-/**
- * Decode a given SD-JWT with Disclosures to get the parsed PID object they define.
- * It ensures provided data is in a valid shape.
- *
- * It DOES NOT verify token signature nor check disclosures are correctly referenced by the SD-JWT.
- * Use {@link verify} instead
- *
- * @function
- * @param token The encoded token that represents a valid sd-jwt for verifiable credentials
- *
- * @returns The validated PID object along with the parsed SD-JWT token and the parsed disclosures
- * @throws A decoding error if the token doesn't resolve in a valid SD-JWT
- * @throws A validation error if the provided data doesn't result in a valid PID
- *
- */
-export function decode(token: string): PidWithToken {
-  let { sdJwt, disclosures: disclosuresWithOriginal } = decodeJwt(
-    token,
-    SdJwt4VC
-  );
-  const disclosures = disclosuresWithOriginal.map((d) => d.decoded);
-  const pid = pidFromToken(sdJwt, disclosures);
-
-  return { pid, sdJwt, disclosures };
-}
-
-/**
- * Verify a given SD-JWT with Disclosures to get the parsed PID object they define.
- * Same as {@link decode} plus:
- *   - token signature verification
- *   - ensure disclosures are well-defined inside the SD-JWT
- *
- * @async @function
- *
- * @todo implement signature validation
- * @todo check disclosures in sd-jwt
- *
- * @param token The encoded token that represents a valid sd-jwt for verifiable credentials
- *
- * @returns {VerifyResult} The validated PID object along with the parsed SD-JWT token and the parsed disclosures
- * @throws A decoding error if the token doesn't resolve in a valid SD-JWT
- * @throws A validation error if the provided data doesn't result in a valid PID
- * @throws A validation error if the provided disclosures are not defined in the SD-JWT
- * @throws Invalid signature error if the token signature is not valid
- *
- */
-export async function verify(token: string): Promise<VerifyResult> {
-  const decoded = decode(token);
-  const publicKey = decoded.sdJwt.payload.cnf.jwk;
-  await verifyJwt(token, publicKey, SdJwt4VC);
-
-  return decoded;
-}
-
-export type PidWithToken = {
-  // The object with the parsed data for PID
-  pid: PID;
-  // The object with the parsed SD-JWT token that shipped the PID. It will be needed to present PID data.
-  sdJwt: SdJwt4VC;
-  // Parsed list of discloures with PID values. It will be needed to present PID data.
-  disclosures: Disclosure[];
-};
-
-/**
- * Result object for {@link verify}
- */
-export type VerifyResult = PidWithToken;
-
-export { PID } from "./types";

package/src/pid/sd-jwt/types.ts

@@ -1,46 +0,0 @@
-import { z } from "zod";
-
-const VerificationEvidence = z.object({
-  type: z.string(),
-  record: z.object({
-    type: z.string(),
-    source: z.object({
-      organization_name: z.string(),
-      organization_id: z.string(),
-      country_code: z.string(),
-    }),
-  }),
-});
-type Verification = z.infer<typeof Verification>;
-const Verification = z.object({
-  trustFramework: z.literal("eidas"),
-  assuranceLevel: z.string(),
-  evidence: z.array(VerificationEvidence),
-});
-
-/**
- * Data structure for the PID.
- * It contains PID claims in plain text as well as verification data with the issuer's information
- *
- * @see https://italia.github.io/eidas-it-wallet-docs/en/pid-data-model.html
- */
-export type PID = z.infer<typeof PID>;
-export const PID = z.object({
-  issuer: z.string(),
-  issuedAt: z.date(),
-  expiration: z.date(),
-  verification: Verification.optional(),
-  claims: z.object({
-    uniqueId: z.string(),
-    givenName: z.string(),
-    familyName: z.string(),
-    birthDate: z.string(),
-    placeOfBirth: z
-      .object({
-        country: z.string(),
-        locality: z.string(),
-      })
-      .optional(),
-    taxIdCode: z.string(),
-  }),
-});

package/src/sd-jwt/__test__/converters.test.ts

@@ -1,27 +0,0 @@
-import { getValueFromDisclosures } from "../converters";
-import { Disclosure } from "../types";
-
-const disclosures: Disclosure[] = [
-  ["6w1_soRXFgaHKfpYn3cvfQ", "given_name", "Mario"],
-  ["fuNp97Hf3wV6y48y-QZhIg", "birth_date", "1980-10-01"],
-  [
-    "p-9LzyWHZBVDvhXDWkN2xA",
-    "place_of_birth",
-    { country: "IT", locality: "Rome" },
-  ],
-];
-
-describe("getValueFromDisclosures", () => {
-  it("should return correct value for given_name", () => {
-    const success = getValueFromDisclosures(disclosures, "given_name");
-    expect(success).toBe("Mario");
-  });
-  it("should return correct value for place_of_birth", () => {
-    const success = getValueFromDisclosures(disclosures, "place_of_birth");
-    expect(success).toEqual({ country: "IT", locality: "Rome" });
-  });
-  it("should fail", () => {
-    const success = getValueFromDisclosures(disclosures, "given_surname");
-    expect(success).toBeUndefined();
-  });
-});

package/src/sd-jwt/__test__/index.test.ts

@@ -1,152 +0,0 @@
-import { z } from "zod";
-import { decode, disclose } from "../index";
-
-import { decodeBase64, encodeBase64 } from "@pagopa/io-react-native-jwt";
-import { SdJwt4VC } from "../types";
-import { pid } from "../__mocks__/sd-jwt";
-
-const { token, signed, tokenizedDisclosures } = pid;
-
-const sdJwt = {
-  header: {
-    kid: "-F_6Uga8n3VegjY2U7YUHK1zLoaD-NPTc63RMISnLaw",
-    typ: "dc+sd-jwt",
-    alg: "ES256",
-  },
-  payload: {
-    _sd: [
-      "0q1D5Jmav6pQaEh_J_Fcv_uNNMQIgCyhQOxqlY4l3qU",
-      "KCJ-AVNv88d-xj6sUIAOJxFnbUh3rHXDKkIH1lFqbRs",
-      "M9lo9YxDNIXrAq2qWeiCA40zpJ_zYfFdR_4AEALcRtU",
-      "czgjUk0nqRCswShChCjdS6A1-v47d_qTCSFIvIHhMoI",
-      "nGnQr7clm3tfTp8yjL_uHrDSOtzR2PVb8S7GeLdAqBQ",
-      "xNIVwlpSsaZ8CJSf0gz5x_75VRWWc6V1mlpejdCrqUs",
-    ],
-    sub: "216f8946-9ecb-4819-9309-c076f34a7e11",
-    _sd_alg: "sha-256",
-    vct: "PersonIdentificationData",
-    "vct#integrity":
-      "13e25888ac7b8a3a6d61440da787fccc81654e61085732bcacd89b36aec32675",
-    iss: "https://pre.eid.wallet.ipzs.it",
-    issuing_country: "IT",
-    issuing_authority: "Istituto Poligrafico e Zecca dello Stato",
-    cnf: {
-      jwk: {
-        kty: "EC",
-        crv: "P-256",
-        kid: "Rv3W-EiKpvBTyk5yZxvrev-7MDB6SlzUCBo_CQjjddU",
-        x: "0Wox7QtyPqByg35MH_XyCcnd5Le-Jm0AXHlUgDBA03Y",
-        y: "eEhVvg1JPqNd3DTSa4mGDGBlwY6NP-EZbLbNFXSXwIg",
-      },
-    },
-    exp: 1751546576,
-    status: {
-      status_assertion: {
-        credential_hash_alg: "sha-256",
-      },
-    },
-  },
-};
-
-// In the very same order than tokenizedDisclosures
-const disclosures = [
-  ["kJDEP8EaNTEMBDOZzZzT4w", "unique_id", "TINIT-LVLDAA85T50G702B"],
-  ["zIAyUFvPfIpE1zBqxI5haQ", "birth_date", "1985-12-10"],
-  ["Gr3R3s290OkQUm-NFTu96A", "tax_id_code", "TINIT-LVLDAA85T50G702B"],
-  ["GxORalMAelfZ0edFJjjYUw", "given_name", "Ada"],
-  ["_vV5RIkl0IOEXKots9kt1w", "family_name", "Lovelace"],
-  ["Cj5tccR72Jwrze2TW4a-wg", "iat", 1720010575],
-];
-it("Ensures example data correctness", () => {
-  expect(
-    JSON.parse(decodeBase64(encodeBase64(JSON.stringify(sdJwt.header))))
-  ).toEqual(sdJwt.header);
-  expect([signed, ...tokenizedDisclosures].join("~")).toBe(token);
-});
-
-describe("decode", () => {
-  it("should decode a valid token", () => {
-    const result = decode(token, SdJwt4VC);
-    expect(result).toEqual({
-      sdJwt,
-      disclosures: disclosures.map((decoded, i) => ({
-        decoded,
-        encoded: tokenizedDisclosures[i],
-      })),
-    });
-  });
-
-  it("should decode with default decoder", () => {
-    const result = decode(token);
-    expect(result).toEqual({
-      sdJwt,
-      disclosures: disclosures.map((decoded, i) => ({
-        decoded,
-        encoded: tokenizedDisclosures[i],
-      })),
-    });
-  });
-
-  it("should accept only decoders that extend SdJwt4VC", () => {
-    const validDecoder = SdJwt4VC.and(
-      z.object({ payload: z.object({ customField: z.string() }) })
-    );
-    const invalidDecoder = z.object({
-      payload: z.object({ customField: z.string() }),
-    });
-
-    try {
-      // ts is fine
-      decode(token, validDecoder);
-      // @ts-expect-error break types
-      decode(token, invalidDecoder);
-    } catch (error) {
-      // ignore actual result, just focus on types
-      // spot the error during type checking phase
-    }
-  });
-});
-
-describe("disclose", () => {
-  it("should encode a valid sdjwt (one claim)", async () => {
-    const result = await disclose(token, ["given_name"]);
-    const expected = {
-      token: `${signed}~WyJHeE9SYWxNQWVsZlowZWRGSmpqWVV3IiwiZ2l2ZW5fbmFtZSIsIkFkYSJd`,
-      paths: [{ claim: "given_name", path: "verified_claims.claims._sd[3]" }],
-    };
-
-    expect(result).toEqual(expected);
-  });
-
-  it("should encode a valid sdjwt (no claims)", async () => {
-    const result = await disclose(token, []);
-    const expected = { token: `${signed}`, paths: [] };
-
-    expect(result).toEqual(expected);
-  });
-
-  it("should encode a valid sdjwt (multiple claims)", async () => {
-    const result = await disclose(token, ["iat", "family_name"]);
-    const expected = {
-      token: `${signed}~WyJfdlY1UklrbDBJT0VYS290czlrdDF3IiwiZmFtaWx5X25hbWUiLCJMb3ZlbGFjZSJd~WyJDajV0Y2NSNzJKd3J6ZTJUVzRhLXdnIiwiaWF0IiwxNzIwMDEwNTc1XQ`,
-      paths: [
-        {
-          claim: "iat",
-          path: "verified_claims.claims._sd[4]",
-        },
-        {
-          claim: "family_name",
-          path: "verified_claims.claims._sd[0]",
-        },
-      ],
-    };
-
-    expect(result).toEqual(expected);
-  });
-
-  it("should fail on unknown claim", async () => {
-    const fn = async () => disclose(token, ["unknown"]);
-
-    await expect(fn()).rejects.toEqual(expect.any(Error));
-  });
-});

package/src/sd-jwt/converters.ts

@@ -1,24 +0,0 @@
-import type { Disclosure } from "./types";
-
-export function getValueFromDisclosures(
-  disclosures: Disclosure[],
-  claimName: string
-) {
-  const value = disclosures.find(([, name]) => name === claimName)?.[2];
-  // value didn't found, we return nothing
-  if (!value) {
-    return undefined;
-  }
-  // value is not a string, it's probably fine
-  if (typeof value !== "string") {
-    return value;
-  }
-  // value is a string, we try to parse it
-  // maybe it's a serialized object
-  try {
-    return JSON.parse(value);
-  } catch (error) {
-    // It's definitely a string
-    return value;
-  }
-}

package/src/sd-jwt/errors.ts

@@ -1,39 +0,0 @@
-/**
- * When claims are requested but not found in the credential
- *
- */
-export class ClaimsNotFoundBetweenDisclosures extends Error {
-  code = "ERR_CLAIMS_NOT_FOUND";
-
-  /** The Claims not found */
-  claims: string[];
-
-  constructor(claims: string | string[]) {
-    const c = Array.isArray(claims) ? claims : [claims];
-    const message = `Some requested claims are not present in the disclosurable values, claims: ${c.join(
-      ", "
-    )}`;
-    super(message);
-    this.claims = c;
-  }
-}
-
-/**
- * When the SD-JWT does not contain an hashed reference to a given set of claims
- */
-export class ClaimsNotFoundInToken extends Error {
-  code = "ERR_CLAIMS_NOT_FOUND_IN_TOKEN";
-
-  /** The Claims not found */
-  claims: string[];
-
-  constructor(claims: string | string[]) {
-    const claimsArray = Array.isArray(claims) ? claims : [claims];
-    super(
-      `Some requested claims are not present in the disclosurable values: ${claimsArray.join(
-        ", "
-      )}`
-    );
-    this.claims = claimsArray;
-  }
-}

package/src/sd-jwt/verifier.ts

@@ -1,18 +0,0 @@
-import { sha256ToBase64 } from "@pagopa/io-react-native-jwt";
-
-import { ValidationFailed } from "../utils/errors";
-import type { DisclosureWithEncoded, ObfuscatedDisclosures } from "./types";
-
-export const verifyDisclosure = async (
-  { encoded, decoded }: DisclosureWithEncoded,
-  claims: ObfuscatedDisclosures["_sd"]
-) => {
-  let hash = await sha256ToBase64(encoded);
-  if (!claims.includes(hash)) {
-    throw new ValidationFailed({
-      message: "Validation of disclosure failed",
-      claim: `${decoded}`,
-      reason: "Disclosure hash not found in claims",
-    });
-  }
-};