@pagopa/io-react-native-wallet 2.5.1 → 3.0.0

package/lib/typescript/wallet-instance-attestation/v1.3.3/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/wallet-instance-attestation/v1.3.3/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAWzB,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBlC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAChF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBnC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/io-react-native-wallet",
-  "version": "2.5.1",
+  "version": "3.0.0",
   "description": "Provide data structures, helpers and API for IO Wallet",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",
@@ -54,7 +54,7 @@
   },
   "devDependencies": {
     "@pagopa/io-react-native-crypto": "^1.2.3",
-    "@pagopa/io-react-native-iso18013": "^0.3.0",
+    "@pagopa/io-react-native-iso18013": "^0.7.0",
     "@pagopa/io-react-native-jwt": "^2.1.0",
     "@react-native/babel-preset": "0.78.3",
     "@react-native/eslint-config": "0.78.3",
@@ -110,12 +110,16 @@
   },
   "jest": {
     "preset": "react-native",
+    "transform": {
+      "\\.[jt]sx?$": "babel-jest",
+      "\\.mjs$": "babel-jest"
+    },
     "modulePathIgnorePatterns": [
       "<rootDir>/example/node_modules",
       "<rootDir>/lib/"
     ],
     "transformIgnorePatterns": [
-      "node_modules/(?!(jest-)?@react-native|react-native|uuid|@pagopa/io-react-native-iso18013)"
+      "node_modules/(?!(jest-)?@react-native|react-native|uuid|@pagopa/io-react-native-iso18013|@openid4vc|dcql)"
     ],
     "setupFiles": [
       "<rootDir>/jestSetup.js"
@@ -136,18 +140,21 @@
     ]
   },
   "dependencies": {
-    "@sd-jwt/core": "^0.18.0",
-    "@sd-jwt/crypto-nodejs": "^0.18.0",
-    "@sd-jwt/types": "^0.18.0",
-    "dcql": "^0.2.21",
-    "js-base64": "^3.7.7",
-    "js-sha256": "^0.9.0",
-    "jsonpath-plus": "^10.2.0",
+    "@pagopa/io-wallet-oauth2": "^1.0.0",
+    "@pagopa/io-wallet-oid4vci": "^1.0.0",
+    "@pagopa/io-wallet-oid4vp": "^1.0.0",
+    "@pagopa/io-wallet-utils": "^1.0.0",
+    "@sd-jwt/core": "^0.19.0",
+    "@sd-jwt/crypto-nodejs": "^0.19.0",
+    "@sd-jwt/jwt-status-list": "^0.19.0",
+    "@sd-jwt/types": "^0.19.0",
+    "dcql": "^3.0.0",
+    "js-base64": "^3.7.8",
+    "js-sha256": "^0.11.1",
     "jsrsasign": "^11.1.0",
-    "parse-url": "^9.2.0",
+    "parse-url": "^10.0.3",
     "react-native-url-polyfill": "^2.0.0",
-    "react-native-uuid": "^2.0.1",
     "uuid": "^11.0.3",
-    "zod": "^3.21.4"
+    "zod": "^3.25.76"
   }
 }

package/src/IoWallet.ts

@@ -0,0 +1,50 @@
+import { ioWalletApiByVersion, type IoWalletApi, type ItwVersion } from "./api";
+
+type DigitalWalletConfig = {
+  /**
+   * IT-Wallet specifications version.
+   */
+  version: ItwVersion;
+};
+
+/**
+ * Instantiate `IoWallet` SDK for a specific IT-Wallet version.
+ *
+ * After initialization, each feature can be accessed under the corresponding namespace.
+ *
+ * @example
+ * const wallet = new IoWallet({ version: "1.0.0" })
+ * wallet.Credential.Issuance.exampleMethod()
+ */
+export class IoWallet {
+  #version: ItwVersion;
+
+  /**
+   * Get the IT-Wallet specifications version bound to this instance.
+   */
+  get version() {
+    return this.#version;
+  }
+
+  constructor({ version }: DigitalWalletConfig) {
+    this.#version = version;
+    const walletApi = ioWalletApiByVersion[version];
+
+    if (!walletApi) {
+      throw new Error(
+        `Invalid version provided: IoWallet does not implement ${version} specifications.`
+      );
+    }
+
+    // Dynamically add features implementations aligned with the specified version
+    for (const feature of Object.keys(walletApi) as (keyof IoWalletApi)[]) {
+      Object.defineProperty(this, feature, {
+        enumerable: true,
+        configurable: false,
+        value: walletApi[feature],
+      });
+    }
+  }
+}
+
+export interface IoWallet extends IoWalletApi {}

package/src/api/index.ts

@@ -0,0 +1,55 @@
+import * as WalletInstance from "../wallet-instance";
+import * as WIA from "../wallet-instance-attestation";
+import * as Trust from "../trust";
+import * as CredentialIssuance from "../credential/issuance";
+import * as CredentialStatus from "../credential/status";
+import * as RemotePresentation from "../credential/presentation";
+import * as CredentialsCatalogue from "../credentials-catalogue";
+import * as Trustmark from "../credential/trustmark";
+import * as CredentialsOffer from "../credential/offer";
+
+export type ItwVersion = "1.0.0" | "1.3.3";
+
+/**
+ * The Wallet public API.
+ */
+export interface IoWalletApi {
+  WalletInstance: WalletInstance.WalletInstanceApi;
+  WalletInstanceAttestation: WIA.WalletInstanceAttestationApi;
+  Trust: Trust.TrustApi;
+  CredentialIssuance: CredentialIssuance.IssuanceApi;
+  CredentialStatus: CredentialStatus.CredentialStatusApi;
+  RemotePresentation: RemotePresentation.RemotePresentationApi;
+  CredentialsCatalogue: CredentialsCatalogue.CredentialsCatalogueApi;
+  Trustmark: Trustmark.TrustmarkApi;
+  CredentialsOffer: CredentialsOffer.OfferApi;
+}
+
+/**
+ * The Wallet API implementations grouped by IT-Wallet specifications version.
+ */
+export const ioWalletApiByVersion: Record<ItwVersion, IoWalletApi> = {
+  "1.0.0": {
+    WalletInstance: WalletInstance.V1_0_0,
+    WalletInstanceAttestation: WIA.V1_0_0,
+    Trust: Trust.V1_0_0,
+    CredentialIssuance: CredentialIssuance.V1_0_0,
+    CredentialStatus: CredentialStatus.V1_0_0,
+    RemotePresentation: RemotePresentation.V1_0_0,
+    CredentialsCatalogue: CredentialsCatalogue.V1_0_0,
+    Trustmark: Trustmark.V1_0_0,
+    CredentialsOffer: CredentialsOffer.V1_0_0,
+  },
+  // TODO: replace v1.0.0 with v1.3.3 implementations
+  "1.3.3": {
+    WalletInstance: WalletInstance.V1_3_3,
+    WalletInstanceAttestation: WIA.V1_3_3,
+    Trust: Trust.V1_0_0,
+    CredentialIssuance: CredentialIssuance.V1_3_3,
+    CredentialStatus: CredentialStatus.V1_3_3,
+    RemotePresentation: RemotePresentation.V1_3_3,
+    CredentialsCatalogue: CredentialsCatalogue.V1_3_3,
+    Trustmark: Trustmark.V1_3_3,
+    CredentialsOffer: CredentialsOffer.V1_3_3,
+  },
+};

package/src/credential/index.ts

@@ -1,7 +1,3 @@
-import * as Issuance from "./issuance";
-import * as Presentation from "./presentation";
-import * as Status from "./status";
-import * as Trustmark from "./trustmark";
 import * as Offer from "./offer";
 
-export { Issuance, Presentation, Status, Trustmark, Offer };
+export { Offer };

package/src/credential/issuance/README.md

@@ -98,6 +98,10 @@ The expected result from the authentication process is in `form_post.jwt` format
   <summary>Credential issuance flow</summary>
 
 ```ts
+import { IoWallet } from "@pagopa/io-react-native-wallet";
+
+const wallet = new IoWallet({ version: "1.0.0" });
+
 // Retrieve the integrity key tag from the store and create its context
 const integrityKeyTag = "example"; // Let's assume this is the key tag used to create the wallet instance
 const integrityContext = getIntegrityContext(integrityKeyTag);
@@ -134,22 +138,14 @@ const credentialKeyTag = uuidv4().toString();
 await generate(credentialKeyTag); // Let's assume this function generates a new hardware-backed key pair
 const credentialCryptoContext = createCryptoContextFor(credentialKeyTag);
 
-// Start the issuance flow
-const startFlow: Credential.Issuance.StartFlow = () => ({
-  issuerUrl: WALLET_EAA_PROVIDER_BASE_URL,
-  credentialId: "someCredentialId",
-});
-
-const { issuerUrl, credentialId } = startFlow();
-
 // Evaluate issuer trust
-const { issuerConf } = await Credential.Issuance.evaluateIssuerTrust(issuerUrl);
+const { issuerConf } = await wallet.CredentialIssuance.evaluateIssuerTrust(WALLET_EAA_PROVIDER_BASE_URL);
 
 // Start user authorization
 const { issuerRequestUri, clientId, codeVerifier } =
-  await Credential.Issuance.startUserAuthorization(
+  await wallet.CredentialIssuance.startUserAuthorization(
     issuerConf,
-    [credentialId],
+    ["someCredentialId"],
     { proofType: "none" },
     {
       walletInstanceAttestation,
@@ -160,7 +156,7 @@ const { issuerRequestUri, clientId, codeVerifier } =
   );
 
 const requestObject =
-  await Credential.Issuance.getRequestedCredentialToBePresented(
+  await wallet.CredentialIssuance.getRequestedCredentialToBePresented(
     issuerRequestUri,
     clientId,
     issuerConf,
@@ -169,7 +165,7 @@ const requestObject =
 
 // Complete the user authorization via form_post.jwt mode
 const { code } =
-  await Credential.Issuance.completeUserAuthorizationWithFormPostJwtMode(
+  await wallet.CredentialIssuance.completeUserAuthorizationWithFormPostJwtMode(
     requestObject,
     pid.credential,
     { wiaCryptoContext, pidCryptoContext: createCryptoContextFor(pid.keyTag) }
@@ -179,11 +175,10 @@ const { code } =
 await regenerateCryptoKey(DPOP_KEYTAG); // Let's assume this function regenerates this ephemeral key for the DPoP
 const dPopCryptoContext = createCryptoContextFor(DPOP_KEYTAG);
 
-const { accessToken } = await Credential.Issuance.authorizeAccess(
+const { accessToken } = await wallet.CredentialIssuance.authorizeAccess(
   issuerConf,
   code,
-  clientId,
-  redirectUri: REDIRECT_URI,
+  REDIRECT_URI,
   codeVerifier,
   {
     walletInstanceAttestation,
@@ -198,7 +193,7 @@ const { credential_configuration_id, credential_identifiers } =
     accessToken.authorization_details[0]!;
 
  // Obtain the credential
-const { credential, format } = await Credential.Issuance.obtainCredential(
+const { credential, format } = await wallet.CredentialIssuance.obtainCredential(
   issuerConf,
   accessToken,
   clientId,
@@ -222,7 +217,7 @@ const mockX509CertRoot = format === "mso_mdoc" ? "base64encodedX509CertRoot" : u
  * WARNING: includeUndefinedAttributes should not be set to true in production in order to get only claims explicitly declared by the issuer.
  */
 const { parsedCredential } =
-  await Credential.Issuance.verifyAndParseCredential(
+  await wallet.CredentialIssuance.verifyAndParseCredential(
     issuerConf,
     credential,
     credential_configuration_id,
@@ -254,6 +249,10 @@ return {
   <summary>eID issuance flow</summary>
 
 ```ts
+import { IoWallet } from "@pagopa/io-react-native-wallet";
+
+const wallet = new IoWallet({ version: "1.0.0" });
+
 // Retrieve the integrity key tag from the store and create its context
 const integrityKeyTag = "example"; // Let's assume this is the key tag used to create the wallet instance
 const integrityContext = getIntegrityContext(integrityKeyTag);
@@ -293,25 +292,17 @@ const credentialKeyTag = uuidv4().toString();
 await generate(credentialKeyTag);
 const credentialCryptoContext = createCryptoContextFor(credentialKeyTag);
 
-// Start the issuance flow
-const startFlow: Credential.Issuance.StartFlow = () => ({
-  issuerUrl: WALLET_EID_PROVIDER_BASE_URL,
-  credentialId: "dc_sd_jwt_PersonIdentificationData",
-});
-
-const { issuerUrl, credentialId } = startFlow();
-
 // Evaluate issuer trust
-const { issuerConf } = await Credential.Issuance.evaluateIssuerTrust(
-  issuerUrl,
+const { issuerConf } = await wallet.CredentialIssuance.evaluateIssuerTrust(
+  WALLET_EID_PROVIDER_BASE_URL,
   { appFetch }
 );
 
 // Start user authorization
 const { issuerRequestUri, clientId, codeVerifier, credentialDefinition } =
-  await Credential.Issuance.startUserAuthorization(
+  await wallet.CredentialIssuance.startUserAuthorization(
     issuerConf,
-    [credentialId], // Request authorization for one or more credentials
+    ["dc_sd_jwt_PersonIdentificationData"], // Request authorization for one or more credentials
     { proofType: "none" },
     {
       walletInstanceAttestation,
@@ -323,7 +314,7 @@ const { issuerRequestUri, clientId, codeVerifier, credentialDefinition } =
 
 // Complete the authorization process with query mode with the authorizationContext which opens the browser
 const { code } =
-  await Credential.Issuance.completeUserAuthorizationWithQueryMode(
+  await wallet.CredentialIssuance.completeUserAuthorizationWithQueryMode(
     issuerRequestUri
   );
 
@@ -331,10 +322,9 @@ const { code } =
 await regenerateCryptoKey(DPOP_KEYTAG);
 const dPopCryptoContext = createCryptoContextFor(DPOP_KEYTAG);
 
-const { accessToken } = await Credential.Issuance.authorizeAccess(
+const { accessToken } = await wallet.CredentialIssuance.authorizeAccess(
   issuerConf,
   code,
-  clientId,
   redirectUri,
   codeVerifier,
   {
@@ -358,7 +348,7 @@ const { credential_configuration_id, credential_identifiers } =
     );
 
 // Obtain che eID credential
-const { credential, format } = await Credential.Issuance.obtainCredential(
+const { credential, format } = await wallet.CredentialIssuance.obtainCredential(
   issuerConf,
   accessToken,
   clientId,
@@ -374,7 +364,7 @@ const { credential, format } = await Credential.Issuance.obtainCredential(
 );
 
 // Parse and verify the eID credential
-const { parsedCredential, issuedAt, expiration } = await Credential.Issuance.verifyAndParseCredential(
+const { parsedCredential, issuedAt, expiration } = await wallet.CredentialIssuance.verifyAndParseCredential(
   issuerConf,
   credential,
   credential_configuration_id,
@@ -400,6 +390,10 @@ The result of this flow is a raw credential and a parsed credential which must b
   <summary>eID issuance flow with MRTD PoP validation</summary>
 
 ```ts
+import { IoWallet } from "@pagopa/io-react-native-wallet";
+
+const wallet = new IoWallet({ version: "1.0.0" });
+
 /**
  *
  * Previous steps are the sames as the "eID issuance flow" example
@@ -409,7 +403,7 @@ The result of this flow is a raw credential and a parsed credential which must b
 // Start user authorization indicating "mrtd-pop" as the proof type with the idpHint of the
 // chosen identification method
 const { issuerRequestUri, clientId, codeVerifier, credentialDefinition } =
-  await Credential.Issuance.startUserAuthorization(
+  await wallet.CredentialIssuance.startUserAuthorization(
     issuerConf,
     [credentialId],
     { proofType: "mrtd-pop", idpHinting: idpHint },
@@ -422,7 +416,7 @@ const { issuerRequestUri, clientId, codeVerifier, credentialDefinition } =
   );
 
 // Obtain the Authorization URL
-const { authUrl } = await Credential.Issuance.buildAuthorizationUrl(
+const { authUrl } = await wallet.CredentialIssuance.buildAuthorizationUrl(
   issuerRequestUri,
   clientId,
   issuerConf,
@@ -431,7 +425,7 @@ const { authUrl } = await Credential.Issuance.buildAuthorizationUrl(
 
 // Extract challenge info from the Authorization URL
 const { challenge_info } =
-  await Credential.Issuance.continueUserAuthorizationWithMRTDPoPChallenge(
+  await wallet.CredentialIssuance.continueUserAuthorizationWithMRTDPoPChallenge(
     authUrl
   );
 
@@ -440,7 +434,7 @@ const {
   htu: initUrl,
   mrtd_auth_session,
   mrtd_pop_jwt_nonce,
-} = await Credential.Issuance.MRTDPoP.verifyAndParseChallengeInfo(
+} = await wallet.CredentialIssuance.MRTDPoP.verifyAndParseChallengeInfo(
   issuerConf,
   challenge_info,
   { wiaCryptoContext }
@@ -451,7 +445,7 @@ const {
   htu: validationUrl,
   challenge,
   mrtd_pop_nonce,
-} = await Credential.Issuance.MRTDPoP.initChallenge(
+} = await wallet.CredentialIssuance.MRTDPoP.initChallenge(
   issuerConf,
   initUrl,
   mrtd_auth_session,
@@ -468,7 +462,7 @@ const { nis, mrtds } = /* NFC interactions functions */
 
 // Validate challenge
 const { mrtd_val_pop_nonce, redirect_uri } =
-  await Credential.Issuance.MRTDPoP.validateChallenge(
+  await wallet.CredentialIssuance.MRTDPoP.validateChallenge(
     issuerConf,
     validationUrl,
     mrtd_auth_session,
@@ -483,7 +477,7 @@ const { mrtd_val_pop_nonce, redirect_uri } =
   );
 
 // Build the callback url
-const { callbackUrl } = await Credential.Issuance.buildChallengeCallbackUrl(
+const { callbackUrl } = await wallet.CredentialIssuance.buildChallengeCallbackUrl(
   redirect_uri,
   mrtd_val_pop_nonce,
   mrtd_auth_session
@@ -494,7 +488,7 @@ const authRedirectUrl = /* From a browser or webview redirect */
 
 // Complete the authorization process with query mode using the returned callback url
 const { code } =
-  await Credential.Issuance.completeUserAuthorizationWithQueryMode(
+  await wallet.CredentialIssuance.completeUserAuthorizationWithQueryMode(
     authRedirectUrl
   );
 
@@ -503,7 +497,6 @@ const { code } =
  * The next steps are the same as the "eID issuance flow" example
  *
  */
-};
 ```
 
 The result of this flow is a raw credential and a parsed credential which must be stored securely in the wallet along with its crypto key.

package/src/credential/issuance/api/01-evaluate-issuer-trust.ts

@@ -0,0 +1,17 @@
+import type { IssuerConfig } from "./IssuerConfig";
+
+export interface EvaluateIssuerTrustApi {
+  /**
+   * The Issuer trust evaluation phase.
+   * Fetch the Issuer's configuration and verify trust.
+   * @since 1.0.0
+   *
+   * @param issuerUrl The base url of the Issuer
+   * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
+   * @returns The Issuer's configuration
+   */
+  evaluateIssuerTrust(
+    issuerUrl: string,
+    ctx?: { appFetch?: GlobalFetch["fetch"] }
+  ): Promise<{ issuerConf: IssuerConfig }>;
+}

package/src/credential/issuance/api/02-start-user-authorization.ts

@@ -0,0 +1,50 @@
+import type { CryptoContext } from "@pagopa/io-react-native-jwt";
+import type { AuthorizationDetail } from "../../../utils/par";
+import type { IssuerConfig } from "./IssuerConfig";
+
+export interface StartUserAuthorizationApi {
+  /**
+   * WARNING: This function must be called after {@link evaluateIssuerTrust}. The next steam is {@link completeUserAuthorizationWithQueryMode} or {@link completeUserAuthorizationWithFormPostJwtMode}
+   *
+   * Creates and sends a PAR request to the PAR endpoint of the authorization server.
+   * This starts the authentication flow to obtain an access token.
+   * This token enables the Wallet Instance to request a digital credential from the Credential Endpoint of the Credential Issuer; when multiple credential types are passed,
+   * it is possible to use the same access token for the issuance of all requested credentials.
+   *
+   * This is an HTTP POST request containing the Wallet Instance identifier (client id), the code challenge and challenge method as specified by PKCE according to RFC 9126
+   * along with the WTE and its proof of possession (WTE-PoP).
+   * Additionally, it includes a request object, which is a signed JWT encapsulating the type of digital credential requested (authorization_details), challenge method and
+   * redirect URI for the document proof step (if L2 flow), the application session identifier on the Wallet Instance side (state), the method (query or form_post.jwt)
+   * by which the Authorization Server should transmit the Authorization Response containing the authorization code issued upon the end user's authentication (response_mode)
+   * to the Wallet Instance's Token Endpoint to obtain the Access Token, and the redirectUri of the Wallet Instance where the Authorization Response should be delivered.
+   * The redirect is achived by using a custom URL scheme that the Wallet Instance is registered to handle.
+   * @since 1.0.0
+   *
+   * @param issuerConf The issuer configuration
+   * @param credentialIds The credential configuration IDs to be requested
+   * @param proof The configuration for the proof to be used in the request: "none" for standard flows, "document" for L2+ with MRTD verification.
+   * @param context.wiaCryptoContext The Wallet Instance's cryptographic context
+   * @param context.walletInstanceAttestation: the Wallet Instance's attestation
+   * @param context.redirectUri: the redirect URI
+   * @param context.appFetch: (optional) the fetch implementation
+   * @returns The URI to which the end user should be redirected to start the authentication flow, along with additional authentication parameters
+   */
+  startUserAuthorization(
+    issuerConf: IssuerConfig,
+    credentialIds: string[],
+    proof:
+      | { proofType: "none" }
+      | { proofType: "mrtd-pop"; idpHinting: string },
+    context: {
+      wiaCryptoContext: CryptoContext;
+      walletInstanceAttestation: string;
+      redirectUri: string;
+      appFetch?: GlobalFetch["fetch"];
+    }
+  ): Promise<{
+    issuerRequestUri: string;
+    clientId: string;
+    codeVerifier: string;
+    credentialDefinition: AuthorizationDetail[];
+  }>;
+}

package/src/credential/issuance/api/03-complete-user-authorization.ts

@@ -0,0 +1,102 @@
+import type { CryptoContext } from "@pagopa/io-react-native-jwt";
+import type {
+  AuthorizationChallengeResult,
+  AuthorizationResult,
+} from "../../../utils/auth";
+import type { RequestObject } from "../../../credential/presentation/api";
+import type { IssuerConfig } from "./IssuerConfig";
+
+export interface CompleteUserAuthorizationApi {
+  /**
+   * WARNING: This function must be called after {@link startUserAuthorization}. The next function to be called is {@link completeUserAuthorizationWithFormPostJwtMode}.
+   *
+   * The interface of the phase to complete User authorization via presentation of existing credentials when the response mode is "form_post.jwt".
+   * It is used as a first step to complete the user authorization by obtaining the requested credential to be presented from the authorization server.
+   * The information is obtained by performing a GET request to the authorization endpoint with request_uri and client_id parameters.
+   * @since 1.0.0
+   *
+   * @param issuerRequestUri the URI of the issuer where the request is sent
+   * @param clientId Identifies the current client across all the requests of the issuing flow returned by {@link startUserAuthorization}
+   * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
+   * @param appFetch (optional) fetch api implementation. Default: built-in fetch
+   * @returns the request object which contains the credential to be presented in order to obtain the requested credential
+   * @throws {ValidationFailed} if an error while validating the response
+   */
+  getRequestedCredentialToBePresented(
+    issuerRequestUri: string,
+    clientId: string,
+    issuerConf: IssuerConfig,
+    appFetch?: GlobalFetch["fetch"]
+  ): Promise<RequestObject>;
+
+  /**
+   * WARNING: This function must be called after obtaining the authorization redirect URL from the webviews (SPID and CIE L3) or browser for CIEID.
+   *
+   * Complete User authorization via strong identification when the response mode is "query" and the request credential is a PersonIdentificationData.
+   * This function parses the authorization redirect URL to extract the authorization response.
+   * @since 1.0.0
+   *
+   * @param authRedirectUrl The URL to which the end user should be redirected to start the authentication flow
+   * @returns the authorization response which contains code, state and iss
+   */
+  completeUserAuthorizationWithQueryMode(
+    authRedirectUrl: string
+  ): Promise<AuthorizationResult>;
+
+  /**
+   * WARNING: This function must be called after {@link getRequestedCredentialToBePresented}. The next function to be called is {@link authorizeAccess}.
+   *
+   * The interface of the phase to complete User authorization via presentation of existing credentials when the response mode is "form_post.jwt".
+   * The information is obtained by performing a POST request to the endpoint received in the response_uri field of the requestObject, where the Authorization Response payload is posted.
+   * Following this,the redirect_uri from the response is used to obtain the final authorization response.
+   * @since 1.0.0
+   *
+   * @param requestObject - The request object containing the necessary parameters for authorization.
+   * @param pid The `PID` that must be presented for the issuance of credentials.
+   * @param appFetch (optional) fetch api implementation. Default: built-in fetch
+   * @returns the authorization response which contains code, state and iss
+   * @throws {ValidationFailed} if an error while validating the response
+   */
+  completeUserAuthorizationWithFormPostJwtMode(
+    requestObject: RequestObject,
+    issuerConf: IssuerConfig,
+    pid: string,
+    context: {
+      wiaCryptoContext: CryptoContext;
+      pidKeyTag: string;
+      appFetch?: GlobalFetch["fetch"];
+    }
+  ): Promise<AuthorizationResult>;
+
+  /**
+   * WARNING: this function must be called after obtaining the authorization redirect URL from the webviews (SPID and CIE L3) or browser for CIEID, and the PID
+   * issuance requires a MRTD PoP challenge.
+   * @since 1.0.0
+   *
+   * @param authRedirectUrl The URL to which the end user should be redirected to start the MRTD PoP validation flow
+   * @returns the authorization response which contains the challenge
+   */
+  continueUserAuthorizationWithMRTDPoPChallenge(
+    authRedirectUrl: string
+  ): Promise<AuthorizationChallengeResult>;
+
+  /**
+   * WARNING: This function must be called after {@link startUserAuthorization}.
+   *
+   * The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
+   * Builds the authorization URL to which the end user should be redirected to continue the authentication flow.
+   * @since 1.0.0
+   *
+   * @param issuerRequestUri the URI of the issuer where the request is sent
+   * @param clientId Identifies the current client across all the requests of the issuing flow returned by {@link startUserAuthorization}
+   * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
+   * @param idpHint Unique identifier of the IDP selected by the user (optional)
+   * @returns An object containing the authorization URL
+   */
+  buildAuthorizationUrl(
+    issuerRequestUri: string,
+    clientId: string,
+    issuerConf: IssuerConfig,
+    idpHint?: string
+  ): Promise<{ authUrl: string }>;
+}

package/src/credential/issuance/api/04-authorize-access.ts

@@ -0,0 +1,37 @@
+import type { CryptoContext } from "@pagopa/io-react-native-jwt";
+import type { IssuerConfig } from "./IssuerConfig";
+import type { TokenResponse } from "./types";
+
+export interface AuthorizeAccessApi {
+  /**
+   * Creates and sends the DPoP Proof JWT to be presented with the authorization code to the /token endpoint of the authorization server
+   * for requesting the issuance of an access token bound to the public key of the Wallet Instance contained within the DPoP.
+   * This enables the Wallet Instance to request a digital credential.
+   * The DPoP Proof JWT is generated according to the section 4.3 of the DPoP RFC 9449 specification.
+   * @since 1.0.0
+   *
+   * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
+   * @param code The authorization code returned by {@link completeUserAuthorizationWithQueryMode} or {@link completeUserAuthorizationWithFormPost}
+   * @param redirectUri The redirect URI which is the custom URL scheme that the Wallet Instance is registered to handle
+   * @param codeVerifier The code verifier returned by {@link startUserAuthorization}
+   * @param context.walletInstanceAttestation The Wallet Instance's attestation
+   * @param context.wiaCryptoContext The Wallet Instance's crypto context
+   * @param context.dPopCryptoContext The DPoP crypto context
+   * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
+   * @return The token response containing the access token along with the token request signed with DPoP which has to be used in the {@link obtainCredential} step.
+   * @throws {ValidationFailed} if an error occurs while parsing the token response
+   * @throws {IssuerResponseError} with a specific code for more context
+   */
+  authorizeAccess(
+    issuerConf: IssuerConfig,
+    code: string,
+    redirectUri: string,
+    codeVerifier: string,
+    context: {
+      walletInstanceAttestation: string;
+      wiaCryptoContext: CryptoContext;
+      dPopCryptoContext: CryptoContext;
+      appFetch?: GlobalFetch["fetch"];
+    }
+  ): Promise<{ accessToken: TokenResponse }>;
+}