@pagopa/io-react-native-wallet 2.5.1 → 3.0.0

package/src/credential/issuance/mrtd-pop/03-validate-challenge.ts

@@ -1,55 +1,13 @@
-import { SignJWT, type CryptoContext } from "@pagopa/io-react-native-jwt";
+import { SignJWT } from "@pagopa/io-react-native-jwt";
+import { fetchMrtdPopVerify } from "@pagopa/io-wallet-oauth2";
 import { v4 as uuidv4 } from "uuid";
-import { IssuerResponseError } from "../../../utils/errors";
-import { hasStatusOrThrow, type Out } from "../../../utils/misc";
 import { createPopToken } from "../../../utils/pop";
-import * as WalletInstanceAttestation from "../../../wallet-instance-attestation";
-import type { EvaluateIssuerTrust } from "../../issuance";
-import {
-  MrtdPopVerificationResult,
-  type IasPayload,
-  type MrtdPayload,
-} from "./types";
-import type { VerifyAndParseChallengeInfo } from "./01-verify-and-parse-challenge-info";
+import * as WalletInstanceAttestation from "../../../wallet-instance-attestation/v1.0.0/utils"; // TODO: decouple from 1.0.0 version
+import { sdkUnexpectedStatusCodeToIssuerError } from "../../../utils/errors";
+import { partialCallbacks } from "../../../utils/callbacks";
+import type { MRTDPoPApi } from "../api/mrtd-pop";
 
-export type ValidateChallenge = (
-  issuerConf: Out<EvaluateIssuerTrust>["issuerConf"],
-  verifyUrl: string,
-  mrtd_auth_session: string,
-  mrtd_pop_nonce: string,
-  mrtd: MrtdPayload,
-  ias: IasPayload,
-  context: {
-    wiaCryptoContext: CryptoContext;
-    walletInstanceAttestation: string;
-    appFetch?: GlobalFetch["fetch"];
-  }
-) => Promise<MrtdPopVerificationResult>;
-
-export type BuildChallengeCallbackUrl = (
-  redirectUri: Out<ValidateChallenge>["redirect_uri"],
-  valPopNonce: Out<ValidateChallenge>["mrtd_val_pop_nonce"],
-  authSession: Out<VerifyAndParseChallengeInfo>["mrtd_auth_session"]
-) => Promise<{
-  callbackUrl: string;
-}>;
-
-/**
- * Validates the MRTD signed challenge by sending the MRTD and IAS payloads to the issuer.
- * This function must be called after {@link initChallenge} and after obtaining the MRTD and IAS payloads
- * through the CIE PACE process.
- *
- * @param issuerConf - The issuer configuration containing the JWKS for signature verification.
- * @param verifyUrl - The endpoint to call to validate the challenge.
- * @param mrtd_auth_session - Session identifier for session binding obtained from the MRTD Proof JWT.
- * @param mrtd_pop_nonce - Nonce value obtained from the MRTD Proof JWT.
- * @param mrtd - MRTD validation data containing Data Groups and SOD.
- * @param ias - IAS validation data containing Anti-Cloning Public Key, and SOD.
- * @param context - The context containing the WIA crypto context used to retrieve the client public key,
- * the wallet instance attestation and an optional fetch implementation.
- * @returns The MRTD PoP Verification Result containing the validation nonce and redirect URI to complete the flow.
- */
-export const validateChallenge: ValidateChallenge = async (
+export const validateChallenge: MRTDPoPApi["validateChallenge"] = async (
   issuerConf,
   verifyUrl,
   mrtd_auth_session,
@@ -64,13 +22,13 @@ export const validateChallenge: ValidateChallenge = async (
     wiaCryptoContext,
   } = context;
 
-  const aud = issuerConf.openid_credential_issuer.credential_issuer;
+  const aud = issuerConf.credential_issuer;
   const iss = WalletInstanceAttestation.decode(walletInstanceAttestation)
     .payload.cnf.jwk.kid;
 
   const signedWiaPoP = await createPopToken(
     {
-      jti: `${uuidv4()}`,
+      jti: uuidv4(),
       aud,
       iss,
     },
@@ -79,7 +37,7 @@ export const validateChallenge: ValidateChallenge = async (
 
   const { kid } = await wiaCryptoContext.getPublicKey();
 
-  const mrtd_validation_jwt = await new SignJWT(wiaCryptoContext)
+  const mrtdValidationJwt = await new SignJWT(wiaCryptoContext)
     .setProtectedHeader({
       typ: "mrtd-ias+jwt",
       kid,
@@ -95,46 +53,32 @@ export const validateChallenge: ValidateChallenge = async (
     .setExpirationTime("5m")
     .sign();
 
-  const requestBody = {
-    mrtd_validation_jwt,
-    mrtd_auth_session,
-    mrtd_pop_nonce,
-  };
-
-  const verifyResult = await appFetch(verifyUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "OAuth-Client-Attestation": walletInstanceAttestation,
-      "OAuth-Client-Attestation-PoP": signedWiaPoP,
+  const verifyResult = await fetchMrtdPopVerify({
+    popVerifyEndpoint: verifyUrl,
+    mrtdAuthSession: mrtd_auth_session,
+    mrtdPopNonce: mrtd_pop_nonce,
+    clientAttestationDPoP: signedWiaPoP,
+    mrtdValidationJwt,
+    walletAttestation: walletInstanceAttestation,
+    callbacks: {
+      fetch: appFetch,
+      ...partialCallbacks,
     },
-    body: JSON.stringify(requestBody),
-  })
-    .then(hasStatusOrThrow(202, IssuerResponseError))
-    .then((res) => res.json());
+  }).catch(sdkUnexpectedStatusCodeToIssuerError);
 
-  const verifyResultParsed = MrtdPopVerificationResult.parse(verifyResult);
-  return verifyResultParsed;
+  return {
+    redirect_uri: verifyResult.redirectUri,
+    mrtd_val_pop_nonce: verifyResult.mrtdValPopNonce,
+  };
 };
 
-/**
- * WARNING: This function must be called after {@link validateChallenge}. The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
- * Builds the callback URL to which the end user should be redirected to continue the authentication flow after the MRTD challenge validation.
- * @param redirectUri - The redirect URI provided by the issuer after the challenge validation to continue the authentication flow.
- * @param valPopNonce - The MRTD validation PoP nonce obtained from the challenge validation response.
- * @param authSession - The MRTD authentication session identifier used for session binding.
- * @returns An object containing the callback URL
- */
-export const buildChallengeCallbackUrl: BuildChallengeCallbackUrl = async (
-  redirectUri,
-  valPopNonce,
-  authSession
-) => {
-  const params = new URLSearchParams({
-    mrtd_val_pop_nonce: valPopNonce,
-    mrtd_auth_session: authSession,
-  });
+export const buildChallengeCallbackUrl: MRTDPoPApi["buildChallengeCallbackUrl"] =
+  async (redirectUri, valPopNonce, authSession) => {
+    const params = new URLSearchParams({
+      mrtd_val_pop_nonce: valPopNonce,
+      mrtd_auth_session: authSession,
+    });
 
-  const callbackUrl = `${redirectUri}?${params}`;
-  return { callbackUrl };
-};
+    const callbackUrl = `${redirectUri}?${params}`;
+    return { callbackUrl };
+  };

package/src/credential/issuance/mrtd-pop/index.ts

@@ -1,27 +1,14 @@
-import {
-  verifyAndParseChallengeInfo,
-  type VerifyAndParseChallengeInfo,
-} from "./01-verify-and-parse-challenge-info";
-import { initChallenge, type InitChallenge } from "./02-init-challenge";
+import type { MRTDPoPApi } from "../api/mrtd-pop";
+import { verifyAndParseChallengeInfo } from "./01-verify-and-parse-challenge-info";
+import { initChallenge } from "./02-init-challenge";
 import {
   validateChallenge,
   buildChallengeCallbackUrl,
-  type ValidateChallenge,
-  type BuildChallengeCallbackUrl,
 } from "./03-validate-challenge";
-import type { MrtdPayload, IasPayload } from "./types";
 
-export {
+export const MRTDPoP: MRTDPoPApi = {
   verifyAndParseChallengeInfo,
   initChallenge,
   validateChallenge,
   buildChallengeCallbackUrl,
 };
-export type {
-  VerifyAndParseChallengeInfo,
-  InitChallenge,
-  ValidateChallenge,
-  BuildChallengeCallbackUrl,
-  MrtdPayload,
-  IasPayload,
-};

package/src/credential/issuance/v1.0.0/01-evaluate-issuer-trust.ts

@@ -0,0 +1,14 @@
+import { getCredentialIssuerEntityConfiguration } from "../../../trust/v1.0.0/entities";
+import type { IssuanceApi } from "../api";
+import { mapToIssuerConfig } from "./mappers";
+
+export const evaluateIssuerTrust: IssuanceApi["evaluateIssuerTrust"] = async (
+  issuerUrl,
+  context = {}
+) => {
+  const issuerConf = await getCredentialIssuerEntityConfiguration(issuerUrl, {
+    appFetch: context.appFetch,
+  });
+
+  return { issuerConf: mapToIssuerConfig(issuerConf) };
+};

package/src/credential/issuance/v1.0.0/02-start-user-authorization.ts

@@ -0,0 +1,68 @@
+import { generateRandomAlphaNumericString } from "../../../utils/misc";
+import { makeParRequest } from "../../../utils/par";
+import { LogLevel, Logger } from "../../../utils/logging";
+import { IoWalletError } from "../../../utils/errors";
+import type { IssuanceApi } from "../api";
+import {
+  selectCredentialDefinition,
+  selectResponseMode,
+} from "../common/authorization";
+
+export const startUserAuthorization: IssuanceApi["startUserAuthorization"] =
+  async (issuerConf, credentialIds, proof, ctx) => {
+    const {
+      wiaCryptoContext,
+      walletInstanceAttestation,
+      redirectUri,
+      appFetch = fetch,
+    } = ctx;
+
+    const clientId = await wiaCryptoContext.getPublicKey().then((_) => _.kid);
+
+    if (!clientId) {
+      Logger.log(
+        LogLevel.ERROR,
+        `Public key associated with kid ${clientId} not found in the device`
+      );
+      throw new IoWalletError("No public key found");
+    }
+    const codeVerifier = generateRandomAlphaNumericString(64);
+    const parEndpoint = issuerConf.pushed_authorization_request_endpoint;
+    const aud = issuerConf.credential_issuer;
+    const responseMode = selectResponseMode(issuerConf, credentialIds);
+    const getPar = makeParRequest({ wiaCryptoContext, appFetch });
+
+    const credentialDefinition = credentialIds.map((c) =>
+      selectCredentialDefinition(issuerConf, c)
+    );
+
+    if (proof.proofType === "mrtd-pop") {
+      /**
+       * When we requests a PID using eID Substantial Authentication with MRTD Verification, we must include
+       * an additional Authorization Details Object in the authorization_details
+       *
+       * See https://italia.github.io/eid-wallet-it-docs/versione-corrente/en/credential-issuance-endpoint.html#pushed-authorization-request-endpoint
+       */
+      credentialDefinition.push({
+        type: "it_l2+document_proof",
+        idphinting: proof.idpHinting,
+        challenge_method: "mrtd+ias",
+        challenge_redirect_uri: redirectUri,
+      });
+    }
+
+    const issuerRequestUri = await getPar(
+      parEndpoint,
+      walletInstanceAttestation,
+      {
+        aud,
+        clientId,
+        codeVerifier,
+        redirectUri,
+        responseMode,
+        authorizationDetails: credentialDefinition,
+      }
+    );
+
+    return { issuerRequestUri, clientId, codeVerifier, credentialDefinition };
+  };

package/src/credential/issuance/v1.0.0/03-complete-user-authorization.ts

@@ -0,0 +1,279 @@
+import {
+  AuthorizationChallengeResultShape,
+  AuthorizationErrorShape,
+  AuthorizationResultShape,
+  type AuthorizationResult,
+} from "../../../utils/auth";
+import { hasStatusOrThrow } from "../../../utils/misc";
+import parseUrl from "parse-url";
+import type { DcqlQuery } from "dcql";
+import { IssuerResponseError, ValidationFailed } from "../../../utils/errors";
+import {
+  decode,
+  SignJWT,
+  type CryptoContext,
+} from "@pagopa/io-react-native-jwt";
+import { ResponseUriResultShape } from "./types";
+import { getJwtFromFormPost } from "../../../utils/decoder";
+import { AuthorizationError, AuthorizationIdpError } from "../common/errors";
+import { LogLevel, Logger } from "../../../utils/logging";
+import { RequestObjectPayload } from "../../presentation/v1.0.0/types";
+import { RemotePresentation as RemotePresentationFlow } from "../../presentation/v1.0.0";
+import type { IssuanceApi } from "../api";
+import type { RemotePresentation } from "../../presentation";
+
+export const continueUserAuthorizationWithMRTDPoPChallenge: IssuanceApi["continueUserAuthorizationWithMRTDPoPChallenge"] =
+  async (authRedirectUrl) => {
+    Logger.log(
+      LogLevel.DEBUG,
+      `The requested credential is a PersonIdentificationData and requires MRTD PoP, starting MRTD PoP validation from auth redirect`
+    );
+    const query = parseUrl(authRedirectUrl).query;
+
+    const authResParsed = AuthorizationChallengeResultShape.safeParse(query);
+    if (!authResParsed.success) {
+      const authErr = AuthorizationErrorShape.safeParse(query);
+      if (!authErr.success) {
+        Logger.log(
+          LogLevel.ERROR,
+          `Error while parsing the authorization response: ${authResParsed.error.message}`
+        );
+        throw new AuthorizationError(authResParsed.error.message); // an error occured while parsing the result and the error
+      }
+      Logger.log(
+        LogLevel.ERROR,
+        `Error while authorizating with the idp: ${JSON.stringify(authErr)}`
+      );
+      throw new AuthorizationIdpError(
+        authErr.data.error,
+        authErr.data.error_description
+      );
+    }
+    return authResParsed.data;
+  };
+
+export const buildAuthorizationUrl: IssuanceApi["buildAuthorizationUrl"] =
+  async (issuerRequestUri, clientId, issuerConf, idpHint) => {
+    const authzRequestEndpoint = issuerConf.authorization_endpoint;
+
+    const params = new URLSearchParams({
+      client_id: clientId,
+      request_uri: issuerRequestUri,
+    });
+
+    if (idpHint) {
+      params.append("idphint", idpHint);
+    }
+
+    const authUrl = `${authzRequestEndpoint}?${params}`;
+
+    return { authUrl };
+  };
+
+export const completeUserAuthorizationWithQueryMode: IssuanceApi["completeUserAuthorizationWithQueryMode"] =
+  async (authRedirectUrl) => {
+    Logger.log(
+      LogLevel.DEBUG,
+      `The requested credential is a PersonIdentificationData, completing the user authorization with query mode`
+    );
+    const query = parseUrl(authRedirectUrl).query;
+
+    return parseAuthorizationResponse(query);
+  };
+
+export const getRequestedCredentialToBePresented: IssuanceApi["getRequestedCredentialToBePresented"] =
+  async (issuerRequestUri, clientId, issuerConf, appFetch = fetch) => {
+    Logger.log(
+      LogLevel.DEBUG,
+      `The requeste credential is not a PersonIdentificationData, requesting the credential to be presented`
+    );
+    const authzRequestEndpoint = issuerConf.authorization_endpoint;
+    const params = new URLSearchParams({
+      client_id: clientId,
+      request_uri: issuerRequestUri,
+    });
+
+    Logger.log(
+      LogLevel.DEBUG,
+      `Requesting the request object to ${authzRequestEndpoint}?${params.toString()}`
+    );
+
+    const requestObject = await appFetch(
+      `${authzRequestEndpoint}?${params.toString()}`,
+      { method: "GET" }
+    )
+      .then(hasStatusOrThrow(200, IssuerResponseError))
+      .then((res) => res.text())
+      .then((jws) => decode(jws))
+      .then((reqObj) => RequestObjectPayload.safeParse(reqObj.payload));
+
+    if (!requestObject.success) {
+      Logger.log(
+        LogLevel.ERROR,
+        `Error while validating the response object: ${requestObject.error.message}`
+      );
+      throw new ValidationFailed({
+        message: "Request Object validation failed",
+        reason: requestObject.error.message,
+      });
+    }
+    return requestObject.data;
+  };
+
+export const completeUserAuthorizationWithFormPostJwtMode: IssuanceApi["completeUserAuthorizationWithFormPostJwtMode"] =
+  async (
+    requestObject,
+    _issuerConfig,
+    pid,
+    { wiaCryptoContext, pidKeyTag, appFetch = fetch }
+  ) => {
+    Logger.log(
+      LogLevel.DEBUG,
+      `The requeste credential is not a PersonIdentificationData, completing the user authorization with form_post.jwt mode`
+    );
+
+    const dcqlQueryResult = await RemotePresentationFlow.evaluateDcqlQuery(
+      requestObject.dcql_query as DcqlQuery,
+      [[pidKeyTag, pid]]
+    );
+
+    const authRequestObject = {
+      nonce: requestObject.nonce,
+      clientId: requestObject.client_id,
+      responseUri: requestObject.response_uri,
+    };
+
+    const remotePresentation =
+      await RemotePresentationFlow.prepareRemotePresentations(
+        dcqlQueryResult,
+        authRequestObject
+      );
+
+    const authzResponsePayload = await createAuthzResponsePayload({
+      state: requestObject.state,
+      remotePresentation,
+      wiaCryptoContext,
+    });
+
+    Logger.log(
+      LogLevel.DEBUG,
+      `Authz response payload: ${authzResponsePayload}`
+    );
+
+    // Note: according to the spec, the response should be encrypted with the public key of the RP however this is not implemented yet
+    // https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-signed-and-encrypted-response
+    // const rsaPublicJwk = chooseRSAPublicKeyToEncrypt(rpConf);
+    // const encrypted = await new EncryptJwe(authzResponsePayload, {
+    //   alg: "RSA-OAEP-256",
+    //   enc: "A256CBC-HS512",
+    //   kid: rsaPublicJwk.kid,
+    // }).encrypt(rsaPublicJwk);
+
+    const body = new URLSearchParams({
+      response: authzResponsePayload,
+    }).toString();
+
+    const resUriRes = await appFetch(requestObject.response_uri, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+      body,
+    })
+      .then(hasStatusOrThrow(200, IssuerResponseError))
+      .then((reqUri) => reqUri.json());
+
+    const responseUri = ResponseUriResultShape.safeParse(resUriRes);
+    if (!responseUri.success) {
+      Logger.log(
+        LogLevel.ERROR,
+        `Error while validating the response uri: ${responseUri.error.message}`
+      );
+      throw new ValidationFailed({
+        message: "Response Uri validation failed",
+        reason: responseUri.error.message,
+      });
+    }
+
+    return await appFetch(responseUri.data.redirect_uri)
+      .then(hasStatusOrThrow(200, IssuerResponseError))
+      .then((res) => res.text())
+      .then(getJwtFromFormPost)
+      .then((cbRes) => parseAuthorizationResponse(cbRes.decodedJwt.payload));
+  };
+
+/**
+ * Parse the authorization response and return the result which contains code, state and iss.
+ * @throws {AuthorizationError} if an error occurs during the parsing process
+ * @throws {AuthorizationIdpError} if an error occurs during the parsing process and the error is related to the IDP
+ * @param authRes the authorization response to be parsed
+ * @returns the authorization result which contains code, state and iss
+ */
+export const parseAuthorizationResponse = (
+  authRes: unknown
+): AuthorizationResult => {
+  const authResParsed = AuthorizationResultShape.safeParse(authRes);
+  if (!authResParsed.success) {
+    const authErr = AuthorizationErrorShape.safeParse(authRes);
+    if (!authErr.success) {
+      Logger.log(
+        LogLevel.ERROR,
+        `Error while parsing the authorization response: ${authResParsed.error.message}`
+      );
+      throw new AuthorizationError(authResParsed.error.message); // an error occured while parsing the result and the error
+    }
+    Logger.log(
+      LogLevel.ERROR,
+      `Error while authorizating with the idp: ${JSON.stringify(authErr)}`
+    );
+    throw new AuthorizationIdpError(
+      authErr.data.error,
+      authErr.data.error_description
+    );
+  }
+  return authResParsed.data;
+};
+
+/**
+ * Creates the authorization response payload to be sent.
+ * This payload includes the state and the VP tokens for the presented credentials.
+ * The payload is encoded in Base64.
+ * @param state - The state parameter from the request object (optional).
+ * @param remotePresentations - An array of remote presentations containing credential IDs and their corresponding VP tokens.
+ * @returns The Base64 encoded authorization response payload.
+ */
+const createAuthzResponsePayload = async ({
+  state,
+  remotePresentation,
+  wiaCryptoContext,
+}: {
+  state?: string;
+  remotePresentation: RemotePresentation;
+  wiaCryptoContext: CryptoContext;
+}): Promise<string> => {
+  const { kid } = await wiaCryptoContext.getPublicKey();
+
+  return new SignJWT(wiaCryptoContext)
+    .setProtectedHeader({
+      typ: "jwt",
+      kid,
+    })
+    .setPayload({
+      /**
+       * TODO [SIW-2264]: `state` coming from `requestObject` is marked as `optional`
+       * At the moment, it is not entirely clear whether this value can indeed be omitted
+       * and, if so, what the consequences of its absence might be.
+       */
+      ...(state ? { state } : {}),
+      vp_token: remotePresentation.presentations.reduce(
+        (vp_token, { credentialId, vpToken }) => ({
+          ...vp_token,
+          [credentialId]: vpToken,
+        }),
+        {}
+      ),
+    })
+    .setIssuedAt()
+    .setExpirationTime("1h")
+    .sign();
+};

package/src/credential/issuance/v1.0.0/04-authorize-access.ts

@@ -0,0 +1,93 @@
+import { v4 as uuidv4 } from "uuid";
+import { hasStatusOrThrow } from "../../../utils/misc";
+import { createDPopToken } from "../../../utils/dpop";
+import { createPopToken } from "../../../utils/pop";
+import { TokenResponse } from "./types";
+import { IssuerResponseError, ValidationFailed } from "../../../utils/errors";
+import { LogLevel, Logger } from "../../../utils/logging";
+import type { IssuanceApi } from "../api";
+import * as WalletInstanceAttestation from "../../../wallet-instance-attestation/v1.0.0/utils";
+
+export const authorizeAccess: IssuanceApi["authorizeAccess"] = async (
+  issuerConf,
+  code,
+  redirectUri,
+  codeVerifier,
+  context
+) => {
+  const {
+    appFetch = fetch,
+    walletInstanceAttestation,
+    wiaCryptoContext,
+    dPopCryptoContext,
+  } = context;
+  const aud = issuerConf.credential_issuer;
+  const iss = WalletInstanceAttestation.decode(walletInstanceAttestation)
+    .payload.cnf.jwk.kid;
+
+  const tokenUrl = issuerConf.token_endpoint;
+
+  const tokenRequestSignedDPop = await createDPopToken(
+    {
+      htm: "POST",
+      htu: tokenUrl,
+      jti: `${uuidv4()}`,
+    },
+    dPopCryptoContext
+  );
+
+  Logger.log(LogLevel.DEBUG, `Token request DPoP: ${tokenRequestSignedDPop}`);
+
+  const signedWiaPoP = await createPopToken(
+    {
+      jti: `${uuidv4()}`,
+      aud,
+      iss,
+    },
+    wiaCryptoContext
+  );
+
+  Logger.log(LogLevel.DEBUG, `WIA DPoP token: ${signedWiaPoP}`);
+
+  const requestBody = {
+    grant_type: "authorization_code",
+    code,
+    code_verifier: codeVerifier,
+    redirect_uri: redirectUri,
+  };
+
+  const authorizationRequestFormBody = new URLSearchParams(requestBody);
+
+  Logger.log(
+    LogLevel.DEBUG,
+    `Auth form request body: ${authorizationRequestFormBody}`
+  );
+
+  const tokenRes = await appFetch(tokenUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      DPoP: tokenRequestSignedDPop,
+      "OAuth-Client-Attestation": walletInstanceAttestation,
+      "OAuth-Client-Attestation-PoP": signedWiaPoP,
+    },
+    body: authorizationRequestFormBody.toString(),
+  })
+    .then(hasStatusOrThrow(200, IssuerResponseError))
+    .then((res) => res.json())
+    .then((body) => TokenResponse.safeParse(body));
+
+  if (!tokenRes.success) {
+    Logger.log(
+      LogLevel.ERROR,
+      `Token Response validation failed: ${tokenRes.error.message}`
+    );
+
+    throw new ValidationFailed({
+      message: "Token Response validation failed",
+      reason: tokenRes.error.message,
+    });
+  }
+
+  return { accessToken: tokenRes.data };
+};