@pagopa/io-react-native-wallet 2.5.1 → 3.0.0

package/src/credential/issuance/v1.0.0/05-obtain-credential.ts

@@ -0,0 +1,212 @@
+import {
+  type CryptoContext,
+  sha256ToBase64,
+  SignJWT,
+} from "@pagopa/io-react-native-jwt";
+import { v4 as uuidv4 } from "uuid";
+import { hasStatusOrThrow } from "../../../utils/misc";
+import {
+  IssuerResponseError,
+  IssuerResponseErrorCodes,
+  ResponseErrorBuilder,
+  UnexpectedStatusCodeError,
+  ValidationFailed,
+} from "../../../utils/errors";
+import { createDPopToken } from "../../../utils/dpop";
+import { LogLevel, Logger } from "../../../utils/logging";
+import type { IssuanceApi } from "../api";
+import { CredentialResponse, NonceResponse } from "./types";
+
+export const createNonceProof = async (
+  nonce: string,
+  issuer: string,
+  audience: string,
+  ctx: CryptoContext
+): Promise<string> => {
+  const jwk = await ctx.getPublicKey();
+  return new SignJWT(ctx)
+    .setPayload({
+      nonce,
+    })
+    .setProtectedHeader({
+      typ: "openid4vci-proof+jwt",
+      jwk,
+    })
+    .setAudience(audience)
+    .setIssuer(issuer)
+    .setIssuedAt()
+    .setExpirationTime("5min")
+    .sign();
+};
+
+export const obtainCredential: IssuanceApi["obtainCredential"] = async (
+  issuerConf,
+  accessToken,
+  clientId,
+  credentialDefinition,
+  context
+) => {
+  const {
+    credentialCryptoContext,
+    appFetch = fetch,
+    dPopCryptoContext,
+  } = context;
+  const { credential_configuration_id, credential_identifier } =
+    credentialDefinition;
+
+  const credentialUrl = issuerConf.credential_endpoint;
+  const issuerUrl = issuerConf.credential_issuer;
+  const nonceUrl = issuerConf.nonce_endpoint;
+
+  // Fetch the nonce from the Credential Issuer
+  const { c_nonce } = await appFetch(nonceUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+  })
+    .then(hasStatusOrThrow(200))
+    .then((res) => res.json())
+    .then((body) => NonceResponse.parse(body));
+
+  /**
+   * JWT proof token to bind the request nonce to the key that will bind the holder User with the Credential
+   * This is presented along with the access token to the Credential Endpoint as proof of possession of the private key used to sign the Access Token.
+   * @see https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#name-proof-types
+   */
+  const signedNonceProof = await createNonceProof(
+    c_nonce,
+    clientId,
+    issuerUrl,
+    credentialCryptoContext
+  );
+
+  Logger.log(LogLevel.DEBUG, `Signed nonce proof: ${signedNonceProof}`);
+
+  // Validation of accessTokenResponse.authorization_details if contain credentialDefinition
+  const containsCredentialDefinition = accessToken.authorization_details.some(
+    (c) =>
+      c.credential_configuration_id === credential_configuration_id &&
+      (credential_identifier
+        ? c.credential_identifiers.includes(credential_identifier)
+        : true)
+  );
+
+  if (!containsCredentialDefinition) {
+    Logger.log(
+      LogLevel.ERROR,
+      `Credential definition not found in the access token response ${accessToken.authorization_details}`
+    );
+    throw new ValidationFailed({
+      message:
+        "The access token response does not contain the requested credential",
+    });
+  }
+
+  /**
+   * The credential request body.
+   * We accept both `credential_identifier` (recommended) and `credential_configuration_id`
+   * when the Authorization Server does not support `credential_identifier`.
+   * @see https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-15.html#section-3.3.4
+   */
+  const credentialRequestFormBody = credential_identifier
+    ? {
+        credential_identifier: credential_identifier,
+        proof: { jwt: signedNonceProof, proof_type: "jwt" },
+      }
+    : {
+        credential_configuration_id: credential_configuration_id,
+        proof: { jwt: signedNonceProof, proof_type: "jwt" },
+      };
+
+  Logger.log(
+    LogLevel.DEBUG,
+    `Credential request body: ${JSON.stringify(credentialRequestFormBody)}`
+  );
+
+  const tokenRequestSignedDPop = await createDPopToken(
+    {
+      htm: "POST",
+      htu: credentialUrl,
+      jti: `${uuidv4()}`,
+      ath: await sha256ToBase64(accessToken.access_token),
+    },
+    dPopCryptoContext
+  );
+
+  Logger.log(LogLevel.DEBUG, `Token request DPoP: ${tokenRequestSignedDPop}`);
+
+  const credentialRes = await appFetch(credentialUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      DPoP: tokenRequestSignedDPop,
+      Authorization: `${accessToken.token_type} ${accessToken.access_token}`,
+    },
+    body: JSON.stringify(credentialRequestFormBody),
+  })
+    .then(hasStatusOrThrow(200))
+    .then((res) => res.json())
+    .then((body) => CredentialResponse.safeParse(body))
+    .catch(handleObtainCredentialError);
+
+  if (!credentialRes.success) {
+    Logger.log(
+      LogLevel.ERROR,
+      `Credential Response validation failed: ${credentialRes.error.message}`
+    );
+    throw new ValidationFailed({
+      message: "Credential Response validation failed",
+      reason: credentialRes.error.message,
+    });
+  }
+
+  Logger.log(
+    LogLevel.DEBUG,
+    `Credential Response: ${JSON.stringify(credentialRes.data)}`
+  );
+
+  // Extract the format corresponding to the credential_configuration_id used
+  const issuerCredentialConfig =
+    issuerConf.credential_configurations_supported[credential_configuration_id];
+
+  // TODO: [SIW-2264] Handle multiple credentials
+  return {
+    credential: credentialRes.data.credentials.at(0)!.credential,
+    format: issuerCredentialConfig!.format,
+  };
+};
+
+/**
+ * Handle the credential error by mapping it to a custom exception.
+ * If the error is not an instance of {@link UnexpectedStatusCodeError}, it is thrown as is.
+ * @param e - The error to be handled
+ * @throws {IssuerResponseError} with a specific code for more context
+ */
+const handleObtainCredentialError = (e: unknown) => {
+  Logger.log(LogLevel.ERROR, `Error occurred while obtaining credential: ${e}`);
+
+  if (!(e instanceof UnexpectedStatusCodeError)) {
+    throw e;
+  }
+
+  throw new ResponseErrorBuilder(IssuerResponseError)
+    .handle(201, {
+      // Although it is technically not an error, we handle it as such to avoid
+      // changing the return type of `obtainCredential` and introduce a breaking change.
+      code: IssuerResponseErrorCodes.CredentialIssuingNotSynchronous,
+      message:
+        "This credential cannot be issued synchronously. It will be available at a later time.",
+    })
+    .handle(403, {
+      code: IssuerResponseErrorCodes.CredentialInvalidStatus,
+      message: "Invalid status found for the given credential",
+    })
+    .handle(404, {
+      code: IssuerResponseErrorCodes.CredentialInvalidStatus,
+      message: "Invalid status found for the given credential",
+    })
+    .handle("*", {
+      code: IssuerResponseErrorCodes.CredentialRequestFailed,
+      message: "Unable to obtain the requested credential",
+    })
+    .buildFrom(e);
+};

package/src/credential/issuance/v1.0.0/06-verify-and-parse-credential.ts

@@ -0,0 +1,46 @@
+import { IoWalletError } from "../../../utils/errors";
+import { Logger, LogLevel } from "../../../utils/logging";
+import { verifyAndParseCredentialMDoc } from "../common/06-verify-and-parse-credential.mdoc";
+import { verifyAndParseCredentialSdJwt } from "../common/06-verify-and-parse-credential.sdjwt";
+import type { IssuanceApi } from "../api";
+
+export const verifyAndParseCredential: IssuanceApi["verifyAndParseCredential"] =
+  async (
+    issuerConf,
+    credential,
+    credentialConfigurationId,
+    context,
+    x509CertRoot
+  ) => {
+    const format =
+      issuerConf.credential_configurations_supported[credentialConfigurationId]
+        ?.format;
+
+    switch (format) {
+      case "dc+sd-jwt": {
+        Logger.log(LogLevel.DEBUG, "Parsing credential in dc+sd-jwt format");
+        return verifyAndParseCredentialSdJwt(
+          issuerConf,
+          credential,
+          credentialConfigurationId,
+          context
+        );
+      }
+      case "mso_mdoc": {
+        Logger.log(LogLevel.DEBUG, "Parsing credential in mso_mdoc format");
+        return verifyAndParseCredentialMDoc(
+          issuerConf,
+          credential,
+          credentialConfigurationId,
+          context,
+          x509CertRoot
+        );
+      }
+
+      default: {
+        const message = `Unsupported credential format: ${format}`;
+        Logger.log(LogLevel.ERROR, message);
+        throw new IoWalletError(message);
+      }
+    }
+  };

package/src/credential/issuance/v1.0.0/index.ts

@@ -0,0 +1,28 @@
+import type { IssuanceApi } from "../api";
+import { evaluateIssuerTrust } from "./01-evaluate-issuer-trust";
+import { startUserAuthorization } from "./02-start-user-authorization";
+import {
+  continueUserAuthorizationWithMRTDPoPChallenge,
+  completeUserAuthorizationWithQueryMode,
+  completeUserAuthorizationWithFormPostJwtMode,
+  buildAuthorizationUrl,
+  getRequestedCredentialToBePresented,
+} from "./03-complete-user-authorization";
+import { authorizeAccess } from "./04-authorize-access";
+import { obtainCredential } from "./05-obtain-credential";
+import { verifyAndParseCredential } from "./06-verify-and-parse-credential";
+import { MRTDPoP } from "../mrtd-pop";
+
+export const Issuance: IssuanceApi = {
+  evaluateIssuerTrust,
+  startUserAuthorization,
+  buildAuthorizationUrl,
+  completeUserAuthorizationWithQueryMode,
+  continueUserAuthorizationWithMRTDPoPChallenge,
+  getRequestedCredentialToBePresented,
+  completeUserAuthorizationWithFormPostJwtMode,
+  authorizeAccess,
+  obtainCredential,
+  verifyAndParseCredential,
+  MRTDPoP,
+};

package/src/credential/issuance/v1.0.0/mappers.ts

@@ -0,0 +1,29 @@
+import { CredentialIssuerEntityConfiguration } from "../../../trust/v1.0.0/types";
+import { createMapper } from "../../../utils/mappers";
+import type { IssuerConfig } from "../api/IssuerConfig";
+
+export const mapToIssuerConfig = createMapper<
+  CredentialIssuerEntityConfiguration,
+  IssuerConfig
+>((x) => {
+  const {
+    oauth_authorization_server,
+    openid_credential_issuer,
+    federation_entity,
+  } = x.payload.metadata;
+  return {
+    authorization_endpoint: oauth_authorization_server.authorization_endpoint,
+    credential_endpoint: openid_credential_issuer.credential_endpoint,
+    credential_issuer: openid_credential_issuer.credential_issuer,
+    credential_configurations_supported:
+      openid_credential_issuer.credential_configurations_supported,
+    keys: openid_credential_issuer.jwks.keys,
+    pushed_authorization_request_endpoint:
+      oauth_authorization_server.pushed_authorization_request_endpoint,
+    token_endpoint: oauth_authorization_server.token_endpoint,
+    status_assertion_endpoint:
+      openid_credential_issuer.status_attestation_endpoint,
+    nonce_endpoint: openid_credential_issuer.nonce_endpoint,
+    federation_entity,
+  };
+});

package/src/credential/issuance/v1.0.0/types.ts

@@ -0,0 +1,28 @@
+import * as z from "zod";
+import { AuthorizationDetail, TokenResponse } from "../api/types";
+
+// Reusing the following API types because they are the same in v1.0.0
+export { AuthorizationDetail, TokenResponse };
+
+export type CredentialResponse = z.infer<typeof CredentialResponse>;
+
+export const CredentialResponse = z.object({
+  credentials: z.array(
+    z.object({
+      credential: z.string(),
+    })
+  ),
+  notification_id: z.string().optional(),
+});
+
+/**
+ * Shape from parsing a response given by a request uri during the EAA credential issuance flow with response mode "form_post.jwt".
+ */
+export const ResponseUriResultShape = z.object({
+  redirect_uri: z.string(),
+});
+
+export type NonceResponse = z.infer<typeof NonceResponse>;
+export const NonceResponse = z.object({
+  c_nonce: z.string(),
+});

package/src/credential/issuance/v1.3.3/01-evaluate-issuer-trust.ts

@@ -0,0 +1,19 @@
+import { fetchMetadata } from "@pagopa/io-wallet-oid4vci";
+import { partialCallbacks } from "../../../utils/callbacks";
+import type { IssuanceApi } from "../api";
+import { mapToIssuerConfig } from "./mappers";
+
+export const evaluateIssuerTrust: IssuanceApi["evaluateIssuerTrust"] = async (
+  issuerUrl,
+  context = {}
+) => {
+  const issuerMetadata = await fetchMetadata({
+    credentialIssuerUrl: issuerUrl,
+    callbacks: {
+      ...partialCallbacks,
+      fetch: context.appFetch,
+    },
+  });
+
+  return { issuerConf: mapToIssuerConfig(issuerMetadata) };
+};

package/src/credential/issuance/v1.3.3/02-start-user-authorization.ts

@@ -0,0 +1,109 @@
+import {
+  createPushedAuthorizationRequest,
+  fetchPushedAuthorizationResponse,
+  createClientAttestationPopJwt,
+} from "@pagopa/io-wallet-oauth2";
+import type { CallbackContext } from "@pagopa/io-wallet-oauth2";
+import { LogLevel, Logger } from "../../../utils/logging";
+import type { IssuanceApi } from "../api";
+import { SignJWT } from "@pagopa/io-react-native-jwt";
+import { partialCallbacks } from "../../../utils/callbacks";
+import { IoWalletError } from "../../../utils/errors";
+import {
+  selectCredentialDefinition,
+  selectResponseMode,
+} from "../common/authorization";
+
+export const startUserAuthorization: IssuanceApi["startUserAuthorization"] =
+  async (issuerConf, credentialIds, proof, ctx) => {
+    const {
+      wiaCryptoContext,
+      walletInstanceAttestation,
+      redirectUri,
+      appFetch = fetch,
+    } = ctx;
+
+    const clientId = await wiaCryptoContext.getPublicKey().then((_) => _.kid);
+
+    if (!clientId) {
+      Logger.log(
+        LogLevel.ERROR,
+        `Public key associated with kid ${clientId} not found in the device`
+      );
+      throw new IoWalletError("No public key found");
+    }
+
+    const responseMode = selectResponseMode(issuerConf, credentialIds);
+
+    const credentialDefinition = credentialIds.map((c) =>
+      selectCredentialDefinition(issuerConf, c)
+    );
+
+    if (proof.proofType === "mrtd-pop") {
+      /**
+       * When we requests a PID using eID Substantial Authentication with MRTD Verification, we must include
+       * an additional Authorization Details Object in the authorization_details
+       *
+       * See https://italia.github.io/eid-wallet-it-docs/versione-corrente/en/credential-issuance-endpoint.html#pushed-authorization-request-endpoint
+       */
+      credentialDefinition.push({
+        type: "it_l2+document_proof",
+        idphinting: proof.idpHinting,
+        challenge_method: "mrtd+ias",
+        challenge_redirect_uri: redirectUri,
+      });
+    }
+
+    const signerJwk = await wiaCryptoContext.getPublicKey();
+    const signJwt: CallbackContext["signJwt"] = async (_, payload) => ({
+      jwt: await new SignJWT(wiaCryptoContext).setPayload(payload).sign(),
+      signerJwk,
+    });
+
+    const parRequest = await createPushedAuthorizationRequest({
+      callbacks: {
+        ...partialCallbacks,
+        signJwt,
+      },
+      authorizationServerMetadata: {
+        require_signed_request_object: true,
+      },
+      clientId,
+      audience: issuerConf.credential_issuer,
+      authorization_details: credentialDefinition,
+      codeChallengeMethodsSupported: ["S256"],
+      responseMode,
+      redirectUri,
+    });
+
+    const clientAttestationPoP = await createClientAttestationPopJwt({
+      callbacks: {
+        signJwt,
+      },
+      clientAttestation: walletInstanceAttestation,
+      authorizationServer: issuerConf.authorization_endpoint,
+      signer: {
+        method: "jwk",
+        alg: "ES256",
+        publicJwk: signerJwk,
+      },
+    });
+
+    const { request_uri } = await fetchPushedAuthorizationResponse({
+      callbacks: {
+        fetch: appFetch,
+      },
+      pushedAuthorizationRequestEndpoint:
+        issuerConf.pushed_authorization_request_endpoint,
+      pushedAuthorizationRequest: parRequest,
+      clientAttestationDPoP: clientAttestationPoP,
+      walletAttestation: walletInstanceAttestation,
+    });
+
+    return {
+      issuerRequestUri: request_uri,
+      clientId,
+      codeVerifier: parRequest.pkceCodeVerifier,
+      credentialDefinition,
+    };
+  };