@pagopa/io-react-native-wallet 2.5.1 → 3.0.0

package/src/sd-jwt/index.ts

@@ -1,177 +1,35 @@
-import { z } from "zod";
-
-import {
-  decode as decodeJwt,
-  sha256ToBase64,
-  SignJWT,
-  verify as verifyJwt,
-} from "@pagopa/io-react-native-jwt";
-import { Disclosure, type DisclosureWithEncoded, SdJwt4VC } from "./types";
-import { verifyDisclosure } from "./verifier";
-import type { JWK } from "../utils/jwk";
-import * as Errors from "./errors";
-import { Base64 } from "js-base64";
-import { type Presentation } from "../credential/presentation/types";
+import { sha256ToBase64, SignJWT } from "@pagopa/io-react-native-jwt";
+import { decodeSdJwtSync } from "@sd-jwt/decode";
+import { present } from "@sd-jwt/present";
+import { digest } from "@sd-jwt/crypto-nodejs";
+import type { Presentation } from "src/credential/presentation";
+import { SdJwt4VCBase } from "./types";
 
 export * from "./utils";
 
-const decodeDisclosure = (encoded: string): DisclosureWithEncoded => {
-  const utf8String = Base64.decode(encoded); // Decode Base64 into UTF-8 string
-  const decoded = Disclosure.parse(JSON.parse(utf8String));
-  return { decoded, encoded };
-};
-
 /**
  * Decode a given SD-JWT with Disclosures to get the parsed SD-JWT object they define.
  * It ensures provided data is in a valid shape.
  *
  * It DOES NOT verify token signature nor check disclosures are correctly referenced by the SD-JWT.
- * Use {@link verify} instead
  *
- * @function
  * @param token The encoded token that represents a valid sd-jwt for verifiable credentials
- * @param customSchema (optional) Schema to use to parse the SD-JWT. Default: SdJwt4VC
- *
  * @returns The parsed SD-JWT token and the parsed disclosures
- *
  */
-export const decode = <S extends z.ZodType<SdJwt4VC>>(
-  token: string,
-  customSchema?: S
-): {
-  sdJwt: z.infer<S>;
-  disclosures: DisclosureWithEncoded[];
-} => {
-  // token are expected in the form "sd-jwt~disclosure0~disclosure1~...~disclosureN~"
-  if (token.slice(-1) === "~") {
-    token = token.slice(0, -1);
-  }
-  const [rawSdJwt = "", ...rawDisclosures] = token.split("~");
-
-  // get the sd-jwt as object
-  // validate it's a valid SD-JWT for Verifiable Credentials
-  const decodedJwt = decodeJwt(rawSdJwt);
+export const decode = (token: string) => {
+  const decoded = decodeSdJwtSync(token, digest);
 
-  // use a custom parsed if provided, otherwise use base SdJwt4VC
-  const parser = customSchema || SdJwt4VC;
-
-  const sdJwt = parser.parse({
-    header: decodedJwt.protectedHeader,
-    payload: decodedJwt.payload,
+  const sdJwt = SdJwt4VCBase.parse({
+    header: decoded.jwt.header,
+    payload: decoded.jwt.payload,
   });
-
-  // get disclosures as list of triples
-  // validate each triple
-  // throw a validation error if at least one fails to parse
-  const disclosures = rawDisclosures.map(decodeDisclosure);
-
+  const disclosures = decoded.disclosures.map((disclosure) => ({
+    encoded: disclosure._digest,
+    decoded: [disclosure.salt, disclosure.key, disclosure.value],
+  }));
   return { sdJwt, disclosures };
 };
 
-/**
- * Select disclosures from a given SD-JWT with Disclosures.
- * Claims relate with disclosures by their name.
- *
- * @function
- * @param token The encoded token that represents a valid sd-jwt for verifiable credentials
- * @param claims The list of claims to be disclosed
- *
- * @throws {ClaimsNotFoundBetweenDisclosures} When one or more claims does not relate to any discloure.
- * @throws {ClaimsNotFoundInToken} When one or more claims are not contained in the SD-JWT token.
- * @returns The encoded token with only the requested disclosures, along with the path each claim can be found on the SD-JWT token
- *
- */
-export const disclose = async (
-  token: string,
-  claims: string[]
-): Promise<{ token: string; paths: { claim: string; path: string }[] }> => {
-  const [rawSdJwt, ...rawDisclosures] = token.split("~");
-  const { sdJwt, disclosures } = decode(token, SdJwt4VC);
-
-  // for each claim, return the path on which they are located in the SD-JWT token
-  const paths = await Promise.all(
-    claims.map(async (claim) => {
-      const disclosure = disclosures.find(
-        ({ decoded: [, name] }) => name === claim
-      );
-
-      // check every claim represents a known disclosure
-      if (!disclosure) {
-        throw new Errors.ClaimsNotFoundBetweenDisclosures(claim);
-      }
-
-      const hash = await sha256ToBase64(disclosure.encoded);
-
-      // _sd is defined in verified_claims.claims and verified_claims.verification
-      // we must look into both
-      if (sdJwt.payload._sd.includes(hash)) {
-        const index = sdJwt.payload._sd.indexOf(hash);
-        return { claim, path: `verified_claims.claims._sd[${index}]` };
-      }
-
-      throw new Errors.ClaimsNotFoundInToken(claim);
-    })
-  );
-
-  // The disclosures in the new SD-JWT aligned with version 1.0
-  // include a trailing "~" character.
-  // To avoid parsing errors, it is necessary to filter the array
-  // to remove any empty strings
-  const filteredDisclosures = rawDisclosures.filter(Boolean).filter((d) => {
-    const {
-      decoded: [, name],
-    } = decodeDisclosure(d);
-    return claims.includes(name);
-  });
-
-  // compose the final disclosed token
-  const disclosedToken = [rawSdJwt, ...filteredDisclosures].join("~");
-  return { token: disclosedToken, paths };
-};
-
-/**
- * Verify a given SD-JWT with Disclosures
- * Same as {@link decode} plus:
- *   - token signature verification
- *   - ensure disclosures are well-defined inside the SD-JWT
- *
- * @async @function
- *
- *
- * @param token The encoded token that represents a valid sd-jwt for verifiable credentials
- * @param publicKey The single public key or an array of public keys to validate the signature.
- * @param customSchema Schema to use to parse the SD-JWT
- *
- * @returns The parsed SD-JWT token and the parsed disclosures
- *
- */
-export const verify = async <S extends z.ZodType<SdJwt4VC>>(
-  token: string,
-  publicKey: JWK | JWK[],
-  customSchema?: S
-): Promise<{ sdJwt: z.infer<S>; disclosures: Disclosure[] }> => {
-  // get decoded data
-  const [rawSdJwt = ""] = token.split("~");
-  const decoded = decode(token, customSchema);
-
-  //Check signature
-  await verifyJwt(rawSdJwt, publicKey);
-
-  //Check disclosures in sd-jwt
-  const claims = [...decoded.sdJwt.payload._sd];
-
-  await Promise.all(
-    decoded.disclosures.map(
-      async (disclosure) => await verifyDisclosure(disclosure, claims)
-    )
-  );
-
-  return {
-    sdJwt: decoded.sdJwt,
-    disclosures: decoded.disclosures.map((d) => d.decoded),
-  };
-};
-
 /**
  * Prepares a Verified Presentation (VP) token to be sent as part of an
  * authorization response in an OpenID 4 Verifiable Presentations flow.
@@ -190,15 +48,15 @@ export const verify = async <S extends z.ZodType<SdJwt4VC>>(
 export const prepareVpToken = async (
   nonce: string,
   client_id: string,
-  [verifiableCredential, requestedClaims, cryptoContext]: Presentation
+  [verifiableCredential, presentationFrame, cryptoContext]: Presentation
 ): Promise<{
   vp_token: string;
 }> => {
   // Produce a VP token with only requested claims from the verifiable credential
-  const { token: vp } = await disclose(verifiableCredential, requestedClaims);
+  const vp = await present(verifiableCredential, presentationFrame, digest);
 
   // <Issuer-signed JWT>~<Disclosure 1>~<Disclosure N>~
-  const sd_hash = await sha256ToBase64(`${vp}~`);
+  const sd_hash = await sha256ToBase64(vp);
 
   const kbJwt = await new SignJWT(cryptoContext)
     .setProtectedHeader({
@@ -212,11 +70,8 @@ export const prepareVpToken = async (
     .setAudience(client_id)
     .setIssuedAt()
     .sign();
-
   // <Issuer-signed JWT>~<Disclosure 1>~...~<Disclosure N>~<KB-JWT>
-  const vp_token = [vp, kbJwt].join("~");
+  const vp_token = [vp, kbJwt].join("");
 
   return { vp_token };
 };
-
-export { SdJwt4VC, Errors };

package/src/sd-jwt/types.ts

@@ -1,24 +1,6 @@
-import { JWK } from "../utils/jwk";
 import { z } from "zod";
-
-export const UnixTime = z.number().min(0).max(2147483647000);
-export type UnixTime = z.infer<typeof UnixTime>;
-
-export type ObfuscatedDisclosures = z.infer<typeof ObfuscatedDisclosures>;
-export const ObfuscatedDisclosures = z.object({ _sd: z.array(z.string()) });
-
-/**
- * A triple of values in the form of {salt, claim name, claim value} that represent a parsed disclosure.
- *
- * @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-04
- * @see https://vcstuff.github.io/draft-terbu-sd-jwt-vc/draft-terbu-oauth-sd-jwt-vc.html
- */
-export type Disclosure = z.infer<typeof Disclosure>;
-export const Disclosure = z.tuple([
-  /* salt */ z.string(),
-  /* claim name */ z.string(),
-  /* claim value */ z.unknown(),
-]);
+import { UnixTime } from "../utils/zod";
+import { JWK } from "../utils/jwk";
 
 /**
  * For backward compatibility reasons it is still necessary to support the legacy SD-JWT
@@ -27,29 +9,21 @@ export const Disclosure = z.tuple([
 export type SupportedSdJwtLegacyFormat = typeof LEGACY_SD_JWT;
 export const LEGACY_SD_JWT = "vc+sd-jwt";
 
-/**
- * Encoding depends on the serialization algorithm used when generating the disclosure tokens.
- * The SD-JWT reference itself take no decision about how to handle whitespaces in serialized objects.
- * For such reason, we may find conveninent to have encoded and decode values stored explicitly in the same structure.
- * Please note that `encoded` can always decode into `decode`, but `decode` may or may not be encoded with the same value of `encoded`
- *
- * @see https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-05.html#name-disclosures-for-object-prop
- */
-export type DisclosureWithEncoded = {
-  decoded: Disclosure;
-  encoded: string;
-};
-
 const StatusAssertion = z.object({
   credential_hash_alg: z.literal("sha-256"),
 });
 
+const StatusList = z.object({
+  idx: z.string(),
+  uri: z.string(),
+});
+
 /**
- * Type for a Verifiable Credential in SD-JWT format.
- * It supports both the older and the new data model for backward compatibility.
+ * Type for a Verifiable Credential base SD-JWT.
+ * It only contains common claims across versions.
  */
-export type SdJwt4VC = z.infer<typeof SdJwt4VC>;
-export const SdJwt4VC = z.object({
+export type SdJwt4VCBase = z.infer<typeof SdJwt4VCBase>;
+export const SdJwt4VCBase = z.object({
   header: z.object({
     typ: z.enum(["dc+sd-jwt", LEGACY_SD_JWT]),
     alg: z.string(),
@@ -58,31 +32,28 @@ export const SdJwt4VC = z.object({
     x5c: z.array(z.string()).optional(),
     vctm: z.array(z.string()).optional(),
   }),
-  payload: z.intersection(
-    z.object({
-      iss: z.string(),
-      sub: z.string(),
-      iat: UnixTime.optional(),
-      exp: UnixTime,
-      _sd_alg: z.literal("sha-256"),
-      status: z
-        .union([
-          // Credentials v1.0
-          z.object({ status_assertion: StatusAssertion }),
-          // Legacy credentials v0.7.1
-          z.object({ status_attestation: StatusAssertion }),
-        ])
-        .optional(),
-      cnf: z.object({
-        jwk: JWK,
-      }),
-      vct: z.string(),
-      "vct#integrity": z.string().optional(),
-      issuing_authority: z.string().optional(),
-      issuing_country: z.string().optional(),
+  payload: z.object({
+    _sd: z.array(z.string()),
+    _sd_alg: z.literal("sha-256"),
+    iss: z.string(),
+    sub: z.string(),
+    iat: UnixTime.optional(),
+    exp: UnixTime,
+    cnf: z.object({
+      jwk: JWK,
     }),
-    ObfuscatedDisclosures
-  ),
+    status: z.union([
+      z.object({
+        status_list: StatusList,
+      }),
+      z.object({
+        /** @deprecated Use `status.status_list` */
+        status_assertion: StatusAssertion,
+      }),
+    ]),
+    vct: z.string(),
+    "vct#integrity": z.string().optional(),
+  }),
 });
 
 /**
@@ -111,7 +82,7 @@ export const Verification = z.object({
 /**
  * Metadata for a digital credential. This information is retrieved from the URL defined in the `vct` claim.
  *
- * @see https://italia.github.io/eid-wallet-it-docs/v0.9.1/en/pid-eaa-data-model.html#digital-credential-metadata-type
+ * @see https://italia.github.io/eid-wallet-it-docs/releases/1.0.1/en/credential-data-model.html#digital-credential-metadata-type
  */
 export type TypeMetadata = z.infer<typeof TypeMetadata>;
 export const TypeMetadata = z.object({
@@ -127,5 +98,4 @@ export const TypeMetadata = z.object({
       logo_uri: z.string().url(),
     }),
   }),
-  // TODO: add more fields
 });

package/src/sd-jwt/utils.ts

@@ -1,4 +1,6 @@
 import { sha256ToBase64 } from "@pagopa/io-react-native-jwt";
+import { decodeSdJwtSync, getClaimsSync } from "@sd-jwt/decode";
+import { digest } from "@sd-jwt/crypto-nodejs";
 import { hasStatusOrThrow } from "../utils/misc";
 import { TypeMetadata, Verification } from "./types";
 import {
@@ -6,8 +8,6 @@ import {
   IssuerResponseError,
   ValidationFailed,
 } from "../utils/errors";
-import { decode } from ".";
-import { getValueFromDisclosures } from "./converters";
 
 /**
  * Retrieve the Type Metadata for a credential and verify its integrity.
@@ -62,12 +62,15 @@ export const fetchTypeMetadata = async (
 export const getVerification = (
   credentialSdJwt: string
 ): Verification | undefined => {
-  const { disclosures } = decode(credentialSdJwt);
-  const verificationDisclosure = getValueFromDisclosures(
-    disclosures.map((d) => d.decoded),
-    "verification"
+  const decoded = decodeSdJwtSync(credentialSdJwt, digest);
+
+  const claims = getClaimsSync<Record<string, unknown>>(
+    decoded.jwt.payload,
+    decoded.disclosures,
+    digest
   );
-  return verificationDisclosure
-    ? Verification.parse(verificationDisclosure)
+
+  return claims.verification
+    ? Verification.parse(claims.verification)
     : undefined;
 };

package/src/trust/README.md

@@ -38,15 +38,24 @@ sequenceDiagram
 ### Validate a trust chain
 
 ```ts
-import { validateTrustChain } from "./trust";
+import { IoWallet } from "@pagopa/io-react-native-wallet";
 import { trustAnchorEntityConfiguration } from "./your-data";
 import { chain } from "./your-data"; // array of JWTs, starting from leaf
 
-const result = await validateTrustChain(trustAnchorEntityConfiguration, chain, {
+const wallet = new IoWallet({ version: "1.0.0" });
+
+const result = await wallet.Trust.verifyTrustChain(
+  trustAnchorEntityConfiguration, 
+  chain, 
+  {
     connectTimeout: 3000,
     readTimeout: 3000,
     requireCrl: false,
-});
+  },
+  {
+    renewOnFail: true // Optional trust chain renewal
+  }
+);
 ```
 
 * The `chain` must be an array of signed JWT strings.
@@ -55,6 +64,9 @@ const result = await validateTrustChain(trustAnchorEntityConfiguration, chain, {
 
 ### Renew a trust chain
 
+[>!NOTE]
+> Internal only
+
 ```ts
 import { renewTrustChain } from "./trust";
 
@@ -66,9 +78,11 @@ This will fetch updated JWTs from each authority in the chain.
 ### Build a trust chain
 
 ```ts
-import { buildTrustChain } from "./trust";
+import { IoWallet } from "@pagopa/io-react-native-wallet";
 
-const chain = await buildTrustChain({
+const wallet = new IoWallet({ version: "1.0.0" });
+
+const chain = await wallet.Trust.buildTrustChain({
   leaf: "https://example-leaf",
   trustAnchor: trustAnchorEntityConfiguration,
 });
@@ -90,18 +104,17 @@ const chain = await buildTrustChain({
 ### Build and Validate Example
 
 ```ts
-import {
-  buildTrustChain,
-  validateTrustChain,
-} from "./trust";
+import { IoWallet } from "@pagopa/io-react-native-wallet";
 import { trustAnchorEntityConfiguration } from "./your-data";
 
-const chain = await buildTrustChain({
+const wallet = new IoWallet({ version: "1.0.0" });
+
+const chain = await wallet.Trust.buildTrustChain({
   leaf: "https://example-leaf",
   trustAnchor: trustAnchorEntityConfiguration,
 });
 
-const result = await validateTrustChain(trustAnchorEntityConfiguration, chain, {
+const result = await wallet.Trust.verifyTrustChain(trustAnchorEntityConfiguration, chain, {
   connectTimeout: 3000,
   readTimeout: 3000,
   requireCrl: true,

package/src/trust/api/TrustAnchorConfig.ts

@@ -0,0 +1,20 @@
+import * as z from "zod";
+import { JWK } from "../../utils/jwk";
+import { FederationEntityMetadata } from "../common/types";
+
+/**
+ * Common Trust Anchor configuration
+ * @public
+ */
+export type TrustAnchorConfig = z.infer<typeof TrustAnchorConfig>;
+export const TrustAnchorConfig = z.object({
+  jwt: z.object({
+    header: z.object({
+      typ: z.literal("entity-statement+jwt"),
+      alg: z.string(),
+      kid: z.string(),
+    }),
+  }),
+  keys: z.array(JWK),
+  federation_entity: FederationEntityMetadata,
+});

package/src/trust/api/index.ts

@@ -0,0 +1,57 @@
+import { type X509CertificateOptions } from "@pagopa/io-react-native-crypto";
+import type { TrustAnchorConfig } from "./TrustAnchorConfig";
+import type { ParsedToken } from "../common/utils";
+
+type FetchContext = { appFetch?: GlobalFetch["fetch"] };
+
+export interface TrustApi {
+  /**
+   * Get the common Trust Anchor Configuration, which is uniform across versions.
+   *
+   * @param trustAnchorBaseUrl The Trust Anchor base URL
+   * @returns The Trust Anchor Configuration object
+   */
+  getTrustAnchorEntityConfiguration(
+    trustAnchorBaseUrl: string,
+    ctx?: FetchContext
+  ): Promise<TrustAnchorConfig>;
+
+  /**
+   * Build a not-verified trust chain for a given Relying Party (RP) entity.
+   *
+   * @param relyingPartyEntityBaseUrl The base URL of the RP entity
+   * @param trustAnchorConfig The entity configuration of the known trust anchor.
+   * @param appFetch An optional instance of the http client to be used.
+   * @returns A list of signed tokens that represent the trust chain, in the order of the chain (from the RP to the Trust Anchor)
+   * @throws {FederationError} When an element of the chain fails to parse or other build steps fail.
+   */
+  buildTrustChain(
+    relyingPartyEntityBaseUrl: string,
+    trustAnchorConfig: TrustAnchorConfig,
+    appFetch?: GlobalFetch["fetch"]
+  ): Promise<string[]>;
+
+  /**
+   * Verify a given trust chain is actually valid.
+   * It can handle fast chain renewal, which means we try to fetch a fresh version of each statement.
+   *
+   * @param trustAnchorEntity The entity configuration of the known trust anchor
+   * @param chain The chain of statements to be validated
+   * @param x509Options Options for the verification process
+   * @param appFetch (optional) fetch api implementation
+   * @param renewOnFail Whether to attempt to renew the trust chain if the initial validation fails
+   * @returns The result of the chain validation
+   * @throws {FederationError} If the chain is not valid
+   */
+  verifyTrustChain(
+    trustAnchorEntity: TrustAnchorConfig,
+    chain: string[],
+    x509Options?: X509CertificateOptions,
+    ctx?: {
+      appFetch?: GlobalFetch["fetch"];
+      renewOnFail?: boolean;
+    }
+  ): Promise<ParsedToken[]>;
+}
+
+export { type TrustAnchorConfig };