@pagopa/io-react-native-wallet 2.5.1 → 3.0.0

package/src/trust/common/verify-chain.ts

@@ -0,0 +1,293 @@
+import { BaseEntityConfiguration, EntityStatement } from "./types";
+import { JWK } from "../../utils/jwk";
+import * as z from "zod";
+import {
+  decode,
+  getTrustAnchorX509Certificate,
+  verify,
+  type ParsedToken,
+} from "./utils";
+import {
+  FederationError,
+  MissingFederationFetchEndpointError,
+  MissingX509CertsError,
+  TrustChainEmptyError,
+  TrustChainRenewalError,
+  TrustChainTokenMissingError,
+  X509ValidationError,
+} from "./errors";
+import {
+  type CertificateValidationResult,
+  verifyCertificateChain,
+  type X509CertificateOptions,
+} from "@pagopa/io-react-native-crypto";
+import {
+  getSignedEntityConfiguration,
+  getSignedEntityStatement,
+} from "./utils";
+import type { TrustApi } from "../api";
+import type { TrustAnchorConfig } from "../api/TrustAnchorConfig";
+
+export type BuilderConfig = {
+  EntityStatementShape: z.ZodType<EntityStatement>;
+  EntityConfigurationShape: z.ZodType<BaseEntityConfiguration>;
+  /**
+   * The first element of the chain is supposed to be the Entity Configuration for the document issuer
+   */
+  FirstElementShape: z.ZodType<BaseEntityConfiguration>;
+  /**
+   * Each element but the first is supposed to be an Entity Statement
+   */
+  MiddleElementShape: z.ZodType<EntityStatement>;
+  /**
+   * The last element of the chain can either be an Entity Statement
+   * or the Entity Configuration for the known Trust Anchor
+   */
+  LastElementShape: z.ZodType<EntityStatement | BaseEntityConfiguration>;
+};
+
+/**
+ * Factory function to create `validateTrustChain`.
+ * @param config Version specific Entity shapes
+ * @returns `validateTrustChain` function compliant with the public API
+ */
+function createValidateTrustChain({
+  FirstElementShape,
+  MiddleElementShape,
+  LastElementShape,
+}: BuilderConfig) {
+  /**
+   * Validates a provided trust chain against a known trust anchor, including X.509 certificate checks.
+   *
+   * @param trustAnchorEntity The entity configuration of the known trust anchor (for JWT validation).
+   * @param chain The chain of statements to be validated.
+   * @param x509Options Options for X.509 certificate validation.
+   * @returns The list of parsed tokens representing the chain.
+   * @throws {FederationError} If the chain is not valid (JWT or X.509). Specific errors like TrustChainEmptyError, X509ValidationError may be thrown.
+   */
+  return async function validateTrustChain(
+    trustAnchorEntity: TrustAnchorConfig,
+    chain: string[],
+    x509Options: X509CertificateOptions
+  ): Promise<ParsedToken[]> {
+    // If the chain is empty, fail
+    if (chain.length === 0) {
+      throw new TrustChainEmptyError("Cannot verify empty trust chain.");
+    }
+
+    // Select the expected token shape
+    const selectTokenShape = (elementIndex: number) =>
+      elementIndex === 0
+        ? FirstElementShape
+        : elementIndex === chain.length - 1
+          ? LastElementShape
+          : MiddleElementShape;
+
+    // Select the kid from the current index
+    const selectKid = (currentIndex: number): string => {
+      const token = chain[currentIndex];
+      if (!token) {
+        throw new TrustChainTokenMissingError(
+          `Token missing at index ${currentIndex} in trust chain.`,
+          { index: currentIndex }
+        );
+      }
+      const shape = selectTokenShape(currentIndex);
+      return shape.parse(decode(token)).header.kid;
+    };
+
+    // Select keys from the next token
+    // If the current token is the last, keys from trust anchor will be used
+    const selectKeys = (currentIndex: number): JWK[] => {
+      if (currentIndex === chain.length - 1) {
+        return trustAnchorEntity.keys;
+      }
+
+      const nextIndex = currentIndex + 1;
+      const nextToken = chain[nextIndex];
+      if (!nextToken) {
+        throw new TrustChainTokenMissingError(
+          `Next token missing at index ${nextIndex} (needed for keys for token at ${currentIndex}).`,
+          { index: nextIndex }
+        );
+      }
+      const shape = selectTokenShape(nextIndex);
+      return shape.parse(decode(nextToken)).payload.jwks.keys;
+    };
+
+    const x509TrustAnchorCertBase64 =
+      getTrustAnchorX509Certificate(trustAnchorEntity);
+
+    // Iterate the chain and validate each element's signature against the public keys of its next
+    // If there is no next, hence it's the end of the chain, and it must be verified by the Trust Anchor
+    const validationPromises = chain.map(async (tokenString, i) => {
+      const kidFromTokenHeader = selectKid(i);
+      const signerJwks = selectKeys(i);
+
+      // Step 1: Verify JWT signature
+      const parsedToken = await verify(
+        tokenString,
+        kidFromTokenHeader,
+        signerJwks
+      );
+
+      // Step 2: X.509 Certificate Chain Validation
+      const jwkUsedForVerification = signerJwks.find(
+        (k) => k.kid === kidFromTokenHeader
+      );
+
+      if (!jwkUsedForVerification) {
+        throw new FederationError(
+          `JWK with kid '${kidFromTokenHeader}' was not found in signer's JWKS for token at index ${i}, though JWT verification passed.`,
+          { tokenIndex: i, kid: kidFromTokenHeader }
+        );
+      }
+
+      if (
+        !jwkUsedForVerification.x5c ||
+        jwkUsedForVerification.x5c.length === 0
+      ) {
+        throw new MissingX509CertsError(
+          `JWK with kid '${kidFromTokenHeader}' does not contain an X.509 certificate chain (x5c) for token at index ${i}.`
+        );
+      }
+
+      // If the chain has more than one certificate AND
+      // the last certificate in the x5c chain is the same as the trust anchor,
+      // remove the anchor from the chain being passed, as it's supplied separately.
+      const certChainBase64 =
+        jwkUsedForVerification.x5c.length > 1 &&
+        jwkUsedForVerification.x5c.at(-1) === x509TrustAnchorCertBase64
+          ? jwkUsedForVerification.x5c.slice(0, -1)
+          : jwkUsedForVerification.x5c;
+
+      const x509ValidationResult: CertificateValidationResult =
+        await verifyCertificateChain(
+          certChainBase64,
+          x509TrustAnchorCertBase64,
+          x509Options
+        );
+
+      if (!x509ValidationResult.isValid) {
+        throw new X509ValidationError(
+          `X.509 certificate chain validation failed for token at index ${i} (kid: ${kidFromTokenHeader}). Status: ${x509ValidationResult.validationStatus}. Error: ${x509ValidationResult.errorMessage}`,
+          {
+            tokenIndex: i,
+            kid: kidFromTokenHeader,
+            x509ValidationStatus: x509ValidationResult.validationStatus,
+            x509ErrorMessage: x509ValidationResult.errorMessage,
+          }
+        );
+      }
+      return parsedToken;
+    });
+
+    return Promise.all(validationPromises);
+  };
+}
+
+/**
+ * Factory function to create `renewTrustChain`.
+ * @param config Version specific Entity shapes
+ * @returns `renewTrustChain` function
+ */
+function createRenewTrustChain({
+  EntityStatementShape,
+  EntityConfigurationShape,
+}: BuilderConfig) {
+  /**
+   * Given a trust chain, obtain a new trust chain by fetching each element's fresh version
+   *
+   * @param chain The original chain
+   * @param appFetch (optional) fetch api implementation
+   * @returns A list of signed token that represent the trust chain, in the same order of the provided chain
+   * @throws {FederationError} If the chain is not valid
+   */
+  return async function renewTrustChain(
+    chain: string[],
+    appFetch: GlobalFetch["fetch"] = fetch
+  ): Promise<string[]> {
+    return Promise.all(
+      chain.map(async (token, index) => {
+        const decoded = decode(token);
+
+        const entityStatementResult = EntityStatementShape.safeParse(decoded);
+        const entityConfigurationResult =
+          EntityConfigurationShape.safeParse(decoded);
+
+        if (entityConfigurationResult.success) {
+          return getSignedEntityConfiguration(
+            entityConfigurationResult.data.payload.iss,
+            { appFetch }
+          );
+        }
+        if (entityStatementResult.success) {
+          const entityStatement = entityStatementResult.data;
+
+          const parentBaseUrl = entityStatement.payload.iss;
+          const parentECJwt = await getSignedEntityConfiguration(
+            parentBaseUrl,
+            { appFetch }
+          );
+          const parentEC = EntityConfigurationShape.parse(decode(parentECJwt));
+
+          const federationFetchEndpoint =
+            parentEC.payload.metadata.federation_entity
+              .federation_fetch_endpoint;
+          if (!federationFetchEndpoint) {
+            throw new MissingFederationFetchEndpointError(
+              `Parent EC at ${parentBaseUrl} is missing federation_fetch_endpoint, cannot renew ES for ${entityStatement.payload.sub}.`,
+              {
+                entityBaseUrl: entityStatement.payload.sub,
+                missingInEntityUrl: parentBaseUrl,
+              }
+            );
+          }
+          return getSignedEntityStatement(
+            federationFetchEndpoint,
+            entityStatement.payload.sub,
+            { appFetch }
+          );
+        }
+        throw new TrustChainRenewalError(
+          `Failed to renew trust chain. Reason: element #${index} failed to parse.`,
+          { originalChain: chain }
+        );
+      })
+    );
+  };
+}
+
+/**
+ * Factory function to create `verifyTrustChain`.
+ * @param config Version specific Entity shapes
+ * @returns `verifyTrustChain` function compliant with the public API
+ */
+export function createVerifyTrustChain(
+  config: BuilderConfig
+): TrustApi["verifyTrustChain"] {
+  return async function verifyTrustChain(
+    trustAnchorEntity,
+    chain,
+    x509Options = {
+      connectTimeout: 10000,
+      readTimeout: 10000,
+      requireCrl: true,
+    },
+    { appFetch = fetch, renewOnFail = true } = {}
+  ) {
+    const validateTrustChain = createValidateTrustChain(config);
+    const renewTrustChain = createRenewTrustChain(config);
+
+    try {
+      return await validateTrustChain(trustAnchorEntity, chain, x509Options);
+    } catch (error) {
+      if (renewOnFail) {
+        const renewedChain = await renewTrustChain(chain, appFetch);
+        return validateTrustChain(trustAnchorEntity, renewedChain, x509Options);
+      } else {
+        throw error;
+      }
+    }
+  };
+}

package/src/trust/index.ts

@@ -1,6 +1,4 @@
-import * as Build from "./build-chain";
-import * as Verify from "./verify-chain";
-import * as Errors from "./errors";
-import * as Types from "./types";
-
-export { Build, Verify, Errors, Types };
+import * as Errors from "./common/errors";
+export { Errors };
+export type * from "./api";
+export { Trust as V1_0_0 } from "./v1.0.0";

package/src/trust/v1.0.0/build-chain.ts

@@ -0,0 +1,8 @@
+import { createBuildTrustChain } from "../common/build-chain";
+import { EntityStatement } from "../common/types";
+import { EntityConfiguration } from "./types";
+
+export const buildTrustChain = createBuildTrustChain({
+  EntityStatementShape: EntityStatement,
+  EntityConfigurationShape: EntityConfiguration,
+});

package/src/trust/v1.0.0/entities.ts

@@ -0,0 +1,93 @@
+import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
+import {
+  WalletProviderEntityConfiguration,
+  CredentialIssuerEntityConfiguration,
+  EntityConfiguration,
+  RelyingPartyEntityConfiguration,
+  TrustAnchorEntityConfiguration,
+} from "./types";
+import type { z } from "zod";
+import {
+  getSignedEntityConfiguration,
+  type FetchOptions,
+} from "../common/utils";
+
+/**
+ * Fetch and parse the entity configuration document for a given federation entity.
+ * This is an inner method to serve public interfaces.
+ * @version 1.0.0
+ *
+ * To add another entity configuration type (example: Foo entity type):
+ *  - create its zod schema and type by inherit from the base type (example: FooEntityConfiguration = BaseEntityConfiguration.and(...))
+ *  - add such type to EntityConfiguration union
+ *  - create a public function which use such type (example: getFooEntityConfiguration = (url, options) => Promise<FooEntityConfiguration>)
+ *
+ * @param entityBaseUrl The base url of the entity.
+ * @param schema The expected schema of the entity configuration, according to the kind of entity we are fetching from.
+ * @param options An optional object with additional options.
+ * @param options.appFetch An optional instance of the http client to be used.
+ * @returns The parsed entity configuration object
+ * @throws {IoWalletError} If the http request fails
+ * @throws Parse error if the document is not in the expected shape.
+ */
+async function fetchAndParseEntityConfiguration<T extends EntityConfiguration>(
+  entityBaseUrl: string,
+  schema: z.ZodType<T>,
+  { appFetch = fetch }: FetchOptions = {}
+): Promise<T> {
+  const responseText = await getSignedEntityConfiguration(entityBaseUrl, {
+    appFetch,
+  });
+
+  const responseJwt = decodeJwt(responseText);
+  return schema.parse({
+    header: responseJwt.protectedHeader,
+    payload: responseJwt.payload,
+  });
+}
+
+export const getWalletProviderEntityConfiguration = (
+  entityBaseUrl: string,
+  options?: FetchOptions
+) =>
+  fetchAndParseEntityConfiguration(
+    entityBaseUrl,
+    WalletProviderEntityConfiguration,
+    options
+  );
+
+export const getCredentialIssuerEntityConfiguration = (
+  entityBaseUrl: string,
+  options?: FetchOptions
+) =>
+  fetchAndParseEntityConfiguration(
+    entityBaseUrl,
+    CredentialIssuerEntityConfiguration,
+    options
+  );
+
+export const getTrustAnchorEntityConfiguration = (
+  entityBaseUrl: string,
+  options?: FetchOptions
+) =>
+  fetchAndParseEntityConfiguration(
+    entityBaseUrl,
+    TrustAnchorEntityConfiguration,
+    options
+  );
+
+export const getRelyingPartyEntityConfiguration = (
+  entityBaseUrl: string,
+  options?: FetchOptions
+) =>
+  fetchAndParseEntityConfiguration(
+    entityBaseUrl,
+    RelyingPartyEntityConfiguration,
+    options
+  );
+
+export const getEntityConfiguration = (
+  entityBaseUrl: string,
+  options?: FetchOptions
+) =>
+  fetchAndParseEntityConfiguration(entityBaseUrl, EntityConfiguration, options);

package/src/trust/v1.0.0/index.ts

@@ -0,0 +1,15 @@
+import type { TrustApi } from "../api";
+import { getTrustAnchorEntityConfiguration } from "./entities";
+import { withMapperAsync } from "../../utils/mappers";
+import { mapToTrustAnchorConfig } from "./mappers";
+import { buildTrustChain } from "./build-chain";
+import { verifyTrustChain } from "./verify-chain";
+
+export const Trust: TrustApi = {
+  getTrustAnchorEntityConfiguration: withMapperAsync(
+    mapToTrustAnchorConfig,
+    getTrustAnchorEntityConfiguration
+  ),
+  buildTrustChain,
+  verifyTrustChain,
+};

package/src/trust/v1.0.0/mappers.ts

@@ -0,0 +1,15 @@
+import { createMapper } from "../../utils/mappers";
+import { TrustAnchorEntityConfiguration } from "./types";
+import type { TrustAnchorConfig } from "../api/TrustAnchorConfig";
+
+export const mapToTrustAnchorConfig = createMapper<
+  TrustAnchorEntityConfiguration,
+  TrustAnchorConfig
+>((x) => {
+  const { federation_entity } = x.payload.metadata;
+  return {
+    jwt: { header: x.header },
+    keys: x.payload.jwks.keys,
+    federation_entity,
+  };
+});

package/src/trust/v1.0.0/types.ts

@@ -0,0 +1,178 @@
+import * as z from "zod";
+import { JWK } from "../../utils/jwk";
+import { BaseEntityConfiguration } from "../common/types";
+import { jsonWebKeySchema } from "@openid-federation/core";
+
+const RelyingPartyMetadata = z.object({
+  application_type: z.string().optional(),
+  client_id: z.string().optional(),
+  client_name: z.string().optional(),
+  jwks: z.object({
+    keys: z.array(jsonWebKeySchema),
+  }),
+  contacts: z.array(z.string()).optional(),
+  request_uris: z.array(z.string()).optional(),
+  authorization_signed_response_alg: z.string().optional(),
+  authorization_encrypted_response_alg: z.string().optional(),
+  authorization_encrypted_response_enc: z.string().optional(),
+});
+
+// Display metadata for a credential, used by the issuer to
+// instruct the Wallet Solution on how to render the credential correctly
+type CredentialDisplayMetadata = z.infer<typeof CredentialDisplayMetadata>;
+const CredentialDisplayMetadata = z.object({
+  name: z.string(),
+  locale: z.string(),
+});
+
+// Metadata for displaying issuer information
+type CredentialIssuerDisplayMetadata = z.infer<
+  typeof CredentialIssuerDisplayMetadata
+>;
+const CredentialIssuerDisplayMetadata = z.object({
+  name: z.string(),
+  locale: z.string(),
+});
+
+type ClaimsMetadata = z.infer<typeof ClaimsMetadata>;
+const ClaimsMetadata = z.object({
+  path: z.array(z.union([z.string(), z.number(), z.null()])), // https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-15.html#name-claims-path-pointer
+  display: z.array(CredentialDisplayMetadata),
+});
+
+type IssuanceErrorSupported = z.infer<typeof IssuanceErrorSupported>;
+const IssuanceErrorSupported = z.object({
+  display: z.array(
+    z.object({
+      title: z.string(),
+      description: z.string(),
+      locale: z.string(),
+    })
+  ),
+});
+
+// Metadata for a credential which is supported by an Issuer
+type SupportedCredentialMetadata = z.infer<typeof SupportedCredentialMetadata>;
+const SupportedCredentialMetadata = z.intersection(
+  z.discriminatedUnion("format", [
+    z.object({ format: z.literal("dc+sd-jwt"), vct: z.string() }),
+    z.object({ format: z.literal("mso_mdoc"), doctype: z.string() }),
+  ]),
+  z.object({
+    scope: z.string(),
+    display: z.array(CredentialDisplayMetadata),
+    claims: z.array(ClaimsMetadata),
+    cryptographic_binding_methods_supported: z.array(z.string()),
+    credential_signing_alg_values_supported: z.array(z.string()),
+    authentic_source: z.string().optional(),
+    issuance_errors_supported: z.record(IssuanceErrorSupported).optional(),
+  })
+);
+
+// Entity configuration for a Trust Anchor (it has no specific metadata section)
+export type TrustAnchorEntityConfiguration = z.infer<
+  typeof TrustAnchorEntityConfiguration
+>;
+export const TrustAnchorEntityConfiguration = BaseEntityConfiguration;
+
+// Entity configuration for a Credential Issuer
+export type CredentialIssuerEntityConfiguration = z.infer<
+  typeof CredentialIssuerEntityConfiguration
+>;
+export const CredentialIssuerEntityConfiguration = BaseEntityConfiguration.and(
+  z.object({
+    payload: z.object({
+      jwks: z.object({ keys: z.array(JWK) }),
+      metadata: z.object({
+        openid_credential_issuer: z.object({
+          credential_issuer: z.string(),
+          credential_endpoint: z.string(),
+          revocation_endpoint: z.string().optional(),
+          nonce_endpoint: z.string(),
+          status_attestation_endpoint: z.string(),
+          display: z.array(CredentialIssuerDisplayMetadata),
+          credential_configurations_supported: z.record(
+            SupportedCredentialMetadata
+          ),
+          jwks: z.object({ keys: z.array(JWK) }),
+          trust_frameworks_supported: z.array(z.string()),
+          evidence_supported: z.array(z.string()),
+        }),
+        oauth_authorization_server: z.object({
+          authorization_endpoint: z.string(),
+          pushed_authorization_request_endpoint: z.string(),
+          token_endpoint: z.string(),
+          client_registration_types_supported: z.array(z.string()),
+          code_challenge_methods_supported: z.array(z.string()),
+          acr_values_supported: z.array(z.string()),
+          grant_types_supported: z.array(z.string()),
+          issuer: z.string(),
+          jwks: z.object({ keys: z.array(JWK) }),
+          scopes_supported: z.array(z.string()),
+          response_modes_supported: z.array(z.string()),
+          token_endpoint_auth_methods_supported: z.array(z.string()),
+          token_endpoint_auth_signing_alg_values_supported: z.array(z.string()),
+          request_object_signing_alg_values_supported: z.array(z.string()),
+        }),
+        /**
+         * Credential Issuers act as Relying Party when they require the presentation of other credentials.
+         * This does not apply for PID issuance, which requires CIE authz.
+         */
+        openid_credential_verifier: RelyingPartyMetadata.optional(),
+      }),
+    }),
+  })
+);
+
+// Entity configuration for a Relying Party
+export type RelyingPartyEntityConfiguration = z.infer<
+  typeof RelyingPartyEntityConfiguration
+>;
+export const RelyingPartyEntityConfiguration = BaseEntityConfiguration.and(
+  z.object({
+    payload: z.object({
+      metadata: z.object({
+        openid_credential_verifier: RelyingPartyMetadata,
+      }),
+    }),
+  })
+);
+
+// Entity configuration for a Wallet Provider
+export type WalletProviderEntityConfiguration = z.infer<
+  typeof WalletProviderEntityConfiguration
+>;
+export const WalletProviderEntityConfiguration = BaseEntityConfiguration.and(
+  z.object({
+    payload: z.object({
+      metadata: z.object({
+        wallet_provider: z
+          .object({
+            token_endpoint: z.string(),
+            aal_values_supported: z.array(z.string()).optional(),
+            grant_types_supported: z.array(z.string()),
+            token_endpoint_auth_methods_supported: z.array(z.string()),
+            token_endpoint_auth_signing_alg_values_supported: z.array(
+              z.string()
+            ),
+            jwks: z.object({ keys: z.array(JWK) }),
+          })
+          .passthrough(),
+      }),
+    }),
+  })
+);
+
+// Maps any entity configuration by the union of every possible shapes
+export type EntityConfiguration = z.infer<typeof EntityConfiguration>;
+export const EntityConfiguration = z.union(
+  [
+    WalletProviderEntityConfiguration,
+    CredentialIssuerEntityConfiguration,
+    TrustAnchorEntityConfiguration,
+    RelyingPartyEntityConfiguration,
+  ],
+  {
+    description: "Any kind of Entity Configuration allowed in the ecosystem",
+  }
+);

package/src/trust/v1.0.0/verify-chain.ts

@@ -0,0 +1,12 @@
+import { z } from "zod";
+import { EntityStatement } from "../common/types";
+import { createVerifyTrustChain } from "../common/verify-chain";
+import { EntityConfiguration, TrustAnchorEntityConfiguration } from "./types";
+
+export const verifyTrustChain = createVerifyTrustChain({
+  EntityStatementShape: EntityStatement,
+  EntityConfigurationShape: EntityConfiguration,
+  FirstElementShape: EntityConfiguration,
+  MiddleElementShape: EntityStatement,
+  LastElementShape: z.union([EntityStatement, TrustAnchorEntityConfiguration]),
+});

package/src/trust/v1.3.3/entities.ts

@@ -0,0 +1,51 @@
+import type z from "zod";
+import {
+  type FetchOptions,
+  getSignedEntityConfiguration,
+} from "../common/utils";
+import { EntityConfiguration, RelyingPartyEntityConfiguration } from "./types";
+import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
+
+/**
+ * Fetch and parse the entity configuration document for a given federation entity.
+ * This is an inner method to serve public interfaces.
+ * @version 1.3.3
+ *
+ * To add another entity configuration type (example: Foo entity type):
+ *  - create its zod schema and type by inherit from the base type (example: FooEntityConfiguration = BaseEntityConfiguration.and(...))
+ *  - add such type to EntityConfiguration union
+ *  - create a public function which use such type (example: getFooEntityConfiguration = (url, options) => Promise<FooEntityConfiguration>)
+ *
+ * @param entityBaseUrl The base url of the entity.
+ * @param schema The expected schema of the entity configuration, according to the kind of entity we are fetching from.
+ * @param options An optional object with additional options.
+ * @param options.appFetch An optional instance of the http client to be used.
+ * @returns The parsed entity configuration object
+ * @throws {IoWalletError} If the http request fails
+ * @throws Parse error if the document is not in the expected shape.
+ */
+async function fetchAndParseEntityConfiguration<T extends EntityConfiguration>(
+  entityBaseUrl: string,
+  schema: z.ZodType<T>,
+  { appFetch = fetch }: FetchOptions = {}
+): Promise<T> {
+  const responseText = await getSignedEntityConfiguration(entityBaseUrl, {
+    appFetch,
+  });
+
+  const responseJwt = decodeJwt(responseText);
+  return schema.parse({
+    header: responseJwt.protectedHeader,
+    payload: responseJwt.payload,
+  });
+}
+
+export const getRelyingPartyEntityConfiguration = (
+  entityBaseUrl: string,
+  options?: FetchOptions
+) =>
+  fetchAndParseEntityConfiguration(
+    entityBaseUrl,
+    RelyingPartyEntityConfiguration,
+    options
+  );