@pagopa/io-react-native-wallet 2.5.1 → 3.0.0

package/src/wallet-instance-attestation/v1.3.3/types.ts

@@ -0,0 +1,48 @@
+import * as z from "zod";
+import { JWK } from "../../utils/jwk";
+import { Jwt } from "../common/types";
+
+const Status = z.object({
+  status_list: z.object({
+    idx: z.number(),
+    uri: z.string(),
+  }),
+});
+
+export type WalletAppAttestationJwt = z.infer<typeof WalletAppAttestationJwt>;
+export const WalletAppAttestationJwt = z.object({
+  header: z.intersection(
+    Jwt.shape.header,
+    z.object({
+      typ: z.literal("oauth-client-attestation+jwt"),
+    })
+  ),
+  payload: z.intersection(
+    Jwt.shape.payload,
+    z.object({
+      sub: z.string(),
+      wallet_link: z.string().optional(),
+      wallet_name: z.string().optional(),
+      status: Status.optional(),
+    })
+  ),
+});
+
+export type WalletUnitAttestationJwt = z.infer<typeof WalletUnitAttestationJwt>;
+export const WalletUnitAttestationJwt = z.object({
+  header: z.intersection(
+    Jwt.shape.header,
+    z.object({
+      typ: z.literal("key-attestation+jwt"),
+    })
+  ),
+  payload: z.intersection(
+    Jwt.shape.payload,
+    z.object({
+      attested_keys: z.array(JWK),
+      user_authentication: z.array(z.string()),
+      key_storage: z.array(z.string()),
+      status: Status,
+    })
+  ),
+});

package/lib/commonjs/credential/issuance/01-start-flow.js

@@ -1,2 +0,0 @@
-"use strict";
-//# sourceMappingURL=01-start-flow.js.map

package/lib/commonjs/credential/issuance/01-start-flow.js.map

@@ -1 +0,0 @@
-{"version":3,"names":[],"sourceRoot":"../../../../src","sources":["credential/issuance/01-start-flow.ts"],"mappings":""}

package/lib/commonjs/credential/issuance/02-evaluate-issuer-trust.js

@@ -1,32 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.evaluateIssuerTrust = void 0;
-var _buildChain = require("../../trust/build-chain");
-/**
- * WARNING: This function must be called after {@link startFlow}. The next function to be called is {@link startUserAuthorization}.
- * The Issuer trust evaluation phase.
- * Fetch the Issuer's configuration and verify trust.
- *
- * @param issuerUrl The base url of the Issuer returned by {@link startFlow}
- * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
- * @returns The Issuer's configuration
- */
-const evaluateIssuerTrust = async function (issuerUrl) {
-  let context = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
-  const issuerConf = await (0, _buildChain.getCredentialIssuerEntityConfiguration)(issuerUrl, {
-    appFetch: context.appFetch
-  }).then(_ref => {
-    let {
-      payload
-    } = _ref;
-    return payload.metadata;
-  });
-  return {
-    issuerConf
-  };
-};
-exports.evaluateIssuerTrust = evaluateIssuerTrust;
-//# sourceMappingURL=02-evaluate-issuer-trust.js.map

package/lib/commonjs/credential/issuance/02-evaluate-issuer-trust.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_buildChain","require","evaluateIssuerTrust","issuerUrl","context","arguments","length","undefined","issuerConf","getCredentialIssuerEntityConfiguration","appFetch","then","_ref","payload","metadata","exports"],"sourceRoot":"../../../../src","sources":["credential/issuance/02-evaluate-issuer-trust.ts"],"mappings":";;;;;;AAGA,IAAAA,WAAA,GAAAC,OAAA;AAWA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,mBAAwC,GAAG,eAAAA,CACtDC,SAAS,EAEN;EAAA,IADHC,OAAO,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEZ,MAAMG,UAAU,GAAG,MAAM,IAAAC,kDAAsC,EAACN,SAAS,EAAE;IACzEO,QAAQ,EAAEN,OAAO,CAACM;EACpB,CAAC,CAAC,CAACC,IAAI,CAACC,IAAA;IAAA,IAAC;MAAEC;IAAQ,CAAC,GAAAD,IAAA;IAAA,OAAKC,OAAO,CAACC,QAAQ;EAAA,EAAC;EAE1C,OAAO;IAAEN;EAAW,CAAC;AACvB,CAAC;AAACO,OAAA,CAAAb,mBAAA,GAAAA,mBAAA"}

package/lib/commonjs/credential/issuance/03-start-user-authorization.js

@@ -1,132 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.startUserAuthorization = void 0;
-var _misc = require("../../utils/misc");
-var _par = require("../../utils/par");
-var _logging = require("../../utils/logging");
-/**
- * Ensures that the credential type requested is supported by the issuer and contained in the
- * issuer configuration.
- * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
- * @param credentialId The credential configuration ID to be requested;
- * @returns The credential definition to be used in the request which includes the format and the type and its type
- */
-const selectCredentialDefinition = (issuerConf, credentialId) => {
-  const credential_configurations_supported = issuerConf.openid_credential_issuer.credential_configurations_supported;
-  const [result] = Object.keys(credential_configurations_supported).filter(e => e.includes(credentialId)).map(() => ({
-    credential_configuration_id: credentialId,
-    type: "openid_credential"
-  }));
-  if (!result) {
-    _logging.Logger.log(_logging.LogLevel.ERROR, `Requested credential ${credentialId} is not supported by the issuer according to its configuration ${JSON.stringify(credential_configurations_supported)}`);
-    throw new Error(`No credential support the type '${credentialId}'`);
-  }
-  return result;
-};
-
-/**
- * Ensures that the response mode requested is supported by the issuer and contained in the issuer configuration.
- * When multiple credentials are provided, all of them must support the same response_mode.
- * @param issuerConf The issuer configuration
- * @param credentialIds The credential configuration IDs to be requested
- * @returns The response mode to be used in the request, "query" for PersonIdentificationData and "form_post.jwt" for all other types.
- */
-const selectResponseMode = (issuerConf, credentialIds) => {
-  const responseModeSupported = issuerConf.oauth_authorization_server.response_modes_supported;
-  const responseModeSet = new Set();
-  for (const credentialId of credentialIds) {
-    responseModeSet.add(credentialId.match(/PersonIdentificationData/i) ? "query" : "form_post.jwt");
-  }
-  if (responseModeSet.size !== 1) {
-    _logging.Logger.log(_logging.LogLevel.ERROR, `${credentialIds} have incompatible response_mode: ${[...responseModeSet.values()]}`);
-    throw new Error("Requested credentials have incompatible response_mode and cannot be requested with the same PAR request");
-  }
-  const [responseMode] = responseModeSet.values();
-  _logging.Logger.log(_logging.LogLevel.DEBUG, `Selected response mode ${responseMode} for credential IDs ${credentialIds}`);
-  if (!responseModeSupported.includes(responseMode)) {
-    _logging.Logger.log(_logging.LogLevel.ERROR, `Requested response mode ${responseMode} is not supported by the issuer according to its configuration ${JSON.stringify(responseModeSupported)}`);
-    throw new Error(`No response mode support for IDs '${credentialIds}'`);
-  }
-  return responseMode;
-};
-
-/**
- * WARNING: This function must be called after {@link evaluateIssuerTrust} and {@link startFlow}. The next steam is {@link compeUserAuthorizationWithQueryMode} or {@link compeUserAuthorizationWithFormPostJwtMode}
- *
- * Creates and sends a PAR request to the /as/par endpoint of the authorization server.
- * This starts the authentication flow to obtain an access token.
- * This token enables the Wallet Instance to request a digital credential from the Credential Endpoint of the Credential Issuer; when multiple credential types are passed,
- * it is possible to use the same access token for the issuance of all requested credentials.
- * This is an HTTP POST request containing the Wallet Instance identifier (client id), the code challenge and challenge method as specified by PKCE according to RFC 9126
- * along with the WTE and its proof of possession (WTE-PoP).
- * Additionally, it includes a request object, which is a signed JWT encapsulating the type of digital credential requested (authorization_details), challenge method and
- * redirect URI for the document proof step (if L2 flow), the application session identifier on the Wallet Instance side (state),
- * the method (query or form_post.jwt) by which the Authorization Server
- * should transmit the Authorization Response containing the authorization code issued upon the end user's authentication (response_mode)
- * to the Wallet Instance's Token Endpoint to obtain the Access Token, and the redirectUri of the Wallet Instance where the Authorization Response
- * should be delivered. The redirect is achived by using a custom URL scheme that the Wallet Instance is registered to handle.
- * @param issuerConf The issuer configuration
- * @param credentialIds The credential configuration IDs to be requested
- * @param proof The configuration for the proof to be used in the request: "none" for standard flows, "document" for L2+ with MRTD verification.
- * @param ctx The context object containing;
- *  - wiaCryptoContext: the Wallet Instance's cryptographic context
- *  - walletInstanceAttestation: the Wallet Instance's attestation
- *  - redirectUri: the redirect URI
- *  - appFetch: (optional) the fetch implementation
- * @returns The URI to which the end user should be redirected to start the authentication flow, along with the client id, the code verifier and the credential definition(s)
- */
-const startUserAuthorization = async (issuerConf, credentialIds, proof, ctx) => {
-  const {
-    wiaCryptoContext,
-    walletInstanceAttestation,
-    redirectUri,
-    appFetch = fetch
-  } = ctx;
-  const clientId = await wiaCryptoContext.getPublicKey().then(_ => _.kid);
-  if (!clientId) {
-    _logging.Logger.log(_logging.LogLevel.ERROR, `Public key associated with kid ${clientId} not found in the device`);
-    throw new Error("No public key found");
-  }
-  const codeVerifier = (0, _misc.generateRandomAlphaNumericString)(64);
-  const parEndpoint = issuerConf.oauth_authorization_server.pushed_authorization_request_endpoint;
-  const aud = issuerConf.openid_credential_issuer.credential_issuer;
-  const responseMode = selectResponseMode(issuerConf, credentialIds);
-  const getPar = (0, _par.makeParRequest)({
-    wiaCryptoContext,
-    appFetch
-  });
-  const credentialDefinition = [...credentialIds.map(c => selectCredentialDefinition(issuerConf, c))];
-  if (proof.proofType === "mrtd-pop") {
-    /**
-     * When we requests a PID using eID Substantial Authentication with MRTD Verification, we must include
-     * an additional Authorization Details Object in the authorization_details
-     *
-     * See https://italia.github.io/eid-wallet-it-docs/versione-corrente/en/credential-issuance-endpoint.html#pushed-authorization-request-endpoint
-     */
-    credentialDefinition.push({
-      type: "it_l2+document_proof",
-      idphinting: proof.idpHinting,
-      challenge_method: "mrtd+ias",
-      challenge_redirect_uri: redirectUri
-    });
-  }
-  const issuerRequestUri = await getPar(parEndpoint, walletInstanceAttestation, {
-    aud,
-    clientId,
-    codeVerifier,
-    redirectUri,
-    responseMode,
-    authorizationDetails: credentialDefinition
-  });
-  return {
-    issuerRequestUri,
-    clientId,
-    codeVerifier,
-    credentialDefinition
-  };
-};
-exports.startUserAuthorization = startUserAuthorization;
-//# sourceMappingURL=03-start-user-authorization.js.map

package/lib/commonjs/credential/issuance/03-start-user-authorization.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_misc","require","_par","_logging","selectCredentialDefinition","issuerConf","credentialId","credential_configurations_supported","openid_credential_issuer","result","Object","keys","filter","e","includes","map","credential_configuration_id","type","Logger","log","LogLevel","ERROR","JSON","stringify","Error","selectResponseMode","credentialIds","responseModeSupported","oauth_authorization_server","response_modes_supported","responseModeSet","Set","add","match","size","values","responseMode","DEBUG","startUserAuthorization","proof","ctx","wiaCryptoContext","walletInstanceAttestation","redirectUri","appFetch","fetch","clientId","getPublicKey","then","_","kid","codeVerifier","generateRandomAlphaNumericString","parEndpoint","pushed_authorization_request_endpoint","aud","credential_issuer","getPar","makeParRequest","credentialDefinition","c","proofType","push","idphinting","idpHinting","challenge_method","challenge_redirect_uri","issuerRequestUri","authorizationDetails","exports"],"sourceRoot":"../../../../src","sources":["credential/issuance/03-start-user-authorization.ts"],"mappings":";;;;;;AAEA,IAAAA,KAAA,GAAAC,OAAA;AAGA,IAAAC,IAAA,GAAAD,OAAA;AACA,IAAAE,QAAA,GAAAF,OAAA;AAmBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMG,0BAA0B,GAAGA,CACjCC,UAAkD,EAClDC,YAA4C,KACpB;EACxB,MAAMC,mCAAmC,GACvCF,UAAU,CAACG,wBAAwB,CAACD,mCAAmC;EAEzE,MAAM,CAACE,MAAM,CAAC,GAAGC,MAAM,CAACC,IAAI,CAACJ,mCAAmC,CAAC,CAC9DK,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,QAAQ,CAACR,YAAY,CAAC,CAAC,CACvCS,GAAG,CAAC,OAAO;IACVC,2BAA2B,EAAEV,YAAY;IACzCW,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACR,MAAM,EAAE;IACXS,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,wBAAuBf,YAAa,kEAAiEgB,IAAI,CAACC,SAAS,CAAChB,mCAAmC,CAAE,EAC5J,CAAC;IACD,MAAM,IAAIiB,KAAK,CAAE,mCAAkClB,YAAa,GAAE,CAAC;EACrE;EACA,OAAOG,MAAM;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMgB,kBAAkB,GAAGA,CACzBpB,UAAkD,EAClDqB,aAAuB,KACN;EACjB,MAAMC,qBAAqB,GACzBtB,UAAU,CAACuB,0BAA0B,CAACC,wBAAwB;EAEhE,MAAMC,eAAe,GAAG,IAAIC,GAAG,CAAe,CAAC;EAE/C,KAAK,MAAMzB,YAAY,IAAIoB,aAAa,EAAE;IACxCI,eAAe,CAACE,GAAG,CACjB1B,YAAY,CAAC2B,KAAK,CAAC,2BAA2B,CAAC,GAC3C,OAAO,GACP,eACN,CAAC;EACH;EAEA,IAAIH,eAAe,CAACI,IAAI,KAAK,CAAC,EAAE;IAC9BhB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,GAAEK,aAAc,qCAAoC,CAAC,GAAGI,eAAe,CAACK,MAAM,CAAC,CAAC,CAAE,EACrF,CAAC;IACD,MAAM,IAAIX,KAAK,CACb,yGACF,CAAC;EACH;EAEA,MAAM,CAACY,YAAY,CAAC,GAAGN,eAAe,CAACK,MAAM,CAAC,CAAC;EAE/CjB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACiB,KAAK,EACb,0BAAyBD,YAAa,uBAAsBV,aAAc,EAC7E,CAAC;EAED,IAAI,CAACC,qBAAqB,CAACb,QAAQ,CAACsB,YAAa,CAAC,EAAE;IAClDlB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2BAA0Be,YAAa,kEAAiEd,IAAI,CAACC,SAAS,CAACI,qBAAqB,CAAE,EACjJ,CAAC;IACD,MAAM,IAAIH,KAAK,CAAE,qCAAoCE,aAAc,GAAE,CAAC;EACxE;EAEA,OAAOU,YAAY;AACrB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,sBAA8C,GAAG,MAAAA,CAC5DjC,UAAU,EACVqB,aAAa,EACba,KAAK,EACLC,GAAG,KACA;EACH,MAAM;IACJC,gBAAgB;IAChBC,yBAAyB;IACzBC,WAAW;IACXC,QAAQ,GAAGC;EACb,CAAC,GAAGL,GAAG;EAEP,MAAMM,QAAQ,GAAG,MAAML,gBAAgB,CAACM,YAAY,CAAC,CAAC,CAACC,IAAI,CAAEC,CAAC,IAAKA,CAAC,CAACC,GAAG,CAAC;EAEzE,IAAI,CAACJ,QAAQ,EAAE;IACb5B,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,kCAAiCyB,QAAS,0BAC7C,CAAC;IACD,MAAM,IAAItB,KAAK,CAAC,qBAAqB,CAAC;EACxC;EACA,MAAM2B,YAAY,GAAG,IAAAC,sCAAgC,EAAC,EAAE,CAAC;EACzD,MAAMC,WAAW,GACfhD,UAAU,CAACuB,0BAA0B,CAAC0B,qCAAqC;EAC7E,MAAMC,GAAG,GAAGlD,UAAU,CAACG,wBAAwB,CAACgD,iBAAiB;EACjE,MAAMpB,YAAY,GAAGX,kBAAkB,CAACpB,UAAU,EAAEqB,aAAa,CAAC;EAClE,MAAM+B,MAAM,GAAG,IAAAC,mBAAc,EAAC;IAAEjB,gBAAgB;IAAEG;EAAS,CAAC,CAAC;EAE7D,MAAMe,oBAAoB,GAAG,CAC3B,GAAGjC,aAAa,CAACX,GAAG,CAAE6C,CAAC,IAAKxD,0BAA0B,CAACC,UAAU,EAAEuD,CAAC,CAAC,CAAC,CACvE;EAED,IAAIrB,KAAK,CAACsB,SAAS,KAAK,UAAU,EAAE;IAClC;AACJ;AACA;AACA;AACA;AACA;IACIF,oBAAoB,CAACG,IAAI,CAAC;MACxB7C,IAAI,EAAE,sBAAsB;MAC5B8C,UAAU,EAAExB,KAAK,CAACyB,UAAU;MAC5BC,gBAAgB,EAAE,UAAU;MAC5BC,sBAAsB,EAAEvB;IAC1B,CAAC,CAAC;EACJ;EAEA,MAAMwB,gBAAgB,GAAG,MAAMV,MAAM,CACnCJ,WAAW,EACXX,yBAAyB,EACzB;IACEa,GAAG;IACHT,QAAQ;IACRK,YAAY;IACZR,WAAW;IACXP,YAAY;IACZgC,oBAAoB,EAAET;EACxB,CACF,CAAC;EAED,OAAO;IAAEQ,gBAAgB;IAAErB,QAAQ;IAAEK,YAAY;IAAEQ;EAAqB,CAAC;AAC3E,CAAC;AAACU,OAAA,CAAA/B,sBAAA,GAAAA,sBAAA"}

package/lib/commonjs/credential/issuance/04-complete-user-authorization.js

@@ -1,259 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.parseAuthorizationResponse = exports.getRequestedCredentialToBePresented = exports.continueUserAuthorizationWithMRTDPoPChallenge = exports.completeUserAuthorizationWithQueryMode = exports.completeUserAuthorizationWithFormPostJwtMode = exports.buildAuthorizationUrl = void 0;
-var _auth = require("../../utils/auth");
-var _misc = require("../../utils/misc");
-var _parseUrl = _interopRequireDefault(require("parse-url"));
-var _errors = require("../../utils/errors");
-var _ioReactNativeJwt = require("@pagopa/io-react-native-jwt");
-var _types = require("../presentation/types");
-var _types2 = require("./types");
-var _decoder = require("../../utils/decoder");
-var _errors2 = require("./errors");
-var _logging = require("../../utils/logging");
-var _ = require("..");
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-/**
- * The interface of the phase to complete User authorization via strong identification when the response mode is "query" and the request credential is a PersonIdentificationData.
- */
-
-/**
- * WARNING: this function must be called after obtaining the authorization redirect URL from the webviews (SPID and CIE L3) or browser for CIEID, and the PID
- * issuance requires a MRTD PoP challenge.
- * @param authRedirectUrl The URL to which the end user should be redirected to start the MRTD PoP validation flow
- * @returns the authorization response which contains the challenge
- */
-const continueUserAuthorizationWithMRTDPoPChallenge = async authRedirectUrl => {
-  _logging.Logger.log(_logging.LogLevel.DEBUG, `The requested credential is a PersonIdentificationData and requires MRTD PoP, starting MRTD PoP validation from auth redirect`);
-  const query = (0, _parseUrl.default)(authRedirectUrl).query;
-  const authResParsed = _auth.AuthorizationChallengeResultShape.safeParse(query);
-  if (!authResParsed.success) {
-    const authErr = _auth.AuthorizationErrorShape.safeParse(query);
-    if (!authErr.success) {
-      _logging.Logger.log(_logging.LogLevel.ERROR, `Error while parsing the authorization response: ${authResParsed.error.message}`);
-      throw new _errors2.AuthorizationError(authResParsed.error.message); // an error occured while parsing the result and the error
-    }
-
-    _logging.Logger.log(_logging.LogLevel.ERROR, `Error while authorizating with the idp: ${JSON.stringify(authErr)}`);
-    throw new _errors2.AuthorizationIdpError(authErr.data.error, authErr.data.error_description);
-  }
-  return authResParsed.data;
-};
-
-/**
- * WARNING: This function must be called after {@link startUserAuthorization}. The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
- * Builds the authorization URL to which the end user should be redirected to continue the authentication flow.
- * @param issuerRequestUri the URI of the issuer where the request is sent
- * @param clientId Identifies the current client across all the requests of the issuing flow returned by {@link startUserAuthorization}
- * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
- * @param idpHint Unique identifier of the IDP selected by the user (optional)
- * @returns An object containing the authorization URL
- */
-exports.continueUserAuthorizationWithMRTDPoPChallenge = continueUserAuthorizationWithMRTDPoPChallenge;
-const buildAuthorizationUrl = async (issuerRequestUri, clientId, issuerConf, idpHint) => {
-  const authzRequestEndpoint = issuerConf.oauth_authorization_server.authorization_endpoint;
-  const params = new URLSearchParams({
-    client_id: clientId,
-    request_uri: issuerRequestUri
-  });
-  if (idpHint) {
-    params.append("idphint", idpHint);
-  }
-  const authUrl = `${authzRequestEndpoint}?${params}`;
-  return {
-    authUrl
-  };
-};
-
-/**
- * WARNING: This function must be called after obtaining the authorization redirect URL from the webviews (SPID and CIE L3) or browser for CIEID.
- * Complete User authorization via strong identification when the response mode is "query" and the request credential is a PersonIdentificationData.
- * This function parses the authorization redirect URL to extract the authorization response.
- * @param authRedirectUrl The URL to which the end user should be redirected to start the authentication flow
- * @returns the authorization response which contains code, state and iss
- */
-exports.buildAuthorizationUrl = buildAuthorizationUrl;
-const completeUserAuthorizationWithQueryMode = async authRedirectUrl => {
-  _logging.Logger.log(_logging.LogLevel.DEBUG, `The requested credential is a PersonIdentificationData, completing the user authorization with query mode`);
-  const query = (0, _parseUrl.default)(authRedirectUrl).query;
-  return parseAuthorizationResponse(query);
-};
-
-/**
- * WARNING: This function must be called after {@link startUserAuthorization}. The next function to be called is {@link completeUserAuthorizationWithFormPostJwtMode}.
- * The interface of the phase to complete User authorization via presentation of existing credentials when the response mode is "form_post.jwt".
- * It is used as a first step to complete the user authorization by obtaining the requested credential to be presented from the authorization server.
- * The information is obtained by performing a GET request to the authorization endpoint with request_uri and client_id parameters.
- * @param issuerRequestUri the URI of the issuer where the request is sent
- * @param clientId Identifies the current client across all the requests of the issuing flow returned by {@link startUserAuthorization}
- * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
- * @param appFetch (optional) fetch api implementation. Default: built-in fetch
- * @throws {ValidationFailed} if an error while validating the response
- * @returns the request object which contains the credential to be presented in order to obtain the requested credential
- */
-exports.completeUserAuthorizationWithQueryMode = completeUserAuthorizationWithQueryMode;
-const getRequestedCredentialToBePresented = async function (issuerRequestUri, clientId, issuerConf) {
-  let appFetch = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : fetch;
-  _logging.Logger.log(_logging.LogLevel.DEBUG, `The requeste credential is not a PersonIdentificationData, requesting the credential to be presented`);
-  const authzRequestEndpoint = issuerConf.oauth_authorization_server.authorization_endpoint;
-  const params = new URLSearchParams({
-    client_id: clientId,
-    request_uri: issuerRequestUri
-  });
-  _logging.Logger.log(_logging.LogLevel.DEBUG, `Requesting the request object to ${authzRequestEndpoint}?${params.toString()}`);
-  const requestObject = await appFetch(`${authzRequestEndpoint}?${params.toString()}`, {
-    method: "GET"
-  }).then((0, _misc.hasStatusOrThrow)(200, _errors.IssuerResponseError)).then(res => res.text()).then(jws => (0, _ioReactNativeJwt.decode)(jws)).then(reqObj => _types.RequestObject.safeParse(reqObj.payload));
-  if (!requestObject.success) {
-    _logging.Logger.log(_logging.LogLevel.ERROR, `Error while validating the response object: ${requestObject.error.message}`);
-    throw new _errors.ValidationFailed({
-      message: "Request Object validation failed",
-      reason: requestObject.error.message
-    });
-  }
-  return requestObject.data;
-};
-
-/**
- * WARNING: This function must be called after {@link getRequestedCredentialToBePresented}. The next function to be called is {@link authorizeAccess}.
- * The interface of the phase to complete User authorization via presentation of existing credentials when the response mode is "form_post.jwt".
- * The information is obtained by performing a POST request to the endpoint received in the response_uri field of the requestObject, where the Authorization Response payload is posted.
- * Following this,the redirect_uri from the response is used to obtain the final authorization response.
- * @param requestObject - The request object containing the necessary parameters for authorization.
- * @param pid The `PID` that must be presented for the issuance of credentials.
- * @param appFetch (optional) fetch api implementation. Default: built-in fetch
- * @throws {ValidationFailed} if an error while validating the response
- * @returns the authorization response which contains code, state and iss
- */
-exports.getRequestedCredentialToBePresented = getRequestedCredentialToBePresented;
-const completeUserAuthorizationWithFormPostJwtMode = async (requestObject, pid, _ref) => {
-  let {
-    wiaCryptoContext,
-    pidCryptoContext,
-    appFetch = fetch
-  } = _ref;
-  _logging.Logger.log(_logging.LogLevel.DEBUG, `The requeste credential is not a PersonIdentificationData, completing the user authorization with form_post.jwt mode`);
-  if (!requestObject.dcql_query) {
-    throw new Error("Invalid request object");
-  }
-  const dcqlQueryResult = _.Presentation.evaluateDcqlQuery([[pidCryptoContext, pid]], requestObject.dcql_query);
-  const credentialsToPresent = dcqlQueryResult.map(_ref2 => {
-    let {
-      requiredDisclosures,
-      ...rest
-    } = _ref2;
-    return {
-      ...rest,
-      requestedClaims: requiredDisclosures.map(_ref3 => {
-        let [, claimName] = _ref3;
-        return claimName;
-      })
-    };
-  });
-  const remotePresentations = await _.Presentation.prepareRemotePresentations(credentialsToPresent, requestObject.nonce, requestObject.client_id);
-  const authzResponsePayload = await createAuthzResponsePayload({
-    state: requestObject.state,
-    remotePresentations,
-    wiaCryptoContext
-  });
-  _logging.Logger.log(_logging.LogLevel.DEBUG, `Authz response payload: ${authzResponsePayload}`);
-
-  // Note: according to the spec, the response should be encrypted with the public key of the RP however this is not implemented yet
-  // https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-signed-and-encrypted-response
-  // const rsaPublicJwk = chooseRSAPublicKeyToEncrypt(rpConf);
-  // const encrypted = await new EncryptJwe(authzResponsePayload, {
-  //   alg: "RSA-OAEP-256",
-  //   enc: "A256CBC-HS512",
-  //   kid: rsaPublicJwk.kid,
-  // }).encrypt(rsaPublicJwk);
-
-  const body = new URLSearchParams({
-    response: authzResponsePayload
-  }).toString();
-  const resUriRes = await appFetch(requestObject.response_uri, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body
-  }).then((0, _misc.hasStatusOrThrow)(200, _errors.IssuerResponseError)).then(reqUri => reqUri.json());
-  const responseUri = _types2.ResponseUriResultShape.safeParse(resUriRes);
-  if (!responseUri.success) {
-    _logging.Logger.log(_logging.LogLevel.ERROR, `Error while validating the response uri: ${responseUri.error.message}`);
-    throw new _errors.ValidationFailed({
-      message: "Response Uri validation failed",
-      reason: responseUri.error.message
-    });
-  }
-  return await appFetch(responseUri.data.redirect_uri).then((0, _misc.hasStatusOrThrow)(200, _errors.IssuerResponseError)).then(res => res.text()).then(_decoder.getJwtFromFormPost).then(cbRes => parseAuthorizationResponse(cbRes.decodedJwt.payload));
-};
-
-/**
- * Parse the authorization response and return the result which contains code, state and iss.
- * @throws {AuthorizationError} if an error occurs during the parsing process
- * @throws {AuthorizationIdpError} if an error occurs during the parsing process and the error is related to the IDP
- * @param authRes the authorization response to be parsed
- * @returns the authorization result which contains code, state and iss
- */
-exports.completeUserAuthorizationWithFormPostJwtMode = completeUserAuthorizationWithFormPostJwtMode;
-const parseAuthorizationResponse = authRes => {
-  const authResParsed = _auth.AuthorizationResultShape.safeParse(authRes);
-  if (!authResParsed.success) {
-    const authErr = _auth.AuthorizationErrorShape.safeParse(authRes);
-    if (!authErr.success) {
-      _logging.Logger.log(_logging.LogLevel.ERROR, `Error while parsing the authorization response: ${authResParsed.error.message}`);
-      throw new _errors2.AuthorizationError(authResParsed.error.message); // an error occured while parsing the result and the error
-    }
-
-    _logging.Logger.log(_logging.LogLevel.ERROR, `Error while authorizating with the idp: ${JSON.stringify(authErr)}`);
-    throw new _errors2.AuthorizationIdpError(authErr.data.error, authErr.data.error_description);
-  }
-  return authResParsed.data;
-};
-
-/**
- * Creates the authorization response payload to be sent.
- * This payload includes the state and the VP tokens for the presented credentials.
- * The payload is encoded in Base64.
- * @param state - The state parameter from the request object (optional).
- * @param remotePresentations - An array of remote presentations containing credential IDs and their corresponding VP tokens.
- * @returns The Base64 encoded authorization response payload.
- */
-exports.parseAuthorizationResponse = parseAuthorizationResponse;
-const createAuthzResponsePayload = async _ref4 => {
-  let {
-    state,
-    remotePresentations,
-    wiaCryptoContext
-  } = _ref4;
-  const {
-    kid
-  } = await wiaCryptoContext.getPublicKey();
-  return new _ioReactNativeJwt.SignJWT(wiaCryptoContext).setProtectedHeader({
-    typ: "jwt",
-    kid
-  }).setPayload({
-    /**
-     * TODO [SIW-2264]: `state` coming from `requestObject` is marked as `optional`
-     * At the moment, it is not entirely clear whether this value can indeed be omitted
-     * and, if so, what the consequences of its absence might be.
-     */
-    ...(state ? {
-      state
-    } : {}),
-    vp_token: remotePresentations.reduce((vp_token, _ref5) => {
-      let {
-        credentialId,
-        vpToken
-      } = _ref5;
-      return {
-        ...vp_token,
-        [credentialId]: vpToken
-      };
-    }, {})
-  }).setIssuedAt().setExpirationTime("1h").sign();
-};
-//# sourceMappingURL=04-complete-user-authorization.js.map

package/lib/commonjs/credential/issuance/04-complete-user-authorization.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_auth","require","_misc","_parseUrl","_interopRequireDefault","_errors","_ioReactNativeJwt","_types","_types2","_decoder","_errors2","_logging","_","obj","__esModule","default","continueUserAuthorizationWithMRTDPoPChallenge","authRedirectUrl","Logger","log","LogLevel","DEBUG","query","parseUrl","authResParsed","AuthorizationChallengeResultShape","safeParse","success","authErr","AuthorizationErrorShape","ERROR","error","message","AuthorizationError","JSON","stringify","AuthorizationIdpError","data","error_description","exports","buildAuthorizationUrl","issuerRequestUri","clientId","issuerConf","idpHint","authzRequestEndpoint","oauth_authorization_server","authorization_endpoint","params","URLSearchParams","client_id","request_uri","append","authUrl","completeUserAuthorizationWithQueryMode","parseAuthorizationResponse","getRequestedCredentialToBePresented","appFetch","arguments","length","undefined","fetch","toString","requestObject","method","then","hasStatusOrThrow","IssuerResponseError","res","text","jws","decode","reqObj","RequestObject","payload","ValidationFailed","reason","completeUserAuthorizationWithFormPostJwtMode","pid","_ref","wiaCryptoContext","pidCryptoContext","dcql_query","Error","dcqlQueryResult","Presentation","evaluateDcqlQuery","credentialsToPresent","map","_ref2","requiredDisclosures","rest","requestedClaims","_ref3","claimName","remotePresentations","prepareRemotePresentations","nonce","authzResponsePayload","createAuthzResponsePayload","state","body","response","resUriRes","response_uri","headers","reqUri","json","responseUri","ResponseUriResultShape","redirect_uri","getJwtFromFormPost","cbRes","decodedJwt","authRes","AuthorizationResultShape","_ref4","kid","getPublicKey","SignJWT","setProtectedHeader","typ","setPayload","vp_token","reduce","_ref5","credentialId","vpToken","setIssuedAt","setExpirationTime","sign"],"sourceRoot":"../../../../src","sources":["credential/issuance/04-complete-user-authorization.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAOA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,SAAA,GAAAC,sBAAA,CAAAH,OAAA;AACA,IAAAI,OAAA,GAAAJ,OAAA;AAEA,IAAAK,iBAAA,GAAAL,OAAA;AAKA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,OAAA,GAAAP,OAAA;AACA,IAAAQ,QAAA,GAAAR,OAAA;AACA,IAAAS,QAAA,GAAAT,OAAA;AACA,IAAAU,QAAA,GAAAV,OAAA;AACA,IAAAW,CAAA,GAAAX,OAAA;AAAkC,SAAAG,uBAAAS,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAGlC;AACA;AACA;;AAmCA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMG,6CAA4F,GACvG,MAAOC,eAAe,IAAK;EACzBC,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,+HACH,CAAC;EACD,MAAMC,KAAK,GAAG,IAAAC,iBAAQ,EAACN,eAAe,CAAC,CAACK,KAAK;EAE7C,MAAME,aAAa,GAAGC,uCAAiC,CAACC,SAAS,CAACJ,KAAK,CAAC;EACxE,IAAI,CAACE,aAAa,CAACG,OAAO,EAAE;IAC1B,MAAMC,OAAO,GAAGC,6BAAuB,CAACH,SAAS,CAACJ,KAAK,CAAC;IACxD,IAAI,CAACM,OAAO,CAACD,OAAO,EAAE;MACpBT,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,mDAAkDN,aAAa,CAACO,KAAK,CAACC,OAAQ,EACjF,CAAC;MACD,MAAM,IAAIC,2BAAkB,CAACT,aAAa,CAACO,KAAK,CAACC,OAAO,CAAC,CAAC,CAAC;IAC7D;;IACAd,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,2CAA0CI,IAAI,CAACC,SAAS,CAACP,OAAO,CAAE,EACrE,CAAC;IACD,MAAM,IAAIQ,8BAAqB,CAC7BR,OAAO,CAACS,IAAI,CAACN,KAAK,EAClBH,OAAO,CAACS,IAAI,CAACC,iBACf,CAAC;EACH;EACA,OAAOd,aAAa,CAACa,IAAI;AAC3B,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AARAE,OAAA,CAAAvB,6CAAA,GAAAA,6CAAA;AASO,MAAMwB,qBAA4C,GAAG,MAAAA,CAC1DC,gBAAgB,EAChBC,QAAQ,EACRC,UAAU,EACVC,OAAO,KACJ;EACH,MAAMC,oBAAoB,GACxBF,UAAU,CAACG,0BAA0B,CAACC,sBAAsB;EAE9D,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCC,SAAS,EAAER,QAAQ;IACnBS,WAAW,EAAEV;EACf,CAAC,CAAC;EAEF,IAAIG,OAAO,EAAE;IACXI,MAAM,CAACI,MAAM,CAAC,SAAS,EAAER,OAAO,CAAC;EACnC;EAEA,MAAMS,OAAO,GAAI,GAAER,oBAAqB,IAAGG,MAAO,EAAC;EAEnD,OAAO;IAAEK;EAAQ,CAAC;AACpB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AANAd,OAAA,CAAAC,qBAAA,GAAAA,qBAAA;AAOO,MAAMc,sCAA8E,GACzF,MAAOrC,eAAe,IAAK;EACzBC,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2GACH,CAAC;EACD,MAAMC,KAAK,GAAG,IAAAC,iBAAQ,EAACN,eAAe,CAAC,CAACK,KAAK;EAE7C,OAAOiC,0BAA0B,CAACjC,KAAK,CAAC;AAC1C,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAXAiB,OAAA,CAAAe,sCAAA,GAAAA,sCAAA;AAYO,MAAME,mCAAwE,GACnF,eAAAA,CAAOf,gBAAgB,EAAEC,QAAQ,EAAEC,UAAU,EAAuB;EAAA,IAArBc,QAAQ,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAGG,KAAK;EAC7D3C,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,sGACH,CAAC;EACD,MAAMwB,oBAAoB,GACxBF,UAAU,CAACG,0BAA0B,CAACC,sBAAsB;EAC9D,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCC,SAAS,EAAER,QAAQ;IACnBS,WAAW,EAAEV;EACf,CAAC,CAAC;EAEFvB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,oCAAmCwB,oBAAqB,IAAGG,MAAM,CAACc,QAAQ,CAAC,CAAE,EAChF,CAAC;EAED,MAAMC,aAAa,GAAG,MAAMN,QAAQ,CACjC,GAAEZ,oBAAqB,IAAGG,MAAM,CAACc,QAAQ,CAAC,CAAE,EAAC,EAC9C;IAAEE,MAAM,EAAE;EAAM,CAClB,CAAC,CACEC,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,EAAEC,2BAAmB,CAAC,CAAC,CAChDF,IAAI,CAAEG,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBJ,IAAI,CAAEK,GAAG,IAAK,IAAAC,wBAAM,EAACD,GAAG,CAAC,CAAC,CAC1BL,IAAI,CAAEO,MAAM,IAAKC,oBAAa,CAAC/C,SAAS,CAAC8C,MAAM,CAACE,OAAO,CAAC,CAAC;EAE5D,IAAI,CAACX,aAAa,CAACpC,OAAO,EAAE;IAC1BT,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,+CAA8CiC,aAAa,CAAChC,KAAK,CAACC,OAAQ,EAC7E,CAAC;IACD,MAAM,IAAI2C,wBAAgB,CAAC;MACzB3C,OAAO,EAAE,kCAAkC;MAC3C4C,MAAM,EAAEb,aAAa,CAAChC,KAAK,CAACC;IAC9B,CAAC,CAAC;EACJ;EACA,OAAO+B,aAAa,CAAC1B,IAAI;AAC3B,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAVAE,OAAA,CAAAiB,mCAAA,GAAAA,mCAAA;AAWO,MAAMqB,4CAA0F,GACrG,MAAAA,CACEd,aAAa,EACbe,GAAG,EAAAC,IAAA,KAEA;EAAA,IADH;IAAEC,gBAAgB;IAAEC,gBAAgB;IAAExB,QAAQ,GAAGI;EAAM,CAAC,GAAAkB,IAAA;EAExD7D,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,sHACH,CAAC;EAED,IAAI,CAAC0C,aAAa,CAACmB,UAAU,EAAE;IAC7B,MAAM,IAAIC,KAAK,CAAC,wBAAwB,CAAC;EAC3C;EAEA,MAAMC,eAAe,GAAGC,cAAY,CAACC,iBAAiB,CACpD,CAAC,CAACL,gBAAgB,EAAEH,GAAG,CAAC,CAAC,EACzBf,aAAa,CAACmB,UAChB,CAAC;EAED,MAAMK,oBAAoB,GAAGH,eAAe,CAACI,GAAG,CAC9CC,KAAA;IAAA,IAAC;MAAEC,mBAAmB;MAAE,GAAGC;IAAK,CAAC,GAAAF,KAAA;IAAA,OAAM;MACrC,GAAGE,IAAI;MACPC,eAAe,EAAEF,mBAAmB,CAACF,GAAG,CAACK,KAAA;QAAA,IAAC,GAAGC,SAAS,CAAC,GAAAD,KAAA;QAAA,OAAKC,SAAS;MAAA;IACvE,CAAC;EAAA,CACH,CAAC;EAED,MAAMC,mBAAmB,GAAG,MAAMV,cAAY,CAACW,0BAA0B,CACvET,oBAAoB,EACpBxB,aAAa,CAACkC,KAAK,EACnBlC,aAAa,CAACb,SAChB,CAAC;EAED,MAAMgD,oBAAoB,GAAG,MAAMC,0BAA0B,CAAC;IAC5DC,KAAK,EAAErC,aAAa,CAACqC,KAAK;IAC1BL,mBAAmB;IACnBf;EACF,CAAC,CAAC;EAEF9D,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2BAA0B6E,oBAAqB,EAClD,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;EAEA,MAAMG,IAAI,GAAG,IAAIpD,eAAe,CAAC;IAC/BqD,QAAQ,EAAEJ;EACZ,CAAC,CAAC,CAACpC,QAAQ,CAAC,CAAC;EAEb,MAAMyC,SAAS,GAAG,MAAM9C,QAAQ,CAACM,aAAa,CAACyC,YAAY,EAAE;IAC3DxC,MAAM,EAAE,MAAM;IACdyC,OAAO,EAAE;MACP,cAAc,EAAE;IAClB,CAAC;IACDJ;EACF,CAAC,CAAC,CACCpC,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,EAAEC,2BAAmB,CAAC,CAAC,CAChDF,IAAI,CAAEyC,MAAM,IAAKA,MAAM,CAACC,IAAI,CAAC,CAAC,CAAC;EAElC,MAAMC,WAAW,GAAGC,8BAAsB,CAACnF,SAAS,CAAC6E,SAAS,CAAC;EAC/D,IAAI,CAACK,WAAW,CAACjF,OAAO,EAAE;IACxBT,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,4CAA2C8E,WAAW,CAAC7E,KAAK,CAACC,OAAQ,EACxE,CAAC;IACD,MAAM,IAAI2C,wBAAgB,CAAC;MACzB3C,OAAO,EAAE,gCAAgC;MACzC4C,MAAM,EAAEgC,WAAW,CAAC7E,KAAK,CAACC;IAC5B,CAAC,CAAC;EACJ;EAEA,OAAO,MAAMyB,QAAQ,CAACmD,WAAW,CAACvE,IAAI,CAACyE,YAAY,CAAC,CACjD7C,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,EAAEC,2BAAmB,CAAC,CAAC,CAChDF,IAAI,CAAEG,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBJ,IAAI,CAAC8C,2BAAkB,CAAC,CACxB9C,IAAI,CAAE+C,KAAK,IAAKzD,0BAA0B,CAACyD,KAAK,CAACC,UAAU,CAACvC,OAAO,CAAC,CAAC;AAC1E,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AANAnC,OAAA,CAAAsC,4CAAA,GAAAA,4CAAA;AAOO,MAAMtB,0BAA0B,GACrC2D,OAAgB,IACQ;EACxB,MAAM1F,aAAa,GAAG2F,8BAAwB,CAACzF,SAAS,CAACwF,OAAO,CAAC;EACjE,IAAI,CAAC1F,aAAa,CAACG,OAAO,EAAE;IAC1B,MAAMC,OAAO,GAAGC,6BAAuB,CAACH,SAAS,CAACwF,OAAO,CAAC;IAC1D,IAAI,CAACtF,OAAO,CAACD,OAAO,EAAE;MACpBT,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,mDAAkDN,aAAa,CAACO,KAAK,CAACC,OAAQ,EACjF,CAAC;MACD,MAAM,IAAIC,2BAAkB,CAACT,aAAa,CAACO,KAAK,CAACC,OAAO,CAAC,CAAC,CAAC;IAC7D;;IACAd,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,2CAA0CI,IAAI,CAACC,SAAS,CAACP,OAAO,CAAE,EACrE,CAAC;IACD,MAAM,IAAIQ,8BAAqB,CAC7BR,OAAO,CAACS,IAAI,CAACN,KAAK,EAClBH,OAAO,CAACS,IAAI,CAACC,iBACf,CAAC;EACH;EACA,OAAOd,aAAa,CAACa,IAAI;AAC3B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAPAE,OAAA,CAAAgB,0BAAA,GAAAA,0BAAA;AAQA,MAAM4C,0BAA0B,GAAG,MAAAiB,KAAA,IAQZ;EAAA,IARmB;IACxChB,KAAK;IACLL,mBAAmB;IACnBf;EAKF,CAAC,GAAAoC,KAAA;EACC,MAAM;IAAEC;EAAI,CAAC,GAAG,MAAMrC,gBAAgB,CAACsC,YAAY,CAAC,CAAC;EAErD,OAAO,IAAIC,yBAAO,CAACvC,gBAAgB,CAAC,CACjCwC,kBAAkB,CAAC;IAClBC,GAAG,EAAE,KAAK;IACVJ;EACF,CAAC,CAAC,CACDK,UAAU,CAAC;IACV;AACN;AACA;AACA;AACA;IACM,IAAItB,KAAK,GAAG;MAAEA;IAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3BuB,QAAQ,EAAE5B,mBAAmB,CAAC6B,MAAM,CAClC,CAACD,QAAQ,EAAAE,KAAA;MAAA,IAAE;QAAEC,YAAY;QAAEC;MAAQ,CAAC,GAAAF,KAAA;MAAA,OAAM;QACxC,GAAGF,QAAQ;QACX,CAACG,YAAY,GAAGC;MAClB,CAAC;IAAA,CAAC,EACF,CAAC,CACH;EACF,CAAC,CAAC,CACDC,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,IAAI,CAAC,CACvBC,IAAI,CAAC,CAAC;AACX,CAAC"}

package/lib/commonjs/credential/issuance/05-authorize-access.js

@@ -1,87 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.authorizeAccess = void 0;
-var _misc = require("../../utils/misc");
-var _dpop = require("../../utils/dpop");
-var _uuid = require("uuid");
-var _pop = require("../../utils/pop");
-var WalletInstanceAttestation = _interopRequireWildcard(require("../../wallet-instance-attestation"));
-var _types = require("./types");
-var _errors = require("../../utils/errors");
-var _logging = require("../../utils/logging");
-function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
-function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
-/**
- * Creates and sends the DPoP Proof JWT to be presented with the authorization code to the /token endpoint of the authorization server
- * for requesting the issuance of an access token bound to the public key of the Wallet Instance contained within the DPoP.
- * This enables the Wallet Instance to request a digital credential.
- * The DPoP Proof JWT is generated according to the section 4.3 of the DPoP RFC 9449 specification.
- * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
- * @param code The authorization code returned by {@link completeUserAuthorizationWithQueryMode} or {@link completeUserAuthorizationWithFormPost}
- * @param redirectUri The redirect URI which is the custom URL scheme that the Wallet Instance is registered to handle
- * @param clientId The client id returned by {@link startUserAuthorization}
- * @param codeVerifier The code verifier returned by {@link startUserAuthorization}
- * @param context.walletInstanceAttestation The Wallet Instance's attestation
- * @param context.wiaCryptoContext The Wallet Instance's crypto context
- * @param context.dPopCryptoContext The DPoP crypto context
- * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
- * @throws {ValidationFailed} if an error occurs while parsing the token response
- * @throws {IssuerResponseError} with a specific code for more context
- * @return The token response containing the access token along with the token request signed with DPoP which has to be used in the {@link obtainCredential} step.
- */
-const authorizeAccess = async (issuerConf, code, _, redirectUri, codeVerifier, context) => {
-  const {
-    appFetch = fetch,
-    walletInstanceAttestation,
-    wiaCryptoContext,
-    dPopCryptoContext
-  } = context;
-  const aud = issuerConf.openid_credential_issuer.credential_issuer;
-  const iss = WalletInstanceAttestation.decode(walletInstanceAttestation).payload.cnf.jwk.kid;
-  const tokenUrl = issuerConf.oauth_authorization_server.token_endpoint;
-  const tokenRequestSignedDPop = await (0, _dpop.createDPopToken)({
-    htm: "POST",
-    htu: tokenUrl,
-    jti: `${(0, _uuid.v4)()}`
-  }, dPopCryptoContext);
-  _logging.Logger.log(_logging.LogLevel.DEBUG, `Token request DPoP: ${tokenRequestSignedDPop}`);
-  const signedWiaPoP = await (0, _pop.createPopToken)({
-    jti: `${(0, _uuid.v4)()}`,
-    aud,
-    iss
-  }, wiaCryptoContext);
-  _logging.Logger.log(_logging.LogLevel.DEBUG, `WIA DPoP token: ${signedWiaPoP}`);
-  const requestBody = {
-    grant_type: "authorization_code",
-    code,
-    code_verifier: codeVerifier,
-    redirect_uri: redirectUri
-  };
-  const authorizationRequestFormBody = new URLSearchParams(requestBody);
-  _logging.Logger.log(_logging.LogLevel.DEBUG, `Auth form request body: ${authorizationRequestFormBody}`);
-  const tokenRes = await appFetch(tokenUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      DPoP: tokenRequestSignedDPop,
-      "OAuth-Client-Attestation": walletInstanceAttestation,
-      "OAuth-Client-Attestation-PoP": signedWiaPoP
-    },
-    body: authorizationRequestFormBody.toString()
-  }).then((0, _misc.hasStatusOrThrow)(200, _errors.IssuerResponseError)).then(res => res.json()).then(body => _types.TokenResponse.safeParse(body));
-  if (!tokenRes.success) {
-    _logging.Logger.log(_logging.LogLevel.ERROR, `Token Response validation failed: ${tokenRes.error.message}`);
-    throw new _errors.ValidationFailed({
-      message: "Token Response validation failed",
-      reason: tokenRes.error.message
-    });
-  }
-  return {
-    accessToken: tokenRes.data
-  };
-};
-exports.authorizeAccess = authorizeAccess;
-//# sourceMappingURL=05-authorize-access.js.map

package/lib/commonjs/credential/issuance/05-authorize-access.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_misc","require","_dpop","_uuid","_pop","WalletInstanceAttestation","_interopRequireWildcard","_types","_errors","_logging","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","authorizeAccess","issuerConf","code","_","redirectUri","codeVerifier","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","dPopCryptoContext","aud","openid_credential_issuer","credential_issuer","iss","decode","payload","cnf","jwk","kid","tokenUrl","oauth_authorization_server","token_endpoint","tokenRequestSignedDPop","createDPopToken","htm","htu","jti","uuidv4","Logger","log","LogLevel","DEBUG","signedWiaPoP","createPopToken","requestBody","grant_type","code_verifier","redirect_uri","authorizationRequestFormBody","URLSearchParams","tokenRes","method","headers","DPoP","body","toString","then","hasStatusOrThrow","IssuerResponseError","res","json","TokenResponse","safeParse","success","ERROR","error","message","ValidationFailed","reason","accessToken","data","exports"],"sourceRoot":"../../../../src","sources":["credential/issuance/05-authorize-access.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,IAAA,GAAAH,OAAA;AACA,IAAAI,yBAAA,GAAAC,uBAAA,CAAAL,OAAA;AAEA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,OAAA,GAAAP,OAAA;AAEA,IAAAQ,QAAA,GAAAR,OAAA;AAAuD,SAAAS,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAL,wBAAAS,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAgBvD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMW,eAAgC,GAAG,MAAAA,CAC9CC,UAAU,EACVC,IAAI,EACJC,CAAC,EACDC,WAAW,EACXC,YAAY,EACZC,OAAO,KACJ;EACH,MAAM;IACJC,QAAQ,GAAGC,KAAK;IAChBC,yBAAyB;IACzBC,gBAAgB;IAChBC;EACF,CAAC,GAAGL,OAAO;EACX,MAAMM,GAAG,GAAGX,UAAU,CAACY,wBAAwB,CAACC,iBAAiB;EACjE,MAAMC,GAAG,GAAG1C,yBAAyB,CAAC2C,MAAM,CAACP,yBAAyB,CAAC,CACpEQ,OAAO,CAACC,GAAG,CAACC,GAAG,CAACC,GAAG;EAEtB,MAAMC,QAAQ,GAAGpB,UAAU,CAACqB,0BAA0B,CAACC,cAAc;EAErE,MAAMC,sBAAsB,GAAG,MAAM,IAAAC,qBAAe,EAClD;IACEC,GAAG,EAAE,MAAM;IACXC,GAAG,EAAEN,QAAQ;IACbO,GAAG,EAAG,GAAE,IAAAC,QAAM,EAAC,CAAE;EACnB,CAAC,EACDlB,iBACF,CAAC;EAEDmB,eAAM,CAACC,GAAG,CAACC,iBAAQ,CAACC,KAAK,EAAG,uBAAsBT,sBAAuB,EAAC,CAAC;EAE3E,MAAMU,YAAY,GAAG,MAAM,IAAAC,mBAAc,EACvC;IACEP,GAAG,EAAG,GAAE,IAAAC,QAAM,EAAC,CAAE,EAAC;IAClBjB,GAAG;IACHG;EACF,CAAC,EACDL,gBACF,CAAC;EAEDoB,eAAM,CAACC,GAAG,CAACC,iBAAQ,CAACC,KAAK,EAAG,mBAAkBC,YAAa,EAAC,CAAC;EAE7D,MAAME,WAAW,GAAG;IAClBC,UAAU,EAAE,oBAAoB;IAChCnC,IAAI;IACJoC,aAAa,EAAEjC,YAAY;IAC3BkC,YAAY,EAAEnC;EAChB,CAAC;EAED,MAAMoC,4BAA4B,GAAG,IAAIC,eAAe,CAACL,WAAW,CAAC;EAErEN,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2BAA0BO,4BAA6B,EAC1D,CAAC;EAED,MAAME,QAAQ,GAAG,MAAMnC,QAAQ,CAACc,QAAQ,EAAE;IACxCsB,MAAM,EAAE,MAAM;IACdC,OAAO,EAAE;MACP,cAAc,EAAE,mCAAmC;MACnDC,IAAI,EAAErB,sBAAsB;MAC5B,0BAA0B,EAAEf,yBAAyB;MACrD,8BAA8B,EAAEyB;IAClC,CAAC;IACDY,IAAI,EAAEN,4BAA4B,CAACO,QAAQ,CAAC;EAC9C,CAAC,CAAC,CACCC,IAAI,CAAC,IAAAC,sBAAgB,EAAC,GAAG,EAAEC,2BAAmB,CAAC,CAAC,CAChDF,IAAI,CAAEG,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC,CACzBJ,IAAI,CAAEF,IAAI,IAAKO,oBAAa,CAACC,SAAS,CAACR,IAAI,CAAC,CAAC;EAEhD,IAAI,CAACJ,QAAQ,CAACa,OAAO,EAAE;IACrBzB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACwB,KAAK,EACb,qCAAoCd,QAAQ,CAACe,KAAK,CAACC,OAAQ,EAC9D,CAAC;IAED,MAAM,IAAIC,wBAAgB,CAAC;MACzBD,OAAO,EAAE,kCAAkC;MAC3CE,MAAM,EAAElB,QAAQ,CAACe,KAAK,CAACC;IACzB,CAAC,CAAC;EACJ;EAEA,OAAO;IAAEG,WAAW,EAAEnB,QAAQ,CAACoB;EAAK,CAAC;AACvC,CAAC;AAACC,OAAA,CAAA/D,eAAA,GAAAA,eAAA"}