@pagopa/io-react-native-wallet 3.1.2 → 3.3.0

package/lib/commonjs/credential/issuance/README.md

@@ -8,6 +8,8 @@ Credentials instead require a simpler authorization flow and they require other
 
 The supported credentials are defined in the entity configuration of the issuer which is evaluted and parsed in the `evaluateIssuerTrust` step. Available credentials are identified with a unique `credential_configuration_id`, that must be used when requesting authorization. The Authorization Server returns an array of **credential identifiers** that map to the `credential_configuration_id` provided: to obtain the credential, one of the credential identifiers (or all of them) must be requested to the credential endpoint.
 
+In the newest versions of IT-Wallet specifications it is mandatory that the cryptographic keys bound to each credential are stored in a WSCD and attested in a **Wallet Unit Attestation**, that must be sent to the Issuer when requesting a credential.
+
 ## Sequence Diagram
 
 ```mermaid
@@ -20,8 +22,9 @@ graph TD;
     C4.1[completeUserAuthorizationWithFormPostJwtMode]
     E4[completeUserAuthorizationWithQueryMode]
     5[authorizeAccess]
-    6[obtainCredential]
-    7[verifyAndParseCredential]
+    6[WalletUnitAttestation.getAttestation]
+    7[obtainCredential]
+    8[verifyAndParseCredential]
     credSel{Is credential an eID?}
     proofSel{Requires MRTD PoP?}
     M1[continueUserAuthorizationWithMRTDPoPChallenge]
@@ -44,6 +47,7 @@ graph TD;
     E4 --> 5
     5 --> 6
     6 --> 7
+    7 --> 8
 
     M1 --> M2
     M2 --> M3
@@ -92,6 +96,10 @@ When the credential is different than an eID, the flow requires the user to pres
 
 The expected result from the authentication process is in `form_post.jwt` format as defined in [JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)](https://openid.net/specs/oauth-v2-jarm.html#name-response-mode-form_postjwt).
 
+## Batch issuance
+
+To obtain a batch of credentials the Issuance module exposes a dedicated method—`obtainCredentialsBatch`—that returns a list of credentials of the same type with different cryptographic data. For this reason the caller must generate multiple keys and attest them in a single Wallet Unit Attestation.
+
 ## Examples
 
 <details>
@@ -119,12 +127,28 @@ const { WALLET_PROVIDER_BASE_URL, WALLET_EAA_PROVIDER_BASE_URL, REDIRECT_URI } =
  * WARNING: The integrity context must be the same used when creating the Wallet Instance with the same keytag.
  */
 const walletInstanceAttestation =
-  await WalletInstanceAttestation.getAttestation({
-    wiaCryptoContext,
-    integrityContext,
-    walletProviderBaseUrl: WALLET_PROVIDER_BASE_URL,
-    appFetch,
-  });
+  await wallet.WalletInstanceAttestation.getAttestation(
+    {
+      walletProviderBaseUrl: WALLET_PROVIDER_BASE_URL,
+      walletSolutionId: "exampleId",
+      walletSolutionVersion: "1.2.3",
+    },
+    {
+      wiaCryptoContext,
+      integrityContext,
+      appFetch,
+    }
+  );
+
+const credentialKeyTag = uuidv4().toString();
+let walletUnitAttestation: string | undefined;
+
+// Obtains a Wallet Unit Attestation if supported
+if (wallet.WalletUnitAttestation.isSupported) {
+  walletUnitAttestation = await wallet.WalletUnitAttestation.getAttestation(); // See the Wallet Unit Attestation README for more details
+} else {
+  await generate(credentialKeyTag); // Let's assume this function generates a new hardware-backed key pair
+}
 
 const pid = {
   credential: "example",
@@ -133,9 +157,6 @@ const pid = {
   credentialType: "PersonIdentificationData";
 };
 
-// Create credential crypto context
-const credentialKeyTag = uuidv4().toString();
-await generate(credentialKeyTag); // Let's assume this function generates a new hardware-backed key pair
 const credentialCryptoContext = createCryptoContextFor(credentialKeyTag);
 
 // Evaluate issuer trust
@@ -271,12 +292,18 @@ const { WALLET_PROVIDER_BASE_URL, WALLET_EID_PROVIDER_BASE_URL, REDIRECT_URI } =
  * WARNING: The integrity context must be the same used when creating the Wallet Instance with the same keytag.
  */
 const walletInstanceAttestation =
-  await WalletInstanceAttestation.getAttestation({
-    wiaCryptoContext,
-    integrityContext,
-    walletProviderBaseUrl: WALLET_PROVIDER_BASE_URL,
-    appFetch,
-  });
+  await wallet.WalletInstanceAttestation.getAttestation(
+    {
+      walletProviderBaseUrl: WALLET_PROVIDER_BASE_URL,
+      walletSolutionId: "exampleId",
+      walletSolutionVersion: "1.2.3",
+    },
+    {
+      wiaCryptoContext,
+      integrityContext,
+      appFetch,
+    }
+  );
 
 const idpHit = "https://example.com"; // Let's assume this is the IDP hint
 

package/lib/commonjs/credential/issuance/common/02-start-user-authorization.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.selectResponseMode = exports.selectCredentialDefinition = void 0;
+var _errors = require("../../../utils/errors");
 var _logging = require("../../../utils/logging");
 /**
  * Ensures that the credential type requested is supported by the issuer and contained in the
@@ -20,7 +21,7 @@ const selectCredentialDefinition = (issuerConf, credentialId) => {
   }));
   if (!result) {
     _logging.Logger.log(_logging.LogLevel.ERROR, `Requested credential ${credentialId} is not supported by the issuer according to its configuration ${JSON.stringify(credential_configurations_supported)}`);
-    throw new Error(`No credential support the type '${credentialId}'`);
+    throw new _errors.IoWalletError(`No credential support the type '${credentialId}'`);
   }
   return result;
 };
@@ -40,14 +41,14 @@ const selectResponseMode = (issuerConf, credentialIds) => {
   }
   if (responseModeSet.size !== 1) {
     _logging.Logger.log(_logging.LogLevel.ERROR, `${credentialIds} have incompatible response_mode: ${[...responseModeSet.values()]}`);
-    throw new Error("Requested credentials have incompatible response_mode and cannot be requested with the same PAR request");
+    throw new _errors.IoWalletError("Requested credentials have incompatible response_mode and cannot be requested with the same PAR request");
   }
   const [responseMode] = responseModeSet.values();
   _logging.Logger.log(_logging.LogLevel.DEBUG, `Selected response mode ${responseMode} for credential IDs ${credentialIds}`);
   const responseModeSupported = issuerConf.response_modes_supported;
   if (responseModeSupported && !responseModeSupported.includes(responseMode)) {
     _logging.Logger.log(_logging.LogLevel.ERROR, `Requested response mode ${responseMode} is not supported by the issuer according to its configuration ${JSON.stringify(responseModeSupported)}`);
-    throw new Error(`No response mode support for IDs '${credentialIds}'`);
+    throw new _errors.IoWalletError(`No response mode support for IDs '${credentialIds}'`);
   }
   return responseMode;
 };

package/lib/commonjs/credential/issuance/common/02-start-user-authorization.js.map

@@ -1 +1 @@
-{"version":3,"names":["_logging","require","selectCredentialDefinition","issuerConf","credentialId","credential_configurations_supported","result","Object","keys","filter","e","includes","map","credential_configuration_id","type","Logger","log","LogLevel","ERROR","JSON","stringify","Error","exports","selectResponseMode","credentialIds","responseModeSet","Set","add","match","size","values","responseMode","DEBUG","responseModeSupported","response_modes_supported"],"sourceRoot":"../../../../../src","sources":["credential/issuance/common/02-start-user-authorization.ts"],"mappings":";;;;;;AAAA,IAAAA,QAAA,GAAAC,OAAA;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,0BAA0B,GAAGA,CACxCC,UAAwB,EACxBC,YAAoB,KACI;EACxB,MAAMC,mCAAmC,GACvCF,UAAU,CAACE,mCAAmC;EAEhD,MAAM,CAACC,MAAM,CAAC,GAAGC,MAAM,CAACC,IAAI,CAACH,mCAAmC,CAAC,CAC9DI,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,QAAQ,CAACP,YAAY,CAAC,CAAC,CACvCQ,GAAG,CAAC,OAAO;IACVC,2BAA2B,EAAET,YAAY;IACzCU,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACR,MAAM,EAAE;IACXS,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,wBAAuBd,YAAa,kEAAiEe,IAAI,CAACC,SAAS,CAACf,mCAAmC,CAAE,EAC5J,CAAC;IACD,MAAM,IAAIgB,KAAK,CAAE,mCAAkCjB,YAAa,GAAE,CAAC;EACrE;EACA,OAAOE,MAAM;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AANAgB,OAAA,CAAApB,0BAAA,GAAAA,0BAAA;AAOO,MAAMqB,kBAAkB,GAAGA,CAChCpB,UAAwB,EACxBqB,aAAuB,KACN;EACjB,MAAMC,eAAe,GAAG,IAAIC,GAAG,CAAe,CAAC;EAE/C,KAAK,MAAMtB,YAAY,IAAIoB,aAAa,EAAE;IACxCC,eAAe,CAACE,GAAG,CACjBvB,YAAY,CAACwB,KAAK,CAAC,2BAA2B,CAAC,GAC3C,OAAO,GACP,eACN,CAAC;EACH;EAEA,IAAIH,eAAe,CAACI,IAAI,KAAK,CAAC,EAAE;IAC9Bd,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,GAAEM,aAAc,qCAAoC,CAAC,GAAGC,eAAe,CAACK,MAAM,CAAC,CAAC,CAAE,EACrF,CAAC;IACD,MAAM,IAAIT,KAAK,CACb,yGACF,CAAC;EACH;EAEA,MAAM,CAACU,YAAY,CAAC,GAAGN,eAAe,CAACK,MAAM,CAAC,CAAC;EAE/Cf,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACe,KAAK,EACb,0BAAyBD,YAAa,uBAAsBP,aAAc,EAC7E,CAAC;EAED,MAAMS,qBAAqB,GAAG9B,UAAU,CAAC+B,wBAAwB;EACjE,IAAID,qBAAqB,IAAI,CAACA,qBAAqB,CAACtB,QAAQ,CAACoB,YAAa,CAAC,EAAE;IAC3EhB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2BAA0Ba,YAAa,kEAAiEZ,IAAI,CAACC,SAAS,CAACa,qBAAqB,CAAE,EACjJ,CAAC;IACD,MAAM,IAAIZ,KAAK,CAAE,qCAAoCG,aAAc,GAAE,CAAC;EACxE;EAEA,OAAOO,YAAY;AACrB,CAAC;AAACT,OAAA,CAAAC,kBAAA,GAAAA,kBAAA"}
+{"version":3,"names":["_errors","require","_logging","selectCredentialDefinition","issuerConf","credentialId","credential_configurations_supported","result","Object","keys","filter","e","includes","map","credential_configuration_id","type","Logger","log","LogLevel","ERROR","JSON","stringify","IoWalletError","exports","selectResponseMode","credentialIds","responseModeSet","Set","add","match","size","values","responseMode","DEBUG","responseModeSupported","response_modes_supported"],"sourceRoot":"../../../../../src","sources":["credential/issuance/common/02-start-user-authorization.ts"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,QAAA,GAAAD,OAAA;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,0BAA0B,GAAGA,CACxCC,UAAwB,EACxBC,YAAoB,KACI;EACxB,MAAMC,mCAAmC,GACvCF,UAAU,CAACE,mCAAmC;EAEhD,MAAM,CAACC,MAAM,CAAC,GAAGC,MAAM,CAACC,IAAI,CAACH,mCAAmC,CAAC,CAC9DI,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,QAAQ,CAACP,YAAY,CAAC,CAAC,CACvCQ,GAAG,CAAC,OAAO;IACVC,2BAA2B,EAAET,YAAY;IACzCU,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACR,MAAM,EAAE;IACXS,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,wBAAuBd,YAAa,kEAAiEe,IAAI,CAACC,SAAS,CAACf,mCAAmC,CAAE,EAC5J,CAAC;IACD,MAAM,IAAIgB,qBAAa,CAAE,mCAAkCjB,YAAa,GAAE,CAAC;EAC7E;EACA,OAAOE,MAAM;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AANAgB,OAAA,CAAApB,0BAAA,GAAAA,0BAAA;AAOO,MAAMqB,kBAAkB,GAAGA,CAChCpB,UAAwB,EACxBqB,aAAuB,KACN;EACjB,MAAMC,eAAe,GAAG,IAAIC,GAAG,CAAe,CAAC;EAE/C,KAAK,MAAMtB,YAAY,IAAIoB,aAAa,EAAE;IACxCC,eAAe,CAACE,GAAG,CACjBvB,YAAY,CAACwB,KAAK,CAAC,2BAA2B,CAAC,GAC3C,OAAO,GACP,eACN,CAAC;EACH;EAEA,IAAIH,eAAe,CAACI,IAAI,KAAK,CAAC,EAAE;IAC9Bd,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,GAAEM,aAAc,qCAAoC,CAAC,GAAGC,eAAe,CAACK,MAAM,CAAC,CAAC,CAAE,EACrF,CAAC;IACD,MAAM,IAAIT,qBAAa,CACrB,yGACF,CAAC;EACH;EAEA,MAAM,CAACU,YAAY,CAAC,GAAGN,eAAe,CAACK,MAAM,CAAC,CAAC;EAE/Cf,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACe,KAAK,EACb,0BAAyBD,YAAa,uBAAsBP,aAAc,EAC7E,CAAC;EAED,MAAMS,qBAAqB,GAAG9B,UAAU,CAAC+B,wBAAwB;EACjE,IAAID,qBAAqB,IAAI,CAACA,qBAAqB,CAACtB,QAAQ,CAACoB,YAAa,CAAC,EAAE;IAC3EhB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2BAA0Ba,YAAa,kEAAiEZ,IAAI,CAACC,SAAS,CAACa,qBAAqB,CAAE,EACjJ,CAAC;IACD,MAAM,IAAIZ,qBAAa,CACpB,qCAAoCG,aAAc,GACrD,CAAC;EACH;EAEA,OAAOO,YAAY;AACrB,CAAC;AAACT,OAAA,CAAAC,kBAAA,GAAAA,kBAAA"}

package/lib/commonjs/credential/issuance/common/06-verify-and-parse-credential.sdjwt.js

@@ -12,6 +12,8 @@ var _errors = require("../../../utils/errors");
 var _logging = require("../../../utils/logging");
 var _jwk = require("../../../utils/jwk");
 var _credentials = require("../../../utils/credentials");
+var _x = require("../../../utils/x509");
+var _errors2 = require("../../../trust/common/errors");
 /**
  * Parse a Sd-Jwt credential according to the issuer configuration
  * @param credentialConfig - the list of supported credentials, as defined in the issuer configuration with their claims metadata
@@ -118,6 +120,23 @@ const parseCredentialSdJwt = function (credentialConfig, parsedCredentialRaw) {
   return processLevel(parsedCredentialRaw, []);
 };
 
+/**
+ * JWT verifier implementing the interface expected by the SD-JWT library.
+ * Verification is delegated to `io-react-native-jwt` to leverage its support for multiple algorithms.
+ * @returns Boolean indicating whether the verification succeeded or not
+ */
+const sdJwtInstanceVerifier = async (data, signature, options) => {
+  if (!(options !== null && options !== void 0 && options.issuerKeys)) {
+    return false;
+  }
+  try {
+    await (0, _ioReactNativeJwt.verify)(`${data}.${signature}`, options.issuerKeys);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
 /**
  * Given a credential, verify it's in the supported format
  * and the credential is correctly signed
@@ -134,15 +153,13 @@ const parseCredentialSdJwt = function (credentialConfig, parsedCredentialRaw) {
  *
  */
 async function verifyCredentialSdJwt(rawCredential, issuerKeys, holderBindingContext) {
-  const {
-    protectedHeader
-  } = (0, _ioReactNativeJwt.decode)(rawCredential);
-  const verifierJwk = (0, _ioReactNativeJwt.getJwkFromHeader)(protectedHeader, issuerKeys);
   const sdJwtInstance = new _core.SDJwtInstance({
     hasher: _cryptoNodejs.digest,
-    verifier: await _cryptoNodejs.ES256.getVerifier(verifierJwk)
+    verifier: sdJwtInstanceVerifier
   });
-  const [verifiedCredential, holderBindingKey] = await Promise.all([sdJwtInstance.verify(rawCredential), holderBindingContext.getPublicKey()]);
+  const [verifiedCredential, holderBindingKey] = await Promise.all([sdJwtInstance.verify(rawCredential, {
+    issuerKeys
+  }), holderBindingContext.getPublicKey()]);
   const {
     cnf
   } = verifiedCredential.payload;
@@ -153,14 +170,26 @@ async function verifyCredentialSdJwt(rawCredential, issuerKeys, holderBindingCon
   }
   return await sdJwtInstance.decode((0, _credentials.fixLegacyCredentialSdJwt)(rawCredential));
 }
-const verifyAndParseCredentialSdJwt = async (issuerConf, credential, credentialConfigurationId, _ref) => {
+const verifyAndParseCredentialSdJwt = async (issuerConf, credential, credentialConfigurationId, _ref, x509CertRoot) => {
   let {
     credentialCryptoContext,
     ignoreMissingAttributes,
-    includeUndefinedAttributes
+    includeUndefinedAttributes,
+    validateCertificateChain
   } = _ref;
   const decoded = await verifyCredentialSdJwt(credential, issuerConf.keys, credentialCryptoContext);
   _logging.Logger.log(_logging.LogLevel.DEBUG, `Decoded credential: ${JSON.stringify(decoded)}`);
+  if (validateCertificateChain) {
+    var _decoded$jwt;
+    if (!x509CertRoot) {
+      throw new _errors.IoWalletError("Missing x509CertRoot");
+    }
+    const x5c = (_decoded$jwt = decoded.jwt) === null || _decoded$jwt === void 0 || (_decoded$jwt = _decoded$jwt.header) === null || _decoded$jwt === void 0 ? void 0 : _decoded$jwt.x5c;
+    if (!x5c || !Array.isArray(x5c) || x5c.length === 0) {
+      throw new _errors2.MissingX509CertsError("Missing x509 certificates");
+    }
+    await (0, _x.verifyX509Chain)(x5c, x509CertRoot);
+  }
   const credentialConfig = issuerConf.credential_configurations_supported[credentialConfigurationId];
   if (!credentialConfig) {
     _logging.Logger.log(_logging.LogLevel.ERROR, `Credential type not supported by the issuer: ${credentialConfigurationId}`);

package/lib/commonjs/credential/issuance/common/06-verify-and-parse-credential.sdjwt.js.map

@@ -1 +1 @@
-{"version":3,"names":["_ioReactNativeJwt","require","_core","_cryptoNodejs","_parser","_errors","_logging","_jwk","_credentials","parseCredentialSdJwt","credentialConfig","parsedCredentialRaw","ignoreMissingAttributes","arguments","length","undefined","includeUndefinedAttributes","claimsMetadata","claims","missingPaths","rootKeysToVerify","Set","map","c","path","filter","p","rootKey","push","missing","join","received","Object","keys","IoWalletError","getDisplayNames","match","find","isPathEqual","nameMap","entry","display","locale","name","processLevel","currentData","currentPath","Array","isArray","item","dataObj","result","processedKeys","configKeysAtThisLevel","claim","isPrefixOf","nextPart","includes","key","stringKey","toString","dataValue","newPath","localizedNames","value","add","entries","has","verifyCredentialSdJwt","rawCredential","issuerKeys","holderBindingContext","protectedHeader","decode","verifierJwk","getJwkFromHeader","sdJwtInstance","SDJwtInstance","hasher","digest","verifier","ES256","getVerifier","verifiedCredential","holderBindingKey","Promise","all","verify","getPublicKey","cnf","payload","isSameThumbprint","jwk","message","kid","Logger","log","LogLevel","ERROR","fixLegacyCredentialSdJwt","verifyAndParseCredentialSdJwt","issuerConf","credential","credentialConfigurationId","_ref","credentialCryptoContext","decoded","DEBUG","JSON","stringify","credential_configurations_supported","getClaims","parsedCredential","issuedAt","iat","Date","exp","expiration","exports"],"sourceRoot":"../../../../../src","sources":["credential/issuance/common/06-verify-and-parse-credential.sdjwt.ts"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AAKA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,aAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,OAAA,GAAAJ,OAAA;AACA,IAAAK,QAAA,GAAAL,OAAA;AACA,IAAAM,IAAA,GAAAN,OAAA;AAEA,IAAAO,YAAA,GAAAP,OAAA;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMQ,oBAAoB,GAAG,SAAAA,CAC3BC,gBAAgC,EAChCC,mBAA4C,EAGvB;EAAA,IAFrBC,uBAAgC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,KAAK;EAAA,IACxCG,0BAAmC,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,KAAK;EAE3C,MAAMI,cAAc,GAAGP,gBAAgB,CAACQ,MAAM,IAAI,EAAE;;EAEpD;EACA,IAAI,CAACN,uBAAuB,EAAE;IAC5B,MAAMO,YAAsB,GAAG,EAAE;IACjC,MAAMC,gBAAgB,GAAG,IAAIC,GAAG,CAC9BJ,cAAc,CACXK,GAAG,CAAEC,CAAC,IAAKA,CAAC,CAACC,IAAI,CAAC,CAAC,CAAC,CAAC,CACrBC,MAAM,CAAEC,CAAC,IAAkB,OAAOA,CAAC,KAAK,QAAQ,CACrD,CAAC;IAED,KAAK,MAAMC,OAAO,IAAIP,gBAAgB,EAAE;MACtC,IAAI,EAAEO,OAAO,IAAIhB,mBAAmB,CAAC,EAAE;QACrCQ,YAAY,CAACS,IAAI,CAACD,OAAO,CAAC;MAC5B;IACF;IAEA,IAAIR,YAAY,CAACL,MAAM,GAAG,CAAC,EAAE;MAC3B,MAAMe,OAAO,GAAGV,YAAY,CAACW,IAAI,CAAC,IAAI,CAAC;MACvC,MAAMC,QAAQ,GAAGC,MAAM,CAACC,IAAI,CAACtB,mBAAmB,CAAC,CAACmB,IAAI,CAAC,IAAI,CAAC;MAC5D,MAAM,IAAII,qBAAa,CACpB,4DAA2DL,OAAQ,iBAAgBE,QAAS,GAC/F,CAAC;IACH;EACF;;EAEA;AACF;AACA;EACE,MAAMI,eAAe,GACnBX,IAAgC,IACO;IACvC,MAAMY,KAAK,GAAGnB,cAAc,CAACoB,IAAI,CAAEd,CAAC,IAAK,IAAAe,mBAAW,EAACf,CAAC,CAACC,IAAI,EAAEA,IAAI,CAAC,CAAC;IACnE,IAAI,CAACY,KAAK,EAAE,OAAOrB,SAAS;IAE5B,MAAMwB,OAA+B,GAAG,CAAC,CAAC;IAC1C,KAAK,MAAMC,KAAK,IAAIJ,KAAK,CAACK,OAAO,EAAE;MACjCF,OAAO,CAACC,KAAK,CAACE,MAAM,CAAC,GAAGF,KAAK,CAACG,IAAI;IACpC;IACA,OAAOJ,OAAO;EAChB,CAAC;;EAED;AACF;AACA;EACE,MAAMK,YAAY,GAAGA,CACnBC,WAAoB,EACpBC,WAAuC,KAC3B;IACZ;IACA,IAAIC,KAAK,CAACC,OAAO,CAACH,WAAW,CAAC,EAAE;MAC9B,OAAOA,WAAW,CAACvB,GAAG,CAAE2B,IAAI,IAC1BL,YAAY,CAACK,IAAI,EAAE,CAAC,GAAGH,WAAW,EAAE,IAAI,CAAC,CAC3C,CAAC;IACH;;IAEA;IACA,IAAI,OAAOD,WAAW,KAAK,QAAQ,IAAIA,WAAW,KAAK,IAAI,EAAE;MAC3D,OAAOA,WAAW;IACpB;IAEA,MAAMK,OAAO,GAAGL,WAAsC;IACtD,MAAMM,MAAwB,GAAG,CAAC,CAAC;IACnC,MAAMC,aAAa,GAAG,IAAI/B,GAAG,CAAkB,CAAC;;IAEhD;IACA,MAAMgC,qBAA0C,GAAG,EAAE;IACrD,KAAK,MAAMC,KAAK,IAAIrC,cAAc,EAAE;MAClC;MACA,IAAI,IAAAsC,kBAAU,EAACT,WAAW,EAAEQ,KAAK,CAAC9B,IAAI,CAAC,EAAE;QACvC,MAAMgC,QAAQ,GAAGF,KAAK,CAAC9B,IAAI,CAACsB,WAAW,CAAChC,MAAM,CAAC;QAC/C,IACE,CAAC,OAAO0C,QAAQ,KAAK,QAAQ,IAAI,OAAOA,QAAQ,KAAK,QAAQ,KAC7D,CAACH,qBAAqB,CAACI,QAAQ,CAACD,QAAQ,CAAC,EACzC;UACAH,qBAAqB,CAACzB,IAAI,CAAC4B,QAAQ,CAAC;QACtC;MACF;IACF;;IAEA;IACA,KAAK,MAAME,GAAG,IAAIL,qBAAqB,EAAE;MACvC,MAAMM,SAAS,GAAGD,GAAG,CAACE,QAAQ,CAAC,CAAC;MAChC,MAAMC,SAAS,GAAGX,OAAO,CAACS,SAAS,CAAC;MACpC,IAAIE,SAAS,KAAK9C,SAAS,EAAE;MAE7B,MAAM+C,OAAO,GAAG,CAAC,GAAGhB,WAAW,EAAEY,GAAG,CAAC;MAErC,IAAIK,cAAc,GAAG5B,eAAe,CAAC2B,OAAO,CAAC;;MAE7C;MACA,IAAI,CAACC,cAAc,IAAIhB,KAAK,CAACC,OAAO,CAACa,SAAS,CAAC,EAAE;QAC/CE,cAAc,GAAG5B,eAAe,CAAC,CAAC,GAAG2B,OAAO,EAAE,IAAI,CAAC,CAAC;MACtD;MAEAX,MAAM,CAACQ,SAAS,CAAC,GAAG;QAClBhB,IAAI,EAAEoB,cAAc,IAAIJ,SAAS;QACjCK,KAAK,EAAEpB,YAAY,CAACiB,SAAS,EAAEC,OAAO;MACxC,CAAC;MAEDV,aAAa,CAACa,GAAG,CAACP,GAAG,CAAC;IACxB;;IAEA;IACA,IAAI1C,0BAA0B,EAAE;MAC9B,KAAK,MAAM,CAAC0C,GAAG,EAAEM,KAAK,CAAC,IAAIhC,MAAM,CAACkC,OAAO,CAAChB,OAAO,CAAC,EAAE;QAClD,IAAI,CAACE,aAAa,CAACe,GAAG,CAACT,GAAG,CAAC,EAAE;UAC3BP,MAAM,CAACO,GAAG,CAAC,GAAG;YACZf,IAAI,EAAEe,GAAG;YACTM,KAAK,EAAEA;UACT,CAAC;QACH;MACF;IACF;IAEA,OAAOb,MAAM;EACf,CAAC;EAED,OAAOP,YAAY,CAACjC,mBAAmB,EAAE,EAAE,CAAC;AAC9C,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeyD,qBAAqBA,CAClCC,aAAqB,EACrBC,UAAiB,EACjBC,oBAAmC,EACnB;EAChB,MAAM;IAAEC;EAAgB,CAAC,GAAG,IAAAC,wBAAM,EAACJ,aAAa,CAAC;EACjD,MAAMK,WAAW,GAAG,IAAAC,kCAAgB,EAACH,eAAe,EAAEF,UAAU,CAAC;EAEjE,MAAMM,aAAa,GAAG,IAAIC,mBAAa,CAAC;IACtCC,MAAM,EAAEC,oBAAM;IACdC,QAAQ,EAAE,MAAMC,mBAAK,CAACC,WAAW,CAACR,WAAW;EAC/C,CAAC,CAAC;EAEF,MAAM,CAACS,kBAAkB,EAAEC,gBAAgB,CAAC,GAAG,MAAMC,OAAO,CAACC,GAAG,CAAC,CAC/DV,aAAa,CAACW,MAAM,CAAClB,aAAa,CAAC,EACnCE,oBAAoB,CAACiB,YAAY,CAAC,CAAC,CACpC,CAAC;EAEF,MAAM;IAAEC;EAAI,CAAC,GAAGN,kBAAkB,CAACO,OAAkC;EACrE,IAAI,EAAE,MAAM,IAAAC,qBAAgB,EAACF,GAAG,CAACG,GAAG,EAAER,gBAAuB,CAAC,CAAC,EAAE;IAC/D,MAAMS,OAAO,GAAI,kDAAiDT,gBAAgB,CAACU,GAAI,UAASL,GAAG,CAACG,GAAG,CAACE,GAAI,EAAC;IAC7GC,eAAM,CAACC,GAAG,CAACC,iBAAQ,CAACC,KAAK,EAAEL,OAAO,CAAC;IACnC,MAAM,IAAI3D,qBAAa,CAAC2D,OAAO,CAAC;EAClC;EAEA,OAAO,MAAMjB,aAAa,CAACH,MAAM,CAAC,IAAA0B,qCAAwB,EAAC9B,aAAa,CAAC,CAAC;AAC5E;AAEO,MAAM+B,6BAAsE,GACjF,MAAAA,CACEC,UAAU,EACVC,UAAU,EACVC,yBAAyB,EAAAC,IAAA,KAMtB;EAAA,IALH;IACEC,uBAAuB;IACvB7F,uBAAuB;IACvBI;EACF,CAAC,GAAAwF,IAAA;EAED,MAAME,OAAO,GAAG,MAAMtC,qBAAqB,CACzCkC,UAAU,EACVD,UAAU,CAACpE,IAAI,EACfwE,uBACF,CAAC;EAEDV,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,uBAAsBC,IAAI,CAACC,SAAS,CAACH,OAAO,CAAE,EACjD,CAAC;EAED,MAAMhG,gBAAgB,GACpB2F,UAAU,CAACS,mCAAmC,CAACP,yBAAyB,CAAC;EAE3E,IAAI,CAAC7F,gBAAgB,EAAE;IACrBqF,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,gDAA+CK,yBAA0B,EAC5E,CAAC;IACD,MAAM,IAAIrE,qBAAa,CAAC,6CAA6C,CAAC;EACxE;EAEA,MAAMvB,mBAAmB,GAAI,MAAM+F,OAAO,CAACK,SAAS,CAAChC,oBAAM,CAG1D;EAED,MAAMiC,gBAAgB,GAAGvG,oBAAoB,CAC3CC,gBAAgB,EAChBC,mBAAmB,EACnBC,uBAAuB,EACvBI,0BACF,CAAC;EAED,MAAMiG,QAAQ,GACZ,OAAOtG,mBAAmB,CAACuG,GAAG,KAAK,QAAQ,GACvC,IAAIC,IAAI,CAACxG,mBAAmB,CAACuG,GAAG,GAAG,IAAI,CAAC,GACxCnG,SAAS;EAEf,IAAI,OAAOJ,mBAAmB,CAACyG,GAAG,KAAK,QAAQ,EAAE;IAC/C,MAAM,IAAIlF,qBAAa,CAAC,2CAA2C,CAAC;EACtE;EACA,MAAMmF,UAAU,GAAG,IAAIF,IAAI,CAACxG,mBAAmB,CAACyG,GAAG,GAAG,IAAI,CAAC;EAE3DrB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,sBAAqBC,IAAI,CAACC,SAAS,CAACG,gBAAgB,CAAE,gBAAeC,QAAS,EACjF,CAAC;EAED,OAAO;IACLD,gBAAgB;IAChBK,UAAU;IACVJ;EACF,CAAC;AACH,CAAC;AAACK,OAAA,CAAAlB,6BAAA,GAAAA,6BAAA"}
+{"version":3,"names":["_ioReactNativeJwt","require","_core","_cryptoNodejs","_parser","_errors","_logging","_jwk","_credentials","_x","_errors2","parseCredentialSdJwt","credentialConfig","parsedCredentialRaw","ignoreMissingAttributes","arguments","length","undefined","includeUndefinedAttributes","claimsMetadata","claims","missingPaths","rootKeysToVerify","Set","map","c","path","filter","p","rootKey","push","missing","join","received","Object","keys","IoWalletError","getDisplayNames","match","find","isPathEqual","nameMap","entry","display","locale","name","processLevel","currentData","currentPath","Array","isArray","item","dataObj","result","processedKeys","configKeysAtThisLevel","claim","isPrefixOf","nextPart","includes","key","stringKey","toString","dataValue","newPath","localizedNames","value","add","entries","has","sdJwtInstanceVerifier","data","signature","options","issuerKeys","verifyJwt","verifyCredentialSdJwt","rawCredential","holderBindingContext","sdJwtInstance","SDJwtInstance","hasher","digest","verifier","verifiedCredential","holderBindingKey","Promise","all","verify","getPublicKey","cnf","payload","isSameThumbprint","jwk","message","kid","Logger","log","LogLevel","ERROR","decode","fixLegacyCredentialSdJwt","verifyAndParseCredentialSdJwt","issuerConf","credential","credentialConfigurationId","_ref","x509CertRoot","credentialCryptoContext","validateCertificateChain","decoded","DEBUG","JSON","stringify","_decoded$jwt","x5c","jwt","header","MissingX509CertsError","verifyX509Chain","credential_configurations_supported","getClaims","parsedCredential","issuedAt","iat","Date","exp","expiration","exports"],"sourceRoot":"../../../../../src","sources":["credential/issuance/common/06-verify-and-parse-credential.sdjwt.ts"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AAIA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,aAAA,GAAAF,OAAA;AAEA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,OAAA,GAAAJ,OAAA;AACA,IAAAK,QAAA,GAAAL,OAAA;AACA,IAAAM,IAAA,GAAAN,OAAA;AAEA,IAAAO,YAAA,GAAAP,OAAA;AACA,IAAAQ,EAAA,GAAAR,OAAA;AACA,IAAAS,QAAA,GAAAT,OAAA;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMU,oBAAoB,GAAG,SAAAA,CAC3BC,gBAAgC,EAChCC,mBAA4C,EAGvB;EAAA,IAFrBC,uBAAgC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,KAAK;EAAA,IACxCG,0BAAmC,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,KAAK;EAE3C,MAAMI,cAAc,GAAGP,gBAAgB,CAACQ,MAAM,IAAI,EAAE;;EAEpD;EACA,IAAI,CAACN,uBAAuB,EAAE;IAC5B,MAAMO,YAAsB,GAAG,EAAE;IACjC,MAAMC,gBAAgB,GAAG,IAAIC,GAAG,CAC9BJ,cAAc,CACXK,GAAG,CAAEC,CAAC,IAAKA,CAAC,CAACC,IAAI,CAAC,CAAC,CAAC,CAAC,CACrBC,MAAM,CAAEC,CAAC,IAAkB,OAAOA,CAAC,KAAK,QAAQ,CACrD,CAAC;IAED,KAAK,MAAMC,OAAO,IAAIP,gBAAgB,EAAE;MACtC,IAAI,EAAEO,OAAO,IAAIhB,mBAAmB,CAAC,EAAE;QACrCQ,YAAY,CAACS,IAAI,CAACD,OAAO,CAAC;MAC5B;IACF;IAEA,IAAIR,YAAY,CAACL,MAAM,GAAG,CAAC,EAAE;MAC3B,MAAMe,OAAO,GAAGV,YAAY,CAACW,IAAI,CAAC,IAAI,CAAC;MACvC,MAAMC,QAAQ,GAAGC,MAAM,CAACC,IAAI,CAACtB,mBAAmB,CAAC,CAACmB,IAAI,CAAC,IAAI,CAAC;MAC5D,MAAM,IAAII,qBAAa,CACpB,4DAA2DL,OAAQ,iBAAgBE,QAAS,GAC/F,CAAC;IACH;EACF;;EAEA;AACF;AACA;EACE,MAAMI,eAAe,GACnBX,IAAgC,IACO;IACvC,MAAMY,KAAK,GAAGnB,cAAc,CAACoB,IAAI,CAAEd,CAAC,IAAK,IAAAe,mBAAW,EAACf,CAAC,CAACC,IAAI,EAAEA,IAAI,CAAC,CAAC;IACnE,IAAI,CAACY,KAAK,EAAE,OAAOrB,SAAS;IAE5B,MAAMwB,OAA+B,GAAG,CAAC,CAAC;IAC1C,KAAK,MAAMC,KAAK,IAAIJ,KAAK,CAACK,OAAO,EAAE;MACjCF,OAAO,CAACC,KAAK,CAACE,MAAM,CAAC,GAAGF,KAAK,CAACG,IAAI;IACpC;IACA,OAAOJ,OAAO;EAChB,CAAC;;EAED;AACF;AACA;EACE,MAAMK,YAAY,GAAGA,CACnBC,WAAoB,EACpBC,WAAuC,KAC3B;IACZ;IACA,IAAIC,KAAK,CAACC,OAAO,CAACH,WAAW,CAAC,EAAE;MAC9B,OAAOA,WAAW,CAACvB,GAAG,CAAE2B,IAAI,IAC1BL,YAAY,CAACK,IAAI,EAAE,CAAC,GAAGH,WAAW,EAAE,IAAI,CAAC,CAC3C,CAAC;IACH;;IAEA;IACA,IAAI,OAAOD,WAAW,KAAK,QAAQ,IAAIA,WAAW,KAAK,IAAI,EAAE;MAC3D,OAAOA,WAAW;IACpB;IAEA,MAAMK,OAAO,GAAGL,WAAsC;IACtD,MAAMM,MAAwB,GAAG,CAAC,CAAC;IACnC,MAAMC,aAAa,GAAG,IAAI/B,GAAG,CAAkB,CAAC;;IAEhD;IACA,MAAMgC,qBAA0C,GAAG,EAAE;IACrD,KAAK,MAAMC,KAAK,IAAIrC,cAAc,EAAE;MAClC;MACA,IAAI,IAAAsC,kBAAU,EAACT,WAAW,EAAEQ,KAAK,CAAC9B,IAAI,CAAC,EAAE;QACvC,MAAMgC,QAAQ,GAAGF,KAAK,CAAC9B,IAAI,CAACsB,WAAW,CAAChC,MAAM,CAAC;QAC/C,IACE,CAAC,OAAO0C,QAAQ,KAAK,QAAQ,IAAI,OAAOA,QAAQ,KAAK,QAAQ,KAC7D,CAACH,qBAAqB,CAACI,QAAQ,CAACD,QAAQ,CAAC,EACzC;UACAH,qBAAqB,CAACzB,IAAI,CAAC4B,QAAQ,CAAC;QACtC;MACF;IACF;;IAEA;IACA,KAAK,MAAME,GAAG,IAAIL,qBAAqB,EAAE;MACvC,MAAMM,SAAS,GAAGD,GAAG,CAACE,QAAQ,CAAC,CAAC;MAChC,MAAMC,SAAS,GAAGX,OAAO,CAACS,SAAS,CAAC;MACpC,IAAIE,SAAS,KAAK9C,SAAS,EAAE;MAE7B,MAAM+C,OAAO,GAAG,CAAC,GAAGhB,WAAW,EAAEY,GAAG,CAAC;MAErC,IAAIK,cAAc,GAAG5B,eAAe,CAAC2B,OAAO,CAAC;;MAE7C;MACA,IAAI,CAACC,cAAc,IAAIhB,KAAK,CAACC,OAAO,CAACa,SAAS,CAAC,EAAE;QAC/CE,cAAc,GAAG5B,eAAe,CAAC,CAAC,GAAG2B,OAAO,EAAE,IAAI,CAAC,CAAC;MACtD;MAEAX,MAAM,CAACQ,SAAS,CAAC,GAAG;QAClBhB,IAAI,EAAEoB,cAAc,IAAIJ,SAAS;QACjCK,KAAK,EAAEpB,YAAY,CAACiB,SAAS,EAAEC,OAAO;MACxC,CAAC;MAEDV,aAAa,CAACa,GAAG,CAACP,GAAG,CAAC;IACxB;;IAEA;IACA,IAAI1C,0BAA0B,EAAE;MAC9B,KAAK,MAAM,CAAC0C,GAAG,EAAEM,KAAK,CAAC,IAAIhC,MAAM,CAACkC,OAAO,CAAChB,OAAO,CAAC,EAAE;QAClD,IAAI,CAACE,aAAa,CAACe,GAAG,CAACT,GAAG,CAAC,EAAE;UAC3BP,MAAM,CAACO,GAAG,CAAC,GAAG;YACZf,IAAI,EAAEe,GAAG;YACTM,KAAK,EAAEA;UACT,CAAC;QACH;MACF;IACF;IAEA,OAAOb,MAAM;EACf,CAAC;EAED,OAAOP,YAAY,CAACjC,mBAAmB,EAAE,EAAE,CAAC;AAC9C,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA,MAAMyD,qBAAsD,GAAG,MAAAA,CAC7DC,IAAI,EACJC,SAAS,EACTC,OAAO,KACJ;EACH,IAAI,EAACA,OAAO,aAAPA,OAAO,eAAPA,OAAO,CAAEC,UAAU,GAAE;IACxB,OAAO,KAAK;EACd;EACA,IAAI;IACF,MAAM,IAAAC,wBAAS,EAAE,GAAEJ,IAAK,IAAGC,SAAU,EAAC,EAAEC,OAAO,CAACC,UAAU,CAAC;IAC3D,OAAO,IAAI;EACb,CAAC,CAAC,MAAM;IACN,OAAO,KAAK;EACd;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeE,qBAAqBA,CAClCC,aAAqB,EACrBH,UAAiB,EACjBI,oBAAmC,EACnB;EAChB,MAAMC,aAAa,GAAG,IAAIC,mBAAa,CAAC;IACtCC,MAAM,EAAEC,oBAAM;IACdC,QAAQ,EAAEb;EACZ,CAAC,CAAC;EAEF,MAAM,CAACc,kBAAkB,EAAEC,gBAAgB,CAAC,GAAG,MAAMC,OAAO,CAACC,GAAG,CAAC,CAC/DR,aAAa,CAACS,MAAM,CAACX,aAAa,EAAE;IAAEH;EAAW,CAAC,CAAC,EACnDI,oBAAoB,CAACW,YAAY,CAAC,CAAC,CACpC,CAAC;EAEF,MAAM;IAAEC;EAAI,CAAC,GAAGN,kBAAkB,CAACO,OAAkC;EACrE,IAAI,EAAE,MAAM,IAAAC,qBAAgB,EAACF,GAAG,CAACG,GAAG,EAAER,gBAAuB,CAAC,CAAC,EAAE;IAC/D,MAAMS,OAAO,GAAI,kDAAiDT,gBAAgB,CAACU,GAAI,UAASL,GAAG,CAACG,GAAG,CAACE,GAAI,EAAC;IAC7GC,eAAM,CAACC,GAAG,CAACC,iBAAQ,CAACC,KAAK,EAAEL,OAAO,CAAC;IACnC,MAAM,IAAI1D,qBAAa,CAAC0D,OAAO,CAAC;EAClC;EAEA,OAAO,MAAMf,aAAa,CAACqB,MAAM,CAAC,IAAAC,qCAAwB,EAACxB,aAAa,CAAC,CAAC;AAC5E;AAEO,MAAMyB,6BAAsE,GACjF,MAAAA,CACEC,UAAU,EACVC,UAAU,EACVC,yBAAyB,EAAAC,IAAA,EAOzBC,YAAY,KACT;EAAA,IAPH;IACEC,uBAAuB;IACvB9F,uBAAuB;IACvBI,0BAA0B;IAC1B2F;EACF,CAAC,GAAAH,IAAA;EAGD,MAAMI,OAAO,GAAG,MAAMlC,qBAAqB,CACzC4B,UAAU,EACVD,UAAU,CAACpE,IAAI,EACfyE,uBACF,CAAC;EAEDZ,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACa,KAAK,EACb,uBAAsBC,IAAI,CAACC,SAAS,CAACH,OAAO,CAAE,EACjD,CAAC;EAED,IAAID,wBAAwB,EAAE;IAAA,IAAAK,YAAA;IAC5B,IAAI,CAACP,YAAY,EAAE;MACjB,MAAM,IAAIvE,qBAAa,CAAC,sBAAsB,CAAC;IACjD;IACA,MAAM+E,GAAG,IAAAD,YAAA,GAAGJ,OAAO,CAACM,GAAG,cAAAF,YAAA,gBAAAA,YAAA,GAAXA,YAAA,CAAaG,MAAM,cAAAH,YAAA,uBAAnBA,YAAA,CAAqBC,GAA2B;IAC5D,IAAI,CAACA,GAAG,IAAI,CAAClE,KAAK,CAACC,OAAO,CAACiE,GAAG,CAAC,IAAIA,GAAG,CAACnG,MAAM,KAAK,CAAC,EAAE;MACnD,MAAM,IAAIsG,8BAAqB,CAAC,2BAA2B,CAAC;IAC9D;IACA,MAAM,IAAAC,kBAAe,EAACJ,GAAG,EAAER,YAAY,CAAC;EAC1C;EAEA,MAAM/F,gBAAgB,GACpB2F,UAAU,CAACiB,mCAAmC,CAACf,yBAAyB,CAAC;EAE3E,IAAI,CAAC7F,gBAAgB,EAAE;IACrBoF,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,gDAA+CM,yBAA0B,EAC5E,CAAC;IACD,MAAM,IAAIrE,qBAAa,CAAC,6CAA6C,CAAC;EACxE;EAEA,MAAMvB,mBAAmB,GAAI,MAAMiG,OAAO,CAACW,SAAS,CAACvC,oBAAM,CAG1D;EAED,MAAMwC,gBAAgB,GAAG/G,oBAAoB,CAC3CC,gBAAgB,EAChBC,mBAAmB,EACnBC,uBAAuB,EACvBI,0BACF,CAAC;EAED,MAAMyG,QAAQ,GACZ,OAAO9G,mBAAmB,CAAC+G,GAAG,KAAK,QAAQ,GACvC,IAAIC,IAAI,CAAChH,mBAAmB,CAAC+G,GAAG,GAAG,IAAI,CAAC,GACxC3G,SAAS;EAEf,IAAI,OAAOJ,mBAAmB,CAACiH,GAAG,KAAK,QAAQ,EAAE;IAC/C,MAAM,IAAI1F,qBAAa,CAAC,2CAA2C,CAAC;EACtE;EACA,MAAM2F,UAAU,GAAG,IAAIF,IAAI,CAAChH,mBAAmB,CAACiH,GAAG,GAAG,IAAI,CAAC;EAE3D9B,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACa,KAAK,EACb,sBAAqBC,IAAI,CAACC,SAAS,CAACS,gBAAgB,CAAE,gBAAeC,QAAS,EACjF,CAAC;EAED,OAAO;IACLD,gBAAgB;IAChBK,UAAU;IACVJ;EACF,CAAC;AACH,CAAC;AAACK,OAAA,CAAA1B,6BAAA,GAAAA,6BAAA"}

package/lib/commonjs/credential/issuance/mrtd-pop/02-init-challenge.js

@@ -3,50 +3,58 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.initChallenge = void 0;
-var _uuid = require("uuid");
+exports.createInitChallenge = createInitChallenge;
 var _ioWalletOauth = require("@pagopa/io-wallet-oauth2");
 var _ioWalletUtils = require("@pagopa/io-wallet-utils");
-var _pop = require("../../../utils/pop");
 var _logging = require("../../../utils/logging");
-var WalletInstanceAttestation = _interopRequireWildcard(require("../../../wallet-instance-attestation/v1.0.0/utils"));
 var _errors = require("../../../utils/errors");
 var _callbacks = require("../../../utils/callbacks");
-function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
-function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
-// TODO: decouple from version 1.0.0
-
-const initChallenge = async (issuerConf, initUrl, mrtd_auth_session, mrtd_pop_jwt_nonce, context) => {
-  const {
-    appFetch = fetch,
-    walletInstanceAttestation,
-    wiaCryptoContext
-  } = context;
-  const iss = WalletInstanceAttestation.decode(walletInstanceAttestation).payload.cnf.jwk.kid;
-  const signedWiaPoP = await (0, _pop.createPopToken)({
-    jti: (0, _uuid.v4)(),
-    aud: issuerConf.credential_issuer,
-    iss
-  }, wiaCryptoContext);
-  const initResult = await (0, _ioWalletOauth.fetchMrtdPopInit)({
-    popInitEndpoint: initUrl,
-    mrtdAuthSession: mrtd_auth_session,
-    mrtdPopJwtNonce: mrtd_pop_jwt_nonce,
-    walletAttestation: walletInstanceAttestation,
-    clientAttestationDPoP: signedWiaPoP,
-    callbacks: {
-      verifyJwt: (0, _callbacks.createVerifyJwtFromJwks)(issuerConf.keys),
-      fetch: appFetch
-    }
-  }).catch(handleInitChallengeError);
-  return {
-    challenge: initResult.challenge,
-    mrtd_pop_nonce: initResult.mrtdPopNonce,
-    pop_verify_endpoint: initResult.popVerifyEndpoint,
-    mrz: initResult.mrz
+/**
+ * Factory function to create `initChallenge` for MRTD PoP flow.
+ * The factory is needed to inject version specific SDK configuration.
+ * @param config Configuration object containing the IO Wallet SDK configuration
+ * @returns `initChallenge` function compliant with the public API
+ */
+function createInitChallenge(config) {
+  return async function initChallenge(issuerConf, initUrl, mrtd_auth_session, mrtd_pop_jwt_nonce, context) {
+    const {
+      appFetch = fetch,
+      walletInstanceAttestation,
+      wiaCryptoContext
+    } = context;
+    const clientAttestationDPoP = await (0, _ioWalletOauth.createClientAttestationPopJwt)({
+      config: config.sdkConfig,
+      callbacks: {
+        generateRandom: _callbacks.partialCallbacks.generateRandom,
+        signJwt: (0, _callbacks.createSignJwtFromCryptoContext)(wiaCryptoContext)
+      },
+      clientAttestation: walletInstanceAttestation,
+      authorizationServer: issuerConf.credential_issuer,
+      signer: {
+        method: "jwk",
+        alg: "ES256",
+        publicJwk: await wiaCryptoContext.getPublicKey()
+      }
+    });
+    const initResult = await (0, _ioWalletOauth.fetchMrtdPopInit)({
+      popInitEndpoint: initUrl,
+      mrtdAuthSession: mrtd_auth_session,
+      mrtdPopJwtNonce: mrtd_pop_jwt_nonce,
+      walletAttestation: walletInstanceAttestation,
+      clientAttestationDPoP,
+      callbacks: {
+        verifyJwt: (0, _callbacks.createVerifyJwtFromJwks)(issuerConf.keys),
+        fetch: appFetch
+      }
+    }).catch(handleInitChallengeError);
+    return {
+      challenge: initResult.challenge,
+      mrtd_pop_nonce: initResult.mrtdPopNonce,
+      pop_verify_endpoint: initResult.popVerifyEndpoint,
+      mrz: initResult.mrz
+    };
   };
-};
-exports.initChallenge = initChallenge;
+}
 const handleInitChallengeError = e => {
   _logging.Logger.log(_logging.LogLevel.ERROR, `Failed to get MRTD challenge: ${e}`);
   if (!(e instanceof _ioWalletUtils.UnexpectedStatusCodeError)) {

package/lib/commonjs/credential/issuance/mrtd-pop/02-init-challenge.js.map

@@ -1 +1 @@
-{"version":3,"names":["_uuid","require","_ioWalletOauth","_ioWalletUtils","_pop","_logging","WalletInstanceAttestation","_interopRequireWildcard","_errors","_callbacks","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","initChallenge","issuerConf","initUrl","mrtd_auth_session","mrtd_pop_jwt_nonce","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","iss","decode","payload","cnf","jwk","kid","signedWiaPoP","createPopToken","jti","uuidv4","aud","credential_issuer","initResult","fetchMrtdPopInit","popInitEndpoint","mrtdAuthSession","mrtdPopJwtNonce","walletAttestation","clientAttestationDPoP","callbacks","verifyJwt","createVerifyJwtFromJwks","keys","catch","handleInitChallengeError","challenge","mrtd_pop_nonce","mrtdPopNonce","pop_verify_endpoint","popVerifyEndpoint","mrz","exports","e","Logger","log","LogLevel","ERROR","SdkUnexpectedStatusCodeError","ResponseErrorBuilder","IssuerResponseError","handle","code","IssuerResponseErrorCodes","MrtdChallengeInitRequestFailed","message","buildFrom"],"sourceRoot":"../../../../../src","sources":["credential/issuance/mrtd-pop/02-init-challenge.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,cAAA,GAAAD,OAAA;AACA,IAAAE,cAAA,GAAAF,OAAA;AACA,IAAAG,IAAA,GAAAH,OAAA;AACA,IAAAI,QAAA,GAAAJ,OAAA;AACA,IAAAK,yBAAA,GAAAC,uBAAA,CAAAN,OAAA;AACA,IAAAO,OAAA,GAAAP,OAAA;AAMA,IAAAQ,UAAA,GAAAR,OAAA;AAAmE,SAAAS,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAJ,wBAAAQ,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAP6B;;AASzF,MAAMW,aAA0C,GAAG,MAAAA,CACxDC,UAAU,EACVC,OAAO,EACPC,iBAAiB,EACjBC,kBAAkB,EAClBC,OAAO,KACJ;EACH,MAAM;IACJC,QAAQ,GAAGC,KAAK;IAChBC,yBAAyB;IACzBC;EACF,CAAC,GAAGJ,OAAO;EAEX,MAAMK,GAAG,GAAGpC,yBAAyB,CAACqC,MAAM,CAACH,yBAAyB,CAAC,CACpEI,OAAO,CAACC,GAAG,CAACC,GAAG,CAACC,GAAG;EAEtB,MAAMC,YAAY,GAAG,MAAM,IAAAC,mBAAc,EACvC;IACEC,GAAG,EAAE,IAAAC,QAAM,EAAC,CAAC;IACbC,GAAG,EAAEnB,UAAU,CAACoB,iBAAiB;IACjCX;EACF,CAAC,EACDD,gBACF,CAAC;EAED,MAAMa,UAAU,GAAG,MAAM,IAAAC,+BAAgB,EAAC;IACxCC,eAAe,EAAEtB,OAAO;IACxBuB,eAAe,EAAEtB,iBAAiB;IAClCuB,eAAe,EAAEtB,kBAAkB;IACnCuB,iBAAiB,EAAEnB,yBAAyB;IAC5CoB,qBAAqB,EAAEZ,YAAY;IACnCa,SAAS,EAAE;MACTC,SAAS,EAAE,IAAAC,kCAAuB,EAAC9B,UAAU,CAAC+B,IAAI,CAAC;MACnDzB,KAAK,EAAED;IACT;EACF,CAAC,CAAC,CAAC2B,KAAK,CAACC,wBAAwB,CAAC;EAElC,OAAO;IACLC,SAAS,EAAEb,UAAU,CAACa,SAAS;IAC/BC,cAAc,EAAEd,UAAU,CAACe,YAAY;IACvCC,mBAAmB,EAAEhB,UAAU,CAACiB,iBAAiB;IACjDC,GAAG,EAAElB,UAAU,CAACkB;EAClB,CAAC;AACH,CAAC;AAACC,OAAA,CAAAzC,aAAA,GAAAA,aAAA;AAEF,MAAMkC,wBAAwB,GAAIQ,CAAU,IAAK;EAC/CC,eAAM,CAACC,GAAG,CAACC,iBAAQ,CAACC,KAAK,EAAG,iCAAgCJ,CAAE,EAAC,CAAC;EAEhE,IAAI,EAAEA,CAAC,YAAYK,wCAA4B,CAAC,EAAE;IAChD,MAAML,CAAC;EACT;EAEA,MAAM,IAAIM,4BAAoB,CAACC,2BAAmB,CAAC,CAChDC,MAAM,CAAC,GAAG,EAAE;IACXC,IAAI,EAAEC,gCAAwB,CAACC,8BAA8B;IAC7DC,OAAO,EAAE;EACX,CAAC,CAAC,CACDC,SAAS,CAACb,CAAC,CAAC;AACjB,CAAC"}
+{"version":3,"names":["_ioWalletOauth","require","_ioWalletUtils","_logging","_errors","_callbacks","createInitChallenge","config","initChallenge","issuerConf","initUrl","mrtd_auth_session","mrtd_pop_jwt_nonce","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","clientAttestationDPoP","createClientAttestationPopJwt","sdkConfig","callbacks","generateRandom","partialCallbacks","signJwt","createSignJwtFromCryptoContext","clientAttestation","authorizationServer","credential_issuer","signer","method","alg","publicJwk","getPublicKey","initResult","fetchMrtdPopInit","popInitEndpoint","mrtdAuthSession","mrtdPopJwtNonce","walletAttestation","verifyJwt","createVerifyJwtFromJwks","keys","catch","handleInitChallengeError","challenge","mrtd_pop_nonce","mrtdPopNonce","pop_verify_endpoint","popVerifyEndpoint","mrz","e","Logger","log","LogLevel","ERROR","SdkUnexpectedStatusCodeError","ResponseErrorBuilder","IssuerResponseError","handle","code","IssuerResponseErrorCodes","MrtdChallengeInitRequestFailed","message","buildFrom"],"sourceRoot":"../../../../../src","sources":["credential/issuance/mrtd-pop/02-init-challenge.ts"],"mappings":";;;;;;AAAA,IAAAA,cAAA,GAAAC,OAAA;AAIA,IAAAC,cAAA,GAAAD,OAAA;AAIA,IAAAE,QAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AAMA,IAAAI,UAAA,GAAAJ,OAAA;AAUA;AACA;AACA;AACA;AACA;AACA;AACO,SAASK,mBAAmBA,CACjCC,MAAc,EACe;EAC7B,OAAO,eAAeC,aAAaA,CACjCC,UAAU,EACVC,OAAO,EACPC,iBAAiB,EACjBC,kBAAkB,EAClBC,OAAO,EACP;IACA,MAAM;MACJC,QAAQ,GAAGC,KAAK;MAChBC,yBAAyB;MACzBC;IACF,CAAC,GAAGJ,OAAO;IAEX,MAAMK,qBAAqB,GAAG,MAAM,IAAAC,4CAA6B,EAAC;MAChEZ,MAAM,EAAEA,MAAM,CAACa,SAAS;MACxBC,SAAS,EAAE;QACTC,cAAc,EAAEC,2BAAgB,CAACD,cAAc;QAC/CE,OAAO,EAAE,IAAAC,yCAA8B,EAACR,gBAAgB;MAC1D,CAAC;MACDS,iBAAiB,EAAEV,yBAAyB;MAC5CW,mBAAmB,EAAElB,UAAU,CAACmB,iBAAiB;MACjDC,MAAM,EAAE;QACNC,MAAM,EAAE,KAAK;QACbC,GAAG,EAAE,OAAO;QACZC,SAAS,EAAE,MAAMf,gBAAgB,CAACgB,YAAY,CAAC;MACjD;IACF,CAAC,CAAC;IAEF,MAAMC,UAAU,GAAG,MAAM,IAAAC,+BAAgB,EAAC;MACxCC,eAAe,EAAE1B,OAAO;MACxB2B,eAAe,EAAE1B,iBAAiB;MAClC2B,eAAe,EAAE1B,kBAAkB;MACnC2B,iBAAiB,EAAEvB,yBAAyB;MAC5CE,qBAAqB;MACrBG,SAAS,EAAE;QACTmB,SAAS,EAAE,IAAAC,kCAAuB,EAAChC,UAAU,CAACiC,IAAI,CAAC;QACnD3B,KAAK,EAAED;MACT;IACF,CAAC,CAAC,CAAC6B,KAAK,CAACC,wBAAwB,CAAC;IAElC,OAAO;MACLC,SAAS,EAAEX,UAAU,CAACW,SAAS;MAC/BC,cAAc,EAAEZ,UAAU,CAACa,YAAY;MACvCC,mBAAmB,EAAEd,UAAU,CAACe,iBAAiB;MACjDC,GAAG,EAAEhB,UAAU,CAACgB;IAClB,CAAC;EACH,CAAC;AACH;AAEA,MAAMN,wBAAwB,GAAIO,CAAU,IAAK;EAC/CC,eAAM,CAACC,GAAG,CAACC,iBAAQ,CAACC,KAAK,EAAG,iCAAgCJ,CAAE,EAAC,CAAC;EAEhE,IAAI,EAAEA,CAAC,YAAYK,wCAA4B,CAAC,EAAE;IAChD,MAAML,CAAC;EACT;EAEA,MAAM,IAAIM,4BAAoB,CAACC,2BAAmB,CAAC,CAChDC,MAAM,CAAC,GAAG,EAAE;IACXC,IAAI,EAAEC,gCAAwB,CAACC,8BAA8B;IAC7DC,OAAO,EAAE;EACX,CAAC,CAAC,CACDC,SAAS,CAACb,CAAC,CAAC;AACjB,CAAC"}

package/lib/commonjs/credential/issuance/mrtd-pop/03-validate-challenge.js

@@ -3,62 +3,69 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.validateChallenge = exports.buildChallengeCallbackUrl = void 0;
+exports.buildChallengeCallbackUrl = void 0;
+exports.createValidateChallenge = createValidateChallenge;
 var _ioReactNativeJwt = require("@pagopa/io-react-native-jwt");
 var _ioWalletOauth = require("@pagopa/io-wallet-oauth2");
-var _uuid = require("uuid");
-var _pop = require("../../../utils/pop");
-var WalletInstanceAttestation = _interopRequireWildcard(require("../../../wallet-instance-attestation/v1.0.0/utils"));
 var _errors = require("../../../utils/errors");
 var _callbacks = require("../../../utils/callbacks");
-function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
-function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
-// TODO: decouple from 1.0.0 version
-
-const validateChallenge = async (issuerConf, verifyUrl, mrtd_auth_session, mrtd_pop_nonce, mrtd, ias, context) => {
-  const {
-    appFetch = fetch,
-    walletInstanceAttestation,
-    wiaCryptoContext
-  } = context;
-  const aud = issuerConf.credential_issuer;
-  const iss = WalletInstanceAttestation.decode(walletInstanceAttestation).payload.cnf.jwk.kid;
-  const signedWiaPoP = await (0, _pop.createPopToken)({
-    jti: (0, _uuid.v4)(),
-    aud,
-    iss
-  }, wiaCryptoContext);
-  const {
-    kid
-  } = await wiaCryptoContext.getPublicKey();
-  const mrtdValidationJwt = await new _ioReactNativeJwt.SignJWT(wiaCryptoContext).setProtectedHeader({
-    typ: "mrtd-ias+jwt",
-    kid
-  }).setPayload({
-    iss,
-    aud,
-    document_type: "cie",
-    mrtd,
-    ias
-  }).setIssuedAt().setExpirationTime("5m").sign();
-  const verifyResult = await (0, _ioWalletOauth.fetchMrtdPopVerify)({
-    popVerifyEndpoint: verifyUrl,
-    mrtdAuthSession: mrtd_auth_session,
-    mrtdPopNonce: mrtd_pop_nonce,
-    clientAttestationDPoP: signedWiaPoP,
-    mrtdValidationJwt,
-    walletAttestation: walletInstanceAttestation,
-    callbacks: {
-      fetch: appFetch,
-      ..._callbacks.partialCallbacks
-    }
-  }).catch(_errors.sdkUnexpectedStatusCodeToIssuerError);
-  return {
-    redirect_uri: verifyResult.redirectUri,
-    mrtd_val_pop_nonce: verifyResult.mrtdValPopNonce
+/**
+ * Factory function to create `validateChallenge` for MRTD PoP flow.
+ * The factory is needed to inject version specific SDK configuration.
+ * @param config Configuration object containing the IO Wallet SDK configuration
+ * @returns `validateChallenge` function compliant with the public API
+ */
+function createValidateChallenge(config) {
+  return async function validateChallenge(issuerConf, verifyUrl, mrtd_auth_session, mrtd_pop_nonce, mrtd, ias, context) {
+    const {
+      appFetch = fetch,
+      walletInstanceAttestation,
+      wiaCryptoContext
+    } = context;
+    const aud = issuerConf.credential_issuer;
+    const wiaPublicJwk = await wiaCryptoContext.getPublicKey();
+    const clientAttestationDPoP = await (0, _ioWalletOauth.createClientAttestationPopJwt)({
+      config: config.sdkConfig,
+      callbacks: {
+        generateRandom: _callbacks.partialCallbacks.generateRandom,
+        signJwt: (0, _callbacks.createSignJwtFromCryptoContext)(wiaCryptoContext)
+      },
+      clientAttestation: walletInstanceAttestation,
+      authorizationServer: aud,
+      signer: {
+        method: "jwk",
+        alg: "ES256",
+        publicJwk: wiaPublicJwk
+      }
+    });
+    const mrtdValidationJwt = await new _ioReactNativeJwt.SignJWT(wiaCryptoContext).setProtectedHeader({
+      typ: "mrtd-ias+jwt",
+      kid: wiaPublicJwk.kid
+    }).setPayload({
+      iss: wiaPublicJwk.kid,
+      aud,
+      document_type: "cie",
+      mrtd,
+      ias
+    }).setIssuedAt().setExpirationTime("5m").sign();
+    const verifyResult = await (0, _ioWalletOauth.fetchMrtdPopVerify)({
+      popVerifyEndpoint: verifyUrl,
+      mrtdAuthSession: mrtd_auth_session,
+      mrtdPopNonce: mrtd_pop_nonce,
+      clientAttestationDPoP,
+      mrtdValidationJwt,
+      walletAttestation: walletInstanceAttestation,
+      callbacks: {
+        fetch: appFetch,
+        ..._callbacks.partialCallbacks
+      }
+    }).catch(_errors.sdkUnexpectedStatusCodeToIssuerError);
+    return {
+      redirect_uri: verifyResult.redirectUri,
+      mrtd_val_pop_nonce: verifyResult.mrtdValPopNonce
+    };
   };
-};
-exports.validateChallenge = validateChallenge;
+}
 const buildChallengeCallbackUrl = async (redirectUri, valPopNonce, authSession) => {
   const params = new URLSearchParams({
     mrtd_val_pop_nonce: valPopNonce,

package/lib/commonjs/credential/issuance/mrtd-pop/03-validate-challenge.js.map

@@ -1 +1 @@
-{"version":3,"names":["_ioReactNativeJwt","require","_ioWalletOauth","_uuid","_pop","WalletInstanceAttestation","_interopRequireWildcard","_errors","_callbacks","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","validateChallenge","issuerConf","verifyUrl","mrtd_auth_session","mrtd_pop_nonce","mrtd","ias","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","aud","credential_issuer","iss","decode","payload","cnf","jwk","kid","signedWiaPoP","createPopToken","jti","uuidv4","getPublicKey","mrtdValidationJwt","SignJWT","setProtectedHeader","typ","setPayload","document_type","setIssuedAt","setExpirationTime","sign","verifyResult","fetchMrtdPopVerify","popVerifyEndpoint","mrtdAuthSession","mrtdPopNonce","clientAttestationDPoP","walletAttestation","callbacks","partialCallbacks","catch","sdkUnexpectedStatusCodeToIssuerError","redirect_uri","redirectUri","mrtd_val_pop_nonce","mrtdValPopNonce","exports","buildChallengeCallbackUrl","valPopNonce","authSession","params","URLSearchParams","callbackUrl"],"sourceRoot":"../../../../../src","sources":["credential/issuance/mrtd-pop/03-validate-challenge.ts"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AACA,IAAAC,cAAA,GAAAD,OAAA;AACA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,IAAA,GAAAH,OAAA;AACA,IAAAI,yBAAA,GAAAC,uBAAA,CAAAL,OAAA;AACA,IAAAM,OAAA,GAAAN,OAAA;AACA,IAAAO,UAAA,GAAAP,OAAA;AAA4D,SAAAQ,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAJ,wBAAAQ,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAFoC;;AAKzF,MAAMW,iBAAkD,GAAG,MAAAA,CAChEC,UAAU,EACVC,SAAS,EACTC,iBAAiB,EACjBC,cAAc,EACdC,IAAI,EACJC,GAAG,EACHC,OAAO,KACJ;EACH,MAAM;IACJC,QAAQ,GAAGC,KAAK;IAChBC,yBAAyB;IACzBC;EACF,CAAC,GAAGJ,OAAO;EAEX,MAAMK,GAAG,GAAGX,UAAU,CAACY,iBAAiB;EACxC,MAAMC,GAAG,GAAGxC,yBAAyB,CAACyC,MAAM,CAACL,yBAAyB,CAAC,CACpEM,OAAO,CAACC,GAAG,CAACC,GAAG,CAACC,GAAG;EAEtB,MAAMC,YAAY,GAAG,MAAM,IAAAC,mBAAc,EACvC;IACEC,GAAG,EAAE,IAAAC,QAAM,EAAC,CAAC;IACbX,GAAG;IACHE;EACF,CAAC,EACDH,gBACF,CAAC;EAED,MAAM;IAAEQ;EAAI,CAAC,GAAG,MAAMR,gBAAgB,CAACa,YAAY,CAAC,CAAC;EAErD,MAAMC,iBAAiB,GAAG,MAAM,IAAIC,yBAAO,CAACf,gBAAgB,CAAC,CAC1DgB,kBAAkB,CAAC;IAClBC,GAAG,EAAE,cAAc;IACnBT;EACF,CAAC,CAAC,CACDU,UAAU,CAAC;IACVf,GAAG;IACHF,GAAG;IACHkB,aAAa,EAAE,KAAK;IACpBzB,IAAI;IACJC;EACF,CAAC,CAAC,CACDyB,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,IAAI,CAAC,CACvBC,IAAI,CAAC,CAAC;EAET,MAAMC,YAAY,GAAG,MAAM,IAAAC,iCAAkB,EAAC;IAC5CC,iBAAiB,EAAElC,SAAS;IAC5BmC,eAAe,EAAElC,iBAAiB;IAClCmC,YAAY,EAAElC,cAAc;IAC5BmC,qBAAqB,EAAEnB,YAAY;IACnCK,iBAAiB;IACjBe,iBAAiB,EAAE9B,yBAAyB;IAC5C+B,SAAS,EAAE;MACThC,KAAK,EAAED,QAAQ;MACf,GAAGkC;IACL;EACF,CAAC,CAAC,CAACC,KAAK,CAACC,4CAAoC,CAAC;EAE9C,OAAO;IACLC,YAAY,EAAEX,YAAY,CAACY,WAAW;IACtCC,kBAAkB,EAAEb,YAAY,CAACc;EACnC,CAAC;AACH,CAAC;AAACC,OAAA,CAAAjD,iBAAA,GAAAA,iBAAA;AAEK,MAAMkD,yBAAkE,GAC7E,MAAAA,CAAOJ,WAAW,EAAEK,WAAW,EAAEC,WAAW,KAAK;EAC/C,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCP,kBAAkB,EAAEI,WAAW;IAC/BhD,iBAAiB,EAAEiD;EACrB,CAAC,CAAC;EAEF,MAAMG,WAAW,GAAI,GAAET,WAAY,IAAGO,MAAO,EAAC;EAC9C,OAAO;IAAEE;EAAY,CAAC;AACxB,CAAC;AAACN,OAAA,CAAAC,yBAAA,GAAAA,yBAAA"}
+{"version":3,"names":["_ioReactNativeJwt","require","_ioWalletOauth","_errors","_callbacks","createValidateChallenge","config","validateChallenge","issuerConf","verifyUrl","mrtd_auth_session","mrtd_pop_nonce","mrtd","ias","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","aud","credential_issuer","wiaPublicJwk","getPublicKey","clientAttestationDPoP","createClientAttestationPopJwt","sdkConfig","callbacks","generateRandom","partialCallbacks","signJwt","createSignJwtFromCryptoContext","clientAttestation","authorizationServer","signer","method","alg","publicJwk","mrtdValidationJwt","SignJWT","setProtectedHeader","typ","kid","setPayload","iss","document_type","setIssuedAt","setExpirationTime","sign","verifyResult","fetchMrtdPopVerify","popVerifyEndpoint","mrtdAuthSession","mrtdPopNonce","walletAttestation","catch","sdkUnexpectedStatusCodeToIssuerError","redirect_uri","redirectUri","mrtd_val_pop_nonce","mrtdValPopNonce","buildChallengeCallbackUrl","valPopNonce","authSession","params","URLSearchParams","callbackUrl","exports"],"sourceRoot":"../../../../../src","sources":["credential/issuance/mrtd-pop/03-validate-challenge.ts"],"mappings":";;;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AACA,IAAAC,cAAA,GAAAD,OAAA;AAKA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAH,OAAA;AAUA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,uBAAuBA,CACrCC,MAAc,EACmB;EACjC,OAAO,eAAeC,iBAAiBA,CACrCC,UAAU,EACVC,SAAS,EACTC,iBAAiB,EACjBC,cAAc,EACdC,IAAI,EACJC,GAAG,EACHC,OAAO,EACP;IACA,MAAM;MACJC,QAAQ,GAAGC,KAAK;MAChBC,yBAAyB;MACzBC;IACF,CAAC,GAAGJ,OAAO;IAEX,MAAMK,GAAG,GAAGX,UAAU,CAACY,iBAAiB;IAExC,MAAMC,YAAY,GAAG,MAAMH,gBAAgB,CAACI,YAAY,CAAC,CAAC;IAE1D,MAAMC,qBAAqB,GAAG,MAAM,IAAAC,4CAA6B,EAAC;MAChElB,MAAM,EAAEA,MAAM,CAACmB,SAAS;MACxBC,SAAS,EAAE;QACTC,cAAc,EAAEC,2BAAgB,CAACD,cAAc;QAC/CE,OAAO,EAAE,IAAAC,yCAA8B,EAACZ,gBAAgB;MAC1D,CAAC;MACDa,iBAAiB,EAAEd,yBAAyB;MAC5Ce,mBAAmB,EAAEb,GAAG;MACxBc,MAAM,EAAE;QACNC,MAAM,EAAE,KAAK;QACbC,GAAG,EAAE,OAAO;QACZC,SAAS,EAAEf;MACb;IACF,CAAC,CAAC;IAEF,MAAMgB,iBAAiB,GAAG,MAAM,IAAIC,yBAAO,CAACpB,gBAAgB,CAAC,CAC1DqB,kBAAkB,CAAC;MAClBC,GAAG,EAAE,cAAc;MACnBC,GAAG,EAAEpB,YAAY,CAACoB;IACpB,CAAC,CAAC,CACDC,UAAU,CAAC;MACVC,GAAG,EAAEtB,YAAY,CAACoB,GAAG;MACrBtB,GAAG;MACHyB,aAAa,EAAE,KAAK;MACpBhC,IAAI;MACJC;IACF,CAAC,CAAC,CACDgC,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,IAAI,CAAC,CACvBC,IAAI,CAAC,CAAC;IAET,MAAMC,YAAY,GAAG,MAAM,IAAAC,iCAAkB,EAAC;MAC5CC,iBAAiB,EAAEzC,SAAS;MAC5B0C,eAAe,EAAEzC,iBAAiB;MAClC0C,YAAY,EAAEzC,cAAc;MAC5BY,qBAAqB;MACrBc,iBAAiB;MACjBgB,iBAAiB,EAAEpC,yBAAyB;MAC5CS,SAAS,EAAE;QACTV,KAAK,EAAED,QAAQ;QACf,GAAGa;MACL;IACF,CAAC,CAAC,CAAC0B,KAAK,CAACC,4CAAoC,CAAC;IAE9C,OAAO;MACLC,YAAY,EAAER,YAAY,CAACS,WAAW;MACtCC,kBAAkB,EAAEV,YAAY,CAACW;IACnC,CAAC;EACH,CAAC;AACH;AAEO,MAAMC,yBAAkE,GAC7E,MAAAA,CAAOH,WAAW,EAAEI,WAAW,EAAEC,WAAW,KAAK;EAC/C,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCN,kBAAkB,EAAEG,WAAW;IAC/BnD,iBAAiB,EAAEoD;EACrB,CAAC,CAAC;EAEF,MAAMG,WAAW,GAAI,GAAER,WAAY,IAAGM,MAAO,EAAC;EAC9C,OAAO;IAAEE;EAAY,CAAC;AACxB,CAAC;AAACC,OAAA,CAAAN,yBAAA,GAAAA,yBAAA"}

package/lib/commonjs/credential/issuance/mrtd-pop/index.js

@@ -3,15 +3,31 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.MRTDPoP = void 0;
+exports.MRTDPoPv1_3 = exports.MRTDPoPv1_0 = void 0;
+var _config = require("../../../utils/config");
 var _verifyAndParseChallengeInfo = require("./01-verify-and-parse-challenge-info");
 var _initChallenge = require("./02-init-challenge");
 var _validateChallenge = require("./03-validate-challenge");
-const MRTDPoP = {
+const MRTDPoPv1_0 = {
   verifyAndParseChallengeInfo: _verifyAndParseChallengeInfo.verifyAndParseChallengeInfo,
-  initChallenge: _initChallenge.initChallenge,
-  validateChallenge: _validateChallenge.validateChallenge,
+  initChallenge: (0, _initChallenge.createInitChallenge)({
+    sdkConfig: _config.sdkConfigV1_0
+  }),
+  validateChallenge: (0, _validateChallenge.createValidateChallenge)({
+    sdkConfig: _config.sdkConfigV1_0
+  }),
   buildChallengeCallbackUrl: _validateChallenge.buildChallengeCallbackUrl
 };
-exports.MRTDPoP = MRTDPoP;
+exports.MRTDPoPv1_0 = MRTDPoPv1_0;
+const MRTDPoPv1_3 = {
+  verifyAndParseChallengeInfo: _verifyAndParseChallengeInfo.verifyAndParseChallengeInfo,
+  initChallenge: (0, _initChallenge.createInitChallenge)({
+    sdkConfig: _config.sdkConfigV1_3
+  }),
+  validateChallenge: (0, _validateChallenge.createValidateChallenge)({
+    sdkConfig: _config.sdkConfigV1_3
+  }),
+  buildChallengeCallbackUrl: _validateChallenge.buildChallengeCallbackUrl
+};
+exports.MRTDPoPv1_3 = MRTDPoPv1_3;
 //# sourceMappingURL=index.js.map

package/lib/commonjs/credential/issuance/mrtd-pop/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_verifyAndParseChallengeInfo","require","_initChallenge","_validateChallenge","MRTDPoP","verifyAndParseChallengeInfo","initChallenge","validateChallenge","buildChallengeCallbackUrl","exports"],"sourceRoot":"../../../../../src","sources":["credential/issuance/mrtd-pop/index.ts"],"mappings":";;;;;;AACA,IAAAA,4BAAA,GAAAC,OAAA;AACA,IAAAC,cAAA,GAAAD,OAAA;AACA,IAAAE,kBAAA,GAAAF,OAAA;AAKO,MAAMG,OAAmB,GAAG;EACjCC,2BAA2B,EAA3BA,wDAA2B;EAC3BC,aAAa,EAAbA,4BAAa;EACbC,iBAAiB,EAAjBA,oCAAiB;EACjBC,yBAAyB,EAAzBA;AACF,CAAC;AAACC,OAAA,CAAAL,OAAA,GAAAA,OAAA"}
+{"version":3,"names":["_config","require","_verifyAndParseChallengeInfo","_initChallenge","_validateChallenge","MRTDPoPv1_0","verifyAndParseChallengeInfo","initChallenge","createInitChallenge","sdkConfig","sdkConfigV1_0","validateChallenge","createValidateChallenge","buildChallengeCallbackUrl","exports","MRTDPoPv1_3","sdkConfigV1_3"],"sourceRoot":"../../../../../src","sources":["credential/issuance/mrtd-pop/index.ts"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEA,IAAAC,4BAAA,GAAAD,OAAA;AACA,IAAAE,cAAA,GAAAF,OAAA;AACA,IAAAG,kBAAA,GAAAH,OAAA;AAKO,MAAMI,WAAuB,GAAG;EACrCC,2BAA2B,EAA3BA,wDAA2B;EAC3BC,aAAa,EAAE,IAAAC,kCAAmB,EAAC;IAAEC,SAAS,EAAEC;EAAc,CAAC,CAAC;EAChEC,iBAAiB,EAAE,IAAAC,0CAAuB,EAAC;IAAEH,SAAS,EAAEC;EAAc,CAAC,CAAC;EACxEG,yBAAyB,EAAzBA;AACF,CAAC;AAACC,OAAA,CAAAT,WAAA,GAAAA,WAAA;AAEK,MAAMU,WAAuB,GAAG;EACrCT,2BAA2B,EAA3BA,wDAA2B;EAC3BC,aAAa,EAAE,IAAAC,kCAAmB,EAAC;IAAEC,SAAS,EAAEO;EAAc,CAAC,CAAC;EAChEL,iBAAiB,EAAE,IAAAC,0CAAuB,EAAC;IAAEH,SAAS,EAAEO;EAAc,CAAC,CAAC;EACxEH,yBAAyB,EAAzBA;AACF,CAAC;AAACC,OAAA,CAAAC,WAAA,GAAAA,WAAA"}