@pagopa/io-react-native-wallet 3.1.2 → 3.3.0

package/lib/commonjs/utils/callbacks.js.map

@@ -1 +1 @@
-{"version":3,"names":["_ioReactNativeJwt","require","_cryptoNodejs","_jsrsasign","_errors","_misc","partialCallbacks","generateRandom","generateRandomBytes","hash","digest","encryptJwe","_ref","data","publicJwk","alg","enc","kid","jwe","EncryptJwe","encrypt","encryptionJwk","verifyJwt","jwtSigner","jwt","method","IoWalletError","verify","compact","verified","signerJwk","decryptJwe","getX509CertificateMetadata","certificate","x509","X509","readCertPEM","sanExt","getExtSubjectAltName","sanDnsNames","sanUriNames","item","array","push","dns","uri","exports","createVerifyJwtFromJwks","jwks","_","getJwkFromHeader","header"],"sourceRoot":"../../../src","sources":["utils/callbacks.ts"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AAGA,IAAAC,aAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,KAAA,GAAAJ,OAAA;AAQA;;AAMA;AACA;AACA;AACA;AACA;AACO,MAAMK,gBAAwC,GAAG;EACtDC,cAAc,EAAEC,yBAAmB;EACnCC,IAAI,EAAEC,oBAAqB;EAC3BC,UAAU,EAAE,MAAAA,CAAAC,IAAA,EAAqCC,IAAI;IAAA,IAAlC;MAAEC,SAAS;MAAEC,GAAG;MAAEC,GAAG;MAAEC;IAAI,CAAC,GAAAL,IAAA;IAAA,OAAY;MACzD;MACAM,GAAG,EAAE,MAAM,IAAIC,4BAAU,CAACN,IAAI,EAAE;QAAEE,GAAG;QAAEC,GAAG;QAAEC;MAAI,CAAC,CAAC,CAACG,OAAO,CAACN,SAAS,CAAC;MACrEO,aAAa,EAAEP;IACjB,CAAC;EAAA,CAAC;EACFQ,SAAS,EAAE,MAAAA,CAAOC,SAAS,EAAEC,GAAG,KAAK;IACnC;IACA,IAAID,SAAS,CAACE,MAAM,KAAK,KAAK,EAAE;MAC9B,MAAM,IAAIC,qBAAa,CAAE,8BAA6BH,SAAS,CAACE,MAAO,EAAC,CAAC;IAC3E;IACA,IAAI;MACF,MAAM,IAAAE,wBAAM,EAACH,GAAG,CAACI,OAAO,EAAEL,SAAS,CAACT,SAAS,CAAC;MAC9C,OAAO;QAAEe,QAAQ,EAAE,IAAI;QAAEC,SAAS,EAAEP,SAAS,CAACT;MAAU,CAAC;IAC3D,CAAC,CAAC,MAAM;MACN,OAAO;QAAEe,QAAQ,EAAE;MAAM,CAAC;IAC5B;EACF,CAAC;EACDE,UAAU,EAAEA,CAAA,KAAM;IAChB,MAAM,IAAIL,qBAAa,CAAC,+BAA+B,CAAC;EAC1D,CAAC;EACDM,0BAA0B,EAAGC,WAAW,IAAK;IAC3C,MAAMC,IAAI,GAAG,IAAIC,eAAI,CAAC,CAAC;IACvBD,IAAI,CAACE,WAAW,CAACH,WAAW,CAAC;IAC7B,MAAMI,MAAM,GAAGH,IAAI,CAACI,oBAAoB,CAACL,WAAW,CAAC;IAErD,MAAMM,WAAqB,GAAG,EAAE;IAChC,MAAMC,WAAqB,GAAG,EAAE;IAEhC,KAAK,MAAMC,IAAI,IAAIJ,MAAM,CAACK,KAAK,EAAE;MAC/B,IAAI,CAACD,IAAI,EAAE;MACX,IAAI,KAAK,IAAIA,IAAI,EAAEF,WAAW,CAACI,IAAI,CAACF,IAAI,CAACG,GAAG,CAAC;MAC7C,IAAI,KAAK,IAAIH,IAAI,EAAED,WAAW,CAACG,IAAI,CAACF,IAAI,CAACI,GAAG,CAAC;IAC/C;IAEA,OAAO;MAAEN,WAAW;MAAEC;IAAY,CAAC;EACrC;AACF,CAAC;AAACM,OAAA,CAAAxC,gBAAA,GAAAA,gBAAA;AAIF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMyC,uBAAuB,GAClCC,IAAW,IACsB;EACjC,OAAO,eAAe1B,SAASA,CAAC2B,CAAC,EAAEzB,GAAG,EAAE;IACtC,IAAI;MACF,MAAMM,SAAS,GAAG,IAAAoB,kCAAgB,EAAC1B,GAAG,CAAC2B,MAAM,EAAeH,IAAI,CAAC;MACjE,MAAM,IAAArB,wBAAM,EAACH,GAAG,CAACI,OAAO,EAAEE,SAAS,CAAC;MACpC,OAAO;QAAED,QAAQ,EAAE,IAAI;QAAEC;MAAU,CAAC;IACtC,CAAC,CAAC,MAAM;MACN,OAAO;QAAED,QAAQ,EAAE;MAAM,CAAC;IAC5B;EACF,CAAC;AACH,CAAC;AAACiB,OAAA,CAAAC,uBAAA,GAAAA,uBAAA"}
+{"version":3,"names":["_ioReactNativeJwt","require","_cryptoNodejs","_jsrsasign","_errors","_misc","_crypto","getJwkFromSigner","signer","method","getJwkFromCertificateChain","x5c","assert","trustChain","length","getJwkFromTrustChain","kid","publicJwk","IoWalletError","partialCallbacks","generateRandom","generateRandomBytes","hash","digest","encryptJwe","_ref","data","alg","enc","jwe","EncryptJwe","encrypt","encryptionJwk","verifyJwt","jwtSigner","jwt","signerJwk","verify","compact","verified","decryptJwe","getX509CertificateMetadata","certificate","x509","X509","readCertPEM","sanExt","getExtSubjectAltName","sanDnsNames","sanUriNames","item","array","push","dns","uri","exports","createVerifyJwtFromJwks","jwks","_","getJwkFromHeader","header","createSignJwtFromCryptoContext","cryptoContext","signJwt","_ref2","payload","SignJWT","setProtectedHeader","setPayload","sign","getPublicKey"],"sourceRoot":"../../../src","sources":["utils/callbacks.ts"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AAQA,IAAAC,aAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,KAAA,GAAAJ,OAAA;AAEA,IAAAK,OAAA,GAAAL,OAAA;AAOA;;AAMA;AACA;AACA;AACA;AACA;AACA,MAAMM,gBAAgB,GAAG,MAAOC,MAAiB,IAAmB;EAClE,QAAQA,MAAM,CAACC,MAAM;IACnB,KAAK,KAAK;MACR,OAAO,IAAAC,kCAA0B,EAACF,MAAM,CAACG,GAAG,CAAC;IAC/C,KAAK,YAAY;MAAE;QACjB,IAAAC,YAAM,EACJJ,MAAM,CAACK,UAAU,IAAIL,MAAM,CAACK,UAAU,CAACC,MAAM,GAAG,CAAC,EACjD,+CACF,CAAC;QACD,OAAO,IAAAC,4BAAoB,EAACP,MAAM,CAACK,UAAU,EAAEL,MAAM,CAACQ,GAAG,CAAC;MAC5D;IACA,KAAK,KAAK;MACR,OAAOR,MAAM,CAACS,SAAS;IACzB;MACE,MAAM,IAAIC,qBAAa,CAAE,8BAA6BV,MAAM,CAACC,MAAO,EAAC,CAAC;EAC1E;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACO,MAAMU,gBAAwC,GAAG;EACtDC,cAAc,EAAEC,yBAAmB;EACnCC,IAAI,EAAEC,oBAAqB;EAC3BC,UAAU,EAAE,MAAAA,CAAAC,IAAA,EAAqCC,IAAI;IAAA,IAAlC;MAAET,SAAS;MAAEU,GAAG;MAAEC,GAAG;MAAEZ;IAAI,CAAC,GAAAS,IAAA;IAAA,OAAY;MACzD;MACAI,GAAG,EAAE,MAAM,IAAIC,4BAAU,CAACJ,IAAI,EAAE;QAAEC,GAAG;QAAEC,GAAG;QAAEZ;MAAI,CAAC,CAAC,CAACe,OAAO,CAACd,SAAS,CAAC;MACrEe,aAAa,EAAEf;IACjB,CAAC;EAAA,CAAC;EACFgB,SAAS,EAAE,MAAAA,CAAOC,SAAS,EAAEC,GAAG,KAAK;IACnC,IAAI;MACF,MAAMC,SAAS,GAAG,MAAM7B,gBAAgB,CAAC2B,SAAS,CAAC;MACnD,MAAM,IAAAG,wBAAM,EAACF,GAAG,CAACG,OAAO,EAAEF,SAAS,CAAC;MACpC,OAAO;QAAEG,QAAQ,EAAE,IAAI;QAAEH;MAAU,CAAC;IACtC,CAAC,CAAC,MAAM;MACN,OAAO;QAAEG,QAAQ,EAAE;MAAM,CAAC;IAC5B;EACF,CAAC;EACDC,UAAU,EAAEA,CAAA,KAAM;IAChB,MAAM,IAAItB,qBAAa,CAAC,+BAA+B,CAAC;EAC1D,CAAC;EACDuB,0BAA0B,EAAGC,WAAW,IAAK;IAC3C,MAAMC,IAAI,GAAG,IAAIC,eAAI,CAAC,CAAC;IACvBD,IAAI,CAACE,WAAW,CAACH,WAAW,CAAC;IAC7B,MAAMI,MAAM,GAAGH,IAAI,CAACI,oBAAoB,CAACL,WAAW,CAAC;IAErD,MAAMM,WAAqB,GAAG,EAAE;IAChC,MAAMC,WAAqB,GAAG,EAAE;IAEhC,KAAK,MAAMC,IAAI,IAAIJ,MAAM,CAACK,KAAK,EAAE;MAC/B,IAAI,CAACD,IAAI,EAAE;MACX,IAAI,KAAK,IAAIA,IAAI,EAAEF,WAAW,CAACI,IAAI,CAACF,IAAI,CAACG,GAAG,CAAC;MAC7C,IAAI,KAAK,IAAIH,IAAI,EAAED,WAAW,CAACG,IAAI,CAACF,IAAI,CAACI,GAAG,CAAC;IAC/C;IAEA,OAAO;MAAEN,WAAW;MAAEC;IAAY,CAAC;EACrC;AACF,CAAC;AAACM,OAAA,CAAApC,gBAAA,GAAAA,gBAAA;AAIF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMqC,uBAAuB,GAClCC,IAAW,IACsB;EACjC,OAAO,eAAexB,SAASA,CAACyB,CAAC,EAAEvB,GAAG,EAAE;IACtC,IAAI;MACF,MAAMC,SAAS,GAAG,IAAAuB,kCAAgB,EAACxB,GAAG,CAACyB,MAAM,EAAeH,IAAI,CAAC;MACjE,MAAM,IAAApB,wBAAM,EAACF,GAAG,CAACG,OAAO,EAAEF,SAAS,CAAC;MACpC,OAAO;QAAEG,QAAQ,EAAE,IAAI;QAAEH;MAAU,CAAC;IACtC,CAAC,CAAC,MAAM;MACN,OAAO;QAAEG,QAAQ,EAAE;MAAM,CAAC;IAC5B;EACF,CAAC;AACH,CAAC;;AAED;AACA;AACA;AACA;AACA;AAJAgB,OAAA,CAAAC,uBAAA,GAAAA,uBAAA;AAKO,MAAMK,8BAA8B,GACzCC,aAA4B,IACG;EAC/B,OAAO,eAAeC,OAAOA,CAAC7B,SAAS,EAAA8B,KAAA,EAAuB;IAAA,IAArB;MAAEJ,MAAM;MAAEK;IAAQ,CAAC,GAAAD,KAAA;IAC1D,OAAO;MACL7B,GAAG,EAAE,MAAM,IAAI+B,yBAAO,CAACJ,aAAa,CAAC,CAClCK,kBAAkB,CAACP,MAAM,CAAC,CAC1BQ,UAAU,CAACH,OAAO,CAAC,CACnBI,IAAI,CAAC,CAAC;MACTjC,SAAS,EACPF,SAAS,CAACzB,MAAM,KAAK,KAAK,GACtByB,SAAS,CAACjB,SAAS,GACnB,MAAM6C,aAAa,CAACQ,YAAY,CAAC;IACzC,CAAC;EACH,CAAC;AACH,CAAC;AAACf,OAAA,CAAAM,8BAAA,GAAAA,8BAAA"}

package/lib/commonjs/utils/crypto.js

@@ -3,13 +3,21 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.withEphemeralKey = exports.getSigninJwkFromCert = exports.createCryptoContextFor = exports.convertBase64DerToPem = void 0;
+exports.withEphemeralKey = exports.getSigninJwkFromCert = exports.getJwkFromTrustChain = exports.getJwkFromCertificateChain = exports.createCryptoContextFor = exports.convertBase64DerToPem = void 0;
 var _ioReactNativeCrypto = require("@pagopa/io-react-native-crypto");
 var _uuid = require("uuid");
 var _ioReactNativeJwt = require("@pagopa/io-react-native-jwt");
 var _jwk = require("./jwk");
 var _jsrsasign = require("jsrsasign");
 var _errors = require("./errors");
+/**
+ * Extension of the {@link CryptoContext} that adds key generation with optional key attestation.
+ *
+ * This context requires the consumer to provide an additional method for **key generation**;
+ * on Android this method should also generate a key attestation as a certificate chain
+ * to ensure the key pair is hardware-backed.
+ */
+
 /**
  * Create a CryptoContext bound to a key pair.
  * Key pair is supposed to exist already in the device's keychain.
@@ -88,11 +96,56 @@ const getSigninJwkFromCert = pemCert => {
 };
 
 /**
- * Extension of the {@link CryptoContext} that adds key generation with optional key attestation.
+ * Retrieves the signing JWK from a x509 certificate chain.
  *
- * This context requires the consumer to provide an additional method for **key generation**;
- * on Android this method should also generate a key attestation as a certificate chain
- * to ensure the key pair is hardware-backed.
+ * @param certChain - The x509 certificate chain.
+ * @returns The signing JWK.
+ * @throws Will throw an error if no suitable keys are found.
  */
 exports.getSigninJwkFromCert = getSigninJwkFromCert;
+const getJwkFromCertificateChain = async certChain => {
+  const [leafCert] = certChain;
+  if (!leafCert) {
+    throw new _errors.IoWalletError("The provided certificate chain is invalid or malformed");
+  }
+  const pemCert = convertBase64DerToPem(leafCert);
+  return getSigninJwkFromCert(pemCert);
+};
+
+/**
+ * Retrieves the signing JWK from a trust chain of entity configuration JWTs, matching the provided signer KID.
+ *
+ * @param trustChain - The trust chain of entity configuration JWTs.
+ * @param signerKid - The KID of the signer to look for in the trust chain.
+ * @returns The signing JWK.
+ * @throws Will throw an error if no suitable keys are found.
+ */
+exports.getJwkFromCertificateChain = getJwkFromCertificateChain;
+const getJwkFromTrustChain = (trustChain, signerKid) => {
+  const [entityConfigurationJwt] = trustChain;
+  if (!entityConfigurationJwt) {
+    throw new _errors.IoWalletError("The provided trust chain is invalid or malformed");
+  }
+  const keys = [];
+  const decodedEntityConfigJwt = (0, _ioReactNativeJwt.decode)(entityConfigurationJwt);
+  const baseEntityConfig = decodedEntityConfigJwt.payload;
+
+  // Get top-level JWKS
+  if (baseEntityConfig.jwks) {
+    keys.push(..._jwk.JWKS.parse(baseEntityConfig.jwks).keys);
+  }
+
+  // Check metadata entries for additional JWKS like openid_credential_verifier
+  if (baseEntityConfig.metadata) {
+    for (const metadata of Object.values(baseEntityConfig.metadata)) {
+      if (metadata.jwks) {
+        keys.push(..._jwk.JWKS.parse(metadata.jwks).keys);
+      }
+    }
+  }
+  const federationJwk = keys.find(key => key.kid === signerKid);
+  if (!federationJwk) throw new _errors.IoWalletError("No suitable key was found in the provided trust chain");
+  return federationJwk;
+};
+exports.getJwkFromTrustChain = getJwkFromTrustChain;
 //# sourceMappingURL=crypto.js.map

package/lib/commonjs/utils/crypto.js.map

@@ -1 +1 @@
-{"version":3,"names":["_ioReactNativeCrypto","require","_uuid","_ioReactNativeJwt","_jwk","_jsrsasign","_errors","createCryptoContextFor","keytag","getPublicKey","getPublicKeyFixed","then","jwk","kid","thumbprint","getSignature","value","sign","exports","withEphemeralKey","fn","uuidv4","generate","ephemeralContext","finally","deleteKey","convertBase64DerToPem","certificate","getSigninJwkFromCert","pemCert","x509","X509","readCertPEM","publicKey","RSAKey","KJUR","crypto","ECDSA","JWK","parse","KEYUTIL","getJWKFromKey","use","IoWalletError"],"sourceRoot":"../../../src","sources":["utils/crypto.ts"],"mappings":";;;;;;AAAA,IAAAA,oBAAA,GAAAC,OAAA;AAMA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,iBAAA,GAAAF,OAAA;AACA,IAAAG,IAAA,GAAAH,OAAA;AACA,IAAAI,UAAA,GAAAJ,OAAA;AACA,IAAAK,OAAA,GAAAL,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMM,sBAAsB,GAAIC,MAAc,IAAoB;EACvE,OAAO;IACL,MAAMC,YAAYA,CAAA,EAAG;MACnB,OAAO,IAAAC,sCAAiB,EAACF,MAAM,CAAC,CAACG,IAAI,CAAC,MAAOC,GAAG,KAAM;QACpD,GAAGA,GAAG;QACN;QACA;QACA;QACA;QACAC,GAAG,EAAE,MAAM,IAAAC,4BAAU,EAACF,GAAG;MAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IACD;AACJ;AACA;AACA;AACA;AACA;IACI,MAAMG,YAAYA,CAACC,KAAa,EAAE;MAChC,OAAO,IAAAC,yBAAI,EAACD,KAAK,EAAER,MAAM,CAAC;IAC5B;EACF,CAAC;AACH,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAPAU,OAAA,CAAAX,sBAAA,GAAAA,sBAAA;AAQO,MAAMY,gBAAgB,GAAG,MAC9BC,EAAmD,IACpC;EACf;EACA,MAAMZ,MAAM,GAAI,aAAY,IAAAa,QAAM,EAAC,CAAE,EAAC;EACtC,MAAM,IAAAC,6BAAQ,EAACd,MAAM,CAAC;EACtB,MAAMe,gBAAgB,GAAGhB,sBAAsB,CAACC,MAAM,CAAC;EACvD,OAAOY,EAAE,CAACG,gBAAgB,CAAC,CAACC,OAAO,CAAC,MAAM,IAAAC,8BAAS,EAACjB,MAAM,CAAC,CAAC;AAC9D,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AALAU,OAAA,CAAAC,gBAAA,GAAAA,gBAAA;AAMO,MAAMO,qBAAqB,GAAIC,WAAmB,IACtD,gCAA+BA,WAAY,6BAA4B;;AAE1E;AACA;AACA;AACA;AACA;AACA;AACA;AANAT,OAAA,CAAAQ,qBAAA,GAAAA,qBAAA;AAOO,MAAME,oBAAoB,GAAIC,OAAe,IAAU;EAC5D,MAAMC,IAAI,GAAG,IAAIC,eAAI,CAAC,CAAC;EACvBD,IAAI,CAACE,WAAW,CAACH,OAAO,CAAC;EACzB,MAAMI,SAAS,GAAGH,IAAI,CAACrB,YAAY,CAAC,CAAC;EAErC,IAAIwB,SAAS,YAAYC,iBAAM,IAAID,SAAS,YAAYE,eAAI,CAACC,MAAM,CAACC,KAAK,EAAE;IACzE,OAAO;MACL,GAAGC,QAAG,CAACC,KAAK,CAACC,kBAAO,CAACC,aAAa,CAACR,SAAS,CAAC,CAAC;MAC9CS,GAAG,EAAE;IACP,CAAC;EACH;EAEA,MAAM,IAAIC,qBAAa,CACrB,2DACF,CAAC;AACH,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AANAzB,OAAA,CAAAU,oBAAA,GAAAA,oBAAA"}
+{"version":3,"names":["_ioReactNativeCrypto","require","_uuid","_ioReactNativeJwt","_jwk","_jsrsasign","_errors","createCryptoContextFor","keytag","getPublicKey","getPublicKeyFixed","then","jwk","kid","thumbprint","getSignature","value","sign","exports","withEphemeralKey","fn","uuidv4","generate","ephemeralContext","finally","deleteKey","convertBase64DerToPem","certificate","getSigninJwkFromCert","pemCert","x509","X509","readCertPEM","publicKey","RSAKey","KJUR","crypto","ECDSA","JWK","parse","KEYUTIL","getJWKFromKey","use","IoWalletError","getJwkFromCertificateChain","certChain","leafCert","getJwkFromTrustChain","trustChain","signerKid","entityConfigurationJwt","keys","decodedEntityConfigJwt","decode","baseEntityConfig","payload","jwks","push","JWKS","metadata","Object","values","federationJwk","find","key"],"sourceRoot":"../../../src","sources":["utils/crypto.ts"],"mappings":";;;;;;AAAA,IAAAA,oBAAA,GAAAC,OAAA;AAMA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,iBAAA,GAAAF,OAAA;AAMA,IAAAG,IAAA,GAAAH,OAAA;AACA,IAAAI,UAAA,GAAAJ,OAAA;AACA,IAAAK,OAAA,GAAAL,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;;AAYA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMM,sBAAsB,GAAIC,MAAc,IAAoB;EACvE,OAAO;IACL,MAAMC,YAAYA,CAAA,EAAG;MACnB,OAAO,IAAAC,sCAAiB,EAACF,MAAM,CAAC,CAACG,IAAI,CAAC,MAAOC,GAAG,KAAM;QACpD,GAAGA,GAAG;QACN;QACA;QACA;QACA;QACAC,GAAG,EAAE,MAAM,IAAAC,4BAAU,EAACF,GAAG;MAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IACD;AACJ;AACA;AACA;AACA;AACA;IACI,MAAMG,YAAYA,CAACC,KAAa,EAAE;MAChC,OAAO,IAAAC,yBAAI,EAACD,KAAK,EAAER,MAAM,CAAC;IAC5B;EACF,CAAC;AACH,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAPAU,OAAA,CAAAX,sBAAA,GAAAA,sBAAA;AAQO,MAAMY,gBAAgB,GAAG,MAC9BC,EAAmD,IACpC;EACf;EACA,MAAMZ,MAAM,GAAI,aAAY,IAAAa,QAAM,EAAC,CAAE,EAAC;EACtC,MAAM,IAAAC,6BAAQ,EAACd,MAAM,CAAC;EACtB,MAAMe,gBAAgB,GAAGhB,sBAAsB,CAACC,MAAM,CAAC;EACvD,OAAOY,EAAE,CAACG,gBAAgB,CAAC,CAACC,OAAO,CAAC,MAAM,IAAAC,8BAAS,EAACjB,MAAM,CAAC,CAAC;AAC9D,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AALAU,OAAA,CAAAC,gBAAA,GAAAA,gBAAA;AAMO,MAAMO,qBAAqB,GAAIC,WAAmB,IACtD,gCAA+BA,WAAY,6BAA4B;;AAE1E;AACA;AACA;AACA;AACA;AACA;AACA;AANAT,OAAA,CAAAQ,qBAAA,GAAAA,qBAAA;AAOO,MAAME,oBAAoB,GAAIC,OAAe,IAAU;EAC5D,MAAMC,IAAI,GAAG,IAAIC,eAAI,CAAC,CAAC;EACvBD,IAAI,CAACE,WAAW,CAACH,OAAO,CAAC;EACzB,MAAMI,SAAS,GAAGH,IAAI,CAACrB,YAAY,CAAC,CAAC;EAErC,IAAIwB,SAAS,YAAYC,iBAAM,IAAID,SAAS,YAAYE,eAAI,CAACC,MAAM,CAACC,KAAK,EAAE;IACzE,OAAO;MACL,GAAGC,QAAG,CAACC,KAAK,CAACC,kBAAO,CAACC,aAAa,CAACR,SAAS,CAAC,CAAC;MAC9CS,GAAG,EAAE;IACP,CAAC;EACH;EAEA,MAAM,IAAIC,qBAAa,CACrB,2DACF,CAAC;AACH,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AANAzB,OAAA,CAAAU,oBAAA,GAAAA,oBAAA;AAOO,MAAMgB,0BAA0B,GAAG,MACxCC,SAAmB,IACF;EACjB,MAAM,CAACC,QAAQ,CAAC,GAAGD,SAAS;EAC5B,IAAI,CAACC,QAAQ,EAAE;IACb,MAAM,IAAIH,qBAAa,CACrB,wDACF,CAAC;EACH;EACA,MAAMd,OAAO,GAAGH,qBAAqB,CAACoB,QAAQ,CAAC;EAC/C,OAAOlB,oBAAoB,CAACC,OAAO,CAAC;AACtC,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAPAX,OAAA,CAAA0B,0BAAA,GAAAA,0BAAA;AAQO,MAAMG,oBAAoB,GAAGA,CAClCC,UAAoB,EACpBC,SAAiB,KACT;EACR,MAAM,CAACC,sBAAsB,CAAC,GAAGF,UAAU;EAC3C,IAAI,CAACE,sBAAsB,EAAE;IAC3B,MAAM,IAAIP,qBAAa,CAAC,kDAAkD,CAAC;EAC7E;EAEA,MAAMQ,IAAW,GAAG,EAAE;EACtB,MAAMC,sBAAsB,GAAG,IAAAC,wBAAM,EAACH,sBAAsB,CAAC;EAC7D,MAAMI,gBAAgB,GACpBF,sBAAsB,CAACG,OAA6C;;EAEtE;EACA,IAAID,gBAAgB,CAACE,IAAI,EAAE;IACzBL,IAAI,CAACM,IAAI,CAAC,GAAGC,SAAI,CAACnB,KAAK,CAACe,gBAAgB,CAACE,IAAI,CAAC,CAACL,IAAI,CAAC;EACtD;;EAEA;EACA,IAAIG,gBAAgB,CAACK,QAAQ,EAAE;IAC7B,KAAK,MAAMA,QAAQ,IAAIC,MAAM,CAACC,MAAM,CAClCP,gBAAgB,CAACK,QACnB,CAAC,EAAE;MACD,IAAIA,QAAQ,CAACH,IAAI,EAAE;QACjBL,IAAI,CAACM,IAAI,CAAC,GAAGC,SAAI,CAACnB,KAAK,CAACoB,QAAQ,CAACH,IAAI,CAAC,CAACL,IAAI,CAAC;MAC9C;IACF;EACF;EAEA,MAAMW,aAAa,GAAGX,IAAI,CAACY,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACnD,GAAG,KAAKoC,SAAS,CAAC;EAC/D,IAAI,CAACa,aAAa,EAChB,MAAM,IAAInB,qBAAa,CACrB,uDACF,CAAC;EACH,OAAOmB,aAAa;AACtB,CAAC;AAAC5C,OAAA,CAAA6B,oBAAA,GAAAA,oBAAA"}

package/lib/commonjs/utils/x509.js

@@ -0,0 +1,34 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.verifyX509Chain = void 0;
+var _ioReactNativeCrypto = require("@pagopa/io-react-native-crypto");
+var _errors = require("../trust/common/errors");
+/**
+ * This function checks whether the x509 certificate chain is valid against a specified Certificate Authority (CA)
+ *
+ * @param x5chain The mdoc's x509 certificate chain
+ * @param x509CertRoot The Trust Anchor CA
+ * @param options Options for certificate validation
+ */
+const verifyX509Chain = async function (x5chain, x509CertRoot) {
+  let options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {
+    connectTimeout: 10000,
+    readTimeout: 10000,
+    requireCrl: true
+  };
+  // Strip the trust anchor from the chain if the issuer included it,
+  // since verifyCertificateChain expects it passed separately.
+  const certChain = x5chain.length > 1 && x5chain.at(-1) === x509CertRoot ? x5chain.slice(0, -1) : x5chain;
+  const x509ValidationResult = await (0, _ioReactNativeCrypto.verifyCertificateChain)(certChain, x509CertRoot, options);
+  if (!x509ValidationResult.isValid) {
+    throw new _errors.X509ValidationError(`X.509 certificate chain validation failed. Status: ${x509ValidationResult.validationStatus}. Error: ${x509ValidationResult.errorMessage}`, {
+      x509ValidationStatus: x509ValidationResult.validationStatus,
+      x509ErrorMessage: x509ValidationResult.errorMessage
+    });
+  }
+};
+exports.verifyX509Chain = verifyX509Chain;
+//# sourceMappingURL=x509.js.map

package/lib/commonjs/utils/x509.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_ioReactNativeCrypto","require","_errors","verifyX509Chain","x5chain","x509CertRoot","options","arguments","length","undefined","connectTimeout","readTimeout","requireCrl","certChain","at","slice","x509ValidationResult","verifyCertificateChain","isValid","X509ValidationError","validationStatus","errorMessage","x509ValidationStatus","x509ErrorMessage","exports"],"sourceRoot":"../../../src","sources":["utils/x509.ts"],"mappings":";;;;;;AAAA,IAAAA,oBAAA,GAAAC,OAAA;AAKA,IAAAC,OAAA,GAAAD,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,eAAe,GAAG,eAAAA,CAC7BC,OAAiB,EACjBC,YAAoB,EAMjB;EAAA,IALHC,OAA+B,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG;IAChCG,cAAc,EAAE,KAAK;IACrBC,WAAW,EAAE,KAAK;IAClBC,UAAU,EAAE;EACd,CAAC;EAED;EACA;EACA,MAAMC,SAAS,GACbT,OAAO,CAACI,MAAM,GAAG,CAAC,IAAIJ,OAAO,CAACU,EAAE,CAAC,CAAC,CAAC,CAAC,KAAKT,YAAY,GACjDD,OAAO,CAACW,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACpBX,OAAO;EAEb,MAAMY,oBAAiD,GACrD,MAAM,IAAAC,2CAAsB,EAACJ,SAAS,EAAER,YAAY,EAAEC,OAAO,CAAC;EAEhE,IAAI,CAACU,oBAAoB,CAACE,OAAO,EAAE;IACjC,MAAM,IAAIC,2BAAmB,CAC1B,sDAAqDH,oBAAoB,CAACI,gBAAiB,YAAWJ,oBAAoB,CAACK,YAAa,EAAC,EAC1I;MACEC,oBAAoB,EAAEN,oBAAoB,CAACI,gBAAgB;MAC3DG,gBAAgB,EAAEP,oBAAoB,CAACK;IACzC,CACF,CAAC;EACH;AACF,CAAC;AAACG,OAAA,CAAArB,eAAA,GAAAA,eAAA"}

package/lib/commonjs/wallet-instance-attestation/api/types.js

@@ -22,8 +22,6 @@ const DecodedWalletInstanceAttestation = z.object({
     jwk: _jwk.JWK
   }),
   sub: z.string(),
-  wallet_provider_name: z.string().optional(),
-  wallet_solution_id: z.string().optional(),
   /** @deprecated */
   wallet_link: z.string().optional(),
   /** @deprecated */

package/lib/commonjs/wallet-instance-attestation/api/types.js.map

@@ -1 +1 @@
-{"version":3,"names":["z","_interopRequireWildcard","require","_zod2","_jwk","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","DecodedWalletInstanceAttestation","object","iss","string","iat","UnixTime","exp","cnf","jwk","JWK","sub","wallet_provider_name","optional","wallet_solution_id","wallet_link","wallet_name","aal","exports"],"sourceRoot":"../../../../src","sources":["wallet-instance-attestation/api/types.ts"],"mappings":";;;;;;AAAA,IAAAA,CAAA,GAAAC,uBAAA,CAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,IAAA,GAAAF,OAAA;AAAsC,SAAAG,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAL,wBAAAS,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAEtC;AACA;AACA;AACA;;AAIO,MAAMW,gCAAgC,GAAG3B,CAAC,CAAC4B,MAAM,CAAC;EACvDC,GAAG,EAAE7B,CAAC,CAAC8B,MAAM,CAAC,CAAC;EACfC,GAAG,EAAEC,cAAQ;EACbC,GAAG,EAAED,cAAQ;EACbE,GAAG,EAAElC,CAAC,CAAC4B,MAAM,CAAC;IAAEO,GAAG,EAAEC;EAAI,CAAC,CAAC;EAC3BC,GAAG,EAAErC,CAAC,CAAC8B,MAAM,CAAC,CAAC;EACfQ,oBAAoB,EAAEtC,CAAC,CAAC8B,MAAM,CAAC,CAAC,CAACS,QAAQ,CAAC,CAAC;EAC3CC,kBAAkB,EAAExC,CAAC,CAAC8B,MAAM,CAAC,CAAC,CAACS,QAAQ,CAAC,CAAC;EACzC;EACAE,WAAW,EAAEzC,CAAC,CAAC8B,MAAM,CAAC,CAAC,CAACS,QAAQ,CAAC,CAAC;EAClC;EACAG,WAAW,EAAE1C,CAAC,CAAC8B,MAAM,CAAC,CAAC,CAACS,QAAQ,CAAC,CAAC;EAClC;EACAI,GAAG,EAAE3C,CAAC,CAAC8B,MAAM,CAAC,CAAC,CAACS,QAAQ,CAAC;AAC3B,CAAC,CAAC;AAACK,OAAA,CAAAjB,gCAAA,GAAAA,gCAAA"}
+{"version":3,"names":["z","_interopRequireWildcard","require","_zod2","_jwk","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","DecodedWalletInstanceAttestation","object","iss","string","iat","UnixTime","exp","cnf","jwk","JWK","sub","wallet_link","optional","wallet_name","aal","exports"],"sourceRoot":"../../../../src","sources":["wallet-instance-attestation/api/types.ts"],"mappings":";;;;;;AAAA,IAAAA,CAAA,GAAAC,uBAAA,CAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,IAAA,GAAAF,OAAA;AAAsC,SAAAG,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAL,wBAAAS,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAEtC;AACA;AACA;AACA;;AAIO,MAAMW,gCAAgC,GAAG3B,CAAC,CAAC4B,MAAM,CAAC;EACvDC,GAAG,EAAE7B,CAAC,CAAC8B,MAAM,CAAC,CAAC;EACfC,GAAG,EAAEC,cAAQ;EACbC,GAAG,EAAED,cAAQ;EACbE,GAAG,EAAElC,CAAC,CAAC4B,MAAM,CAAC;IAAEO,GAAG,EAAEC;EAAI,CAAC,CAAC;EAC3BC,GAAG,EAAErC,CAAC,CAAC8B,MAAM,CAAC,CAAC;EACf;EACAQ,WAAW,EAAEtC,CAAC,CAAC8B,MAAM,CAAC,CAAC,CAACS,QAAQ,CAAC,CAAC;EAClC;EACAC,WAAW,EAAExC,CAAC,CAAC8B,MAAM,CAAC,CAAC,CAACS,QAAQ,CAAC,CAAC;EAClC;EACAE,GAAG,EAAEzC,CAAC,CAAC8B,MAAM,CAAC,CAAC,CAACS,QAAQ,CAAC;AAC3B,CAAC,CAAC;AAACG,OAAA,CAAAf,gCAAA,GAAAA,gCAAA"}

package/lib/commonjs/wallet-instance-attestation/v1.3.3/mappers.js

@@ -6,20 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.mapToDecodedWalletInstanceAttestation = void 0;
 var _mappers = require("../../utils/mappers");
 var _types = require("../api/types");
-const mapToDecodedWalletInstanceAttestation = (0, _mappers.createMapper)(_ref => {
-  let {
-    payload
-  } = _ref;
-  const {
-    eudi_wallet_info,
-    ...rest
-  } = payload;
-  return {
-    ...rest,
-    wallet_provider_name: eudi_wallet_info.general_info.wallet_provider_name,
-    wallet_solution_id: eudi_wallet_info.general_info.wallet_solution_id
-  };
-}, {
+const mapToDecodedWalletInstanceAttestation = (0, _mappers.createMapper)(x => x.payload, {
   outputSchema: _types.DecodedWalletInstanceAttestation
 });
 exports.mapToDecodedWalletInstanceAttestation = mapToDecodedWalletInstanceAttestation;

package/lib/commonjs/wallet-instance-attestation/v1.3.3/mappers.js.map

@@ -1 +1 @@
-{"version":3,"names":["_mappers","require","_types","mapToDecodedWalletInstanceAttestation","createMapper","_ref","payload","eudi_wallet_info","rest","wallet_provider_name","general_info","wallet_solution_id","outputSchema","DecodedWalletInstanceAttestation","exports"],"sourceRoot":"../../../../src","sources":["wallet-instance-attestation/v1.3.3/mappers.ts"],"mappings":";;;;;;AAAA,IAAAA,QAAA,GAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AAGO,MAAME,qCAAqC,GAAG,IAAAC,qBAAY,EAI/DC,IAAA,IAAiB;EAAA,IAAhB;IAAEC;EAAQ,CAAC,GAAAD,IAAA;EACV,MAAM;IAAEE,gBAAgB;IAAE,GAAGC;EAAK,CAAC,GAAGF,OAAO;EAC7C,OAAO;IACL,GAAGE,IAAI;IACPC,oBAAoB,EAAEF,gBAAgB,CAACG,YAAY,CAACD,oBAAoB;IACxEE,kBAAkB,EAAEJ,gBAAgB,CAACG,YAAY,CAACC;EACpD,CAAC;AACH,CAAC,EACD;EAAEC,YAAY,EAAEC;AAAiC,CACnD,CAAC;AAACC,OAAA,CAAAX,qCAAA,GAAAA,qCAAA"}
+{"version":3,"names":["_mappers","require","_types","mapToDecodedWalletInstanceAttestation","createMapper","x","payload","outputSchema","DecodedWalletInstanceAttestation","exports"],"sourceRoot":"../../../../src","sources":["wallet-instance-attestation/v1.3.3/mappers.ts"],"mappings":";;;;;;AAAA,IAAAA,QAAA,GAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AAGO,MAAME,qCAAqC,GAAG,IAAAC,qBAAY,EAG9DC,CAAC,IAAKA,CAAC,CAACC,OAAO,EAAE;EAClBC,YAAY,EAAEC;AAChB,CAAC,CAAC;AAACC,OAAA,CAAAN,qCAAA,GAAAA,qCAAA"}

package/lib/commonjs/wallet-instance-attestation/v1.3.3/types.js

@@ -14,13 +14,8 @@ const WalletInstanceAttestationJwt = z.object({
   })),
   payload: z.intersection(_types.Jwt.shape.payload, z.object({
     sub: z.string(),
-    eudi_wallet_info: z.object({
-      general_info: z.object({
-        wallet_provider_name: z.string(),
-        wallet_solution_id: z.string(),
-        wallet_solution_version: z.string()
-      })
-    })
+    wallet_link: z.string().optional(),
+    wallet_name: z.string().optional()
   }))
 });
 exports.WalletInstanceAttestationJwt = WalletInstanceAttestationJwt;

package/lib/commonjs/wallet-instance-attestation/v1.3.3/types.js.map

@@ -1 +1 @@
-{"version":3,"names":["z","_interopRequireWildcard","require","_types","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","WalletInstanceAttestationJwt","object","header","intersection","Jwt","shape","typ","literal","payload","sub","string","eudi_wallet_info","general_info","wallet_provider_name","wallet_solution_id","wallet_solution_version","exports","WalletInstanceAttestationResponse","wallet_instance_attestation"],"sourceRoot":"../../../../src","sources":["wallet-instance-attestation/v1.3.3/types.ts"],"mappings":";;;;;;AAAA,IAAAA,CAAA,GAAAC,uBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AAAsC,SAAAE,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAJ,wBAAAQ,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAK/B,MAAMW,4BAA4B,GAAG1B,CAAC,CAAC2B,MAAM,CAAC;EACnDC,MAAM,EAAE5B,CAAC,CAAC6B,YAAY,CACpBC,UAAG,CAACC,KAAK,CAACH,MAAM,EAChB5B,CAAC,CAAC2B,MAAM,CAAC;IACPK,GAAG,EAAEhC,CAAC,CAACiC,OAAO,CAAC,8BAA8B;EAC/C,CAAC,CACH,CAAC;EACDC,OAAO,EAAElC,CAAC,CAAC6B,YAAY,CACrBC,UAAG,CAACC,KAAK,CAACG,OAAO,EACjBlC,CAAC,CAAC2B,MAAM,CAAC;IACPQ,GAAG,EAAEnC,CAAC,CAACoC,MAAM,CAAC,CAAC;IACfC,gBAAgB,EAAErC,CAAC,CAAC2B,MAAM,CAAC;MACzBW,YAAY,EAAEtC,CAAC,CAAC2B,MAAM,CAAC;QACrBY,oBAAoB,EAAEvC,CAAC,CAACoC,MAAM,CAAC,CAAC;QAChCI,kBAAkB,EAAExC,CAAC,CAACoC,MAAM,CAAC,CAAC;QAC9BK,uBAAuB,EAAEzC,CAAC,CAACoC,MAAM,CAAC;MACpC,CAAC;IACH,CAAC;EACH,CAAC,CACH;AACF,CAAC,CAAC;AAACM,OAAA,CAAAhB,4BAAA,GAAAA,4BAAA;AAKI,MAAMiB,iCAAiC,GAAG3C,CAAC,CAAC2B,MAAM,CAAC;EACxDiB,2BAA2B,EAAE5C,CAAC,CAACoC,MAAM,CAAC;AACxC,CAAC,CAAC;AAACM,OAAA,CAAAC,iCAAA,GAAAA,iCAAA"}
+{"version":3,"names":["z","_interopRequireWildcard","require","_types","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","WalletInstanceAttestationJwt","object","header","intersection","Jwt","shape","typ","literal","payload","sub","string","wallet_link","optional","wallet_name","exports","WalletInstanceAttestationResponse","wallet_instance_attestation"],"sourceRoot":"../../../../src","sources":["wallet-instance-attestation/v1.3.3/types.ts"],"mappings":";;;;;;AAAA,IAAAA,CAAA,GAAAC,uBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AAAsC,SAAAE,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAJ,wBAAAQ,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAK/B,MAAMW,4BAA4B,GAAG1B,CAAC,CAAC2B,MAAM,CAAC;EACnDC,MAAM,EAAE5B,CAAC,CAAC6B,YAAY,CACpBC,UAAG,CAACC,KAAK,CAACH,MAAM,EAChB5B,CAAC,CAAC2B,MAAM,CAAC;IACPK,GAAG,EAAEhC,CAAC,CAACiC,OAAO,CAAC,8BAA8B;EAC/C,CAAC,CACH,CAAC;EACDC,OAAO,EAAElC,CAAC,CAAC6B,YAAY,CACrBC,UAAG,CAACC,KAAK,CAACG,OAAO,EACjBlC,CAAC,CAAC2B,MAAM,CAAC;IACPQ,GAAG,EAAEnC,CAAC,CAACoC,MAAM,CAAC,CAAC;IACfC,WAAW,EAAErC,CAAC,CAACoC,MAAM,CAAC,CAAC,CAACE,QAAQ,CAAC,CAAC;IAClCC,WAAW,EAAEvC,CAAC,CAACoC,MAAM,CAAC,CAAC,CAACE,QAAQ,CAAC;EACnC,CAAC,CACH;AACF,CAAC,CAAC;AAACE,OAAA,CAAAd,4BAAA,GAAAA,4BAAA;AAKI,MAAMe,iCAAiC,GAAGzC,CAAC,CAAC2B,MAAM,CAAC;EACxDe,2BAA2B,EAAE1C,CAAC,CAACoC,MAAM,CAAC;AACxC,CAAC,CAAC;AAACI,OAAA,CAAAC,iCAAA,GAAAA,iCAAA"}

package/lib/commonjs/wallet-unit-attestation/api/types.js

@@ -26,17 +26,6 @@ const DecodedWalletUnitAttestation = z.object({
   user_authentication: z.array(z.string()),
   key_storage: z.array(z.string()),
   status: Status,
-  eudi_wallet_info: z.object({
-    general_info: z.object({
-      wallet_provider_name: z.string(),
-      wallet_solution_id: z.string(),
-      wallet_solution_version: z.string()
-    }),
-    key_storage_info: z.object({
-      keys_exportable: z.boolean(),
-      storage_type: z.string()
-    })
-  }),
   iss: z.string(),
   iat: _zod2.UnixTime,
   exp: _zod2.UnixTime

package/lib/commonjs/wallet-unit-attestation/api/types.js.map

@@ -1 +1 @@
-{"version":3,"names":["z","_interopRequireWildcard","require","_zod2","_jwk","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","Status","object","status_list","idx","number","uri","string","DecodedWalletUnitAttestation","attested_keys","array","JWK","user_authentication","key_storage","status","eudi_wallet_info","general_info","wallet_provider_name","wallet_solution_id","wallet_solution_version","key_storage_info","keys_exportable","boolean","storage_type","iss","iat","UnixTime","exp","exports"],"sourceRoot":"../../../../src","sources":["wallet-unit-attestation/api/types.ts"],"mappings":";;;;;;AAAA,IAAAA,CAAA,GAAAC,uBAAA,CAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,IAAA,GAAAF,OAAA;AAAsC,SAAAG,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAL,wBAAAS,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAEtC,MAAMW,MAAM,GAAG3B,CAAC,CAAC4B,MAAM,CAAC;EACtBC,WAAW,EAAE7B,CAAC,CAAC4B,MAAM,CAAC;IACpBE,GAAG,EAAE9B,CAAC,CAAC+B,MAAM,CAAC,CAAC;IACfC,GAAG,EAAEhC,CAAC,CAACiC,MAAM,CAAC;EAChB,CAAC;AACH,CAAC,CAAC;;AAEF;AACA;AACA;AACA;;AAIO,MAAMC,4BAA4B,GAAGlC,CAAC,CAAC4B,MAAM,CAAC;EACnDO,aAAa,EAAEnC,CAAC,CAACoC,KAAK,CAACC,QAAG,CAAC;EAC3BC,mBAAmB,EAAEtC,CAAC,CAACoC,KAAK,CAACpC,CAAC,CAACiC,MAAM,CAAC,CAAC,CAAC;EACxCM,WAAW,EAAEvC,CAAC,CAACoC,KAAK,CAACpC,CAAC,CAACiC,MAAM,CAAC,CAAC,CAAC;EAChCO,MAAM,EAAEb,MAAM;EACdc,gBAAgB,EAAEzC,CAAC,CAAC4B,MAAM,CAAC;IACzBc,YAAY,EAAE1C,CAAC,CAAC4B,MAAM,CAAC;MACrBe,oBAAoB,EAAE3C,CAAC,CAACiC,MAAM,CAAC,CAAC;MAChCW,kBAAkB,EAAE5C,CAAC,CAACiC,MAAM,CAAC,CAAC;MAC9BY,uBAAuB,EAAE7C,CAAC,CAACiC,MAAM,CAAC;IACpC,CAAC,CAAC;IACFa,gBAAgB,EAAE9C,CAAC,CAAC4B,MAAM,CAAC;MACzBmB,eAAe,EAAE/C,CAAC,CAACgD,OAAO,CAAC,CAAC;MAC5BC,YAAY,EAAEjD,CAAC,CAACiC,MAAM,CAAC;IACzB,CAAC;EACH,CAAC,CAAC;EACFiB,GAAG,EAAElD,CAAC,CAACiC,MAAM,CAAC,CAAC;EACfkB,GAAG,EAAEC,cAAQ;EACbC,GAAG,EAAED;AACP,CAAC,CAAC;AAACE,OAAA,CAAApB,4BAAA,GAAAA,4BAAA"}
+{"version":3,"names":["z","_interopRequireWildcard","require","_zod2","_jwk","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","Status","object","status_list","idx","number","uri","string","DecodedWalletUnitAttestation","attested_keys","array","JWK","user_authentication","key_storage","status","iss","iat","UnixTime","exp","exports"],"sourceRoot":"../../../../src","sources":["wallet-unit-attestation/api/types.ts"],"mappings":";;;;;;AAAA,IAAAA,CAAA,GAAAC,uBAAA,CAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,IAAA,GAAAF,OAAA;AAAsC,SAAAG,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAL,wBAAAS,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAEtC,MAAMW,MAAM,GAAG3B,CAAC,CAAC4B,MAAM,CAAC;EACtBC,WAAW,EAAE7B,CAAC,CAAC4B,MAAM,CAAC;IACpBE,GAAG,EAAE9B,CAAC,CAAC+B,MAAM,CAAC,CAAC;IACfC,GAAG,EAAEhC,CAAC,CAACiC,MAAM,CAAC;EAChB,CAAC;AACH,CAAC,CAAC;;AAEF;AACA;AACA;AACA;;AAIO,MAAMC,4BAA4B,GAAGlC,CAAC,CAAC4B,MAAM,CAAC;EACnDO,aAAa,EAAEnC,CAAC,CAACoC,KAAK,CAACC,QAAG,CAAC;EAC3BC,mBAAmB,EAAEtC,CAAC,CAACoC,KAAK,CAACpC,CAAC,CAACiC,MAAM,CAAC,CAAC,CAAC;EACxCM,WAAW,EAAEvC,CAAC,CAACoC,KAAK,CAACpC,CAAC,CAACiC,MAAM,CAAC,CAAC,CAAC;EAChCO,MAAM,EAAEb,MAAM;EACdc,GAAG,EAAEzC,CAAC,CAACiC,MAAM,CAAC,CAAC;EACfS,GAAG,EAAEC,cAAQ;EACbC,GAAG,EAAED;AACP,CAAC,CAAC;AAACE,OAAA,CAAAX,4BAAA,GAAAA,4BAAA"}

package/lib/module/credential/issuance/README.md

@@ -8,6 +8,8 @@ Credentials instead require a simpler authorization flow and they require other
 
 The supported credentials are defined in the entity configuration of the issuer which is evaluted and parsed in the `evaluateIssuerTrust` step. Available credentials are identified with a unique `credential_configuration_id`, that must be used when requesting authorization. The Authorization Server returns an array of **credential identifiers** that map to the `credential_configuration_id` provided: to obtain the credential, one of the credential identifiers (or all of them) must be requested to the credential endpoint.
 
+In the newest versions of IT-Wallet specifications it is mandatory that the cryptographic keys bound to each credential are stored in a WSCD and attested in a **Wallet Unit Attestation**, that must be sent to the Issuer when requesting a credential.
+
 ## Sequence Diagram
 
 ```mermaid
@@ -20,8 +22,9 @@ graph TD;
     C4.1[completeUserAuthorizationWithFormPostJwtMode]
     E4[completeUserAuthorizationWithQueryMode]
     5[authorizeAccess]
-    6[obtainCredential]
-    7[verifyAndParseCredential]
+    6[WalletUnitAttestation.getAttestation]
+    7[obtainCredential]
+    8[verifyAndParseCredential]
     credSel{Is credential an eID?}
     proofSel{Requires MRTD PoP?}
     M1[continueUserAuthorizationWithMRTDPoPChallenge]
@@ -44,6 +47,7 @@ graph TD;
     E4 --> 5
     5 --> 6
     6 --> 7
+    7 --> 8
 
     M1 --> M2
     M2 --> M3
@@ -92,6 +96,10 @@ When the credential is different than an eID, the flow requires the user to pres
 
 The expected result from the authentication process is in `form_post.jwt` format as defined in [JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)](https://openid.net/specs/oauth-v2-jarm.html#name-response-mode-form_postjwt).
 
+## Batch issuance
+
+To obtain a batch of credentials the Issuance module exposes a dedicated method—`obtainCredentialsBatch`—that returns a list of credentials of the same type with different cryptographic data. For this reason the caller must generate multiple keys and attest them in a single Wallet Unit Attestation.
+
 ## Examples
 
 <details>
@@ -119,12 +127,28 @@ const { WALLET_PROVIDER_BASE_URL, WALLET_EAA_PROVIDER_BASE_URL, REDIRECT_URI } =
  * WARNING: The integrity context must be the same used when creating the Wallet Instance with the same keytag.
  */
 const walletInstanceAttestation =
-  await WalletInstanceAttestation.getAttestation({
-    wiaCryptoContext,
-    integrityContext,
-    walletProviderBaseUrl: WALLET_PROVIDER_BASE_URL,
-    appFetch,
-  });
+  await wallet.WalletInstanceAttestation.getAttestation(
+    {
+      walletProviderBaseUrl: WALLET_PROVIDER_BASE_URL,
+      walletSolutionId: "exampleId",
+      walletSolutionVersion: "1.2.3",
+    },
+    {
+      wiaCryptoContext,
+      integrityContext,
+      appFetch,
+    }
+  );
+
+const credentialKeyTag = uuidv4().toString();
+let walletUnitAttestation: string | undefined;
+
+// Obtains a Wallet Unit Attestation if supported
+if (wallet.WalletUnitAttestation.isSupported) {
+  walletUnitAttestation = await wallet.WalletUnitAttestation.getAttestation(); // See the Wallet Unit Attestation README for more details
+} else {
+  await generate(credentialKeyTag); // Let's assume this function generates a new hardware-backed key pair
+}
 
 const pid = {
   credential: "example",
@@ -133,9 +157,6 @@ const pid = {
   credentialType: "PersonIdentificationData";
 };
 
-// Create credential crypto context
-const credentialKeyTag = uuidv4().toString();
-await generate(credentialKeyTag); // Let's assume this function generates a new hardware-backed key pair
 const credentialCryptoContext = createCryptoContextFor(credentialKeyTag);
 
 // Evaluate issuer trust
@@ -271,12 +292,18 @@ const { WALLET_PROVIDER_BASE_URL, WALLET_EID_PROVIDER_BASE_URL, REDIRECT_URI } =
  * WARNING: The integrity context must be the same used when creating the Wallet Instance with the same keytag.
  */
 const walletInstanceAttestation =
-  await WalletInstanceAttestation.getAttestation({
-    wiaCryptoContext,
-    integrityContext,
-    walletProviderBaseUrl: WALLET_PROVIDER_BASE_URL,
-    appFetch,
-  });
+  await wallet.WalletInstanceAttestation.getAttestation(
+    {
+      walletProviderBaseUrl: WALLET_PROVIDER_BASE_URL,
+      walletSolutionId: "exampleId",
+      walletSolutionVersion: "1.2.3",
+    },
+    {
+      wiaCryptoContext,
+      integrityContext,
+      appFetch,
+    }
+  );
 
 const idpHit = "https://example.com"; // Let's assume this is the IDP hint
 

package/lib/module/credential/issuance/common/02-start-user-authorization.js

@@ -1,3 +1,4 @@
+import { IoWalletError } from "../../../utils/errors";
 import { LogLevel, Logger } from "../../../utils/logging";
 /**
  * Ensures that the credential type requested is supported by the issuer and contained in the
@@ -14,7 +15,7 @@ export const selectCredentialDefinition = (issuerConf, credentialId) => {
   }));
   if (!result) {
     Logger.log(LogLevel.ERROR, `Requested credential ${credentialId} is not supported by the issuer according to its configuration ${JSON.stringify(credential_configurations_supported)}`);
-    throw new Error(`No credential support the type '${credentialId}'`);
+    throw new IoWalletError(`No credential support the type '${credentialId}'`);
   }
   return result;
 };
@@ -33,14 +34,14 @@ export const selectResponseMode = (issuerConf, credentialIds) => {
   }
   if (responseModeSet.size !== 1) {
     Logger.log(LogLevel.ERROR, `${credentialIds} have incompatible response_mode: ${[...responseModeSet.values()]}`);
-    throw new Error("Requested credentials have incompatible response_mode and cannot be requested with the same PAR request");
+    throw new IoWalletError("Requested credentials have incompatible response_mode and cannot be requested with the same PAR request");
   }
   const [responseMode] = responseModeSet.values();
   Logger.log(LogLevel.DEBUG, `Selected response mode ${responseMode} for credential IDs ${credentialIds}`);
   const responseModeSupported = issuerConf.response_modes_supported;
   if (responseModeSupported && !responseModeSupported.includes(responseMode)) {
     Logger.log(LogLevel.ERROR, `Requested response mode ${responseMode} is not supported by the issuer according to its configuration ${JSON.stringify(responseModeSupported)}`);
-    throw new Error(`No response mode support for IDs '${credentialIds}'`);
+    throw new IoWalletError(`No response mode support for IDs '${credentialIds}'`);
   }
   return responseMode;
 };

package/lib/module/credential/issuance/common/02-start-user-authorization.js.map

@@ -1 +1 @@
-{"version":3,"names":["LogLevel","Logger","selectCredentialDefinition","issuerConf","credentialId","credential_configurations_supported","result","Object","keys","filter","e","includes","map","credential_configuration_id","type","log","ERROR","JSON","stringify","Error","selectResponseMode","credentialIds","responseModeSet","Set","add","match","size","values","responseMode","DEBUG","responseModeSupported","response_modes_supported"],"sourceRoot":"../../../../../src","sources":["credential/issuance/common/02-start-user-authorization.ts"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,QAAQ,wBAAwB;AAMzD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,0BAA0B,GAAGA,CACxCC,UAAwB,EACxBC,YAAoB,KACI;EACxB,MAAMC,mCAAmC,GACvCF,UAAU,CAACE,mCAAmC;EAEhD,MAAM,CAACC,MAAM,CAAC,GAAGC,MAAM,CAACC,IAAI,CAACH,mCAAmC,CAAC,CAC9DI,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,QAAQ,CAACP,YAAY,CAAC,CAAC,CACvCQ,GAAG,CAAC,OAAO;IACVC,2BAA2B,EAAET,YAAY;IACzCU,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACR,MAAM,EAAE;IACXL,MAAM,CAACc,GAAG,CACRf,QAAQ,CAACgB,KAAK,EACb,wBAAuBZ,YAAa,kEAAiEa,IAAI,CAACC,SAAS,CAACb,mCAAmC,CAAE,EAC5J,CAAC;IACD,MAAM,IAAIc,KAAK,CAAE,mCAAkCf,YAAa,GAAE,CAAC;EACrE;EACA,OAAOE,MAAM;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMc,kBAAkB,GAAGA,CAChCjB,UAAwB,EACxBkB,aAAuB,KACN;EACjB,MAAMC,eAAe,GAAG,IAAIC,GAAG,CAAe,CAAC;EAE/C,KAAK,MAAMnB,YAAY,IAAIiB,aAAa,EAAE;IACxCC,eAAe,CAACE,GAAG,CACjBpB,YAAY,CAACqB,KAAK,CAAC,2BAA2B,CAAC,GAC3C,OAAO,GACP,eACN,CAAC;EACH;EAEA,IAAIH,eAAe,CAACI,IAAI,KAAK,CAAC,EAAE;IAC9BzB,MAAM,CAACc,GAAG,CACRf,QAAQ,CAACgB,KAAK,EACb,GAAEK,aAAc,qCAAoC,CAAC,GAAGC,eAAe,CAACK,MAAM,CAAC,CAAC,CAAE,EACrF,CAAC;IACD,MAAM,IAAIR,KAAK,CACb,yGACF,CAAC;EACH;EAEA,MAAM,CAACS,YAAY,CAAC,GAAGN,eAAe,CAACK,MAAM,CAAC,CAAC;EAE/C1B,MAAM,CAACc,GAAG,CACRf,QAAQ,CAAC6B,KAAK,EACb,0BAAyBD,YAAa,uBAAsBP,aAAc,EAC7E,CAAC;EAED,MAAMS,qBAAqB,GAAG3B,UAAU,CAAC4B,wBAAwB;EACjE,IAAID,qBAAqB,IAAI,CAACA,qBAAqB,CAACnB,QAAQ,CAACiB,YAAa,CAAC,EAAE;IAC3E3B,MAAM,CAACc,GAAG,CACRf,QAAQ,CAACgB,KAAK,EACb,2BAA0BY,YAAa,kEAAiEX,IAAI,CAACC,SAAS,CAACY,qBAAqB,CAAE,EACjJ,CAAC;IACD,MAAM,IAAIX,KAAK,CAAE,qCAAoCE,aAAc,GAAE,CAAC;EACxE;EAEA,OAAOO,YAAY;AACrB,CAAC"}
+{"version":3,"names":["IoWalletError","LogLevel","Logger","selectCredentialDefinition","issuerConf","credentialId","credential_configurations_supported","result","Object","keys","filter","e","includes","map","credential_configuration_id","type","log","ERROR","JSON","stringify","selectResponseMode","credentialIds","responseModeSet","Set","add","match","size","values","responseMode","DEBUG","responseModeSupported","response_modes_supported"],"sourceRoot":"../../../../../src","sources":["credential/issuance/common/02-start-user-authorization.ts"],"mappings":"AAAA,SAASA,aAAa,QAAQ,uBAAuB;AACrD,SAASC,QAAQ,EAAEC,MAAM,QAAQ,wBAAwB;AAMzD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,0BAA0B,GAAGA,CACxCC,UAAwB,EACxBC,YAAoB,KACI;EACxB,MAAMC,mCAAmC,GACvCF,UAAU,CAACE,mCAAmC;EAEhD,MAAM,CAACC,MAAM,CAAC,GAAGC,MAAM,CAACC,IAAI,CAACH,mCAAmC,CAAC,CAC9DI,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,QAAQ,CAACP,YAAY,CAAC,CAAC,CACvCQ,GAAG,CAAC,OAAO;IACVC,2BAA2B,EAAET,YAAY;IACzCU,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACR,MAAM,EAAE;IACXL,MAAM,CAACc,GAAG,CACRf,QAAQ,CAACgB,KAAK,EACb,wBAAuBZ,YAAa,kEAAiEa,IAAI,CAACC,SAAS,CAACb,mCAAmC,CAAE,EAC5J,CAAC;IACD,MAAM,IAAIN,aAAa,CAAE,mCAAkCK,YAAa,GAAE,CAAC;EAC7E;EACA,OAAOE,MAAM;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMa,kBAAkB,GAAGA,CAChChB,UAAwB,EACxBiB,aAAuB,KACN;EACjB,MAAMC,eAAe,GAAG,IAAIC,GAAG,CAAe,CAAC;EAE/C,KAAK,MAAMlB,YAAY,IAAIgB,aAAa,EAAE;IACxCC,eAAe,CAACE,GAAG,CACjBnB,YAAY,CAACoB,KAAK,CAAC,2BAA2B,CAAC,GAC3C,OAAO,GACP,eACN,CAAC;EACH;EAEA,IAAIH,eAAe,CAACI,IAAI,KAAK,CAAC,EAAE;IAC9BxB,MAAM,CAACc,GAAG,CACRf,QAAQ,CAACgB,KAAK,EACb,GAAEI,aAAc,qCAAoC,CAAC,GAAGC,eAAe,CAACK,MAAM,CAAC,CAAC,CAAE,EACrF,CAAC;IACD,MAAM,IAAI3B,aAAa,CACrB,yGACF,CAAC;EACH;EAEA,MAAM,CAAC4B,YAAY,CAAC,GAAGN,eAAe,CAACK,MAAM,CAAC,CAAC;EAE/CzB,MAAM,CAACc,GAAG,CACRf,QAAQ,CAAC4B,KAAK,EACb,0BAAyBD,YAAa,uBAAsBP,aAAc,EAC7E,CAAC;EAED,MAAMS,qBAAqB,GAAG1B,UAAU,CAAC2B,wBAAwB;EACjE,IAAID,qBAAqB,IAAI,CAACA,qBAAqB,CAAClB,QAAQ,CAACgB,YAAa,CAAC,EAAE;IAC3E1B,MAAM,CAACc,GAAG,CACRf,QAAQ,CAACgB,KAAK,EACb,2BAA0BW,YAAa,kEAAiEV,IAAI,CAACC,SAAS,CAACW,qBAAqB,CAAE,EACjJ,CAAC;IACD,MAAM,IAAI9B,aAAa,CACpB,qCAAoCqB,aAAc,GACrD,CAAC;EACH;EAEA,OAAOO,YAAY;AACrB,CAAC"}

package/lib/module/credential/issuance/common/06-verify-and-parse-credential.sdjwt.js

@@ -1,11 +1,13 @@
-import { getJwkFromHeader, decode } from "@pagopa/io-react-native-jwt";
+import { verify as verifyJwt } from "@pagopa/io-react-native-jwt";
 import { SDJwtInstance } from "@sd-jwt/core";
-import { digest, ES256 } from "@sd-jwt/crypto-nodejs";
+import { digest } from "@sd-jwt/crypto-nodejs";
 import { isPathEqual, isPrefixOf } from "../../../utils/parser";
 import { IoWalletError } from "../../../utils/errors";
 import { LogLevel, Logger } from "../../../utils/logging";
 import { isSameThumbprint } from "../../../utils/jwk";
 import { fixLegacyCredentialSdJwt } from "../../../utils/credentials";
+import { verifyX509Chain } from "../../../utils/x509";
+import { MissingX509CertsError } from "../../../trust/common/errors";
 /**
  * Parse a Sd-Jwt credential according to the issuer configuration
  * @param credentialConfig - the list of supported credentials, as defined in the issuer configuration with their claims metadata
@@ -112,6 +114,23 @@ const parseCredentialSdJwt = function (credentialConfig, parsedCredentialRaw) {
   return processLevel(parsedCredentialRaw, []);
 };
 
+/**
+ * JWT verifier implementing the interface expected by the SD-JWT library.
+ * Verification is delegated to `io-react-native-jwt` to leverage its support for multiple algorithms.
+ * @returns Boolean indicating whether the verification succeeded or not
+ */
+const sdJwtInstanceVerifier = async (data, signature, options) => {
+  if (!(options !== null && options !== void 0 && options.issuerKeys)) {
+    return false;
+  }
+  try {
+    await verifyJwt(`${data}.${signature}`, options.issuerKeys);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
 /**
  * Given a credential, verify it's in the supported format
  * and the credential is correctly signed
@@ -128,15 +147,13 @@ const parseCredentialSdJwt = function (credentialConfig, parsedCredentialRaw) {
  *
  */
 async function verifyCredentialSdJwt(rawCredential, issuerKeys, holderBindingContext) {
-  const {
-    protectedHeader
-  } = decode(rawCredential);
-  const verifierJwk = getJwkFromHeader(protectedHeader, issuerKeys);
   const sdJwtInstance = new SDJwtInstance({
     hasher: digest,
-    verifier: await ES256.getVerifier(verifierJwk)
+    verifier: sdJwtInstanceVerifier
   });
-  const [verifiedCredential, holderBindingKey] = await Promise.all([sdJwtInstance.verify(rawCredential), holderBindingContext.getPublicKey()]);
+  const [verifiedCredential, holderBindingKey] = await Promise.all([sdJwtInstance.verify(rawCredential, {
+    issuerKeys
+  }), holderBindingContext.getPublicKey()]);
   const {
     cnf
   } = verifiedCredential.payload;
@@ -147,14 +164,26 @@ async function verifyCredentialSdJwt(rawCredential, issuerKeys, holderBindingCon
   }
   return await sdJwtInstance.decode(fixLegacyCredentialSdJwt(rawCredential));
 }
-export const verifyAndParseCredentialSdJwt = async (issuerConf, credential, credentialConfigurationId, _ref) => {
+export const verifyAndParseCredentialSdJwt = async (issuerConf, credential, credentialConfigurationId, _ref, x509CertRoot) => {
   let {
     credentialCryptoContext,
     ignoreMissingAttributes,
-    includeUndefinedAttributes
+    includeUndefinedAttributes,
+    validateCertificateChain
   } = _ref;
   const decoded = await verifyCredentialSdJwt(credential, issuerConf.keys, credentialCryptoContext);
   Logger.log(LogLevel.DEBUG, `Decoded credential: ${JSON.stringify(decoded)}`);
+  if (validateCertificateChain) {
+    var _decoded$jwt;
+    if (!x509CertRoot) {
+      throw new IoWalletError("Missing x509CertRoot");
+    }
+    const x5c = (_decoded$jwt = decoded.jwt) === null || _decoded$jwt === void 0 || (_decoded$jwt = _decoded$jwt.header) === null || _decoded$jwt === void 0 ? void 0 : _decoded$jwt.x5c;
+    if (!x5c || !Array.isArray(x5c) || x5c.length === 0) {
+      throw new MissingX509CertsError("Missing x509 certificates");
+    }
+    await verifyX509Chain(x5c, x509CertRoot);
+  }
   const credentialConfig = issuerConf.credential_configurations_supported[credentialConfigurationId];
   if (!credentialConfig) {
     Logger.log(LogLevel.ERROR, `Credential type not supported by the issuer: ${credentialConfigurationId}`);

package/lib/module/credential/issuance/common/06-verify-and-parse-credential.sdjwt.js.map

@@ -1 +1 @@
-{"version":3,"names":["getJwkFromHeader","decode","SDJwtInstance","digest","ES256","isPathEqual","isPrefixOf","IoWalletError","LogLevel","Logger","isSameThumbprint","fixLegacyCredentialSdJwt","parseCredentialSdJwt","credentialConfig","parsedCredentialRaw","ignoreMissingAttributes","arguments","length","undefined","includeUndefinedAttributes","claimsMetadata","claims","missingPaths","rootKeysToVerify","Set","map","c","path","filter","p","rootKey","push","missing","join","received","Object","keys","getDisplayNames","match","find","nameMap","entry","display","locale","name","processLevel","currentData","currentPath","Array","isArray","item","dataObj","result","processedKeys","configKeysAtThisLevel","claim","nextPart","includes","key","stringKey","toString","dataValue","newPath","localizedNames","value","add","entries","has","verifyCredentialSdJwt","rawCredential","issuerKeys","holderBindingContext","protectedHeader","verifierJwk","sdJwtInstance","hasher","verifier","getVerifier","verifiedCredential","holderBindingKey","Promise","all","verify","getPublicKey","cnf","payload","jwk","message","kid","log","ERROR","verifyAndParseCredentialSdJwt","issuerConf","credential","credentialConfigurationId","_ref","credentialCryptoContext","decoded","DEBUG","JSON","stringify","credential_configurations_supported","getClaims","parsedCredential","issuedAt","iat","Date","exp","expiration"],"sourceRoot":"../../../../../src","sources":["credential/issuance/common/06-verify-and-parse-credential.sdjwt.ts"],"mappings":"AAAA,SACEA,gBAAgB,EAEhBC,MAAM,QACD,6BAA6B;AACpC,SAAqBC,aAAa,QAAQ,cAAc;AACxD,SAASC,MAAM,EAAEC,KAAK,QAAQ,uBAAuB;AACrD,SAASC,WAAW,EAAEC,UAAU,QAAQ,uBAAuB;AAC/D,SAASC,aAAa,QAAQ,uBAAuB;AACrD,SAASC,QAAQ,EAAEC,MAAM,QAAQ,wBAAwB;AACzD,SAASC,gBAAgB,QAAkB,oBAAoB;AAE/D,SAASC,wBAAwB,QAAQ,4BAA4B;AAMrE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,oBAAoB,GAAG,SAAAA,CAC3BC,gBAAgC,EAChCC,mBAA4C,EAGvB;EAAA,IAFrBC,uBAAgC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,KAAK;EAAA,IACxCG,0BAAmC,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,KAAK;EAE3C,MAAMI,cAAc,GAAGP,gBAAgB,CAACQ,MAAM,IAAI,EAAE;;EAEpD;EACA,IAAI,CAACN,uBAAuB,EAAE;IAC5B,MAAMO,YAAsB,GAAG,EAAE;IACjC,MAAMC,gBAAgB,GAAG,IAAIC,GAAG,CAC9BJ,cAAc,CACXK,GAAG,CAAEC,CAAC,IAAKA,CAAC,CAACC,IAAI,CAAC,CAAC,CAAC,CAAC,CACrBC,MAAM,CAAEC,CAAC,IAAkB,OAAOA,CAAC,KAAK,QAAQ,CACrD,CAAC;IAED,KAAK,MAAMC,OAAO,IAAIP,gBAAgB,EAAE;MACtC,IAAI,EAAEO,OAAO,IAAIhB,mBAAmB,CAAC,EAAE;QACrCQ,YAAY,CAACS,IAAI,CAACD,OAAO,CAAC;MAC5B;IACF;IAEA,IAAIR,YAAY,CAACL,MAAM,GAAG,CAAC,EAAE;MAC3B,MAAMe,OAAO,GAAGV,YAAY,CAACW,IAAI,CAAC,IAAI,CAAC;MACvC,MAAMC,QAAQ,GAAGC,MAAM,CAACC,IAAI,CAACtB,mBAAmB,CAAC,CAACmB,IAAI,CAAC,IAAI,CAAC;MAC5D,MAAM,IAAI1B,aAAa,CACpB,4DAA2DyB,OAAQ,iBAAgBE,QAAS,GAC/F,CAAC;IACH;EACF;;EAEA;AACF;AACA;EACE,MAAMG,eAAe,GACnBV,IAAgC,IACO;IACvC,MAAMW,KAAK,GAAGlB,cAAc,CAACmB,IAAI,CAAEb,CAAC,IAAKrB,WAAW,CAACqB,CAAC,CAACC,IAAI,EAAEA,IAAI,CAAC,CAAC;IACnE,IAAI,CAACW,KAAK,EAAE,OAAOpB,SAAS;IAE5B,MAAMsB,OAA+B,GAAG,CAAC,CAAC;IAC1C,KAAK,MAAMC,KAAK,IAAIH,KAAK,CAACI,OAAO,EAAE;MACjCF,OAAO,CAACC,KAAK,CAACE,MAAM,CAAC,GAAGF,KAAK,CAACG,IAAI;IACpC;IACA,OAAOJ,OAAO;EAChB,CAAC;;EAED;AACF;AACA;EACE,MAAMK,YAAY,GAAGA,CACnBC,WAAoB,EACpBC,WAAuC,KAC3B;IACZ;IACA,IAAIC,KAAK,CAACC,OAAO,CAACH,WAAW,CAAC,EAAE;MAC9B,OAAOA,WAAW,CAACrB,GAAG,CAAEyB,IAAI,IAC1BL,YAAY,CAACK,IAAI,EAAE,CAAC,GAAGH,WAAW,EAAE,IAAI,CAAC,CAC3C,CAAC;IACH;;IAEA;IACA,IAAI,OAAOD,WAAW,KAAK,QAAQ,IAAIA,WAAW,KAAK,IAAI,EAAE;MAC3D,OAAOA,WAAW;IACpB;IAEA,MAAMK,OAAO,GAAGL,WAAsC;IACtD,MAAMM,MAAwB,GAAG,CAAC,CAAC;IACnC,MAAMC,aAAa,GAAG,IAAI7B,GAAG,CAAkB,CAAC;;IAEhD;IACA,MAAM8B,qBAA0C,GAAG,EAAE;IACrD,KAAK,MAAMC,KAAK,IAAInC,cAAc,EAAE;MAClC;MACA,IAAId,UAAU,CAACyC,WAAW,EAAEQ,KAAK,CAAC5B,IAAI,CAAC,EAAE;QACvC,MAAM6B,QAAQ,GAAGD,KAAK,CAAC5B,IAAI,CAACoB,WAAW,CAAC9B,MAAM,CAAC;QAC/C,IACE,CAAC,OAAOuC,QAAQ,KAAK,QAAQ,IAAI,OAAOA,QAAQ,KAAK,QAAQ,KAC7D,CAACF,qBAAqB,CAACG,QAAQ,CAACD,QAAQ,CAAC,EACzC;UACAF,qBAAqB,CAACvB,IAAI,CAACyB,QAAQ,CAAC;QACtC;MACF;IACF;;IAEA;IACA,KAAK,MAAME,GAAG,IAAIJ,qBAAqB,EAAE;MACvC,MAAMK,SAAS,GAAGD,GAAG,CAACE,QAAQ,CAAC,CAAC;MAChC,MAAMC,SAAS,GAAGV,OAAO,CAACQ,SAAS,CAAC;MACpC,IAAIE,SAAS,KAAK3C,SAAS,EAAE;MAE7B,MAAM4C,OAAO,GAAG,CAAC,GAAGf,WAAW,EAAEW,GAAG,CAAC;MAErC,IAAIK,cAAc,GAAG1B,eAAe,CAACyB,OAAO,CAAC;;MAE7C;MACA,IAAI,CAACC,cAAc,IAAIf,KAAK,CAACC,OAAO,CAACY,SAAS,CAAC,EAAE;QAC/CE,cAAc,GAAG1B,eAAe,CAAC,CAAC,GAAGyB,OAAO,EAAE,IAAI,CAAC,CAAC;MACtD;MAEAV,MAAM,CAACO,SAAS,CAAC,GAAG;QAClBf,IAAI,EAAEmB,cAAc,IAAIJ,SAAS;QACjCK,KAAK,EAAEnB,YAAY,CAACgB,SAAS,EAAEC,OAAO;MACxC,CAAC;MAEDT,aAAa,CAACY,GAAG,CAACP,GAAG,CAAC;IACxB;;IAEA;IACA,IAAIvC,0BAA0B,EAAE;MAC9B,KAAK,MAAM,CAACuC,GAAG,EAAEM,KAAK,CAAC,IAAI7B,MAAM,CAAC+B,OAAO,CAACf,OAAO,CAAC,EAAE;QAClD,IAAI,CAACE,aAAa,CAACc,GAAG,CAACT,GAAG,CAAC,EAAE;UAC3BN,MAAM,CAACM,GAAG,CAAC,GAAG;YACZd,IAAI,EAAEc,GAAG;YACTM,KAAK,EAAEA;UACT,CAAC;QACH;MACF;IACF;IAEA,OAAOZ,MAAM;EACf,CAAC;EAED,OAAOP,YAAY,CAAC/B,mBAAmB,EAAE,EAAE,CAAC;AAC9C,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAesD,qBAAqBA,CAClCC,aAAqB,EACrBC,UAAiB,EACjBC,oBAAmC,EACnB;EAChB,MAAM;IAAEC;EAAgB,CAAC,GAAGvE,MAAM,CAACoE,aAAa,CAAC;EACjD,MAAMI,WAAW,GAAGzE,gBAAgB,CAACwE,eAAe,EAAEF,UAAU,CAAC;EAEjE,MAAMI,aAAa,GAAG,IAAIxE,aAAa,CAAC;IACtCyE,MAAM,EAAExE,MAAM;IACdyE,QAAQ,EAAE,MAAMxE,KAAK,CAACyE,WAAW,CAACJ,WAAW;EAC/C,CAAC,CAAC;EAEF,MAAM,CAACK,kBAAkB,EAAEC,gBAAgB,CAAC,GAAG,MAAMC,OAAO,CAACC,GAAG,CAAC,CAC/DP,aAAa,CAACQ,MAAM,CAACb,aAAa,CAAC,EACnCE,oBAAoB,CAACY,YAAY,CAAC,CAAC,CACpC,CAAC;EAEF,MAAM;IAAEC;EAAI,CAAC,GAAGN,kBAAkB,CAACO,OAAkC;EACrE,IAAI,EAAE,MAAM3E,gBAAgB,CAAC0E,GAAG,CAACE,GAAG,EAAEP,gBAAuB,CAAC,CAAC,EAAE;IAC/D,MAAMQ,OAAO,GAAI,kDAAiDR,gBAAgB,CAACS,GAAI,UAASJ,GAAG,CAACE,GAAG,CAACE,GAAI,EAAC;IAC7G/E,MAAM,CAACgF,GAAG,CAACjF,QAAQ,CAACkF,KAAK,EAAEH,OAAO,CAAC;IACnC,MAAM,IAAIhF,aAAa,CAACgF,OAAO,CAAC;EAClC;EAEA,OAAO,MAAMb,aAAa,CAACzE,MAAM,CAACU,wBAAwB,CAAC0D,aAAa,CAAC,CAAC;AAC5E;AAEA,OAAO,MAAMsB,6BAAsE,GACjF,MAAAA,CACEC,UAAU,EACVC,UAAU,EACVC,yBAAyB,EAAAC,IAAA,KAMtB;EAAA,IALH;IACEC,uBAAuB;IACvBjF,uBAAuB;IACvBI;EACF,CAAC,GAAA4E,IAAA;EAED,MAAME,OAAO,GAAG,MAAM7B,qBAAqB,CACzCyB,UAAU,EACVD,UAAU,CAACxD,IAAI,EACf4D,uBACF,CAAC;EAEDvF,MAAM,CAACgF,GAAG,CACRjF,QAAQ,CAAC0F,KAAK,EACb,uBAAsBC,IAAI,CAACC,SAAS,CAACH,OAAO,CAAE,EACjD,CAAC;EAED,MAAMpF,gBAAgB,GACpB+E,UAAU,CAACS,mCAAmC,CAACP,yBAAyB,CAAC;EAE3E,IAAI,CAACjF,gBAAgB,EAAE;IACrBJ,MAAM,CAACgF,GAAG,CACRjF,QAAQ,CAACkF,KAAK,EACb,gDAA+CI,yBAA0B,EAC5E,CAAC;IACD,MAAM,IAAIvF,aAAa,CAAC,6CAA6C,CAAC;EACxE;EAEA,MAAMO,mBAAmB,GAAI,MAAMmF,OAAO,CAACK,SAAS,CAACnG,MAAM,CAG1D;EAED,MAAMoG,gBAAgB,GAAG3F,oBAAoB,CAC3CC,gBAAgB,EAChBC,mBAAmB,EACnBC,uBAAuB,EACvBI,0BACF,CAAC;EAED,MAAMqF,QAAQ,GACZ,OAAO1F,mBAAmB,CAAC2F,GAAG,KAAK,QAAQ,GACvC,IAAIC,IAAI,CAAC5F,mBAAmB,CAAC2F,GAAG,GAAG,IAAI,CAAC,GACxCvF,SAAS;EAEf,IAAI,OAAOJ,mBAAmB,CAAC6F,GAAG,KAAK,QAAQ,EAAE;IAC/C,MAAM,IAAIpG,aAAa,CAAC,2CAA2C,CAAC;EACtE;EACA,MAAMqG,UAAU,GAAG,IAAIF,IAAI,CAAC5F,mBAAmB,CAAC6F,GAAG,GAAG,IAAI,CAAC;EAE3DlG,MAAM,CAACgF,GAAG,CACRjF,QAAQ,CAAC0F,KAAK,EACb,sBAAqBC,IAAI,CAACC,SAAS,CAACG,gBAAgB,CAAE,gBAAeC,QAAS,EACjF,CAAC;EAED,OAAO;IACLD,gBAAgB;IAChBK,UAAU;IACVJ;EACF,CAAC;AACH,CAAC"}
+{"version":3,"names":["verify","verifyJwt","SDJwtInstance","digest","isPathEqual","isPrefixOf","IoWalletError","LogLevel","Logger","isSameThumbprint","fixLegacyCredentialSdJwt","verifyX509Chain","MissingX509CertsError","parseCredentialSdJwt","credentialConfig","parsedCredentialRaw","ignoreMissingAttributes","arguments","length","undefined","includeUndefinedAttributes","claimsMetadata","claims","missingPaths","rootKeysToVerify","Set","map","c","path","filter","p","rootKey","push","missing","join","received","Object","keys","getDisplayNames","match","find","nameMap","entry","display","locale","name","processLevel","currentData","currentPath","Array","isArray","item","dataObj","result","processedKeys","configKeysAtThisLevel","claim","nextPart","includes","key","stringKey","toString","dataValue","newPath","localizedNames","value","add","entries","has","sdJwtInstanceVerifier","data","signature","options","issuerKeys","verifyCredentialSdJwt","rawCredential","holderBindingContext","sdJwtInstance","hasher","verifier","verifiedCredential","holderBindingKey","Promise","all","getPublicKey","cnf","payload","jwk","message","kid","log","ERROR","decode","verifyAndParseCredentialSdJwt","issuerConf","credential","credentialConfigurationId","_ref","x509CertRoot","credentialCryptoContext","validateCertificateChain","decoded","DEBUG","JSON","stringify","_decoded$jwt","x5c","jwt","header","credential_configurations_supported","getClaims","parsedCredential","issuedAt","iat","Date","exp","expiration"],"sourceRoot":"../../../../../src","sources":["credential/issuance/common/06-verify-and-parse-credential.sdjwt.ts"],"mappings":"AAAA,SAEEA,MAAM,IAAIC,SAAS,QACd,6BAA6B;AACpC,SAAqBC,aAAa,QAAQ,cAAc;AACxD,SAASC,MAAM,QAAQ,uBAAuB;AAE9C,SAASC,WAAW,EAAEC,UAAU,QAAQ,uBAAuB;AAC/D,SAASC,aAAa,QAAQ,uBAAuB;AACrD,SAASC,QAAQ,EAAEC,MAAM,QAAQ,wBAAwB;AACzD,SAASC,gBAAgB,QAAkB,oBAAoB;AAE/D,SAASC,wBAAwB,QAAQ,4BAA4B;AACrE,SAASC,eAAe,QAAQ,qBAAqB;AACrD,SAASC,qBAAqB,QAAQ,8BAA8B;AAMpE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,oBAAoB,GAAG,SAAAA,CAC3BC,gBAAgC,EAChCC,mBAA4C,EAGvB;EAAA,IAFrBC,uBAAgC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,KAAK;EAAA,IACxCG,0BAAmC,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,KAAK;EAE3C,MAAMI,cAAc,GAAGP,gBAAgB,CAACQ,MAAM,IAAI,EAAE;;EAEpD;EACA,IAAI,CAACN,uBAAuB,EAAE;IAC5B,MAAMO,YAAsB,GAAG,EAAE;IACjC,MAAMC,gBAAgB,GAAG,IAAIC,GAAG,CAC9BJ,cAAc,CACXK,GAAG,CAAEC,CAAC,IAAKA,CAAC,CAACC,IAAI,CAAC,CAAC,CAAC,CAAC,CACrBC,MAAM,CAAEC,CAAC,IAAkB,OAAOA,CAAC,KAAK,QAAQ,CACrD,CAAC;IAED,KAAK,MAAMC,OAAO,IAAIP,gBAAgB,EAAE;MACtC,IAAI,EAAEO,OAAO,IAAIhB,mBAAmB,CAAC,EAAE;QACrCQ,YAAY,CAACS,IAAI,CAACD,OAAO,CAAC;MAC5B;IACF;IAEA,IAAIR,YAAY,CAACL,MAAM,GAAG,CAAC,EAAE;MAC3B,MAAMe,OAAO,GAAGV,YAAY,CAACW,IAAI,CAAC,IAAI,CAAC;MACvC,MAAMC,QAAQ,GAAGC,MAAM,CAACC,IAAI,CAACtB,mBAAmB,CAAC,CAACmB,IAAI,CAAC,IAAI,CAAC;MAC5D,MAAM,IAAI5B,aAAa,CACpB,4DAA2D2B,OAAQ,iBAAgBE,QAAS,GAC/F,CAAC;IACH;EACF;;EAEA;AACF;AACA;EACE,MAAMG,eAAe,GACnBV,IAAgC,IACO;IACvC,MAAMW,KAAK,GAAGlB,cAAc,CAACmB,IAAI,CAAEb,CAAC,IAAKvB,WAAW,CAACuB,CAAC,CAACC,IAAI,EAAEA,IAAI,CAAC,CAAC;IACnE,IAAI,CAACW,KAAK,EAAE,OAAOpB,SAAS;IAE5B,MAAMsB,OAA+B,GAAG,CAAC,CAAC;IAC1C,KAAK,MAAMC,KAAK,IAAIH,KAAK,CAACI,OAAO,EAAE;MACjCF,OAAO,CAACC,KAAK,CAACE,MAAM,CAAC,GAAGF,KAAK,CAACG,IAAI;IACpC;IACA,OAAOJ,OAAO;EAChB,CAAC;;EAED;AACF;AACA;EACE,MAAMK,YAAY,GAAGA,CACnBC,WAAoB,EACpBC,WAAuC,KAC3B;IACZ;IACA,IAAIC,KAAK,CAACC,OAAO,CAACH,WAAW,CAAC,EAAE;MAC9B,OAAOA,WAAW,CAACrB,GAAG,CAAEyB,IAAI,IAC1BL,YAAY,CAACK,IAAI,EAAE,CAAC,GAAGH,WAAW,EAAE,IAAI,CAAC,CAC3C,CAAC;IACH;;IAEA;IACA,IAAI,OAAOD,WAAW,KAAK,QAAQ,IAAIA,WAAW,KAAK,IAAI,EAAE;MAC3D,OAAOA,WAAW;IACpB;IAEA,MAAMK,OAAO,GAAGL,WAAsC;IACtD,MAAMM,MAAwB,GAAG,CAAC,CAAC;IACnC,MAAMC,aAAa,GAAG,IAAI7B,GAAG,CAAkB,CAAC;;IAEhD;IACA,MAAM8B,qBAA0C,GAAG,EAAE;IACrD,KAAK,MAAMC,KAAK,IAAInC,cAAc,EAAE;MAClC;MACA,IAAIhB,UAAU,CAAC2C,WAAW,EAAEQ,KAAK,CAAC5B,IAAI,CAAC,EAAE;QACvC,MAAM6B,QAAQ,GAAGD,KAAK,CAAC5B,IAAI,CAACoB,WAAW,CAAC9B,MAAM,CAAC;QAC/C,IACE,CAAC,OAAOuC,QAAQ,KAAK,QAAQ,IAAI,OAAOA,QAAQ,KAAK,QAAQ,KAC7D,CAACF,qBAAqB,CAACG,QAAQ,CAACD,QAAQ,CAAC,EACzC;UACAF,qBAAqB,CAACvB,IAAI,CAACyB,QAAQ,CAAC;QACtC;MACF;IACF;;IAEA;IACA,KAAK,MAAME,GAAG,IAAIJ,qBAAqB,EAAE;MACvC,MAAMK,SAAS,GAAGD,GAAG,CAACE,QAAQ,CAAC,CAAC;MAChC,MAAMC,SAAS,GAAGV,OAAO,CAACQ,SAAS,CAAC;MACpC,IAAIE,SAAS,KAAK3C,SAAS,EAAE;MAE7B,MAAM4C,OAAO,GAAG,CAAC,GAAGf,WAAW,EAAEW,GAAG,CAAC;MAErC,IAAIK,cAAc,GAAG1B,eAAe,CAACyB,OAAO,CAAC;;MAE7C;MACA,IAAI,CAACC,cAAc,IAAIf,KAAK,CAACC,OAAO,CAACY,SAAS,CAAC,EAAE;QAC/CE,cAAc,GAAG1B,eAAe,CAAC,CAAC,GAAGyB,OAAO,EAAE,IAAI,CAAC,CAAC;MACtD;MAEAV,MAAM,CAACO,SAAS,CAAC,GAAG;QAClBf,IAAI,EAAEmB,cAAc,IAAIJ,SAAS;QACjCK,KAAK,EAAEnB,YAAY,CAACgB,SAAS,EAAEC,OAAO;MACxC,CAAC;MAEDT,aAAa,CAACY,GAAG,CAACP,GAAG,CAAC;IACxB;;IAEA;IACA,IAAIvC,0BAA0B,EAAE;MAC9B,KAAK,MAAM,CAACuC,GAAG,EAAEM,KAAK,CAAC,IAAI7B,MAAM,CAAC+B,OAAO,CAACf,OAAO,CAAC,EAAE;QAClD,IAAI,CAACE,aAAa,CAACc,GAAG,CAACT,GAAG,CAAC,EAAE;UAC3BN,MAAM,CAACM,GAAG,CAAC,GAAG;YACZd,IAAI,EAAEc,GAAG;YACTM,KAAK,EAAEA;UACT,CAAC;QACH;MACF;IACF;IAEA,OAAOZ,MAAM;EACf,CAAC;EAED,OAAOP,YAAY,CAAC/B,mBAAmB,EAAE,EAAE,CAAC;AAC9C,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA,MAAMsD,qBAAsD,GAAG,MAAAA,CAC7DC,IAAI,EACJC,SAAS,EACTC,OAAO,KACJ;EACH,IAAI,EAACA,OAAO,aAAPA,OAAO,eAAPA,OAAO,CAAEC,UAAU,GAAE;IACxB,OAAO,KAAK;EACd;EACA,IAAI;IACF,MAAMxE,SAAS,CAAE,GAAEqE,IAAK,IAAGC,SAAU,EAAC,EAAEC,OAAO,CAACC,UAAU,CAAC;IAC3D,OAAO,IAAI;EACb,CAAC,CAAC,MAAM;IACN,OAAO,KAAK;EACd;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,qBAAqBA,CAClCC,aAAqB,EACrBF,UAAiB,EACjBG,oBAAmC,EACnB;EAChB,MAAMC,aAAa,GAAG,IAAI3E,aAAa,CAAC;IACtC4E,MAAM,EAAE3E,MAAM;IACd4E,QAAQ,EAAEV;EACZ,CAAC,CAAC;EAEF,MAAM,CAACW,kBAAkB,EAAEC,gBAAgB,CAAC,GAAG,MAAMC,OAAO,CAACC,GAAG,CAAC,CAC/DN,aAAa,CAAC7E,MAAM,CAAC2E,aAAa,EAAE;IAAEF;EAAW,CAAC,CAAC,EACnDG,oBAAoB,CAACQ,YAAY,CAAC,CAAC,CACpC,CAAC;EAEF,MAAM;IAAEC;EAAI,CAAC,GAAGL,kBAAkB,CAACM,OAAkC;EACrE,IAAI,EAAE,MAAM7E,gBAAgB,CAAC4E,GAAG,CAACE,GAAG,EAAEN,gBAAuB,CAAC,CAAC,EAAE;IAC/D,MAAMO,OAAO,GAAI,kDAAiDP,gBAAgB,CAACQ,GAAI,UAASJ,GAAG,CAACE,GAAG,CAACE,GAAI,EAAC;IAC7GjF,MAAM,CAACkF,GAAG,CAACnF,QAAQ,CAACoF,KAAK,EAAEH,OAAO,CAAC;IACnC,MAAM,IAAIlF,aAAa,CAACkF,OAAO,CAAC;EAClC;EAEA,OAAO,MAAMX,aAAa,CAACe,MAAM,CAAClF,wBAAwB,CAACiE,aAAa,CAAC,CAAC;AAC5E;AAEA,OAAO,MAAMkB,6BAAsE,GACjF,MAAAA,CACEC,UAAU,EACVC,UAAU,EACVC,yBAAyB,EAAAC,IAAA,EAOzBC,YAAY,KACT;EAAA,IAPH;IACEC,uBAAuB;IACvBnF,uBAAuB;IACvBI,0BAA0B;IAC1BgF;EACF,CAAC,GAAAH,IAAA;EAGD,MAAMI,OAAO,GAAG,MAAM3B,qBAAqB,CACzCqB,UAAU,EACVD,UAAU,CAACzD,IAAI,EACf8D,uBACF,CAAC;EAED3F,MAAM,CAACkF,GAAG,CACRnF,QAAQ,CAAC+F,KAAK,EACb,uBAAsBC,IAAI,CAACC,SAAS,CAACH,OAAO,CAAE,EACjD,CAAC;EAED,IAAID,wBAAwB,EAAE;IAAA,IAAAK,YAAA;IAC5B,IAAI,CAACP,YAAY,EAAE;MACjB,MAAM,IAAI5F,aAAa,CAAC,sBAAsB,CAAC;IACjD;IACA,MAAMoG,GAAG,IAAAD,YAAA,GAAGJ,OAAO,CAACM,GAAG,cAAAF,YAAA,gBAAAA,YAAA,GAAXA,YAAA,CAAaG,MAAM,cAAAH,YAAA,uBAAnBA,YAAA,CAAqBC,GAA2B;IAC5D,IAAI,CAACA,GAAG,IAAI,CAACzD,KAAK,CAACC,OAAO,CAACwD,GAAG,CAAC,IAAIA,GAAG,CAACxF,MAAM,KAAK,CAAC,EAAE;MACnD,MAAM,IAAIN,qBAAqB,CAAC,2BAA2B,CAAC;IAC9D;IACA,MAAMD,eAAe,CAAC+F,GAAG,EAAER,YAAY,CAAC;EAC1C;EAEA,MAAMpF,gBAAgB,GACpBgF,UAAU,CAACe,mCAAmC,CAACb,yBAAyB,CAAC;EAE3E,IAAI,CAAClF,gBAAgB,EAAE;IACrBN,MAAM,CAACkF,GAAG,CACRnF,QAAQ,CAACoF,KAAK,EACb,gDAA+CK,yBAA0B,EAC5E,CAAC;IACD,MAAM,IAAI1F,aAAa,CAAC,6CAA6C,CAAC;EACxE;EAEA,MAAMS,mBAAmB,GAAI,MAAMsF,OAAO,CAACS,SAAS,CAAC3G,MAAM,CAG1D;EAED,MAAM4G,gBAAgB,GAAGlG,oBAAoB,CAC3CC,gBAAgB,EAChBC,mBAAmB,EACnBC,uBAAuB,EACvBI,0BACF,CAAC;EAED,MAAM4F,QAAQ,GACZ,OAAOjG,mBAAmB,CAACkG,GAAG,KAAK,QAAQ,GACvC,IAAIC,IAAI,CAACnG,mBAAmB,CAACkG,GAAG,GAAG,IAAI,CAAC,GACxC9F,SAAS;EAEf,IAAI,OAAOJ,mBAAmB,CAACoG,GAAG,KAAK,QAAQ,EAAE;IAC/C,MAAM,IAAI7G,aAAa,CAAC,2CAA2C,CAAC;EACtE;EACA,MAAM8G,UAAU,GAAG,IAAIF,IAAI,CAACnG,mBAAmB,CAACoG,GAAG,GAAG,IAAI,CAAC;EAE3D3G,MAAM,CAACkF,GAAG,CACRnF,QAAQ,CAAC+F,KAAK,EACb,sBAAqBC,IAAI,CAACC,SAAS,CAACO,gBAAgB,CAAE,gBAAeC,QAAS,EACjF,CAAC;EAED,OAAO;IACLD,gBAAgB;IAChBK,UAAU;IACVJ;EACF,CAAC;AACH,CAAC"}