@pagopa/io-react-native-wallet 3.2.0 → 3.4.0

package/README.md

@@ -6,7 +6,7 @@ It is designed to **support multiple versions of IT-Wallet specifications** via
 
 Follows the [eudi-wallet-it-docs](https://github.com/italia/eudi-wallet-it-docs) specifications:
 - Version [1.0.0](https://github.com/italia/eudi-wallet-it-docs/releases/tag/1.0.0)
-- Version [1.3.3](https://github.com/italia/eudi-wallet-it-docs/releases/tag/1.3.3) - 🚧 WIP
+- Version [1.3.3](https://github.com/italia/eudi-wallet-it-docs/releases/tag/1.3.3)
 
 The following table highlights the relationship between `io-react-native-wallet` and IT-Wallet specifications.
 

package/lib/commonjs/credential/issuance/README.md

@@ -19,8 +19,8 @@ graph TD;
     2[evaluateIssuerTrust]
     3[startUserAuthorization]
     C4[getRequestedCredentialToBePresented]
-    C4.1[completeUserAuthorizationWithFormPostJwtMode]
-    E4[completeUserAuthorizationWithQueryMode]
+    C4.1[completeEaaUserAuthorizationWithQueryMode]
+    E4[completePidUserAuthorizationWithQueryMode]
     5[authorizeAccess]
     6[WalletUnitAttestation.getAttestation]
     7[obtainCredential]
@@ -86,11 +86,15 @@ MRTD Verification is a sub-flow of the Issuance flow and is used when the reques
 1. **Primary Authentication**: LoA3 electronic identification (SPID or CIEid L2).
 2. **MRTD Proof of Possession (PoP)**: Electronic document reading and cryptographic verification.
 
-This process is initiated by the Authorization Server responding to the primary authentication step with a redirect that includes a challenge in the query string, which is handled by the `continueUserAuthorizationWithMRTDPoPChallenge` function. Once the MRTD PoP is completed, the user must continue the PID issuance flow with the `completeUserAuthorizationWithQueryMode` function.
+This process is initiated by the Authorization Server responding to the primary authentication step with a redirect that includes a challenge in the query string, which is handled by the `continueUserAuthorizationWithMRTDPoPChallenge` function. Once the MRTD PoP is completed, the user must continue the PID issuance flow with the `completePidUserAuthorizationWithQueryMode` function.
 
 Complete documentation for the MRTD PoP flow can be found here: [mrtd-pop](./mrtd-pop/README.md)
 
-## Authentication through credentials (Form Post JWT Mode)
+## Authentication through credentials (Query  Mode) - v1.3
+
+When the credential is different than an eID, the flow requires the user to present other credentials in order to obtain the requested one. Starting from IT-Wallet specifications v1.3, the EAA issuance flow uses the query mode to complete the user authorization. This is done through the `getRequestedCredentialToBePresented` followed by the `completeEaaUserAuthorizationWithQueryMode`.
+
+## Authentication through credentials (Form Post JWT Mode) - v1.0
 
 When the credential is different than an eID, the flow requires the user to present other credentials in order to obtain the requested one. This is done through the `getRequestedCredentialToBePresented` followed by the `completeUserAuthorizationWithFormPostJwtMode`.
 
@@ -163,7 +167,7 @@ const credentialCryptoContext = createCryptoContextFor(credentialKeyTag);
 const { issuerConf } = await wallet.CredentialIssuance.evaluateIssuerTrust(WALLET_EAA_PROVIDER_BASE_URL);
 
 // Start user authorization
-const { issuerRequestUri, clientId, codeVerifier } =
+const { issuerRequestUri, clientId, codeVerifier, responseMode } =
   await wallet.CredentialIssuance.startUserAuthorization(
     issuerConf,
     ["someCredentialId"],
@@ -184,13 +188,27 @@ const requestObject =
     appFetch
   );
 
-// Complete the user authorization via form_post.jwt mode
-const { code } =
-  await wallet.CredentialIssuance.completeUserAuthorizationWithFormPostJwtMode(
-    requestObject,
-    pid.credential,
-    { wiaCryptoContext, pidCryptoContext: createCryptoContextFor(pid.keyTag) }
-  );
+let code: string;
+if (responseMode === "form_post.jwt") {
+  // Complete the user authorization via form_post.jwt mode
+  ({ code } =
+    await wallet.CredentialIssuance.completeUserAuthorizationWithFormPostJwtMode(
+      requestObject,
+      issuerConf,
+      [pid.keyTag, pid.credential],
+      { wiaCryptoContext, appFetch }
+    ));
+} else {
+  // Complete the user authorization via query mode
+  ({ code } =
+    await wallet.CredentialIssuance.completeEaaUserAuthorizationWithQueryMode(
+      requestObject,
+      issuerConf,
+      [pid.keyTag, pid.credential],
+      REDIRECT_URI,
+      { appFetch }
+    ));
+}
 
 // Generate the DPoP context which will be used for the whole issuance flow
 await regenerateCryptoKey(DPOP_KEYTAG); // Let's assume this function regenerates this ephemeral key for the DPoP
@@ -330,7 +348,7 @@ const { issuerConf } = await wallet.CredentialIssuance.evaluateIssuerTrust(
 const { issuerRequestUri, clientId, codeVerifier, credentialDefinition } =
   await wallet.CredentialIssuance.startUserAuthorization(
     issuerConf,
-    ["dc_sd_jwt_PersonIdentificationData"], // Request authorization for one or more credentials
+    ["dc_sd_jwt_pid"], // Request authorization for one or more credentials
     { proofType: "none" },
     {
       walletInstanceAttestation,
@@ -342,7 +360,7 @@ const { issuerRequestUri, clientId, codeVerifier, credentialDefinition } =
 
 // Complete the authorization process with query mode with the authorizationContext which opens the browser
 const { code } =
-  await wallet.CredentialIssuance.completeUserAuthorizationWithQueryMode(
+  await wallet.CredentialIssuance.completePidUserAuthorizationWithQueryMode(
     issuerRequestUri
   );
 

package/lib/commonjs/credential/issuance/api/IssuerConfig.js

@@ -58,6 +58,7 @@ const IssuerConfig = _zod.z.object({
   credential_configurations_supported: _zod.z.record(_zod.z.string(), CredentialConfig),
   federation_entity: _types.FederationEntityMetadata,
   credential_issuance_batch_size: _zod.z.number().optional(),
+  encrypted_response_enc_values_supported: _zod.z.array(_zod.z.string()).optional(),
   /**
    * @deprecated
    */

package/lib/commonjs/credential/issuance/api/IssuerConfig.js.map

@@ -1 +1 @@
-{"version":3,"names":["_zod","require","_jwk","_types","DisplayConfig","z","object","name","string","locale","ClaimConfig","path","array","union","number","null","display","IssuanceErrorSupported","title","description","CredentialConfig","intersection","discriminatedUnion","format","literal","vct","doctype","scope","claims","authentic_source","optional","issuance_errors_supported","record","IssuerConfig","credential_issuer","pushed_authorization_request_endpoint","authorization_endpoint","token_endpoint","nonce_endpoint","status_assertion_endpoint","credential_endpoint","keys","JWK","credential_configurations_supported","federation_entity","FederationEntityMetadata","credential_issuance_batch_size","response_modes_supported","exports"],"sourceRoot":"../../../../../src","sources":["credential/issuance/api/IssuerConfig.ts"],"mappings":";;;;;;AAAA,IAAAA,IAAA,GAAAC,OAAA;AACA,IAAAC,IAAA,GAAAD,OAAA;AACA,IAAAE,MAAA,GAAAF,OAAA;AAEA,MAAMG,aAAa,GAAGC,MAAC,CAACC,MAAM,CAAC;EAC7BC,IAAI,EAAEF,MAAC,CAACG,MAAM,CAAC,CAAC;EAChBC,MAAM,EAAEJ,MAAC,CAACG,MAAM,CAAC;AACnB,CAAC,CAAC;AAEF,MAAME,WAAW,GAAGL,MAAC,CAACC,MAAM,CAAC;EAC3BK,IAAI,EAAEN,MAAC,CAACO,KAAK,CAACP,MAAC,CAACQ,KAAK,CAAC,CAACR,MAAC,CAACG,MAAM,CAAC,CAAC,EAAEH,MAAC,CAACS,MAAM,CAAC,CAAC,EAAET,MAAC,CAACU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;EAC1DC,OAAO,EAAEX,MAAC,CAACO,KAAK,CAACR,aAAa;AAChC,CAAC,CAAC;AAEF,MAAMa,sBAAsB,GAAGZ,MAAC,CAACC,MAAM,CAAC;EACtCU,OAAO,EAAEX,MAAC,CAACO,KAAK,CACdP,MAAC,CAACC,MAAM,CAAC;IACPY,KAAK,EAAEb,MAAC,CAACG,MAAM,CAAC,CAAC;IACjBW,WAAW,EAAEd,MAAC,CAACG,MAAM,CAAC,CAAC;IACvBC,MAAM,EAAEJ,MAAC,CAACG,MAAM,CAAC;EACnB,CAAC,CACH;AACF,CAAC,CAAC;AAEF,MAAMY,gBAAgB,GAAGf,MAAC,CAACgB,YAAY,CACrChB,MAAC,CAACiB,kBAAkB,CAAC,QAAQ,EAAE,CAC7BjB,MAAC,CAACC,MAAM,CAAC;EAAEiB,MAAM,EAAElB,MAAC,CAACmB,OAAO,CAAC,WAAW,CAAC;EAAEC,GAAG,EAAEpB,MAAC,CAACG,MAAM,CAAC;AAAE,CAAC,CAAC,EAC7DH,MAAC,CAACC,MAAM,CAAC;EAAEiB,MAAM,EAAElB,MAAC,CAACmB,OAAO,CAAC,UAAU,CAAC;EAAEE,OAAO,EAAErB,MAAC,CAACG,MAAM,CAAC;AAAE,CAAC,CAAC,CACjE,CAAC,EACFH,MAAC,CAACC,MAAM,CAAC;EACPqB,KAAK,EAAEtB,MAAC,CAACG,MAAM,CAAC,CAAC;EACjBQ,OAAO,EAAEX,MAAC,CAACO,KAAK,CAACR,aAAa,CAAC;EAC/BwB,MAAM,EAAEvB,MAAC,CAACO,KAAK,CAACF,WAAW,CAAC;EAC5B;AACJ;AACA;EACImB,gBAAgB,EAAExB,MAAC,CAACG,MAAM,CAAC,CAAC,CAACsB,QAAQ,CAAC,CAAC;EACvC;AACJ;AACA;EACIC,yBAAyB,EAAE1B,MAAC,CACzB2B,MAAM,CAAC3B,MAAC,CAACG,MAAM,CAAC,CAAC,EAAES,sBAAsB,CAAC,CAC1Ca,QAAQ,CAAC;AACd,CAAC,CACH,CAAC;;AAED;AACA;AACA;;AAEO,MAAMG,YAAY,GAAG5B,MAAC,CAACC,MAAM,CAAC;EACnC4B,iBAAiB,EAAE7B,MAAC,CAACG,MAAM,CAAC,CAAC;EAC7B2B,qCAAqC,EAAE9B,MAAC,CAACG,MAAM,CAAC,CAAC;EACjD4B,sBAAsB,EAAE/B,MAAC,CAACG,MAAM,CAAC,CAAC;EAClC6B,cAAc,EAAEhC,MAAC,CAACG,MAAM,CAAC,CAAC;EAC1B8B,cAAc,EAAEjC,MAAC,CAACG,MAAM,CAAC,CAAC;EAC1B+B,yBAAyB,EAAElC,MAAC,CAACG,MAAM,CAAC,CAAC,CAACsB,QAAQ,CAAC,CAAC;EAChDU,mBAAmB,EAAEnC,MAAC,CAACG,MAAM,CAAC,CAAC;EAC/BiC,IAAI,EAAEpC,MAAC,CAACO,KAAK,CAAC8B,QAAG,CAAC;EAClBC,mCAAmC,EAAEtC,MAAC,CAAC2B,MAAM,CAAC3B,MAAC,CAACG,MAAM,CAAC,CAAC,EAAEY,gBAAgB,CAAC;EAC3EwB,iBAAiB,EAAEC,+BAAwB;EAC3CC,8BAA8B,EAAEzC,MAAC,CAACS,MAAM,CAAC,CAAC,CAACgB,QAAQ,CAAC,CAAC;EACrD;AACF;AACA;EACEiB,wBAAwB,EAAE1C,MAAC,CAACO,KAAK,CAACP,MAAC,CAACG,MAAM,CAAC,CAAC,CAAC,CAACsB,QAAQ,CAAC;AACzD,CAAC,CAAC;AAACkB,OAAA,CAAAf,YAAA,GAAAA,YAAA"}
+{"version":3,"names":["_zod","require","_jwk","_types","DisplayConfig","z","object","name","string","locale","ClaimConfig","path","array","union","number","null","display","IssuanceErrorSupported","title","description","CredentialConfig","intersection","discriminatedUnion","format","literal","vct","doctype","scope","claims","authentic_source","optional","issuance_errors_supported","record","IssuerConfig","credential_issuer","pushed_authorization_request_endpoint","authorization_endpoint","token_endpoint","nonce_endpoint","status_assertion_endpoint","credential_endpoint","keys","JWK","credential_configurations_supported","federation_entity","FederationEntityMetadata","credential_issuance_batch_size","encrypted_response_enc_values_supported","response_modes_supported","exports"],"sourceRoot":"../../../../../src","sources":["credential/issuance/api/IssuerConfig.ts"],"mappings":";;;;;;AAAA,IAAAA,IAAA,GAAAC,OAAA;AACA,IAAAC,IAAA,GAAAD,OAAA;AACA,IAAAE,MAAA,GAAAF,OAAA;AAEA,MAAMG,aAAa,GAAGC,MAAC,CAACC,MAAM,CAAC;EAC7BC,IAAI,EAAEF,MAAC,CAACG,MAAM,CAAC,CAAC;EAChBC,MAAM,EAAEJ,MAAC,CAACG,MAAM,CAAC;AACnB,CAAC,CAAC;AAEF,MAAME,WAAW,GAAGL,MAAC,CAACC,MAAM,CAAC;EAC3BK,IAAI,EAAEN,MAAC,CAACO,KAAK,CAACP,MAAC,CAACQ,KAAK,CAAC,CAACR,MAAC,CAACG,MAAM,CAAC,CAAC,EAAEH,MAAC,CAACS,MAAM,CAAC,CAAC,EAAET,MAAC,CAACU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;EAC1DC,OAAO,EAAEX,MAAC,CAACO,KAAK,CAACR,aAAa;AAChC,CAAC,CAAC;AAEF,MAAMa,sBAAsB,GAAGZ,MAAC,CAACC,MAAM,CAAC;EACtCU,OAAO,EAAEX,MAAC,CAACO,KAAK,CACdP,MAAC,CAACC,MAAM,CAAC;IACPY,KAAK,EAAEb,MAAC,CAACG,MAAM,CAAC,CAAC;IACjBW,WAAW,EAAEd,MAAC,CAACG,MAAM,CAAC,CAAC;IACvBC,MAAM,EAAEJ,MAAC,CAACG,MAAM,CAAC;EACnB,CAAC,CACH;AACF,CAAC,CAAC;AAEF,MAAMY,gBAAgB,GAAGf,MAAC,CAACgB,YAAY,CACrChB,MAAC,CAACiB,kBAAkB,CAAC,QAAQ,EAAE,CAC7BjB,MAAC,CAACC,MAAM,CAAC;EAAEiB,MAAM,EAAElB,MAAC,CAACmB,OAAO,CAAC,WAAW,CAAC;EAAEC,GAAG,EAAEpB,MAAC,CAACG,MAAM,CAAC;AAAE,CAAC,CAAC,EAC7DH,MAAC,CAACC,MAAM,CAAC;EAAEiB,MAAM,EAAElB,MAAC,CAACmB,OAAO,CAAC,UAAU,CAAC;EAAEE,OAAO,EAAErB,MAAC,CAACG,MAAM,CAAC;AAAE,CAAC,CAAC,CACjE,CAAC,EACFH,MAAC,CAACC,MAAM,CAAC;EACPqB,KAAK,EAAEtB,MAAC,CAACG,MAAM,CAAC,CAAC;EACjBQ,OAAO,EAAEX,MAAC,CAACO,KAAK,CAACR,aAAa,CAAC;EAC/BwB,MAAM,EAAEvB,MAAC,CAACO,KAAK,CAACF,WAAW,CAAC;EAC5B;AACJ;AACA;EACImB,gBAAgB,EAAExB,MAAC,CAACG,MAAM,CAAC,CAAC,CAACsB,QAAQ,CAAC,CAAC;EACvC;AACJ;AACA;EACIC,yBAAyB,EAAE1B,MAAC,CACzB2B,MAAM,CAAC3B,MAAC,CAACG,MAAM,CAAC,CAAC,EAAES,sBAAsB,CAAC,CAC1Ca,QAAQ,CAAC;AACd,CAAC,CACH,CAAC;;AAED;AACA;AACA;;AAEO,MAAMG,YAAY,GAAG5B,MAAC,CAACC,MAAM,CAAC;EACnC4B,iBAAiB,EAAE7B,MAAC,CAACG,MAAM,CAAC,CAAC;EAC7B2B,qCAAqC,EAAE9B,MAAC,CAACG,MAAM,CAAC,CAAC;EACjD4B,sBAAsB,EAAE/B,MAAC,CAACG,MAAM,CAAC,CAAC;EAClC6B,cAAc,EAAEhC,MAAC,CAACG,MAAM,CAAC,CAAC;EAC1B8B,cAAc,EAAEjC,MAAC,CAACG,MAAM,CAAC,CAAC;EAC1B+B,yBAAyB,EAAElC,MAAC,CAACG,MAAM,CAAC,CAAC,CAACsB,QAAQ,CAAC,CAAC;EAChDU,mBAAmB,EAAEnC,MAAC,CAACG,MAAM,CAAC,CAAC;EAC/BiC,IAAI,EAAEpC,MAAC,CAACO,KAAK,CAAC8B,QAAG,CAAC;EAClBC,mCAAmC,EAAEtC,MAAC,CAAC2B,MAAM,CAAC3B,MAAC,CAACG,MAAM,CAAC,CAAC,EAAEY,gBAAgB,CAAC;EAC3EwB,iBAAiB,EAAEC,+BAAwB;EAC3CC,8BAA8B,EAAEzC,MAAC,CAACS,MAAM,CAAC,CAAC,CAACgB,QAAQ,CAAC,CAAC;EACrDiB,uCAAuC,EAAE1C,MAAC,CAACO,KAAK,CAACP,MAAC,CAACG,MAAM,CAAC,CAAC,CAAC,CAACsB,QAAQ,CAAC,CAAC;EACvE;AACF;AACA;EACEkB,wBAAwB,EAAE3C,MAAC,CAACO,KAAK,CAACP,MAAC,CAACG,MAAM,CAAC,CAAC,CAAC,CAACsB,QAAQ,CAAC;AACzD,CAAC,CAAC;AAACmB,OAAA,CAAAhB,YAAA,GAAAA,YAAA"}

package/lib/commonjs/credential/issuance/common/02-start-user-authorization.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.selectResponseMode = exports.selectCredentialDefinition = void 0;
+var _errors = require("../../../utils/errors");
 var _logging = require("../../../utils/logging");
 /**
  * Ensures that the credential type requested is supported by the issuer and contained in the
@@ -20,7 +21,7 @@ const selectCredentialDefinition = (issuerConf, credentialId) => {
   }));
   if (!result) {
     _logging.Logger.log(_logging.LogLevel.ERROR, `Requested credential ${credentialId} is not supported by the issuer according to its configuration ${JSON.stringify(credential_configurations_supported)}`);
-    throw new Error(`No credential support the type '${credentialId}'`);
+    throw new _errors.IoWalletError(`No credential support the type '${credentialId}'`);
   }
   return result;
 };
@@ -40,14 +41,14 @@ const selectResponseMode = (issuerConf, credentialIds) => {
   }
   if (responseModeSet.size !== 1) {
     _logging.Logger.log(_logging.LogLevel.ERROR, `${credentialIds} have incompatible response_mode: ${[...responseModeSet.values()]}`);
-    throw new Error("Requested credentials have incompatible response_mode and cannot be requested with the same PAR request");
+    throw new _errors.IoWalletError("Requested credentials have incompatible response_mode and cannot be requested with the same PAR request");
   }
   const [responseMode] = responseModeSet.values();
   _logging.Logger.log(_logging.LogLevel.DEBUG, `Selected response mode ${responseMode} for credential IDs ${credentialIds}`);
   const responseModeSupported = issuerConf.response_modes_supported;
   if (responseModeSupported && !responseModeSupported.includes(responseMode)) {
     _logging.Logger.log(_logging.LogLevel.ERROR, `Requested response mode ${responseMode} is not supported by the issuer according to its configuration ${JSON.stringify(responseModeSupported)}`);
-    throw new Error(`No response mode support for IDs '${credentialIds}'`);
+    throw new _errors.IoWalletError(`No response mode support for IDs '${credentialIds}'`);
   }
   return responseMode;
 };

package/lib/commonjs/credential/issuance/common/02-start-user-authorization.js.map

@@ -1 +1 @@
-{"version":3,"names":["_logging","require","selectCredentialDefinition","issuerConf","credentialId","credential_configurations_supported","result","Object","keys","filter","e","includes","map","credential_configuration_id","type","Logger","log","LogLevel","ERROR","JSON","stringify","Error","exports","selectResponseMode","credentialIds","responseModeSet","Set","add","match","size","values","responseMode","DEBUG","responseModeSupported","response_modes_supported"],"sourceRoot":"../../../../../src","sources":["credential/issuance/common/02-start-user-authorization.ts"],"mappings":";;;;;;AAAA,IAAAA,QAAA,GAAAC,OAAA;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,0BAA0B,GAAGA,CACxCC,UAAwB,EACxBC,YAAoB,KACI;EACxB,MAAMC,mCAAmC,GACvCF,UAAU,CAACE,mCAAmC;EAEhD,MAAM,CAACC,MAAM,CAAC,GAAGC,MAAM,CAACC,IAAI,CAACH,mCAAmC,CAAC,CAC9DI,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,QAAQ,CAACP,YAAY,CAAC,CAAC,CACvCQ,GAAG,CAAC,OAAO;IACVC,2BAA2B,EAAET,YAAY;IACzCU,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACR,MAAM,EAAE;IACXS,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,wBAAuBd,YAAa,kEAAiEe,IAAI,CAACC,SAAS,CAACf,mCAAmC,CAAE,EAC5J,CAAC;IACD,MAAM,IAAIgB,KAAK,CAAE,mCAAkCjB,YAAa,GAAE,CAAC;EACrE;EACA,OAAOE,MAAM;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AANAgB,OAAA,CAAApB,0BAAA,GAAAA,0BAAA;AAOO,MAAMqB,kBAAkB,GAAGA,CAChCpB,UAAwB,EACxBqB,aAAuB,KACN;EACjB,MAAMC,eAAe,GAAG,IAAIC,GAAG,CAAe,CAAC;EAE/C,KAAK,MAAMtB,YAAY,IAAIoB,aAAa,EAAE;IACxCC,eAAe,CAACE,GAAG,CACjBvB,YAAY,CAACwB,KAAK,CAAC,2BAA2B,CAAC,GAC3C,OAAO,GACP,eACN,CAAC;EACH;EAEA,IAAIH,eAAe,CAACI,IAAI,KAAK,CAAC,EAAE;IAC9Bd,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,GAAEM,aAAc,qCAAoC,CAAC,GAAGC,eAAe,CAACK,MAAM,CAAC,CAAC,CAAE,EACrF,CAAC;IACD,MAAM,IAAIT,KAAK,CACb,yGACF,CAAC;EACH;EAEA,MAAM,CAACU,YAAY,CAAC,GAAGN,eAAe,CAACK,MAAM,CAAC,CAAC;EAE/Cf,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACe,KAAK,EACb,0BAAyBD,YAAa,uBAAsBP,aAAc,EAC7E,CAAC;EAED,MAAMS,qBAAqB,GAAG9B,UAAU,CAAC+B,wBAAwB;EACjE,IAAID,qBAAqB,IAAI,CAACA,qBAAqB,CAACtB,QAAQ,CAACoB,YAAa,CAAC,EAAE;IAC3EhB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2BAA0Ba,YAAa,kEAAiEZ,IAAI,CAACC,SAAS,CAACa,qBAAqB,CAAE,EACjJ,CAAC;IACD,MAAM,IAAIZ,KAAK,CAAE,qCAAoCG,aAAc,GAAE,CAAC;EACxE;EAEA,OAAOO,YAAY;AACrB,CAAC;AAACT,OAAA,CAAAC,kBAAA,GAAAA,kBAAA"}
+{"version":3,"names":["_errors","require","_logging","selectCredentialDefinition","issuerConf","credentialId","credential_configurations_supported","result","Object","keys","filter","e","includes","map","credential_configuration_id","type","Logger","log","LogLevel","ERROR","JSON","stringify","IoWalletError","exports","selectResponseMode","credentialIds","responseModeSet","Set","add","match","size","values","responseMode","DEBUG","responseModeSupported","response_modes_supported"],"sourceRoot":"../../../../../src","sources":["credential/issuance/common/02-start-user-authorization.ts"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,QAAA,GAAAD,OAAA;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,0BAA0B,GAAGA,CACxCC,UAAwB,EACxBC,YAAoB,KACI;EACxB,MAAMC,mCAAmC,GACvCF,UAAU,CAACE,mCAAmC;EAEhD,MAAM,CAACC,MAAM,CAAC,GAAGC,MAAM,CAACC,IAAI,CAACH,mCAAmC,CAAC,CAC9DI,MAAM,CAAEC,CAAC,IAAKA,CAAC,CAACC,QAAQ,CAACP,YAAY,CAAC,CAAC,CACvCQ,GAAG,CAAC,OAAO;IACVC,2BAA2B,EAAET,YAAY;IACzCU,IAAI,EAAE;EACR,CAAC,CAAC,CAAC;EAEL,IAAI,CAACR,MAAM,EAAE;IACXS,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,wBAAuBd,YAAa,kEAAiEe,IAAI,CAACC,SAAS,CAACf,mCAAmC,CAAE,EAC5J,CAAC;IACD,MAAM,IAAIgB,qBAAa,CAAE,mCAAkCjB,YAAa,GAAE,CAAC;EAC7E;EACA,OAAOE,MAAM;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AANAgB,OAAA,CAAApB,0BAAA,GAAAA,0BAAA;AAOO,MAAMqB,kBAAkB,GAAGA,CAChCpB,UAAwB,EACxBqB,aAAuB,KACN;EACjB,MAAMC,eAAe,GAAG,IAAIC,GAAG,CAAe,CAAC;EAE/C,KAAK,MAAMtB,YAAY,IAAIoB,aAAa,EAAE;IACxCC,eAAe,CAACE,GAAG,CACjBvB,YAAY,CAACwB,KAAK,CAAC,2BAA2B,CAAC,GAC3C,OAAO,GACP,eACN,CAAC;EACH;EAEA,IAAIH,eAAe,CAACI,IAAI,KAAK,CAAC,EAAE;IAC9Bd,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,GAAEM,aAAc,qCAAoC,CAAC,GAAGC,eAAe,CAACK,MAAM,CAAC,CAAC,CAAE,EACrF,CAAC;IACD,MAAM,IAAIT,qBAAa,CACrB,yGACF,CAAC;EACH;EAEA,MAAM,CAACU,YAAY,CAAC,GAAGN,eAAe,CAACK,MAAM,CAAC,CAAC;EAE/Cf,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACe,KAAK,EACb,0BAAyBD,YAAa,uBAAsBP,aAAc,EAC7E,CAAC;EAED,MAAMS,qBAAqB,GAAG9B,UAAU,CAAC+B,wBAAwB;EACjE,IAAID,qBAAqB,IAAI,CAACA,qBAAqB,CAACtB,QAAQ,CAACoB,YAAa,CAAC,EAAE;IAC3EhB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,2BAA0Ba,YAAa,kEAAiEZ,IAAI,CAACC,SAAS,CAACa,qBAAqB,CAAE,EACjJ,CAAC;IACD,MAAM,IAAIZ,qBAAa,CACpB,qCAAoCG,aAAc,GACrD,CAAC;EACH;EAEA,OAAOO,YAAY;AACrB,CAAC;AAACT,OAAA,CAAAC,kBAAA,GAAAA,kBAAA"}

package/lib/commonjs/credential/issuance/common/06-verify-and-parse-credential.sdjwt.js

@@ -12,6 +12,8 @@ var _errors = require("../../../utils/errors");
 var _logging = require("../../../utils/logging");
 var _jwk = require("../../../utils/jwk");
 var _credentials = require("../../../utils/credentials");
+var _x = require("../../../utils/x509");
+var _errors2 = require("../../../trust/common/errors");
 /**
  * Parse a Sd-Jwt credential according to the issuer configuration
  * @param credentialConfig - the list of supported credentials, as defined in the issuer configuration with their claims metadata
@@ -117,6 +119,24 @@ const parseCredentialSdJwt = function (credentialConfig, parsedCredentialRaw) {
   };
   return processLevel(parsedCredentialRaw, []);
 };
+/**
+ * JWT verifier implementing the interface expected by the SD-JWT library.
+ * Verification is delegated to `io-react-native-jwt` to leverage its support for multiple algorithms.
+ * @returns Boolean indicating whether the verification succeeded or not
+ */
+const sdJwtInstanceVerifier = async (data, signature, options) => {
+  if (!(options !== null && options !== void 0 && options.issuerKeys)) {
+    return false;
+  }
+  try {
+    await (0, _ioReactNativeJwt.verify)(`${data}.${signature}`, options.issuerKeys, {
+      clockTolerance: options.skewSeconds
+    });
+    return true;
+  } catch {
+    return false;
+  }
+};
 
 /**
  * Given a credential, verify it's in the supported format
@@ -134,15 +154,14 @@ const parseCredentialSdJwt = function (credentialConfig, parsedCredentialRaw) {
  *
  */
 async function verifyCredentialSdJwt(rawCredential, issuerKeys, holderBindingContext) {
-  const {
-    protectedHeader
-  } = (0, _ioReactNativeJwt.decode)(rawCredential);
-  const verifierJwk = (0, _ioReactNativeJwt.getJwkFromHeader)(protectedHeader, issuerKeys);
   const sdJwtInstance = new _core.SDJwtInstance({
     hasher: _cryptoNodejs.digest,
-    verifier: await _cryptoNodejs.ES256.getVerifier(verifierJwk)
+    verifier: sdJwtInstanceVerifier
   });
-  const [verifiedCredential, holderBindingKey] = await Promise.all([sdJwtInstance.verify(rawCredential), holderBindingContext.getPublicKey()]);
+  const [verifiedCredential, holderBindingKey] = await Promise.all([sdJwtInstance.verify(rawCredential, {
+    issuerKeys,
+    skewSeconds: 30
+  }), holderBindingContext.getPublicKey()]);
   const {
     cnf
   } = verifiedCredential.payload;
@@ -153,14 +172,26 @@ async function verifyCredentialSdJwt(rawCredential, issuerKeys, holderBindingCon
   }
   return await sdJwtInstance.decode((0, _credentials.fixLegacyCredentialSdJwt)(rawCredential));
 }
-const verifyAndParseCredentialSdJwt = async (issuerConf, credential, credentialConfigurationId, _ref) => {
+const verifyAndParseCredentialSdJwt = async (issuerConf, credential, credentialConfigurationId, _ref, x509CertRoot) => {
   let {
     credentialCryptoContext,
     ignoreMissingAttributes,
-    includeUndefinedAttributes
+    includeUndefinedAttributes,
+    validateCertificateChain
   } = _ref;
   const decoded = await verifyCredentialSdJwt(credential, issuerConf.keys, credentialCryptoContext);
   _logging.Logger.log(_logging.LogLevel.DEBUG, `Decoded credential: ${JSON.stringify(decoded)}`);
+  if (validateCertificateChain) {
+    var _decoded$jwt;
+    if (!x509CertRoot) {
+      throw new _errors.IoWalletError("Missing x509CertRoot");
+    }
+    const x5c = (_decoded$jwt = decoded.jwt) === null || _decoded$jwt === void 0 || (_decoded$jwt = _decoded$jwt.header) === null || _decoded$jwt === void 0 ? void 0 : _decoded$jwt.x5c;
+    if (!x5c || !Array.isArray(x5c) || x5c.length === 0) {
+      throw new _errors2.MissingX509CertsError("Missing x509 certificates");
+    }
+    await (0, _x.verifyX509Chain)(x5c, x509CertRoot);
+  }
   const credentialConfig = issuerConf.credential_configurations_supported[credentialConfigurationId];
   if (!credentialConfig) {
     _logging.Logger.log(_logging.LogLevel.ERROR, `Credential type not supported by the issuer: ${credentialConfigurationId}`);

package/lib/commonjs/credential/issuance/common/06-verify-and-parse-credential.sdjwt.js.map

@@ -1 +1 @@
-{"version":3,"names":["_ioReactNativeJwt","require","_core","_cryptoNodejs","_parser","_errors","_logging","_jwk","_credentials","parseCredentialSdJwt","credentialConfig","parsedCredentialRaw","ignoreMissingAttributes","arguments","length","undefined","includeUndefinedAttributes","claimsMetadata","claims","missingPaths","rootKeysToVerify","Set","map","c","path","filter","p","rootKey","push","missing","join","received","Object","keys","IoWalletError","getDisplayNames","match","find","isPathEqual","nameMap","entry","display","locale","name","processLevel","currentData","currentPath","Array","isArray","item","dataObj","result","processedKeys","configKeysAtThisLevel","claim","isPrefixOf","nextPart","includes","key","stringKey","toString","dataValue","newPath","localizedNames","value","add","entries","has","verifyCredentialSdJwt","rawCredential","issuerKeys","holderBindingContext","protectedHeader","decode","verifierJwk","getJwkFromHeader","sdJwtInstance","SDJwtInstance","hasher","digest","verifier","ES256","getVerifier","verifiedCredential","holderBindingKey","Promise","all","verify","getPublicKey","cnf","payload","isSameThumbprint","jwk","message","kid","Logger","log","LogLevel","ERROR","fixLegacyCredentialSdJwt","verifyAndParseCredentialSdJwt","issuerConf","credential","credentialConfigurationId","_ref","credentialCryptoContext","decoded","DEBUG","JSON","stringify","credential_configurations_supported","getClaims","parsedCredential","issuedAt","iat","Date","exp","expiration","exports"],"sourceRoot":"../../../../../src","sources":["credential/issuance/common/06-verify-and-parse-credential.sdjwt.ts"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AAKA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,aAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,OAAA,GAAAJ,OAAA;AACA,IAAAK,QAAA,GAAAL,OAAA;AACA,IAAAM,IAAA,GAAAN,OAAA;AAEA,IAAAO,YAAA,GAAAP,OAAA;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMQ,oBAAoB,GAAG,SAAAA,CAC3BC,gBAAgC,EAChCC,mBAA4C,EAGvB;EAAA,IAFrBC,uBAAgC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,KAAK;EAAA,IACxCG,0BAAmC,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,KAAK;EAE3C,MAAMI,cAAc,GAAGP,gBAAgB,CAACQ,MAAM,IAAI,EAAE;;EAEpD;EACA,IAAI,CAACN,uBAAuB,EAAE;IAC5B,MAAMO,YAAsB,GAAG,EAAE;IACjC,MAAMC,gBAAgB,GAAG,IAAIC,GAAG,CAC9BJ,cAAc,CACXK,GAAG,CAAEC,CAAC,IAAKA,CAAC,CAACC,IAAI,CAAC,CAAC,CAAC,CAAC,CACrBC,MAAM,CAAEC,CAAC,IAAkB,OAAOA,CAAC,KAAK,QAAQ,CACrD,CAAC;IAED,KAAK,MAAMC,OAAO,IAAIP,gBAAgB,EAAE;MACtC,IAAI,EAAEO,OAAO,IAAIhB,mBAAmB,CAAC,EAAE;QACrCQ,YAAY,CAACS,IAAI,CAACD,OAAO,CAAC;MAC5B;IACF;IAEA,IAAIR,YAAY,CAACL,MAAM,GAAG,CAAC,EAAE;MAC3B,MAAMe,OAAO,GAAGV,YAAY,CAACW,IAAI,CAAC,IAAI,CAAC;MACvC,MAAMC,QAAQ,GAAGC,MAAM,CAACC,IAAI,CAACtB,mBAAmB,CAAC,CAACmB,IAAI,CAAC,IAAI,CAAC;MAC5D,MAAM,IAAII,qBAAa,CACpB,4DAA2DL,OAAQ,iBAAgBE,QAAS,GAC/F,CAAC;IACH;EACF;;EAEA;AACF;AACA;EACE,MAAMI,eAAe,GACnBX,IAAgC,IACO;IACvC,MAAMY,KAAK,GAAGnB,cAAc,CAACoB,IAAI,CAAEd,CAAC,IAAK,IAAAe,mBAAW,EAACf,CAAC,CAACC,IAAI,EAAEA,IAAI,CAAC,CAAC;IACnE,IAAI,CAACY,KAAK,EAAE,OAAOrB,SAAS;IAE5B,MAAMwB,OAA+B,GAAG,CAAC,CAAC;IAC1C,KAAK,MAAMC,KAAK,IAAIJ,KAAK,CAACK,OAAO,EAAE;MACjCF,OAAO,CAACC,KAAK,CAACE,MAAM,CAAC,GAAGF,KAAK,CAACG,IAAI;IACpC;IACA,OAAOJ,OAAO;EAChB,CAAC;;EAED;AACF;AACA;EACE,MAAMK,YAAY,GAAGA,CACnBC,WAAoB,EACpBC,WAAuC,KAC3B;IACZ;IACA,IAAIC,KAAK,CAACC,OAAO,CAACH,WAAW,CAAC,EAAE;MAC9B,OAAOA,WAAW,CAACvB,GAAG,CAAE2B,IAAI,IAC1BL,YAAY,CAACK,IAAI,EAAE,CAAC,GAAGH,WAAW,EAAE,IAAI,CAAC,CAC3C,CAAC;IACH;;IAEA;IACA,IAAI,OAAOD,WAAW,KAAK,QAAQ,IAAIA,WAAW,KAAK,IAAI,EAAE;MAC3D,OAAOA,WAAW;IACpB;IAEA,MAAMK,OAAO,GAAGL,WAAsC;IACtD,MAAMM,MAAwB,GAAG,CAAC,CAAC;IACnC,MAAMC,aAAa,GAAG,IAAI/B,GAAG,CAAkB,CAAC;;IAEhD;IACA,MAAMgC,qBAA0C,GAAG,EAAE;IACrD,KAAK,MAAMC,KAAK,IAAIrC,cAAc,EAAE;MAClC;MACA,IAAI,IAAAsC,kBAAU,EAACT,WAAW,EAAEQ,KAAK,CAAC9B,IAAI,CAAC,EAAE;QACvC,MAAMgC,QAAQ,GAAGF,KAAK,CAAC9B,IAAI,CAACsB,WAAW,CAAChC,MAAM,CAAC;QAC/C,IACE,CAAC,OAAO0C,QAAQ,KAAK,QAAQ,IAAI,OAAOA,QAAQ,KAAK,QAAQ,KAC7D,CAACH,qBAAqB,CAACI,QAAQ,CAACD,QAAQ,CAAC,EACzC;UACAH,qBAAqB,CAACzB,IAAI,CAAC4B,QAAQ,CAAC;QACtC;MACF;IACF;;IAEA;IACA,KAAK,MAAME,GAAG,IAAIL,qBAAqB,EAAE;MACvC,MAAMM,SAAS,GAAGD,GAAG,CAACE,QAAQ,CAAC,CAAC;MAChC,MAAMC,SAAS,GAAGX,OAAO,CAACS,SAAS,CAAC;MACpC,IAAIE,SAAS,KAAK9C,SAAS,EAAE;MAE7B,MAAM+C,OAAO,GAAG,CAAC,GAAGhB,WAAW,EAAEY,GAAG,CAAC;MAErC,IAAIK,cAAc,GAAG5B,eAAe,CAAC2B,OAAO,CAAC;;MAE7C;MACA,IAAI,CAACC,cAAc,IAAIhB,KAAK,CAACC,OAAO,CAACa,SAAS,CAAC,EAAE;QAC/CE,cAAc,GAAG5B,eAAe,CAAC,CAAC,GAAG2B,OAAO,EAAE,IAAI,CAAC,CAAC;MACtD;MAEAX,MAAM,CAACQ,SAAS,CAAC,GAAG;QAClBhB,IAAI,EAAEoB,cAAc,IAAIJ,SAAS;QACjCK,KAAK,EAAEpB,YAAY,CAACiB,SAAS,EAAEC,OAAO;MACxC,CAAC;MAEDV,aAAa,CAACa,GAAG,CAACP,GAAG,CAAC;IACxB;;IAEA;IACA,IAAI1C,0BAA0B,EAAE;MAC9B,KAAK,MAAM,CAAC0C,GAAG,EAAEM,KAAK,CAAC,IAAIhC,MAAM,CAACkC,OAAO,CAAChB,OAAO,CAAC,EAAE;QAClD,IAAI,CAACE,aAAa,CAACe,GAAG,CAACT,GAAG,CAAC,EAAE;UAC3BP,MAAM,CAACO,GAAG,CAAC,GAAG;YACZf,IAAI,EAAEe,GAAG;YACTM,KAAK,EAAEA;UACT,CAAC;QACH;MACF;IACF;IAEA,OAAOb,MAAM;EACf,CAAC;EAED,OAAOP,YAAY,CAACjC,mBAAmB,EAAE,EAAE,CAAC;AAC9C,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeyD,qBAAqBA,CAClCC,aAAqB,EACrBC,UAAiB,EACjBC,oBAAmC,EACnB;EAChB,MAAM;IAAEC;EAAgB,CAAC,GAAG,IAAAC,wBAAM,EAACJ,aAAa,CAAC;EACjD,MAAMK,WAAW,GAAG,IAAAC,kCAAgB,EAACH,eAAe,EAAEF,UAAU,CAAC;EAEjE,MAAMM,aAAa,GAAG,IAAIC,mBAAa,CAAC;IACtCC,MAAM,EAAEC,oBAAM;IACdC,QAAQ,EAAE,MAAMC,mBAAK,CAACC,WAAW,CAACR,WAAW;EAC/C,CAAC,CAAC;EAEF,MAAM,CAACS,kBAAkB,EAAEC,gBAAgB,CAAC,GAAG,MAAMC,OAAO,CAACC,GAAG,CAAC,CAC/DV,aAAa,CAACW,MAAM,CAAClB,aAAa,CAAC,EACnCE,oBAAoB,CAACiB,YAAY,CAAC,CAAC,CACpC,CAAC;EAEF,MAAM;IAAEC;EAAI,CAAC,GAAGN,kBAAkB,CAACO,OAAkC;EACrE,IAAI,EAAE,MAAM,IAAAC,qBAAgB,EAACF,GAAG,CAACG,GAAG,EAAER,gBAAuB,CAAC,CAAC,EAAE;IAC/D,MAAMS,OAAO,GAAI,kDAAiDT,gBAAgB,CAACU,GAAI,UAASL,GAAG,CAACG,GAAG,CAACE,GAAI,EAAC;IAC7GC,eAAM,CAACC,GAAG,CAACC,iBAAQ,CAACC,KAAK,EAAEL,OAAO,CAAC;IACnC,MAAM,IAAI3D,qBAAa,CAAC2D,OAAO,CAAC;EAClC;EAEA,OAAO,MAAMjB,aAAa,CAACH,MAAM,CAAC,IAAA0B,qCAAwB,EAAC9B,aAAa,CAAC,CAAC;AAC5E;AAEO,MAAM+B,6BAAsE,GACjF,MAAAA,CACEC,UAAU,EACVC,UAAU,EACVC,yBAAyB,EAAAC,IAAA,KAMtB;EAAA,IALH;IACEC,uBAAuB;IACvB7F,uBAAuB;IACvBI;EACF,CAAC,GAAAwF,IAAA;EAED,MAAME,OAAO,GAAG,MAAMtC,qBAAqB,CACzCkC,UAAU,EACVD,UAAU,CAACpE,IAAI,EACfwE,uBACF,CAAC;EAEDV,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,uBAAsBC,IAAI,CAACC,SAAS,CAACH,OAAO,CAAE,EACjD,CAAC;EAED,MAAMhG,gBAAgB,GACpB2F,UAAU,CAACS,mCAAmC,CAACP,yBAAyB,CAAC;EAE3E,IAAI,CAAC7F,gBAAgB,EAAE;IACrBqF,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,gDAA+CK,yBAA0B,EAC5E,CAAC;IACD,MAAM,IAAIrE,qBAAa,CAAC,6CAA6C,CAAC;EACxE;EAEA,MAAMvB,mBAAmB,GAAI,MAAM+F,OAAO,CAACK,SAAS,CAAChC,oBAAM,CAG1D;EAED,MAAMiC,gBAAgB,GAAGvG,oBAAoB,CAC3CC,gBAAgB,EAChBC,mBAAmB,EACnBC,uBAAuB,EACvBI,0BACF,CAAC;EAED,MAAMiG,QAAQ,GACZ,OAAOtG,mBAAmB,CAACuG,GAAG,KAAK,QAAQ,GACvC,IAAIC,IAAI,CAACxG,mBAAmB,CAACuG,GAAG,GAAG,IAAI,CAAC,GACxCnG,SAAS;EAEf,IAAI,OAAOJ,mBAAmB,CAACyG,GAAG,KAAK,QAAQ,EAAE;IAC/C,MAAM,IAAIlF,qBAAa,CAAC,2CAA2C,CAAC;EACtE;EACA,MAAMmF,UAAU,GAAG,IAAIF,IAAI,CAACxG,mBAAmB,CAACyG,GAAG,GAAG,IAAI,CAAC;EAE3DrB,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACU,KAAK,EACb,sBAAqBC,IAAI,CAACC,SAAS,CAACG,gBAAgB,CAAE,gBAAeC,QAAS,EACjF,CAAC;EAED,OAAO;IACLD,gBAAgB;IAChBK,UAAU;IACVJ;EACF,CAAC;AACH,CAAC;AAACK,OAAA,CAAAlB,6BAAA,GAAAA,6BAAA"}
+{"version":3,"names":["_ioReactNativeJwt","require","_core","_cryptoNodejs","_parser","_errors","_logging","_jwk","_credentials","_x","_errors2","parseCredentialSdJwt","credentialConfig","parsedCredentialRaw","ignoreMissingAttributes","arguments","length","undefined","includeUndefinedAttributes","claimsMetadata","claims","missingPaths","rootKeysToVerify","Set","map","c","path","filter","p","rootKey","push","missing","join","received","Object","keys","IoWalletError","getDisplayNames","match","find","isPathEqual","nameMap","entry","display","locale","name","processLevel","currentData","currentPath","Array","isArray","item","dataObj","result","processedKeys","configKeysAtThisLevel","claim","isPrefixOf","nextPart","includes","key","stringKey","toString","dataValue","newPath","localizedNames","value","add","entries","has","sdJwtInstanceVerifier","data","signature","options","issuerKeys","verifyJwt","clockTolerance","skewSeconds","verifyCredentialSdJwt","rawCredential","holderBindingContext","sdJwtInstance","SDJwtInstance","hasher","digest","verifier","verifiedCredential","holderBindingKey","Promise","all","verify","getPublicKey","cnf","payload","isSameThumbprint","jwk","message","kid","Logger","log","LogLevel","ERROR","decode","fixLegacyCredentialSdJwt","verifyAndParseCredentialSdJwt","issuerConf","credential","credentialConfigurationId","_ref","x509CertRoot","credentialCryptoContext","validateCertificateChain","decoded","DEBUG","JSON","stringify","_decoded$jwt","x5c","jwt","header","MissingX509CertsError","verifyX509Chain","credential_configurations_supported","getClaims","parsedCredential","issuedAt","iat","Date","exp","expiration","exports"],"sourceRoot":"../../../../../src","sources":["credential/issuance/common/06-verify-and-parse-credential.sdjwt.ts"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AAIA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,aAAA,GAAAF,OAAA;AAEA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,OAAA,GAAAJ,OAAA;AACA,IAAAK,QAAA,GAAAL,OAAA;AACA,IAAAM,IAAA,GAAAN,OAAA;AAEA,IAAAO,YAAA,GAAAP,OAAA;AACA,IAAAQ,EAAA,GAAAR,OAAA;AACA,IAAAS,QAAA,GAAAT,OAAA;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMU,oBAAoB,GAAG,SAAAA,CAC3BC,gBAAgC,EAChCC,mBAA4C,EAGvB;EAAA,IAFrBC,uBAAgC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,KAAK;EAAA,IACxCG,0BAAmC,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,KAAK;EAE3C,MAAMI,cAAc,GAAGP,gBAAgB,CAACQ,MAAM,IAAI,EAAE;;EAEpD;EACA,IAAI,CAACN,uBAAuB,EAAE;IAC5B,MAAMO,YAAsB,GAAG,EAAE;IACjC,MAAMC,gBAAgB,GAAG,IAAIC,GAAG,CAC9BJ,cAAc,CACXK,GAAG,CAAEC,CAAC,IAAKA,CAAC,CAACC,IAAI,CAAC,CAAC,CAAC,CAAC,CACrBC,MAAM,CAAEC,CAAC,IAAkB,OAAOA,CAAC,KAAK,QAAQ,CACrD,CAAC;IAED,KAAK,MAAMC,OAAO,IAAIP,gBAAgB,EAAE;MACtC,IAAI,EAAEO,OAAO,IAAIhB,mBAAmB,CAAC,EAAE;QACrCQ,YAAY,CAACS,IAAI,CAACD,OAAO,CAAC;MAC5B;IACF;IAEA,IAAIR,YAAY,CAACL,MAAM,GAAG,CAAC,EAAE;MAC3B,MAAMe,OAAO,GAAGV,YAAY,CAACW,IAAI,CAAC,IAAI,CAAC;MACvC,MAAMC,QAAQ,GAAGC,MAAM,CAACC,IAAI,CAACtB,mBAAmB,CAAC,CAACmB,IAAI,CAAC,IAAI,CAAC;MAC5D,MAAM,IAAII,qBAAa,CACpB,4DAA2DL,OAAQ,iBAAgBE,QAAS,GAC/F,CAAC;IACH;EACF;;EAEA;AACF;AACA;EACE,MAAMI,eAAe,GACnBX,IAAgC,IACO;IACvC,MAAMY,KAAK,GAAGnB,cAAc,CAACoB,IAAI,CAAEd,CAAC,IAAK,IAAAe,mBAAW,EAACf,CAAC,CAACC,IAAI,EAAEA,IAAI,CAAC,CAAC;IACnE,IAAI,CAACY,KAAK,EAAE,OAAOrB,SAAS;IAE5B,MAAMwB,OAA+B,GAAG,CAAC,CAAC;IAC1C,KAAK,MAAMC,KAAK,IAAIJ,KAAK,CAACK,OAAO,EAAE;MACjCF,OAAO,CAACC,KAAK,CAACE,MAAM,CAAC,GAAGF,KAAK,CAACG,IAAI;IACpC;IACA,OAAOJ,OAAO;EAChB,CAAC;;EAED;AACF;AACA;EACE,MAAMK,YAAY,GAAGA,CACnBC,WAAoB,EACpBC,WAAuC,KAC3B;IACZ;IACA,IAAIC,KAAK,CAACC,OAAO,CAACH,WAAW,CAAC,EAAE;MAC9B,OAAOA,WAAW,CAACvB,GAAG,CAAE2B,IAAI,IAC1BL,YAAY,CAACK,IAAI,EAAE,CAAC,GAAGH,WAAW,EAAE,IAAI,CAAC,CAC3C,CAAC;IACH;;IAEA;IACA,IAAI,OAAOD,WAAW,KAAK,QAAQ,IAAIA,WAAW,KAAK,IAAI,EAAE;MAC3D,OAAOA,WAAW;IACpB;IAEA,MAAMK,OAAO,GAAGL,WAAsC;IACtD,MAAMM,MAAwB,GAAG,CAAC,CAAC;IACnC,MAAMC,aAAa,GAAG,IAAI/B,GAAG,CAAkB,CAAC;;IAEhD;IACA,MAAMgC,qBAA0C,GAAG,EAAE;IACrD,KAAK,MAAMC,KAAK,IAAIrC,cAAc,EAAE;MAClC;MACA,IAAI,IAAAsC,kBAAU,EAACT,WAAW,EAAEQ,KAAK,CAAC9B,IAAI,CAAC,EAAE;QACvC,MAAMgC,QAAQ,GAAGF,KAAK,CAAC9B,IAAI,CAACsB,WAAW,CAAChC,MAAM,CAAC;QAC/C,IACE,CAAC,OAAO0C,QAAQ,KAAK,QAAQ,IAAI,OAAOA,QAAQ,KAAK,QAAQ,KAC7D,CAACH,qBAAqB,CAACI,QAAQ,CAACD,QAAQ,CAAC,EACzC;UACAH,qBAAqB,CAACzB,IAAI,CAAC4B,QAAQ,CAAC;QACtC;MACF;IACF;;IAEA;IACA,KAAK,MAAME,GAAG,IAAIL,qBAAqB,EAAE;MACvC,MAAMM,SAAS,GAAGD,GAAG,CAACE,QAAQ,CAAC,CAAC;MAChC,MAAMC,SAAS,GAAGX,OAAO,CAACS,SAAS,CAAC;MACpC,IAAIE,SAAS,KAAK9C,SAAS,EAAE;MAE7B,MAAM+C,OAAO,GAAG,CAAC,GAAGhB,WAAW,EAAEY,GAAG,CAAC;MAErC,IAAIK,cAAc,GAAG5B,eAAe,CAAC2B,OAAO,CAAC;;MAE7C;MACA,IAAI,CAACC,cAAc,IAAIhB,KAAK,CAACC,OAAO,CAACa,SAAS,CAAC,EAAE;QAC/CE,cAAc,GAAG5B,eAAe,CAAC,CAAC,GAAG2B,OAAO,EAAE,IAAI,CAAC,CAAC;MACtD;MAEAX,MAAM,CAACQ,SAAS,CAAC,GAAG;QAClBhB,IAAI,EAAEoB,cAAc,IAAIJ,SAAS;QACjCK,KAAK,EAAEpB,YAAY,CAACiB,SAAS,EAAEC,OAAO;MACxC,CAAC;MAEDV,aAAa,CAACa,GAAG,CAACP,GAAG,CAAC;IACxB;;IAEA;IACA,IAAI1C,0BAA0B,EAAE;MAC9B,KAAK,MAAM,CAAC0C,GAAG,EAAEM,KAAK,CAAC,IAAIhC,MAAM,CAACkC,OAAO,CAAChB,OAAO,CAAC,EAAE;QAClD,IAAI,CAACE,aAAa,CAACe,GAAG,CAACT,GAAG,CAAC,EAAE;UAC3BP,MAAM,CAACO,GAAG,CAAC,GAAG;YACZf,IAAI,EAAEe,GAAG;YACTM,KAAK,EAAEA;UACT,CAAC;QACH;MACF;IACF;IAEA,OAAOb,MAAM;EACf,CAAC;EAED,OAAOP,YAAY,CAACjC,mBAAmB,EAAE,EAAE,CAAC;AAC9C,CAAC;AAID;AACA;AACA;AACA;AACA;AACA,MAAMyD,qBAA4C,GAAG,MAAAA,CACnDC,IAAI,EACJC,SAAS,EACTC,OAAO,KACJ;EACH,IAAI,EAACA,OAAO,aAAPA,OAAO,eAAPA,OAAO,CAAEC,UAAU,GAAE;IACxB,OAAO,KAAK;EACd;EACA,IAAI;IACF,MAAM,IAAAC,wBAAS,EAAE,GAAEJ,IAAK,IAAGC,SAAU,EAAC,EAAEC,OAAO,CAACC,UAAU,EAAE;MAC1DE,cAAc,EAAEH,OAAO,CAACI;IAC1B,CAAC,CAAC;IACF,OAAO,IAAI;EACb,CAAC,CAAC,MAAM;IACN,OAAO,KAAK;EACd;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,qBAAqBA,CAClCC,aAAqB,EACrBL,UAAiB,EACjBM,oBAAmC,EACnB;EAChB,MAAMC,aAAa,GAAG,IAAIC,mBAAa,CAAC;IACtCC,MAAM,EAAEC,oBAAM;IACdC,QAAQ,EAAEf;EACZ,CAAC,CAAC;EAEF,MAAM,CAACgB,kBAAkB,EAAEC,gBAAgB,CAAC,GAAG,MAAMC,OAAO,CAACC,GAAG,CAAC,CAC/DR,aAAa,CAACS,MAAM,CAACX,aAAa,EAAE;IAAEL,UAAU;IAAEG,WAAW,EAAE;EAAG,CAAC,CAAC,EACpEG,oBAAoB,CAACW,YAAY,CAAC,CAAC,CACpC,CAAC;EAEF,MAAM;IAAEC;EAAI,CAAC,GAAGN,kBAAkB,CAACO,OAAkC;EACrE,IAAI,EAAE,MAAM,IAAAC,qBAAgB,EAACF,GAAG,CAACG,GAAG,EAAER,gBAAuB,CAAC,CAAC,EAAE;IAC/D,MAAMS,OAAO,GAAI,kDAAiDT,gBAAgB,CAACU,GAAI,UAASL,GAAG,CAACG,GAAG,CAACE,GAAI,EAAC;IAC7GC,eAAM,CAACC,GAAG,CAACC,iBAAQ,CAACC,KAAK,EAAEL,OAAO,CAAC;IACnC,MAAM,IAAI5D,qBAAa,CAAC4D,OAAO,CAAC;EAClC;EAEA,OAAO,MAAMf,aAAa,CAACqB,MAAM,CAAC,IAAAC,qCAAwB,EAACxB,aAAa,CAAC,CAAC;AAC5E;AAEO,MAAMyB,6BAAsE,GACjF,MAAAA,CACEC,UAAU,EACVC,UAAU,EACVC,yBAAyB,EAAAC,IAAA,EAOzBC,YAAY,KACT;EAAA,IAPH;IACEC,uBAAuB;IACvBhG,uBAAuB;IACvBI,0BAA0B;IAC1B6F;EACF,CAAC,GAAAH,IAAA;EAGD,MAAMI,OAAO,GAAG,MAAMlC,qBAAqB,CACzC4B,UAAU,EACVD,UAAU,CAACtE,IAAI,EACf2E,uBACF,CAAC;EAEDZ,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACa,KAAK,EACb,uBAAsBC,IAAI,CAACC,SAAS,CAACH,OAAO,CAAE,EACjD,CAAC;EAED,IAAID,wBAAwB,EAAE;IAAA,IAAAK,YAAA;IAC5B,IAAI,CAACP,YAAY,EAAE;MACjB,MAAM,IAAIzE,qBAAa,CAAC,sBAAsB,CAAC;IACjD;IACA,MAAMiF,GAAG,IAAAD,YAAA,GAAGJ,OAAO,CAACM,GAAG,cAAAF,YAAA,gBAAAA,YAAA,GAAXA,YAAA,CAAaG,MAAM,cAAAH,YAAA,uBAAnBA,YAAA,CAAqBC,GAA2B;IAC5D,IAAI,CAACA,GAAG,IAAI,CAACpE,KAAK,CAACC,OAAO,CAACmE,GAAG,CAAC,IAAIA,GAAG,CAACrG,MAAM,KAAK,CAAC,EAAE;MACnD,MAAM,IAAIwG,8BAAqB,CAAC,2BAA2B,CAAC;IAC9D;IACA,MAAM,IAAAC,kBAAe,EAACJ,GAAG,EAAER,YAAY,CAAC;EAC1C;EAEA,MAAMjG,gBAAgB,GACpB6F,UAAU,CAACiB,mCAAmC,CAACf,yBAAyB,CAAC;EAE3E,IAAI,CAAC/F,gBAAgB,EAAE;IACrBsF,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACC,KAAK,EACb,gDAA+CM,yBAA0B,EAC5E,CAAC;IACD,MAAM,IAAIvE,qBAAa,CAAC,6CAA6C,CAAC;EACxE;EAEA,MAAMvB,mBAAmB,GAAI,MAAMmG,OAAO,CAACW,SAAS,CAACvC,oBAAM,CAG1D;EAED,MAAMwC,gBAAgB,GAAGjH,oBAAoB,CAC3CC,gBAAgB,EAChBC,mBAAmB,EACnBC,uBAAuB,EACvBI,0BACF,CAAC;EAED,MAAM2G,QAAQ,GACZ,OAAOhH,mBAAmB,CAACiH,GAAG,KAAK,QAAQ,GACvC,IAAIC,IAAI,CAAClH,mBAAmB,CAACiH,GAAG,GAAG,IAAI,CAAC,GACxC7G,SAAS;EAEf,IAAI,OAAOJ,mBAAmB,CAACmH,GAAG,KAAK,QAAQ,EAAE;IAC/C,MAAM,IAAI5F,qBAAa,CAAC,2CAA2C,CAAC;EACtE;EACA,MAAM6F,UAAU,GAAG,IAAIF,IAAI,CAAClH,mBAAmB,CAACmH,GAAG,GAAG,IAAI,CAAC;EAE3D9B,eAAM,CAACC,GAAG,CACRC,iBAAQ,CAACa,KAAK,EACb,sBAAqBC,IAAI,CAACC,SAAS,CAACS,gBAAgB,CAAE,gBAAeC,QAAS,EACjF,CAAC;EAED,OAAO;IACLD,gBAAgB;IAChBK,UAAU;IACVJ;EACF,CAAC;AACH,CAAC;AAACK,OAAA,CAAA1B,6BAAA,GAAAA,6BAAA"}

package/lib/commonjs/credential/issuance/mrtd-pop/02-init-challenge.js

@@ -3,50 +3,58 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.initChallenge = void 0;
-var _uuid = require("uuid");
+exports.createInitChallenge = createInitChallenge;
 var _ioWalletOauth = require("@pagopa/io-wallet-oauth2");
 var _ioWalletUtils = require("@pagopa/io-wallet-utils");
-var _pop = require("../../../utils/pop");
 var _logging = require("../../../utils/logging");
-var WalletInstanceAttestation = _interopRequireWildcard(require("../../../wallet-instance-attestation/v1.0.0/utils"));
 var _errors = require("../../../utils/errors");
 var _callbacks = require("../../../utils/callbacks");
-function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
-function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
-// TODO: decouple from version 1.0.0
-
-const initChallenge = async (issuerConf, initUrl, mrtd_auth_session, mrtd_pop_jwt_nonce, context) => {
-  const {
-    appFetch = fetch,
-    walletInstanceAttestation,
-    wiaCryptoContext
-  } = context;
-  const iss = WalletInstanceAttestation.decode(walletInstanceAttestation).payload.cnf.jwk.kid;
-  const signedWiaPoP = await (0, _pop.createPopToken)({
-    jti: (0, _uuid.v4)(),
-    aud: issuerConf.credential_issuer,
-    iss
-  }, wiaCryptoContext);
-  const initResult = await (0, _ioWalletOauth.fetchMrtdPopInit)({
-    popInitEndpoint: initUrl,
-    mrtdAuthSession: mrtd_auth_session,
-    mrtdPopJwtNonce: mrtd_pop_jwt_nonce,
-    walletAttestation: walletInstanceAttestation,
-    clientAttestationDPoP: signedWiaPoP,
-    callbacks: {
-      verifyJwt: (0, _callbacks.createVerifyJwtFromJwks)(issuerConf.keys),
-      fetch: appFetch
-    }
-  }).catch(handleInitChallengeError);
-  return {
-    challenge: initResult.challenge,
-    mrtd_pop_nonce: initResult.mrtdPopNonce,
-    pop_verify_endpoint: initResult.popVerifyEndpoint,
-    mrz: initResult.mrz
+/**
+ * Factory function to create `initChallenge` for MRTD PoP flow.
+ * The factory is needed to inject version specific SDK configuration.
+ * @param config Configuration object containing the IO Wallet SDK configuration
+ * @returns `initChallenge` function compliant with the public API
+ */
+function createInitChallenge(config) {
+  return async function initChallenge(issuerConf, initUrl, mrtd_auth_session, mrtd_pop_jwt_nonce, context) {
+    const {
+      appFetch = fetch,
+      walletInstanceAttestation,
+      wiaCryptoContext
+    } = context;
+    const clientAttestationDPoP = await (0, _ioWalletOauth.createClientAttestationPopJwt)({
+      config: config.sdkConfig,
+      callbacks: {
+        generateRandom: _callbacks.partialCallbacks.generateRandom,
+        signJwt: (0, _callbacks.createSignJwtFromCryptoContext)(wiaCryptoContext)
+      },
+      clientAttestation: walletInstanceAttestation,
+      authorizationServer: issuerConf.credential_issuer,
+      signer: {
+        method: "jwk",
+        alg: "ES256",
+        publicJwk: await wiaCryptoContext.getPublicKey()
+      }
+    });
+    const initResult = await (0, _ioWalletOauth.fetchMrtdPopInit)({
+      popInitEndpoint: initUrl,
+      mrtdAuthSession: mrtd_auth_session,
+      mrtdPopJwtNonce: mrtd_pop_jwt_nonce,
+      walletAttestation: walletInstanceAttestation,
+      clientAttestationDPoP,
+      callbacks: {
+        verifyJwt: (0, _callbacks.createVerifyJwtFromJwks)(issuerConf.keys),
+        fetch: appFetch
+      }
+    }).catch(handleInitChallengeError);
+    return {
+      challenge: initResult.challenge,
+      mrtd_pop_nonce: initResult.mrtdPopNonce,
+      pop_verify_endpoint: initResult.popVerifyEndpoint,
+      mrz: initResult.mrz
+    };
   };
-};
-exports.initChallenge = initChallenge;
+}
 const handleInitChallengeError = e => {
   _logging.Logger.log(_logging.LogLevel.ERROR, `Failed to get MRTD challenge: ${e}`);
   if (!(e instanceof _ioWalletUtils.UnexpectedStatusCodeError)) {

package/lib/commonjs/credential/issuance/mrtd-pop/02-init-challenge.js.map

@@ -1 +1 @@
-{"version":3,"names":["_uuid","require","_ioWalletOauth","_ioWalletUtils","_pop","_logging","WalletInstanceAttestation","_interopRequireWildcard","_errors","_callbacks","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","initChallenge","issuerConf","initUrl","mrtd_auth_session","mrtd_pop_jwt_nonce","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","iss","decode","payload","cnf","jwk","kid","signedWiaPoP","createPopToken","jti","uuidv4","aud","credential_issuer","initResult","fetchMrtdPopInit","popInitEndpoint","mrtdAuthSession","mrtdPopJwtNonce","walletAttestation","clientAttestationDPoP","callbacks","verifyJwt","createVerifyJwtFromJwks","keys","catch","handleInitChallengeError","challenge","mrtd_pop_nonce","mrtdPopNonce","pop_verify_endpoint","popVerifyEndpoint","mrz","exports","e","Logger","log","LogLevel","ERROR","SdkUnexpectedStatusCodeError","ResponseErrorBuilder","IssuerResponseError","handle","code","IssuerResponseErrorCodes","MrtdChallengeInitRequestFailed","message","buildFrom"],"sourceRoot":"../../../../../src","sources":["credential/issuance/mrtd-pop/02-init-challenge.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,cAAA,GAAAD,OAAA;AACA,IAAAE,cAAA,GAAAF,OAAA;AACA,IAAAG,IAAA,GAAAH,OAAA;AACA,IAAAI,QAAA,GAAAJ,OAAA;AACA,IAAAK,yBAAA,GAAAC,uBAAA,CAAAN,OAAA;AACA,IAAAO,OAAA,GAAAP,OAAA;AAMA,IAAAQ,UAAA,GAAAR,OAAA;AAAmE,SAAAS,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAJ,wBAAAQ,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAP6B;;AASzF,MAAMW,aAA0C,GAAG,MAAAA,CACxDC,UAAU,EACVC,OAAO,EACPC,iBAAiB,EACjBC,kBAAkB,EAClBC,OAAO,KACJ;EACH,MAAM;IACJC,QAAQ,GAAGC,KAAK;IAChBC,yBAAyB;IACzBC;EACF,CAAC,GAAGJ,OAAO;EAEX,MAAMK,GAAG,GAAGpC,yBAAyB,CAACqC,MAAM,CAACH,yBAAyB,CAAC,CACpEI,OAAO,CAACC,GAAG,CAACC,GAAG,CAACC,GAAG;EAEtB,MAAMC,YAAY,GAAG,MAAM,IAAAC,mBAAc,EACvC;IACEC,GAAG,EAAE,IAAAC,QAAM,EAAC,CAAC;IACbC,GAAG,EAAEnB,UAAU,CAACoB,iBAAiB;IACjCX;EACF,CAAC,EACDD,gBACF,CAAC;EAED,MAAMa,UAAU,GAAG,MAAM,IAAAC,+BAAgB,EAAC;IACxCC,eAAe,EAAEtB,OAAO;IACxBuB,eAAe,EAAEtB,iBAAiB;IAClCuB,eAAe,EAAEtB,kBAAkB;IACnCuB,iBAAiB,EAAEnB,yBAAyB;IAC5CoB,qBAAqB,EAAEZ,YAAY;IACnCa,SAAS,EAAE;MACTC,SAAS,EAAE,IAAAC,kCAAuB,EAAC9B,UAAU,CAAC+B,IAAI,CAAC;MACnDzB,KAAK,EAAED;IACT;EACF,CAAC,CAAC,CAAC2B,KAAK,CAACC,wBAAwB,CAAC;EAElC,OAAO;IACLC,SAAS,EAAEb,UAAU,CAACa,SAAS;IAC/BC,cAAc,EAAEd,UAAU,CAACe,YAAY;IACvCC,mBAAmB,EAAEhB,UAAU,CAACiB,iBAAiB;IACjDC,GAAG,EAAElB,UAAU,CAACkB;EAClB,CAAC;AACH,CAAC;AAACC,OAAA,CAAAzC,aAAA,GAAAA,aAAA;AAEF,MAAMkC,wBAAwB,GAAIQ,CAAU,IAAK;EAC/CC,eAAM,CAACC,GAAG,CAACC,iBAAQ,CAACC,KAAK,EAAG,iCAAgCJ,CAAE,EAAC,CAAC;EAEhE,IAAI,EAAEA,CAAC,YAAYK,wCAA4B,CAAC,EAAE;IAChD,MAAML,CAAC;EACT;EAEA,MAAM,IAAIM,4BAAoB,CAACC,2BAAmB,CAAC,CAChDC,MAAM,CAAC,GAAG,EAAE;IACXC,IAAI,EAAEC,gCAAwB,CAACC,8BAA8B;IAC7DC,OAAO,EAAE;EACX,CAAC,CAAC,CACDC,SAAS,CAACb,CAAC,CAAC;AACjB,CAAC"}
+{"version":3,"names":["_ioWalletOauth","require","_ioWalletUtils","_logging","_errors","_callbacks","createInitChallenge","config","initChallenge","issuerConf","initUrl","mrtd_auth_session","mrtd_pop_jwt_nonce","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","clientAttestationDPoP","createClientAttestationPopJwt","sdkConfig","callbacks","generateRandom","partialCallbacks","signJwt","createSignJwtFromCryptoContext","clientAttestation","authorizationServer","credential_issuer","signer","method","alg","publicJwk","getPublicKey","initResult","fetchMrtdPopInit","popInitEndpoint","mrtdAuthSession","mrtdPopJwtNonce","walletAttestation","verifyJwt","createVerifyJwtFromJwks","keys","catch","handleInitChallengeError","challenge","mrtd_pop_nonce","mrtdPopNonce","pop_verify_endpoint","popVerifyEndpoint","mrz","e","Logger","log","LogLevel","ERROR","SdkUnexpectedStatusCodeError","ResponseErrorBuilder","IssuerResponseError","handle","code","IssuerResponseErrorCodes","MrtdChallengeInitRequestFailed","message","buildFrom"],"sourceRoot":"../../../../../src","sources":["credential/issuance/mrtd-pop/02-init-challenge.ts"],"mappings":";;;;;;AAAA,IAAAA,cAAA,GAAAC,OAAA;AAIA,IAAAC,cAAA,GAAAD,OAAA;AAIA,IAAAE,QAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AAMA,IAAAI,UAAA,GAAAJ,OAAA;AAUA;AACA;AACA;AACA;AACA;AACA;AACO,SAASK,mBAAmBA,CACjCC,MAAc,EACe;EAC7B,OAAO,eAAeC,aAAaA,CACjCC,UAAU,EACVC,OAAO,EACPC,iBAAiB,EACjBC,kBAAkB,EAClBC,OAAO,EACP;IACA,MAAM;MACJC,QAAQ,GAAGC,KAAK;MAChBC,yBAAyB;MACzBC;IACF,CAAC,GAAGJ,OAAO;IAEX,MAAMK,qBAAqB,GAAG,MAAM,IAAAC,4CAA6B,EAAC;MAChEZ,MAAM,EAAEA,MAAM,CAACa,SAAS;MACxBC,SAAS,EAAE;QACTC,cAAc,EAAEC,2BAAgB,CAACD,cAAc;QAC/CE,OAAO,EAAE,IAAAC,yCAA8B,EAACR,gBAAgB;MAC1D,CAAC;MACDS,iBAAiB,EAAEV,yBAAyB;MAC5CW,mBAAmB,EAAElB,UAAU,CAACmB,iBAAiB;MACjDC,MAAM,EAAE;QACNC,MAAM,EAAE,KAAK;QACbC,GAAG,EAAE,OAAO;QACZC,SAAS,EAAE,MAAMf,gBAAgB,CAACgB,YAAY,CAAC;MACjD;IACF,CAAC,CAAC;IAEF,MAAMC,UAAU,GAAG,MAAM,IAAAC,+BAAgB,EAAC;MACxCC,eAAe,EAAE1B,OAAO;MACxB2B,eAAe,EAAE1B,iBAAiB;MAClC2B,eAAe,EAAE1B,kBAAkB;MACnC2B,iBAAiB,EAAEvB,yBAAyB;MAC5CE,qBAAqB;MACrBG,SAAS,EAAE;QACTmB,SAAS,EAAE,IAAAC,kCAAuB,EAAChC,UAAU,CAACiC,IAAI,CAAC;QACnD3B,KAAK,EAAED;MACT;IACF,CAAC,CAAC,CAAC6B,KAAK,CAACC,wBAAwB,CAAC;IAElC,OAAO;MACLC,SAAS,EAAEX,UAAU,CAACW,SAAS;MAC/BC,cAAc,EAAEZ,UAAU,CAACa,YAAY;MACvCC,mBAAmB,EAAEd,UAAU,CAACe,iBAAiB;MACjDC,GAAG,EAAEhB,UAAU,CAACgB;IAClB,CAAC;EACH,CAAC;AACH;AAEA,MAAMN,wBAAwB,GAAIO,CAAU,IAAK;EAC/CC,eAAM,CAACC,GAAG,CAACC,iBAAQ,CAACC,KAAK,EAAG,iCAAgCJ,CAAE,EAAC,CAAC;EAEhE,IAAI,EAAEA,CAAC,YAAYK,wCAA4B,CAAC,EAAE;IAChD,MAAML,CAAC;EACT;EAEA,MAAM,IAAIM,4BAAoB,CAACC,2BAAmB,CAAC,CAChDC,MAAM,CAAC,GAAG,EAAE;IACXC,IAAI,EAAEC,gCAAwB,CAACC,8BAA8B;IAC7DC,OAAO,EAAE;EACX,CAAC,CAAC,CACDC,SAAS,CAACb,CAAC,CAAC;AACjB,CAAC"}

package/lib/commonjs/credential/issuance/mrtd-pop/03-validate-challenge.js

@@ -3,62 +3,69 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.validateChallenge = exports.buildChallengeCallbackUrl = void 0;
+exports.buildChallengeCallbackUrl = void 0;
+exports.createValidateChallenge = createValidateChallenge;
 var _ioReactNativeJwt = require("@pagopa/io-react-native-jwt");
 var _ioWalletOauth = require("@pagopa/io-wallet-oauth2");
-var _uuid = require("uuid");
-var _pop = require("../../../utils/pop");
-var WalletInstanceAttestation = _interopRequireWildcard(require("../../../wallet-instance-attestation/v1.0.0/utils"));
 var _errors = require("../../../utils/errors");
 var _callbacks = require("../../../utils/callbacks");
-function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
-function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
-// TODO: decouple from 1.0.0 version
-
-const validateChallenge = async (issuerConf, verifyUrl, mrtd_auth_session, mrtd_pop_nonce, mrtd, ias, context) => {
-  const {
-    appFetch = fetch,
-    walletInstanceAttestation,
-    wiaCryptoContext
-  } = context;
-  const aud = issuerConf.credential_issuer;
-  const iss = WalletInstanceAttestation.decode(walletInstanceAttestation).payload.cnf.jwk.kid;
-  const signedWiaPoP = await (0, _pop.createPopToken)({
-    jti: (0, _uuid.v4)(),
-    aud,
-    iss
-  }, wiaCryptoContext);
-  const {
-    kid
-  } = await wiaCryptoContext.getPublicKey();
-  const mrtdValidationJwt = await new _ioReactNativeJwt.SignJWT(wiaCryptoContext).setProtectedHeader({
-    typ: "mrtd-ias+jwt",
-    kid
-  }).setPayload({
-    iss,
-    aud,
-    document_type: "cie",
-    mrtd,
-    ias
-  }).setIssuedAt().setExpirationTime("5m").sign();
-  const verifyResult = await (0, _ioWalletOauth.fetchMrtdPopVerify)({
-    popVerifyEndpoint: verifyUrl,
-    mrtdAuthSession: mrtd_auth_session,
-    mrtdPopNonce: mrtd_pop_nonce,
-    clientAttestationDPoP: signedWiaPoP,
-    mrtdValidationJwt,
-    walletAttestation: walletInstanceAttestation,
-    callbacks: {
-      fetch: appFetch,
-      ..._callbacks.partialCallbacks
-    }
-  }).catch(_errors.sdkUnexpectedStatusCodeToIssuerError);
-  return {
-    redirect_uri: verifyResult.redirectUri,
-    mrtd_val_pop_nonce: verifyResult.mrtdValPopNonce
+/**
+ * Factory function to create `validateChallenge` for MRTD PoP flow.
+ * The factory is needed to inject version specific SDK configuration.
+ * @param config Configuration object containing the IO Wallet SDK configuration
+ * @returns `validateChallenge` function compliant with the public API
+ */
+function createValidateChallenge(config) {
+  return async function validateChallenge(issuerConf, verifyUrl, mrtd_auth_session, mrtd_pop_nonce, mrtd, ias, context) {
+    const {
+      appFetch = fetch,
+      walletInstanceAttestation,
+      wiaCryptoContext
+    } = context;
+    const aud = issuerConf.credential_issuer;
+    const wiaPublicJwk = await wiaCryptoContext.getPublicKey();
+    const clientAttestationDPoP = await (0, _ioWalletOauth.createClientAttestationPopJwt)({
+      config: config.sdkConfig,
+      callbacks: {
+        generateRandom: _callbacks.partialCallbacks.generateRandom,
+        signJwt: (0, _callbacks.createSignJwtFromCryptoContext)(wiaCryptoContext)
+      },
+      clientAttestation: walletInstanceAttestation,
+      authorizationServer: aud,
+      signer: {
+        method: "jwk",
+        alg: "ES256",
+        publicJwk: wiaPublicJwk
+      }
+    });
+    const mrtdValidationJwt = await new _ioReactNativeJwt.SignJWT(wiaCryptoContext).setProtectedHeader({
+      typ: "mrtd-ias+jwt",
+      kid: wiaPublicJwk.kid
+    }).setPayload({
+      iss: wiaPublicJwk.kid,
+      aud,
+      document_type: "cie",
+      mrtd,
+      ias
+    }).setIssuedAt().setExpirationTime("5m").sign();
+    const verifyResult = await (0, _ioWalletOauth.fetchMrtdPopVerify)({
+      popVerifyEndpoint: verifyUrl,
+      mrtdAuthSession: mrtd_auth_session,
+      mrtdPopNonce: mrtd_pop_nonce,
+      clientAttestationDPoP,
+      mrtdValidationJwt,
+      walletAttestation: walletInstanceAttestation,
+      callbacks: {
+        fetch: appFetch,
+        ..._callbacks.partialCallbacks
+      }
+    }).catch(_errors.sdkUnexpectedStatusCodeToIssuerError);
+    return {
+      redirect_uri: verifyResult.redirectUri,
+      mrtd_val_pop_nonce: verifyResult.mrtdValPopNonce
+    };
   };
-};
-exports.validateChallenge = validateChallenge;
+}
 const buildChallengeCallbackUrl = async (redirectUri, valPopNonce, authSession) => {
   const params = new URLSearchParams({
     mrtd_val_pop_nonce: valPopNonce,

package/lib/commonjs/credential/issuance/mrtd-pop/03-validate-challenge.js.map

@@ -1 +1 @@
-{"version":3,"names":["_ioReactNativeJwt","require","_ioWalletOauth","_uuid","_pop","WalletInstanceAttestation","_interopRequireWildcard","_errors","_callbacks","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","validateChallenge","issuerConf","verifyUrl","mrtd_auth_session","mrtd_pop_nonce","mrtd","ias","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","aud","credential_issuer","iss","decode","payload","cnf","jwk","kid","signedWiaPoP","createPopToken","jti","uuidv4","getPublicKey","mrtdValidationJwt","SignJWT","setProtectedHeader","typ","setPayload","document_type","setIssuedAt","setExpirationTime","sign","verifyResult","fetchMrtdPopVerify","popVerifyEndpoint","mrtdAuthSession","mrtdPopNonce","clientAttestationDPoP","walletAttestation","callbacks","partialCallbacks","catch","sdkUnexpectedStatusCodeToIssuerError","redirect_uri","redirectUri","mrtd_val_pop_nonce","mrtdValPopNonce","exports","buildChallengeCallbackUrl","valPopNonce","authSession","params","URLSearchParams","callbackUrl"],"sourceRoot":"../../../../../src","sources":["credential/issuance/mrtd-pop/03-validate-challenge.ts"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AACA,IAAAC,cAAA,GAAAD,OAAA;AACA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,IAAA,GAAAH,OAAA;AACA,IAAAI,yBAAA,GAAAC,uBAAA,CAAAL,OAAA;AACA,IAAAM,OAAA,GAAAN,OAAA;AACA,IAAAO,UAAA,GAAAP,OAAA;AAA4D,SAAAQ,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAJ,wBAAAQ,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAFoC;;AAKzF,MAAMW,iBAAkD,GAAG,MAAAA,CAChEC,UAAU,EACVC,SAAS,EACTC,iBAAiB,EACjBC,cAAc,EACdC,IAAI,EACJC,GAAG,EACHC,OAAO,KACJ;EACH,MAAM;IACJC,QAAQ,GAAGC,KAAK;IAChBC,yBAAyB;IACzBC;EACF,CAAC,GAAGJ,OAAO;EAEX,MAAMK,GAAG,GAAGX,UAAU,CAACY,iBAAiB;EACxC,MAAMC,GAAG,GAAGxC,yBAAyB,CAACyC,MAAM,CAACL,yBAAyB,CAAC,CACpEM,OAAO,CAACC,GAAG,CAACC,GAAG,CAACC,GAAG;EAEtB,MAAMC,YAAY,GAAG,MAAM,IAAAC,mBAAc,EACvC;IACEC,GAAG,EAAE,IAAAC,QAAM,EAAC,CAAC;IACbX,GAAG;IACHE;EACF,CAAC,EACDH,gBACF,CAAC;EAED,MAAM;IAAEQ;EAAI,CAAC,GAAG,MAAMR,gBAAgB,CAACa,YAAY,CAAC,CAAC;EAErD,MAAMC,iBAAiB,GAAG,MAAM,IAAIC,yBAAO,CAACf,gBAAgB,CAAC,CAC1DgB,kBAAkB,CAAC;IAClBC,GAAG,EAAE,cAAc;IACnBT;EACF,CAAC,CAAC,CACDU,UAAU,CAAC;IACVf,GAAG;IACHF,GAAG;IACHkB,aAAa,EAAE,KAAK;IACpBzB,IAAI;IACJC;EACF,CAAC,CAAC,CACDyB,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,IAAI,CAAC,CACvBC,IAAI,CAAC,CAAC;EAET,MAAMC,YAAY,GAAG,MAAM,IAAAC,iCAAkB,EAAC;IAC5CC,iBAAiB,EAAElC,SAAS;IAC5BmC,eAAe,EAAElC,iBAAiB;IAClCmC,YAAY,EAAElC,cAAc;IAC5BmC,qBAAqB,EAAEnB,YAAY;IACnCK,iBAAiB;IACjBe,iBAAiB,EAAE9B,yBAAyB;IAC5C+B,SAAS,EAAE;MACThC,KAAK,EAAED,QAAQ;MACf,GAAGkC;IACL;EACF,CAAC,CAAC,CAACC,KAAK,CAACC,4CAAoC,CAAC;EAE9C,OAAO;IACLC,YAAY,EAAEX,YAAY,CAACY,WAAW;IACtCC,kBAAkB,EAAEb,YAAY,CAACc;EACnC,CAAC;AACH,CAAC;AAACC,OAAA,CAAAjD,iBAAA,GAAAA,iBAAA;AAEK,MAAMkD,yBAAkE,GAC7E,MAAAA,CAAOJ,WAAW,EAAEK,WAAW,EAAEC,WAAW,KAAK;EAC/C,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCP,kBAAkB,EAAEI,WAAW;IAC/BhD,iBAAiB,EAAEiD;EACrB,CAAC,CAAC;EAEF,MAAMG,WAAW,GAAI,GAAET,WAAY,IAAGO,MAAO,EAAC;EAC9C,OAAO;IAAEE;EAAY,CAAC;AACxB,CAAC;AAACN,OAAA,CAAAC,yBAAA,GAAAA,yBAAA"}
+{"version":3,"names":["_ioReactNativeJwt","require","_ioWalletOauth","_errors","_callbacks","createValidateChallenge","config","validateChallenge","issuerConf","verifyUrl","mrtd_auth_session","mrtd_pop_nonce","mrtd","ias","context","appFetch","fetch","walletInstanceAttestation","wiaCryptoContext","aud","credential_issuer","wiaPublicJwk","getPublicKey","clientAttestationDPoP","createClientAttestationPopJwt","sdkConfig","callbacks","generateRandom","partialCallbacks","signJwt","createSignJwtFromCryptoContext","clientAttestation","authorizationServer","signer","method","alg","publicJwk","mrtdValidationJwt","SignJWT","setProtectedHeader","typ","kid","setPayload","iss","document_type","setIssuedAt","setExpirationTime","sign","verifyResult","fetchMrtdPopVerify","popVerifyEndpoint","mrtdAuthSession","mrtdPopNonce","walletAttestation","catch","sdkUnexpectedStatusCodeToIssuerError","redirect_uri","redirectUri","mrtd_val_pop_nonce","mrtdValPopNonce","buildChallengeCallbackUrl","valPopNonce","authSession","params","URLSearchParams","callbackUrl","exports"],"sourceRoot":"../../../../../src","sources":["credential/issuance/mrtd-pop/03-validate-challenge.ts"],"mappings":";;;;;;;AAAA,IAAAA,iBAAA,GAAAC,OAAA;AACA,IAAAC,cAAA,GAAAD,OAAA;AAKA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAH,OAAA;AAUA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,uBAAuBA,CACrCC,MAAc,EACmB;EACjC,OAAO,eAAeC,iBAAiBA,CACrCC,UAAU,EACVC,SAAS,EACTC,iBAAiB,EACjBC,cAAc,EACdC,IAAI,EACJC,GAAG,EACHC,OAAO,EACP;IACA,MAAM;MACJC,QAAQ,GAAGC,KAAK;MAChBC,yBAAyB;MACzBC;IACF,CAAC,GAAGJ,OAAO;IAEX,MAAMK,GAAG,GAAGX,UAAU,CAACY,iBAAiB;IAExC,MAAMC,YAAY,GAAG,MAAMH,gBAAgB,CAACI,YAAY,CAAC,CAAC;IAE1D,MAAMC,qBAAqB,GAAG,MAAM,IAAAC,4CAA6B,EAAC;MAChElB,MAAM,EAAEA,MAAM,CAACmB,SAAS;MACxBC,SAAS,EAAE;QACTC,cAAc,EAAEC,2BAAgB,CAACD,cAAc;QAC/CE,OAAO,EAAE,IAAAC,yCAA8B,EAACZ,gBAAgB;MAC1D,CAAC;MACDa,iBAAiB,EAAEd,yBAAyB;MAC5Ce,mBAAmB,EAAEb,GAAG;MACxBc,MAAM,EAAE;QACNC,MAAM,EAAE,KAAK;QACbC,GAAG,EAAE,OAAO;QACZC,SAAS,EAAEf;MACb;IACF,CAAC,CAAC;IAEF,MAAMgB,iBAAiB,GAAG,MAAM,IAAIC,yBAAO,CAACpB,gBAAgB,CAAC,CAC1DqB,kBAAkB,CAAC;MAClBC,GAAG,EAAE,cAAc;MACnBC,GAAG,EAAEpB,YAAY,CAACoB;IACpB,CAAC,CAAC,CACDC,UAAU,CAAC;MACVC,GAAG,EAAEtB,YAAY,CAACoB,GAAG;MACrBtB,GAAG;MACHyB,aAAa,EAAE,KAAK;MACpBhC,IAAI;MACJC;IACF,CAAC,CAAC,CACDgC,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,IAAI,CAAC,CACvBC,IAAI,CAAC,CAAC;IAET,MAAMC,YAAY,GAAG,MAAM,IAAAC,iCAAkB,EAAC;MAC5CC,iBAAiB,EAAEzC,SAAS;MAC5B0C,eAAe,EAAEzC,iBAAiB;MAClC0C,YAAY,EAAEzC,cAAc;MAC5BY,qBAAqB;MACrBc,iBAAiB;MACjBgB,iBAAiB,EAAEpC,yBAAyB;MAC5CS,SAAS,EAAE;QACTV,KAAK,EAAED,QAAQ;QACf,GAAGa;MACL;IACF,CAAC,CAAC,CAAC0B,KAAK,CAACC,4CAAoC,CAAC;IAE9C,OAAO;MACLC,YAAY,EAAER,YAAY,CAACS,WAAW;MACtCC,kBAAkB,EAAEV,YAAY,CAACW;IACnC,CAAC;EACH,CAAC;AACH;AAEO,MAAMC,yBAAkE,GAC7E,MAAAA,CAAOH,WAAW,EAAEI,WAAW,EAAEC,WAAW,KAAK;EAC/C,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAAC;IACjCN,kBAAkB,EAAEG,WAAW;IAC/BnD,iBAAiB,EAAEoD;EACrB,CAAC,CAAC;EAEF,MAAMG,WAAW,GAAI,GAAER,WAAY,IAAGM,MAAO,EAAC;EAC9C,OAAO;IAAEE;EAAY,CAAC;AACxB,CAAC;AAACC,OAAA,CAAAN,yBAAA,GAAAA,yBAAA"}