@pagopa/io-react-native-wallet 3.6.1 → 3.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/io-react-native-wallet",
-  "version": "3.6.1",
+  "version": "3.6.3",
   "description": "Provide data structures, helpers and API for IO Wallet",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",
@@ -140,11 +140,11 @@
     ]
   },
   "dependencies": {
-    "@pagopa/io-wallet-oauth2": "1.5.3",
-    "@pagopa/io-wallet-oid-federation": "1.5.3",
-    "@pagopa/io-wallet-oid4vci": "1.5.3",
-    "@pagopa/io-wallet-oid4vp": "1.5.3",
-    "@pagopa/io-wallet-utils": "1.5.3",
+    "@pagopa/io-wallet-oauth2": "1.5.4-alpha-20260717125503",
+    "@pagopa/io-wallet-oid-federation": "1.5.4-alpha-20260717125503",
+    "@pagopa/io-wallet-oid4vci": "1.5.4-alpha-20260717125503",
+    "@pagopa/io-wallet-oid4vp": "1.5.4-alpha-20260717125503",
+    "@pagopa/io-wallet-utils": "1.5.4-alpha-20260717125503",
     "@sd-jwt/core": "^0.19.0",
     "@sd-jwt/crypto-nodejs": "^0.19.0",
     "@sd-jwt/jwt-status-list": "^0.19.0",

package/src/client/generated/wallet-provider.ts

@@ -64,6 +64,14 @@ export const CreateWalletInstanceAttestationBody = z.string();
 export type CreateWalletUnitAttestationBody = z.infer<typeof CreateWalletUnitAttestationBody>;
 export const CreateWalletUnitAttestationBody = z.string();
 
+export type CreateKeyAttestationBody = z.infer<typeof CreateKeyAttestationBody>;
+export const CreateKeyAttestationBody = z.string();
+
+export type KeyAttestation = z.infer<typeof KeyAttestation>;
+export const KeyAttestation = z.object({
+  key_attestation: z.string(),
+});
+
 export type ProblemJson = z.infer<typeof ProblemJson>;
 export const ProblemJson = z.object({
   type: z.string().optional(),
@@ -185,6 +193,19 @@ export const post_CreateWalletUnitAttestation = {
   response: WalletUnitAttestation,
 };
 
+export type post_CreateKeyAttestation = typeof post_CreateKeyAttestation;
+export const post_CreateKeyAttestation = {
+  method: z.literal("POST"),
+  path: z.literal("/key-attestations"),
+  parameters: z.object({
+    header: z.object({
+      "Content-Type": z.string().optional(),
+    }),
+    body: CreateKeyAttestationBody,
+  }),
+  response: KeyAttestation,
+};
+
 // <EndpointByMethod>
 export const EndpointByMethod = {
   get: {
@@ -199,6 +220,7 @@ export const EndpointByMethod = {
     "/wallet-attestations": post_CreateWalletAttestation,
     "/wallet-instance-attestations": post_CreateWalletInstanceAttestation,
     "/wallet-unit-attestations": post_CreateWalletUnitAttestation,
+    "/key-attestations": post_CreateKeyAttestation,
   },
   put: {
     "/wallet-instances/{id}/status": put_SetWalletInstanceStatus,

package/src/credential/issuance/v1.3.3/01-evaluate-issuer-trust.ts

@@ -1,8 +1,8 @@
 import {
   fetchMetadata,
-  type MetadataResponseV1_3,
+  type MetadataResponseV1_4,
 } from "@pagopa/io-wallet-oid4vci";
-import { sdkConfigV1_3 } from "../../../utils/config";
+import { sdkConfigV1_4 } from "../../../utils/config";
 import type { IssuanceApi } from "../api";
 import { mapToIssuerConfig } from "./mappers";
 
@@ -11,13 +11,13 @@ export const evaluateIssuerTrust: IssuanceApi["evaluateIssuerTrust"] = async (
   context = {}
 ) => {
   const issuerMetadata = (await fetchMetadata({
-    config: sdkConfigV1_3,
+    config: sdkConfigV1_4,
     credentialIssuerUrl: issuerUrl,
     authorizationServer: context.authorizationServer,
     callbacks: {
       fetch: context.appFetch,
     },
-  })) as MetadataResponseV1_3;
+  })) as MetadataResponseV1_4;
 
   return { issuerConf: mapToIssuerConfig(issuerMetadata) };
 };

package/src/credential/issuance/v1.3.3/mappers.ts

@@ -1,4 +1,4 @@
-import type { MetadataResponseV1_3 } from "@pagopa/io-wallet-oid4vci";
+import type { MetadataResponseV1_4 } from "@pagopa/io-wallet-oid4vci";
 import type { ParsedAuthorizeRequestResult } from "@pagopa/io-wallet-oid4vp";
 import { assert } from "../../../utils/misc";
 import { createMapper } from "../../../utils/mappers";
@@ -9,7 +9,7 @@ import { IssuerConfig } from "../api/IssuerConfig";
 type CredentialConfigurations =
   IssuerConfig["credential_configurations_supported"];
 type OpenIdCredentialIssuer =
-  MetadataResponseV1_3["metadata"]["openid_credential_issuer"];
+  MetadataResponseV1_4["metadata"]["openid_credential_issuer"];
 
 const mapCredentialConfigurationsSupported = (
   oidIssuer: NonNullable<OpenIdCredentialIssuer>
@@ -34,7 +34,7 @@ const mapCredentialConfigurationsSupported = (
   );
 
 export const mapToIssuerConfig = createMapper<
-  MetadataResponseV1_3,
+  MetadataResponseV1_4,
   IssuerConfig
 >(
   (x) => {

package/src/credential/presentation/v1.3.3/04-verify-certificate-chain.ts

@@ -20,14 +20,22 @@ export const verifyAuthRequestCertificateChain: RemotePresentationApi["verifyAut
 
     const requestObject = decode(requestObjectJwt);
 
-    const certChain = requestObject.protectedHeader.x5c;
+    const x5c = requestObject.protectedHeader.x5c;
 
-    if (!certChain) {
+    if (!x5c) {
       throw new MissingX509CertsError(
         "No certificate chain (x5c) found in the Request Object"
       );
     }
 
+    // The native validator expects the chain to include the leaf and any
+    // intermediates, excluding the trust anchor (supplied separately as
+    // `caRootCert`). Some RPs include the anchor as the last entry of x5c,
+    // which must be stripped or the native validator (notably on iOS) treats
+    // it as an extraneous/unexpected trailing certificate and fails.
+    const certChain =
+      x5c.length > 1 && x5c.at(-1) === caRootCert ? x5c.slice(0, -1) : x5c;
+
     const validationResult = await verifyCertificateChain(
       certChain,
       caRootCert,
@@ -41,7 +49,7 @@ export const verifyAuthRequestCertificateChain: RemotePresentationApi["verifyAut
       );
 
       throw new X509ValidationError(
-        "X.509 certificate chain validation failed"
+        `X.509 certificate chain validation failed. Status: ${validationResult.validationStatus}. Error: ${validationResult.errorMessage}`
       );
     }
 

package/src/credential/status/api/status-list.ts

@@ -73,4 +73,18 @@ export interface StatusListApi {
     rawStatus: string;
     status: string;
   };
+
+  /**
+   * Extracts the status list entry from a raw credential, i.e. the object containing `uri` and `ìdx`.
+   *
+   * This method **does not perform any HTTP request** to fetch the list. Use {@link get} or {@link getByUri} instead to fetch it.
+   * @since 1.3.3
+   * @param credential The raw credential
+   * @param format The credential format
+   * @returns The status list entry extracted from the credential
+   */
+  getStatusListEntry(
+    credential: string,
+    format: CredentialFormat
+  ): Promise<{ idx: number; uri: string }>;
 }

package/src/credential/status/v1.3.3/01-status-list.ts

@@ -6,13 +6,12 @@ import {
 } from "@sd-jwt/jwt-status-list";
 import { IoWalletError } from "../../../utils/errors";
 import { hasStatusOrThrow } from "../../../utils/misc";
-import type { CredentialFormat } from "../../../credential/issuance/api";
 import type { StatusListApi } from "../api/status-list";
 
-const getStatusListEntry = async (
-  credential: string,
-  format: CredentialFormat
-): Promise<StatusListEntry> => {
+export const getStatusListEntry: StatusListApi["getStatusListEntry"] = async (
+  credential,
+  format
+) => {
   let statusListEntry: StatusListEntry | undefined;
 
   if (format === "mso_mdoc") {

package/src/credential/status/v1.3.3/index.ts

@@ -1,5 +1,9 @@
 import type { CredentialStatusApi } from "../api";
-import { getStatusList, getStatusListByUri } from "./01-status-list";
+import {
+  getStatusList,
+  getStatusListByUri,
+  getStatusListEntry,
+} from "./01-status-list";
 import { verifyAndParseStatusList } from "./02-verify-and-parse-status-list";
 import { getStatus } from "./03-get-status";
 
@@ -13,5 +17,6 @@ export const CredentialStatus: CredentialStatusApi = {
     getByUri: getStatusListByUri,
     verifyAndParse: verifyAndParseStatusList,
     getStatus,
+    getStatusListEntry,
   },
 };

package/src/credentials-catalogue/api/DigitalCredentialsCatalogue.ts

@@ -118,7 +118,6 @@ export const DigitalCredential = z.object({
   authentic_sources: z.array(AuthenticSource),
   parent_credentials: z.array(z.string()).optional(),
   formats: z.array(CredentialFormat).optional(),
-  // claims: z.array(Claim), // TODO: [SIW-3978] Should we keep claims?
 });
 export type DigitalCredential = z.infer<typeof DigitalCredential>;
 

package/src/credentials-catalogue/v1.3.3/mappers.ts

@@ -70,8 +70,14 @@ export const mapToCredentialsCatalogue = createMapper<
         `Schemas for ${credentialType} must be present in the Schema Registry`
       );
       return schemas.map((schema) => ({
-        configuration_id: schema.id, // TODO: [SIW-3978] Fix this, the schema ID does not correspond to configuration_id
-        ...schema,
+        // Since the schema registry does not contain the actual configuration ID, it is composed according
+        // to the IT-Wallet Credential Issuer's convention. Note that this might not be true for every Issuer.
+        configuration_id: `${schema.format.replace(/[+-]/g, "_")}_${schema.credential_type}`,
+        format: schema.format,
+        vct: schema.vct,
+        docType: schema.docType,
+        schema_uri: schema.schema_uri,
+        "schema_uri#integrity": schema["schema_uri#integrity"],
       }));
     };
 

package/src/sd-jwt/types.ts

@@ -14,7 +14,7 @@ const StatusAssertion = z.object({
 });
 
 const StatusList = z.object({
-  idx: z.string(),
+  idx: z.number(),
   uri: z.string(),
 });
 

package/src/wallet-unit-attestation/v1.3.3/issuing.ts

@@ -127,7 +127,7 @@ export const getAttestation: WalletUnitAttestationSupportedApi["getAttestation"]
     );
 
     const response = await api
-      .post("/wallet-unit-attestations", {
+      .post("/key-attestations", {
         header: {
           "Content-Type": "text/plain",
         },
@@ -137,11 +137,11 @@ export const getAttestation: WalletUnitAttestationSupportedApi["getAttestation"]
 
     Logger.log(
       LogLevel.DEBUG,
-      `Obtained Wallet Unit Attestation: ${response.wallet_unit_attestation}`
+      `Obtained Wallet Unit Attestation: ${response.key_attestation}`
     );
 
     return {
       format: "jwt",
-      attestation: response.wallet_unit_attestation,
+      attestation: response.key_attestation,
     };
   };

package/src/wallet-unit-attestation/v1.3.3/types.ts

@@ -17,5 +17,5 @@ export type WalletUnitAttestationResponse = z.infer<
   typeof WalletUnitAttestationResponse
 >;
 export const WalletUnitAttestationResponse = z.object({
-  wallet_unit_attestation: z.string(),
+  key_attestation: z.string(),
 });