@pagopa/io-react-native-wallet 3.6.2 → 3.6.4

package/src/credential/issuance/api/03-complete-user-authorization.ts

@@ -1,51 +1,34 @@
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
+
+import type { RequestObject } from "../../../credential/presentation/api";
+import type { EvaluateDcqlQueryApi } from "../../../credential/presentation/api/06-evaluate-dcql-query";
 import type {
   AuthorizationChallengeResult,
   AuthorizationResult,
 } from "../../../utils/auth";
-import type { RequestObject } from "../../../credential/presentation/api";
-import type { EvaluateDcqlQueryApi } from "../../../credential/presentation/api/06-evaluate-dcql-query";
 import type { Out } from "../../../utils/misc";
 import type { IssuerConfig } from "./IssuerConfig";
 
-export type EvaluatedDcqlQuery = Out<EvaluateDcqlQueryApi["evaluateDcqlQuery"]>;
-
 export interface CompleteUserAuthorizationApi {
   /**
-   * WARNING: This function must be called after {@link startUserAuthorization}. The next step is evaluating the returned request object's DCQL query with {@link EvaluateDcqlQueryApi.evaluateDcqlQuery}.
+   * WARNING: This function must be called after {@link startUserAuthorization}.
    *
-   * The interface of the phase to complete User authorization via presentation of existing credentials when the response mode is "form_post.jwt".
-   * It is used as a first step to complete the user authorization by obtaining the requested credential to be presented from the authorization server.
-   * The information is obtained by performing a GET request to the authorization endpoint with request_uri and client_id parameters.
+   * The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
+   * Builds the authorization URL to which the end user should be redirected to continue the authentication flow.
    * @since 1.0.0
    *
    * @param issuerRequestUri the URI of the issuer where the request is sent
    * @param clientId Identifies the current client across all the requests of the issuing flow returned by {@link startUserAuthorization}
    * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
-   * @param appFetch (optional) fetch api implementation. Default: built-in fetch
-   * @returns the request object which contains the credential to be presented in order to obtain the requested credential
-   * @throws {ValidationFailed} if an error while validating the response
+   * @param idpHint Unique identifier of the IDP selected by the user (optional)
+   * @returns An object containing the authorization URL
    */
-  getRequestedCredentialToBePresented(
+  buildAuthorizationUrl(
     issuerRequestUri: string,
     clientId: string,
     issuerConf: IssuerConfig,
-    appFetch?: GlobalFetch["fetch"]
-  ): Promise<RequestObject>;
-
-  /**
-   * WARNING: This function must be called after obtaining the authorization redirect URL from the webviews (SPID and CIE L3) or browser for CIEID.
-   *
-   * Complete User authorization via strong identification when the response mode is "query" and the request credential is a PersonIdentificationData.
-   * This function parses the authorization redirect URL to extract the authorization response.
-   * @since 1.0.0
-   *
-   * @param authRedirectUrl The URL to which the end user should be redirected to start the authentication flow
-   * @returns the authorization response which contains code, state and iss
-   */
-  completePidUserAuthorizationWithQueryMode(
-    authRedirectUrl: string
-  ): Promise<AuthorizationResult>;
+    idpHint?: string,
+  ): Promise<{ authUrl: string }>;
 
   /**
    * Complete user authorization when the response mode is "query" and the requested credential is an Electronic Attestation of Attributes (EAA).
@@ -68,7 +51,21 @@ export interface CompleteUserAuthorizationApi {
       appFetch?: GlobalFetch["fetch"];
       /** Function to fetch the final redirect uri; it allows full control on how redirects are handled. If not provided, `appFetch` is used. */
       fetchFinalRedirectUri?: (url: string) => Promise<string | undefined>;
-    }
+    },
+  ): Promise<AuthorizationResult>;
+
+  /**
+   * WARNING: This function must be called after obtaining the authorization redirect URL from the webviews (SPID and CIE L3) or browser for CIEID.
+   *
+   * Complete User authorization via strong identification when the response mode is "query" and the request credential is a PersonIdentificationData.
+   * This function parses the authorization redirect URL to extract the authorization response.
+   * @since 1.0.0
+   *
+   * @param authRedirectUrl The URL to which the end user should be redirected to start the authentication flow
+   * @returns the authorization response which contains code, state and iss
+   */
+  completePidUserAuthorizationWithQueryMode(
+    authRedirectUrl: string,
   ): Promise<AuthorizationResult>;
 
   /**
@@ -90,9 +87,9 @@ export interface CompleteUserAuthorizationApi {
     issuerConf: IssuerConfig,
     evaluatedDcqlQuery: EvaluatedDcqlQuery,
     context: {
-      wiaCryptoContext: CryptoContext;
       appFetch?: GlobalFetch["fetch"];
-    }
+      wiaCryptoContext: CryptoContext;
+    },
   ): Promise<AuthorizationResult>;
 
   /**
@@ -104,26 +101,30 @@ export interface CompleteUserAuthorizationApi {
    * @returns the authorization response which contains the challenge
    */
   continueUserAuthorizationWithMRTDPoPChallenge(
-    authRedirectUrl: string
+    authRedirectUrl: string,
   ): Promise<AuthorizationChallengeResult>;
 
   /**
-   * WARNING: This function must be called after {@link startUserAuthorization}.
+   * WARNING: This function must be called after {@link startUserAuthorization}. The next step is evaluating the returned request object's DCQL query with {@link EvaluateDcqlQueryApi.evaluateDcqlQuery}.
    *
-   * The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
-   * Builds the authorization URL to which the end user should be redirected to continue the authentication flow.
+   * The interface of the phase to complete User authorization via presentation of existing credentials when the response mode is "form_post.jwt".
+   * It is used as a first step to complete the user authorization by obtaining the requested credential to be presented from the authorization server.
+   * The information is obtained by performing a GET request to the authorization endpoint with request_uri and client_id parameters.
    * @since 1.0.0
    *
    * @param issuerRequestUri the URI of the issuer where the request is sent
    * @param clientId Identifies the current client across all the requests of the issuing flow returned by {@link startUserAuthorization}
    * @param issuerConf The issuer configuration returned by {@link evaluateIssuerTrust}
-   * @param idpHint Unique identifier of the IDP selected by the user (optional)
-   * @returns An object containing the authorization URL
+   * @param appFetch (optional) fetch api implementation. Default: built-in fetch
+   * @returns the request object which contains the credential to be presented in order to obtain the requested credential
+   * @throws {ValidationFailed} if an error while validating the response
    */
-  buildAuthorizationUrl(
+  getRequestedCredentialToBePresented(
     issuerRequestUri: string,
     clientId: string,
     issuerConf: IssuerConfig,
-    idpHint?: string
-  ): Promise<{ authUrl: string }>;
+    appFetch?: GlobalFetch["fetch"],
+  ): Promise<RequestObject>;
 }
+
+export type EvaluatedDcqlQuery = Out<EvaluateDcqlQueryApi["evaluateDcqlQuery"]>;

package/src/credential/issuance/api/04-authorize-access.ts

@@ -1,4 +1,5 @@
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
+
 import type { IssuerConfig } from "./IssuerConfig";
 import type { TokenResponse } from "./types";
 
@@ -28,10 +29,10 @@ export interface AuthorizeAccessApi {
     redirectUri: string,
     codeVerifier: string,
     context: {
+      appFetch?: GlobalFetch["fetch"];
+      dPopCryptoContext: CryptoContext;
       walletInstanceAttestation: string;
       wiaCryptoContext: CryptoContext;
-      dPopCryptoContext: CryptoContext;
-      appFetch?: GlobalFetch["fetch"];
-    }
+    },
   ): Promise<{ accessToken: TokenResponse }>;
 }

package/src/credential/issuance/api/05-obtain-credential.ts

@@ -1,7 +1,8 @@
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
+
 import type { Out } from "../../../utils/misc";
-import type { IssuerConfig } from "./IssuerConfig";
 import type { AuthorizeAccessApi } from "./04-authorize-access";
+import type { IssuerConfig } from "./IssuerConfig";
 import type { CredentialFormat } from "./types";
 
 export interface ObtainCredentialApi {
@@ -32,11 +33,11 @@ export interface ObtainCredentialApi {
       credential_identifier?: string;
     },
     context: {
-      dPopCryptoContext: CryptoContext;
+      appFetch?: GlobalFetch["fetch"];
       credentialCryptoContext: CryptoContext;
+      dPopCryptoContext: CryptoContext;
       walletUnitAttestation?: string;
-      appFetch?: GlobalFetch["fetch"];
-    }
+    },
   ): Promise<{
     credential: string;
     format: CredentialFormat;
@@ -59,10 +60,10 @@ export interface ObtainCredentialApi {
       credential_identifier: string;
     },
     context: {
-      dPopCryptoContext: CryptoContext;
+      appFetch?: GlobalFetch["fetch"];
       credentialCryptoContexts: CryptoContext[];
+      dPopCryptoContext: CryptoContext;
       walletUnitAttestation?: string;
-      appFetch?: GlobalFetch["fetch"];
-    }
+    },
   ): Promise<{ credential: string; format: CredentialFormat }[]>;
 }

package/src/credential/issuance/api/06-verify-and-parse-credential.ts

@@ -1,4 +1,5 @@
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
+
 import type { IssuerConfig } from "./IssuerConfig";
 import type { ParsedCredential } from "./types";
 
@@ -37,10 +38,10 @@ export interface VerifyAndParseCredentialApi {
        */
       validateCertificateChain?: boolean;
     },
-    x509CertRoot?: string
+    x509CertRoot?: string,
   ): Promise<{
-    parsedCredential: ParsedCredential;
     expiration: Date;
     issuedAt: Date | undefined;
+    parsedCredential: ParsedCredential;
   }>;
 }

package/src/credential/issuance/api/IssuerConfig.ts

@@ -1,47 +1,48 @@
 import { z } from "zod";
-import { JWK } from "../../../utils/jwk";
+
 import { FederationEntityMetadata } from "../../../trust/common/types";
+import { JWK } from "../../../utils/jwk";
 
 const DisplayConfig = z.object({
-  name: z.string(),
   locale: z.string(),
+  name: z.string(),
 });
 
 const ClaimConfig = z.object({
-  path: z.array(z.union([z.string(), z.number(), z.null()])),
   display: z.array(DisplayConfig).optional(),
+  path: z.array(z.union([z.string(), z.number(), z.null()])),
 });
 
 const IssuanceErrorSupported = z.object({
   display: z.array(
     z.object({
-      title: z.string(),
       description: z.string(),
       locale: z.string(),
-    })
+      title: z.string(),
+    }),
   ),
 });
 
 const CredentialConfig = z.intersection(
   z.discriminatedUnion("format", [
     z.object({ format: z.literal("dc+sd-jwt"), vct: z.string() }),
-    z.object({ format: z.literal("mso_mdoc"), doctype: z.string() }),
+    z.object({ doctype: z.string(), format: z.literal("mso_mdoc") }),
   ]),
   z.object({
-    scope: z.string(),
-    display: z.array(DisplayConfig),
-    claims: z.array(ClaimConfig),
     /**
      * @deprecated Use the Credentials Catalogue to get the Auth Source
      */
     authentic_source: z.string().optional(),
+    claims: z.array(ClaimConfig),
+    display: z.array(DisplayConfig),
     /**
      * @deprecated Kept for backward compatibility with v0.7.1
      */
     issuance_errors_supported: z
       .record(z.string(), IssuanceErrorSupported)
       .optional(),
-  })
+    scope: z.string(),
+  }),
 );
 
 /**
@@ -49,26 +50,26 @@ const CredentialConfig = z.intersection(
  */
 export type IssuerConfig = z.infer<typeof IssuerConfig>;
 export const IssuerConfig = z.object({
-  credential_issuer: z.string(),
+  authorization_endpoint: z.string(),
   /**
    * Authorization Servers advertised by the Credential Issuer. Present when the
    * Issuer relies on one or more external Authorization Servers; used to validate
    * the `authorization_server` selected by a credential offer.
    */
   authorization_servers: z.tuple([z.string()], z.string()).optional(),
-  pushed_authorization_request_endpoint: z.string(),
-  authorization_endpoint: z.string(),
-  token_endpoint: z.string(),
-  nonce_endpoint: z.string(),
-  status_assertion_endpoint: z.string().optional(),
-  credential_endpoint: z.string(),
-  keys: z.array(JWK),
   credential_configurations_supported: z.record(z.string(), CredentialConfig),
-  federation_entity: FederationEntityMetadata,
+  credential_endpoint: z.string(),
   credential_issuance_batch_size: z.number().optional(),
+  credential_issuer: z.string(),
   encrypted_response_enc_values_supported: z.array(z.string()).optional(),
+  federation_entity: FederationEntityMetadata,
+  keys: z.array(JWK),
+  nonce_endpoint: z.string(),
+  pushed_authorization_request_endpoint: z.string(),
   /**
    * @deprecated
    */
   response_modes_supported: z.array(z.string()).optional(),
+  status_assertion_endpoint: z.string().optional(),
+  token_endpoint: z.string(),
 });

package/src/credential/issuance/api/index.ts

@@ -7,16 +7,16 @@ import { type VerifyAndParseCredentialApi } from "./06-verify-and-parse-credenti
 import { type MRTDPoPApi } from "./mrtd-pop";
 
 export interface IssuanceApi
-  extends EvaluateIssuerTrustApi,
-    StartUserAuthorizationApi,
+  extends AuthorizeAccessApi,
     CompleteUserAuthorizationApi,
-    AuthorizeAccessApi,
+    EvaluateIssuerTrustApi,
     ObtainCredentialApi,
+    StartUserAuthorizationApi,
     VerifyAndParseCredentialApi {
   MRTDPoP: MRTDPoPApi;
 }
 
-export type { IssuerConfig } from "./IssuerConfig";
 export type { EvaluatedDcqlQuery } from "./03-complete-user-authorization";
+export type { IssuerConfig } from "./IssuerConfig";
 export type * as MRTDPoP from "./mrtd-pop";
 export type * from "./types";

package/src/credential/issuance/api/mrtd-pop/index.ts

@@ -1,4 +1,5 @@
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
+
 import type { IssuerConfig } from "../IssuerConfig";
 import type {
   IasPayload,
@@ -10,28 +11,18 @@ import type {
 
 export interface MRTDPoPApi {
   /**
-   * Verifies and parses the payload of a MRTD Proof Challenge Info JWT obtained after the primary authentication.
-   *
-   * This function performs the following steps:
-   * 1. Validates the JWT signature using the issuer's JWKS.
-   * 2. Decodes the JWT and parses its structure according to the {@link MrtdProofChallengeInfo} schema.
-   * 3. Verifies that the `aud` claim matches the client's public key ID.
-   * 4. Checks that the JWT is not expired and was not issued in the future.
-   *
-   * @param issuerConf - The issuer configuration containing the JWKS for signature verification.
-   * @param challengeInfoJwt - The JWT string representing the MRTD Proof Challenge Info.
-   * @param context - The context containing the WIA crypto context used to retrieve the client public key.
-   * @returns The parsed payload of the MRTD Proof Challenge Info JWT.
-   * @throws {Error} If the JWT signature is invalid, the structure is malformed, the `aud` claim does not match,
-   * or the JWT is expired/not yet valid.
+   * WARNING: This function must be called after {@link validateChallenge}. The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
+   * Builds the callback URL to which the end user should be redirected to continue the authentication flow after the MRTD challenge validation.
+   * @param redirectUri - The redirect URI provided by the issuer after the challenge validation to continue the authentication flow.
+   * @param valPopNonce - The MRTD validation PoP nonce obtained from the challenge validation response.
+   * @param authSession - The MRTD authentication session identifier used for session binding.
+   * @returns An object containing the callback URL
    */
-  verifyAndParseChallengeInfo(
-    issuerConf: IssuerConfig,
-    challengeInfoJwt: string,
-    context: {
-      wiaCryptoContext: CryptoContext;
-    }
-  ): Promise<MrtdProofChallengeInfo>;
+  buildChallengeCallbackUrl(
+    redirectUri: string,
+    valPopNonce: string,
+    authSession: string,
+  ): Promise<{ callbackUrl: string }>;
 
   /**
    * Initializes the MRTD challenge with the data received from the issuer after the primary authentication.
@@ -51,10 +42,10 @@ export interface MRTDPoPApi {
     mrtd_auth_session: string,
     mrtd_pop_jwt_nonce: string,
     context: {
-      wiaCryptoContext: CryptoContext;
-      walletInstanceAttestation: string;
       appFetch?: GlobalFetch["fetch"];
-    }
+      walletInstanceAttestation: string;
+      wiaCryptoContext: CryptoContext;
+    },
   ): Promise<MrtdPoPChallenge>;
 
   /**
@@ -80,25 +71,35 @@ export interface MRTDPoPApi {
     mrtd: MrtdPayload,
     ias: IasPayload,
     context: {
-      wiaCryptoContext: CryptoContext;
-      walletInstanceAttestation: string;
       appFetch?: GlobalFetch["fetch"];
-    }
+      walletInstanceAttestation: string;
+      wiaCryptoContext: CryptoContext;
+    },
   ): Promise<MrtdPopVerificationResult>;
 
   /**
-   * WARNING: This function must be called after {@link validateChallenge}. The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
-   * Builds the callback URL to which the end user should be redirected to continue the authentication flow after the MRTD challenge validation.
-   * @param redirectUri - The redirect URI provided by the issuer after the challenge validation to continue the authentication flow.
-   * @param valPopNonce - The MRTD validation PoP nonce obtained from the challenge validation response.
-   * @param authSession - The MRTD authentication session identifier used for session binding.
-   * @returns An object containing the callback URL
+   * Verifies and parses the payload of a MRTD Proof Challenge Info JWT obtained after the primary authentication.
+   *
+   * This function performs the following steps:
+   * 1. Validates the JWT signature using the issuer's JWKS.
+   * 2. Decodes the JWT and parses its structure according to the {@link MrtdProofChallengeInfo} schema.
+   * 3. Verifies that the `aud` claim matches the client's public key ID.
+   * 4. Checks that the JWT is not expired and was not issued in the future.
+   *
+   * @param issuerConf - The issuer configuration containing the JWKS for signature verification.
+   * @param challengeInfoJwt - The JWT string representing the MRTD Proof Challenge Info.
+   * @param context - The context containing the WIA crypto context used to retrieve the client public key.
+   * @returns The parsed payload of the MRTD Proof Challenge Info JWT.
+   * @throws {Error} If the JWT signature is invalid, the structure is malformed, the `aud` claim does not match,
+   * or the JWT is expired/not yet valid.
    */
-  buildChallengeCallbackUrl(
-    redirectUri: string,
-    valPopNonce: string,
-    authSession: string
-  ): Promise<{ callbackUrl: string }>;
+  verifyAndParseChallengeInfo(
+    issuerConf: IssuerConfig,
+    challengeInfoJwt: string,
+    context: {
+      wiaCryptoContext: CryptoContext;
+    },
+  ): Promise<MrtdProofChallengeInfo>;
 }
 
 export * from "./types";

package/src/credential/issuance/api/mrtd-pop/types.ts

@@ -1,37 +1,37 @@
-export type MrtdPayload = {
-  dg1: string;
-  dg11: string;
-  sod_mrtd: string;
-};
-
-export type IasPayload = {
+export interface IasPayload {
+  challenge_signed: string;
   ias_pk: string;
   sod_ias: string;
-  challenge_signed: string;
-};
+}
 
-export type MrtdProofChallengeInfo = {
-  iss: string;
-  aud: string;
-  iat: number;
-  exp: number;
-  status: "require_interaction";
-  type: "mrtd+ias";
-  mrtd_auth_session: string;
-  state: string;
-  mrtd_pop_jwt_nonce: string;
-  htu: string;
-  htm: "POST";
-};
+export interface MrtdPayload {
+  dg1: string;
+  dg11: string;
+  sod_mrtd: string;
+}
 
-export type MrtdPoPChallenge = {
+export interface MrtdPoPChallenge {
   challenge: string;
   mrtd_pop_nonce: string;
-  pop_verify_endpoint: string;
   mrz?: string;
-};
+  pop_verify_endpoint: string;
+}
 
-export type MrtdPopVerificationResult = {
+export interface MrtdPopVerificationResult {
   mrtd_val_pop_nonce: string;
   redirect_uri: string;
-};
+}
+
+export interface MrtdProofChallengeInfo {
+  aud: string;
+  exp: number;
+  htm: "POST";
+  htu: string;
+  iat: number;
+  iss: string;
+  mrtd_auth_session: string;
+  mrtd_pop_jwt_nonce: string;
+  state: string;
+  status: "require_interaction";
+  type: "mrtd+ias";
+}

package/src/credential/issuance/api/types.ts

@@ -1,11 +1,13 @@
 import * as z from "zod";
 
+export type AuthorizationDetail = z.infer<typeof AuthorizationDetail>;
+
 export type CredentialFormat = "dc+sd-jwt" | "mso_mdoc";
 
 // The credential as a collection of attributes in plain value
-export type ParsedCredential = {
-  /** Attribute key */
-  [claim: string]: {
+export type ParsedCredential = Record<
+  string,
+  {
     name:
       | /* if i18n is provided */ Record<
           string /* locale */,
@@ -14,21 +16,20 @@ export type ParsedCredential = {
       | /* if no i18n is provided */ string
       | undefined; // Add undefined as a possible value for the name property
     value: unknown;
-  };
-};
+  }
+>;
 
-export type AuthorizationDetail = z.infer<typeof AuthorizationDetail>;
 export const AuthorizationDetail = z.object({
-  type: z.literal("openid_credential"),
   credential_configuration_id: z.string(),
   credential_identifiers: z.array(z.string()),
+  type: z.literal("openid_credential"),
 });
 
 export type TokenResponse = z.infer<typeof TokenResponse>;
 export const TokenResponse = z.object({
   access_token: z.string(),
-  refresh_token: z.string().optional(),
   authorization_details: z.array(AuthorizationDetail),
   expires_in: z.number().optional(),
+  refresh_token: z.string().optional(),
   token_type: z.string(),
 });

package/src/credential/issuance/common/02-start-user-authorization.ts

@@ -1,9 +1,10 @@
+import type { IssuerConfig } from "../api";
+
 import { IoWalletError } from "../../../utils/errors";
-import { LogLevel, Logger } from "../../../utils/logging";
+import { Logger, LogLevel } from "../../../utils/logging";
 import { AuthorizationDetail } from "../../../utils/par";
-import type { IssuerConfig } from "../api";
 
-type ResponseMode = "query" | "form_post.jwt";
+type ResponseMode = "form_post.jwt" | "query";
 
 /**
  * Ensures that the credential type requested is supported by the issuer and contained in the
@@ -14,7 +15,7 @@ type ResponseMode = "query" | "form_post.jwt";
  */
 export const selectCredentialDefinition = (
   issuerConf: IssuerConfig,
-  credentialId: string
+  credentialId: string,
 ): AuthorizationDetail => {
   const credential_configurations_supported =
     issuerConf.credential_configurations_supported;
@@ -29,7 +30,7 @@ export const selectCredentialDefinition = (
   if (!result) {
     Logger.log(
       LogLevel.ERROR,
-      `Requested credential ${credentialId} is not supported by the issuer according to its configuration ${JSON.stringify(credential_configurations_supported)}`
+      `Requested credential ${credentialId} is not supported by the issuer according to its configuration ${JSON.stringify(credential_configurations_supported)}`,
     );
     throw new IoWalletError(`No credential support the type '${credentialId}'`);
   }
@@ -45,7 +46,7 @@ export const selectCredentialDefinition = (
  */
 export const selectResponseMode = (
   issuerConf: IssuerConfig,
-  credentialIds: string[]
+  credentialIds: string[],
 ): ResponseMode => {
   const responseModeSet = new Set<ResponseMode>();
 
@@ -53,37 +54,42 @@ export const selectResponseMode = (
     responseModeSet.add(
       credentialId.match(/PersonIdentificationData/i)
         ? "query"
-        : "form_post.jwt"
+        : "form_post.jwt",
     );
   }
 
   if (responseModeSet.size !== 1) {
     Logger.log(
       LogLevel.ERROR,
-      `${credentialIds} have incompatible response_mode: ${[...responseModeSet.values()]}`
+      `${credentialIds} have incompatible response_mode: ${[...responseModeSet.values()]}`,
     );
     throw new IoWalletError(
-      "Requested credentials have incompatible response_mode and cannot be requested with the same PAR request"
+      "Requested credentials have incompatible response_mode and cannot be requested with the same PAR request",
     );
   }
 
   const [responseMode] = responseModeSet.values();
+  if (!responseMode) {
+    throw new IoWalletError(
+      `No response mode found for requested credential IDs '${credentialIds}'`,
+    );
+  }
 
   Logger.log(
     LogLevel.DEBUG,
-    `Selected response mode ${responseMode} for credential IDs ${credentialIds}`
+    `Selected response mode ${responseMode} for credential IDs ${credentialIds}`,
   );
 
   const responseModeSupported = issuerConf.response_modes_supported;
-  if (responseModeSupported && !responseModeSupported.includes(responseMode!)) {
+  if (responseModeSupported && !responseModeSupported.includes(responseMode)) {
     Logger.log(
       LogLevel.ERROR,
-      `Requested response mode ${responseMode} is not supported by the issuer according to its configuration ${JSON.stringify(responseModeSupported)}`
+      `Requested response mode ${responseMode} is not supported by the issuer according to its configuration ${JSON.stringify(responseModeSupported)}`,
     );
     throw new IoWalletError(
-      `No response mode support for IDs '${credentialIds}'`
+      `No response mode support for IDs '${credentialIds}'`,
     );
   }
 
-  return responseMode!;
+  return responseMode;
 };