@pagopa/io-react-native-wallet 3.6.2 → 3.6.4

package/src/credential/presentation/api/04-verify-certificate-chain.ts

@@ -22,6 +22,6 @@ export interface VerifyAuthRequestCertificateChainApi {
     requestObjectJwt: string,
     params: {
       caRootCert: string;
-    }
+    },
   ): Promise<CertificateValidationResult>;
 }

package/src/credential/presentation/api/05-verify-request-object.ts

@@ -19,6 +19,6 @@ export interface VerifyRequestObjectApi {
       clientId: string;
       rpConf?: RelyingPartyConfig;
       state?: string;
-    }
+    },
   ): Promise<{ requestObject: RequestObject }>;
 }

package/src/credential/presentation/api/06-evaluate-dcql-query.ts

@@ -8,10 +8,10 @@ import type {
 /**
  * The purpose for the credential request by the RP.
  */
-export type CredentialPurpose = {
-  required: boolean;
+export interface CredentialPurpose {
   description?: string;
-};
+  required: boolean;
+}
 
 export type Disclosure = [
   string /* salt */,
@@ -19,12 +19,6 @@ export type Disclosure = [
   unknown /* claim value */,
 ];
 
-export type EvaluatedDisclosure = {
-  namespace?: string;
-  name: string;
-  value: unknown;
-};
-
 export interface EvaluateDcqlQueryApi {
   /**
    * Evaluate a list of credentials against a DCQL query. The function returns details
@@ -40,15 +34,21 @@ export interface EvaluateDcqlQueryApi {
   evaluateDcqlQuery(
     query: DcqlQuery,
     credentialsSdJwt: Credential4Dcql[],
-    credentialsMdoc?: Credential4Dcql[]
+    credentialsMdoc?: Credential4Dcql[],
   ): Promise<
-    ({
-      id: string;
+    (CredentialFormat & {
       credential: string;
+      id: string;
       keyTag: string;
-      requiredDisclosures: EvaluatedDisclosure[];
       presentationFrame: PresentationFrame;
       purposes: CredentialPurpose[];
-    } & CredentialFormat)[]
+      requiredDisclosures: EvaluatedDisclosure[];
+    })[]
   >;
 }
+
+export interface EvaluatedDisclosure {
+  name: string;
+  namespace?: string;
+  value: unknown;
+}

package/src/credential/presentation/api/07-send-authorization-response.ts

@@ -1,14 +1,12 @@
+import type { Out } from "../../../../src/utils/misc";
+import type { EvaluateDcqlQueryApi } from "./06-evaluate-dcql-query";
+import type { RelyingPartyConfig } from "./RelyingPartyConfig";
 import type {
   AuthorizationResponse,
   ErrorResponse,
   RemotePresentation,
   RequestObject,
 } from "./types";
-import type { RelyingPartyConfig } from "./RelyingPartyConfig";
-import type { EvaluateDcqlQueryApi } from "./06-evaluate-dcql-query";
-import type { Out } from "../../../../src/utils/misc";
-type FetchContext = { appFetch?: GlobalFetch["fetch"] };
-
 export interface SendAuthorizationResponseApi {
   /**
    * Prepares remote presentations for a set of credentials.
@@ -25,43 +23,47 @@ export interface SendAuthorizationResponseApi {
   prepareRemotePresentations(
     credentials: Out<EvaluateDcqlQueryApi["evaluateDcqlQuery"]>,
     authRequestObject: {
-      nonce: string;
       clientId: string;
+      nonce: string;
       responseUri: string;
-    }
+    },
   ): Promise<RemotePresentation>;
 
   /**
-   * Sends the authorization response containing the VP Token to the Relying Party (RP).
+   * Sends the authorization error response to the Relying Party (RP).
    * This function completes the presentation flow in an OpenID 4 Verifiable Presentations scenario.
    * @since 1.0.0
    *
    * @param requestObject The request details, including presentation requirements.
-   * @param remotePresentation The presentations to send, each with their VP token
-   * @param rpConf Optional Relying Party configuration (OpenID Federation clients only)
+   * @param error The response error value, with description
    * @param context Contains optional custom fetch implementation.
    * @returns Parsed and validated authorization response from the Relying Party.
    */
-  sendAuthorizationResponse(
+  sendAuthorizationErrorResponse(
     requestObject: RequestObject,
-    remotePresentation: RemotePresentation,
-    rpConf?: RelyingPartyConfig,
-    context?: FetchContext
+    error: { error: ErrorResponse; errorDescription: string },
+    context?: FetchContext,
   ): Promise<AuthorizationResponse>;
 
   /**
-   * Sends the authorization error response to the Relying Party (RP).
+   * Sends the authorization response containing the VP Token to the Relying Party (RP).
    * This function completes the presentation flow in an OpenID 4 Verifiable Presentations scenario.
    * @since 1.0.0
    *
    * @param requestObject The request details, including presentation requirements.
-   * @param error The response error value, with description
+   * @param remotePresentation The presentations to send, each with their VP token
+   * @param rpConf Optional Relying Party configuration (OpenID Federation clients only)
    * @param context Contains optional custom fetch implementation.
    * @returns Parsed and validated authorization response from the Relying Party.
    */
-  sendAuthorizationErrorResponse(
+  sendAuthorizationResponse(
     requestObject: RequestObject,
-    error: { error: ErrorResponse; errorDescription: string },
-    context?: FetchContext
+    remotePresentation: RemotePresentation,
+    rpConf?: RelyingPartyConfig,
+    context?: FetchContext,
   ): Promise<AuthorizationResponse>;
 }
+
+interface FetchContext {
+  appFetch?: GlobalFetch["fetch"];
+}

package/src/credential/presentation/api/RelyingPartyConfig.ts

@@ -1,5 +1,6 @@
-import * as z from "zod";
 import { jsonWebKeySchema } from "@pagopa/io-wallet-oid-federation";
+import * as z from "zod";
+
 import { FederationEntityMetadata } from "../../../trust/common/types";
 
 /**
@@ -7,12 +8,6 @@ import { FederationEntityMetadata } from "../../../trust/common/types";
  */
 export type RelyingPartyConfig = z.infer<typeof RelyingPartyConfig>;
 export const RelyingPartyConfig = z.object({
-  subject: z.string().optional(),
-  jwks: z.object({
-    keys: z.array(jsonWebKeySchema),
-  }),
-  // UI (from federation_entity)
-  federation_entity: FederationEntityMetadata,
   /** @deprecated JARM legacy (v1.0 only) */
   authorization_encrypted_response_alg: z.string().optional(),
   /** @deprecated JARM legacy (v1.0 only) */
@@ -22,4 +17,10 @@ export const RelyingPartyConfig = z.object({
     .array(z.string())
     .min(1)
     .optional(),
+  // UI (from federation_entity)
+  federation_entity: FederationEntityMetadata,
+  jwks: z.object({
+    keys: z.array(jsonWebKeySchema),
+  }),
+  subject: z.string().optional(),
 });

package/src/credential/presentation/api/index.ts

@@ -8,13 +8,13 @@ import type { SendAuthorizationResponseApi } from "./07-send-authorization-respo
 import type { RelyingPartyConfig } from "./RelyingPartyConfig";
 
 export interface RemotePresentationApi
-  extends StartFlowApi,
+  extends EvaluateDcqlQueryApi,
     EvaluateRelyingPartyTrustApi,
     GetRequestObjectApi,
+    SendAuthorizationResponseApi,
+    StartFlowApi,
     VerifyAuthRequestCertificateChainApi,
-    VerifyRequestObjectApi,
-    EvaluateDcqlQueryApi,
-    SendAuthorizationResponseApi {}
+    VerifyRequestObjectApi {}
 
 export type { RelyingPartyConfig };
 export * from "./types";

package/src/credential/presentation/api/types.ts

@@ -1,7 +1,9 @@
-import * as z from "zod";
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
-import type { DcqlQuery as DcqlQueryLib } from "dcql";
 import type { jsonWebKeySet } from "@pagopa/io-wallet-oid-federation";
+import type { DcqlQuery as DcqlQueryLib } from "dcql";
+
+import * as z from "zod";
+
 import type { SupportedSdJwtLegacyFormat } from "../../../sd-jwt/types";
 
 export type PresentationParams = z.infer<typeof PresentationParams>;
@@ -16,16 +18,16 @@ export const PresentationParams = z.object({
 export type WalletMetadata = z.infer<typeof WalletMetadata>;
 export const WalletMetadata = z.object({
   authorization_endpoint: z.string().url(),
-  client_id_schemes_supported: z.array(z.string()).optional(),
   client_id_prefixes_supported: z.array(z.string()).optional(),
-  response_types_supported: z.array(z.string()).optional(),
-  response_modes_supported: z.array(z.string()).optional(),
+  client_id_schemes_supported: z.array(z.string()).optional(),
   request_object_signing_alg_values_supported: z.array(z.string()).optional(),
+  response_modes_supported: z.array(z.string()).optional(),
+  response_types_supported: z.array(z.string()).optional(),
   vp_formats_supported: z.record(
     z.string(),
     z.object({
       "sd-jwt_alg_values": z.array(z.string()).optional(), // alg_values_supported?
-    })
+    }),
   ),
 });
 
@@ -56,89 +58,89 @@ export const ErrorResponse = z.enum([
   "invalid_client",
 ]);
 
-export type AuthorizationResponse = {
+export interface AuthorizationResponse {
   redirect_uri?: string;
-};
+}
 
 /**
- * A object that associate the information needed to multiple remote presentation
- * Used with DCQL queries
+ * A pair that associate a key tag with a credential, used in DCQL queries
  */
-export type RemotePresentationDetails = {
-  requestedClaims: string[];
-  credentialId: string;
-  vpToken: string;
-};
+export type Credential4Dcql = [string /* keyTag */, string /* credential */];
 
-type ClientMetadata = {
-  jwks: jsonWebKeySet;
-  encrypted_response_enc_values_supported: string[];
-  vp_formats_supported: Record<string, { "sd-jwt_alg_values"?: string[] }>;
-  client_name?: string;
-  logo_uri?: string;
-};
+export type CredentialFormat =
+  | { doctype: string; format: "mso_mdoc" }
+  | { format: "dc+sd-jwt"; vct: string }
+  | { format: SupportedSdJwtLegacyFormat; vct: string };
+
+export type DcqlQuery = DcqlQueryLib.Input;
+
+export interface EvaluatedDisclosure {
+  name: string;
+  namespace?: string;
+  value: unknown;
+}
 
 /**
- * Common Request Object type, decoupled from specific IT-Wallet versions
+ * A pair that associate a tokenized Verified Credential with the claims presented or requested to present.
  */
-export type RequestObject = {
-  iss: string;
-  response_uri: string;
-  nonce: string;
-  state?: string;
-  client_id: string;
-  dcql_query: Record<string, unknown>;
-  response_type: "vp_token";
-  response_mode: "direct_post.jwt";
-  x5c?: string[];
-  trust_chain?: string[];
-  client_metadata?: ClientMetadata;
-};
+export type Presentation = [
+  /* verified credential token */ string,
+  /* claims */ PresentationFrame,
+  /* the context for the key associated to the credential */ CryptoContext,
+];
+
+/**
+ * An object that defines claims to disclose. Nested claims must use a nested structure.
+ * @example { name: true, address: { country: true } }
+ */
+export interface PresentationFrame {
+  [k: string]: boolean | PresentationFrame | undefined;
+}
 
 /**
  * A object that associate the information needed to multiple remote presentation
  */
-export type RemotePresentation = {
+export interface RemotePresentation {
+  generatedNonce?: string /* nonce generated by app, used in mdoc presentation */;
   presentations: {
-    requestedClaims: string[];
     credentialId: string;
     format: string;
+    requestedClaims: string[];
     vpToken: string;
   }[];
-  generatedNonce?: string /* nonce generated by app, used in mdoc presentation */;
-};
+}
 
 /**
- * A pair that associate a key tag with a credential, used in DCQL queries
+ * A object that associate the information needed to multiple remote presentation
+ * Used with DCQL queries
  */
-export type Credential4Dcql = [string /* keyTag */, string /* credential */];
-
-export type DcqlQuery = DcqlQueryLib.Input;
+export interface RemotePresentationDetails {
+  credentialId: string;
+  requestedClaims: string[];
+  vpToken: string;
+}
 
 /**
- * An object that defines claims to disclose. Nested claims must use a nested structure.
- * @example { name: true, address: { country: true } }
+ * Common Request Object type, decoupled from specific IT-Wallet versions
  */
-export type PresentationFrame = {
-  [k: string]: boolean | undefined | PresentationFrame;
+export type RequestObject = {
+  client_id: string;
+  client_metadata?: ClientMetadata;
+  dcql_query: Record<string, unknown>;
+  iss: string;
+  nonce: string;
+  response_mode: "direct_post.jwt";
+  response_type: "vp_token";
+  response_uri: string;
+  state?: string;
+  trust_chain?: string[];
+  x5c?: string[];
 };
 
-/**
- * A pair that associate a tokenized Verified Credential with the claims presented or requested to present.
- */
-export type Presentation = [
-  /* verified credential token */ string,
-  /* claims */ PresentationFrame,
-  /* the context for the key associated to the credential */ CryptoContext,
-];
-
-export type CredentialFormat =
-  | { format: "dc+sd-jwt"; vct: string }
-  | { format: SupportedSdJwtLegacyFormat; vct: string }
-  | { format: "mso_mdoc"; doctype: string };
-
-export type EvaluatedDisclosure = {
-  namespace?: string;
-  name: string;
-  value: unknown;
+type ClientMetadata = {
+  client_name?: string;
+  encrypted_response_enc_values_supported: string[];
+  jwks: jsonWebKeySet;
+  logo_uri?: string;
+  vp_formats_supported: Record<string, { "sd-jwt_alg_values"?: string[] }>;
 };

package/src/credential/presentation/common/errors.ts

@@ -1,44 +1,51 @@
-import { IoWalletError, serializeAttrs } from "../../../utils/errors";
 import type { SupportedSdJwtLegacyFormat } from "../../../sd-jwt/types";
+
+import { IoWalletError, serializeAttrs } from "../../../utils/errors";
 export { DcqlError } from "dcql";
 
+export type NotFoundDetail = (
+  | { doctypeValue?: string; format: "mso_mdoc" }
+  | { format: "dc+sd-jwt" | SupportedSdJwtLegacyFormat; vctValues?: string[] }
+) & {
+  id: string;
+  issues?: string[];
+  reason?: string;
+};
+
 /**
  * An error subclass thrown when auth request decode fail
  *
  */
 export class AuthRequestDecodeError extends IoWalletError {
-  code = "ERR_IO_WALLET_AUTHENTICATION_REQUEST_DECODE_FAILED";
-
   /** The Claim for which the validation failed. */
   claim: string;
 
+  code = "ERR_IO_WALLET_AUTHENTICATION_REQUEST_DECODE_FAILED";
+
   /** Reason code for the validation failure. */
   reason: string;
 
-  constructor(
-    message: string,
-    claim: string = "unspecified",
-    reason: string = "unspecified"
-  ) {
-    super(serializeAttrs({ message, claim, reason }));
+  constructor(message: string, claim = "unspecified", reason = "unspecified") {
+    super(serializeAttrs({ claim, message, reason }));
     this.claim = claim;
     this.reason = reason;
   }
 }
 
 /**
- * When selecting a public key from an entity configuration, and no one meets the requirements for the scenario
- *
+ * Error thrown when one or more credentials cannot be found in the wallet
+ * and the presentation request cannot be satisfied.
  */
-export class NoSuitableKeysFoundInEntityConfiguration extends IoWalletError {
-  code = "ERR_NO_SUITABLE_KEYS_NOT_FOUND";
+export class CredentialsNotFoundError extends IoWalletError {
+  code = "ERR_CREDENTIALS_NOT_FOUND";
+  details: NotFoundDetail[];
 
   /**
-   * @param scenario describe the scenario in which the error arise
+   * @param details The details of the credentials that could not be found.
    */
-  constructor(scenario: string) {
-    const message = `Entity configuration do not provide any suitable keys (${scenario}).`;
-    super(message);
+  constructor(details: NotFoundDetail[]) {
+    super("One or more credentials cannot be found in the wallet");
+    this.details = details;
   }
 }
 
@@ -89,28 +96,18 @@ export class MissingDataError extends IoWalletError {
   }
 }
 
-export type NotFoundDetail = (
-  | { format: "dc+sd-jwt" | SupportedSdJwtLegacyFormat; vctValues?: string[] }
-  | { format: "mso_mdoc"; doctypeValue?: string }
-) & {
-  id: string;
-  reason?: string;
-  issues?: string[];
-};
-
 /**
- * Error thrown when one or more credentials cannot be found in the wallet
- * and the presentation request cannot be satisfied.
+ * When selecting a public key from an entity configuration, and no one meets the requirements for the scenario
+ *
  */
-export class CredentialsNotFoundError extends IoWalletError {
-  code = "ERR_CREDENTIALS_NOT_FOUND";
-  details: NotFoundDetail[];
+export class NoSuitableKeysFoundInEntityConfiguration extends IoWalletError {
+  code = "ERR_NO_SUITABLE_KEYS_NOT_FOUND";
 
   /**
-   * @param details The details of the credentials that could not be found.
+   * @param scenario describe the scenario in which the error arise
    */
-  constructor(details: NotFoundDetail[]) {
-    super("One or more credentials cannot be found in the wallet");
-    this.details = details;
+  constructor(scenario: string) {
+    const message = `Entity configuration do not provide any suitable keys (${scenario}).`;
+    super(message);
   }
 }

package/src/credential/presentation/common/utils/dcql.ts

@@ -1,26 +1,28 @@
 import { DcqlClaimsQuery, DcqlQuery, DcqlQueryResult } from "dcql";
-import { isObject } from "../../../../utils/object";
+
 import type { EvaluatedDisclosure, PresentationFrame } from "../../api/types";
-import { IoWalletError } from "../../../../utils/errors";
-import { LEGACY_SD_JWT } from "../../../../sd-jwt/types";
 import type { NotFoundDetail } from "../errors";
 
-type DcqlMatchSuccess = Extract<
-  DcqlQueryResult.CredentialMatch,
-  { success: true }
->;
+import { LEGACY_SD_JWT } from "../../../../sd-jwt/types";
+import { IoWalletError } from "../../../../utils/errors";
+import { isObject } from "../../../../utils/object";
 
 type DcqlMatchFailure = Extract<
   DcqlQueryResult.CredentialMatch,
   { success: false }
 >;
 
+type DcqlMatchSuccess = Extract<
+  DcqlQueryResult.CredentialMatch,
+  { success: true }
+>;
+
 /**
  * Extract only successful matches from the DCQL query result.
  */
 export const getDcqlQueryMatches = (result: DcqlQueryResult) =>
   Object.entries(result.credential_matches).filter(
-    ([, match]) => match.success === true
+    ([, match]) => match.success === true,
   ) as [string, DcqlMatchSuccess][];
 
 /**
@@ -28,16 +30,16 @@ export const getDcqlQueryMatches = (result: DcqlQueryResult) =>
  */
 const getDcqlQueryFailedMatches = (result: DcqlQueryResult) =>
   Object.entries(result.credential_matches).filter(
-    ([, match]) => match.success === false
+    ([, match]) => match.success === false,
   ) as [string, DcqlMatchFailure][];
 
 /**
  * Extract details related to failed credentials
  */
 export const extractFailedCredentialsDetails = (
-  queryResult: DcqlQueryResult
-): NotFoundDetail[] => {
-  return getDcqlQueryFailedMatches(queryResult).map(([id, match]) => {
+  queryResult: DcqlQueryResult,
+): NotFoundDetail[] =>
+  getDcqlQueryFailedMatches(queryResult).map(([id, match]) => {
     const credential = queryResult.credentials.find((c) => c.id === id);
 
     const issues = match.failed_credentials?.flatMap((c) => {
@@ -46,7 +48,7 @@ export const extractFailedCredentialsDetails = (
       }
       if (c.claims.failed_claim_sets) {
         return c.claims.failed_claim_sets.flatMap(
-          (cs) => Object.values(cs.issues).flat() as string[]
+          (cs) => Object.values(cs.issues).flat() as string[],
         );
       }
       return [];
@@ -54,10 +56,10 @@ export const extractFailedCredentialsDetails = (
 
     if (credential?.format === "mso_mdoc") {
       return {
+        doctypeValue: credential.meta?.doctype_value,
+        format: credential.format,
         id,
         issues,
-        format: credential.format,
-        doctypeValue: credential.meta?.doctype_value,
       };
     }
 
@@ -66,9 +68,9 @@ export const extractFailedCredentialsDetails = (
       credential?.format === LEGACY_SD_JWT
     ) {
       return {
+        format: credential.format,
         id,
         issues,
-        format: credential.format,
         vctValues:
           credential.meta && "vct_values" in credential.meta
             ? credential.meta.vct_values
@@ -77,7 +79,6 @@ export const extractFailedCredentialsDetails = (
     }
     throw new IoWalletError(`Unsupported format: ${credential?.format}`);
   });
-};
 
 /**
  * Extract a compact list of claims from the `dcql` result.
@@ -85,10 +86,10 @@ export const extractFailedCredentialsDetails = (
  * @returns The list of claims in {@link EvaluatedDisclosure} format
  */
 export const getClaimsFromDcqlMatch = (
-  match: DcqlQueryResult.CredentialMatch
+  match: DcqlQueryResult.CredentialMatch,
 ): EvaluatedDisclosure[] =>
   getValidDcqlClaims(match).flatMap((c) =>
-    Object.entries(c.output).map(([name, value]) => ({ name, value }))
+    Object.entries(c.output).map(([name, value]) => ({ name, value })),
   );
 
 /**
@@ -98,8 +99,8 @@ export const getClaimsFromDcqlMatch = (
  * @returns A presentation frame compatible with `@sd-jwt/present`
  */
 export const pathToPresentationFrame = (
-  path: (string | number | null)[],
-  claim: Record<string, unknown>
+  path: (null | number | string)[],
+  claim: Record<string, unknown>,
 ): PresentationFrame => {
   const [segment, ...rest] = path;
 
@@ -115,7 +116,7 @@ export const pathToPresentationFrame = (
     if (Array.isArray(maybeArrayClaim)) {
       return maybeArrayClaim.reduce(
         (acc, c, i) => ({ ...acc, [i]: pathToPresentationFrame(rest, c) }),
-        {}
+        {},
       );
     }
     // @ts-expect-error unwind recursion
@@ -135,7 +136,7 @@ export const pathToPresentationFrame = (
  */
 export const getPresentationFrameFromDcqlMatch = (
   match: DcqlQueryResult.CredentialMatch,
-  originalQuery: DcqlQuery
+  originalQuery: DcqlQuery,
 ): PresentationFrame => {
   // The original DCQL query claims are needed to get their path
   const queryClaims =
@@ -148,10 +149,13 @@ export const getPresentationFrameFromDcqlMatch = (
 
   // Build a presentation frame from each claim's path
   return getValidDcqlClaims(match).reduce((acc, c) => {
-    const pf = pathToPresentationFrame(
-      typedQueryClaims[c.claim_index]!.path,
-      c.output
-    );
+    const path = typedQueryClaims[c.claim_index]?.path;
+    if (!path) {
+      throw new Error(
+        `Claim at index ${c.claim_index} does not have a path in the original query.`,
+      );
+    }
+    const pf = pathToPresentationFrame(path, c.output);
     // Merge objects with the same key to not lose objects that are already in the accumulator
     for (const [key, value] of Object.entries(pf)) {
       acc[key] = isObject(value) ? Object.assign(value, acc[key]) : value;
@@ -178,9 +182,9 @@ export const getValidDcqlClaims = (match: DcqlQueryResult.CredentialMatch) => {
   // We select claims in the order they are defined in the set
   if (validClaimSet) {
     return (
-      validClaimSet.valid_claim_indexes?.map(
-        (i) => validClaims.find((c) => c.claim_index === i)!
-      ) ?? []
+      validClaimSet.valid_claim_indexes
+        ?.map((i) => validClaims.find((c) => c.claim_index === i))
+        .filter((c): c is NonNullable<typeof c> => c != null) ?? []
     );
   }