@pagopa/io-react-native-wallet 3.6.2 → 3.6.4

package/src/credential/presentation/common/utils/http.ts

@@ -10,7 +10,7 @@ import type { DirectAuthorizationBodyPayload } from "../../v1.0.0/types";
  */
 export const buildDirectPostBody = async (
   { state }: RequestObject,
-  payload: DirectAuthorizationBodyPayload
+  payload: DirectAuthorizationBodyPayload,
 ): Promise<string> => {
   const formUrlEncodedBody = new URLSearchParams({
     ...(state && { state }),
@@ -22,7 +22,7 @@ export const buildDirectPostBody = async (
             ? JSON.stringify(value)
             : value,
       }),
-      {} as Record<string, string>
+      {} as Record<string, string>,
     ),
   });
 

package/src/credential/presentation/common/utils/mdoc.ts

@@ -1,11 +1,14 @@
+import type { DcqlMdocCredential, DcqlQueryResult } from "dcql";
+
 import { CBOR } from "@pagopa/io-react-native-iso18013";
 import { b64utob64 } from "jsrsasign";
-import type { DcqlMdocCredential, DcqlQueryResult } from "dcql";
+
 import type {
   Credential4Dcql,
   EvaluatedDisclosure,
   PresentationFrame,
 } from "../../api";
+
 import { getValidDcqlClaims } from "./dcql";
 
 type CustomDcqlMdocCredential = DcqlMdocCredential & {
@@ -19,12 +22,12 @@ type CustomDcqlMdocCredential = DcqlMdocCredential & {
  * @returns List of `dcql` compatible objects
  */
 export const mapCredentialsToObj = async (
-  credentialsMdoc: Credential4Dcql[]
-): Promise<CustomDcqlMdocCredential[]> => {
-  return await Promise.all(
+  credentialsMdoc: Credential4Dcql[],
+): Promise<CustomDcqlMdocCredential[]> =>
+  await Promise.all(
     credentialsMdoc.map(async (credential) => {
       const issuerSigned = await CBOR.decodeIssuerSigned(
-        b64utob64(credential[1])
+        b64utob64(credential[1]),
       );
 
       const namespaces = Object.entries(issuerSigned.nameSpaces).reduce(
@@ -34,7 +37,7 @@ export const mapCredentialsToObj = async (
               ...ac,
               [el.elementIdentifier]: el.elementValue,
             }),
-            {} as Record<string, unknown>
+            {} as Record<string, unknown>,
           );
 
           return {
@@ -42,19 +45,18 @@ export const mapCredentialsToObj = async (
             [ns]: flattenNsClaims,
           };
         },
-        {} as DcqlMdocCredential["namespaces"]
+        {} as DcqlMdocCredential["namespaces"],
       );
 
       return {
         credential_format: "mso_mdoc",
-        doctype: issuerSigned.issuerAuth.payload.docType || "missing_doctype",
         cryptographic_holder_binding: true,
+        doctype: issuerSigned.issuerAuth.payload.docType || "missing_doctype",
         namespaces,
         original_credential: credential,
       } satisfies CustomDcqlMdocCredential;
-    })
+    }),
   );
-};
 
 /**
  * Extract a compact list of claims from the `dcql` result.
@@ -62,16 +64,16 @@ export const mapCredentialsToObj = async (
  * @returns The list of claims in {@link EvaluatedDisclosure} format
  */
 export const getClaimsFromDcqlMatch = (
-  match: DcqlQueryResult.CredentialMatch
+  match: DcqlQueryResult.CredentialMatch,
 ): EvaluatedDisclosure[] =>
   getValidDcqlClaims(match).flatMap(({ output }) =>
     Object.entries(output).flatMap(([ns, nsClaims]) =>
       Object.keys(nsClaims).map((claimName) => ({
-        namespace: ns,
         name: claimName,
+        namespace: ns,
         value: nsClaims[claimName],
-      }))
-    )
+      })),
+    ),
   );
 
 /**
@@ -83,7 +85,7 @@ export const getClaimsFromDcqlMatch = (
  */
 export const getPresentationFrameFromClaims = (
   requestedClaims: EvaluatedDisclosure[],
-  docType: string
+  docType: string,
 ): PresentationFrame => ({
   [docType]: requestedClaims.reduce((acc, { name, namespace }) => {
     if (namespace) {

package/src/credential/presentation/common/utils/sd-jwt.ts

@@ -1,11 +1,14 @@
-import { SDJwtInstance, type SDJwt } from "@sd-jwt/core";
-import { getClaims } from "@sd-jwt/decode";
-import { digest } from "@sd-jwt/crypto-nodejs";
 import type { DcqlSdJwtVcCredential } from "dcql";
-import { IoWalletError } from "../../../../utils/errors";
+
+import { type SDJwt, SDJwtInstance } from "@sd-jwt/core";
+import { digest } from "@sd-jwt/crypto-nodejs";
+import { getClaims } from "@sd-jwt/decode";
+
+import type { Credential4Dcql } from "../../api";
+
 import { LEGACY_SD_JWT } from "../../../../sd-jwt/types";
 import { fixLegacyCredentialSdJwt } from "../../../../utils/credentials";
-import type { Credential4Dcql } from "../../api";
+import { IoWalletError } from "../../../../utils/errors";
 
 type CustomDcqlSdJwtVcCredential = DcqlSdJwtVcCredential & {
   original_credential: Credential4Dcql;
@@ -27,14 +30,14 @@ const getClaimsFromDecodedSdJwt = async (decodedRawSdJwt: SDJwt) => {
   const claims = await getClaims<DcqlSdJwtVcCredential["claims"]>(
     decodedRawSdJwt.jwt.payload,
     decodedRawSdJwt.disclosures ?? [],
-    digest
+    digest,
   );
 
-  for (const claim of NON_DISCLOSABLE_CLAIMS) {
-    delete claims[claim];
-  }
-
-  return claims;
+  return Object.fromEntries(
+    Object.entries(claims).filter(
+      ([key]) => !NON_DISCLOSABLE_CLAIMS.includes(key),
+    ),
+  );
 };
 
 /**
@@ -44,7 +47,7 @@ const getClaimsFromDecodedSdJwt = async (decodedRawSdJwt: SDJwt) => {
  * @returns List of `dcql` compatible objects
  */
 export const mapCredentialsToObj = async (
-  credentials: Credential4Dcql[]
+  credentials: Credential4Dcql[],
 ): Promise<CustomDcqlSdJwtVcCredential[]> => {
   const sdJwt = new SDJwtInstance({
     hasher: digest,
@@ -53,19 +56,19 @@ export const mapCredentialsToObj = async (
   return Promise.all(
     credentials.map(async (credential) => {
       const decodedRawSdJwt = await sdJwt.decode(
-        fixLegacyCredentialSdJwt(credential[1])
+        fixLegacyCredentialSdJwt(credential[1]),
       );
       const claims = await getClaimsFromDecodedSdJwt(decodedRawSdJwt);
       return {
-        vct: decodedRawSdJwt.jwt?.payload?.vct as string,
+        claims,
         credential_format:
           decodedRawSdJwt.jwt?.header?.typ === LEGACY_SD_JWT
             ? LEGACY_SD_JWT
             : "dc+sd-jwt",
         cryptographic_holder_binding: true,
-        claims,
         original_credential: credential,
+        vct: decodedRawSdJwt.jwt?.payload?.vct as string,
       } satisfies CustomDcqlSdJwtVcCredential;
-    })
+    }),
   );
 };

package/src/credential/presentation/v1.0.0/01-start-flow.ts

@@ -1,9 +1,10 @@
-import { InvalidQRCodeError } from "../common/errors";
 import type { RemotePresentationApi } from "../api";
+
 import { PresentationParams } from "../api/types";
+import { InvalidQRCodeError } from "../common/errors";
 
 export const startFlowFromQR: RemotePresentationApi["startFlowFromQR"] = (
-  params
+  params,
 ) => {
   const result = PresentationParams.safeParse({
     ...params,
@@ -14,7 +15,7 @@ export const startFlowFromQR: RemotePresentationApi["startFlowFromQR"] = (
 
   if (!result.data.request_uri) {
     throw new InvalidQRCodeError(
-      "Invalid QR code missing the required 'request_uri' parameter."
+      "Invalid QR code missing the required 'request_uri' parameter.",
     );
   }
 

package/src/credential/presentation/v1.0.0/02-evaluate-rp-trust.ts

@@ -1,12 +1,13 @@
-import { getRelyingPartyEntityConfiguration } from "../../../trust/v1.0.0/entities";
 import type { RemotePresentationApi } from "../api";
+
+import { getRelyingPartyEntityConfiguration } from "../../../trust/v1.0.0/entities";
 import { mapToRelyingPartyConfig } from "./mappers";
 
 export const evaluateRelyingPartyTrust: RemotePresentationApi["evaluateRelyingPartyTrust"] =
   async (rpUrl, { appFetch = fetch } = {}) => {
     const rpEntityConfiguration = await getRelyingPartyEntityConfiguration(
       rpUrl,
-      { appFetch }
+      { appFetch },
     );
     return {
       rpConf: mapToRelyingPartyConfig(rpEntityConfiguration),

package/src/credential/presentation/v1.0.0/03-get-request-object.ts

@@ -1,13 +1,14 @@
+import type { RemotePresentationApi } from "../api";
+
 import { RelyingPartyResponseError } from "../../../utils/errors";
 import { hasStatusOrThrow } from "../../../utils/misc";
-import type { RemotePresentationApi } from "../api";
 import { RequestObjectWalletCapabilities } from "../api/types";
 import { InvalidQRCodeError } from "../common/errors";
 
 export const getRequestObject: RemotePresentationApi["getRequestObject"] =
   async (
     authorizationRequestUrl,
-    { appFetch = fetch, walletCapabilities } = {}
+    { appFetch = fetch, walletCapabilities } = {},
   ) => {
     const authorizationUrl = new URL(authorizationRequestUrl);
 
@@ -20,7 +21,7 @@ export const getRequestObject: RemotePresentationApi["getRequestObject"] =
       authorizationUrl.searchParams.get("request_uri") ?? undefined;
     if (!requestUri) {
       throw new InvalidQRCodeError(
-        "The QR code is missing the required 'request_uri' parameter."
+        "The QR code is missing the required 'request_uri' parameter.",
       );
     }
 
@@ -35,11 +36,11 @@ export const getRequestObject: RemotePresentationApi["getRequestObject"] =
       });
 
       const requestObjectEncodedJwt = await appFetch(requestUri, {
-        method: "POST",
+        body: formUrlEncodedBody.toString(),
         headers: {
           "Content-Type": "application/x-www-form-urlencoded",
         },
-        body: formUrlEncodedBody.toString(),
+        method: "POST",
       })
         .then(hasStatusOrThrow(200, RelyingPartyResponseError))
         .then((res) => res.text());

package/src/credential/presentation/v1.0.0/05-verify-request-object.ts

@@ -1,17 +1,19 @@
 import { decode as decodeJwt, verify } from "@pagopa/io-react-native-jwt";
 import { type z } from "zod";
+
 import type { RelyingPartyConfig, RemotePresentationApi } from "../api";
+
 import { IoWalletError } from "../../../utils/errors";
 import { InvalidRequestObjectError } from "../common/errors";
-import { RawRequestObject } from "./types";
 import { mapToRequestObject } from "./mappers";
+import { RawRequestObject } from "./types";
 import { getJwksFromRpConfig } from "./utils.jwks";
 
 export const verifyRequestObject: RemotePresentationApi["verifyRequestObject"] =
   async (requestObjectEncodedJwt, { clientId, rpConf, state }) => {
     if (!rpConf) {
       throw new IoWalletError(
-        "Relying Party Configuration is required for OpenID Federation clients"
+        "Relying Party Configuration is required for OpenID Federation clients",
       );
     }
 
@@ -19,15 +21,15 @@ export const verifyRequestObject: RemotePresentationApi["verifyRequestObject"] =
 
     const pubKey = getSigPublicKey(
       rpConf,
-      requestObjectJwt.protectedHeader.kid
+      requestObjectJwt.protectedHeader.kid,
     );
 
     try {
       // Standard claims are verified within `verify`
       await verify(requestObjectEncodedJwt, pubKey, { issuer: clientId });
-    } catch (_) {
+    } catch {
       throw new InvalidRequestObjectError(
-        "The Request Object signature verification failed"
+        "The Request Object signature verification failed",
       );
     }
 
@@ -42,13 +44,13 @@ export const verifyRequestObject: RemotePresentationApi["verifyRequestObject"] =
 
     if (!isClientIdMatch) {
       throw new InvalidRequestObjectError(
-        "Client ID does not match Request Object or Entity Configuration"
+        "Client ID does not match Request Object or Entity Configuration",
       );
     }
 
     if (state && state !== rawRequestObject.payload.state) {
       throw new InvalidRequestObjectError(
-        "The provided state does not match the Request Object's"
+        "The provided state does not match the Request Object's",
       );
     }
 
@@ -73,7 +75,7 @@ const validateRequestObjectShape = (payload: unknown): RawRequestObject => {
 
   throw new InvalidRequestObjectError(
     "The Request Object cannot be parsed successfully",
-    formatFlattenedZodErrors(requestObjectParse.error.flatten())
+    formatFlattenedZodErrors(requestObjectParse.error.flatten()),
   );
 };
 
@@ -87,7 +89,7 @@ const validateRequestObjectShape = (payload: unknown): RawRequestObject => {
  */
 const getSigPublicKey = (
   rpConf: RelyingPartyConfig,
-  kid: string | undefined
+  kid: string | undefined,
 ) => {
   try {
     const { keys } = getJwksFromRpConfig(rpConf);
@@ -97,9 +99,9 @@ const getSigPublicKey = (
     if (!pubKey) throw new Error();
 
     return pubKey;
-  } catch (_) {
+  } catch {
     throw new InvalidRequestObjectError(
-      `The public key for signature verification (${kid}) cannot be found in the Entity Configuration`
+      `The public key for signature verification (${kid}) cannot be found in the Entity Configuration`,
     );
   }
 };
@@ -108,7 +110,7 @@ const getSigPublicKey = (
  * Utility to format flattened Zod errors into a simplified string `key1: key1_error, key2: key2_error`
  */
 const formatFlattenedZodErrors = (
-  errors: z.core.$ZodFlattenedError<RawRequestObject>
+  errors: z.core.$ZodFlattenedError<RawRequestObject>,
 ): string =>
   Object.entries(errors.fieldErrors)
     .map(([key, error]) => `${key}: ${error[0]}`)

package/src/credential/presentation/v1.0.0/06-evaluate-dcql-query.ts

@@ -1,16 +1,19 @@
-import { DcqlQuery, DcqlError } from "dcql";
+import { DcqlError, DcqlQuery } from "dcql";
 import { isValiError } from "valibot";
-import { CredentialsNotFoundError } from "../common/errors";
+
 import type { Credential4Dcql, RemotePresentationApi } from "../api";
 import type { CredentialPurpose } from "../api/06-evaluate-dcql-query";
-import * as sdJwtUtils from "../common/utils/sd-jwt";
+
+import { LEGACY_SD_JWT } from "../../../sd-jwt/types";
+import { IoWalletError } from "../../../utils/errors";
+import { CredentialsNotFoundError } from "../common/errors";
 import {
   extractFailedCredentialsDetails,
   getClaimsFromDcqlMatch,
   getDcqlQueryMatches,
   getPresentationFrameFromDcqlMatch,
 } from "../common/utils/dcql";
-import { LEGACY_SD_JWT } from "../../../sd-jwt/types";
+import * as sdJwtUtils from "../common/utils/sd-jwt";
 
 export const evaluateDcqlQuery: RemotePresentationApi["evaluateDcqlQuery"] =
   async (query, credentialsSdJwt) => {
@@ -21,7 +24,7 @@ export const evaluateDcqlQuery: RemotePresentationApi["evaluateDcqlQuery"] =
         acc[c.vct] = c.original_credential;
         return acc;
       },
-      {} as Record<string, Credential4Dcql>
+      {} as Record<string, Credential4Dcql>,
     );
 
     try {
@@ -33,7 +36,7 @@ export const evaluateDcqlQuery: RemotePresentationApi["evaluateDcqlQuery"] =
 
       if (!queryResult.can_be_satisfied) {
         throw new CredentialsNotFoundError(
-          extractFailedCredentialsDetails(queryResult)
+          extractFailedCredentialsDetails(queryResult),
         );
       }
 
@@ -55,39 +58,47 @@ export const evaluateDcqlQuery: RemotePresentationApi["evaluateDcqlQuery"] =
             "vct" in matchOutput)
         ) {
           const { vct } = matchOutput;
-          const [keyTag, credential] = credentialsByVct[vct]!;
+          const cred = credentialsByVct[vct];
+
+          if (!cred) {
+            throw new IoWalletError(
+              `Credential with vct ${vct} not found in the provided credentials`,
+            );
+          }
+
+          const [keyTag, credential] = cred;
 
           const requiredDisclosures = getClaimsFromDcqlMatch(match);
           const presentationFrame = getPresentationFrameFromDcqlMatch(
             match,
-            parsedQuery
+            parsedQuery,
           );
 
           return {
+            credential,
+            format: matchOutput.credential_format,
             id,
-            vct,
             keyTag,
-            format: matchOutput.credential_format,
-            credential,
-            requiredDisclosures,
             presentationFrame,
             // When it is a match but no credential_sets are found, the credential is required by default
             // See https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6.4.2
             purposes: purposes ?? [{ required: true }],
+            requiredDisclosures,
+            vct,
           };
         }
 
         throw new Error(
-          `Unsupported credential format: ${matchOutput?.credential_format}`
+          `Unsupported credential format: ${matchOutput?.credential_format}`,
         );
       });
     } catch (error) {
       // Invalid DCQL query structure. Remap to `DcqlError` for consistency.
       if (isValiError(error)) {
         throw new DcqlError({
-          message: "Failed to parse the provided DCQL query",
-          code: "PARSE_ERROR",
           cause: error.issues,
+          code: "PARSE_ERROR",
+          message: "Failed to parse the provided DCQL query",
         });
       }
 

package/src/credential/presentation/v1.0.0/07-send-authorization-response.ts

@@ -1,7 +1,11 @@
 import { EncryptJwe } from "@pagopa/io-react-native-jwt";
-import { NoSuitableKeysFoundInEntityConfiguration } from "../common/errors";
-import { hasStatusOrThrow } from "../../../utils/misc";
+
 import type { JWK } from "../../../utils/jwk";
+import type { RelyingPartyConfig, RemotePresentationApi } from "../api";
+import type { RequestObject } from "../api/types";
+
+import { prepareVpToken } from "../../../sd-jwt";
+import { createCryptoContextFor } from "../../../utils/crypto";
 import {
   IoWalletError,
   RelyingPartyResponseError,
@@ -9,13 +13,11 @@ import {
   ResponseErrorBuilder,
   UnexpectedStatusCodeError,
 } from "../../../utils/errors";
-import { prepareVpToken } from "../../../sd-jwt";
-import type { RequestObject } from "../api/types";
-import type { RelyingPartyConfig, RemotePresentationApi } from "../api";
+import { hasStatusOrThrow } from "../../../utils/misc";
+import { NoSuitableKeysFoundInEntityConfiguration } from "../common/errors";
+import { buildDirectPostBody } from "../common/utils/http";
 import { AuthorizationResponse, DirectAuthorizationBodyPayload } from "./types";
 import { getJwksFromRpConfig } from "./utils.jwks";
-import { buildDirectPostBody } from "../common/utils/http";
-import { createCryptoContextFor } from "../../../utils/crypto";
 
 /**
  * Selects a public key (with `use = enc`) from the set of JWK keys
@@ -34,7 +36,7 @@ export const choosePublicKeyToEncrypt = (rpJwkKeys: JWK[]): JWK => {
 
   // No suitable key found
   throw new NoSuitableKeysFoundInEntityConfiguration(
-    "No suitable public key found for encryption."
+    "No suitable public key found for encryption.",
   );
 };
 
@@ -49,7 +51,7 @@ export const choosePublicKeyToEncrypt = (rpJwkKeys: JWK[]): JWK => {
 export const buildDirectPostJwtBody = async (
   requestObject: RequestObject,
   rpConf: RelyingPartyConfig,
-  payload: DirectAuthorizationBodyPayload
+  payload: DirectAuthorizationBodyPayload,
 ): Promise<string> => {
   type Jwe = ConstructorParameters<typeof EncryptJwe>[1];
 
@@ -97,16 +99,16 @@ export const prepareRemotePresentations: RemotePresentationApi["prepareRemotePre
             item.credential,
             item.presentationFrame,
             createCryptoContextFor(item.keyTag),
-          ]
+          ],
         );
 
         return {
-          requestedClaims: item.requiredDisclosures.map(({ name }) => name),
           credentialId: item.id,
-          vpToken: vp_token,
           format: item.format,
+          requestedClaims: item.requiredDisclosures.map(({ name }) => name),
+          vpToken: vp_token,
         };
-      })
+      }),
     );
 
     return { presentations };
@@ -117,11 +119,11 @@ export const sendAuthorizationResponse: RemotePresentationApi["sendAuthorization
     requestObject,
     remotePresentation,
     rpConf,
-    { appFetch = fetch } = {}
+    { appFetch = fetch } = {},
   ) => {
     if (!rpConf) {
       throw new IoWalletError(
-        "Relying Party Configuration is required for OpenID Federation clients"
+        "Relying Party Configuration is required for OpenID Federation clients",
       );
     }
 
@@ -133,17 +135,17 @@ export const sendAuthorizationResponse: RemotePresentationApi["sendAuthorization
           ...acc,
           [presentation.credentialId]: presentation.vpToken,
         }),
-        {} as Record<string, string>
+        {} as Record<string, string>,
       ),
     });
 
     // 2. Send the authorization response via HTTP POST and validate the response
     return await appFetch(requestObject.response_uri, {
-      method: "POST",
+      body: requestBody,
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
       },
-      body: requestBody,
+      method: "POST",
     })
       .then(hasStatusOrThrow(200))
       .then((res) => res.json())
@@ -155,7 +157,7 @@ export const sendAuthorizationErrorResponse: RemotePresentationApi["sendAuthoriz
   async (
     requestObject,
     { error, errorDescription },
-    { appFetch = fetch } = {}
+    { appFetch = fetch } = {},
   ) => {
     const requestBody = await buildDirectPostBody(requestObject, {
       error,
@@ -163,11 +165,11 @@ export const sendAuthorizationErrorResponse: RemotePresentationApi["sendAuthoriz
     });
 
     return await appFetch(requestObject.response_uri, {
-      method: "POST",
+      body: requestBody,
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
       },
-      body: requestBody,
+      method: "POST",
     })
       .then(hasStatusOrThrow(200, RelyingPartyResponseError))
       .then((res) => res.json())

package/src/credential/presentation/v1.0.0/index.ts

@@ -1,4 +1,5 @@
 import type { RemotePresentationApi } from "../api";
+
 import { startFlowFromQR } from "./01-start-flow";
 import { evaluateRelyingPartyTrust } from "./02-evaluate-rp-trust";
 import { getRequestObject } from "./03-get-request-object";
@@ -6,17 +7,17 @@ import { verifyRequestObject } from "./05-verify-request-object";
 import { evaluateDcqlQuery } from "./06-evaluate-dcql-query";
 import {
   prepareRemotePresentations,
-  sendAuthorizationResponse,
   sendAuthorizationErrorResponse,
+  sendAuthorizationResponse,
 } from "./07-send-authorization-response";
 
 export const RemotePresentation: RemotePresentationApi = {
-  startFlowFromQR,
+  evaluateDcqlQuery,
   evaluateRelyingPartyTrust,
   getRequestObject,
-  verifyRequestObject,
-  evaluateDcqlQuery,
   prepareRemotePresentations,
-  sendAuthorizationResponse,
   sendAuthorizationErrorResponse,
+  sendAuthorizationResponse,
+  startFlowFromQR,
+  verifyRequestObject,
 };

package/src/credential/presentation/v1.0.0/mappers.ts

@@ -1,7 +1,8 @@
-import { createMapper } from "../../../utils/mappers";
-import { RelyingPartyEntityConfiguration } from "../../../trust/v1.0.0/types";
 import type { RelyingPartyConfig } from "../api";
 import type { RequestObject } from "../api/types";
+
+import { RelyingPartyEntityConfiguration } from "../../../trust/v1.0.0/types";
+import { createMapper } from "../../../utils/mappers";
 import { RawRequestObject } from "./types";
 
 export const mapToRelyingPartyConfig = createMapper<
@@ -10,26 +11,26 @@ export const mapToRelyingPartyConfig = createMapper<
 >(({ payload }) => {
   const { federation_entity, openid_credential_verifier } = payload.metadata;
   return {
-    subject: payload.sub,
-    jwks: openid_credential_verifier.jwks,
     authorization_encrypted_response_alg:
       openid_credential_verifier.authorization_encrypted_response_alg,
     authorization_encrypted_response_enc:
       openid_credential_verifier.authorization_encrypted_response_enc,
     federation_entity,
+    jwks: openid_credential_verifier.jwks,
+    subject: payload.sub,
   };
 });
 
 export const mapToRequestObject = createMapper<RawRequestObject, RequestObject>(
   ({ header, payload }) => ({
-    iss: payload.iss,
     client_id: payload.client_id,
     dcql_query: payload.dcql_query,
+    iss: payload.iss,
     nonce: payload.nonce,
-    response_uri: payload.response_uri,
-    state: payload.state,
     response_mode: payload.response_mode,
     response_type: payload.response_type,
+    response_uri: payload.response_uri,
+    state: payload.state,
     trust_chain: header.trust_chain,
-  })
+  }),
 );