@pagopa/io-react-native-wallet 3.6.2 → 3.6.4

package/src/credential/presentation/v1.0.0/types.ts

@@ -1,4 +1,5 @@
 import * as z from "zod";
+
 import { UnixTime } from "../../../utils/zod";
 import { ErrorResponse } from "../api/types";
 
@@ -7,22 +8,22 @@ export const RawRequestObject = z.object({
   header: z.object({
     alg: z.string(),
     kid: z.string(),
-    typ: z.literal("oauth-authz-req+jwt"),
     trust_chain: z.array(z.string()).optional(),
+    typ: z.literal("oauth-authz-req+jwt"),
   }),
   payload: z.object({
-    iss: z.string(),
-    iat: UnixTime,
+    client_id: z.string(),
+    dcql_query: z.record(z.string(), z.any()), // Validation happens within the `dcql` library, no need to duplicate it here
     exp: UnixTime,
-    state: z.string(),
+    iat: UnixTime,
+    iss: z.string(),
     nonce: z.string(),
-    response_uri: z.string(),
     request_uri_method: z.string().optional(),
-    response_type: z.literal("vp_token"),
     response_mode: z.literal("direct_post.jwt"),
-    client_id: z.string(),
-    dcql_query: z.record(z.string(), z.any()), // Validation happens within the `dcql` library, no need to duplicate it here
+    response_type: z.literal("vp_token"),
+    response_uri: z.string(),
     scope: z.string().optional(),
+    state: z.string(),
     wallet_nonce: z.string().optional(),
   }),
 });
@@ -42,7 +43,7 @@ export const DirectAuthorizationBodyPayload = z.union([
 
 export type AuthorizationResponse = z.infer<typeof AuthorizationResponse>;
 export const AuthorizationResponse = z.object({
-  status: z.string().optional(),
-  response_code: z.string().optional(),
   redirect_uri: z.string().optional(),
+  response_code: z.string().optional(),
+  status: z.string().optional(),
 });

package/src/credential/presentation/v1.0.0/utils.jwks.ts

@@ -1,13 +1,14 @@
-import { JWKS, type JWK } from "../../../utils/jwk";
 import type { RelyingPartyConfig } from "../api";
 
+import { type JWK, JWKS } from "../../../utils/jwk";
+
 /**
  * Fetches the JSON Web Key Set (JWKS) from the Relying Party's Entity Configuration.
  * @param rpConfig - The Relying Party's common configuration,
  * @returns An object containing an array of JSON Web Keys (JWKs).
  */
 export const getJwksFromRpConfig = (
-  rpConfig: RelyingPartyConfig
+  rpConfig: RelyingPartyConfig,
 ): { keys: JWK[] } => {
   const jwks = rpConfig.jwks.keys;
 
@@ -18,7 +19,7 @@ export const getJwksFromRpConfig = (
   const parsed = JWKS.safeParse({ keys: jwks });
   if (!parsed.success) {
     throw new Error(
-      "JWKS contains unsupported or invalid keys (only RSA/EC JWK supported)"
+      "JWKS contains unsupported or invalid keys (only RSA/EC JWK supported)",
     );
   }
 

package/src/credential/presentation/v1.0.0/utils.ts

@@ -1,13 +1,14 @@
-import { JWKS, type JWK } from "../../../utils/jwk";
 import type { RelyingPartyConfig } from "../api";
 
+import { type JWK, JWKS } from "../../../utils/jwk";
+
 /**
  * Fetches the JSON Web Key Set (JWKS) from the Relying Party's Entity Configuration.
  * @param rpConfig - The Relying Party's common configuration,
  * @returns An object containing an array of JSON Web Keys (JWKs).
  */
 export const getJwksFromRpConfig = (
-  rpConfig: RelyingPartyConfig
+  rpConfig: RelyingPartyConfig,
 ): { keys: JWK[] } => {
   const jwks = rpConfig.jwks.keys;
 
@@ -18,7 +19,7 @@ export const getJwksFromRpConfig = (
   const parsed = JWKS.safeParse({ keys: jwks });
   if (!parsed.success) {
     throw new Error(
-      "JWKS contains unsupported or invalid keys (only RSA/EC JWK supported)"
+      "JWKS contains unsupported or invalid keys (only RSA/EC JWK supported)",
     );
   }
 

package/src/credential/presentation/v1.3.3/01-start-flow.ts

@@ -1,10 +1,12 @@
-import { InvalidQRCodeError } from "../common/errors";
+import { validateAuthorizationRequestParams } from "@pagopa/io-wallet-oid4vp";
+
 import type { RemotePresentationApi } from "../api";
+
 import { PresentationParams } from "../api/types";
-import { validateAuthorizationRequestParams } from "@pagopa/io-wallet-oid4vp";
+import { InvalidQRCodeError } from "../common/errors";
 
 export const startFlowFromQR: RemotePresentationApi["startFlowFromQR"] = (
-  params
+  params,
 ) => {
   const parsed = PresentationParams.safeParse(params);
 

package/src/credential/presentation/v1.3.3/02-evaluate-rp-trust.ts

@@ -1,12 +1,13 @@
-import { getRelyingPartyEntityConfiguration } from "../../../trust/v1.3.3/entities";
 import type { RemotePresentationApi } from "../api";
+
+import { getRelyingPartyEntityConfiguration } from "../../../trust/v1.3.3/entities";
 import { mapToRelyingPartyConfig } from "./mappers";
 
 export const evaluateRelyingPartyTrust: RemotePresentationApi["evaluateRelyingPartyTrust"] =
   async (rpUrl, { appFetch = fetch } = {}) => {
     const rpEntityConfiguration = await getRelyingPartyEntityConfiguration(
       rpUrl,
-      { appFetch }
+      { appFetch },
     );
 
     const rpConf = mapToRelyingPartyConfig(rpEntityConfiguration);

package/src/credential/presentation/v1.3.3/03-get-request-object.ts

@@ -1,12 +1,14 @@
+import { fetchAuthorizationRequest as sdkFetchAuthorizationRequest } from "@pagopa/io-wallet-oid4vp";
+
 import type { RemotePresentationApi } from "../api";
+
 import { RequestObjectWalletCapabilities } from "../api/types";
-import { fetchAuthorizationRequest as sdkFetchAuthorizationRequest } from "@pagopa/io-wallet-oid4vp";
 import { mapSdkFetchAuthRequestError } from "./sdkErrorMapper";
 
 export const getRequestObject: RemotePresentationApi["getRequestObject"] =
   async (
     authorizationRequestUrl,
-    { appFetch = fetch, walletCapabilities } = {}
+    { appFetch = fetch, walletCapabilities } = {},
   ) => {
     const walletParams = walletCapabilities
       ? (() => {

package/src/credential/presentation/v1.3.3/04-verify-certificate-chain.ts

@@ -1,9 +1,11 @@
-import type { RemotePresentationApi } from "../api";
-import { decode } from "@pagopa/io-react-native-jwt";
 import {
   verifyCertificateChain,
   type X509CertificateOptions,
 } from "@pagopa/io-react-native-crypto";
+import { decode } from "@pagopa/io-react-native-jwt";
+
+import type { RemotePresentationApi } from "../api";
+
 import {
   MissingX509CertsError,
   X509ValidationError,
@@ -13,9 +15,9 @@ import { Logger, LogLevel } from "../../../utils/logging";
 export const verifyAuthRequestCertificateChain: RemotePresentationApi["verifyAuthRequestCertificateChain"] =
   async (requestObjectJwt, { caRootCert }) => {
     const x509Options: X509CertificateOptions = {
-      requireCrl: false,
       connectTimeout: 10_000,
       readTimeout: 10_000,
+      requireCrl: false,
     };
 
     const requestObject = decode(requestObjectJwt);
@@ -24,7 +26,7 @@ export const verifyAuthRequestCertificateChain: RemotePresentationApi["verifyAut
 
     if (!x5c) {
       throw new MissingX509CertsError(
-        "No certificate chain (x5c) found in the Request Object"
+        "No certificate chain (x5c) found in the Request Object",
       );
     }
 
@@ -39,17 +41,17 @@ export const verifyAuthRequestCertificateChain: RemotePresentationApi["verifyAut
     const validationResult = await verifyCertificateChain(
       certChain,
       caRootCert,
-      x509Options
+      x509Options,
     );
 
     if (!validationResult.isValid) {
       Logger.log(
         LogLevel.ERROR,
-        `Certificate chain failure: ${validationResult.validationStatus} - ${validationResult.errorMessage}`
+        `Certificate chain failure: ${validationResult.validationStatus} - ${validationResult.errorMessage}`,
       );
 
       throw new X509ValidationError(
-        `X.509 certificate chain validation failed. Status: ${validationResult.validationStatus}. Error: ${validationResult.errorMessage}`
+        `X.509 certificate chain validation failed. Status: ${validationResult.validationStatus}. Error: ${validationResult.errorMessage}`,
       );
     }
 

package/src/credential/presentation/v1.3.3/05-verify-request-object.ts

@@ -1,31 +1,33 @@
-import type { RelyingPartyConfig, RemotePresentationApi } from "../api";
 import {
-  parseAuthorizeRequest as sdkParseAuthorizeRequest,
   ClientIdPrefix,
   extractClientIdPrefix,
+  parseAuthorizeRequest as sdkParseAuthorizeRequest,
 } from "@pagopa/io-wallet-oid4vp";
 import QuickCrypto from "react-native-quick-crypto";
+
+import type { RelyingPartyConfig, RemotePresentationApi } from "../api";
+import type { RawRequestObject } from "./types";
+
 import { partialCallbacks } from "../../../utils/callbacks";
 import { sdkConfigV1_3 } from "../../../utils/config";
 import { IoWalletError } from "../../../utils/errors";
 import { InvalidRequestObjectError } from "../common/errors";
-import { mapSdkRequestObjectError } from "./sdkErrorMapper";
 import { mapToRequestObject } from "./mappers";
-import type { RawRequestObject } from "./types";
+import { mapSdkRequestObjectError } from "./sdkErrorMapper";
 
 export const verifyRequestObject: RemotePresentationApi["verifyRequestObject"] =
   async (requestObjectEncodedJwt, { clientId: fullClientId, rpConf }) => {
     const parsedRequestObject = await sdkParseAuthorizeRequest({
-      config: sdkConfigV1_3,
-      requestObjectJwt: requestObjectEncodedJwt,
       callbacks: {
         verifyJwt: partialCallbacks.verifyJwt,
       },
+      config: sdkConfigV1_3,
+      requestObjectJwt: requestObjectEncodedJwt,
     }).catch(mapSdkRequestObjectError);
 
     const rawRequestObject = parsedRequestObject as RawRequestObject;
 
-    const { prefix, clientId } = extractClientIdPrefix(fullClientId);
+    const { clientId, prefix } = extractClientIdPrefix(fullClientId);
 
     if (prefix === ClientIdPrefix.X509_HASH) {
       validateX509HashClient(rawRequestObject.header.x5c, clientId);
@@ -39,7 +41,7 @@ export const verifyRequestObject: RemotePresentationApi["verifyRequestObject"] =
         rawRequestObject,
         fullClientId,
         clientId,
-        rpConf
+        rpConf,
       );
     }
 
@@ -52,11 +54,11 @@ const validateOpenIDFederationClient = (
   requestObject: RawRequestObject,
   fullClientId: string,
   clientId: string,
-  rpConf: RelyingPartyConfig | undefined
+  rpConf: RelyingPartyConfig | undefined,
 ) => {
   if (!rpConf) {
     throw new IoWalletError(
-      "Relying Party Configuration is required for OpenID Federation clients"
+      "Relying Party Configuration is required for OpenID Federation clients",
     );
   }
 
@@ -66,22 +68,30 @@ const validateOpenIDFederationClient = (
 
   if (!isClientIdMatch) {
     throw new InvalidRequestObjectError(
-      "Client ID does not match Request Object or Entity Configuration"
+      "Client ID does not match Request Object or Entity Configuration",
     );
   }
 };
 
 const validateX509HashClient = (
   certificateChain: string[],
-  x509Hash: string
+  x509Hash: string,
 ) => {
+  const cert = certificateChain[0];
+
+  if (!cert) {
+    throw new InvalidRequestObjectError(
+      "Certificate chain is empty, cannot validate x509_hash",
+    );
+  }
+
   const calculatedHash = QuickCrypto.createHash("sha-256")
-    .update(certificateChain[0]!, "base64")
+    .update(cert, "base64")
     .digest("base64url");
 
   if (x509Hash !== calculatedHash) {
     throw new InvalidRequestObjectError(
-      "x509_hash does not match the hash of the x5c leaf certificate"
+      "x509_hash does not match the hash of the x5c leaf certificate",
     );
   }
 };

package/src/credential/presentation/v1.3.3/06-evaluate-dcql-query.ts

@@ -1,16 +1,18 @@
-import { DcqlQuery, DcqlError } from "dcql";
+import { DcqlError, DcqlQuery } from "dcql";
 import { isValiError } from "valibot";
-import { CredentialsNotFoundError } from "../common/errors";
-import type { CredentialPurpose } from "../api/06-evaluate-dcql-query";
-import * as sdJwtUtils from "../common/utils/sd-jwt";
-import * as mdocUtils from "../common/utils/mdoc";
+
 import type { Credential4Dcql, RemotePresentationApi } from "../api";
+import type { CredentialPurpose } from "../api/06-evaluate-dcql-query";
+
+import { CredentialsNotFoundError } from "../common/errors";
 import {
   extractFailedCredentialsDetails,
-  getDcqlQueryMatches,
   getClaimsFromDcqlMatch,
+  getDcqlQueryMatches,
   getPresentationFrameFromDcqlMatch,
 } from "../common/utils/dcql";
+import * as mdocUtils from "../common/utils/mdoc";
+import * as sdJwtUtils from "../common/utils/sd-jwt";
 
 export const evaluateDcqlQuery: RemotePresentationApi["evaluateDcqlQuery"] =
   async (query, credentialsSdJwt, credentialsMdoc = []) => {
@@ -27,7 +29,7 @@ export const evaluateDcqlQuery: RemotePresentationApi["evaluateDcqlQuery"] =
         ...acc,
         ["vct" in c ? c.vct : c.doctype]: c.original_credential,
       }),
-      {} as Record<string, Credential4Dcql>
+      {} as Record<string, Credential4Dcql>,
     );
 
     try {
@@ -39,7 +41,7 @@ export const evaluateDcqlQuery: RemotePresentationApi["evaluateDcqlQuery"] =
 
       if (!queryResult.can_be_satisfied) {
         throw new CredentialsNotFoundError(
-          extractFailedCredentialsDetails(queryResult)
+          extractFailedCredentialsDetails(queryResult),
         );
       }
 
@@ -55,61 +57,73 @@ export const evaluateDcqlQuery: RemotePresentationApi["evaluateDcqlQuery"] =
 
         if (matchOutput?.credential_format === "dc+sd-jwt") {
           const { vct } = matchOutput;
-          const [keyTag, credential] = credentialsById[vct]!;
+          const sdjwtCredential = credentialsById[vct];
+          if (!sdjwtCredential) {
+            throw new Error(
+              `Credential with vct ${vct} not found in the provided credentials.`,
+            );
+          }
+          const [keyTag, credential] = sdjwtCredential;
 
           const requiredDisclosures = getClaimsFromDcqlMatch(match);
           const presentationFrame = getPresentationFrameFromDcqlMatch(
             match,
-            parsedQuery
+            parsedQuery,
           );
 
           return {
+            credential,
+            format: matchOutput.credential_format,
             id,
-            vct,
             keyTag,
-            format: matchOutput.credential_format,
-            credential,
-            requiredDisclosures,
             presentationFrame,
             // When it is a match but no credential_sets are found, the credential is required by default
             // See https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-6.4.2
             purposes: purposes ?? [{ required: true }],
+            requiredDisclosures,
+            vct,
           };
         }
 
         if (matchOutput?.credential_format === "mso_mdoc") {
           const { doctype } = matchOutput;
-          const [keyTag, credential] = credentialsById[doctype]!;
+          const mdocCredential = credentialsById[doctype];
+          if (!mdocCredential) {
+            throw new Error(
+              `Credential with doctype ${doctype} not found in the provided credentials.`,
+            );
+          }
+          const [keyTag, credential] = mdocCredential;
 
           const requiredDisclosures = mdocUtils.getClaimsFromDcqlMatch(match);
           const presentationFrame = mdocUtils.getPresentationFrameFromClaims(
             requiredDisclosures,
-            doctype
+            doctype,
           );
 
           return {
-            id,
+            credential,
             doctype,
-            keyTag,
             format: matchOutput.credential_format,
-            credential,
-            requiredDisclosures,
+            id,
+            keyTag,
             presentationFrame,
             purposes: purposes ?? [{ required: true }],
+            requiredDisclosures,
           };
         }
 
         throw new Error(
-          `Unsupported credential format: ${matchOutput?.credential_format}`
+          `Unsupported credential format: ${matchOutput?.credential_format}`,
         );
       });
     } catch (error) {
       // Invalid DCQL query structure. Remap to `DcqlError` for consistency.
       if (isValiError(error)) {
         throw new DcqlError({
-          message: "Failed to parse the provided DCQL query",
-          code: "PARSE_ERROR",
           cause: error.issues,
+          code: "PARSE_ERROR",
+          message: "Failed to parse the provided DCQL query",
         });
       }
 

package/src/credential/presentation/v1.3.3/07-send-authorization-response.ts

@@ -2,23 +2,25 @@ import {
   createAuthorizationResponse as sdkCreateAuthorizationResponse,
   fetchAuthorizationResponse as sdkFetchAuthorizationResponse,
 } from "@pagopa/io-wallet-oid4vp";
+
 import type { RemotePresentationApi } from "../api";
+
+import { prepareVpTokenMdoc } from "../../../mdoc";
+import { prepareVpToken } from "../../../sd-jwt";
 import { partialCallbacks } from "../../../utils/callbacks";
-import { mapSdkAuthorizationResponseError } from "./sdkErrorMapper";
-import {
-  generateRandomAlphaNumericString,
-  hasStatusOrThrow,
-} from "../../../utils/misc";
+import { sdkConfigV1_3 } from "../../../utils/config";
+import { createCryptoContextFor } from "../../../utils/crypto";
 import {
   IoWalletError,
   RelyingPartyResponseError,
 } from "../../../utils/errors";
-import { AuthorizationResponse } from "./types";
+import {
+  generateRandomAlphaNumericString,
+  hasStatusOrThrow,
+} from "../../../utils/misc";
 import { buildDirectPostBody } from "../common/utils/http";
-import { prepareVpToken } from "../../../sd-jwt";
-import { createCryptoContextFor } from "../../../utils/crypto";
-import { sdkConfigV1_3 } from "../../../utils/config";
-import { prepareVpTokenMdoc } from "../../../mdoc";
+import { mapSdkAuthorizationResponseError } from "./sdkErrorMapper";
+import { AuthorizationResponse } from "./types";
 
 /**
  * Prepares remote presentations for a set of credentials.
@@ -50,14 +52,14 @@ export const prepareRemotePresentations: RemotePresentationApi["prepareRemotePre
               item.credential,
               item.presentationFrame,
               createCryptoContextFor(item.keyTag),
-            ]
+            ],
           );
 
           return {
-            requestedClaims: item.requiredDisclosures.map(({ name }) => name),
             credentialId: item.id,
-            vpToken: vp_token,
             format,
+            requestedClaims: item.requiredDisclosures.map(({ name }) => name),
+            vpToken: vp_token,
           };
         }
 
@@ -73,24 +75,24 @@ export const prepareRemotePresentations: RemotePresentationApi["prepareRemotePre
               item.credential,
               item.presentationFrame,
               createCryptoContextFor(item.keyTag),
-            ]
+            ],
           );
 
           return {
-            requestedClaims: item.requiredDisclosures.map(({ name }) => name),
             credentialId: item.id,
-            vpToken: vp_token,
             format: "mso_mdoc",
+            requestedClaims: item.requiredDisclosures.map(({ name }) => name),
+            vpToken: vp_token,
           };
         }
 
         throw new IoWalletError(`${format} format is not supported.`);
-      })
+      }),
     );
 
     return {
-      presentations,
       generatedNonce,
+      presentations,
     };
   };
 
@@ -99,23 +101,29 @@ export const sendAuthorizationResponse: RemotePresentationApi["sendAuthorization
     requestObject,
     remotePresentation,
     rpConf,
-    { appFetch = fetch } = {}
+    { appFetch = fetch } = {},
   ) => {
     try {
       if (!rpConf && !requestObject.client_metadata) {
         throw new IoWalletError(
-          "At least one of rpConf or requestObject.client_metadata must be provided to send the authorization response"
+          "At least one of rpConf or requestObject.client_metadata must be provided to send the authorization response",
         );
       }
 
       // When the RP is not an OpenID Federation client, rpConf will be undefined
       // so the keys are taken from the Request Object's client_metadata.
+      const clientMetadata = requestObject.client_metadata;
+      const jwks = rpConf?.jwks ?? clientMetadata?.jwks;
+      if (!jwks) {
+        throw new IoWalletError(
+          "Missing jwks in both rpConf and requestObject.client_metadata",
+        );
+      }
       const rpJwks = {
-        jwks: rpConf?.jwks ?? requestObject.client_metadata!.jwks,
         encrypted_response_enc_values_supported:
           rpConf?.encrypted_response_enc_values_supported ??
-          requestObject.client_metadata!
-            .encrypted_response_enc_values_supported,
+          clientMetadata?.encrypted_response_enc_values_supported,
+        jwks,
       };
 
       const vp_token = remotePresentation.presentations.reduce(
@@ -123,24 +131,24 @@ export const sendAuthorizationResponse: RemotePresentationApi["sendAuthorization
           (acc[p.credentialId] ??= []).push(p.vpToken);
           return acc;
         },
-        {} as Record<string, string[]>
+        {} as Record<string, string[]>,
       );
 
       const { jarm } = await sdkCreateAuthorizationResponse({
-        config: sdkConfigV1_3,
-        requestObject,
-        rpJwks,
-        vp_token,
         callbacks: {
           encryptJwe: partialCallbacks.encryptJwe,
           generateRandom: partialCallbacks.generateRandom,
         },
+        config: sdkConfigV1_3,
+        requestObject,
+        rpJwks,
+        vp_token,
       });
 
       return await sdkFetchAuthorizationResponse({
         authorizationResponseJarm: jarm.responseJwe,
-        presentationResponseUri: requestObject.response_uri,
         callbacks: { fetch: appFetch },
+        presentationResponseUri: requestObject.response_uri,
       });
     } catch (err) {
       throw mapSdkAuthorizationResponseError(err);
@@ -151,7 +159,7 @@ export const sendAuthorizationErrorResponse: RemotePresentationApi["sendAuthoriz
   async (
     requestObject,
     { error, errorDescription },
-    { appFetch = fetch } = {}
+    { appFetch = fetch } = {},
   ) => {
     const requestBody = await buildDirectPostBody(requestObject, {
       error,
@@ -159,11 +167,11 @@ export const sendAuthorizationErrorResponse: RemotePresentationApi["sendAuthoriz
     });
 
     return await appFetch(requestObject.response_uri, {
-      method: "POST",
+      body: requestBody,
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
       },
-      body: requestBody,
+      method: "POST",
     })
       .then(hasStatusOrThrow(200, RelyingPartyResponseError))
       .then((res) => res.json())

package/src/credential/presentation/v1.3.3/index.ts

@@ -1,4 +1,5 @@
 import type { RemotePresentationApi } from "../api";
+
 import { startFlowFromQR } from "./01-start-flow";
 import { evaluateRelyingPartyTrust } from "./02-evaluate-rp-trust";
 import { getRequestObject } from "./03-get-request-object";
@@ -7,18 +8,18 @@ import { verifyRequestObject } from "./05-verify-request-object";
 import { evaluateDcqlQuery } from "./06-evaluate-dcql-query";
 import {
   prepareRemotePresentations,
-  sendAuthorizationResponse,
   sendAuthorizationErrorResponse,
+  sendAuthorizationResponse,
 } from "./07-send-authorization-response";
 
 export const RemotePresentation: RemotePresentationApi = {
-  startFlowFromQR,
+  evaluateDcqlQuery,
   evaluateRelyingPartyTrust,
   getRequestObject,
-  verifyAuthRequestCertificateChain,
-  verifyRequestObject,
-  evaluateDcqlQuery,
   prepareRemotePresentations,
-  sendAuthorizationResponse,
   sendAuthorizationErrorResponse,
+  sendAuthorizationResponse,
+  startFlowFromQR,
+  verifyAuthRequestCertificateChain,
+  verifyRequestObject,
 };