@pagopa/io-react-native-wallet 3.6.2 → 3.6.4

package/src/credential/presentation/v1.3.3/mappers.ts

@@ -1,7 +1,8 @@
-import { RelyingPartyEntityConfiguration } from "../../../trust/v1.3.3/types";
-import { createMapper } from "../../../utils/mappers";
 import type { RelyingPartyConfig } from "../api/RelyingPartyConfig";
 import type { RequestObject } from "../api/types";
+
+import { RelyingPartyEntityConfiguration } from "../../../trust/v1.3.3/types";
+import { createMapper } from "../../../utils/mappers";
 import { RawRequestObject } from "./types";
 
 export const mapToRelyingPartyConfig = createMapper<
@@ -11,26 +12,26 @@ export const mapToRelyingPartyConfig = createMapper<
   const { federation_entity, openid_credential_verifier } = payload.metadata;
 
   return {
-    subject: payload.sub,
-    jwks: openid_credential_verifier.jwks,
-    federation_entity,
     encrypted_response_enc_values_supported:
       openid_credential_verifier.encrypted_response_enc_values_supported,
+    federation_entity,
+    jwks: openid_credential_verifier.jwks,
+    subject: payload.sub,
   };
 });
 
 export const mapToRequestObject = createMapper<RawRequestObject, RequestObject>(
-  ({ payload, header }) => ({
-    iss: payload.iss ?? "",
+  ({ header, payload }) => ({
     client_id: payload.client_id,
+    client_metadata: payload.client_metadata,
     dcql_query: payload.dcql_query,
+    iss: payload.iss ?? "",
     nonce: payload.nonce,
-    response_uri: payload.response_uri,
-    state: payload.state,
     response_mode: payload.response_mode,
     response_type: payload.response_type,
-    client_metadata: payload.client_metadata,
-    x5c: header.x5c,
+    response_uri: payload.response_uri,
+    state: payload.state,
     trust_chain: header.trust_chain,
-  })
+    x5c: header.x5c,
+  }),
 );

package/src/credential/presentation/v1.3.3/sdkErrorMapper.ts

@@ -1,17 +1,19 @@
+import type { RelyingPartyResponseErrorCode } from "src/utils/error-codes";
+
 import { ValidationError as SdkValidationError } from "@openid4vc/utils";
+import { Oauth2JwtParseError as SdkOauth2JwtParseError } from "@pagopa/io-wallet-oauth2";
 import {
-  FetchAuthorizationResponseError as SdkFetchAuthorizationResponseError,
   CreateAuthorizationResponseError as SdkCreateAuthorizationResponseError,
+  FetchAuthorizationResponseError as SdkFetchAuthorizationResponseError,
 } from "@pagopa/io-wallet-oid4vp";
+import { UnexpectedStatusCodeError as SdkUnexpectedStatusCodeError } from "@pagopa/io-wallet-utils";
+
 import {
   RelyingPartyResponseError,
   RelyingPartyResponseErrorCodes,
   ResponseErrorBuilder,
 } from "../../../utils/errors";
-import { Oauth2JwtParseError as SdkOauth2JwtParseError } from "@pagopa/io-wallet-oauth2";
 import { InvalidRequestObjectError } from "../common/errors";
-import { UnexpectedStatusCodeError as SdkUnexpectedStatusCodeError } from "@pagopa/io-wallet-utils";
-import type { RelyingPartyResponseErrorCode } from "src/utils/error-codes";
 
 /**
  * Helper to create a generic RelyingPartyResponseError
@@ -19,7 +21,7 @@ import type { RelyingPartyResponseErrorCode } from "src/utils/error-codes";
 const toRelyingPartyResponseError = (
   message: string,
   statusCode: number,
-  code: RelyingPartyResponseErrorCode = RelyingPartyResponseErrorCodes.RelyingPartyGenericError
+  code: RelyingPartyResponseErrorCode = RelyingPartyResponseErrorCodes.RelyingPartyGenericError,
 ) =>
   new RelyingPartyResponseError({
     code,
@@ -46,13 +48,13 @@ export const mapSdkRequestObjectError = (err: unknown) => {
   if (err instanceof SdkValidationError) {
     throw new InvalidRequestObjectError(
       "The Request Object structure is invalid",
-      err.message
+      err.message,
     );
   }
 
   if (err instanceof SdkOauth2JwtParseError) {
     throw new InvalidRequestObjectError(
-      "The Request Object is not a valid JWT"
+      "The Request Object is not a valid JWT",
     );
   }
 

package/src/credential/presentation/v1.3.3/types.ts

@@ -1,8 +1,8 @@
-import * as z from "zod";
 import {
   zOpenid4vpAuthorizationRequestHeaderV1_3,
   zOpenid4vpAuthorizationRequestPayload,
 } from "@pagopa/io-wallet-oid4vp";
+import * as z from "zod";
 
 export type RawRequestObject = z.infer<typeof RawRequestObject>;
 export const RawRequestObject = z.object({
@@ -12,7 +12,7 @@ export const RawRequestObject = z.object({
 
 export type AuthorizationResponse = z.infer<typeof AuthorizationResponse>;
 export const AuthorizationResponse = z.object({
-  status: z.string().optional(),
-  response_code: z.string().optional(),
   redirect_uri: z.string().optional(),
+  response_code: z.string().optional(),
+  status: z.string().optional(),
 });

package/src/credential/status/api/index.ts

@@ -1,10 +1,6 @@
 import type { StatusAssertionApi } from "./status-assertion";
 import type { StatusListApi } from "./status-list";
 
-interface UnsupportedApi {
-  isSupported: false;
-}
-
 /**
  * Credential status API. It supports status assertion and status list.
  *
@@ -22,4 +18,8 @@ export interface CredentialStatusApi {
   statusList: StatusListApi | UnsupportedApi;
 }
 
+interface UnsupportedApi {
+  isSupported: false;
+}
+
 export * from "./types";

package/src/credential/status/api/status-assertion.ts

@@ -1,12 +1,11 @@
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
-import type { CredentialFormat, IssuerConfig } from "../../issuance/api";
+
 import type { SupportedSdJwtLegacyFormat } from "../../../sd-jwt/types";
 import type { Out } from "../../../utils/misc";
+import type { CredentialFormat, IssuerConfig } from "../../issuance/api";
 import type { ParsedStatusAssertion } from "./types";
 
 export interface StatusAssertionApi {
-  isSupported: true;
-
   /**
    * Get the status assertion of a digital credential.
    * @since 1.0.0
@@ -26,12 +25,14 @@ export interface StatusAssertionApi {
     credential: string,
     format: CredentialFormat | SupportedSdJwtLegacyFormat,
     context: {
+      appFetch?: GlobalFetch["fetch"];
       credentialCryptoContext: CryptoContext;
       wiaCryptoContext: CryptoContext;
-      appFetch?: GlobalFetch["fetch"];
-    }
+    },
   ): Promise<{ statusAssertion: string }>;
 
+  isSupported: true;
+
   /**
    * Given a status assertion, verifies that:
    * - It's in the supported format;
@@ -52,6 +53,6 @@ export interface StatusAssertionApi {
     issuerConf: IssuerConfig,
     statusAssertion: Out<StatusAssertionApi["get"]>,
     credential: string,
-    format: CredentialFormat | SupportedSdJwtLegacyFormat
+    format: CredentialFormat | SupportedSdJwtLegacyFormat,
   ): Promise<{ parsedStatusAssertion: ParsedStatusAssertion }>;
 }

package/src/credential/status/api/status-list.ts

@@ -3,8 +3,6 @@ import type { JWK } from "../../../utils/jwk";
 import type { StatusList } from "./types";
 
 export interface StatusListApi {
-  isSupported: true;
-
   /**
    * Get the status list token referenced by a credential. This function fetches the list
    * from the uri found in the credential's `status` claim.
@@ -28,12 +26,12 @@ export interface StatusListApi {
     format: CredentialFormat,
     context?: {
       appFetch?: GlobalFetch["fetch"];
-    }
+    },
   ): Promise<{
-    statusList: string;
     format: "jwt";
-    uri: string;
     idx: number;
+    statusList: string;
+    uri: string;
   }>;
 
   /**
@@ -47,18 +45,9 @@ export interface StatusListApi {
     uri: string,
     context?: {
       appFetch?: GlobalFetch["fetch"];
-    }
+    },
   ): Promise<string>;
 
-  /**
-   * Verifies the signature of a status list token and parses its payload.
-   * @since 1.3.3
-   * @param keys The JSON Web Key Set to verify the status list signature
-   * @param statusList The encoded status list token
-   * @returns The decoded status list payload
-   */
-  verifyAndParse(keys: JWK[], statusList: string): Promise<StatusList>;
-
   /**
    * Extracts the status at the specified index from a decoded status list.
    * @since 1.3.3
@@ -68,7 +57,7 @@ export interface StatusListApi {
    */
   getStatus(
     statusList: StatusList["status_list"],
-    idx: number
+    idx: number,
   ): {
     rawStatus: string;
     status: string;
@@ -85,6 +74,17 @@ export interface StatusListApi {
    */
   getStatusListEntry(
     credential: string,
-    format: CredentialFormat
+    format: CredentialFormat,
   ): Promise<{ idx: number; uri: string }>;
+
+  isSupported: true;
+
+  /**
+   * Verifies the signature of a status list token and parses its payload.
+   * @since 1.3.3
+   * @param keys The JSON Web Key Set to verify the status list signature
+   * @param statusList The encoded status list token
+   * @returns The decoded status list payload
+   */
+  verifyAndParse(keys: JWK[], statusList: string): Promise<StatusList>;
 }

package/src/credential/status/api/types.ts

@@ -1,21 +1,22 @@
 import { z } from "zod";
+
 import { UnixTime } from "../../../utils/zod";
 
 /**
  * Common type for a parsed Status Assertion
  */
-export type ParsedStatusAssertion = {
-  iss: string;
-  iat: number;
-  exp: number;
+export interface ParsedStatusAssertion {
   credential_hash: string;
   credential_hash_alg: string;
-  credential_status_type: string;
   credential_status_detail?: {
-    state: string;
     description: string;
+    state: string;
   };
-};
+  credential_status_type: string;
+  exp: number;
+  iat: number;
+  iss: string;
+}
 
 const StatusListBits = z.union([
   z.literal(1),
@@ -26,17 +27,17 @@ const StatusListBits = z.union([
 
 export type StatusListContent = z.infer<typeof StatusListContent>;
 export const StatusListContent = z.object({
+  aggregation_uri: z.url().optional(),
   bits: StatusListBits,
   lst: z.string().min(1),
-  aggregation_uri: z.url().optional(),
 });
 
 export type StatusList = z.infer<typeof StatusList>;
 export const StatusList = z.object({
-  sub: z.url(),
+  exp: UnixTime.optional(),
   iat: UnixTime,
   iss: z.url().optional(),
-  exp: UnixTime.optional(),
-  ttl: z.number().positive().optional(),
   status_list: StatusListContent,
+  sub: z.url(),
+  ttl: z.number().positive().optional(),
 });

package/src/credential/status/v1.0.0/01-status-assertion.ts

@@ -1,10 +1,9 @@
-import {
-  getCredentialHashWithouDiscloures,
-  hasStatusOrThrow,
-} from "../../../utils/misc";
 import { SignJWT } from "@pagopa/io-react-native-jwt";
 import { v4 as uuidv4 } from "uuid";
-import { StatusAssertionResponse } from "./types";
+
+import type { StatusAssertionApi } from "../api/status-assertion";
+
+import { extractJwkFromCredential } from "../../../utils/credentials";
 import {
   IoWalletError,
   IssuerResponseError,
@@ -13,16 +12,19 @@ import {
   UnexpectedStatusCodeError,
 } from "../../../utils/errors";
 import { Logger, LogLevel } from "../../../utils/logging";
-import { extractJwkFromCredential } from "../../../utils/credentials";
-import type { StatusAssertionApi } from "../api/status-assertion";
+import {
+  getCredentialHashWithouDiscloures,
+  hasStatusOrThrow,
+} from "../../../utils/misc";
+import { StatusAssertionResponse } from "./types";
 
 export const getStatusAssertion: StatusAssertionApi["get"] = async (
   issuerConf,
   credential,
   format,
-  ctx
+  ctx,
 ) => {
-  const { credentialCryptoContext, wiaCryptoContext, appFetch = fetch } = ctx;
+  const { appFetch = fetch, credentialCryptoContext, wiaCryptoContext } = ctx;
 
   const jwk = await extractJwkFromCredential(credential, format);
   const issuerJwk = await wiaCryptoContext.getPublicKey();
@@ -31,22 +33,22 @@ export const getStatusAssertion: StatusAssertionApi["get"] = async (
 
   if (!statusAttUrl) {
     throw new IoWalletError(
-      "Status assertion endpoint not found in the Issuer configuration"
+      "Status assertion endpoint not found in the Issuer configuration",
     );
   }
 
   const credentialPop = await new SignJWT(credentialCryptoContext)
     .setPayload({
-      iss: issuerJwk.kid,
       aud: statusAttUrl,
-      jti: uuidv4().toString(),
       credential_hash: credentialHash,
       credential_hash_alg: "sha-256",
+      iss: issuerJwk.kid,
+      jti: uuidv4().toString(),
     })
     .setProtectedHeader({
       alg: "ES256",
-      typ: "status-assertion-request+jwt",
       kid: jwk.kid,
+      typ: "status-assertion-request+jwt",
     })
     .setIssuedAt()
     .setExpirationTime("5m")
@@ -59,11 +61,11 @@ export const getStatusAssertion: StatusAssertionApi["get"] = async (
   Logger.log(LogLevel.DEBUG, `Credential pop: ${credentialPop}`);
 
   const result = await appFetch(statusAttUrl, {
-    method: "POST",
+    body: JSON.stringify(body),
     headers: {
       "Content-Type": "application/json",
     },
-    body: JSON.stringify(body),
+    method: "POST",
   })
     .then(hasStatusOrThrow(200))
     .then((raw) => raw.json())
@@ -72,7 +74,11 @@ export const getStatusAssertion: StatusAssertionApi["get"] = async (
 
   const [statusAttestationJwt] = result.status_assertion_responses;
 
-  return { statusAssertion: statusAttestationJwt! };
+  if (!statusAttestationJwt) {
+    throw new IoWalletError("Status assertion response is empty");
+  }
+
+  return { statusAssertion: statusAttestationJwt };
 };
 
 /**

package/src/credential/status/v1.0.0/02-verify-and-parse-status-assertion.ts

@@ -1,20 +1,22 @@
+import { decode as decodeJwt, verify } from "@pagopa/io-react-native-jwt";
+
+import type { StatusAssertionApi } from "../api/status-assertion";
+
+import { extractJwkFromCredential } from "../../../utils/credentials";
 import {
   IoWalletError,
   IssuerResponseError,
   IssuerResponseErrorCodes,
 } from "../../../utils/errors";
-import { decode as decodeJwt, verify } from "@pagopa/io-react-native-jwt";
+import { isSameThumbprint } from "../../../utils/jwk";
+import { Logger, LogLevel } from "../../../utils/logging";
+import { mapToParsedStatusAssertion } from "./mappers";
 import {
   type InvalidStatusErrorReason,
   ParsedStatusAssertionErrorJwt,
   ParsedStatusAssertionResponse,
   StatusType,
 } from "./types";
-import { Logger, LogLevel } from "../../../utils/logging";
-import { extractJwkFromCredential } from "../../../utils/credentials";
-import { isSameThumbprint } from "../../../utils/jwk";
-import type { StatusAssertionApi } from "../api/status-assertion";
-import { mapToParsedStatusAssertion } from "./mappers";
 
 export const verifyAndParseStatusAssertion: StatusAssertionApi["verifyAndParse"] =
   async (issuerConf, rawStatusAssertion, credential, format) => {
@@ -30,7 +32,7 @@ export const verifyAndParseStatusAssertion: StatusAssertionApi["verifyAndParse"]
 
     Logger.log(
       LogLevel.DEBUG,
-      `Parsed status assertion: ${JSON.stringify(parsedStatusAssertion)}`
+      `Parsed status assertion: ${JSON.stringify(parsedStatusAssertion)}`,
     );
 
     // Errors are transmitted in the JWT and use a 200 HTTP status code
@@ -38,8 +40,8 @@ export const verifyAndParseStatusAssertion: StatusAssertionApi["verifyAndParse"]
       throw new IssuerResponseError({
         code: IssuerResponseErrorCodes.CredentialInvalidStatus,
         message: "The status assertion contains an error",
-        statusCode: 200,
         reason: buildErrorReason(parsedStatusAssertion),
+        statusCode: 200,
       });
     }
 
@@ -56,8 +58,8 @@ export const verifyAndParseStatusAssertion: StatusAssertionApi["verifyAndParse"]
       throw new IssuerResponseError({
         code: IssuerResponseErrorCodes.CredentialInvalidStatus,
         message: "Invalid status found for the given credential",
-        statusCode: 200,
         reason: buildErrorReason(parsedStatusAssertion),
+        statusCode: 200,
       });
     }
 
@@ -67,7 +69,7 @@ export const verifyAndParseStatusAssertion: StatusAssertionApi["verifyAndParse"]
   };
 
 const isStatusAssertionError = (
-  assertion: ParsedStatusAssertionResponse
+  assertion: ParsedStatusAssertionResponse,
 ): assertion is ParsedStatusAssertionErrorJwt =>
   assertion.header.typ === "status-assertion-error+jwt";
 
@@ -78,10 +80,18 @@ const isStatusAssertionError = (
  */
 const buildErrorReason = ({
   payload,
-}: ParsedStatusAssertionResponse): InvalidStatusErrorReason =>
-  "error" in payload
-    ? payload
-    : {
-        error: payload.credential_status_detail!.state,
-        error_description: payload.credential_status_detail!.description,
-      };
+}: ParsedStatusAssertionResponse): InvalidStatusErrorReason => {
+  if ("error" in payload) return payload;
+
+  const { credential_status_detail } = payload;
+  if (!credential_status_detail) {
+    throw new IoWalletError(
+      "Missing credential_status_detail in an invalid status assertion",
+    );
+  }
+
+  return {
+    error: credential_status_detail.state,
+    error_description: credential_status_detail.description,
+  };
+};

package/src/credential/status/v1.0.0/index.ts

@@ -1,11 +1,12 @@
 import type { CredentialStatusApi } from "../api";
+
 import { getStatusAssertion } from "./01-status-assertion";
 import { verifyAndParseStatusAssertion } from "./02-verify-and-parse-status-assertion";
 
 export const CredentialStatus: CredentialStatusApi = {
   statusAssertion: {
-    isSupported: true,
     get: getStatusAssertion,
+    isSupported: true,
     verifyAndParse: verifyAndParseStatusAssertion,
   },
   statusList: {

package/src/credential/status/v1.0.0/mappers.ts

@@ -1,7 +1,8 @@
-import { createMapper } from "../../../utils/mappers";
 import type { ParsedStatusAssertion } from "../api/types";
 import type { ParsedStatusAssertionJwt } from "./types";
 
+import { createMapper } from "../../../utils/mappers";
+
 export const mapToParsedStatusAssertion = createMapper<
   ParsedStatusAssertionJwt,
   ParsedStatusAssertion

package/src/credential/status/v1.0.0/types.ts

@@ -1,7 +1,8 @@
-import { UnixTime } from "../../../utils/zod";
-import { JWK } from "../../../utils/jwk";
 import * as z from "zod";
 
+import { JWK } from "../../../utils/jwk";
+import { UnixTime } from "../../../utils/zod";
+
 /**
  * Shape from parsing a status assertion response in case of 201.
  */
@@ -9,39 +10,39 @@ export const StatusAssertionResponse = z.object({
   status_assertion_responses: z.array(z.string()),
 });
 
+export type ParsedStatusAssertionJwt = z.infer<typeof ParsedStatusAssertionJwt>;
+
 /**
  * Type from parsing a status assertion response in case of 201.
  * Inferred from {@link StatusAssertionResponse}.
  */
 export type StatusAssertionResponse = z.infer<typeof StatusAssertionResponse>;
 
-export type ParsedStatusAssertionJwt = z.infer<typeof ParsedStatusAssertionJwt>;
-
 /**
  * Shape for parsing a successful status assertion in a JWT.
  */
 export const ParsedStatusAssertionJwt = z.object({
   header: z.object({
-    typ: z.literal("status-assertion+jwt"),
     alg: z.string(),
     kid: z.string().optional(),
+    typ: z.literal("status-assertion+jwt"),
   }),
   payload: z.object({
-    iss: z.string(),
-    credential_status_type: z.string(),
+    cnf: z.object({
+      jwk: JWK,
+    }),
+    credential_hash: z.string(),
+    credential_hash_alg: z.string(),
     credential_status_detail: z
       .object({
-        state: z.string(),
         description: z.string(),
+        state: z.string(),
       })
       .optional(),
-    credential_hash_alg: z.string(),
-    credential_hash: z.string(),
-    cnf: z.object({
-      jwk: JWK,
-    }),
+    credential_status_type: z.string(),
     exp: UnixTime,
     iat: UnixTime,
+    iss: z.string(),
   }),
 });
 
@@ -55,13 +56,13 @@ export type ParsedStatusAssertionErrorJwt = z.infer<
  */
 export const ParsedStatusAssertionErrorJwt = z.object({
   header: z.object({
-    typ: z.literal("status-assertion-error+jwt"),
     alg: z.string(),
     kid: z.string().optional(),
+    typ: z.literal("status-assertion-error+jwt"),
   }),
   payload: z.object({
-    credential_hash_alg: z.string(),
     credential_hash: z.string(),
+    credential_hash_alg: z.string(),
     error: z.string(),
     error_description: z.string(),
   }),
@@ -79,9 +80,9 @@ export const ParsedStatusAssertionResponse = z.union([
 ]);
 
 export enum StatusType {
-  VALID = "0x00",
   INVALID = "0x01",
   SUSPENDED = "0x02",
+  VALID = "0x00",
 }
 
 export type InvalidStatusErrorReason = {

package/src/credential/status/v1.3.3/01-status-list.ts

@@ -4,13 +4,15 @@ import {
   getStatusListFromJWT,
   type StatusListEntry,
 } from "@sd-jwt/jwt-status-list";
+
+import type { StatusListApi } from "../api/status-list";
+
 import { IoWalletError } from "../../../utils/errors";
 import { hasStatusOrThrow } from "../../../utils/misc";
-import type { StatusListApi } from "../api/status-list";
 
 export const getStatusListEntry: StatusListApi["getStatusListEntry"] = async (
   credential,
-  format
+  format,
 ) => {
   let statusListEntry: StatusListEntry | undefined;
 
@@ -34,7 +36,7 @@ export const getStatusListEntry: StatusListApi["getStatusListEntry"] = async (
 const fetchStatusList = (
   uri: string,
   appFetch: GlobalFetch["fetch"],
-  options: { cacheDisabled?: boolean } = {}
+  options: { cacheDisabled?: boolean } = {},
 ) =>
   appFetch(uri, {
     headers: {
@@ -47,7 +49,7 @@ const fetchStatusList = (
 
 export const getStatusListByUri: StatusListApi["getByUri"] = async (
   uri,
-  { appFetch = fetch } = {}
+  { appFetch = fetch } = {},
 ) => {
   // When the HTTP response includes cache headers, fetch will return a cached response and the JWT might be expired
   let statusList = await fetchStatusList(uri, appFetch);
@@ -67,9 +69,9 @@ export const getStatusListByUri: StatusListApi["getByUri"] = async (
 export const getStatusList: StatusListApi["get"] = async (
   credential,
   format,
-  context
+  context,
 ) => {
-  const { uri, idx } = await getStatusListEntry(credential, format);
+  const { idx, uri } = await getStatusListEntry(credential, format);
   const statusList = await getStatusListByUri(uri, context);
-  return { uri, idx, statusList, format: "jwt" };
+  return { format: "jwt", idx, statusList, uri };
 };

package/src/credential/status/v1.3.3/02-verify-and-parse-status-list.ts

@@ -1,10 +1,12 @@
 import { decode as decodeJwt, verify } from "@pagopa/io-react-native-jwt";
+
 import type { StatusListApi } from "../api/status-list";
+
 import { StatusList } from "../api/types";
 
 export const verifyAndParseStatusList: StatusListApi["verifyAndParse"] = async (
   keys,
-  statusList
+  statusList,
 ) => {
   await verify(statusList, keys);
   return StatusList.parse(decodeJwt(statusList).payload);