@pagopa/io-react-native-wallet 3.6.2 → 3.6.4

package/src/trust/v1.0.0/types.ts

@@ -1,28 +1,29 @@
-import * as z from "zod";
 import { jsonWebKeySchema } from "@pagopa/io-wallet-oid-federation";
+import * as z from "zod";
+
 import { JWK } from "../../utils/jwk";
 import { BaseEntityConfiguration } from "../common/types";
 
 const RelyingPartyMetadata = z.object({
   application_type: z.string().optional(),
+  authorization_encrypted_response_alg: z.string().optional(),
+  authorization_encrypted_response_enc: z.string().optional(),
+  authorization_signed_response_alg: z.string().optional(),
   client_id: z.string().optional(),
   client_name: z.string().optional(),
+  contacts: z.array(z.string()).optional(),
   jwks: z.object({
     keys: z.array(jsonWebKeySchema),
   }),
-  contacts: z.array(z.string()).optional(),
   request_uris: z.array(z.string()).optional(),
-  authorization_signed_response_alg: z.string().optional(),
-  authorization_encrypted_response_alg: z.string().optional(),
-  authorization_encrypted_response_enc: z.string().optional(),
 });
 
 // Display metadata for a credential, used by the issuer to
 // instruct the Wallet Solution on how to render the credential correctly
 type CredentialDisplayMetadata = z.infer<typeof CredentialDisplayMetadata>;
 const CredentialDisplayMetadata = z.object({
-  name: z.string(),
   locale: z.string(),
+  name: z.string(),
 });
 
 // Metadata for displaying issuer information
@@ -30,24 +31,24 @@ type CredentialIssuerDisplayMetadata = z.infer<
   typeof CredentialIssuerDisplayMetadata
 >;
 const CredentialIssuerDisplayMetadata = z.object({
-  name: z.string(),
   locale: z.string(),
+  name: z.string(),
 });
 
 type ClaimsMetadata = z.infer<typeof ClaimsMetadata>;
 const ClaimsMetadata = z.object({
-  path: z.array(z.union([z.string(), z.number(), z.null()])), // https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-15.html#name-claims-path-pointer
   display: z.array(CredentialDisplayMetadata),
+  path: z.array(z.union([z.string(), z.number(), z.null()])), // https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-15.html#name-claims-path-pointer
 });
 
 type IssuanceErrorSupported = z.infer<typeof IssuanceErrorSupported>;
 const IssuanceErrorSupported = z.object({
   display: z.array(
     z.object({
-      title: z.string(),
       description: z.string(),
       locale: z.string(),
-    })
+      title: z.string(),
+    }),
   ),
 });
 
@@ -56,19 +57,19 @@ type SupportedCredentialMetadata = z.infer<typeof SupportedCredentialMetadata>;
 const SupportedCredentialMetadata = z.intersection(
   z.discriminatedUnion("format", [
     z.object({ format: z.literal("dc+sd-jwt"), vct: z.string() }),
-    z.object({ format: z.literal("mso_mdoc"), doctype: z.string() }),
+    z.object({ doctype: z.string(), format: z.literal("mso_mdoc") }),
   ]),
   z.object({
-    scope: z.string(),
-    display: z.array(CredentialDisplayMetadata),
+    authentic_source: z.string().optional(),
     claims: z.array(ClaimsMetadata),
-    cryptographic_binding_methods_supported: z.array(z.string()),
     credential_signing_alg_values_supported: z.array(z.string()),
-    authentic_source: z.string().optional(),
+    cryptographic_binding_methods_supported: z.array(z.string()),
+    display: z.array(CredentialDisplayMetadata),
     issuance_errors_supported: z
       .record(z.string(), IssuanceErrorSupported)
       .optional(),
-  })
+    scope: z.string(),
+  }),
 );
 
 // Entity configuration for a Trust Anchor (it has no specific metadata section)
@@ -86,36 +87,36 @@ export const CredentialIssuerEntityConfiguration = BaseEntityConfiguration.and(
     payload: z.object({
       jwks: z.object({ keys: z.array(JWK) }),
       metadata: z.object({
-        openid_credential_issuer: z.object({
-          credential_issuer: z.string(),
-          credential_endpoint: z.string(),
-          revocation_endpoint: z.string().optional(),
-          nonce_endpoint: z.string(),
-          status_attestation_endpoint: z.string(),
-          display: z.array(CredentialIssuerDisplayMetadata),
-          credential_configurations_supported: z.record(
-            z.string(),
-            SupportedCredentialMetadata
-          ),
-          jwks: z.object({ keys: z.array(JWK) }),
-          trust_frameworks_supported: z.array(z.string()),
-          evidence_supported: z.array(z.string()),
-        }),
         oauth_authorization_server: z.object({
+          acr_values_supported: z.array(z.string()),
           authorization_endpoint: z.string(),
-          pushed_authorization_request_endpoint: z.string(),
-          token_endpoint: z.string(),
           client_registration_types_supported: z.array(z.string()),
           code_challenge_methods_supported: z.array(z.string()),
-          acr_values_supported: z.array(z.string()),
           grant_types_supported: z.array(z.string()),
           issuer: z.string(),
           jwks: z.object({ keys: z.array(JWK) }),
-          scopes_supported: z.array(z.string()),
+          pushed_authorization_request_endpoint: z.string(),
+          request_object_signing_alg_values_supported: z.array(z.string()),
           response_modes_supported: z.array(z.string()),
+          scopes_supported: z.array(z.string()),
+          token_endpoint: z.string(),
           token_endpoint_auth_methods_supported: z.array(z.string()),
           token_endpoint_auth_signing_alg_values_supported: z.array(z.string()),
-          request_object_signing_alg_values_supported: z.array(z.string()),
+        }),
+        openid_credential_issuer: z.object({
+          credential_configurations_supported: z.record(
+            z.string(),
+            SupportedCredentialMetadata,
+          ),
+          credential_endpoint: z.string(),
+          credential_issuer: z.string(),
+          display: z.array(CredentialIssuerDisplayMetadata),
+          evidence_supported: z.array(z.string()),
+          jwks: z.object({ keys: z.array(JWK) }),
+          nonce_endpoint: z.string(),
+          revocation_endpoint: z.string().optional(),
+          status_attestation_endpoint: z.string(),
+          trust_frameworks_supported: z.array(z.string()),
         }),
         /**
          * Credential Issuers act as Relying Party when they require the presentation of other credentials.
@@ -124,7 +125,7 @@ export const CredentialIssuerEntityConfiguration = BaseEntityConfiguration.and(
         openid_credential_verifier: RelyingPartyMetadata.optional(),
       }),
     }),
-  })
+  }),
 );
 
 // Entity configuration for a Relying Party
@@ -138,7 +139,7 @@ export const RelyingPartyEntityConfiguration = BaseEntityConfiguration.and(
         openid_credential_verifier: RelyingPartyMetadata,
       }),
     }),
-  })
+  }),
 );
 
 // Entity configuration for a Wallet Provider
@@ -151,19 +152,19 @@ export const WalletProviderEntityConfiguration = BaseEntityConfiguration.and(
       metadata: z.object({
         wallet_provider: z
           .object({
-            token_endpoint: z.string(),
             aal_values_supported: z.array(z.string()).optional(),
             grant_types_supported: z.array(z.string()),
+            jwks: z.object({ keys: z.array(JWK) }),
+            token_endpoint: z.string(),
             token_endpoint_auth_methods_supported: z.array(z.string()),
             token_endpoint_auth_signing_alg_values_supported: z.array(
-              z.string()
+              z.string(),
             ),
-            jwks: z.object({ keys: z.array(JWK) }),
           })
           .loose(),
       }),
     }),
-  })
+  }),
 );
 
 // Maps any entity configuration by the union of every possible shapes

package/src/trust/v1.0.0/verify-chain.ts

@@ -1,12 +1,13 @@
 import { z } from "zod";
+
 import { EntityStatement } from "../common/types";
 import { createVerifyTrustChain } from "../common/verify-chain";
 import { EntityConfiguration, TrustAnchorEntityConfiguration } from "./types";
 
 export const verifyTrustChain = createVerifyTrustChain({
-  EntityStatementShape: EntityStatement,
   EntityConfigurationShape: EntityConfiguration,
+  EntityStatementShape: EntityStatement,
   FirstElementShape: EntityConfiguration,
-  MiddleElementShape: EntityStatement,
   LastElementShape: z.union([EntityStatement, TrustAnchorEntityConfiguration]),
+  MiddleElementShape: EntityStatement,
 });

package/src/trust/v1.3.3/entities.ts

@@ -1,10 +1,12 @@
 import type z from "zod";
+
+import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
+
 import {
   type FetchOptions,
   getSignedEntityConfiguration,
 } from "../common/utils";
 import { EntityConfiguration, RelyingPartyEntityConfiguration } from "./types";
-import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
 
 /**
  * Fetch and parse the entity configuration document for a given federation entity.
@@ -27,7 +29,7 @@ import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
 async function fetchAndParseEntityConfiguration<T extends EntityConfiguration>(
   entityBaseUrl: string,
   schema: z.ZodType<T>,
-  { appFetch = fetch }: FetchOptions = {}
+  { appFetch = fetch }: FetchOptions = {},
 ): Promise<T> {
   const responseText = await getSignedEntityConfiguration(entityBaseUrl, {
     appFetch,
@@ -42,10 +44,10 @@ async function fetchAndParseEntityConfiguration<T extends EntityConfiguration>(
 
 export const getRelyingPartyEntityConfiguration = (
   entityBaseUrl: string,
-  options?: FetchOptions
+  options?: FetchOptions,
 ) =>
   fetchAndParseEntityConfiguration(
     entityBaseUrl,
     RelyingPartyEntityConfiguration,
-    options
+    options,
   );

package/src/trust/v1.3.3/types.ts

@@ -1,12 +1,13 @@
-import * as z from "zod";
-import { JWK } from "../../utils/jwk";
-import { BaseEntityConfiguration } from "../common/types";
 import {
-  itWalletCredentialIssuerMetadataV1_3,
   itWalletAuthorizationServerMetadataV1_3,
-  itWalletSolutionEntityMetadataV1_3,
+  itWalletCredentialIssuerMetadataV1_3,
   itWalletCredentialVerifierMetadataV1_3,
+  itWalletSolutionEntityMetadataV1_3,
 } from "@pagopa/io-wallet-oid-federation";
+import * as z from "zod";
+
+import { JWK } from "../../utils/jwk";
+import { BaseEntityConfiguration } from "../common/types";
 
 // Entity configuration for a Credential Issuer
 export type CredentialIssuerEntityConfiguration = z.infer<
@@ -17,13 +18,13 @@ export const CredentialIssuerEntityConfiguration = BaseEntityConfiguration.and(
     payload: z.object({
       jwks: z.object({ keys: z.array(JWK) }),
       metadata: z.object({
-        openid_credential_issuer: itWalletCredentialIssuerMetadataV1_3,
         oauth_authorization_server: itWalletAuthorizationServerMetadataV1_3,
+        openid_credential_issuer: itWalletCredentialIssuerMetadataV1_3,
         openid_credential_verifier:
           itWalletCredentialVerifierMetadataV1_3.optional(),
       }),
     }),
-  })
+  }),
 );
 
 // Entity configuration for a Relying Party
@@ -37,7 +38,7 @@ export const RelyingPartyEntityConfiguration = BaseEntityConfiguration.and(
         openid_credential_verifier: itWalletCredentialVerifierMetadataV1_3,
       }),
     }),
-  })
+  }),
 );
 
 // Entity configuration for a Wallet Provider
@@ -51,7 +52,7 @@ export const WalletProviderEntityConfiguration = BaseEntityConfiguration.and(
         wallet_solution: itWalletSolutionEntityMetadataV1_3,
       }),
     }),
-  })
+  }),
 );
 
 // Maps any entity configuration by the union of every possible shapes

package/src/utils/auth.ts

@@ -14,8 +14,8 @@ export interface AuthorizationContext {
  */
 export const AuthorizationResultShape = z.object({
   code: z.string(),
-  state: z.string(),
   iss: z.string().optional(),
+  state: z.string(),
 });
 
 /**

package/src/utils/callbacks.ts

@@ -1,29 +1,31 @@
 import {
+  type CryptoContext,
   EncryptJwe,
   getJwkFromHeader,
   SignJWT,
-  type CryptoContext,
 } from "@pagopa/io-react-native-jwt";
 import { verify } from "@pagopa/io-react-native-jwt";
 import { type CallbackContext, type JwtSigner } from "@pagopa/io-wallet-oauth2";
 import { digest } from "@sd-jwt/crypto-nodejs";
 import { X509 } from "jsrsasign";
-import { IoWalletError } from "./errors";
-import { assert, generateRandomBytes } from "./misc";
+
 import type { JWK } from "./jwk";
-import { getJwkFromCertificateChain, getJwkFromTrustChain } from "./crypto";
 
-type PartialCallbackContext = Omit<
-  CallbackContext,
-  "signJwt" | "clientAuthentication"
->;
+import { getJwkFromCertificateChain, getJwkFromTrustChain } from "./crypto";
+import { IoWalletError } from "./errors";
+import { assert, generateRandomBytes } from "./misc";
 
 // Fix incompatibility between ArrayBuffer types
 type DigestFixed = (
-  data: string | ArrayBuffer | ArrayBufferView,
-  algorithm?: string
+  data: ArrayBuffer | ArrayBufferView | string,
+  algorithm?: string,
 ) => Uint8Array;
 
+type PartialCallbackContext = Omit<
+  CallbackContext,
+  "clientAuthentication" | "signJwt"
+>;
+
 /**
  * Extract the signing JWK from one of the supported signer methods.
  * @param signer - The JWT signer.
@@ -31,17 +33,17 @@ type DigestFixed = (
  */
 const getJwkFromSigner = async (signer: JwtSigner): Promise<JWK> => {
   switch (signer.method) {
-    case "x5c":
-      return getJwkFromCertificateChain(signer.x5c);
     case "federation": {
       assert(
         signer.trustChain && signer.trustChain.length > 0,
-        "Trust chain is required for federation signer"
+        "Trust chain is required for federation signer",
       );
       return getJwkFromTrustChain(signer.trustChain, signer.kid);
     }
     case "jwk":
       return signer.publicJwk as JWK;
+    case "x5c":
+      return getJwkFromCertificateChain(signer.x5c);
     default:
       throw new IoWalletError(`Unsupported signer method: ${signer.method}`);
   }
@@ -53,25 +55,15 @@ const getJwkFromSigner = async (signer: JwtSigner): Promise<JWK> => {
  * as they require parameters that depends on the use case.
  */
 export const partialCallbacks: PartialCallbackContext = {
-  generateRandom: generateRandomBytes,
-  hash: digest as DigestFixed,
-  encryptJwe: async ({ publicJwk, alg, enc, kid }, data) => ({
-    // @ts-expect-error `alg` and `enc` are strings, but EncryptJwe expects specific string literals
-    jwe: await new EncryptJwe(data, { alg, enc, kid }).encrypt(publicJwk),
-    encryptionJwk: publicJwk,
-  }),
-  verifyJwt: async (jwtSigner, jwt) => {
-    try {
-      const signerJwk = await getJwkFromSigner(jwtSigner);
-      await verify(jwt.compact, signerJwk);
-      return { verified: true, signerJwk };
-    } catch {
-      return { verified: false };
-    }
-  },
   decryptJwe: () => {
     throw new IoWalletError("decryptJwe is not implemented");
   },
+  encryptJwe: async ({ alg, enc, kid, publicJwk }, data) => ({
+    encryptionJwk: publicJwk,
+    // @ts-expect-error `alg` and `enc` are strings, but EncryptJwe expects specific string literals
+    jwe: await new EncryptJwe(data, { alg, enc, kid }).encrypt(publicJwk),
+  }),
+  generateRandom: generateRandomBytes,
   getX509CertificateMetadata: (certificate) => {
     const x509 = new X509();
     x509.readCertPEM(certificate);
@@ -88,6 +80,16 @@ export const partialCallbacks: PartialCallbackContext = {
 
     return { sanDnsNames, sanUriNames };
   },
+  hash: digest as DigestFixed,
+  verifyJwt: async (jwtSigner, jwt) => {
+    try {
+      const signerJwk = await getJwkFromSigner(jwtSigner);
+      await verify(jwt.compact, signerJwk);
+      return { signerJwk, verified: true };
+    } catch {
+      return { verified: false };
+    }
+  },
 };
 
 type JWSHeader = Parameters<typeof getJwkFromHeader>[0];
@@ -102,18 +104,17 @@ type JWSHeader = Parameters<typeof getJwkFromHeader>[0];
  * @returns Function that implements `verifyJwt` callback
  */
 export const createVerifyJwtFromJwks = (
-  jwks: JWK[]
-): CallbackContext["verifyJwt"] => {
-  return async function verifyJwt(_, jwt) {
+  jwks: JWK[],
+): CallbackContext["verifyJwt"] =>
+  async function verifyJwt(_, jwt) {
     try {
       const signerJwk = getJwkFromHeader(jwt.header as JWSHeader, jwks);
       await verify(jwt.compact, signerJwk);
-      return { verified: true, signerJwk };
+      return { signerJwk, verified: true };
     } catch {
       return { verified: false };
     }
   };
-};
 
 /**
  * Create a signJwt implementation that signs a JWT using the provided CryptoContext.
@@ -121,9 +122,9 @@ export const createVerifyJwtFromJwks = (
  * @returns Function that implements `signJwt` callback
  */
 export const createSignJwtFromCryptoContext = (
-  cryptoContext: CryptoContext
-): CallbackContext["signJwt"] => {
-  return async function signJwt(jwtSigner, { header, payload }) {
+  cryptoContext: CryptoContext,
+): CallbackContext["signJwt"] =>
+  async function signJwt(jwtSigner, { header, payload }) {
     return {
       jwt: await new SignJWT(cryptoContext)
         .setProtectedHeader(header)
@@ -135,4 +136,3 @@ export const createSignJwtFromCryptoContext = (
           : await cryptoContext.getPublicKey(),
     };
   };
-};

package/src/utils/credentials.ts

@@ -1,14 +1,16 @@
-import { decodeSdJwtSync } from "@sd-jwt/decode";
-import { digest } from "@sd-jwt/crypto-nodejs";
 import { thumbprint } from "@pagopa/io-react-native-jwt";
+import { digest } from "@sd-jwt/crypto-nodejs";
+import { decodeSdJwtSync } from "@sd-jwt/decode";
+
 import type { CredentialFormat } from "../credential/issuance";
 import type { JWK } from "./jwk";
-import { IoWalletError } from "./errors";
+
 import {
   LEGACY_SD_JWT,
   SdJwt4VCBase,
   type SupportedSdJwtLegacyFormat,
 } from "../sd-jwt/types";
+import { IoWalletError } from "./errors";
 
 const SD_JWT = ["dc+sd-jwt", LEGACY_SD_JWT];
 
@@ -20,13 +22,13 @@ const SD_JWT = ["dc+sd-jwt", LEGACY_SD_JWT];
  */
 export const extractJwkFromCredential = async (
   credential: string,
-  format: CredentialFormat | SupportedSdJwtLegacyFormat
+  format: CredentialFormat | SupportedSdJwtLegacyFormat,
 ): Promise<JWK> => {
   if (SD_JWT.includes(format)) {
     // 1. SD-JWT case
     const decoded = decodeSdJwtSync(
       fixLegacyCredentialSdJwt(credential),
-      digest
+      digest,
     );
     const { cnf } = decoded.jwt.payload as SdJwt4VCBase["payload"];
     if (cnf.jwk) {

package/src/utils/crypto.ts

@@ -4,16 +4,18 @@ import {
   getPublicKeyFixed,
   sign,
 } from "@pagopa/io-react-native-crypto";
-import { v4 as uuidv4 } from "uuid";
 import {
+  type CryptoContext,
   decode,
   thumbprint,
-  type CryptoContext,
 } from "@pagopa/io-react-native-jwt";
-import type { BaseEntityConfiguration } from "../trust/common/types";
-import { JWK, JWKS } from "./jwk";
 import { KEYUTIL, KJUR, RSAKey, X509 } from "jsrsasign";
+import { v4 as uuidv4 } from "uuid";
+
+import type { BaseEntityConfiguration } from "../trust/common/types";
+
 import { IoWalletError } from "./errors";
+import { JWK, JWKS } from "./jwk";
 
 /**
  * Extension of the {@link CryptoContext} that adds key generation with optional key attestation.
@@ -29,8 +31,8 @@ export type KeyAttestationCryptoContext = CryptoContext & {
    * @returns An object with a success flag and a key attestation, if it was generated.
    */
   generateKeyWithAttestation(
-    challenge: string
-  ): Promise<{ success: boolean; attestation?: string }>;
+    challenge: string,
+  ): Promise<{ attestation?: string; success: boolean }>;
 };
 
 /**
@@ -40,29 +42,27 @@ export type KeyAttestationCryptoContext = CryptoContext & {
  *
  * @returns the crypto context
  */
-export const createCryptoContextFor = (keytag: string): CryptoContext => {
-  return {
-    async getPublicKey() {
-      return getPublicKeyFixed(keytag).then(async (jwk) => ({
-        ...jwk,
-        // Keys in the TEE are not stored with their KID, which is supposed to be assigned when they are included in JWK sets.
-        // (that is, KID is not a propoerty of the key itself, but it's property used to identify a key in a set).
-        // We assume the convention we use the thumbprint of the public key as KID, thus for easy development we decided to evaluate KID here
-        // However the values is an arbitrary string that might be anything
-        kid: await thumbprint(jwk),
-      }));
-    },
-    /**
-     * Get a signature for a provided value.
-     * If the key pair doesn't exist yet, an error is raised.
-     * @param value
-     * @returns The signature for the value
-     */
-    async getSignature(value: string) {
-      return sign(value, keytag);
-    },
-  };
-};
+export const createCryptoContextFor = (keytag: string): CryptoContext => ({
+  async getPublicKey() {
+    return getPublicKeyFixed(keytag).then(async (jwk) => ({
+      ...jwk,
+      // Keys in the TEE are not stored with their KID, which is supposed to be assigned when they are included in JWK sets.
+      // (that is, KID is not a propoerty of the key itself, but it's property used to identify a key in a set).
+      // We assume the convention we use the thumbprint of the public key as KID, thus for easy development we decided to evaluate KID here
+      // However the values is an arbitrary string that might be anything
+      kid: await thumbprint(jwk),
+    }));
+  },
+  /**
+   * Get a signature for a provided value.
+   * If the key pair doesn't exist yet, an error is raised.
+   * @param value
+   * @returns The signature for the value
+   */
+  async getSignature(value: string) {
+    return sign(value, keytag);
+  },
+});
 
 /**
  * Executes the input function injecting an ephemeral crypto context.
@@ -73,7 +73,7 @@ export const createCryptoContextFor = (keytag: string): CryptoContext => {
  * @returns The returned value of the input procedure.
  */
 export const withEphemeralKey = async <R>(
-  fn: (ephemeralContext: CryptoContext) => Promise<R>
+  fn: (ephemeralContext: CryptoContext) => Promise<R>,
 ): Promise<R> => {
   // Use an ephemeral key to be destroyed after use
   const keytag = `ephemeral-${uuidv4()}`;
@@ -110,7 +110,7 @@ export const getSigninJwkFromCert = (pemCert: string): JWK => {
   }
 
   throw new IoWalletError(
-    "Unable to find the signing key inside the PEM certificate"
+    "Unable to find the signing key inside the PEM certificate",
   );
 };
 
@@ -122,12 +122,12 @@ export const getSigninJwkFromCert = (pemCert: string): JWK => {
  * @throws Will throw an error if no suitable keys are found.
  */
 export const getJwkFromCertificateChain = async (
-  certChain: string[]
+  certChain: string[],
 ): Promise<JWK> => {
   const [leafCert] = certChain;
   if (!leafCert) {
     throw new IoWalletError(
-      "The provided certificate chain is invalid or malformed"
+      "The provided certificate chain is invalid or malformed",
     );
   }
   const pemCert = convertBase64DerToPem(leafCert);
@@ -144,7 +144,7 @@ export const getJwkFromCertificateChain = async (
  */
 export const getJwkFromTrustChain = (
   trustChain: string[],
-  signerKid: string
+  signerKid: string,
 ): JWK => {
   const [entityConfigurationJwt] = trustChain;
   if (!entityConfigurationJwt) {
@@ -164,7 +164,7 @@ export const getJwkFromTrustChain = (
   // Check metadata entries for additional JWKS like openid_credential_verifier
   if (baseEntityConfig.metadata) {
     for (const metadata of Object.values(
-      baseEntityConfig.metadata as Record<string, { jwks?: JWKS }>
+      baseEntityConfig.metadata as Record<string, { jwks?: JWKS }>,
     )) {
       if (metadata.jwks) {
         keys.push(...JWKS.parse(metadata.jwks).keys);
@@ -175,7 +175,7 @@ export const getJwkFromTrustChain = (
   const federationJwk = keys.find((key) => key.kid === signerKid);
   if (!federationJwk)
     throw new IoWalletError(
-      "No suitable key was found in the provided trust chain"
+      "No suitable key was found in the provided trust chain",
     );
   return federationJwk;
 };

package/src/utils/decoder.ts

@@ -1,7 +1,9 @@
 import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
+
 import type { JWTDecodeResult } from "./jwk";
+
 import { ValidationFailed } from "./errors";
-import { LogLevel, Logger } from "./logging";
+import { Logger, LogLevel } from "./logging";
 
 /*
  * Decode a form_post.jwt and return the final JWT.
@@ -32,8 +34,8 @@ import { LogLevel, Logger } from "./logging";
     </html>
  */
 export const getJwtFromFormPost = async (
-  formData: string
-): Promise<{ jwt: string; decodedJwt: JWTDecodeResult }> => {
+  formData: string,
+): Promise<{ decodedJwt: JWTDecodeResult; jwt: string }> => {
   const formPostRegex = /<input[^>]*name="response"[^>]*value="([^"]*)"/i;
   const lineExpressionRegex = /\r\n|\n\r|\n|\r|\s+/g;
 
@@ -44,13 +46,13 @@ export const getJwtFromFormPost = async (
     if (responseJwt) {
       const jwt = responseJwt.replace(lineExpressionRegex, "");
       const decodedJwt = decodeJwt(jwt);
-      return { jwt, decodedJwt };
+      return { decodedJwt, jwt };
     }
   }
 
   Logger.log(
     LogLevel.ERROR,
-    `Unable to obtain JWT from form_post.jwt. Form data: ${formData}`
+    `Unable to obtain JWT from form_post.jwt. Form data: ${formData}`,
   );
   throw new ValidationFailed({
     message: `Unable to obtain JWT from form_post.jwt. Form data: ${formData}`,