@pagopa/io-react-native-wallet 3.6.2 → 3.6.4

package/src/utils/misc.ts

@@ -1,6 +1,7 @@
-import { IoWalletError, UnexpectedStatusCodeError } from "./errors";
 import { sha256 } from "js-sha256";
-import { LogLevel, Logger } from "./logging";
+
+import { IoWalletError, UnexpectedStatusCodeError } from "./errors";
+import { Logger, LogLevel } from "./logging";
 
 /**
  * Check if a response is in the expected status, otherwise throw an error
@@ -16,12 +17,12 @@ export const hasStatusOrThrow =
       const ErrorClass = customError ?? UnexpectedStatusCodeError;
       Logger.log(
         LogLevel.ERROR,
-        `Http request failed. Expected ${status}, got ${res.status}, url: ${res.url}`
+        `Http request failed. Expected ${status}, got ${res.status}, url: ${res.url}`,
       );
       throw new ErrorClass({
         message: `Http request failed. Expected ${status}, got ${res.status}, url: ${res.url}`,
-        statusCode: res.status,
         reason: await parseRawHttpResponse(res), // Pass the response body as reason so the original error can surface
+        statusCode: res.status,
       });
     }
     return res;
@@ -31,7 +32,7 @@ export const hasStatusOrThrow =
  * Utility function to parse a raw HTTP response as JSON if supported, otherwise as text.
  */
 export const parseRawHttpResponse = <T extends Record<string, unknown>>(
-  response: Response
+  response: Response,
 ) =>
   response.headers.get("content-type")?.includes("application/json")
     ? (response.json() as Promise<T>)
@@ -39,9 +40,11 @@ export const parseRawHttpResponse = <T extends Record<string, unknown>>(
 
 // extract a type from an async function output
 // helpful to bind the input of a function to the output of another
-export type Out<FN> = FN extends (...args: any[]) => Promise<any>
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export type Out<FN> = FN extends (...args: any[]) => Promise<unknown>
   ? Awaited<ReturnType<FN>>
-  : FN extends (...args: any[]) => any
+  : // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    FN extends (...args: any[]) => any
     ? ReturnType<FN>
     : never;
 
@@ -52,7 +55,7 @@ export type Out<FN> = FN extends (...args: any[]) => Promise<any>
  */
 export const generateRandomAlphaNumericString = (size: number) =>
   Array.from(Array(size), () =>
-    Math.floor(Math.random() * 36).toString(36)
+    Math.floor(Math.random() * 36).toString(36),
   ).join("");
 
 /**
@@ -70,7 +73,7 @@ export const generateRandomBytes = (size: number) =>
  * @returns The hash of the credential without discloures
  */
 export const getCredentialHashWithouDiscloures = async (
-  credential: string
+  credential: string,
 ): Promise<string> => {
   const tildeIndex = credential.indexOf("~");
   if (tildeIndex === -1) {
@@ -79,17 +82,17 @@ export const getCredentialHashWithouDiscloures = async (
   return sha256(credential.slice(0, tildeIndex));
 };
 
-export const safeJsonParse = <T>(text: string, withDefault?: T): T | null => {
+export const safeJsonParse = <T>(text: string, withDefault?: T): null | T => {
   try {
     return JSON.parse(text);
-  } catch (_) {
+  } catch {
     return withDefault ?? null;
   }
 };
 
 export function assert(
   condition: unknown,
-  msg: string = "Assertion failed"
+  msg = "Assertion failed",
 ): asserts condition {
   if (!condition) {
     throw new IoWalletError(msg);

package/src/utils/par.ts

@@ -1,26 +1,27 @@
 import {
-  sha256ToBase64,
   type CryptoContext,
+  sha256ToBase64,
   SignJWT,
 } from "@pagopa/io-react-native-jwt";
 import { v4 as uuidv4 } from "uuid";
 import * as z from "zod";
+
+import { IssuerResponseError } from "./errors";
+import { Logger, LogLevel } from "./logging";
 import { generateRandomAlphaNumericString, hasStatusOrThrow } from "./misc";
 import { createPopToken } from "./pop";
-import { IssuerResponseError } from "./errors";
-import { LogLevel, Logger } from "./logging";
 
 export type AuthorizationDetail = z.infer<typeof AuthorizationDetail>;
 export const AuthorizationDetail = z.union([
   z.object({
-    type: z.literal("openid_credential"),
     credential_configuration_id: z.string(),
+    type: z.literal("openid_credential"),
   }),
   z.object({
-    type: z.literal("it_l2+document_proof"),
-    idphinting: z.string(),
     challenge_method: z.literal("mrtd+ias"),
     challenge_redirect_uri: z.string(),
+    idphinting: z.string(),
+    type: z.literal("it_l2+document_proof"),
   }),
 ]);
 
@@ -29,45 +30,45 @@ export const AuthorizationDetails = z.array(AuthorizationDetail);
 
 export type ParResponse = z.infer<typeof ParResponse>;
 export const ParResponse = z.object({
-  request_uri: z.string(),
   expires_in: z.number(),
+  request_uri: z.string(),
 });
 
 type AuthDetailsOrScope =
   | { authorizationDetails: AuthorizationDetails; scope?: string }
   | { authorizationDetails?: AuthorizationDetails; scope: string };
 
-type ParRequestPayload = {
+type ParRequestPayload = AuthDetailsOrScope & {
+  aud: string;
   clientId: string;
   codeVerifier: string;
   redirectUri: string;
   responseMode: string;
-  aud: string;
-} & AuthDetailsOrScope;
+};
 
 /**
  * Make a PAR request to the issuer and return the response url
  */
 export const makeParRequest =
   ({
-    wiaCryptoContext,
     appFetch,
+    wiaCryptoContext,
   }: {
-    wiaCryptoContext: CryptoContext;
     appFetch: GlobalFetch["fetch"];
+    wiaCryptoContext: CryptoContext;
   }) =>
   async (
     parEndpoint: string,
     walletInstanceAttestation: string,
     {
-      codeVerifier,
-      responseMode,
+      aud,
+      authorizationDetails,
       clientId,
+      codeVerifier,
       redirectUri,
-      authorizationDetails,
+      responseMode,
       scope,
-      aud,
-    }: ParRequestPayload
+    }: ParRequestPayload,
   ): Promise<string> => {
     const wiaPublicKey = await wiaCryptoContext.getPublicKey();
 
@@ -75,11 +76,11 @@ export const makeParRequest =
 
     const signedWiaPoP = await createPopToken(
       {
-        jti: `${uuidv4()}`,
         aud,
         iss: clientId,
+        jti: `${uuidv4()}`,
       },
-      wiaCryptoContext
+      wiaCryptoContext,
     );
 
     /** A code challenge is provided so that the PAR is bound
@@ -94,20 +95,20 @@ export const makeParRequest =
         The key is matched by its kid */
     const signedJwtForPar = await new SignJWT(wiaCryptoContext)
       .setProtectedHeader({
-        typ: "jwt",
         kid: wiaPublicKey.kid,
+        typ: "jwt",
       })
       .setPayload({
-        jti: `${uuidv4()}`,
         aud,
-        response_type: "code",
-        response_mode: responseMode,
         client_id: clientId,
-        iss: clientId,
-        state: generateRandomAlphaNumericString(32),
         code_challenge: codeChallenge,
         code_challenge_method: codeChallengeMethod,
+        iss: clientId,
+        jti: `${uuidv4()}`,
         redirect_uri: redirectUri,
+        response_mode: responseMode,
+        response_type: "code",
+        state: generateRandomAlphaNumericString(32),
         ...(authorizationDetails && {
           authorization_details: authorizationDetails,
         }),
@@ -118,24 +119,24 @@ export const makeParRequest =
       .sign();
 
     /** The request body for the Pushed Authorization Request */
-    var formBody = new URLSearchParams({
+    const formBody = new URLSearchParams({
       client_id: clientId,
       request: signedJwtForPar,
     });
 
     Logger.log(
       LogLevel.DEBUG,
-      `Sending to PAR endpoint ${parEndpoint}: ${formBody}`
+      `Sending to PAR endpoint ${parEndpoint}: ${formBody}`,
     );
 
     return await appFetch(parEndpoint, {
-      method: "POST",
+      body: formBody.toString(),
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
         "OAuth-Client-Attestation": walletInstanceAttestation,
         "OAuth-Client-Attestation-PoP": signedWiaPoP,
       },
-      body: formBody.toString(),
+      method: "POST",
     })
       .then(hasStatusOrThrow(201, IssuerResponseError))
       .then((res) => res.json())

package/src/utils/parser.ts

@@ -2,16 +2,16 @@
  * Helper to determine if two paths are equal (Supports string | number | null)
  */
 export const isPathEqual = (
-  pathA: (string | number | null)[],
-  pathB: (string | number | null)[]
+  pathA: (null | number | string)[],
+  pathB: (null | number | string)[],
 ): boolean =>
   pathA.length === pathB.length && pathA.every((v, i) => v === pathB[i]);
 /**
  * Helper to check if prefix is the start of fullPath
  */
 export const isPrefixOf = (
-  prefix: (string | number | null)[],
-  fullPath: (string | number | null)[]
+  prefix: (null | number | string)[],
+  fullPath: (null | number | string)[],
 ): boolean => {
   if (prefix.length >= fullPath.length) return false;
   return prefix.every((v, i) => v === fullPath[i]);

package/src/utils/pop.ts

@@ -1,7 +1,6 @@
+import { type CryptoContext, SignJWT } from "@pagopa/io-react-native-jwt";
 import * as z from "zod";
 
-import { SignJWT, type CryptoContext } from "@pagopa/io-react-native-jwt";
-
 /**
  * Create a signed PoP token
  *
@@ -12,14 +11,14 @@ import { SignJWT, type CryptoContext } from "@pagopa/io-react-native-jwt";
  */
 export const createPopToken = async (
   payload: PoPPayload,
-  crypto: CryptoContext
+  crypto: CryptoContext,
 ): Promise<string> => {
   const kid = await crypto.getPublicKey().then((_) => _.kid);
   return new SignJWT(crypto)
     .setPayload(payload)
     .setProtectedHeader({
-      typ: "oauth-client-attestation-pop+jwt",
       kid,
+      typ: "oauth-client-attestation-pop+jwt",
     })
     .setIssuedAt()
     .setExpirationTime("5min")
@@ -28,7 +27,7 @@ export const createPopToken = async (
 
 export type PoPPayload = z.infer<typeof PoPPayload>;
 export const PoPPayload = z.object({
-  jti: z.string(),
   aud: z.string(),
   iss: z.string(),
+  jti: z.string(),
 });

package/src/utils/string.ts

@@ -15,8 +15,8 @@
  */
 export const obfuscateString = (
   value: string,
-  percentage: number = 60,
-  obfuscatedChar: string = "*"
+  percentage = 60,
+  obfuscatedChar = "*",
 ): string => {
   if (!value) {
     return "";

package/src/utils/x509.ts

@@ -1,8 +1,9 @@
 import {
-  verifyCertificateChain,
   type CertificateValidationResult,
+  verifyCertificateChain,
   type X509CertificateOptions,
 } from "@pagopa/io-react-native-crypto";
+
 import { X509ValidationError } from "../trust/common/errors";
 
 /**
@@ -19,7 +20,7 @@ export const verifyX509Chain = async (
     connectTimeout: 10000,
     readTimeout: 10000,
     requireCrl: true,
-  }
+  },
 ) => {
   // Strip the trust anchor from the chain if the issuer included it,
   // since verifyCertificateChain expects it passed separately.
@@ -35,9 +36,9 @@ export const verifyX509Chain = async (
     throw new X509ValidationError(
       `X.509 certificate chain validation failed. Status: ${x509ValidationResult.validationStatus}. Error: ${x509ValidationResult.errorMessage}`,
       {
-        x509ValidationStatus: x509ValidationResult.validationStatus,
         x509ErrorMessage: x509ValidationResult.errorMessage,
-      }
+        x509ValidationStatus: x509ValidationResult.validationStatus,
+      },
     );
   }
 };

package/src/utils/zod.ts

@@ -6,16 +6,16 @@ import { z } from "zod";
 
 const literalSchema = z.union([z.string(), z.number(), z.boolean(), z.null()]);
 
-type Literal = z.infer<typeof literalSchema>;
+type Json = Json[] | Literal | { [key: string]: Json };
 
-type Json = Literal | { [key: string]: Json } | Json[];
+type Literal = z.infer<typeof literalSchema>;
 
 const jsonSchema: z.ZodType<Json> = z.lazy(() =>
   z.union([
     literalSchema,
     z.array(jsonSchema),
     z.record(z.string(), jsonSchema),
-  ])
+  ]),
 );
 
 export const json = () => jsonSchema;
@@ -25,7 +25,7 @@ export const stringToJSONSchema = z
   .transform((str, ctx): z.infer<ReturnType<typeof json>> => {
     try {
       return JSON.parse(str);
-    } catch (e) {
+    } catch {
       ctx.addIssue({ code: "custom", message: "Invalid JSON" });
       return z.NEVER;
     }

package/src/wallet-instance/api/index.ts

@@ -1,35 +1,24 @@
 import type { IntegrityContext } from "../../utils/integrity";
 
-export type WalletInstanceStatus = {
-  id: string;
-  is_revoked: boolean;
-  revocation_reason?:
-    | "CERTIFICATE_REVOKED_BY_ISSUER"
-    | "NEW_WALLET_INSTANCE_CREATED"
-    | "WALLET_INSTANCE_RENEWAL"
-    | "REVOKED_BY_USER";
-};
-
 export interface WalletInstanceApi {
   /**
    * Create a new Wallet Instance.
    */
   createWalletInstance(context: {
+    appFetch?: GlobalFetch["fetch"];
     integrityContext: IntegrityContext;
-    walletProviderBaseUrl: string;
     isRenewal?: boolean;
-    appFetch?: GlobalFetch["fetch"];
+    walletProviderBaseUrl: string;
   }): Promise<string>;
 
   /**
-   * Revoke a Wallet Instance by ID.
-   * @param context.id The Wallet Instance ID. It matches the hardware key tag used for creation.
+   * Get the status of the current Wallet Instance.
+   * @returns Details on the status of the current Wallet Instance
    */
-  revokeWalletInstance(context: {
-    id: string;
-    walletProviderBaseUrl: string;
+  getCurrentWalletInstanceStatus(context: {
     appFetch?: GlobalFetch["fetch"];
-  }): Promise<void>;
+    walletProviderBaseUrl: string;
+  }): Promise<WalletInstanceStatus>;
 
   /**
    * Get the status of a Wallet Instance by ID.
@@ -37,17 +26,28 @@ export interface WalletInstanceApi {
    * @returns Details on the status of the Wallet Instance
    */
   getWalletInstanceStatus(context: {
+    appFetch?: GlobalFetch["fetch"];
     id: string;
     walletProviderBaseUrl: string;
-    appFetch?: GlobalFetch["fetch"];
   }): Promise<WalletInstanceStatus>;
 
   /**
-   * Get the status of the current Wallet Instance.
-   * @returns Details on the status of the current Wallet Instance
+   * Revoke a Wallet Instance by ID.
+   * @param context.id The Wallet Instance ID. It matches the hardware key tag used for creation.
    */
-  getCurrentWalletInstanceStatus(context: {
-    walletProviderBaseUrl: string;
+  revokeWalletInstance(context: {
     appFetch?: GlobalFetch["fetch"];
-  }): Promise<WalletInstanceStatus>;
+    id: string;
+    walletProviderBaseUrl: string;
+  }): Promise<void>;
+}
+
+export interface WalletInstanceStatus {
+  id: string;
+  is_revoked: boolean;
+  revocation_reason?:
+    | "CERTIFICATE_REVOKED_BY_ISSUER"
+    | "NEW_WALLET_INSTANCE_CREATED"
+    | "REVOKED_BY_USER"
+    | "WALLET_INSTANCE_RENEWAL";
 }

package/src/wallet-instance/common/wallet-instance.ts

@@ -1,11 +1,12 @@
+import type { WalletInstanceApi } from "../api";
+
 import { getWalletProviderClient } from "../../client";
 import {
   ResponseErrorBuilder,
   WalletProviderResponseError,
   WalletProviderResponseErrorCodes,
 } from "../../utils/errors";
-import { LogLevel, Logger } from "../../utils/logging";
-import type { WalletInstanceApi } from "../api";
+import { Logger, LogLevel } from "../../utils/logging";
 
 export const createWalletInstance: WalletInstanceApi["createWalletInstance"] =
   async (context) => {
@@ -19,7 +20,7 @@ export const createWalletInstance: WalletInstanceApi["createWalletInstance"] =
 
     Logger.log(
       LogLevel.DEBUG,
-      `Challenge obtained from ${context.walletProviderBaseUrl}: ${challenge}`
+      `Challenge obtained from ${context.walletProviderBaseUrl}: ${challenge}`,
     );
 
     const keyAttestation = await integrityContext.getAttestation(challenge);
@@ -28,7 +29,7 @@ export const createWalletInstance: WalletInstanceApi["createWalletInstance"] =
 
     Logger.log(
       LogLevel.DEBUG,
-      `Key attestation: ${keyAttestation}\nAssociated hardware key tag: ${hardwareKeyTag}`
+      `Key attestation: ${keyAttestation}\nAssociated hardware key tag: ${hardwareKeyTag}`,
     );
 
     //2. Create Wallet Instance
@@ -36,9 +37,9 @@ export const createWalletInstance: WalletInstanceApi["createWalletInstance"] =
       .post("/wallet-instances", {
         body: {
           challenge,
-          key_attestation: keyAttestation,
           hardware_key_tag: hardwareKeyTag,
           is_renewal: isRenewal,
+          key_attestation: keyAttestation,
         },
       })
       .catch(handleCreateWalletInstanceError);
@@ -49,7 +50,7 @@ export const createWalletInstance: WalletInstanceApi["createWalletInstance"] =
 const handleCreateWalletInstanceError = (e: unknown) => {
   Logger.log(
     LogLevel.ERROR,
-    `An error occurred while calling /wallet-instances endpoint: ${e}`
+    `An error occurred while calling /wallet-instances endpoint: ${e}`,
   );
 
   if (!(e instanceof WalletProviderResponseError)) {
@@ -74,8 +75,8 @@ export const revokeWalletInstance: WalletInstanceApi["revokeWalletInstance"] =
     const api = getWalletProviderClient(context);
 
     await api.put("/wallet-instances/{id}/status", {
-      path: { id: context.id },
       body: { status: "REVOKED" },
+      path: { id: context.id },
     });
   };
 

package/src/wallet-instance/v1.0.0/index.ts

@@ -1,14 +1,15 @@
 import type { WalletInstanceApi } from "../api";
+
 import {
   createWalletInstance,
-  revokeWalletInstance,
-  getWalletInstanceStatus,
   getCurrentWalletInstanceStatus,
+  getWalletInstanceStatus,
+  revokeWalletInstance,
 } from "../common/wallet-instance";
 
 export const WalletInstance: WalletInstanceApi = {
   createWalletInstance,
-  revokeWalletInstance,
-  getWalletInstanceStatus,
   getCurrentWalletInstanceStatus,
+  getWalletInstanceStatus,
+  revokeWalletInstance,
 };

package/src/wallet-instance/v1.3.3/index.ts

@@ -1,14 +1,15 @@
 import type { WalletInstanceApi } from "../api";
+
 import {
   createWalletInstance,
-  revokeWalletInstance,
-  getWalletInstanceStatus,
   getCurrentWalletInstanceStatus,
+  getWalletInstanceStatus,
+  revokeWalletInstance,
 } from "../common/wallet-instance";
 
 export const WalletInstance: WalletInstanceApi = {
   createWalletInstance,
-  revokeWalletInstance,
-  getWalletInstanceStatus,
   getCurrentWalletInstanceStatus,
+  getWalletInstanceStatus,
+  revokeWalletInstance,
 };

package/src/wallet-instance-attestation/api/index.ts

@@ -1,4 +1,5 @@
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
+
 import type { IntegrityContext } from "../../utils/integrity";
 import type {
   DecodedWalletInstanceAttestation,
@@ -7,6 +8,20 @@ import type {
 } from "./types";
 
 export interface WalletInstanceAttestationApi {
+  /**
+   * Decode a given JWT to get the parsed Wallet Instance Attestation object they define.
+   * It ensures provided data is in a valid shape.
+   *
+   * It DOES NOT verify token signature nor check disclosures are correctly referenced by the JWT.
+   * Use {@link verify} instead
+   *
+   * @param token The encoded token that represents a valid jwt for Wallet Instance Attestation
+   * @returns The validated Wallet Instance Attestation object
+   * @throws A decoding error if the token doesn't resolve in a valid JWT
+   * @throws A validation error if the provided data doesn't result in a valid Wallet Instance Attestation
+   */
+  decode(token: string): DecodedWalletInstanceAttestation;
+
   /**
    * Request a Wallet Instance Attestation (WIA) to the Wallet provider.
    * The Wallet Instance Attestation may be issued in different formats.
@@ -21,26 +36,12 @@ export interface WalletInstanceAttestationApi {
   getAttestation(
     requestParams: WalletAttestationRequestParams,
     ctx: {
-      wiaCryptoContext: CryptoContext;
-      integrityContext: IntegrityContext;
       appFetch?: GlobalFetch["fetch"];
-    }
+      integrityContext: IntegrityContext;
+      wiaCryptoContext: CryptoContext;
+    },
   ): Promise<WalletAttestation[]>;
 
-  /**
-   * Decode a given JWT to get the parsed Wallet Instance Attestation object they define.
-   * It ensures provided data is in a valid shape.
-   *
-   * It DOES NOT verify token signature nor check disclosures are correctly referenced by the JWT.
-   * Use {@link verify} instead
-   *
-   * @param token The encoded token that represents a valid jwt for Wallet Instance Attestation
-   * @returns The validated Wallet Instance Attestation object
-   * @throws A decoding error if the token doesn't resolve in a valid JWT
-   * @throws A validation error if the provided data doesn't result in a valid Wallet Instance Attestation
-   */
-  decode(token: string): DecodedWalletInstanceAttestation;
-
   /**
    * Verify a given JWT to get the parsed Wallet Instance Attestation object they define.
    * Same as {@link decode} plus token signature verification

package/src/wallet-instance-attestation/api/types.ts

@@ -1,6 +1,7 @@
 import * as z from "zod";
-import { UnixTime } from "../../utils/zod";
+
 import { JWK } from "../../utils/jwk";
+import { UnixTime } from "../../utils/zod";
 
 /**
  * Common Wallet Instance Attestation shape. This object is
@@ -10,26 +11,26 @@ export type DecodedWalletInstanceAttestation = z.infer<
   typeof DecodedWalletInstanceAttestation
 >;
 export const DecodedWalletInstanceAttestation = z.object({
-  iss: z.string(),
-  iat: UnixTime,
-  exp: UnixTime,
+  /** @deprecated */
+  aal: z.string().optional(),
   cnf: z.object({ jwk: JWK }),
+  exp: UnixTime,
+  iat: UnixTime,
+  iss: z.string(),
   sub: z.string(),
   /** @deprecated */
   wallet_link: z.string().optional(),
   /** @deprecated */
   wallet_name: z.string().optional(),
-  /** @deprecated */
-  aal: z.string().optional(),
 });
 
-export type WalletAttestation = {
-  format: string;
+export interface WalletAttestation {
   attestation: string;
-};
+  format: string;
+}
 
-export type WalletAttestationRequestParams = {
+export interface WalletAttestationRequestParams {
   walletProviderBaseUrl: string;
   walletSolutionId: string;
   walletSolutionVersion: string;
-};
+}