@pagopa/io-react-native-wallet 3.6.3 → 3.6.4

package/src/index.ts

@@ -1,54 +1,54 @@
 import type { AuthorizationContext } from "./utils/auth";
-import { fixBase64EncodingOnKey } from "./utils/jwk";
+import type { IntegrityContext } from "./utils/integrity";
 // polyfill due to known bugs on URL implementation for react native
 // https://github.com/facebook/react-native/issues/24428
 import "react-native-url-polyfill/auto";
 
-import * as Trust from "./trust";
-import * as CredentialsCatalogue from "./credentials-catalogue";
 import * as CredentialIssuance from "./credential/issuance";
 import * as CredentialOffer from "./credential/offer";
-import * as CredentialStatus from "./credential/status";
 import * as RemotePresentation from "./credential/presentation";
+import * as CredentialStatus from "./credential/status";
 import * as Trustmark from "./credential/trustmark";
-import * as SdJwt from "./sd-jwt";
+import * as CredentialsCatalogue from "./credentials-catalogue";
 import * as Mdoc from "./mdoc";
-import * as Errors from "./utils/errors";
-import * as WalletInstanceAttestation from "./wallet-instance-attestation";
-import * as WalletUnitAttestation from "./wallet-unit-attestation";
-import * as WalletInstance from "./wallet-instance";
-import * as Logging from "./utils/logging";
-import { AuthorizationDetail, AuthorizationDetails } from "./utils/par";
+import * as SdJwt from "./sd-jwt";
+import * as Trust from "./trust";
 import {
   createCryptoContextFor,
   type KeyAttestationCryptoContext,
 } from "./utils/crypto";
-import type { IntegrityContext } from "./utils/integrity";
+import * as Errors from "./utils/errors";
+import { fixBase64EncodingOnKey } from "./utils/jwk";
+import * as Logging from "./utils/logging";
+import { AuthorizationDetail, AuthorizationDetails } from "./utils/par";
+import * as WalletInstance from "./wallet-instance";
+import * as WalletInstanceAttestation from "./wallet-instance-attestation";
+import * as WalletUnitAttestation from "./wallet-unit-attestation";
 
 export {
-  Trust,
+  AuthorizationDetail,
+  AuthorizationDetails,
+  createCryptoContextFor,
   CredentialIssuance,
   CredentialOffer,
   CredentialsCatalogue,
   CredentialStatus,
+  Errors,
+  fixBase64EncodingOnKey,
+  Logging,
+  Mdoc,
   RemotePresentation,
   SdJwt,
-  Mdoc,
+  Trust,
+  Trustmark,
+  WalletInstance,
   WalletInstanceAttestation,
   WalletUnitAttestation,
-  WalletInstance,
-  Trustmark,
-  Errors,
-  createCryptoContextFor,
-  AuthorizationDetail,
-  AuthorizationDetails,
-  fixBase64EncodingOnKey,
-  Logging,
 };
 
 export type {
-  IntegrityContext,
   AuthorizationContext,
+  IntegrityContext,
   KeyAttestationCryptoContext,
 };
 

package/src/mdoc/index.ts

@@ -1,17 +1,19 @@
+import { type PublicKey } from "@pagopa/io-react-native-crypto";
 import { CBOR, COSE, ISO18013_7 } from "@pagopa/io-react-native-iso18013";
+import { removePadding } from "@pagopa/io-react-native-jwt";
 import { b64utob64 } from "jsrsasign";
-import { type PublicKey } from "@pagopa/io-react-native-crypto";
+
+import type { Presentation } from "../credential/presentation";
+
 import { MissingX509CertsError } from "../trust/common/errors";
-import { IoWalletError } from "../utils/errors";
 import { convertBase64DerToPem, getSigninJwkFromCert } from "../utils/crypto";
-import type { Presentation } from "../credential/presentation";
-import { removePadding } from "@pagopa/io-react-native-jwt";
+import { IoWalletError } from "../utils/errors";
 import { verifyX509Chain } from "../utils/x509";
 export * from "./utils";
 
 export const verify = async (
   token: string,
-  x509CertRoot: string
+  x509CertRoot: string,
 ): Promise<{ issuerSigned: CBOR.IssuerSigned }> => {
   // get decoded data
   const issuerSigned = await CBOR.decodeIssuerSigned(token);
@@ -37,8 +39,15 @@ export const verify = async (
   if (!coseSign1) {
     throw new IoWalletError("Missing coseSign1");
   }
+
+  const firstCert = x5chain[0];
+
+  if (!firstCert) {
+    throw new IoWalletError("x5chain is empty, cannot verify signature");
+  }
+
   // Once the x5chain is verified, the signatures verification can be performed
-  await verifyMdocSignature(coseSign1, x5chain[0]!);
+  await verifyMdocSignature(coseSign1, firstCert);
 
   return { issuerSigned };
 };
@@ -54,8 +63,14 @@ const verifyMdocSignature = async (coseSign1: string, cert: string) => {
   const pemcert = convertBase64DerToPem(cert);
   const jwk = getSigninJwkFromCert(pemcert);
 
-  jwk.x = b64utob64(jwk.x!);
-  jwk.y = b64utob64(jwk.y!);
+  if (!jwk.x || !jwk.y) {
+    throw new IoWalletError(
+      "Missing x or y coordinate in the certificate's public key",
+    );
+  }
+
+  jwk.x = b64utob64(jwk.x);
+  jwk.y = b64utob64(jwk.y);
 
   const signatureCorrect = await COSE.verify(coseSign1, jwk as PublicKey);
 
@@ -69,16 +84,16 @@ export const prepareVpTokenMdoc = async (
   responseUri: string,
   docType: string,
   keyTag: string,
-  [verifiableCredential, presentationFrame]: Presentation
+  [verifiableCredential, presentationFrame]: Presentation,
 ): Promise<{
   vp_token: string;
 }> => {
   /* verifiableCredential is a IssuerSigned structure */
   const documents = [
     {
-      issuerSignedContent: b64utob64(verifiableCredential),
       alias: keyTag,
       docType,
+      issuerSignedContent: b64utob64(verifiableCredential),
     },
   ];
 
@@ -90,7 +105,7 @@ export const prepareVpTokenMdoc = async (
     requestNonce,
     generatedNonce,
     documents,
-    presentationFrame as ISO18013_7.AcceptedFields
+    presentationFrame as ISO18013_7.AcceptedFields,
   );
 
   return {

package/src/mdoc/utils.ts

@@ -1,7 +1,9 @@
 import { CBOR } from "@pagopa/io-react-native-iso18013";
-import { Verification } from "../sd-jwt/types";
+
 import type { IssuanceApi } from "../credential/issuance";
 import type { Out } from "../utils/misc";
+
+import { Verification } from "../sd-jwt/types";
 import { MDOC_VERIFICATION_IDENTIFIER } from "./const";
 
 /**
@@ -23,10 +25,10 @@ export const getParsedCredentialClaimKey = (namespace: string, key: string) =>
 export const getVerificationFromParsedCredential = (
   parsedCredential: Out<
     IssuanceApi["verifyAndParseCredential"]
-  >["parsedCredential"]
+  >["parsedCredential"],
 ) => {
   const verificationKey = Object.keys(parsedCredential).find((key) =>
-    key.endsWith(MDOC_VERIFICATION_IDENTIFIER)
+    key.endsWith(MDOC_VERIFICATION_IDENTIFIER),
   );
   const verification = verificationKey
     ? parsedCredential[verificationKey]?.value
@@ -48,7 +50,7 @@ export const getVerification = async (token: string) => {
   const flattenedClaims = Object.values(issuerSigned.nameSpaces).flat();
 
   const verification = flattenedClaims?.find(
-    (x) => x.elementIdentifier === MDOC_VERIFICATION_IDENTIFIER
+    (x) => x.elementIdentifier === MDOC_VERIFICATION_IDENTIFIER,
   )?.elementValue;
 
   return verification ? Verification.parse(verification) : undefined;

package/src/sd-jwt/__test__/types.test.ts

@@ -7,20 +7,20 @@ describe("Verification.time", () => {
     ["unix milliseconds", 1752122400000],
   ])("accepts %s", (_label, time) => {
     const value = {
-      trust_framework: "eidas",
       assurance_level: "high",
       evidence: [
         {
-          type: "vouch",
-          time,
           attestation: {
-            type: "digital_attestation",
-            reference_number: "abc",
             date_of_issuance: "2025-09-02",
+            reference_number: "abc",
+            type: "digital_attestation",
             voucher: { organization: "IPZS" },
           },
+          time,
+          type: "vouch",
         },
       ],
+      trust_framework: "eidas",
     };
 
     expect(Verification.safeParse(value).success).toBe(true);
@@ -28,8 +28,8 @@ describe("Verification.time", () => {
 
   it("rejects invalid type", () => {
     const value = {
-      trust_framework: ["eidas"],
       assurance_level: "high",
+      trust_framework: ["eidas"],
     };
 
     expect(Verification.safeParse(value).success).toBe(false);

package/src/sd-jwt/__test__/utils.test.ts

@@ -1,11 +1,11 @@
-import { legacyPid, pid } from "../__mocks__/sd-jwt";
 import { getVerification } from "..";
+import { legacyPid, pid } from "../__fixtures__/sd-jwt";
 
 describe("SD-JWT getVerification", () => {
   it("extracts the verification claims correctly", () => {
     expect(getVerification(pid)).toEqual({
-      trust_framework: "it_cie",
       assurance_level: "high",
+      trust_framework: "it_cie",
     });
   });
 

package/src/sd-jwt/index.ts

@@ -1,9 +1,11 @@
 import { sha256ToBase64, SignJWT } from "@pagopa/io-react-native-jwt";
+import { digest } from "@sd-jwt/crypto-nodejs";
 import { decodeSdJwtSync } from "@sd-jwt/decode";
 import { present } from "@sd-jwt/present";
-import { digest } from "@sd-jwt/crypto-nodejs";
-import { fixLegacyCredentialSdJwt } from "../utils/credentials";
+
 import type { Presentation } from "../credential/presentation";
+
+import { fixLegacyCredentialSdJwt } from "../utils/credentials";
 import { SdJwt4VCBase } from "./types";
 
 export * from "./utils";
@@ -25,10 +27,10 @@ export const decode = (token: string) => {
     payload: decoded.jwt.payload,
   });
   const disclosures = decoded.disclosures.map((disclosure) => ({
-    encoded: disclosure._digest,
     decoded: [disclosure.salt, disclosure.key, disclosure.value],
+    encoded: disclosure._digest,
   }));
-  return { sdJwt, disclosures };
+  return { disclosures, sdJwt };
 };
 
 /**
@@ -49,7 +51,7 @@ export const decode = (token: string) => {
 export const prepareVpToken = async (
   nonce: string,
   client_id: string,
-  [verifiableCredential, presentationFrame, cryptoContext]: Presentation
+  [verifiableCredential, presentationFrame, cryptoContext]: Presentation,
 ): Promise<{
   vp_token: string;
 }> => {
@@ -57,7 +59,7 @@ export const prepareVpToken = async (
   const vp = await present(
     fixLegacyCredentialSdJwt(verifiableCredential),
     presentationFrame,
-    digest
+    digest,
   );
 
   // <Issuer-signed JWT>~<Disclosure 1>~<Disclosure N>~
@@ -65,12 +67,12 @@ export const prepareVpToken = async (
 
   const kbJwt = await new SignJWT(cryptoContext)
     .setProtectedHeader({
-      typ: "kb+jwt",
       alg: "ES256",
+      typ: "kb+jwt",
     })
     .setPayload({
-      sd_hash,
       nonce: nonce,
+      sd_hash,
     })
     .setAudience(client_id)
     .setIssuedAt()

package/src/sd-jwt/types.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
-import { UnixTime } from "../utils/zod";
+
 import { JWK } from "../utils/jwk";
+import { UnixTime } from "../utils/zod";
 
 /**
  * For backward compatibility reasons it is still necessary to support the legacy SD-JWT
@@ -25,23 +26,22 @@ const StatusList = z.object({
 export type SdJwt4VCBase = z.infer<typeof SdJwt4VCBase>;
 export const SdJwt4VCBase = z.object({
   header: z.object({
-    typ: z.enum(["dc+sd-jwt", LEGACY_SD_JWT]),
     alg: z.string(),
     kid: z.string(),
     trust_chain: z.array(z.string()).optional(),
-    x5c: z.array(z.string()).optional(),
+    typ: z.enum(["dc+sd-jwt", LEGACY_SD_JWT]),
     vctm: z.array(z.string()).optional(),
+    x5c: z.array(z.string()).optional(),
   }),
   payload: z.object({
     _sd: z.array(z.string()),
     _sd_alg: z.literal("sha-256"),
-    iss: z.string(),
-    sub: z.string(),
-    iat: UnixTime.optional(),
-    exp: UnixTime,
     cnf: z.object({
       jwk: JWK,
     }),
+    exp: UnixTime,
+    iat: UnixTime.optional(),
+    iss: z.string(),
     status: z.union([
       z.object({
         status_list: StatusList,
@@ -51,6 +51,7 @@ export const SdJwt4VCBase = z.object({
         status_assertion: StatusAssertion,
       }),
     ]),
+    sub: z.string(),
     vct: z.string(),
     "vct#integrity": z.string().optional(),
   }),
@@ -62,8 +63,8 @@ export const SdJwt4VCBase = z.object({
  */
 export type Verification = z.infer<typeof Verification>;
 export const Verification = z.object({
-  trust_framework: z.string(),
   assurance_level: z.string(),
+  trust_framework: z.string(),
 });
 
 /**
@@ -73,16 +74,16 @@ export const Verification = z.object({
  */
 export type TypeMetadata = z.infer<typeof TypeMetadata>;
 export const TypeMetadata = z.object({
-  name: z.string(),
-  description: z.string(),
   data_source: z.object({
-    trust_framework: z.string(),
     authentic_source: z.object({
-      organization_name: z.string(),
-      organization_code: z.string(),
       contacts: z.array(z.string()),
       homepage_uri: z.string().url(),
       logo_uri: z.string().url(),
+      organization_code: z.string(),
+      organization_name: z.string(),
     }),
+    trust_framework: z.string(),
   }),
+  description: z.string(),
+  name: z.string(),
 });

package/src/sd-jwt/utils.ts

@@ -1,14 +1,15 @@
 import { sha256ToBase64 } from "@pagopa/io-react-native-jwt";
-import { decodeSdJwtSync, getClaimsSync } from "@sd-jwt/decode";
 import { digest } from "@sd-jwt/crypto-nodejs";
-import { hasStatusOrThrow } from "../utils/misc";
-import { TypeMetadata, Verification } from "./types";
+import { decodeSdJwtSync, getClaimsSync } from "@sd-jwt/decode";
+
+import { fixLegacyCredentialSdJwt } from "../utils/credentials";
 import {
   IoWalletError,
   IssuerResponseError,
   ValidationFailed,
 } from "../utils/errors";
-import { fixLegacyCredentialSdJwt } from "../utils/credentials";
+import { hasStatusOrThrow } from "../utils/misc";
+import { TypeMetadata, Verification } from "./types";
 
 /**
  * Retrieve the Type Metadata for a credential and verify its integrity.
@@ -22,7 +23,7 @@ export const fetchTypeMetadata = async (
   vctIntegrity: string,
   context: {
     appFetch?: GlobalFetch["fetch"];
-  } = {}
+  } = {},
 ): Promise<TypeMetadata> => {
   const { appFetch = fetch } = context;
   const { origin, pathname } = new URL(vct);
@@ -61,17 +62,17 @@ export const fetchTypeMetadata = async (
  * @returns The verification claim or undefined if it wasn't found
  */
 export const getVerification = (
-  credentialSdJwt: string
-): Verification | undefined => {
+  credentialSdJwt: string,
+): undefined | Verification => {
   const decoded = decodeSdJwtSync(
     fixLegacyCredentialSdJwt(credentialSdJwt),
-    digest
+    digest,
   );
 
   const claims = getClaimsSync<Record<string, unknown>>(
     decoded.jwt.payload,
     decoded.disclosures,
-    digest
+    digest,
   );
 
   return claims.verification

package/src/trust/api/TrustAnchorConfig.ts

@@ -1,4 +1,5 @@
 import * as z from "zod";
+
 import { JWK } from "../../utils/jwk";
 import { FederationEntityMetadata } from "../common/types";
 
@@ -8,13 +9,13 @@ import { FederationEntityMetadata } from "../common/types";
  */
 export type TrustAnchorConfig = z.infer<typeof TrustAnchorConfig>;
 export const TrustAnchorConfig = z.object({
+  federation_entity: FederationEntityMetadata,
   jwt: z.object({
     header: z.object({
-      typ: z.literal("entity-statement+jwt"),
       alg: z.string(),
       kid: z.string(),
+      typ: z.literal("entity-statement+jwt"),
     }),
   }),
   keys: z.array(JWK),
-  federation_entity: FederationEntityMetadata,
 });

package/src/trust/api/index.ts

@@ -1,21 +1,9 @@
 import { type X509CertificateOptions } from "@pagopa/io-react-native-crypto";
-import type { TrustAnchorConfig } from "./TrustAnchorConfig";
-import type { ParsedToken } from "../common/utils";
 
-type FetchContext = { appFetch?: GlobalFetch["fetch"] };
+import type { ParsedToken } from "../common/utils";
+import type { TrustAnchorConfig } from "./TrustAnchorConfig";
 
 export interface TrustApi {
-  /**
-   * Get the common Trust Anchor Configuration, which is uniform across versions.
-   *
-   * @param trustAnchorBaseUrl The Trust Anchor base URL
-   * @returns The Trust Anchor Configuration object
-   */
-  getTrustAnchorEntityConfiguration(
-    trustAnchorBaseUrl: string,
-    ctx?: FetchContext
-  ): Promise<TrustAnchorConfig>;
-
   /**
    * Build a not-verified trust chain for a given Relying Party (RP) entity.
    *
@@ -28,9 +16,20 @@ export interface TrustApi {
   buildTrustChain(
     relyingPartyEntityBaseUrl: string,
     trustAnchorConfig: TrustAnchorConfig,
-    appFetch?: GlobalFetch["fetch"]
+    appFetch?: GlobalFetch["fetch"],
   ): Promise<string[]>;
 
+  /**
+   * Get the common Trust Anchor Configuration, which is uniform across versions.
+   *
+   * @param trustAnchorBaseUrl The Trust Anchor base URL
+   * @returns The Trust Anchor Configuration object
+   */
+  getTrustAnchorEntityConfiguration(
+    trustAnchorBaseUrl: string,
+    ctx?: FetchContext,
+  ): Promise<TrustAnchorConfig>;
+
   /**
    * Verify a given trust chain is actually valid.
    * It can handle fast chain renewal, which means we try to fetch a fresh version of each statement.
@@ -50,8 +49,12 @@ export interface TrustApi {
     ctx?: {
       appFetch?: GlobalFetch["fetch"];
       renewOnFail?: boolean;
-    }
+    },
   ): Promise<ParsedToken[]>;
 }
 
+interface FetchContext {
+  appFetch?: GlobalFetch["fetch"];
+}
+
 export { type TrustAnchorConfig };

package/src/trust/common/build-chain.ts

@@ -1,3 +1,8 @@
+import { z } from "zod";
+
+import type { TrustApi } from "../api";
+import type { BaseEntityConfiguration, EntityStatement } from "./types";
+
 import {
   BuildTrustChainError,
   MissingFederationFetchEndpointError,
@@ -11,14 +16,11 @@ import {
   getSignedEntityStatement,
   verify,
 } from "./utils";
-import { z } from "zod";
-import type { TrustApi } from "../api";
-import type { BaseEntityConfiguration, EntityStatement } from "./types";
 
-type BuilderConfig = {
-  EntityStatementShape: z.ZodType<EntityStatement>;
+interface BuilderConfig {
   EntityConfigurationShape: z.ZodType<BaseEntityConfiguration>;
-};
+  EntityStatementShape: z.ZodType<EntityStatement>;
+}
 
 /**
  * Factory function to create `buildTrustChain`.
@@ -26,12 +28,12 @@ type BuilderConfig = {
  * @returns `buildTrustChain` function compliant with the public API
  */
 export function createBuildTrustChain(
-  config: BuilderConfig
+  config: BuilderConfig,
 ): TrustApi["buildTrustChain"] {
   return async function buildTrustChain(
     relyingPartyEntityBaseUrl,
     trustAnchorConfig,
-    appFetch = fetch
+    appFetch = fetch,
   ) {
     // 1: Verify if the RP is authorized by the Trust Anchor's federation list
     // Extract the Trust Anchor's signing key and federation_list_endpoint
@@ -40,7 +42,7 @@ export function createBuildTrustChain(
 
     if (!trustAnchorKey) {
       throw new BuildTrustChainError(
-        "Cannot verify trust anchor: missing signing key in entity configuration."
+        "Cannot verify trust anchor: missing signing key in entity configuration.",
       );
     }
 
@@ -55,7 +57,10 @@ export function createBuildTrustChain(
       if (!federationList.includes(relyingPartyEntityBaseUrl)) {
         throw new RelyingPartyNotAuthorizedError(
           "Relying Party entity base URL is not authorized by the Trust Anchor's federation list.",
-          { relyingPartyUrl: relyingPartyEntityBaseUrl, federationListEndpoint }
+          {
+            federationListEndpoint,
+            relyingPartyUrl: relyingPartyEntityBaseUrl,
+          },
         );
       }
     }
@@ -65,14 +70,14 @@ export function createBuildTrustChain(
     // 1: Recursively gather the trust chain from the RP up to the Trust Anchor
     const trustChain = await gatherTrustChain(
       relyingPartyEntityBaseUrl,
-      appFetch
+      appFetch,
     );
     // 2: Trust Anchor signature verification
     const chainTrustAnchorJwt = trustChain[trustChain.length - 1];
     if (!chainTrustAnchorJwt) {
       throw new BuildTrustChainError(
         "Cannot verify trust anchor: missing entity configuration in gathered chain.",
-        { relyingPartyUrl: relyingPartyEntityBaseUrl }
+        { relyingPartyUrl: relyingPartyEntityBaseUrl },
       );
     }
 
@@ -98,7 +103,7 @@ export function createGatherTrustChain({
   return async function gatherTrustChain(
     entityBaseUrl: string,
     appFetch: GlobalFetch["fetch"],
-    isLeaf: boolean = true
+    isLeaf = true,
   ): Promise<string[]> {
     const chain: string[] = [];
 
@@ -121,12 +126,17 @@ export function createGatherTrustChain({
       }
       return chain;
     }
-    const parentEntityBaseUrl = authorityHints[0]!;
+
+    const parentEntityBaseUrl = authorityHints[0];
+
+    if (!parentEntityBaseUrl) {
+      throw new Error("AuthorityHints array is empty.");
+    }
 
     // Fetch parent EC
     const parentECJwt = await getSignedEntityConfiguration(
       parentEntityBaseUrl,
-      { appFetch }
+      { appFetch },
     );
     const parentEC = EntityConfigurationShape.parse(decode(parentECJwt));
     // Fetch ES
@@ -135,13 +145,13 @@ export function createGatherTrustChain({
     if (!federationFetchEndpoint) {
       throw new MissingFederationFetchEndpointError(
         `Missing federation_fetch_endpoint in parent's (${parentEntityBaseUrl}) configuration when gathering chain for ${entityBaseUrl}.`,
-        { entityBaseUrl, missingInEntityUrl: parentEntityBaseUrl }
+        { entityBaseUrl, missingInEntityUrl: parentEntityBaseUrl },
       );
     }
     const entityStatementJwt = await getSignedEntityStatement(
       federationFetchEndpoint,
       entityBaseUrl,
-      { appFetch }
+      { appFetch },
     );
     // Validate the ES
     EntityStatementShape.parse(decode(entityStatementJwt));
@@ -153,7 +163,7 @@ export function createGatherTrustChain({
     const parentChain = await gatherTrustChain(
       parentEntityBaseUrl,
       appFetch,
-      false
+      false,
     );
 
     return chain.concat(parentChain);