@pagopa/io-react-native-wallet 3.6.3 → 3.6.4

package/src/trust/common/errors.ts

@@ -1,6 +1,7 @@
-import { IoWalletError, serializeAttrs } from "../../utils/errors";
 import type { CertificateValidationStatus } from "@pagopa/io-react-native-crypto"; // Ensure this path is correct
 
+import { IoWalletError, serializeAttrs } from "../../utils/errors";
+
 /**
  * Base class for all federation-specific errors.
  */
@@ -14,58 +15,64 @@ export class FederationError extends IoWalletError {
 }
 
 /**
- * Error thrown when a trust chain is unexpectedly empty.
+ * General error thrown during the trust chain building process.
  */
-export class TrustChainEmptyError extends FederationError {
-  code = "ERR_FED_TRUST_CHAIN_EMPTY";
-  constructor(message = "Trust chain cannot be empty.") {
-    super(message, undefined);
+export class BuildTrustChainError extends FederationError {
+  code = "ERR_FED_BUILD_TRUST_CHAIN_FAILED";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
+  constructor(
+    message: string,
+    details?: {
+      [key: string]: unknown;
+      relyingPartyUrl?: string;
+      trustAnchorKid?: string;
+    },
+  ) {
+    super(message, details);
   }
 }
 
-/**
- * Error thrown when a token is unexpectedly missing from a trust chain during processing.
- */
-export class TrustChainTokenMissingError extends FederationError {
-  code = "ERR_FED_TRUST_CHAIN_TOKEN_MISSING";
-  constructor(message: string, details?: { index?: number }) {
+export class FederationListParseError extends FederationError {
+  code = "ERR_FED_FEDERATION_LIST_PARSE_FAILED";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
+  constructor(message: string, details: { parseError?: string; url: string }) {
     super(message, details);
   }
 }
 
 /**
- * Error thrown when renewing a trust chain fails.
- * This class itself might be used or could be considered a more general renewal error.
+ * Error thrown when a 'federation_fetch_endpoint' is missing in an entity's configuration.
  */
-export class TrustChainRenewalError extends FederationError {
-  code = "ERR_FED_TRUST_CHAIN_RENEWAL_FAILED";
+export class MissingFederationFetchEndpointError extends FederationError {
+  code = "ERR_FED_MISSING_FEDERATION_FETCH_ENDPOINT";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
   constructor(
     message: string,
-    details?: { originalChain?: string[]; [key: string]: unknown }
+    details: { entityBaseUrl: string; missingInEntityUrl: string },
   ) {
     super(message, details);
   }
 }
 
-export class FederationListParseError extends FederationError {
-  code = "ERR_FED_FEDERATION_LIST_PARSE_FAILED";
-  constructor(message: string, details: { url: string; parseError?: string }) {
-    super(message, details);
+/**
+ * Error thrown when the X.509 certificate chain is missing in an entity's configuration.
+ */
+export class MissingX509CertsError extends FederationError {
+  code = "ERR_FED_MISSING_X509_CERTS";
+  constructor(message: string) {
+    super(message, undefined);
   }
 }
 
 /**
- * General error thrown during the trust chain building process.
+ * Error thrown if the Relying Party is not found in the Trust Anchor's federation list.
  */
-export class BuildTrustChainError extends FederationError {
-  code = "ERR_FED_BUILD_TRUST_CHAIN_FAILED";
+export class RelyingPartyNotAuthorizedError extends FederationError {
+  code = "ERR_FED_RELYING_PARTY_NOT_AUTHORIZED";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
   constructor(
     message: string,
-    details?: {
-      relyingPartyUrl?: string;
-      trustAnchorKid?: string;
-      [key: string]: unknown;
-    }
+    details: { federationListEndpoint?: string; relyingPartyUrl: string },
   ) {
     super(message, details);
   }
@@ -82,38 +89,38 @@ export class TrustAnchorKidMissingError extends FederationError {
 }
 
 /**
- * Error thrown if the Relying Party is not found in the Trust Anchor's federation list.
+ * Error thrown when a trust chain is unexpectedly empty.
  */
-export class RelyingPartyNotAuthorizedError extends FederationError {
-  code = "ERR_FED_RELYING_PARTY_NOT_AUTHORIZED";
-  constructor(
-    message: string,
-    details: { relyingPartyUrl: string; federationListEndpoint?: string }
-  ) {
-    super(message, details);
+export class TrustChainEmptyError extends FederationError {
+  code = "ERR_FED_TRUST_CHAIN_EMPTY";
+  constructor(message = "Trust chain cannot be empty.") {
+    super(message, undefined);
   }
 }
 
 /**
- * Error thrown when a 'federation_fetch_endpoint' is missing in an entity's configuration.
+ * Error thrown when renewing a trust chain fails.
+ * This class itself might be used or could be considered a more general renewal error.
  */
-export class MissingFederationFetchEndpointError extends FederationError {
-  code = "ERR_FED_MISSING_FEDERATION_FETCH_ENDPOINT";
+export class TrustChainRenewalError extends FederationError {
+  code = "ERR_FED_TRUST_CHAIN_RENEWAL_FAILED";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
   constructor(
     message: string,
-    details: { entityBaseUrl: string; missingInEntityUrl: string }
+    details?: { [key: string]: unknown; originalChain?: string[] },
   ) {
     super(message, details);
   }
 }
 
 /**
- * Error thrown when the X.509 certificate chain is missing in an entity's configuration.
+ * Error thrown when a token is unexpectedly missing from a trust chain during processing.
  */
-export class MissingX509CertsError extends FederationError {
-  code = "ERR_FED_MISSING_X509_CERTS";
-  constructor(message: string) {
-    super(message, undefined);
+export class TrustChainTokenMissingError extends FederationError {
+  code = "ERR_FED_TRUST_CHAIN_TOKEN_MISSING";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
+  constructor(message: string, details?: { index?: number }) {
+    super(message, details);
   }
 }
 
@@ -123,15 +130,16 @@ export class MissingX509CertsError extends FederationError {
  */
 export class X509ValidationError extends FederationError {
   code = "ERR_FED_X509_VALIDATION_FAILED";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
   constructor(
     message: string,
     details?: {
-      tokenIndex?: number;
+      [key: string]: unknown;
       kid?: string;
-      x509ValidationStatus?: CertificateValidationStatus;
+      tokenIndex?: number;
       x509ErrorMessage?: string;
-      [key: string]: unknown;
-    }
+      x509ValidationStatus?: CertificateValidationStatus;
+    },
   ) {
     super(message, details);
   }

package/src/trust/common/types.ts

@@ -1,24 +1,25 @@
 import * as z from "zod";
+
 import { JWK } from "../../utils/jwk";
 import { UnixTime } from "../../utils/zod";
 
 export const TrustMark = z.object({ id: z.string(), trust_mark: z.string() });
-export type TrustMark = z.infer<typeof TrustMark>;
-
 export type EntityStatement = z.infer<typeof EntityStatement>;
+
+export type TrustMark = z.infer<typeof TrustMark>;
 export const EntityStatement = z.object({
   header: z.object({
-    typ: z.literal("entity-statement+jwt"),
     alg: z.string(),
     kid: z.string(),
+    typ: z.literal("entity-statement+jwt"),
   }),
   payload: z.object({
+    exp: z.number(),
+    iat: z.number(),
     iss: z.string(),
-    sub: z.string(),
     jwks: z.object({ keys: z.array(JWK) }),
+    sub: z.string(),
     trust_marks: z.array(TrustMark).optional(),
-    iat: z.number(),
-    exp: z.number(),
   }),
 });
 
@@ -26,9 +27,9 @@ export type EntityConfigurationHeader = z.infer<
   typeof EntityConfigurationHeader
 >;
 export const EntityConfigurationHeader = z.object({
-  typ: z.literal("entity-statement+jwt"),
   alg: z.string(),
   kid: z.string(),
+  typ: z.literal("entity-statement+jwt"),
 });
 
 /**
@@ -36,19 +37,19 @@ export const EntityConfigurationHeader = z.object({
  */
 export const FederationEntityMetadata = z
   .object({
+    contacts: z.array(z.string()).optional(),
+    endpoint_auth_signing_alg_values_supported: z.string().optional(),
     federation_fetch_endpoint: z.string().optional(),
+    federation_historical_keys_endpoint: z.string().optional(),
     federation_list_endpoint: z.string().optional(),
     federation_resolve_endpoint: z.string().optional(),
-    federation_trust_mark_status_endpoint: z.string().optional(),
-    federation_trust_mark_list_endpoint: z.string().optional(),
     federation_trust_mark_endpoint: z.string().optional(),
-    federation_historical_keys_endpoint: z.string().optional(),
-    endpoint_auth_signing_alg_values_supported: z.string().optional(),
-    organization_name: z.string().optional(),
+    federation_trust_mark_list_endpoint: z.string().optional(),
+    federation_trust_mark_status_endpoint: z.string().optional(),
     homepage_uri: z.string().optional(),
-    policy_uri: z.string().optional(),
     logo_uri: z.string().optional(),
-    contacts: z.array(z.string()).optional(),
+    organization_name: z.string().optional(),
+    policy_uri: z.string().optional(),
   })
   .loose();
 
@@ -58,19 +59,19 @@ export const BaseEntityConfiguration = z.object({
   header: EntityConfigurationHeader,
   payload: z
     .object({
-      iss: z.string(),
-      sub: z.string(),
-      iat: UnixTime,
-      exp: UnixTime,
       authority_hints: z.array(z.string()).optional(),
+      exp: UnixTime,
+      iat: UnixTime,
+      iss: z.string(),
+      jwks: z.object({
+        keys: z.array(JWK),
+      }),
       metadata: z
         .object({
           federation_entity: FederationEntityMetadata,
         })
         .loose(),
-      jwks: z.object({
-        keys: z.array(JWK),
-      }),
+      sub: z.string(),
     })
     .loose(),
 });

package/src/trust/common/utils.ts

@@ -3,33 +3,34 @@ import {
   verify as verifyJwt,
 } from "@pagopa/io-react-native-jwt";
 
-import { hasStatusOrThrow } from "../../utils/misc";
 import type { JWK, JWTDecodeResult } from "../../utils/jwk";
-import { FederationError, FederationListParseError } from "./errors";
 import type { TrustAnchorConfig } from "../api/TrustAnchorConfig";
+
+import { hasStatusOrThrow } from "../../utils/misc";
+import { FederationError, FederationListParseError } from "./errors";
 import { FederationListResponse } from "./types";
 
-export type FetchOptions = {
+export interface FetchOptions {
   appFetch?: GlobalFetch["fetch"];
-};
+}
 
-export type ParsedToken = {
+export interface ParsedToken {
   header: JWTDecodeResult["protectedHeader"];
   payload: JWTDecodeResult["payload"];
-};
+}
 
 // Verify a token signature
 // The kid is extracted from the token header
 export const verify = async (
   token: string,
   kid: string,
-  jwks: JWK[]
+  jwks: JWK[],
 ): Promise<ParsedToken> => {
   const jwk = jwks.find((k) => k.kid === kid);
   if (!jwk) {
     throw new Error(`Invalid kid: ${kid}, token: ${token}`);
   }
-  const { protectedHeader: header, payload } = await verifyJwt(token, jwk);
+  const { payload, protectedHeader: header } = await verifyJwt(token, jwk);
   return { header, payload };
 };
 
@@ -38,41 +39,38 @@ export const verify = async (
  * It seems like typescript can't correctly infer the return type of the function.
  */
 export const decode = (token: string): ParsedToken => {
-  const { protectedHeader: header, payload } = decodeJwt(token);
+  const { payload, protectedHeader: header } = decodeJwt(token);
   return { header, payload };
 };
 
 /**
- * Extracts the X.509 Trust Anchor certificate (Base64 encoded) from the
- * Trust Anchor's Entity Configuration.
+ * Fetch the federation list document from a given endpoint.
  *
- * @param trustAnchorEntity The entity configuration of the known trust anchor.
- * @returns The Base64 encoded X.509 certificate string.
- * @throws {FederationError} If the certificate cannot be derived.
+ * @param federationListEndpoint The URL of the federation list endpoint.
+ * @param appFetch An optional instance of the http client to be used.
+ * @returns The federation list as an array of strings.
+ * @throws {IoWalletError} If the HTTP request fails.
+ * @throws {FederationError} If the result is not in the expected format.
  */
-export function getTrustAnchorX509Certificate(
-  trustAnchorEntity: TrustAnchorConfig
-): string {
-  const taHeaderKid = trustAnchorEntity.jwt.header.kid;
-  const taSigningJwk = trustAnchorEntity.keys.find(
-    (key) => key.kid === taHeaderKid
-  );
-
-  if (!taSigningJwk) {
-    throw new FederationError(
-      `Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' not found in Trust Anchor's JWKS.`,
-      { trustAnchorKid: taHeaderKid, reason: "JWK not found for header kid" }
-    );
-  }
-
-  if (taSigningJwk.x5c && taSigningJwk.x5c.length > 0 && taSigningJwk.x5c[0]) {
-    return taSigningJwk.x5c[0];
-  }
-
-  throw new FederationError(
-    `Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' does not contain a valid 'x5c' certificate array.`,
-    { trustAnchorKid: taHeaderKid, reason: "Missing or empty x5c in JWK" }
-  );
+export async function getFederationList(
+  federationListEndpoint: string,
+  { appFetch = fetch }: FetchOptions = {},
+): Promise<string[]> {
+  return await appFetch(federationListEndpoint, {
+    method: "GET",
+  })
+    .then(hasStatusOrThrow(200))
+    .then((res) => res.json())
+    .then((json) => {
+      const result = FederationListResponse.safeParse(json);
+      if (!result.success) {
+        throw new FederationListParseError(
+          `Invalid federation list format received from ${federationListEndpoint}. Error: ${result.error.message}`,
+          { parseError: result.error.toString(), url: federationListEndpoint },
+        );
+      }
+      return result.data;
+    });
 }
 
 /**
@@ -84,7 +82,7 @@ export function getTrustAnchorX509Certificate(
  */
 export async function getSignedEntityConfiguration(
   entityBaseUrl: string,
-  { appFetch = fetch }: FetchOptions = {}
+  { appFetch = fetch }: FetchOptions = {},
 ): Promise<string> {
   const wellKnownUrl = `${entityBaseUrl}/.well-known/openid-federation`;
 
@@ -107,7 +105,7 @@ export async function getSignedEntityConfiguration(
 export async function getSignedEntityStatement(
   federationFetchEndpoint: string,
   subordinatedEntityBaseUrl: string,
-  { appFetch = fetch }: FetchOptions = {}
+  { appFetch = fetch }: FetchOptions = {},
 ) {
   const url = new URL(federationFetchEndpoint);
   url.searchParams.set("sub", subordinatedEntityBaseUrl);
@@ -120,31 +118,34 @@ export async function getSignedEntityStatement(
 }
 
 /**
- * Fetch the federation list document from a given endpoint.
+ * Extracts the X.509 Trust Anchor certificate (Base64 encoded) from the
+ * Trust Anchor's Entity Configuration.
  *
- * @param federationListEndpoint The URL of the federation list endpoint.
- * @param appFetch An optional instance of the http client to be used.
- * @returns The federation list as an array of strings.
- * @throws {IoWalletError} If the HTTP request fails.
- * @throws {FederationError} If the result is not in the expected format.
+ * @param trustAnchorEntity The entity configuration of the known trust anchor.
+ * @returns The Base64 encoded X.509 certificate string.
+ * @throws {FederationError} If the certificate cannot be derived.
  */
-export async function getFederationList(
-  federationListEndpoint: string,
-  { appFetch = fetch }: FetchOptions = {}
-): Promise<string[]> {
-  return await appFetch(federationListEndpoint, {
-    method: "GET",
-  })
-    .then(hasStatusOrThrow(200))
-    .then((res) => res.json())
-    .then((json) => {
-      const result = FederationListResponse.safeParse(json);
-      if (!result.success) {
-        throw new FederationListParseError(
-          `Invalid federation list format received from ${federationListEndpoint}. Error: ${result.error.message}`,
-          { url: federationListEndpoint, parseError: result.error.toString() }
-        );
-      }
-      return result.data;
-    });
+export function getTrustAnchorX509Certificate(
+  trustAnchorEntity: TrustAnchorConfig,
+): string {
+  const taHeaderKid = trustAnchorEntity.jwt.header.kid;
+  const taSigningJwk = trustAnchorEntity.keys.find(
+    (key) => key.kid === taHeaderKid,
+  );
+
+  if (!taSigningJwk) {
+    throw new FederationError(
+      `Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' not found in Trust Anchor's JWKS.`,
+      { reason: "JWK not found for header kid", trustAnchorKid: taHeaderKid },
+    );
+  }
+
+  if (taSigningJwk.x5c && taSigningJwk.x5c.length > 0 && taSigningJwk.x5c[0]) {
+    return taSigningJwk.x5c[0];
+  }
+
+  throw new FederationError(
+    `Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' does not contain a valid 'x5c' certificate array.`,
+    { reason: "Missing or empty x5c in JWK", trustAnchorKid: taHeaderKid },
+  );
 }