@pagopa/io-react-native-wallet 3.6.3 → 3.7.0

package/src/credential/issuance/api/06-verify-and-parse-credential.ts

@@ -1,4 +1,5 @@
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
+
 import type { IssuerConfig } from "./IssuerConfig";
 import type { ParsedCredential } from "./types";
 
@@ -37,10 +38,10 @@ export interface VerifyAndParseCredentialApi {
        */
       validateCertificateChain?: boolean;
     },
-    x509CertRoot?: string
+    x509CertRoot?: string,
   ): Promise<{
-    parsedCredential: ParsedCredential;
     expiration: Date;
     issuedAt: Date | undefined;
+    parsedCredential: ParsedCredential;
   }>;
 }

package/src/credential/issuance/api/IssuerConfig.ts

@@ -1,47 +1,48 @@
 import { z } from "zod";
-import { JWK } from "../../../utils/jwk";
+
 import { FederationEntityMetadata } from "../../../trust/common/types";
+import { JWK } from "../../../utils/jwk";
 
 const DisplayConfig = z.object({
-  name: z.string(),
   locale: z.string(),
+  name: z.string(),
 });
 
 const ClaimConfig = z.object({
-  path: z.array(z.union([z.string(), z.number(), z.null()])),
   display: z.array(DisplayConfig).optional(),
+  path: z.array(z.union([z.string(), z.number(), z.null()])),
 });
 
 const IssuanceErrorSupported = z.object({
   display: z.array(
     z.object({
-      title: z.string(),
       description: z.string(),
       locale: z.string(),
-    })
+      title: z.string(),
+    }),
   ),
 });
 
 const CredentialConfig = z.intersection(
   z.discriminatedUnion("format", [
     z.object({ format: z.literal("dc+sd-jwt"), vct: z.string() }),
-    z.object({ format: z.literal("mso_mdoc"), doctype: z.string() }),
+    z.object({ doctype: z.string(), format: z.literal("mso_mdoc") }),
   ]),
   z.object({
-    scope: z.string(),
-    display: z.array(DisplayConfig),
-    claims: z.array(ClaimConfig),
     /**
      * @deprecated Use the Credentials Catalogue to get the Auth Source
      */
     authentic_source: z.string().optional(),
+    claims: z.array(ClaimConfig),
+    display: z.array(DisplayConfig),
     /**
      * @deprecated Kept for backward compatibility with v0.7.1
      */
     issuance_errors_supported: z
       .record(z.string(), IssuanceErrorSupported)
       .optional(),
-  })
+    scope: z.string(),
+  }),
 );
 
 /**
@@ -49,26 +50,26 @@ const CredentialConfig = z.intersection(
  */
 export type IssuerConfig = z.infer<typeof IssuerConfig>;
 export const IssuerConfig = z.object({
-  credential_issuer: z.string(),
+  authorization_endpoint: z.string(),
   /**
    * Authorization Servers advertised by the Credential Issuer. Present when the
    * Issuer relies on one or more external Authorization Servers; used to validate
    * the `authorization_server` selected by a credential offer.
    */
   authorization_servers: z.tuple([z.string()], z.string()).optional(),
-  pushed_authorization_request_endpoint: z.string(),
-  authorization_endpoint: z.string(),
-  token_endpoint: z.string(),
-  nonce_endpoint: z.string(),
-  status_assertion_endpoint: z.string().optional(),
-  credential_endpoint: z.string(),
-  keys: z.array(JWK),
   credential_configurations_supported: z.record(z.string(), CredentialConfig),
-  federation_entity: FederationEntityMetadata,
+  credential_endpoint: z.string(),
   credential_issuance_batch_size: z.number().optional(),
+  credential_issuer: z.string(),
   encrypted_response_enc_values_supported: z.array(z.string()).optional(),
+  federation_entity: FederationEntityMetadata,
+  keys: z.array(JWK),
+  nonce_endpoint: z.string(),
+  pushed_authorization_request_endpoint: z.string(),
   /**
    * @deprecated
    */
   response_modes_supported: z.array(z.string()).optional(),
+  status_assertion_endpoint: z.string().optional(),
+  token_endpoint: z.string(),
 });

package/src/credential/issuance/api/index.ts

@@ -7,16 +7,16 @@ import { type VerifyAndParseCredentialApi } from "./06-verify-and-parse-credenti
 import { type MRTDPoPApi } from "./mrtd-pop";
 
 export interface IssuanceApi
-  extends EvaluateIssuerTrustApi,
-    StartUserAuthorizationApi,
+  extends AuthorizeAccessApi,
     CompleteUserAuthorizationApi,
-    AuthorizeAccessApi,
+    EvaluateIssuerTrustApi,
     ObtainCredentialApi,
+    StartUserAuthorizationApi,
     VerifyAndParseCredentialApi {
   MRTDPoP: MRTDPoPApi;
 }
 
-export type { IssuerConfig } from "./IssuerConfig";
 export type { EvaluatedDcqlQuery } from "./03-complete-user-authorization";
+export type { IssuerConfig } from "./IssuerConfig";
 export type * as MRTDPoP from "./mrtd-pop";
 export type * from "./types";

package/src/credential/issuance/api/mrtd-pop/index.ts

@@ -1,4 +1,5 @@
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
+
 import type { IssuerConfig } from "../IssuerConfig";
 import type {
   IasPayload,
@@ -10,28 +11,18 @@ import type {
 
 export interface MRTDPoPApi {
   /**
-   * Verifies and parses the payload of a MRTD Proof Challenge Info JWT obtained after the primary authentication.
-   *
-   * This function performs the following steps:
-   * 1. Validates the JWT signature using the issuer's JWKS.
-   * 2. Decodes the JWT and parses its structure according to the {@link MrtdProofChallengeInfo} schema.
-   * 3. Verifies that the `aud` claim matches the client's public key ID.
-   * 4. Checks that the JWT is not expired and was not issued in the future.
-   *
-   * @param issuerConf - The issuer configuration containing the JWKS for signature verification.
-   * @param challengeInfoJwt - The JWT string representing the MRTD Proof Challenge Info.
-   * @param context - The context containing the WIA crypto context used to retrieve the client public key.
-   * @returns The parsed payload of the MRTD Proof Challenge Info JWT.
-   * @throws {Error} If the JWT signature is invalid, the structure is malformed, the `aud` claim does not match,
-   * or the JWT is expired/not yet valid.
+   * WARNING: This function must be called after {@link validateChallenge}. The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
+   * Builds the callback URL to which the end user should be redirected to continue the authentication flow after the MRTD challenge validation.
+   * @param redirectUri - The redirect URI provided by the issuer after the challenge validation to continue the authentication flow.
+   * @param valPopNonce - The MRTD validation PoP nonce obtained from the challenge validation response.
+   * @param authSession - The MRTD authentication session identifier used for session binding.
+   * @returns An object containing the callback URL
    */
-  verifyAndParseChallengeInfo(
-    issuerConf: IssuerConfig,
-    challengeInfoJwt: string,
-    context: {
-      wiaCryptoContext: CryptoContext;
-    }
-  ): Promise<MrtdProofChallengeInfo>;
+  buildChallengeCallbackUrl(
+    redirectUri: string,
+    valPopNonce: string,
+    authSession: string,
+  ): Promise<{ callbackUrl: string }>;
 
   /**
    * Initializes the MRTD challenge with the data received from the issuer after the primary authentication.
@@ -51,10 +42,10 @@ export interface MRTDPoPApi {
     mrtd_auth_session: string,
     mrtd_pop_jwt_nonce: string,
     context: {
-      wiaCryptoContext: CryptoContext;
-      walletInstanceAttestation: string;
       appFetch?: GlobalFetch["fetch"];
-    }
+      walletInstanceAttestation: string;
+      wiaCryptoContext: CryptoContext;
+    },
   ): Promise<MrtdPoPChallenge>;
 
   /**
@@ -80,25 +71,35 @@ export interface MRTDPoPApi {
     mrtd: MrtdPayload,
     ias: IasPayload,
     context: {
-      wiaCryptoContext: CryptoContext;
-      walletInstanceAttestation: string;
       appFetch?: GlobalFetch["fetch"];
-    }
+      walletInstanceAttestation: string;
+      wiaCryptoContext: CryptoContext;
+    },
   ): Promise<MrtdPopVerificationResult>;
 
   /**
-   * WARNING: This function must be called after {@link validateChallenge}. The generated authUrl must be used to open a browser or webview capable of catching the redirectSchema to perform a get request to the authorization endpoint.
-   * Builds the callback URL to which the end user should be redirected to continue the authentication flow after the MRTD challenge validation.
-   * @param redirectUri - The redirect URI provided by the issuer after the challenge validation to continue the authentication flow.
-   * @param valPopNonce - The MRTD validation PoP nonce obtained from the challenge validation response.
-   * @param authSession - The MRTD authentication session identifier used for session binding.
-   * @returns An object containing the callback URL
+   * Verifies and parses the payload of a MRTD Proof Challenge Info JWT obtained after the primary authentication.
+   *
+   * This function performs the following steps:
+   * 1. Validates the JWT signature using the issuer's JWKS.
+   * 2. Decodes the JWT and parses its structure according to the {@link MrtdProofChallengeInfo} schema.
+   * 3. Verifies that the `aud` claim matches the client's public key ID.
+   * 4. Checks that the JWT is not expired and was not issued in the future.
+   *
+   * @param issuerConf - The issuer configuration containing the JWKS for signature verification.
+   * @param challengeInfoJwt - The JWT string representing the MRTD Proof Challenge Info.
+   * @param context - The context containing the WIA crypto context used to retrieve the client public key.
+   * @returns The parsed payload of the MRTD Proof Challenge Info JWT.
+   * @throws {Error} If the JWT signature is invalid, the structure is malformed, the `aud` claim does not match,
+   * or the JWT is expired/not yet valid.
    */
-  buildChallengeCallbackUrl(
-    redirectUri: string,
-    valPopNonce: string,
-    authSession: string
-  ): Promise<{ callbackUrl: string }>;
+  verifyAndParseChallengeInfo(
+    issuerConf: IssuerConfig,
+    challengeInfoJwt: string,
+    context: {
+      wiaCryptoContext: CryptoContext;
+    },
+  ): Promise<MrtdProofChallengeInfo>;
 }
 
 export * from "./types";

package/src/credential/issuance/api/mrtd-pop/types.ts

@@ -1,37 +1,37 @@
-export type MrtdPayload = {
-  dg1: string;
-  dg11: string;
-  sod_mrtd: string;
-};
-
-export type IasPayload = {
+export interface IasPayload {
+  challenge_signed: string;
   ias_pk: string;
   sod_ias: string;
-  challenge_signed: string;
-};
+}
 
-export type MrtdProofChallengeInfo = {
-  iss: string;
-  aud: string;
-  iat: number;
-  exp: number;
-  status: "require_interaction";
-  type: "mrtd+ias";
-  mrtd_auth_session: string;
-  state: string;
-  mrtd_pop_jwt_nonce: string;
-  htu: string;
-  htm: "POST";
-};
+export interface MrtdPayload {
+  dg1: string;
+  dg11: string;
+  sod_mrtd: string;
+}
 
-export type MrtdPoPChallenge = {
+export interface MrtdPoPChallenge {
   challenge: string;
   mrtd_pop_nonce: string;
-  pop_verify_endpoint: string;
   mrz?: string;
-};
+  pop_verify_endpoint: string;
+}
 
-export type MrtdPopVerificationResult = {
+export interface MrtdPopVerificationResult {
   mrtd_val_pop_nonce: string;
   redirect_uri: string;
-};
+}
+
+export interface MrtdProofChallengeInfo {
+  aud: string;
+  exp: number;
+  htm: "POST";
+  htu: string;
+  iat: number;
+  iss: string;
+  mrtd_auth_session: string;
+  mrtd_pop_jwt_nonce: string;
+  state: string;
+  status: "require_interaction";
+  type: "mrtd+ias";
+}

package/src/credential/issuance/api/types.ts

@@ -1,11 +1,13 @@
 import * as z from "zod";
 
+export type AuthorizationDetail = z.infer<typeof AuthorizationDetail>;
+
 export type CredentialFormat = "dc+sd-jwt" | "mso_mdoc";
 
 // The credential as a collection of attributes in plain value
-export type ParsedCredential = {
-  /** Attribute key */
-  [claim: string]: {
+export type ParsedCredential = Record<
+  string,
+  {
     name:
       | /* if i18n is provided */ Record<
           string /* locale */,
@@ -14,21 +16,20 @@ export type ParsedCredential = {
       | /* if no i18n is provided */ string
       | undefined; // Add undefined as a possible value for the name property
     value: unknown;
-  };
-};
+  }
+>;
 
-export type AuthorizationDetail = z.infer<typeof AuthorizationDetail>;
 export const AuthorizationDetail = z.object({
-  type: z.literal("openid_credential"),
   credential_configuration_id: z.string(),
   credential_identifiers: z.array(z.string()),
+  type: z.literal("openid_credential"),
 });
 
 export type TokenResponse = z.infer<typeof TokenResponse>;
 export const TokenResponse = z.object({
   access_token: z.string(),
-  refresh_token: z.string().optional(),
   authorization_details: z.array(AuthorizationDetail),
   expires_in: z.number().optional(),
+  refresh_token: z.string().optional(),
   token_type: z.string(),
 });

package/src/credential/issuance/common/02-start-user-authorization.ts

@@ -1,9 +1,10 @@
+import type { IssuerConfig } from "../api";
+
 import { IoWalletError } from "../../../utils/errors";
-import { LogLevel, Logger } from "../../../utils/logging";
+import { Logger, LogLevel } from "../../../utils/logging";
 import { AuthorizationDetail } from "../../../utils/par";
-import type { IssuerConfig } from "../api";
 
-type ResponseMode = "query" | "form_post.jwt";
+type ResponseMode = "form_post.jwt" | "query";
 
 /**
  * Ensures that the credential type requested is supported by the issuer and contained in the
@@ -14,7 +15,7 @@ type ResponseMode = "query" | "form_post.jwt";
  */
 export const selectCredentialDefinition = (
   issuerConf: IssuerConfig,
-  credentialId: string
+  credentialId: string,
 ): AuthorizationDetail => {
   const credential_configurations_supported =
     issuerConf.credential_configurations_supported;
@@ -29,7 +30,7 @@ export const selectCredentialDefinition = (
   if (!result) {
     Logger.log(
       LogLevel.ERROR,
-      `Requested credential ${credentialId} is not supported by the issuer according to its configuration ${JSON.stringify(credential_configurations_supported)}`
+      `Requested credential ${credentialId} is not supported by the issuer according to its configuration ${JSON.stringify(credential_configurations_supported)}`,
     );
     throw new IoWalletError(`No credential support the type '${credentialId}'`);
   }
@@ -45,7 +46,7 @@ export const selectCredentialDefinition = (
  */
 export const selectResponseMode = (
   issuerConf: IssuerConfig,
-  credentialIds: string[]
+  credentialIds: string[],
 ): ResponseMode => {
   const responseModeSet = new Set<ResponseMode>();
 
@@ -53,37 +54,42 @@ export const selectResponseMode = (
     responseModeSet.add(
       credentialId.match(/PersonIdentificationData/i)
         ? "query"
-        : "form_post.jwt"
+        : "form_post.jwt",
     );
   }
 
   if (responseModeSet.size !== 1) {
     Logger.log(
       LogLevel.ERROR,
-      `${credentialIds} have incompatible response_mode: ${[...responseModeSet.values()]}`
+      `${credentialIds} have incompatible response_mode: ${[...responseModeSet.values()]}`,
     );
     throw new IoWalletError(
-      "Requested credentials have incompatible response_mode and cannot be requested with the same PAR request"
+      "Requested credentials have incompatible response_mode and cannot be requested with the same PAR request",
     );
   }
 
   const [responseMode] = responseModeSet.values();
+  if (!responseMode) {
+    throw new IoWalletError(
+      `No response mode found for requested credential IDs '${credentialIds}'`,
+    );
+  }
 
   Logger.log(
     LogLevel.DEBUG,
-    `Selected response mode ${responseMode} for credential IDs ${credentialIds}`
+    `Selected response mode ${responseMode} for credential IDs ${credentialIds}`,
   );
 
   const responseModeSupported = issuerConf.response_modes_supported;
-  if (responseModeSupported && !responseModeSupported.includes(responseMode!)) {
+  if (responseModeSupported && !responseModeSupported.includes(responseMode)) {
     Logger.log(
       LogLevel.ERROR,
-      `Requested response mode ${responseMode} is not supported by the issuer according to its configuration ${JSON.stringify(responseModeSupported)}`
+      `Requested response mode ${responseMode} is not supported by the issuer according to its configuration ${JSON.stringify(responseModeSupported)}`,
     );
     throw new IoWalletError(
-      `No response mode support for IDs '${credentialIds}'`
+      `No response mode support for IDs '${credentialIds}'`,
     );
   }
 
-  return responseMode!;
+  return responseMode;
 };

package/src/credential/issuance/common/06-verify-and-parse-credential.mdoc.ts

@@ -1,28 +1,30 @@
+import type { PublicKey } from "@pagopa/io-react-native-crypto";
 import type { CBOR } from "@pagopa/io-react-native-iso18013";
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
-import type { PublicKey } from "@pagopa/io-react-native-crypto";
+
+import type { Out } from "../../../utils/misc";
+import type { IssuanceApi, IssuerConfig, ParsedCredential } from "../api";
+
 import {
   getParsedCredentialClaimKey,
   verify as verifyMdoc,
 } from "../../../mdoc";
 import { IoWalletError } from "../../../utils/errors";
-import type { Out } from "../../../utils/misc";
 import { isSameThumbprint } from "../../../utils/jwk";
-import type { IssuanceApi, IssuerConfig, ParsedCredential } from "../api";
+
+type ClaimConfig = CredentialConf["claims"][number];
 
 type CredentialConf =
   IssuerConfig["credential_configurations_supported"][string];
 
-type ClaimConfig = CredentialConf["claims"][number];
+type DecodedMDocCredential = Out<typeof verifyMdoc> & {
+  issuerSigned: CBOR.IssuerSigned;
+};
 
 type DisplayableClaim = Omit<ClaimConfig, "display"> & {
   display: NonNullable<ClaimConfig["display"]>;
 };
 
-type DecodedMDocCredential = Out<typeof verifyMdoc> & {
-  issuerSigned: CBOR.IssuerSigned;
-};
-
 /**
  * Given a credential, verify it's in the supported format
  * and the credential is correctly signed
@@ -40,7 +42,7 @@ type DecodedMDocCredential = Out<typeof verifyMdoc> & {
 async function verifyCredentialMDoc(
   rawCredential: string,
   x509CertRoot: string,
-  holderBindingContext: CryptoContext
+  holderBindingContext: CryptoContext,
 ): Promise<DecodedMDocCredential> {
   const [decodedCredential, holderBindingKey] =
     // parallel for optimization
@@ -58,7 +60,7 @@ async function verifyCredentialMDoc(
 
   if (!(await isSameThumbprint(key, holderBindingKey as PublicKey))) {
     throw new IoWalletError(
-      `Failed to verify holder binding, holder binding key and mDoc deviceKey don't match`
+      `Failed to verify holder binding, holder binding key and mDoc deviceKey don't match`,
     );
   }
 
@@ -70,8 +72,8 @@ const parseCredentialMDoc = (
   credentialConfig: CredentialConf,
   // credential_type: string,
   { issuerSigned }: DecodedMDocCredential,
-  ignoreMissingAttributes: boolean = false,
-  includeUndefinedAttributes: boolean = false
+  ignoreMissingAttributes = false,
+  includeUndefinedAttributes = false,
 ): ParsedCredential => {
   if (!credentialConfig) {
     throw new IoWalletError("Credential type not supported by the issuer");
@@ -84,12 +86,12 @@ const parseCredentialMDoc = (
   // Claims without display property (such as `iat`, `exp`, `iss`, etc.)
   // must be ignored as they are not meant to be displayed to the user.
   const displayableClaims = credentialConfig.claims.filter(
-    (c) => c.display !== undefined
+    (c) => c.display !== undefined,
   ) as DisplayableClaim[];
 
   const attrDefinitions = displayableClaims.map<
-    [string, string, { name: string; locale: string }[]]
-  >(({ path: [namespace, attribute], display }) => [
+    [string, string, { locale: string; name: string }[]]
+  >(({ display, path: [namespace, attribute] }) => [
     namespace as string,
     attribute as string,
     display,
@@ -105,7 +107,7 @@ const parseCredentialMDoc = (
         namespace,
         v.elementIdentifier,
         v.elementValue,
-      ])
+      ]),
   );
 
   // Check that all mandatory attributes defined in the issuer configuration are present in the disclosure set
@@ -114,8 +116,8 @@ const parseCredentialMDoc = (
     ([attrDefNamespace, attrKey]) =>
       !flatNamespaces.some(
         ([namespace, claim]) =>
-          attrDefNamespace === namespace && attrKey === claim
-      )
+          attrDefNamespace === namespace && attrKey === claim,
+      ),
   );
 
   if (attrsNotInDisclosures.length > 0) {
@@ -126,7 +128,7 @@ const parseCredentialMDoc = (
 
     if (!ignoreMissingAttributes) {
       throw new IoWalletError(
-        `Some attributes are missing in the credential. Missing: [${missing}], received: [${received}]`
+        `Some attributes are missing in the credential. Missing: [${missing}], received: [${received}]`,
       );
     }
   }
@@ -143,10 +145,10 @@ const parseCredentialMDoc = (
             display,
             value: flatNamespaces.find(
               ([namespace, name]) =>
-                attrDefNamespace === namespace && name === attrKey
+                attrDefNamespace === namespace && name === attrKey,
             )?.[2],
           },
-        ] as const
+        ] as const,
     )
     //filter the not found elements
     .filter(([_, __, definition]) => definition.value !== undefined)
@@ -156,17 +158,17 @@ const parseCredentialMDoc = (
       (acc, [attrDefNamespace, attrKey, { display, value }]) => ({
         ...acc,
         [getParsedCredentialClaimKey(attrDefNamespace, attrKey)]: {
-          value,
           name: display.reduce(
             (names, { locale, name }) => ({
               ...names,
               [locale]: name,
             }),
-            {}
+            {},
           ),
+          value,
         },
       }),
-      {}
+      {},
     );
 
   if (includeUndefinedAttributes) {
@@ -174,12 +176,12 @@ const parseCredentialMDoc = (
       Object.values(flatNamespaces)
         .filter(
           ([namespace, key]) =>
-            !definedValues[getParsedCredentialClaimKey(namespace, key)]
+            !definedValues[getParsedCredentialClaimKey(namespace, key)],
         )
         .map(([namespace, key, value]) => [
           getParsedCredentialClaimKey(namespace, key),
-          { value, name: key },
-        ])
+          { name: key, value },
+        ]),
     );
     return {
       ...definedValues,
@@ -200,7 +202,7 @@ export const verifyAndParseCredentialMDoc: IssuanceApi["verifyAndParseCredential
       ignoreMissingAttributes,
       includeUndefinedAttributes,
     },
-    x509CertRoot
+    x509CertRoot,
   ) => {
     if (!x509CertRoot) {
       throw new IoWalletError("Missing x509CertRoot");
@@ -209,28 +211,31 @@ export const verifyAndParseCredentialMDoc: IssuanceApi["verifyAndParseCredential
     const decoded = await verifyCredentialMDoc(
       credential,
       x509CertRoot,
-      credentialCryptoContext
+      credentialCryptoContext,
     );
 
     const credentialConfig =
-      issuerConf.credential_configurations_supported[
-        credentialConfigurationId
-      ]!;
+      issuerConf.credential_configurations_supported[credentialConfigurationId];
+    if (!credentialConfig) {
+      throw new IoWalletError(
+        `Missing credential configuration for ${credentialConfigurationId}`,
+      );
+    }
     const parsedCredential = parseCredentialMDoc(
       credentialConfig,
       decoded,
       ignoreMissingAttributes,
-      includeUndefinedAttributes
+      includeUndefinedAttributes,
     );
 
     const { signed, validUntil } =
       decoded.issuerSigned.issuerAuth.payload.validityInfo;
 
     return {
-      parsedCredential,
       credential,
       credentialConfigurationId,
       expiration: validUntil,
       issuedAt: signed,
+      parsedCredential,
     };
   };