@pagopa/io-react-native-wallet 3.6.3 → 3.7.0

package/src/credential/issuance/common/06-verify-and-parse-credential.sdjwt.ts

@@ -1,25 +1,28 @@
+import type { Verifier } from "@sd-jwt/types";
+
 import {
   type CryptoContext,
   verify as verifyJwt,
 } from "@pagopa/io-react-native-jwt";
-import { type SDJwt, type VerifierOptions, SDJwtInstance } from "@sd-jwt/core";
+import { type SDJwt, SDJwtInstance, type VerifierOptions } from "@sd-jwt/core";
 import { digest } from "@sd-jwt/crypto-nodejs";
-import type { Verifier } from "@sd-jwt/types";
-import { isPathEqual, isPrefixOf } from "../../../utils/parser";
-import { IoWalletError } from "../../../utils/errors";
-import { LogLevel, Logger } from "../../../utils/logging";
-import { isSameThumbprint, type JWK } from "../../../utils/jwk";
+
 import type { SdJwt4VCBase } from "../../../sd-jwt/types";
+import type { IssuanceApi, IssuerConfig, ParsedCredential } from "../api";
+
+import { MissingX509CertsError } from "../../../trust/common/errors";
 import { fixLegacyCredentialSdJwt } from "../../../utils/credentials";
+import { IoWalletError } from "../../../utils/errors";
+import { isSameThumbprint, type JWK } from "../../../utils/jwk";
+import { Logger, LogLevel } from "../../../utils/logging";
+import { isPathEqual, isPrefixOf } from "../../../utils/parser";
 import { verifyX509Chain } from "../../../utils/x509";
-import { MissingX509CertsError } from "../../../trust/common/errors";
-import type { IssuanceApi, IssuerConfig, ParsedCredential } from "../api";
+
+type ClaimConfig = CredentialConf["claims"][number];
 
 type CredentialConf =
   IssuerConfig["credential_configurations_supported"][string];
 
-type ClaimConfig = CredentialConf["claims"][number];
-
 type DisplayableClaim = Omit<ClaimConfig, "display"> & {
   display: NonNullable<ClaimConfig["display"]>;
 };
@@ -35,13 +38,13 @@ type DisplayableClaim = Omit<ClaimConfig, "display"> & {
 const parseCredentialSdJwt = (
   credentialConfig: CredentialConf,
   parsedCredentialRaw: Record<string, unknown>,
-  ignoreMissingAttributes: boolean = false,
-  includeUndefinedAttributes: boolean = false
+  ignoreMissingAttributes = false,
+  includeUndefinedAttributes = false,
 ): ParsedCredential => {
   // Claims without display property (such as `iat`, `exp`, `iss`, etc.)
   // must be ignored as they are not meant to be displayed to the user.
   const displayableClaims = (credentialConfig.claims || []).filter(
-    (c) => c.display !== undefined
+    (c) => c.display !== undefined,
   ) as DisplayableClaim[];
 
   // Check that all mandatory attributes defined in the issuer configuration are present in the credential
@@ -50,7 +53,7 @@ const parseCredentialSdJwt = (
     const rootKeysToVerify = new Set(
       displayableClaims
         .map((c) => c.path[0])
-        .filter((p): p is string => typeof p === "string")
+        .filter((p): p is string => typeof p === "string"),
     );
 
     for (const rootKey of rootKeysToVerify) {
@@ -63,7 +66,7 @@ const parseCredentialSdJwt = (
       const missing = missingPaths.join(", ");
       const received = Object.keys(parsedCredentialRaw).join(", ");
       throw new IoWalletError(
-        `Some attributes are missing in the credential. Missing: [${missing}], received: [${received}]`
+        `Some attributes are missing in the credential. Missing: [${missing}], received: [${received}]`,
       );
     }
   }
@@ -72,7 +75,7 @@ const parseCredentialSdJwt = (
    * Helper to find display metadata for any given path
    */
   const getDisplayNames = (
-    path: (string | number | null)[]
+    path: (null | number | string)[],
   ): Record<string, string> | undefined => {
     const match = displayableClaims.find((c) => isPathEqual(c.path, path));
     if (!match) return undefined;
@@ -89,12 +92,12 @@ const parseCredentialSdJwt = (
    */
   const processLevel = (
     currentData: unknown,
-    currentPath: (string | number | null)[]
+    currentPath: (null | number | string)[],
   ): unknown => {
     // Handle Arrays
     if (Array.isArray(currentData)) {
       return currentData.map((item) =>
-        processLevel(item, [...currentPath, null])
+        processLevel(item, [...currentPath, null]),
       );
     }
 
@@ -105,10 +108,10 @@ const parseCredentialSdJwt = (
 
     const dataObj = currentData as Record<string, unknown>;
     const result: ParsedCredential = {};
-    const processedKeys = new Set<string | number>();
+    const processedKeys = new Set<number | string>();
 
     // Identify unique keys in config at this level
-    const configKeysAtThisLevel: (string | number)[] = [];
+    const configKeysAtThisLevel: (number | string)[] = [];
     for (const claim of displayableClaims) {
       // Check if the claim path starts with the current path
       if (isPrefixOf(currentPath, claim.path)) {
@@ -173,7 +176,7 @@ type SdJwtInstanceVerifier = Verifier<VerifierOptions & { issuerKeys: JWK[] }>;
 const sdJwtInstanceVerifier: SdJwtInstanceVerifier = async (
   data,
   signature,
-  options
+  options,
 ) => {
   if (!options?.issuerKeys) {
     return false;
@@ -206,7 +209,7 @@ const sdJwtInstanceVerifier: SdJwtInstanceVerifier = async (
 async function verifyCredentialSdJwt(
   rawCredential: string,
   issuerKeys: JWK[],
-  holderBindingContext: CryptoContext
+  holderBindingContext: CryptoContext,
 ): Promise<SDJwt> {
   const sdJwtInstance = new SDJwtInstance({
     hasher: digest,
@@ -239,17 +242,17 @@ export const verifyAndParseCredentialSdJwt: IssuanceApi["verifyAndParseCredentia
       includeUndefinedAttributes,
       validateCertificateChain,
     },
-    x509CertRoot
+    x509CertRoot,
   ) => {
     const decoded = await verifyCredentialSdJwt(
       credential,
       issuerConf.keys,
-      credentialCryptoContext
+      credentialCryptoContext,
     );
 
     Logger.log(
       LogLevel.DEBUG,
-      `Decoded credential: ${JSON.stringify(decoded)}`
+      `Decoded credential: ${JSON.stringify(decoded)}`,
     );
 
     if (validateCertificateChain) {
@@ -269,7 +272,7 @@ export const verifyAndParseCredentialSdJwt: IssuanceApi["verifyAndParseCredentia
     if (!credentialConfig) {
       Logger.log(
         LogLevel.ERROR,
-        `Credential type not supported by the issuer: ${credentialConfigurationId}`
+        `Credential type not supported by the issuer: ${credentialConfigurationId}`,
       );
       throw new IoWalletError("Credential type not supported by the issuer");
     }
@@ -283,7 +286,7 @@ export const verifyAndParseCredentialSdJwt: IssuanceApi["verifyAndParseCredentia
       credentialConfig,
       parsedCredentialRaw,
       ignoreMissingAttributes,
-      includeUndefinedAttributes
+      includeUndefinedAttributes,
     );
 
     const issuedAt =
@@ -298,12 +301,12 @@ export const verifyAndParseCredentialSdJwt: IssuanceApi["verifyAndParseCredentia
 
     Logger.log(
       LogLevel.DEBUG,
-      `Parsed credential: ${JSON.stringify(parsedCredential)}\nIssued at: ${issuedAt}`
+      `Parsed credential: ${JSON.stringify(parsedCredential)}\nIssued at: ${issuedAt}`,
     );
 
     return {
-      parsedCredential,
       expiration,
       issuedAt,
+      parsedCredential,
     };
   };

package/src/credential/issuance/common/errors.ts

@@ -5,10 +5,6 @@ import { IoWalletError, serializeAttrs } from "../../../utils/errors";
  */
 export class AuthorizationError extends IoWalletError {
   code = "ERR_IO_WALLET_AUTHORIZATION_ERROR";
-
-  constructor(message?: string) {
-    super(message);
-  }
 }
 
 /**

package/src/credential/issuance/index.ts

@@ -2,4 +2,4 @@ import * as Errors from "./common/errors";
 export { Errors };
 export type * from "./api";
 export { Issuance as V1_0_0 } from "./v1.0.0";
-export { Issuance as V1_3_3 } from "./v1.3.3";
+export { Issuance as V1_4_6 } from "./v1.4.6";

package/src/credential/issuance/mrtd-pop/01-verify-and-parse-challenge-info.ts

@@ -1,24 +1,26 @@
 import { verifyMrtdChallenge } from "@pagopa/io-wallet-oauth2";
-import { IoWalletError } from "../../../utils/errors";
-import { createVerifyJwtFromJwks } from "../../../utils/callbacks";
+
 import type { MRTDPoPApi } from "../api/mrtd-pop";
 
+import { createVerifyJwtFromJwks } from "../../../utils/callbacks";
+import { IoWalletError } from "../../../utils/errors";
+
 export const verifyAndParseChallengeInfo: MRTDPoPApi["verifyAndParseChallengeInfo"] =
   async (issuerConf, challengeInfoJwt, { wiaCryptoContext }) => {
     const clientId = await wiaCryptoContext.getPublicKey().then((x) => x.kid);
 
     if (!clientId) {
       throw new IoWalletError(
-        "Could not extract client_id from Wallet Attestation"
+        "Could not extract client_id from Wallet Attestation",
       );
     }
 
     const verified = await verifyMrtdChallenge({
-      challengeJwt: challengeInfoJwt,
-      clientId,
       callbacks: {
         verifyJwt: createVerifyJwtFromJwks(issuerConf.keys),
       },
+      challengeJwt: challengeInfoJwt,
+      clientId,
     });
 
     return verified.payload;

package/src/credential/issuance/mrtd-pop/02-init-challenge.ts

@@ -6,22 +6,24 @@ import {
   IoWalletSdkConfig,
   UnexpectedStatusCodeError as SdkUnexpectedStatusCodeError,
 } from "@pagopa/io-wallet-utils";
-import { Logger, LogLevel } from "../../../utils/logging";
-import {
-  IssuerResponseError,
-  IssuerResponseErrorCodes,
-  ResponseErrorBuilder,
-} from "../../../utils/errors";
+
 import type { MRTDPoPApi } from "../api/mrtd-pop";
+
 import {
   createSignJwtFromCryptoContext,
   createVerifyJwtFromJwks,
   partialCallbacks,
 } from "../../../utils/callbacks";
+import {
+  IssuerResponseError,
+  IssuerResponseErrorCodes,
+  ResponseErrorBuilder,
+} from "../../../utils/errors";
+import { Logger, LogLevel } from "../../../utils/logging";
 
-type Config = {
+interface Config {
   sdkConfig: IoWalletSdkConfig;
-};
+}
 
 /**
  * Factory function to create `initChallenge` for MRTD PoP flow.
@@ -30,14 +32,14 @@ type Config = {
  * @returns `initChallenge` function compliant with the public API
  */
 export function createInitChallenge(
-  config: Config
+  config: Config,
 ): MRTDPoPApi["initChallenge"] {
   return async function initChallenge(
     issuerConf,
     initUrl,
     mrtd_auth_session,
     mrtd_pop_jwt_nonce,
-    context
+    context,
   ) {
     const {
       appFetch = fetch,
@@ -46,37 +48,37 @@ export function createInitChallenge(
     } = context;
 
     const clientAttestationDPoP = await createClientAttestationPopJwt({
-      config: config.sdkConfig,
+      authorizationServer: issuerConf.credential_issuer,
       callbacks: {
         generateRandom: partialCallbacks.generateRandom,
         signJwt: createSignJwtFromCryptoContext(wiaCryptoContext),
       },
       clientAttestation: walletInstanceAttestation,
-      authorizationServer: issuerConf.credential_issuer,
+      config: config.sdkConfig,
       signer: {
-        method: "jwk",
         alg: "ES256",
+        method: "jwk",
         publicJwk: await wiaCryptoContext.getPublicKey(),
       },
     });
 
     const initResult = await fetchMrtdPopInit({
-      popInitEndpoint: initUrl,
-      mrtdAuthSession: mrtd_auth_session,
-      mrtdPopJwtNonce: mrtd_pop_jwt_nonce,
-      walletAttestation: walletInstanceAttestation,
-      clientAttestationDPoP,
       callbacks: {
-        verifyJwt: createVerifyJwtFromJwks(issuerConf.keys),
         fetch: appFetch,
+        verifyJwt: createVerifyJwtFromJwks(issuerConf.keys),
       },
+      clientAttestationDPoP,
+      mrtdAuthSession: mrtd_auth_session,
+      mrtdPopJwtNonce: mrtd_pop_jwt_nonce,
+      popInitEndpoint: initUrl,
+      walletAttestation: walletInstanceAttestation,
     }).catch(handleInitChallengeError);
 
     return {
       challenge: initResult.challenge,
       mrtd_pop_nonce: initResult.mrtdPopNonce,
-      pop_verify_endpoint: initResult.popVerifyEndpoint,
       mrz: initResult.mrz,
+      pop_verify_endpoint: initResult.popVerifyEndpoint,
     };
   };
 }

package/src/credential/issuance/mrtd-pop/03-validate-challenge.ts

@@ -1,19 +1,22 @@
+import type { IoWalletSdkConfig } from "@pagopa/io-wallet-utils";
+
 import { SignJWT } from "@pagopa/io-react-native-jwt";
 import {
   createClientAttestationPopJwt,
   fetchMrtdPopVerify,
 } from "@pagopa/io-wallet-oauth2";
-import type { IoWalletSdkConfig } from "@pagopa/io-wallet-utils";
-import { sdkUnexpectedStatusCodeToIssuerError } from "../../../utils/errors";
+
+import type { MRTDPoPApi } from "../api/mrtd-pop";
+
 import {
   createSignJwtFromCryptoContext,
   partialCallbacks,
 } from "../../../utils/callbacks";
-import type { MRTDPoPApi } from "../api/mrtd-pop";
+import { sdkUnexpectedStatusCodeToIssuerError } from "../../../utils/errors";
 
-type Config = {
+interface Config {
   sdkConfig: IoWalletSdkConfig;
-};
+}
 
 /**
  * Factory function to create `validateChallenge` for MRTD PoP flow.
@@ -22,7 +25,7 @@ type Config = {
  * @returns `validateChallenge` function compliant with the public API
  */
 export function createValidateChallenge(
-  config: Config
+  config: Config,
 ): MRTDPoPApi["validateChallenge"] {
   return async function validateChallenge(
     issuerConf,
@@ -31,7 +34,7 @@ export function createValidateChallenge(
     mrtd_pop_nonce,
     mrtd,
     ias,
-    context
+    context,
   ) {
     const {
       appFetch = fetch,
@@ -44,52 +47,52 @@ export function createValidateChallenge(
     const wiaPublicJwk = await wiaCryptoContext.getPublicKey();
 
     const clientAttestationDPoP = await createClientAttestationPopJwt({
-      config: config.sdkConfig,
+      authorizationServer: aud,
       callbacks: {
         generateRandom: partialCallbacks.generateRandom,
         signJwt: createSignJwtFromCryptoContext(wiaCryptoContext),
       },
       clientAttestation: walletInstanceAttestation,
-      authorizationServer: aud,
+      config: config.sdkConfig,
       signer: {
-        method: "jwk",
         alg: "ES256",
+        method: "jwk",
         publicJwk: wiaPublicJwk,
       },
     });
 
     const mrtdValidationJwt = await new SignJWT(wiaCryptoContext)
       .setProtectedHeader({
-        typ: "mrtd-ias+jwt",
         kid: wiaPublicJwk.kid,
+        typ: "mrtd-ias+jwt",
       })
       .setPayload({
-        iss: wiaPublicJwk.kid,
         aud,
         document_type: "cie",
-        mrtd,
         ias,
+        iss: wiaPublicJwk.kid,
+        mrtd,
       })
       .setIssuedAt()
       .setExpirationTime("5m")
       .sign();
 
     const verifyResult = await fetchMrtdPopVerify({
-      popVerifyEndpoint: verifyUrl,
-      mrtdAuthSession: mrtd_auth_session,
-      mrtdPopNonce: mrtd_pop_nonce,
-      clientAttestationDPoP,
-      mrtdValidationJwt,
-      walletAttestation: walletInstanceAttestation,
       callbacks: {
         fetch: appFetch,
         ...partialCallbacks,
       },
+      clientAttestationDPoP,
+      mrtdAuthSession: mrtd_auth_session,
+      mrtdPopNonce: mrtd_pop_nonce,
+      mrtdValidationJwt,
+      popVerifyEndpoint: verifyUrl,
+      walletAttestation: walletInstanceAttestation,
     }).catch(sdkUnexpectedStatusCodeToIssuerError);
 
     return {
-      redirect_uri: verifyResult.redirectUri,
       mrtd_val_pop_nonce: verifyResult.mrtdValPopNonce,
+      redirect_uri: verifyResult.redirectUri,
     };
   };
 }
@@ -97,8 +100,8 @@ export function createValidateChallenge(
 export const buildChallengeCallbackUrl: MRTDPoPApi["buildChallengeCallbackUrl"] =
   async (redirectUri, valPopNonce, authSession) => {
     const params = new URLSearchParams({
-      mrtd_val_pop_nonce: valPopNonce,
       mrtd_auth_session: authSession,
+      mrtd_val_pop_nonce: valPopNonce,
     });
 
     const callbackUrl = `${redirectUri}?${params}`;

package/src/credential/issuance/mrtd-pop/index.ts

@@ -1,22 +1,23 @@
-import { sdkConfigV1_0, sdkConfigV1_3 } from "../../../utils/config";
 import type { MRTDPoPApi } from "../api/mrtd-pop";
+
+import { sdkConfigV1_0, sdkConfigV1_4 } from "../../../utils/config";
 import { verifyAndParseChallengeInfo } from "./01-verify-and-parse-challenge-info";
 import { createInitChallenge } from "./02-init-challenge";
 import {
-  createValidateChallenge,
   buildChallengeCallbackUrl,
+  createValidateChallenge,
 } from "./03-validate-challenge";
 
 export const MRTDPoPv1_0: MRTDPoPApi = {
-  verifyAndParseChallengeInfo,
+  buildChallengeCallbackUrl,
   initChallenge: createInitChallenge({ sdkConfig: sdkConfigV1_0 }),
   validateChallenge: createValidateChallenge({ sdkConfig: sdkConfigV1_0 }),
-  buildChallengeCallbackUrl,
+  verifyAndParseChallengeInfo,
 };
 
 export const MRTDPoPv1_3: MRTDPoPApi = {
-  verifyAndParseChallengeInfo,
-  initChallenge: createInitChallenge({ sdkConfig: sdkConfigV1_3 }),
-  validateChallenge: createValidateChallenge({ sdkConfig: sdkConfigV1_3 }),
   buildChallengeCallbackUrl,
+  initChallenge: createInitChallenge({ sdkConfig: sdkConfigV1_4 }),
+  validateChallenge: createValidateChallenge({ sdkConfig: sdkConfigV1_4 }),
+  verifyAndParseChallengeInfo,
 };

package/src/credential/issuance/v1.0.0/01-evaluate-issuer-trust.ts

@@ -1,10 +1,11 @@
-import { getCredentialIssuerEntityConfiguration } from "../../../trust/v1.0.0/entities";
 import type { IssuanceApi } from "../api";
+
+import { getCredentialIssuerEntityConfiguration } from "../../../trust/v1.0.0/entities";
 import { mapToIssuerConfig } from "./mappers";
 
 export const evaluateIssuerTrust: IssuanceApi["evaluateIssuerTrust"] = async (
   issuerUrl,
-  context = {}
+  context = {},
 ) => {
   const issuerConf = await getCredentialIssuerEntityConfiguration(issuerUrl, {
     appFetch: context.appFetch,

package/src/credential/issuance/v1.0.0/02-start-user-authorization.ts

@@ -1,8 +1,9 @@
+import type { IssuanceApi } from "../api";
+
+import { IoWalletError } from "../../../utils/errors";
+import { Logger, LogLevel } from "../../../utils/logging";
 import { generateRandomAlphaNumericString } from "../../../utils/misc";
 import { makeParRequest } from "../../../utils/par";
-import { LogLevel, Logger } from "../../../utils/logging";
-import { IoWalletError } from "../../../utils/errors";
-import type { IssuanceApi } from "../api";
 import {
   selectCredentialDefinition,
   selectResponseMode,
@@ -11,10 +12,10 @@ import {
 export const startUserAuthorization: IssuanceApi["startUserAuthorization"] =
   async (issuerConf, credentialIds, proof, ctx) => {
     const {
-      wiaCryptoContext,
-      walletInstanceAttestation,
-      redirectUri,
       appFetch = fetch,
+      redirectUri,
+      walletInstanceAttestation,
+      wiaCryptoContext,
     } = ctx;
 
     const clientId = await wiaCryptoContext.getPublicKey().then((_) => _.kid);
@@ -22,7 +23,7 @@ export const startUserAuthorization: IssuanceApi["startUserAuthorization"] =
     if (!clientId) {
       Logger.log(
         LogLevel.ERROR,
-        `Public key associated with kid ${clientId} not found in the device`
+        `Public key associated with kid ${clientId} not found in the device`,
       );
       throw new IoWalletError("No public key found");
     }
@@ -30,10 +31,10 @@ export const startUserAuthorization: IssuanceApi["startUserAuthorization"] =
     const parEndpoint = issuerConf.pushed_authorization_request_endpoint;
     const aud = issuerConf.credential_issuer;
     const responseMode = selectResponseMode(issuerConf, credentialIds);
-    const getPar = makeParRequest({ wiaCryptoContext, appFetch });
+    const getPar = makeParRequest({ appFetch, wiaCryptoContext });
 
     const credentialDefinition = credentialIds.map((c) =>
-      selectCredentialDefinition(issuerConf, c)
+      selectCredentialDefinition(issuerConf, c),
     );
 
     if (proof.proofType === "mrtd-pop") {
@@ -44,10 +45,10 @@ export const startUserAuthorization: IssuanceApi["startUserAuthorization"] =
        * See https://italia.github.io/eid-wallet-it-docs/versione-corrente/en/credential-issuance-endpoint.html#pushed-authorization-request-endpoint
        */
       credentialDefinition.push({
-        type: "it_l2+document_proof",
-        idphinting: proof.idpHinting,
         challenge_method: "mrtd+ias",
         challenge_redirect_uri: redirectUri,
+        idphinting: proof.idpHinting,
+        type: "it_l2+document_proof",
       });
     }
 
@@ -56,19 +57,19 @@ export const startUserAuthorization: IssuanceApi["startUserAuthorization"] =
       walletInstanceAttestation,
       {
         aud,
+        authorizationDetails: credentialDefinition,
         clientId,
         codeVerifier,
         redirectUri,
         responseMode,
-        authorizationDetails: credentialDefinition,
-      }
+      },
     );
 
     return {
-      issuerRequestUri,
       clientId,
       codeVerifier,
       credentialDefinition,
+      issuerRequestUri,
       responseMode,
     };
   };