@pagopa/io-react-native-wallet 3.6.3 → 3.7.0

package/src/credential/issuance/{v1.3.3 → v1.4.6}/01-evaluate-issuer-trust.ts

@@ -2,21 +2,23 @@ import {
   fetchMetadata,
   type MetadataResponseV1_4,
 } from "@pagopa/io-wallet-oid4vci";
-import { sdkConfigV1_4 } from "../../../utils/config";
+
 import type { IssuanceApi } from "../api";
+
+import { sdkConfigV1_4 } from "../../../utils/config";
 import { mapToIssuerConfig } from "./mappers";
 
 export const evaluateIssuerTrust: IssuanceApi["evaluateIssuerTrust"] = async (
   issuerUrl,
-  context = {}
+  context = {},
 ) => {
   const issuerMetadata = (await fetchMetadata({
-    config: sdkConfigV1_4,
-    credentialIssuerUrl: issuerUrl,
     authorizationServer: context.authorizationServer,
     callbacks: {
       fetch: context.appFetch,
     },
+    config: sdkConfigV1_4,
+    credentialIssuerUrl: issuerUrl,
   })) as MetadataResponseV1_4;
 
   return { issuerConf: mapToIssuerConfig(issuerMetadata) };

package/src/credential/issuance/{v1.3.3 → v1.4.6}/02-start-user-authorization.ts

@@ -1,29 +1,32 @@
+import type { JwtSignerJwk } from "@pagopa/io-wallet-oauth2";
+
 import {
+  createClientAttestationPopJwt,
   createPushedAuthorizationRequest,
   fetchPushedAuthorizationResponse,
-  createClientAttestationPopJwt,
 } from "@pagopa/io-wallet-oauth2";
-import type { JwtSignerJwk } from "@pagopa/io-wallet-oauth2";
 import { v4 as uuidv4 } from "uuid";
-import { LogLevel, Logger } from "../../../utils/logging";
+
 import type { IssuanceApi } from "../api";
+
 import {
   createSignJwtFromCryptoContext,
   partialCallbacks,
 } from "../../../utils/callbacks";
+import { sdkConfigV1_4 } from "../../../utils/config";
 import { IoWalletError } from "../../../utils/errors";
-import { sdkConfigV1_3 } from "../../../utils/config";
+import { Logger, LogLevel } from "../../../utils/logging";
 import { selectCredentialDefinition } from "../common/02-start-user-authorization";
 
 export const startUserAuthorization: IssuanceApi["startUserAuthorization"] =
   async (issuerConf, credentialIds, proof, ctx) => {
     const {
-      wiaCryptoContext,
-      walletInstanceAttestation,
-      redirectUri,
       appFetch = fetch,
-      scope,
       issuerState,
+      redirectUri,
+      scope,
+      walletInstanceAttestation,
+      wiaCryptoContext,
     } = ctx;
 
     const clientId = await wiaCryptoContext.getPublicKey().then((_) => _.kid);
@@ -31,13 +34,13 @@ export const startUserAuthorization: IssuanceApi["startUserAuthorization"] =
     if (!clientId) {
       Logger.log(
         LogLevel.ERROR,
-        `Public key associated with kid ${clientId} not found in the device`
+        `Public key associated with kid ${clientId} not found in the device`,
       );
       throw new IoWalletError("No public key found");
     }
 
     const credentialDefinition = credentialIds.map((c) =>
-      selectCredentialDefinition(issuerConf, c)
+      selectCredentialDefinition(issuerConf, c),
     );
 
     if (proof.proofType === "mrtd-pop") {
@@ -48,73 +51,73 @@ export const startUserAuthorization: IssuanceApi["startUserAuthorization"] =
        * See https://italia.github.io/eid-wallet-it-docs/versione-corrente/en/credential-issuance-endpoint.html#pushed-authorization-request-endpoint
        */
       credentialDefinition.push({
-        type: "it_l2+document_proof",
-        idphinting: proof.idpHinting,
         challenge_method: "mrtd+ias",
         challenge_redirect_uri: redirectUri,
+        idphinting: proof.idpHinting,
+        type: "it_l2+document_proof",
       });
     }
 
     const wiaSigner: JwtSignerJwk = {
-      method: "jwk",
       alg: "ES256",
+      method: "jwk",
       publicJwk: await wiaCryptoContext.getPublicKey(),
     };
 
     const signJwt = createSignJwtFromCryptoContext(wiaCryptoContext);
 
     const parRequest = await createPushedAuthorizationRequest({
-      config: sdkConfigV1_3,
+      audience: issuerConf.credential_issuer,
+      authorization_details: credentialDefinition,
+      authorizationServerMetadata: {
+        require_signed_request_object: true,
+      },
       callbacks: {
         ...partialCallbacks,
         signJwt,
       },
-      authorizationServerMetadata: {
-        require_signed_request_object: true,
-      },
-      jti: uuidv4(),
       clientId,
-      audience: issuerConf.credential_issuer,
-      authorization_details: credentialDefinition,
       codeChallengeMethodsSupported: ["S256"],
+      config: sdkConfigV1_4,
+      dpop: {
+        signer: wiaSigner,
+      },
+      issuerState,
+      jti: uuidv4(),
       redirectUri,
       // When the issuance is started from a Credential Offer, the `scope` and
       // `issuer_state` carried by the authorization_code grant are forwarded to
       // the PAR. They are `undefined` (and thus omitted) for the regular flow.
       scope,
-      issuerState,
-      dpop: {
-        signer: wiaSigner,
-      },
     });
 
     const clientAttestationPoP = await createClientAttestationPopJwt({
-      config: sdkConfigV1_3,
+      authorizationServer: issuerConf.credential_issuer,
       callbacks: {
         generateRandom: partialCallbacks.generateRandom,
         signJwt,
       },
       clientAttestation: walletInstanceAttestation,
-      authorizationServer: issuerConf.credential_issuer,
-      signer: wiaSigner,
+      config: sdkConfigV1_4,
       jti: uuidv4(),
+      signer: wiaSigner,
     });
 
     const { request_uri } = await fetchPushedAuthorizationResponse({
       callbacks: {
         fetch: appFetch,
       },
+      clientAttestationDPoP: clientAttestationPoP,
+      pushedAuthorizationRequest: parRequest,
       pushedAuthorizationRequestEndpoint:
         issuerConf.pushed_authorization_request_endpoint,
-      pushedAuthorizationRequest: parRequest,
-      clientAttestationDPoP: clientAttestationPoP,
       walletAttestation: walletInstanceAttestation,
     });
 
     return {
-      issuerRequestUri: request_uri,
       clientId,
       codeVerifier: parRequest.pkceCodeVerifier,
       credentialDefinition,
+      issuerRequestUri: request_uri,
     };
   };

package/src/credential/issuance/{v1.3.3 → v1.4.6}/03-complete-user-authorization.ts

@@ -1,37 +1,40 @@
-import {
-  AuthorizationErrorShape,
-  AuthorizationResultShape,
-  type AuthorizationResult,
-} from "../../../utils/auth";
-import parseUrl from "parse-url";
+import type { jsonWebKeySet } from "@pagopa/io-wallet-oid-federation";
+
+import { parseMrtdChallenge } from "@pagopa/io-wallet-oauth2";
+import { sendAuthorizationResponseAndExtractCode } from "@pagopa/io-wallet-oid4vci";
 import {
   createAuthorizationResponse,
-  parseAuthorizeRequest,
-  fetchAuthorizationResponse,
   type CreateAuthorizationResponseResult,
+  fetchAuthorizationResponse,
+  parseAuthorizeRequest,
 } from "@pagopa/io-wallet-oid4vp";
-import { sendAuthorizationResponseAndExtractCode } from "@pagopa/io-wallet-oid4vci";
-import type { jsonWebKeySet } from "@pagopa/io-wallet-oid-federation";
-import { parseMrtdChallenge } from "@pagopa/io-wallet-oauth2";
-import { AuthorizationError, AuthorizationIdpError } from "../common/errors";
-import { LogLevel, Logger } from "../../../utils/logging";
-import { RemotePresentation as RemotePresentationFlow } from "../../presentation/v1.3.3";
+import parseUrl from "parse-url";
+
+import type { RequestObject } from "../../presentation";
+import type { EvaluatedDcqlQuery, IssuanceApi, IssuerConfig } from "../api";
+
+import {
+  AuthorizationErrorShape,
+  type AuthorizationResult,
+  AuthorizationResultShape,
+} from "../../../utils/auth";
 import {
   createVerifyJwtFromJwks,
   partialCallbacks,
 } from "../../../utils/callbacks";
-import { sdkConfigV1_3, sdkConfigV1_4 } from "../../../utils/config";
+import { sdkConfigV1_4 } from "../../../utils/config";
 import { IoWalletError, IssuerResponseError } from "../../../utils/errors";
-import type { EvaluatedDcqlQuery, IssuanceApi, IssuerConfig } from "../api";
-import { mapToRequestObject } from "./mappers";
-import type { RequestObject } from "../../presentation";
+import { Logger, LogLevel } from "../../../utils/logging";
 import { hasStatusOrThrow } from "../../../utils/misc";
+import { RemotePresentation as RemotePresentationFlow } from "../../presentation/v1.4.6";
+import { AuthorizationError, AuthorizationIdpError } from "../common/errors";
+import { mapToRequestObject } from "./mappers";
 
 export const continueUserAuthorizationWithMRTDPoPChallenge: IssuanceApi["continueUserAuthorizationWithMRTDPoPChallenge"] =
   async (authRedirectUrl) => {
     Logger.log(
       LogLevel.DEBUG,
-      "The requested credential is a PID and requires MRTD PoP, starting MRTD PoP validation from auth redirect"
+      "The requested credential is a PID and requires MRTD PoP, starting MRTD PoP validation from auth redirect",
     );
     try {
       const parsedChallenge = parseMrtdChallenge({
@@ -43,7 +46,7 @@ export const continueUserAuthorizationWithMRTDPoPChallenge: IssuanceApi["continu
         err instanceof Error ? err.message : "MRTD challenge parsing failed";
       Logger.log(
         LogLevel.ERROR,
-        `Error while parsing the authorization response: ${errorMessage}`
+        `Error while parsing the authorization response: ${errorMessage}`,
       );
       throw new AuthorizationError(errorMessage);
     }
@@ -71,7 +74,7 @@ export const completePidUserAuthorizationWithQueryMode: IssuanceApi["completePid
   async (authRedirectUrl) => {
     Logger.log(
       LogLevel.DEBUG,
-      "The requested credential is a PID, completing the user authorization with query mode"
+      "The requested credential is a PID, completing the user authorization with query mode",
     );
     const query = parseUrl(authRedirectUrl).query;
 
@@ -82,7 +85,7 @@ export const getRequestedCredentialToBePresented: IssuanceApi["getRequestedCrede
   async (issuerRequestUri, clientId, issuerConf, appFetch = fetch) => {
     Logger.log(
       LogLevel.DEBUG,
-      "The requested credential is not a PID, requesting the credential to be presented"
+      "The requested credential is not a PID, requesting the credential to be presented",
     );
 
     const authzRequestEndpoint = issuerConf.authorization_endpoint;
@@ -93,22 +96,22 @@ export const getRequestedCredentialToBePresented: IssuanceApi["getRequestedCrede
 
     Logger.log(
       LogLevel.DEBUG,
-      `Requesting the request object to ${authzRequestEndpoint}?${params.toString()}`
+      `Requesting the request object to ${authzRequestEndpoint}?${params.toString()}`,
     );
 
     const requestObjectJwt = await appFetch(
       `${authzRequestEndpoint}?${params.toString()}`,
-      { method: "GET" }
+      { method: "GET" },
     )
       .then(hasStatusOrThrow(200, IssuerResponseError))
       .then((res) => res.text());
 
     const parsedAuthRequest = await parseAuthorizeRequest({
-      config: sdkConfigV1_3,
-      requestObjectJwt,
       callbacks: {
         verifyJwt: createVerifyJwtFromJwks(issuerConf.keys),
       },
+      config: sdkConfigV1_4,
+      requestObjectJwt,
     });
 
     return mapToRequestObject(parsedAuthRequest);
@@ -120,17 +123,17 @@ export const completeUserAuthorizationWithFormPostJwtMode: IssuanceApi["complete
     requestObject,
     issuerConfig,
     evaluatedDcqlQuery,
-    { appFetch = fetch }
+    { appFetch = fetch },
   ) => {
     Logger.log(
       LogLevel.DEBUG,
-      "The requested credential is not a PID, completing the user authorization with form_post.jwt mode"
+      "The requested credential is not a PID, completing the user authorization with form_post.jwt mode",
     );
 
     const authzResponse = await processPidPresentationAndCreateAuthzResponse({
-      requestObject,
-      issuerConfig,
       evaluatedDcqlQuery,
+      issuerConfig,
+      requestObject,
     });
 
     Logger.log(LogLevel.DEBUG, `Authz response: ${authzResponse}`);
@@ -149,13 +152,13 @@ export const completeUserAuthorizationWithFormPostJwtMode: IssuanceApi["complete
         fetch: appFetch,
       },
       iss: requestObject.iss,
-      state: requestObject.state ?? "",
       presentationResponseUri: requestObject.response_uri,
       signer: {
         alg: "ES256",
         method: "jwk",
         publicJwk: issuerSigKey,
       },
+      state: requestObject.state ?? "",
     });
   };
 
@@ -165,31 +168,31 @@ export const completeEaaUserAuthorizationWithQueryMode: IssuanceApi["completeEaa
     issuerConfig,
     evaluatedDcqlQuery,
     clientRedirectUri,
-    { appFetch = fetch, fetchFinalRedirectUri } = {}
+    { appFetch = fetch, fetchFinalRedirectUri } = {},
   ) => {
     Logger.log(
       LogLevel.DEBUG,
-      "The requested credential is not a PID, completing the user authorization with query mode"
+      "The requested credential is not a PID, completing the user authorization with query mode",
     );
 
     const authzResponse = await processPidPresentationAndCreateAuthzResponse({
-      requestObject,
-      issuerConfig,
       evaluatedDcqlQuery,
+      issuerConfig,
+      requestObject,
     });
 
     Logger.log(
       LogLevel.DEBUG,
-      `Authz response: ${JSON.stringify(authzResponse)}`
+      `Authz response: ${JSON.stringify(authzResponse)}`,
     );
 
     const { redirect_uri } = await fetchAuthorizationResponse({
       authorizationResponseJarm: authzResponse.jarm.responseJwe,
-      presentationResponseUri: requestObject.response_uri,
       callbacks: {
         ...partialCallbacks,
         fetch: appFetch,
       },
+      presentationResponseUri: requestObject.response_uri,
     });
 
     if (!redirect_uri) {
@@ -230,7 +233,7 @@ export const completeEaaUserAuthorizationWithQueryMode: IssuanceApi["completeEaa
  * @returns the authorization result which contains code, state and iss
  */
 export const parseAuthorizationResponse = (
-  authRes: unknown
+  authRes: unknown,
 ): AuthorizationResult => {
   const authResParsed = AuthorizationResultShape.safeParse(authRes);
   if (!authResParsed.success) {
@@ -238,17 +241,17 @@ export const parseAuthorizationResponse = (
     if (!authErr.success) {
       Logger.log(
         LogLevel.ERROR,
-        `Error while parsing the authorization response: ${authResParsed.error.message}`
+        `Error while parsing the authorization response: ${authResParsed.error.message}`,
       );
       throw new AuthorizationError(authResParsed.error.message); // an error occured while parsing the result and the error
     }
     Logger.log(
       LogLevel.ERROR,
-      `Error while authorizating with the idp: ${JSON.stringify(authErr)}`
+      `Error while authorizating with the idp: ${JSON.stringify(authErr)}`,
     );
     throw new AuthorizationIdpError(
       authErr.data.error,
-      authErr.data.error_description
+      authErr.data.error_description,
     );
   }
   return authResParsed.data;
@@ -262,13 +265,13 @@ export const parseAuthorizationResponse = (
  * @returns The authorization response containing the JARM to be sent to the Issuer
  */
 const processPidPresentationAndCreateAuthzResponse = async ({
-  requestObject,
-  issuerConfig,
   evaluatedDcqlQuery,
+  issuerConfig,
+  requestObject,
 }: {
-  requestObject: RequestObject;
-  issuerConfig: IssuerConfig;
   evaluatedDcqlQuery: EvaluatedDcqlQuery;
+  issuerConfig: IssuerConfig;
+  requestObject: RequestObject;
 }): Promise<CreateAuthorizationResponseResult> => {
   const remotePresentation =
     await RemotePresentationFlow.prepareRemotePresentations(
@@ -277,28 +280,26 @@ const processPidPresentationAndCreateAuthzResponse = async ({
         clientId: requestObject.client_id,
         nonce: requestObject.nonce,
         responseUri: requestObject.response_uri,
-      }
+      },
     );
 
   const vp_token = remotePresentation.presentations.reduce(
     (acc, { credentialId, vpToken }) => ({ ...acc, [credentialId]: [vpToken] }),
-    {} as Record<string, string[]>
+    {} as Record<string, string[]>,
   );
 
   return createAuthorizationResponse({
-    // The SDK 1.4 config is used here in order to resolve the encryption data from the Request Object
-    // client_metadata, otherwise OpenID Federation clients always ignore client_metadata as per 1.3.3 specs.
+    callbacks: {
+      encryptJwe: partialCallbacks.encryptJwe,
+      generateRandom: partialCallbacks.generateRandom,
+    },
     config: sdkConfigV1_4,
     requestObject,
     rpJwks: {
-      jwks: { keys: issuerConfig.keys } as jsonWebKeySet,
       encrypted_response_enc_values_supported:
         issuerConfig.encrypted_response_enc_values_supported,
+      jwks: { keys: issuerConfig.keys } as jsonWebKeySet,
     },
     vp_token,
-    callbacks: {
-      encryptJwe: partialCallbacks.encryptJwe,
-      generateRandom: partialCallbacks.generateRandom,
-    },
   });
 };

package/src/credential/issuance/{v1.3.3 → v1.4.6}/04-authorize-access.ts

@@ -4,26 +4,28 @@ import {
   fetchTokenResponse,
 } from "@pagopa/io-wallet-oauth2";
 import { v4 as uuidv4 } from "uuid";
+
+import type { IssuanceApi, TokenResponse } from "../api";
+
 import {
   createSignJwtFromCryptoContext,
   partialCallbacks,
 } from "../../../utils/callbacks";
+import { sdkConfigV1_4 } from "../../../utils/config";
 import { IoWalletError } from "../../../utils/errors";
-import { sdkConfigV1_3 } from "../../../utils/config";
-import type { IssuanceApi, TokenResponse } from "../api";
 
 export const authorizeAccess: IssuanceApi["authorizeAccess"] = async (
   issuerConf,
   code,
   redirectUri,
   codeVerifier,
-  context
+  context,
 ) => {
   const {
     appFetch = fetch,
+    dPopCryptoContext,
     walletInstanceAttestation,
     wiaCryptoContext,
-    dPopCryptoContext,
   } = context;
 
   const tokenDPoP = await createTokenDPoP({
@@ -31,12 +33,12 @@ export const authorizeAccess: IssuanceApi["authorizeAccess"] = async (
       ...partialCallbacks,
       signJwt: createSignJwtFromCryptoContext(dPopCryptoContext),
     },
+    jti: uuidv4(),
     signer: {
-      method: "jwk",
       alg: "ES256",
+      method: "jwk",
       publicJwk: await dPopCryptoContext.getPublicKey(),
     },
-    jti: uuidv4(),
     tokenRequest: {
       method: "POST",
       url: issuerConf.token_endpoint,
@@ -44,42 +46,42 @@ export const authorizeAccess: IssuanceApi["authorizeAccess"] = async (
   });
 
   const clientAttestationDPoP = await createClientAttestationPopJwt({
-    config: sdkConfigV1_3,
+    authorizationServer: issuerConf.credential_issuer,
     callbacks: {
       generateRandom: partialCallbacks.generateRandom,
       signJwt: createSignJwtFromCryptoContext(wiaCryptoContext),
     },
     clientAttestation: walletInstanceAttestation,
-    authorizationServer: issuerConf.credential_issuer,
+    config: sdkConfigV1_4,
     signer: {
-      method: "jwk",
       alg: "ES256",
+      method: "jwk",
       publicJwk: await wiaCryptoContext.getPublicKey(),
     },
   });
 
   const tokenResponse = await fetchTokenResponse({
     accessTokenEndpoint: issuerConf.token_endpoint,
-    callbacks: {
-      ...partialCallbacks,
-      fetch: appFetch,
-    },
-    walletAttestation: walletInstanceAttestation,
-    dPoP: tokenDPoP.jwt,
-    clientAttestationDPoP,
     accessTokenRequest: {
       code,
-      grant_type: "authorization_code",
       code_verifier: codeVerifier,
+      grant_type: "authorization_code",
       redirect_uri: redirectUri,
     },
+    callbacks: {
+      ...partialCallbacks,
+      fetch: appFetch,
+    },
+    clientAttestationDPoP,
+    dPoP: tokenDPoP.jwt,
+    walletAttestation: walletInstanceAttestation,
   });
 
   // `authorization_details` might be undefined if the PAR used `scope`.
   // We currently do not support `scope` only.
   if (!tokenResponse.authorization_details) {
     throw new IoWalletError(
-      "Access token without authorization_details is not supported"
+      "Access token without authorization_details is not supported",
     );
   }