@pagopa/io-react-native-wallet 3.6.3 → 3.7.0

package/src/credential/presentation/{v1.3.3 → v1.4.6}/07-send-authorization-response.ts

@@ -2,23 +2,25 @@ import {
   createAuthorizationResponse as sdkCreateAuthorizationResponse,
   fetchAuthorizationResponse as sdkFetchAuthorizationResponse,
 } from "@pagopa/io-wallet-oid4vp";
+
 import type { RemotePresentationApi } from "../api";
+
+import { prepareVpTokenMdoc } from "../../../mdoc";
+import { prepareVpToken } from "../../../sd-jwt";
 import { partialCallbacks } from "../../../utils/callbacks";
-import { mapSdkAuthorizationResponseError } from "./sdkErrorMapper";
-import {
-  generateRandomAlphaNumericString,
-  hasStatusOrThrow,
-} from "../../../utils/misc";
+import { sdkConfigV1_4 } from "../../../utils/config";
+import { createCryptoContextFor } from "../../../utils/crypto";
 import {
   IoWalletError,
   RelyingPartyResponseError,
 } from "../../../utils/errors";
-import { AuthorizationResponse } from "./types";
+import {
+  generateRandomAlphaNumericString,
+  hasStatusOrThrow,
+} from "../../../utils/misc";
 import { buildDirectPostBody } from "../common/utils/http";
-import { prepareVpToken } from "../../../sd-jwt";
-import { createCryptoContextFor } from "../../../utils/crypto";
-import { sdkConfigV1_3 } from "../../../utils/config";
-import { prepareVpTokenMdoc } from "../../../mdoc";
+import { mapSdkAuthorizationResponseError } from "./sdkErrorMapper";
+import { AuthorizationResponse } from "./types";
 
 /**
  * Prepares remote presentations for a set of credentials.
@@ -50,14 +52,14 @@ export const prepareRemotePresentations: RemotePresentationApi["prepareRemotePre
               item.credential,
               item.presentationFrame,
               createCryptoContextFor(item.keyTag),
-            ]
+            ],
           );
 
           return {
-            requestedClaims: item.requiredDisclosures.map(({ name }) => name),
             credentialId: item.id,
-            vpToken: vp_token,
             format,
+            requestedClaims: item.requiredDisclosures.map(({ name }) => name),
+            vpToken: vp_token,
           };
         }
 
@@ -73,24 +75,24 @@ export const prepareRemotePresentations: RemotePresentationApi["prepareRemotePre
               item.credential,
               item.presentationFrame,
               createCryptoContextFor(item.keyTag),
-            ]
+            ],
           );
 
           return {
-            requestedClaims: item.requiredDisclosures.map(({ name }) => name),
             credentialId: item.id,
-            vpToken: vp_token,
             format: "mso_mdoc",
+            requestedClaims: item.requiredDisclosures.map(({ name }) => name),
+            vpToken: vp_token,
           };
         }
 
         throw new IoWalletError(`${format} format is not supported.`);
-      })
+      }),
     );
 
     return {
-      presentations,
       generatedNonce,
+      presentations,
     };
   };
 
@@ -99,23 +101,29 @@ export const sendAuthorizationResponse: RemotePresentationApi["sendAuthorization
     requestObject,
     remotePresentation,
     rpConf,
-    { appFetch = fetch } = {}
+    { appFetch = fetch } = {},
   ) => {
     try {
       if (!rpConf && !requestObject.client_metadata) {
         throw new IoWalletError(
-          "At least one of rpConf or requestObject.client_metadata must be provided to send the authorization response"
+          "At least one of rpConf or requestObject.client_metadata must be provided to send the authorization response",
         );
       }
 
       // When the RP is not an OpenID Federation client, rpConf will be undefined
       // so the keys are taken from the Request Object's client_metadata.
+      const clientMetadata = requestObject.client_metadata;
+      const jwks = rpConf?.jwks ?? clientMetadata?.jwks;
+      if (!jwks) {
+        throw new IoWalletError(
+          "Missing jwks in both rpConf and requestObject.client_metadata",
+        );
+      }
       const rpJwks = {
-        jwks: rpConf?.jwks ?? requestObject.client_metadata!.jwks,
         encrypted_response_enc_values_supported:
           rpConf?.encrypted_response_enc_values_supported ??
-          requestObject.client_metadata!
-            .encrypted_response_enc_values_supported,
+          clientMetadata?.encrypted_response_enc_values_supported,
+        jwks,
       };
 
       const vp_token = remotePresentation.presentations.reduce(
@@ -123,24 +131,24 @@ export const sendAuthorizationResponse: RemotePresentationApi["sendAuthorization
           (acc[p.credentialId] ??= []).push(p.vpToken);
           return acc;
         },
-        {} as Record<string, string[]>
+        {} as Record<string, string[]>,
       );
 
       const { jarm } = await sdkCreateAuthorizationResponse({
-        config: sdkConfigV1_3,
-        requestObject,
-        rpJwks,
-        vp_token,
         callbacks: {
           encryptJwe: partialCallbacks.encryptJwe,
           generateRandom: partialCallbacks.generateRandom,
         },
+        config: sdkConfigV1_4,
+        requestObject,
+        rpJwks,
+        vp_token,
       });
 
       return await sdkFetchAuthorizationResponse({
         authorizationResponseJarm: jarm.responseJwe,
-        presentationResponseUri: requestObject.response_uri,
         callbacks: { fetch: appFetch },
+        presentationResponseUri: requestObject.response_uri,
       });
     } catch (err) {
       throw mapSdkAuthorizationResponseError(err);
@@ -151,7 +159,7 @@ export const sendAuthorizationErrorResponse: RemotePresentationApi["sendAuthoriz
   async (
     requestObject,
     { error, errorDescription },
-    { appFetch = fetch } = {}
+    { appFetch = fetch } = {},
   ) => {
     const requestBody = await buildDirectPostBody(requestObject, {
       error,
@@ -159,11 +167,11 @@ export const sendAuthorizationErrorResponse: RemotePresentationApi["sendAuthoriz
     });
 
     return await appFetch(requestObject.response_uri, {
-      method: "POST",
+      body: requestBody,
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
       },
-      body: requestBody,
+      method: "POST",
     })
       .then(hasStatusOrThrow(200, RelyingPartyResponseError))
       .then((res) => res.json())

package/src/credential/presentation/{v1.3.3 → v1.4.6}/index.ts

@@ -1,4 +1,5 @@
 import type { RemotePresentationApi } from "../api";
+
 import { startFlowFromQR } from "./01-start-flow";
 import { evaluateRelyingPartyTrust } from "./02-evaluate-rp-trust";
 import { getRequestObject } from "./03-get-request-object";
@@ -7,18 +8,18 @@ import { verifyRequestObject } from "./05-verify-request-object";
 import { evaluateDcqlQuery } from "./06-evaluate-dcql-query";
 import {
   prepareRemotePresentations,
-  sendAuthorizationResponse,
   sendAuthorizationErrorResponse,
+  sendAuthorizationResponse,
 } from "./07-send-authorization-response";
 
 export const RemotePresentation: RemotePresentationApi = {
-  startFlowFromQR,
+  evaluateDcqlQuery,
   evaluateRelyingPartyTrust,
   getRequestObject,
-  verifyAuthRequestCertificateChain,
-  verifyRequestObject,
-  evaluateDcqlQuery,
   prepareRemotePresentations,
-  sendAuthorizationResponse,
   sendAuthorizationErrorResponse,
+  sendAuthorizationResponse,
+  startFlowFromQR,
+  verifyAuthRequestCertificateChain,
+  verifyRequestObject,
 };

package/src/credential/presentation/{v1.3.3 → v1.4.6}/mappers.ts

@@ -1,7 +1,8 @@
-import { RelyingPartyEntityConfiguration } from "../../../trust/v1.3.3/types";
-import { createMapper } from "../../../utils/mappers";
 import type { RelyingPartyConfig } from "../api/RelyingPartyConfig";
 import type { RequestObject } from "../api/types";
+
+import { RelyingPartyEntityConfiguration } from "../../../trust/v1.4.6/types";
+import { createMapper } from "../../../utils/mappers";
 import { RawRequestObject } from "./types";
 
 export const mapToRelyingPartyConfig = createMapper<
@@ -11,26 +12,26 @@ export const mapToRelyingPartyConfig = createMapper<
   const { federation_entity, openid_credential_verifier } = payload.metadata;
 
   return {
-    subject: payload.sub,
-    jwks: openid_credential_verifier.jwks,
-    federation_entity,
     encrypted_response_enc_values_supported:
       openid_credential_verifier.encrypted_response_enc_values_supported,
+    federation_entity,
+    jwks: openid_credential_verifier.jwks,
+    subject: payload.sub,
   };
 });
 
 export const mapToRequestObject = createMapper<RawRequestObject, RequestObject>(
-  ({ payload, header }) => ({
-    iss: payload.iss ?? "",
+  ({ header, payload }) => ({
     client_id: payload.client_id,
+    client_metadata: payload.client_metadata,
     dcql_query: payload.dcql_query,
+    iss: payload.iss ?? "",
     nonce: payload.nonce,
-    response_uri: payload.response_uri,
-    state: payload.state,
     response_mode: payload.response_mode,
     response_type: payload.response_type,
-    client_metadata: payload.client_metadata,
-    x5c: header.x5c,
+    response_uri: payload.response_uri,
+    state: payload.state,
     trust_chain: header.trust_chain,
-  })
+    x5c: header.x5c,
+  }),
 );

package/src/credential/presentation/{v1.3.3 → v1.4.6}/sdkErrorMapper.ts

@@ -1,17 +1,19 @@
+import type { RelyingPartyResponseErrorCode } from "src/utils/error-codes";
+
 import { ValidationError as SdkValidationError } from "@openid4vc/utils";
+import { Oauth2JwtParseError as SdkOauth2JwtParseError } from "@pagopa/io-wallet-oauth2";
 import {
-  FetchAuthorizationResponseError as SdkFetchAuthorizationResponseError,
   CreateAuthorizationResponseError as SdkCreateAuthorizationResponseError,
+  FetchAuthorizationResponseError as SdkFetchAuthorizationResponseError,
 } from "@pagopa/io-wallet-oid4vp";
+import { UnexpectedStatusCodeError as SdkUnexpectedStatusCodeError } from "@pagopa/io-wallet-utils";
+
 import {
   RelyingPartyResponseError,
   RelyingPartyResponseErrorCodes,
   ResponseErrorBuilder,
 } from "../../../utils/errors";
-import { Oauth2JwtParseError as SdkOauth2JwtParseError } from "@pagopa/io-wallet-oauth2";
 import { InvalidRequestObjectError } from "../common/errors";
-import { UnexpectedStatusCodeError as SdkUnexpectedStatusCodeError } from "@pagopa/io-wallet-utils";
-import type { RelyingPartyResponseErrorCode } from "src/utils/error-codes";
 
 /**
  * Helper to create a generic RelyingPartyResponseError
@@ -19,7 +21,7 @@ import type { RelyingPartyResponseErrorCode } from "src/utils/error-codes";
 const toRelyingPartyResponseError = (
   message: string,
   statusCode: number,
-  code: RelyingPartyResponseErrorCode = RelyingPartyResponseErrorCodes.RelyingPartyGenericError
+  code: RelyingPartyResponseErrorCode = RelyingPartyResponseErrorCodes.RelyingPartyGenericError,
 ) =>
   new RelyingPartyResponseError({
     code,
@@ -46,13 +48,13 @@ export const mapSdkRequestObjectError = (err: unknown) => {
   if (err instanceof SdkValidationError) {
     throw new InvalidRequestObjectError(
       "The Request Object structure is invalid",
-      err.message
+      err.message,
     );
   }
 
   if (err instanceof SdkOauth2JwtParseError) {
     throw new InvalidRequestObjectError(
-      "The Request Object is not a valid JWT"
+      "The Request Object is not a valid JWT",
     );
   }
 

package/src/credential/status/README.md

@@ -2,7 +2,7 @@
 
 This flow is used to obtain the credential status from its credential issuer. The following methods are currently supported:
 - Status Assertion (v1.0.0)
-- Token Status List (v1.3.3)
+- Token Status List (v1.4.6)
 
 Each step in the flow is imported from the related file which is named with a sequential number.
 
@@ -100,7 +100,7 @@ return {
 ```ts
 import { IoWallet } from "@pagopa/io-react-native-wallet";
 
-const wallet = new IoWallet({ version: "1.3.3" });
+const wallet = new IoWallet({ version: "1.4.6" });
 
 const credentialIssuerUrl = "https://issuer.example.com";
 

package/src/credential/status/api/index.ts

@@ -1,10 +1,6 @@
 import type { StatusAssertionApi } from "./status-assertion";
 import type { StatusListApi } from "./status-list";
 
-interface UnsupportedApi {
-  isSupported: false;
-}
-
 /**
  * Credential status API. It supports status assertion and status list.
  *
@@ -22,4 +18,8 @@ export interface CredentialStatusApi {
   statusList: StatusListApi | UnsupportedApi;
 }
 
+interface UnsupportedApi {
+  isSupported: false;
+}
+
 export * from "./types";

package/src/credential/status/api/status-assertion.ts

@@ -1,12 +1,11 @@
 import type { CryptoContext } from "@pagopa/io-react-native-jwt";
-import type { CredentialFormat, IssuerConfig } from "../../issuance/api";
+
 import type { SupportedSdJwtLegacyFormat } from "../../../sd-jwt/types";
 import type { Out } from "../../../utils/misc";
+import type { CredentialFormat, IssuerConfig } from "../../issuance/api";
 import type { ParsedStatusAssertion } from "./types";
 
 export interface StatusAssertionApi {
-  isSupported: true;
-
   /**
    * Get the status assertion of a digital credential.
    * @since 1.0.0
@@ -26,12 +25,14 @@ export interface StatusAssertionApi {
     credential: string,
     format: CredentialFormat | SupportedSdJwtLegacyFormat,
     context: {
+      appFetch?: GlobalFetch["fetch"];
       credentialCryptoContext: CryptoContext;
       wiaCryptoContext: CryptoContext;
-      appFetch?: GlobalFetch["fetch"];
-    }
+    },
   ): Promise<{ statusAssertion: string }>;
 
+  isSupported: true;
+
   /**
    * Given a status assertion, verifies that:
    * - It's in the supported format;
@@ -52,6 +53,6 @@ export interface StatusAssertionApi {
     issuerConf: IssuerConfig,
     statusAssertion: Out<StatusAssertionApi["get"]>,
     credential: string,
-    format: CredentialFormat | SupportedSdJwtLegacyFormat
+    format: CredentialFormat | SupportedSdJwtLegacyFormat,
   ): Promise<{ parsedStatusAssertion: ParsedStatusAssertion }>;
 }

package/src/credential/status/api/status-list.ts

@@ -3,8 +3,6 @@ import type { JWK } from "../../../utils/jwk";
 import type { StatusList } from "./types";
 
 export interface StatusListApi {
-  isSupported: true;
-
   /**
    * Get the status list token referenced by a credential. This function fetches the list
    * from the uri found in the credential's `status` claim.
@@ -28,12 +26,12 @@ export interface StatusListApi {
     format: CredentialFormat,
     context?: {
       appFetch?: GlobalFetch["fetch"];
-    }
+    },
   ): Promise<{
-    statusList: string;
     format: "jwt";
-    uri: string;
     idx: number;
+    statusList: string;
+    uri: string;
   }>;
 
   /**
@@ -47,18 +45,9 @@ export interface StatusListApi {
     uri: string,
     context?: {
       appFetch?: GlobalFetch["fetch"];
-    }
+    },
   ): Promise<string>;
 
-  /**
-   * Verifies the signature of a status list token and parses its payload.
-   * @since 1.3.3
-   * @param keys The JSON Web Key Set to verify the status list signature
-   * @param statusList The encoded status list token
-   * @returns The decoded status list payload
-   */
-  verifyAndParse(keys: JWK[], statusList: string): Promise<StatusList>;
-
   /**
    * Extracts the status at the specified index from a decoded status list.
    * @since 1.3.3
@@ -68,7 +57,7 @@ export interface StatusListApi {
    */
   getStatus(
     statusList: StatusList["status_list"],
-    idx: number
+    idx: number,
   ): {
     rawStatus: string;
     status: string;
@@ -85,6 +74,17 @@ export interface StatusListApi {
    */
   getStatusListEntry(
     credential: string,
-    format: CredentialFormat
+    format: CredentialFormat,
   ): Promise<{ idx: number; uri: string }>;
+
+  isSupported: true;
+
+  /**
+   * Verifies the signature of a status list token and parses its payload.
+   * @since 1.3.3
+   * @param keys The JSON Web Key Set to verify the status list signature
+   * @param statusList The encoded status list token
+   * @returns The decoded status list payload
+   */
+  verifyAndParse(keys: JWK[], statusList: string): Promise<StatusList>;
 }

package/src/credential/status/api/types.ts

@@ -1,21 +1,22 @@
 import { z } from "zod";
+
 import { UnixTime } from "../../../utils/zod";
 
 /**
  * Common type for a parsed Status Assertion
  */
-export type ParsedStatusAssertion = {
-  iss: string;
-  iat: number;
-  exp: number;
+export interface ParsedStatusAssertion {
   credential_hash: string;
   credential_hash_alg: string;
-  credential_status_type: string;
   credential_status_detail?: {
-    state: string;
     description: string;
+    state: string;
   };
-};
+  credential_status_type: string;
+  exp: number;
+  iat: number;
+  iss: string;
+}
 
 const StatusListBits = z.union([
   z.literal(1),
@@ -26,17 +27,17 @@ const StatusListBits = z.union([
 
 export type StatusListContent = z.infer<typeof StatusListContent>;
 export const StatusListContent = z.object({
+  aggregation_uri: z.url().optional(),
   bits: StatusListBits,
   lst: z.string().min(1),
-  aggregation_uri: z.url().optional(),
 });
 
 export type StatusList = z.infer<typeof StatusList>;
 export const StatusList = z.object({
-  sub: z.url(),
+  exp: UnixTime.optional(),
   iat: UnixTime,
   iss: z.url().optional(),
-  exp: UnixTime.optional(),
-  ttl: z.number().positive().optional(),
   status_list: StatusListContent,
+  sub: z.url(),
+  ttl: z.number().positive().optional(),
 });

package/src/credential/status/index.ts

@@ -1,3 +1,3 @@
 export * from "./api";
 export { CredentialStatus as V1_0_0 } from "./v1.0.0";
-export { CredentialStatus as V1_3_3 } from "./v1.3.3";
+export { CredentialStatus as V1_4_6 } from "./v1.4.6";

package/src/credential/status/v1.0.0/01-status-assertion.ts

@@ -1,10 +1,9 @@
-import {
-  getCredentialHashWithouDiscloures,
-  hasStatusOrThrow,
-} from "../../../utils/misc";
 import { SignJWT } from "@pagopa/io-react-native-jwt";
 import { v4 as uuidv4 } from "uuid";
-import { StatusAssertionResponse } from "./types";
+
+import type { StatusAssertionApi } from "../api/status-assertion";
+
+import { extractJwkFromCredential } from "../../../utils/credentials";
 import {
   IoWalletError,
   IssuerResponseError,
@@ -13,16 +12,19 @@ import {
   UnexpectedStatusCodeError,
 } from "../../../utils/errors";
 import { Logger, LogLevel } from "../../../utils/logging";
-import { extractJwkFromCredential } from "../../../utils/credentials";
-import type { StatusAssertionApi } from "../api/status-assertion";
+import {
+  getCredentialHashWithouDiscloures,
+  hasStatusOrThrow,
+} from "../../../utils/misc";
+import { StatusAssertionResponse } from "./types";
 
 export const getStatusAssertion: StatusAssertionApi["get"] = async (
   issuerConf,
   credential,
   format,
-  ctx
+  ctx,
 ) => {
-  const { credentialCryptoContext, wiaCryptoContext, appFetch = fetch } = ctx;
+  const { appFetch = fetch, credentialCryptoContext, wiaCryptoContext } = ctx;
 
   const jwk = await extractJwkFromCredential(credential, format);
   const issuerJwk = await wiaCryptoContext.getPublicKey();
@@ -31,22 +33,22 @@ export const getStatusAssertion: StatusAssertionApi["get"] = async (
 
   if (!statusAttUrl) {
     throw new IoWalletError(
-      "Status assertion endpoint not found in the Issuer configuration"
+      "Status assertion endpoint not found in the Issuer configuration",
     );
   }
 
   const credentialPop = await new SignJWT(credentialCryptoContext)
     .setPayload({
-      iss: issuerJwk.kid,
       aud: statusAttUrl,
-      jti: uuidv4().toString(),
       credential_hash: credentialHash,
       credential_hash_alg: "sha-256",
+      iss: issuerJwk.kid,
+      jti: uuidv4().toString(),
     })
     .setProtectedHeader({
       alg: "ES256",
-      typ: "status-assertion-request+jwt",
       kid: jwk.kid,
+      typ: "status-assertion-request+jwt",
     })
     .setIssuedAt()
     .setExpirationTime("5m")
@@ -59,11 +61,11 @@ export const getStatusAssertion: StatusAssertionApi["get"] = async (
   Logger.log(LogLevel.DEBUG, `Credential pop: ${credentialPop}`);
 
   const result = await appFetch(statusAttUrl, {
-    method: "POST",
+    body: JSON.stringify(body),
     headers: {
       "Content-Type": "application/json",
     },
-    body: JSON.stringify(body),
+    method: "POST",
   })
     .then(hasStatusOrThrow(200))
     .then((raw) => raw.json())
@@ -72,7 +74,11 @@ export const getStatusAssertion: StatusAssertionApi["get"] = async (
 
   const [statusAttestationJwt] = result.status_assertion_responses;
 
-  return { statusAssertion: statusAttestationJwt! };
+  if (!statusAttestationJwt) {
+    throw new IoWalletError("Status assertion response is empty");
+  }
+
+  return { statusAssertion: statusAttestationJwt };
 };
 
 /**