@pagopa/io-react-native-wallet 3.6.3 → 3.7.0

package/src/{wallet-unit-attestation → key-attestation}/api/index.ts

@@ -1,51 +1,49 @@
-import type { IntegrityContext } from "../../utils/integrity";
 import type { KeyAttestationCryptoContext } from "../../utils/crypto";
+import type { IntegrityContext } from "../../utils/integrity";
 import type {
-  DecodedWalletUnitAttestation,
+  DecodedKeyAttestation,
   WalletAttestation,
   WalletAttestationRequestParams,
 } from "./types";
 
-interface UnsupportedApi {
-  isSupported: false;
-}
-
-export type WalletUnitAttestationApi =
-  | WalletUnitAttestationSupportedApi
-  | UnsupportedApi;
+export type KeyAttestationApi = KeyAttestationSupportedApi | UnsupportedApi;
 
-export interface WalletUnitAttestationSupportedApi {
-  isSupported: true;
+export interface KeyAttestationSupportedApi {
+  /**
+   * Decode a given JWT to get the parsed Key Attestation object they define.
+   * It ensures provided data is in a valid shape.
+   *
+   * It DOES NOT verify token signature.
+   *
+   * @param token The encoded token that represents a valid jwt for Key Attestation
+   * @returns The validated Key Attestation object
+   * @throws A decoding error if the token doesn't resolve in a valid JWT
+   * @throws A validation error if the provided data doesn't result in a valid Key Attestation
+   */
+  decode(token: string): DecodedKeyAttestation;
 
   /**
-   * Request a Wallet Unit Attestation (WUA) to the Wallet provider with one or more keys to attest.
+   * Request a Key Attestation (KA) to the Wallet provider with one or more keys to attest.
    * Each key must be provided as a {@link KeyAttestationCryptoContext}.
    *
    * @param requestParams Wallet Provider data for the Wallet Attestation request
    * @param ctx.keysToAttest The list of KeyAttestationCryptoContext's of the keys to attest
    * @param ctx.integrityContext The hardware key pair associated with the Wallet Instance
    * @param ctx.appFetch (optional) Http client
-   * @returns The generated Wallet Unit Attestation with the attested keys
+   * @returns The generated Key Attestation with the attested keys
    */
   getAttestation(
     requestParams: WalletAttestationRequestParams,
     ctx: {
-      keysToAttest: KeyAttestationCryptoContext[];
-      integrityContext: IntegrityContext;
       appFetch?: GlobalFetch["fetch"];
-    }
+      integrityContext: IntegrityContext;
+      keysToAttest: KeyAttestationCryptoContext[];
+    },
   ): Promise<WalletAttestation>;
 
-  /**
-   * Decode a given JWT to get the parsed Wallet Unit Attestation object they define.
-   * It ensures provided data is in a valid shape.
-   *
-   * It DOES NOT verify token signature.
-   *
-   * @param token The encoded token that represents a valid jwt for Wallet Unit Attestation
-   * @returns The validated Wallet Unit Attestation object
-   * @throws A decoding error if the token doesn't resolve in a valid JWT
-   * @throws A validation error if the provided data doesn't result in a valid Wallet Unit Attestation
-   */
-  decode(token: string): DecodedWalletUnitAttestation;
+  isSupported: true;
+}
+
+interface UnsupportedApi {
+  isSupported: false;
 }

package/src/{wallet-unit-attestation → key-attestation}/api/types.ts

@@ -1,6 +1,7 @@
 import * as z from "zod";
-import { UnixTime } from "../../utils/zod";
+
 import { JWK } from "../../utils/jwk";
+import { UnixTime } from "../../utils/zod";
 
 const Status = z.object({
   status_list: z.object({
@@ -10,29 +11,27 @@ const Status = z.object({
 });
 
 /**
- * Common Wallet Unit Attestation shape. This object is
+ * Common Key Attestation shape. This object is
  * an abstraction over the version-specific JWTs.
  */
-export type DecodedWalletUnitAttestation = z.infer<
-  typeof DecodedWalletUnitAttestation
->;
-export const DecodedWalletUnitAttestation = z.object({
+export type DecodedKeyAttestation = z.infer<typeof DecodedKeyAttestation>;
+export const DecodedKeyAttestation = z.object({
   attested_keys: z.array(JWK),
-  user_authentication: z.array(z.string()),
+  exp: UnixTime,
+  iat: UnixTime,
+  iss: z.string(),
   key_storage: z.array(z.string()),
   status: Status,
-  iss: z.string(),
-  iat: UnixTime,
-  exp: UnixTime,
+  user_authentication: z.array(z.string()),
 });
 
-export type WalletAttestation = {
-  format: string;
+export interface WalletAttestation {
   attestation: string;
-};
+  format: string;
+}
 
-export type WalletAttestationRequestParams = {
+export interface WalletAttestationRequestParams {
   walletProviderBaseUrl: string;
   walletSolutionId: string;
   walletSolutionVersion: string;
-};
+}

package/src/key-attestation/index.ts

@@ -0,0 +1,3 @@
+export type * from "./api";
+export { KeyAttestation as V1_0_0 } from "./v1.0.0";
+export { KeyAttestation as V1_4_6 } from "./v1.4.6";

package/src/key-attestation/v1.0.0/index.ts

@@ -0,0 +1,5 @@
+import type { KeyAttestationApi } from "../api";
+
+export const KeyAttestation: KeyAttestationApi = {
+  isSupported: false,
+};

package/src/key-attestation/v1.4.6/index.ts

@@ -0,0 +1,12 @@
+import type { KeyAttestationApi } from "../api";
+
+import { withMapper } from "../../utils/mappers";
+import { getAttestation } from "./issuing";
+import { mapToDecodedKeyAttestation } from "./mappers";
+import { decode } from "./utils";
+
+export const KeyAttestation: KeyAttestationApi = {
+  decode: withMapper(mapToDecodedKeyAttestation, decode),
+  getAttestation,
+  isSupported: true,
+};

package/src/{wallet-unit-attestation/v1.3.3 → key-attestation/v1.4.6}/issuing.ts

@@ -1,12 +1,14 @@
-import { Platform } from "react-native";
 import { SignJWT, thumbprint } from "@pagopa/io-react-native-jwt";
-import { Logger, LogLevel } from "../../utils/logging";
+import { Platform } from "react-native";
+
+import type { KeyAttestationCryptoContext } from "../../utils/crypto";
+import type { KeyAttestationSupportedApi } from "../api";
+
 import { getWalletProviderClient } from "../../client";
-import { fixBase64EncodingOnKey, JWK } from "../../utils/jwk";
 import { IoWalletError } from "../../utils/errors";
-import type { KeyAttestationCryptoContext } from "../../utils/crypto";
-import type { WalletUnitAttestationSupportedApi } from "../api";
-import { WalletUnitAttestationResponse } from "./types";
+import { fixBase64EncodingOnKey, JWK } from "../../utils/jwk";
+import { Logger, LogLevel } from "../../utils/logging";
+import { KeyAttestationResponse } from "./types";
 
 /**
  * Create a Key Attestation Request in JWT format for the provided key.
@@ -16,20 +18,20 @@ import { WalletUnitAttestationResponse } from "./types";
  */
 const createKeyAttestationRequest = async (
   challenge: string,
-  cryptoContext: KeyAttestationCryptoContext
+  cryptoContext: KeyAttestationCryptoContext,
 ) => {
-  const { success, attestation } =
+  const { attestation, success } =
     await cryptoContext.generateKeyWithAttestation(challenge);
 
   if (!success) {
     throw new IoWalletError(
-      "generateKeyWithAttestation failed to generate a cryptographic key for the Wallet Unit Attestation request"
+      "generateKeyWithAttestation failed to generate a cryptographic key for the Key Attestation request",
     );
   }
 
   if (Platform.OS === "android" && !attestation) {
     throw new IoWalletError(
-      "Missing key attestation: on Android the generated key must have a key attestation to request a Wallet Unit Attestation"
+      "Missing Android key attestation: the generated key pair must be hardware-backed",
     );
   }
 
@@ -37,13 +39,13 @@ const createKeyAttestationRequest = async (
 
   const requestJwt = await new SignJWT(cryptoContext)
     .setPayload({
+      cnf: {
+        jwk: fixBase64EncodingOnKey(publicKey),
+      },
       wscd_key_attestation: {
         storage_type: "LOCAL_NATIVE",
         ...(attestation && { attestation }),
       },
-      cnf: {
-        jwk: fixBase64EncodingOnKey(publicKey),
-      },
     })
     .setProtectedHeader({
       kid: publicKey.kid,
@@ -53,65 +55,71 @@ const createKeyAttestationRequest = async (
     .setExpirationTime("1h")
     .sign();
 
-  return { cryptoContext, publicKey, keyAttestationRequestJwt: requestJwt };
+  return { cryptoContext, keyAttestationRequestJwt: requestJwt, publicKey };
 };
 
-export const getAttestation: WalletUnitAttestationSupportedApi["getAttestation"] =
+export const getAttestation: KeyAttestationSupportedApi["getAttestation"] =
   async (
     { walletProviderBaseUrl, walletSolutionId, walletSolutionVersion },
-    { keysToAttest: keysToAttestContexts, integrityContext, appFetch = fetch }
+    { appFetch = fetch, integrityContext, keysToAttest: keysToAttestContexts },
   ) => {
     if (keysToAttestContexts.length === 0) {
       throw new IoWalletError("At least one key to attest must be provided");
     }
 
-    const api = getWalletProviderClient({ walletProviderBaseUrl, appFetch });
+    const api = getWalletProviderClient({ appFetch, walletProviderBaseUrl });
 
     const { nonce } = await api.get("/nonce");
     Logger.log(
       LogLevel.DEBUG,
-      `Challenge obtained from ${walletProviderBaseUrl}: ${nonce}`
+      `Challenge obtained from ${walletProviderBaseUrl}: ${nonce}`,
     );
 
     const keysToAttest = await Promise.all(
       keysToAttestContexts.map((cryptoContext) =>
-        createKeyAttestationRequest(nonce, cryptoContext)
-      )
+        createKeyAttestationRequest(nonce, cryptoContext),
+      ),
     );
 
     // Use the first key to attest to sign the WUA Request JWT
-    const signatureKey = keysToAttest.at(0)!;
+    const signatureKey = keysToAttest.at(0);
+
+    if (!signatureKey) {
+      throw new IoWalletError(
+        "No signature key available for signing the WUA request",
+      );
+    }
 
     const hardwareKeyTag = integrityContext.getHardwareKeyTag();
 
     const clientData = {
       challenge: nonce,
       jwk_thumbprints: await Promise.all(
-        keysToAttest.map((k) => thumbprint(k.publicKey))
+        keysToAttest.map((k) => thumbprint(k.publicKey)),
       ),
     };
 
-    const { signature, authenticatorData } =
+    const { authenticatorData, signature } =
       await integrityContext.getHardwareSignatureWithAuthData(
-        JSON.stringify(clientData)
+        JSON.stringify(clientData),
       );
 
     const signedAttestationRequest = await new SignJWT(
-      signatureKey.cryptoContext
+      signatureKey.cryptoContext,
     )
       .setPayload({
-        nonce,
+        cnf: {
+          jwk: fixBase64EncodingOnKey(signatureKey.publicKey),
+        },
         hardware_key_tag: hardwareKeyTag,
-        iss: hardwareKeyTag,
-        keys_to_attest: keysToAttest.map((k) => k.keyAttestationRequestJwt),
         hardware_signature: signature,
         integrity_assertion: authenticatorData,
+        iss: hardwareKeyTag,
+        keys_to_attest: keysToAttest.map((k) => k.keyAttestationRequestJwt),
+        nonce,
         platform: Platform.OS,
         wallet_solution_id: walletSolutionId,
         wallet_solution_version: walletSolutionVersion,
-        cnf: {
-          jwk: fixBase64EncodingOnKey(signatureKey.publicKey),
-        },
       })
       .setProtectedHeader({
         kid: signatureKey.publicKey.kid,
@@ -123,25 +131,25 @@ export const getAttestation: WalletUnitAttestationSupportedApi["getAttestation"]
 
     Logger.log(
       LogLevel.DEBUG,
-      `Signed attestation request: ${signedAttestationRequest}`
+      `Signed attestation request: ${signedAttestationRequest}`,
     );
 
     const response = await api
       .post("/key-attestations", {
+        body: signedAttestationRequest,
         header: {
           "Content-Type": "text/plain",
         },
-        body: signedAttestationRequest,
       })
-      .then(WalletUnitAttestationResponse.parse);
+      .then(KeyAttestationResponse.parse);
 
     Logger.log(
       LogLevel.DEBUG,
-      `Obtained Wallet Unit Attestation: ${response.key_attestation}`
+      `Obtained Key Attestation: ${response.key_attestation}`,
     );
 
     return {
-      format: "jwt",
       attestation: response.key_attestation,
+      format: "jwt",
     };
   };

package/src/key-attestation/v1.4.6/mappers.ts

@@ -0,0 +1,10 @@
+import { createMapper } from "../../utils/mappers";
+import { DecodedKeyAttestation } from "../api/types";
+import { KeyAttestationJwt } from "./types";
+
+export const mapToDecodedKeyAttestation = createMapper<
+  KeyAttestationJwt,
+  DecodedKeyAttestation
+>((x) => x.payload, {
+  outputSchema: DecodedKeyAttestation,
+});

package/src/key-attestation/v1.4.6/types.ts

@@ -0,0 +1,20 @@
+import * as z from "zod";
+
+import { Jwt } from "../../wallet-instance-attestation/common/types";
+import { DecodedKeyAttestation } from "../api/types";
+
+export type KeyAttestationJwt = z.infer<typeof KeyAttestationJwt>;
+export const KeyAttestationJwt = z.object({
+  header: z.intersection(
+    Jwt.shape.header,
+    z.object({
+      typ: z.literal("key-attestation+jwt"),
+    }),
+  ),
+  payload: DecodedKeyAttestation, // The payload type matches the public API
+});
+
+export type KeyAttestationResponse = z.infer<typeof KeyAttestationResponse>;
+export const KeyAttestationResponse = z.object({
+  key_attestation: z.string(),
+});

package/src/{wallet-unit-attestation/v1.3.3 → key-attestation/v1.4.6}/utils.ts

@@ -1,13 +1,14 @@
 import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
-import { WalletUnitAttestationJwt } from "./types";
+
+import { KeyAttestationJwt } from "./types";
 
 /**
- * Decode a given JWT to get the parsed Wallet Unit Attestation object they define.
+ * Decode a given JWT to get the parsed Key Attestation object they define.
  * It ensures the provided data is in a valid shape, but it DOES NOT verify the signature.
  */
-export function decode(token: string): WalletUnitAttestationJwt {
+export function decode(token: string): KeyAttestationJwt {
   const decodedJwt = decodeJwt(token);
-  return WalletUnitAttestationJwt.parse({
+  return KeyAttestationJwt.parse({
     header: decodedJwt.protectedHeader,
     payload: decodedJwt.payload,
   });

package/src/mdoc/index.ts

@@ -1,17 +1,19 @@
+import { type PublicKey } from "@pagopa/io-react-native-crypto";
 import { CBOR, COSE, ISO18013_7 } from "@pagopa/io-react-native-iso18013";
+import { removePadding } from "@pagopa/io-react-native-jwt";
 import { b64utob64 } from "jsrsasign";
-import { type PublicKey } from "@pagopa/io-react-native-crypto";
+
+import type { Presentation } from "../credential/presentation";
+
 import { MissingX509CertsError } from "../trust/common/errors";
-import { IoWalletError } from "../utils/errors";
 import { convertBase64DerToPem, getSigninJwkFromCert } from "../utils/crypto";
-import type { Presentation } from "../credential/presentation";
-import { removePadding } from "@pagopa/io-react-native-jwt";
+import { IoWalletError } from "../utils/errors";
 import { verifyX509Chain } from "../utils/x509";
 export * from "./utils";
 
 export const verify = async (
   token: string,
-  x509CertRoot: string
+  x509CertRoot: string,
 ): Promise<{ issuerSigned: CBOR.IssuerSigned }> => {
   // get decoded data
   const issuerSigned = await CBOR.decodeIssuerSigned(token);
@@ -37,8 +39,15 @@ export const verify = async (
   if (!coseSign1) {
     throw new IoWalletError("Missing coseSign1");
   }
+
+  const firstCert = x5chain[0];
+
+  if (!firstCert) {
+    throw new IoWalletError("x5chain is empty, cannot verify signature");
+  }
+
   // Once the x5chain is verified, the signatures verification can be performed
-  await verifyMdocSignature(coseSign1, x5chain[0]!);
+  await verifyMdocSignature(coseSign1, firstCert);
 
   return { issuerSigned };
 };
@@ -54,8 +63,14 @@ const verifyMdocSignature = async (coseSign1: string, cert: string) => {
   const pemcert = convertBase64DerToPem(cert);
   const jwk = getSigninJwkFromCert(pemcert);
 
-  jwk.x = b64utob64(jwk.x!);
-  jwk.y = b64utob64(jwk.y!);
+  if (!jwk.x || !jwk.y) {
+    throw new IoWalletError(
+      "Missing x or y coordinate in the certificate's public key",
+    );
+  }
+
+  jwk.x = b64utob64(jwk.x);
+  jwk.y = b64utob64(jwk.y);
 
   const signatureCorrect = await COSE.verify(coseSign1, jwk as PublicKey);
 
@@ -69,16 +84,16 @@ export const prepareVpTokenMdoc = async (
   responseUri: string,
   docType: string,
   keyTag: string,
-  [verifiableCredential, presentationFrame]: Presentation
+  [verifiableCredential, presentationFrame]: Presentation,
 ): Promise<{
   vp_token: string;
 }> => {
   /* verifiableCredential is a IssuerSigned structure */
   const documents = [
     {
-      issuerSignedContent: b64utob64(verifiableCredential),
       alias: keyTag,
       docType,
+      issuerSignedContent: b64utob64(verifiableCredential),
     },
   ];
 
@@ -90,7 +105,7 @@ export const prepareVpTokenMdoc = async (
     requestNonce,
     generatedNonce,
     documents,
-    presentationFrame as ISO18013_7.AcceptedFields
+    presentationFrame as ISO18013_7.AcceptedFields,
   );
 
   return {

package/src/mdoc/utils.ts

@@ -1,7 +1,9 @@
 import { CBOR } from "@pagopa/io-react-native-iso18013";
-import { Verification } from "../sd-jwt/types";
+
 import type { IssuanceApi } from "../credential/issuance";
 import type { Out } from "../utils/misc";
+
+import { Verification } from "../sd-jwt/types";
 import { MDOC_VERIFICATION_IDENTIFIER } from "./const";
 
 /**
@@ -23,10 +25,10 @@ export const getParsedCredentialClaimKey = (namespace: string, key: string) =>
 export const getVerificationFromParsedCredential = (
   parsedCredential: Out<
     IssuanceApi["verifyAndParseCredential"]
-  >["parsedCredential"]
+  >["parsedCredential"],
 ) => {
   const verificationKey = Object.keys(parsedCredential).find((key) =>
-    key.endsWith(MDOC_VERIFICATION_IDENTIFIER)
+    key.endsWith(MDOC_VERIFICATION_IDENTIFIER),
   );
   const verification = verificationKey
     ? parsedCredential[verificationKey]?.value
@@ -48,7 +50,7 @@ export const getVerification = async (token: string) => {
   const flattenedClaims = Object.values(issuerSigned.nameSpaces).flat();
 
   const verification = flattenedClaims?.find(
-    (x) => x.elementIdentifier === MDOC_VERIFICATION_IDENTIFIER
+    (x) => x.elementIdentifier === MDOC_VERIFICATION_IDENTIFIER,
   )?.elementValue;
 
   return verification ? Verification.parse(verification) : undefined;

package/src/sd-jwt/__test__/types.test.ts

@@ -7,20 +7,20 @@ describe("Verification.time", () => {
     ["unix milliseconds", 1752122400000],
   ])("accepts %s", (_label, time) => {
     const value = {
-      trust_framework: "eidas",
       assurance_level: "high",
       evidence: [
         {
-          type: "vouch",
-          time,
           attestation: {
-            type: "digital_attestation",
-            reference_number: "abc",
             date_of_issuance: "2025-09-02",
+            reference_number: "abc",
+            type: "digital_attestation",
             voucher: { organization: "IPZS" },
           },
+          time,
+          type: "vouch",
         },
       ],
+      trust_framework: "eidas",
     };
 
     expect(Verification.safeParse(value).success).toBe(true);
@@ -28,8 +28,8 @@ describe("Verification.time", () => {
 
   it("rejects invalid type", () => {
     const value = {
-      trust_framework: ["eidas"],
       assurance_level: "high",
+      trust_framework: ["eidas"],
     };
 
     expect(Verification.safeParse(value).success).toBe(false);

package/src/sd-jwt/__test__/utils.test.ts

@@ -1,11 +1,11 @@
-import { legacyPid, pid } from "../__mocks__/sd-jwt";
 import { getVerification } from "..";
+import { legacyPid, pid } from "../__fixtures__/sd-jwt";
 
 describe("SD-JWT getVerification", () => {
   it("extracts the verification claims correctly", () => {
     expect(getVerification(pid)).toEqual({
-      trust_framework: "it_cie",
       assurance_level: "high",
+      trust_framework: "it_cie",
     });
   });
 

package/src/sd-jwt/index.ts

@@ -1,9 +1,11 @@
 import { sha256ToBase64, SignJWT } from "@pagopa/io-react-native-jwt";
+import { digest } from "@sd-jwt/crypto-nodejs";
 import { decodeSdJwtSync } from "@sd-jwt/decode";
 import { present } from "@sd-jwt/present";
-import { digest } from "@sd-jwt/crypto-nodejs";
-import { fixLegacyCredentialSdJwt } from "../utils/credentials";
+
 import type { Presentation } from "../credential/presentation";
+
+import { fixLegacyCredentialSdJwt } from "../utils/credentials";
 import { SdJwt4VCBase } from "./types";
 
 export * from "./utils";
@@ -25,10 +27,10 @@ export const decode = (token: string) => {
     payload: decoded.jwt.payload,
   });
   const disclosures = decoded.disclosures.map((disclosure) => ({
-    encoded: disclosure._digest,
     decoded: [disclosure.salt, disclosure.key, disclosure.value],
+    encoded: disclosure._digest,
   }));
-  return { sdJwt, disclosures };
+  return { disclosures, sdJwt };
 };
 
 /**
@@ -49,7 +51,7 @@ export const decode = (token: string) => {
 export const prepareVpToken = async (
   nonce: string,
   client_id: string,
-  [verifiableCredential, presentationFrame, cryptoContext]: Presentation
+  [verifiableCredential, presentationFrame, cryptoContext]: Presentation,
 ): Promise<{
   vp_token: string;
 }> => {
@@ -57,7 +59,7 @@ export const prepareVpToken = async (
   const vp = await present(
     fixLegacyCredentialSdJwt(verifiableCredential),
     presentationFrame,
-    digest
+    digest,
   );
 
   // <Issuer-signed JWT>~<Disclosure 1>~<Disclosure N>~
@@ -65,12 +67,12 @@ export const prepareVpToken = async (
 
   const kbJwt = await new SignJWT(cryptoContext)
     .setProtectedHeader({
-      typ: "kb+jwt",
       alg: "ES256",
+      typ: "kb+jwt",
     })
     .setPayload({
-      sd_hash,
       nonce: nonce,
+      sd_hash,
     })
     .setAudience(client_id)
     .setIssuedAt()