@pagopa/io-react-native-wallet 3.6.3 → 3.7.0

package/src/sd-jwt/types.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
-import { UnixTime } from "../utils/zod";
+
 import { JWK } from "../utils/jwk";
+import { UnixTime } from "../utils/zod";
 
 /**
  * For backward compatibility reasons it is still necessary to support the legacy SD-JWT
@@ -25,23 +26,22 @@ const StatusList = z.object({
 export type SdJwt4VCBase = z.infer<typeof SdJwt4VCBase>;
 export const SdJwt4VCBase = z.object({
   header: z.object({
-    typ: z.enum(["dc+sd-jwt", LEGACY_SD_JWT]),
     alg: z.string(),
     kid: z.string(),
     trust_chain: z.array(z.string()).optional(),
-    x5c: z.array(z.string()).optional(),
+    typ: z.enum(["dc+sd-jwt", LEGACY_SD_JWT]),
     vctm: z.array(z.string()).optional(),
+    x5c: z.array(z.string()).optional(),
   }),
   payload: z.object({
     _sd: z.array(z.string()),
     _sd_alg: z.literal("sha-256"),
-    iss: z.string(),
-    sub: z.string(),
-    iat: UnixTime.optional(),
-    exp: UnixTime,
     cnf: z.object({
       jwk: JWK,
     }),
+    exp: UnixTime,
+    iat: UnixTime.optional(),
+    iss: z.string(),
     status: z.union([
       z.object({
         status_list: StatusList,
@@ -51,6 +51,7 @@ export const SdJwt4VCBase = z.object({
         status_assertion: StatusAssertion,
       }),
     ]),
+    sub: z.string(),
     vct: z.string(),
     "vct#integrity": z.string().optional(),
   }),
@@ -62,8 +63,8 @@ export const SdJwt4VCBase = z.object({
  */
 export type Verification = z.infer<typeof Verification>;
 export const Verification = z.object({
-  trust_framework: z.string(),
   assurance_level: z.string(),
+  trust_framework: z.string(),
 });
 
 /**
@@ -73,16 +74,16 @@ export const Verification = z.object({
  */
 export type TypeMetadata = z.infer<typeof TypeMetadata>;
 export const TypeMetadata = z.object({
-  name: z.string(),
-  description: z.string(),
   data_source: z.object({
-    trust_framework: z.string(),
     authentic_source: z.object({
-      organization_name: z.string(),
-      organization_code: z.string(),
       contacts: z.array(z.string()),
-      homepage_uri: z.string().url(),
-      logo_uri: z.string().url(),
+      homepage_uri: z.url(),
+      logo_uri: z.url(),
+      organization_code: z.string(),
+      organization_name: z.string(),
     }),
+    trust_framework: z.string(),
   }),
+  description: z.string(),
+  name: z.string(),
 });

package/src/sd-jwt/utils.ts

@@ -1,33 +1,38 @@
 import { sha256ToBase64 } from "@pagopa/io-react-native-jwt";
-import { decodeSdJwtSync, getClaimsSync } from "@sd-jwt/decode";
 import { digest } from "@sd-jwt/crypto-nodejs";
-import { hasStatusOrThrow } from "../utils/misc";
-import { TypeMetadata, Verification } from "./types";
+import { decodeSdJwtSync, getClaimsSync } from "@sd-jwt/decode";
+
+import { fixLegacyCredentialSdJwt } from "../utils/credentials";
 import {
   IoWalletError,
   IssuerResponseError,
   ValidationFailed,
 } from "../utils/errors";
-import { fixLegacyCredentialSdJwt } from "../utils/credentials";
+import { hasStatusOrThrow } from "../utils/misc";
+import { TypeMetadata, Verification } from "./types";
 
 /**
  * Retrieve the Type Metadata for a credential and verify its integrity.
- * @param vct The VCT as a valid HTTPS url
+ * @param issuerUrl The Credential Issuer base url
+ * @param vct The VCT as a URN
  * @param vctIntegrity The integrity hash
  * @param context.appFetch (optional) fetch api implementation. Default: built-in fetch
  * @returns The credential metadata {@link TypeMetadata}
  */
 export const fetchTypeMetadata = async (
+  issuerUrl: string,
   vct: string,
   vctIntegrity: string,
   context: {
     appFetch?: GlobalFetch["fetch"];
-  } = {}
+  } = {},
 ): Promise<TypeMetadata> => {
   const { appFetch = fetch } = context;
-  const { origin, pathname } = new URL(vct);
 
-  const metadata = await appFetch(`${origin}/.well-known/vct${pathname}`, {
+  const url = new URL("/.well-known/type-metadata", issuerUrl);
+  url.searchParams.append("vct", vct);
+
+  const metadata = await appFetch(url.toString(), {
     headers: {
       "Content-Type": "application/json",
     },
@@ -61,17 +66,17 @@ export const fetchTypeMetadata = async (
  * @returns The verification claim or undefined if it wasn't found
  */
 export const getVerification = (
-  credentialSdJwt: string
-): Verification | undefined => {
+  credentialSdJwt: string,
+): undefined | Verification => {
   const decoded = decodeSdJwtSync(
     fixLegacyCredentialSdJwt(credentialSdJwt),
-    digest
+    digest,
   );
 
   const claims = getClaimsSync<Record<string, unknown>>(
     decoded.jwt.payload,
     decoded.disclosures,
-    digest
+    digest,
   );
 
   return claims.verification

package/src/trust/api/TrustAnchorConfig.ts

@@ -1,4 +1,5 @@
 import * as z from "zod";
+
 import { JWK } from "../../utils/jwk";
 import { FederationEntityMetadata } from "../common/types";
 
@@ -8,13 +9,13 @@ import { FederationEntityMetadata } from "../common/types";
  */
 export type TrustAnchorConfig = z.infer<typeof TrustAnchorConfig>;
 export const TrustAnchorConfig = z.object({
+  federation_entity: FederationEntityMetadata,
   jwt: z.object({
     header: z.object({
-      typ: z.literal("entity-statement+jwt"),
       alg: z.string(),
       kid: z.string(),
+      typ: z.literal("entity-statement+jwt"),
     }),
   }),
   keys: z.array(JWK),
-  federation_entity: FederationEntityMetadata,
 });

package/src/trust/api/index.ts

@@ -1,21 +1,9 @@
 import { type X509CertificateOptions } from "@pagopa/io-react-native-crypto";
-import type { TrustAnchorConfig } from "./TrustAnchorConfig";
-import type { ParsedToken } from "../common/utils";
 
-type FetchContext = { appFetch?: GlobalFetch["fetch"] };
+import type { ParsedToken } from "../common/utils";
+import type { TrustAnchorConfig } from "./TrustAnchorConfig";
 
 export interface TrustApi {
-  /**
-   * Get the common Trust Anchor Configuration, which is uniform across versions.
-   *
-   * @param trustAnchorBaseUrl The Trust Anchor base URL
-   * @returns The Trust Anchor Configuration object
-   */
-  getTrustAnchorEntityConfiguration(
-    trustAnchorBaseUrl: string,
-    ctx?: FetchContext
-  ): Promise<TrustAnchorConfig>;
-
   /**
    * Build a not-verified trust chain for a given Relying Party (RP) entity.
    *
@@ -28,9 +16,20 @@ export interface TrustApi {
   buildTrustChain(
     relyingPartyEntityBaseUrl: string,
     trustAnchorConfig: TrustAnchorConfig,
-    appFetch?: GlobalFetch["fetch"]
+    appFetch?: GlobalFetch["fetch"],
   ): Promise<string[]>;
 
+  /**
+   * Get the common Trust Anchor Configuration, which is uniform across versions.
+   *
+   * @param trustAnchorBaseUrl The Trust Anchor base URL
+   * @returns The Trust Anchor Configuration object
+   */
+  getTrustAnchorEntityConfiguration(
+    trustAnchorBaseUrl: string,
+    ctx?: FetchContext,
+  ): Promise<TrustAnchorConfig>;
+
   /**
    * Verify a given trust chain is actually valid.
    * It can handle fast chain renewal, which means we try to fetch a fresh version of each statement.
@@ -50,8 +49,12 @@ export interface TrustApi {
     ctx?: {
       appFetch?: GlobalFetch["fetch"];
       renewOnFail?: boolean;
-    }
+    },
   ): Promise<ParsedToken[]>;
 }
 
+interface FetchContext {
+  appFetch?: GlobalFetch["fetch"];
+}
+
 export { type TrustAnchorConfig };

package/src/trust/common/build-chain.ts

@@ -1,3 +1,8 @@
+import { z } from "zod";
+
+import type { TrustApi } from "../api";
+import type { BaseEntityConfiguration, EntityStatement } from "./types";
+
 import {
   BuildTrustChainError,
   MissingFederationFetchEndpointError,
@@ -11,14 +16,11 @@ import {
   getSignedEntityStatement,
   verify,
 } from "./utils";
-import { z } from "zod";
-import type { TrustApi } from "../api";
-import type { BaseEntityConfiguration, EntityStatement } from "./types";
 
-type BuilderConfig = {
-  EntityStatementShape: z.ZodType<EntityStatement>;
+interface BuilderConfig {
   EntityConfigurationShape: z.ZodType<BaseEntityConfiguration>;
-};
+  EntityStatementShape: z.ZodType<EntityStatement>;
+}
 
 /**
  * Factory function to create `buildTrustChain`.
@@ -26,12 +28,12 @@ type BuilderConfig = {
  * @returns `buildTrustChain` function compliant with the public API
  */
 export function createBuildTrustChain(
-  config: BuilderConfig
+  config: BuilderConfig,
 ): TrustApi["buildTrustChain"] {
   return async function buildTrustChain(
     relyingPartyEntityBaseUrl,
     trustAnchorConfig,
-    appFetch = fetch
+    appFetch = fetch,
   ) {
     // 1: Verify if the RP is authorized by the Trust Anchor's federation list
     // Extract the Trust Anchor's signing key and federation_list_endpoint
@@ -40,7 +42,7 @@ export function createBuildTrustChain(
 
     if (!trustAnchorKey) {
       throw new BuildTrustChainError(
-        "Cannot verify trust anchor: missing signing key in entity configuration."
+        "Cannot verify trust anchor: missing signing key in entity configuration.",
       );
     }
 
@@ -55,7 +57,10 @@ export function createBuildTrustChain(
       if (!federationList.includes(relyingPartyEntityBaseUrl)) {
         throw new RelyingPartyNotAuthorizedError(
           "Relying Party entity base URL is not authorized by the Trust Anchor's federation list.",
-          { relyingPartyUrl: relyingPartyEntityBaseUrl, federationListEndpoint }
+          {
+            federationListEndpoint,
+            relyingPartyUrl: relyingPartyEntityBaseUrl,
+          },
         );
       }
     }
@@ -65,14 +70,14 @@ export function createBuildTrustChain(
     // 1: Recursively gather the trust chain from the RP up to the Trust Anchor
     const trustChain = await gatherTrustChain(
       relyingPartyEntityBaseUrl,
-      appFetch
+      appFetch,
     );
     // 2: Trust Anchor signature verification
     const chainTrustAnchorJwt = trustChain[trustChain.length - 1];
     if (!chainTrustAnchorJwt) {
       throw new BuildTrustChainError(
         "Cannot verify trust anchor: missing entity configuration in gathered chain.",
-        { relyingPartyUrl: relyingPartyEntityBaseUrl }
+        { relyingPartyUrl: relyingPartyEntityBaseUrl },
       );
     }
 
@@ -98,7 +103,7 @@ export function createGatherTrustChain({
   return async function gatherTrustChain(
     entityBaseUrl: string,
     appFetch: GlobalFetch["fetch"],
-    isLeaf: boolean = true
+    isLeaf = true,
   ): Promise<string[]> {
     const chain: string[] = [];
 
@@ -121,12 +126,17 @@ export function createGatherTrustChain({
       }
       return chain;
     }
-    const parentEntityBaseUrl = authorityHints[0]!;
+
+    const parentEntityBaseUrl = authorityHints[0];
+
+    if (!parentEntityBaseUrl) {
+      throw new Error("AuthorityHints array is empty.");
+    }
 
     // Fetch parent EC
     const parentECJwt = await getSignedEntityConfiguration(
       parentEntityBaseUrl,
-      { appFetch }
+      { appFetch },
     );
     const parentEC = EntityConfigurationShape.parse(decode(parentECJwt));
     // Fetch ES
@@ -135,13 +145,13 @@ export function createGatherTrustChain({
     if (!federationFetchEndpoint) {
       throw new MissingFederationFetchEndpointError(
         `Missing federation_fetch_endpoint in parent's (${parentEntityBaseUrl}) configuration when gathering chain for ${entityBaseUrl}.`,
-        { entityBaseUrl, missingInEntityUrl: parentEntityBaseUrl }
+        { entityBaseUrl, missingInEntityUrl: parentEntityBaseUrl },
       );
     }
     const entityStatementJwt = await getSignedEntityStatement(
       federationFetchEndpoint,
       entityBaseUrl,
-      { appFetch }
+      { appFetch },
     );
     // Validate the ES
     EntityStatementShape.parse(decode(entityStatementJwt));
@@ -153,7 +163,7 @@ export function createGatherTrustChain({
     const parentChain = await gatherTrustChain(
       parentEntityBaseUrl,
       appFetch,
-      false
+      false,
     );
 
     return chain.concat(parentChain);

package/src/trust/common/errors.ts

@@ -1,6 +1,7 @@
-import { IoWalletError, serializeAttrs } from "../../utils/errors";
 import type { CertificateValidationStatus } from "@pagopa/io-react-native-crypto"; // Ensure this path is correct
 
+import { IoWalletError, serializeAttrs } from "../../utils/errors";
+
 /**
  * Base class for all federation-specific errors.
  */
@@ -14,58 +15,64 @@ export class FederationError extends IoWalletError {
 }
 
 /**
- * Error thrown when a trust chain is unexpectedly empty.
+ * General error thrown during the trust chain building process.
  */
-export class TrustChainEmptyError extends FederationError {
-  code = "ERR_FED_TRUST_CHAIN_EMPTY";
-  constructor(message = "Trust chain cannot be empty.") {
-    super(message, undefined);
+export class BuildTrustChainError extends FederationError {
+  code = "ERR_FED_BUILD_TRUST_CHAIN_FAILED";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
+  constructor(
+    message: string,
+    details?: {
+      [key: string]: unknown;
+      relyingPartyUrl?: string;
+      trustAnchorKid?: string;
+    },
+  ) {
+    super(message, details);
   }
 }
 
-/**
- * Error thrown when a token is unexpectedly missing from a trust chain during processing.
- */
-export class TrustChainTokenMissingError extends FederationError {
-  code = "ERR_FED_TRUST_CHAIN_TOKEN_MISSING";
-  constructor(message: string, details?: { index?: number }) {
+export class FederationListParseError extends FederationError {
+  code = "ERR_FED_FEDERATION_LIST_PARSE_FAILED";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
+  constructor(message: string, details: { parseError?: string; url: string }) {
     super(message, details);
   }
 }
 
 /**
- * Error thrown when renewing a trust chain fails.
- * This class itself might be used or could be considered a more general renewal error.
+ * Error thrown when a 'federation_fetch_endpoint' is missing in an entity's configuration.
  */
-export class TrustChainRenewalError extends FederationError {
-  code = "ERR_FED_TRUST_CHAIN_RENEWAL_FAILED";
+export class MissingFederationFetchEndpointError extends FederationError {
+  code = "ERR_FED_MISSING_FEDERATION_FETCH_ENDPOINT";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
   constructor(
     message: string,
-    details?: { originalChain?: string[]; [key: string]: unknown }
+    details: { entityBaseUrl: string; missingInEntityUrl: string },
   ) {
     super(message, details);
   }
 }
 
-export class FederationListParseError extends FederationError {
-  code = "ERR_FED_FEDERATION_LIST_PARSE_FAILED";
-  constructor(message: string, details: { url: string; parseError?: string }) {
-    super(message, details);
+/**
+ * Error thrown when the X.509 certificate chain is missing in an entity's configuration.
+ */
+export class MissingX509CertsError extends FederationError {
+  code = "ERR_FED_MISSING_X509_CERTS";
+  constructor(message: string) {
+    super(message, undefined);
   }
 }
 
 /**
- * General error thrown during the trust chain building process.
+ * Error thrown if the Relying Party is not found in the Trust Anchor's federation list.
  */
-export class BuildTrustChainError extends FederationError {
-  code = "ERR_FED_BUILD_TRUST_CHAIN_FAILED";
+export class RelyingPartyNotAuthorizedError extends FederationError {
+  code = "ERR_FED_RELYING_PARTY_NOT_AUTHORIZED";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
   constructor(
     message: string,
-    details?: {
-      relyingPartyUrl?: string;
-      trustAnchorKid?: string;
-      [key: string]: unknown;
-    }
+    details: { federationListEndpoint?: string; relyingPartyUrl: string },
   ) {
     super(message, details);
   }
@@ -82,38 +89,38 @@ export class TrustAnchorKidMissingError extends FederationError {
 }
 
 /**
- * Error thrown if the Relying Party is not found in the Trust Anchor's federation list.
+ * Error thrown when a trust chain is unexpectedly empty.
  */
-export class RelyingPartyNotAuthorizedError extends FederationError {
-  code = "ERR_FED_RELYING_PARTY_NOT_AUTHORIZED";
-  constructor(
-    message: string,
-    details: { relyingPartyUrl: string; federationListEndpoint?: string }
-  ) {
-    super(message, details);
+export class TrustChainEmptyError extends FederationError {
+  code = "ERR_FED_TRUST_CHAIN_EMPTY";
+  constructor(message = "Trust chain cannot be empty.") {
+    super(message, undefined);
   }
 }
 
 /**
- * Error thrown when a 'federation_fetch_endpoint' is missing in an entity's configuration.
+ * Error thrown when renewing a trust chain fails.
+ * This class itself might be used or could be considered a more general renewal error.
  */
-export class MissingFederationFetchEndpointError extends FederationError {
-  code = "ERR_FED_MISSING_FEDERATION_FETCH_ENDPOINT";
+export class TrustChainRenewalError extends FederationError {
+  code = "ERR_FED_TRUST_CHAIN_RENEWAL_FAILED";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
   constructor(
     message: string,
-    details: { entityBaseUrl: string; missingInEntityUrl: string }
+    details?: { [key: string]: unknown; originalChain?: string[] },
   ) {
     super(message, details);
   }
 }
 
 /**
- * Error thrown when the X.509 certificate chain is missing in an entity's configuration.
+ * Error thrown when a token is unexpectedly missing from a trust chain during processing.
  */
-export class MissingX509CertsError extends FederationError {
-  code = "ERR_FED_MISSING_X509_CERTS";
-  constructor(message: string) {
-    super(message, undefined);
+export class TrustChainTokenMissingError extends FederationError {
+  code = "ERR_FED_TRUST_CHAIN_TOKEN_MISSING";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
+  constructor(message: string, details?: { index?: number }) {
+    super(message, details);
   }
 }
 
@@ -123,15 +130,16 @@ export class MissingX509CertsError extends FederationError {
  */
 export class X509ValidationError extends FederationError {
   code = "ERR_FED_X509_VALIDATION_FAILED";
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor -- narrows the `details` type for this error subclass
   constructor(
     message: string,
     details?: {
-      tokenIndex?: number;
+      [key: string]: unknown;
       kid?: string;
-      x509ValidationStatus?: CertificateValidationStatus;
+      tokenIndex?: number;
       x509ErrorMessage?: string;
-      [key: string]: unknown;
-    }
+      x509ValidationStatus?: CertificateValidationStatus;
+    },
   ) {
     super(message, details);
   }

package/src/trust/common/types.ts

@@ -1,24 +1,25 @@
 import * as z from "zod";
+
 import { JWK } from "../../utils/jwk";
 import { UnixTime } from "../../utils/zod";
 
 export const TrustMark = z.object({ id: z.string(), trust_mark: z.string() });
-export type TrustMark = z.infer<typeof TrustMark>;
-
 export type EntityStatement = z.infer<typeof EntityStatement>;
+
+export type TrustMark = z.infer<typeof TrustMark>;
 export const EntityStatement = z.object({
   header: z.object({
-    typ: z.literal("entity-statement+jwt"),
     alg: z.string(),
     kid: z.string(),
+    typ: z.literal("entity-statement+jwt"),
   }),
   payload: z.object({
+    exp: z.number(),
+    iat: z.number(),
     iss: z.string(),
-    sub: z.string(),
     jwks: z.object({ keys: z.array(JWK) }),
+    sub: z.string(),
     trust_marks: z.array(TrustMark).optional(),
-    iat: z.number(),
-    exp: z.number(),
   }),
 });
 
@@ -26,9 +27,9 @@ export type EntityConfigurationHeader = z.infer<
   typeof EntityConfigurationHeader
 >;
 export const EntityConfigurationHeader = z.object({
-  typ: z.literal("entity-statement+jwt"),
   alg: z.string(),
   kid: z.string(),
+  typ: z.literal("entity-statement+jwt"),
 });
 
 /**
@@ -36,19 +37,19 @@ export const EntityConfigurationHeader = z.object({
  */
 export const FederationEntityMetadata = z
   .object({
+    contacts: z.array(z.string()).optional(),
+    endpoint_auth_signing_alg_values_supported: z.string().optional(),
     federation_fetch_endpoint: z.string().optional(),
+    federation_historical_keys_endpoint: z.string().optional(),
     federation_list_endpoint: z.string().optional(),
     federation_resolve_endpoint: z.string().optional(),
-    federation_trust_mark_status_endpoint: z.string().optional(),
-    federation_trust_mark_list_endpoint: z.string().optional(),
     federation_trust_mark_endpoint: z.string().optional(),
-    federation_historical_keys_endpoint: z.string().optional(),
-    endpoint_auth_signing_alg_values_supported: z.string().optional(),
-    organization_name: z.string().optional(),
+    federation_trust_mark_list_endpoint: z.string().optional(),
+    federation_trust_mark_status_endpoint: z.string().optional(),
     homepage_uri: z.string().optional(),
-    policy_uri: z.string().optional(),
     logo_uri: z.string().optional(),
-    contacts: z.array(z.string()).optional(),
+    organization_name: z.string().optional(),
+    policy_uri: z.string().optional(),
   })
   .loose();
 
@@ -58,19 +59,19 @@ export const BaseEntityConfiguration = z.object({
   header: EntityConfigurationHeader,
   payload: z
     .object({
-      iss: z.string(),
-      sub: z.string(),
-      iat: UnixTime,
-      exp: UnixTime,
       authority_hints: z.array(z.string()).optional(),
+      exp: UnixTime,
+      iat: UnixTime,
+      iss: z.string(),
+      jwks: z.object({
+        keys: z.array(JWK),
+      }),
       metadata: z
         .object({
           federation_entity: FederationEntityMetadata,
         })
         .loose(),
-      jwks: z.object({
-        keys: z.array(JWK),
-      }),
+      sub: z.string(),
     })
     .loose(),
 });