@pagopa/io-react-native-wallet 3.6.3 → 3.7.0

package/src/trust/common/utils.ts

@@ -3,33 +3,34 @@ import {
   verify as verifyJwt,
 } from "@pagopa/io-react-native-jwt";
 
-import { hasStatusOrThrow } from "../../utils/misc";
 import type { JWK, JWTDecodeResult } from "../../utils/jwk";
-import { FederationError, FederationListParseError } from "./errors";
 import type { TrustAnchorConfig } from "../api/TrustAnchorConfig";
+
+import { hasStatusOrThrow } from "../../utils/misc";
+import { FederationError, FederationListParseError } from "./errors";
 import { FederationListResponse } from "./types";
 
-export type FetchOptions = {
+export interface FetchOptions {
   appFetch?: GlobalFetch["fetch"];
-};
+}
 
-export type ParsedToken = {
+export interface ParsedToken {
   header: JWTDecodeResult["protectedHeader"];
   payload: JWTDecodeResult["payload"];
-};
+}
 
 // Verify a token signature
 // The kid is extracted from the token header
 export const verify = async (
   token: string,
   kid: string,
-  jwks: JWK[]
+  jwks: JWK[],
 ): Promise<ParsedToken> => {
   const jwk = jwks.find((k) => k.kid === kid);
   if (!jwk) {
     throw new Error(`Invalid kid: ${kid}, token: ${token}`);
   }
-  const { protectedHeader: header, payload } = await verifyJwt(token, jwk);
+  const { payload, protectedHeader: header } = await verifyJwt(token, jwk);
   return { header, payload };
 };
 
@@ -38,41 +39,38 @@ export const verify = async (
  * It seems like typescript can't correctly infer the return type of the function.
  */
 export const decode = (token: string): ParsedToken => {
-  const { protectedHeader: header, payload } = decodeJwt(token);
+  const { payload, protectedHeader: header } = decodeJwt(token);
   return { header, payload };
 };
 
 /**
- * Extracts the X.509 Trust Anchor certificate (Base64 encoded) from the
- * Trust Anchor's Entity Configuration.
+ * Fetch the federation list document from a given endpoint.
  *
- * @param trustAnchorEntity The entity configuration of the known trust anchor.
- * @returns The Base64 encoded X.509 certificate string.
- * @throws {FederationError} If the certificate cannot be derived.
+ * @param federationListEndpoint The URL of the federation list endpoint.
+ * @param appFetch An optional instance of the http client to be used.
+ * @returns The federation list as an array of strings.
+ * @throws {IoWalletError} If the HTTP request fails.
+ * @throws {FederationError} If the result is not in the expected format.
  */
-export function getTrustAnchorX509Certificate(
-  trustAnchorEntity: TrustAnchorConfig
-): string {
-  const taHeaderKid = trustAnchorEntity.jwt.header.kid;
-  const taSigningJwk = trustAnchorEntity.keys.find(
-    (key) => key.kid === taHeaderKid
-  );
-
-  if (!taSigningJwk) {
-    throw new FederationError(
-      `Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' not found in Trust Anchor's JWKS.`,
-      { trustAnchorKid: taHeaderKid, reason: "JWK not found for header kid" }
-    );
-  }
-
-  if (taSigningJwk.x5c && taSigningJwk.x5c.length > 0 && taSigningJwk.x5c[0]) {
-    return taSigningJwk.x5c[0];
-  }
-
-  throw new FederationError(
-    `Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' does not contain a valid 'x5c' certificate array.`,
-    { trustAnchorKid: taHeaderKid, reason: "Missing or empty x5c in JWK" }
-  );
+export async function getFederationList(
+  federationListEndpoint: string,
+  { appFetch = fetch }: FetchOptions = {},
+): Promise<string[]> {
+  return await appFetch(federationListEndpoint, {
+    method: "GET",
+  })
+    .then(hasStatusOrThrow(200))
+    .then((res) => res.json())
+    .then((json) => {
+      const result = FederationListResponse.safeParse(json);
+      if (!result.success) {
+        throw new FederationListParseError(
+          `Invalid federation list format received from ${federationListEndpoint}. Error: ${result.error.message}`,
+          { parseError: result.error.toString(), url: federationListEndpoint },
+        );
+      }
+      return result.data;
+    });
 }
 
 /**
@@ -84,7 +82,7 @@ export function getTrustAnchorX509Certificate(
  */
 export async function getSignedEntityConfiguration(
   entityBaseUrl: string,
-  { appFetch = fetch }: FetchOptions = {}
+  { appFetch = fetch }: FetchOptions = {},
 ): Promise<string> {
   const wellKnownUrl = `${entityBaseUrl}/.well-known/openid-federation`;
 
@@ -107,7 +105,7 @@ export async function getSignedEntityConfiguration(
 export async function getSignedEntityStatement(
   federationFetchEndpoint: string,
   subordinatedEntityBaseUrl: string,
-  { appFetch = fetch }: FetchOptions = {}
+  { appFetch = fetch }: FetchOptions = {},
 ) {
   const url = new URL(federationFetchEndpoint);
   url.searchParams.set("sub", subordinatedEntityBaseUrl);
@@ -120,31 +118,34 @@ export async function getSignedEntityStatement(
 }
 
 /**
- * Fetch the federation list document from a given endpoint.
+ * Extracts the X.509 Trust Anchor certificate (Base64 encoded) from the
+ * Trust Anchor's Entity Configuration.
  *
- * @param federationListEndpoint The URL of the federation list endpoint.
- * @param appFetch An optional instance of the http client to be used.
- * @returns The federation list as an array of strings.
- * @throws {IoWalletError} If the HTTP request fails.
- * @throws {FederationError} If the result is not in the expected format.
+ * @param trustAnchorEntity The entity configuration of the known trust anchor.
+ * @returns The Base64 encoded X.509 certificate string.
+ * @throws {FederationError} If the certificate cannot be derived.
  */
-export async function getFederationList(
-  federationListEndpoint: string,
-  { appFetch = fetch }: FetchOptions = {}
-): Promise<string[]> {
-  return await appFetch(federationListEndpoint, {
-    method: "GET",
-  })
-    .then(hasStatusOrThrow(200))
-    .then((res) => res.json())
-    .then((json) => {
-      const result = FederationListResponse.safeParse(json);
-      if (!result.success) {
-        throw new FederationListParseError(
-          `Invalid federation list format received from ${federationListEndpoint}. Error: ${result.error.message}`,
-          { url: federationListEndpoint, parseError: result.error.toString() }
-        );
-      }
-      return result.data;
-    });
+export function getTrustAnchorX509Certificate(
+  trustAnchorEntity: TrustAnchorConfig,
+): string {
+  const taHeaderKid = trustAnchorEntity.jwt.header.kid;
+  const taSigningJwk = trustAnchorEntity.keys.find(
+    (key) => key.kid === taHeaderKid,
+  );
+
+  if (!taSigningJwk) {
+    throw new FederationError(
+      `Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' not found in Trust Anchor's JWKS.`,
+      { reason: "JWK not found for header kid", trustAnchorKid: taHeaderKid },
+    );
+  }
+
+  if (taSigningJwk.x5c && taSigningJwk.x5c.length > 0 && taSigningJwk.x5c[0]) {
+    return taSigningJwk.x5c[0];
+  }
+
+  throw new FederationError(
+    `Cannot derive X.509 Trust Anchor certificate: JWK with kid '${taHeaderKid}' does not contain a valid 'x5c' certificate array.`,
+    { reason: "Missing or empty x5c in JWK", trustAnchorKid: taHeaderKid },
+  );
 }

package/src/trust/common/verify-chain.ts

@@ -1,12 +1,14 @@
-import { BaseEntityConfiguration, EntityStatement } from "./types";
-import { JWK } from "../../utils/jwk";
-import * as z from "zod";
 import {
-  decode,
-  getTrustAnchorX509Certificate,
-  verify,
-  type ParsedToken,
-} from "./utils";
+  type CertificateValidationResult,
+  verifyCertificateChain,
+  type X509CertificateOptions,
+} from "@pagopa/io-react-native-crypto";
+import * as z from "zod";
+
+import type { TrustApi } from "../api";
+import type { TrustAnchorConfig } from "../api/TrustAnchorConfig";
+
+import { JWK } from "../../utils/jwk";
 import {
   FederationError,
   MissingFederationFetchEndpointError,
@@ -16,35 +18,141 @@ import {
   TrustChainTokenMissingError,
   X509ValidationError,
 } from "./errors";
+import { BaseEntityConfiguration, EntityStatement } from "./types";
 import {
-  type CertificateValidationResult,
-  verifyCertificateChain,
-  type X509CertificateOptions,
-} from "@pagopa/io-react-native-crypto";
+  decode,
+  getTrustAnchorX509Certificate,
+  type ParsedToken,
+  verify,
+} from "./utils";
 import {
   getSignedEntityConfiguration,
   getSignedEntityStatement,
 } from "./utils";
-import type { TrustApi } from "../api";
-import type { TrustAnchorConfig } from "../api/TrustAnchorConfig";
 
-export type BuilderConfig = {
-  EntityStatementShape: z.ZodType<EntityStatement>;
+export interface BuilderConfig {
   EntityConfigurationShape: z.ZodType<BaseEntityConfiguration>;
+  EntityStatementShape: z.ZodType<EntityStatement>;
   /**
    * The first element of the chain is supposed to be the Entity Configuration for the document issuer
    */
   FirstElementShape: z.ZodType<BaseEntityConfiguration>;
+  /**
+   * The last element of the chain can either be an Entity Statement
+   * or the Entity Configuration for the known Trust Anchor
+   */
+  LastElementShape: z.ZodType<BaseEntityConfiguration | EntityStatement>;
   /**
    * Each element but the first is supposed to be an Entity Statement
    */
   MiddleElementShape: z.ZodType<EntityStatement>;
+}
+
+/**
+ * Factory function to create `verifyTrustChain`.
+ * @param config Version specific Entity shapes
+ * @returns `verifyTrustChain` function compliant with the public API
+ */
+export function createVerifyTrustChain(
+  config: BuilderConfig,
+): TrustApi["verifyTrustChain"] {
+  return async function verifyTrustChain(
+    trustAnchorEntity,
+    chain,
+    x509Options = {
+      connectTimeout: 10000,
+      readTimeout: 10000,
+      requireCrl: true,
+    },
+    { appFetch = fetch, renewOnFail = true } = {},
+  ) {
+    const validateTrustChain = createValidateTrustChain(config);
+    const renewTrustChain = createRenewTrustChain(config);
+
+    try {
+      return await validateTrustChain(trustAnchorEntity, chain, x509Options);
+    } catch (error) {
+      if (renewOnFail) {
+        const renewedChain = await renewTrustChain(chain, appFetch);
+        return validateTrustChain(trustAnchorEntity, renewedChain, x509Options);
+      } else {
+        throw error;
+      }
+    }
+  };
+}
+
+/**
+ * Factory function to create `renewTrustChain`.
+ * @param config Version specific Entity shapes
+ * @returns `renewTrustChain` function
+ */
+function createRenewTrustChain({
+  EntityConfigurationShape,
+  EntityStatementShape,
+}: BuilderConfig) {
   /**
-   * The last element of the chain can either be an Entity Statement
-   * or the Entity Configuration for the known Trust Anchor
+   * Given a trust chain, obtain a new trust chain by fetching each element's fresh version
+   *
+   * @param chain The original chain
+   * @param appFetch (optional) fetch api implementation
+   * @returns A list of signed token that represent the trust chain, in the same order of the provided chain
+   * @throws {FederationError} If the chain is not valid
    */
-  LastElementShape: z.ZodType<EntityStatement | BaseEntityConfiguration>;
-};
+  return async function renewTrustChain(
+    chain: string[],
+    appFetch: GlobalFetch["fetch"] = fetch,
+  ): Promise<string[]> {
+    return Promise.all(
+      chain.map(async (token, index) => {
+        const decoded = decode(token);
+
+        const entityStatementResult = EntityStatementShape.safeParse(decoded);
+        const entityConfigurationResult =
+          EntityConfigurationShape.safeParse(decoded);
+
+        if (entityConfigurationResult.success) {
+          return getSignedEntityConfiguration(
+            entityConfigurationResult.data.payload.iss,
+            { appFetch },
+          );
+        }
+        if (entityStatementResult.success) {
+          const entityStatement = entityStatementResult.data;
+
+          const parentBaseUrl = entityStatement.payload.iss;
+          const parentECJwt = await getSignedEntityConfiguration(
+            parentBaseUrl,
+            { appFetch },
+          );
+          const parentEC = EntityConfigurationShape.parse(decode(parentECJwt));
+
+          const federationFetchEndpoint =
+            parentEC.payload.metadata.federation_entity
+              .federation_fetch_endpoint;
+          if (!federationFetchEndpoint) {
+            throw new MissingFederationFetchEndpointError(
+              `Parent EC at ${parentBaseUrl} is missing federation_fetch_endpoint, cannot renew ES for ${entityStatement.payload.sub}.`,
+              {
+                entityBaseUrl: entityStatement.payload.sub,
+                missingInEntityUrl: parentBaseUrl,
+              },
+            );
+          }
+          return getSignedEntityStatement(
+            federationFetchEndpoint,
+            entityStatement.payload.sub,
+            { appFetch },
+          );
+        }
+        throw new TrustChainRenewalError(
+          `Failed to renew trust chain. Reason: element #${index} failed to parse.`,
+          { originalChain: chain },
+        );
+      }),
+    );
+  };
+}
 
 /**
  * Factory function to create `validateTrustChain`.
@@ -53,8 +161,8 @@ export type BuilderConfig = {
  */
 function createValidateTrustChain({
   FirstElementShape,
-  MiddleElementShape,
   LastElementShape,
+  MiddleElementShape,
 }: BuilderConfig) {
   /**
    * Validates a provided trust chain against a known trust anchor, including X.509 certificate checks.
@@ -68,7 +176,7 @@ function createValidateTrustChain({
   return async function validateTrustChain(
     trustAnchorEntity: TrustAnchorConfig,
     chain: string[],
-    x509Options: X509CertificateOptions
+    x509Options: X509CertificateOptions,
   ): Promise<ParsedToken[]> {
     // If the chain is empty, fail
     if (chain.length === 0) {
@@ -89,7 +197,7 @@ function createValidateTrustChain({
       if (!token) {
         throw new TrustChainTokenMissingError(
           `Token missing at index ${currentIndex} in trust chain.`,
-          { index: currentIndex }
+          { index: currentIndex },
         );
       }
       const shape = selectTokenShape(currentIndex);
@@ -108,7 +216,7 @@ function createValidateTrustChain({
       if (!nextToken) {
         throw new TrustChainTokenMissingError(
           `Next token missing at index ${nextIndex} (needed for keys for token at ${currentIndex}).`,
-          { index: nextIndex }
+          { index: nextIndex },
         );
       }
       const shape = selectTokenShape(nextIndex);
@@ -128,18 +236,18 @@ function createValidateTrustChain({
       const parsedToken = await verify(
         tokenString,
         kidFromTokenHeader,
-        signerJwks
+        signerJwks,
       );
 
       // Step 2: X.509 Certificate Chain Validation
       const jwkUsedForVerification = signerJwks.find(
-        (k) => k.kid === kidFromTokenHeader
+        (k) => k.kid === kidFromTokenHeader,
       );
 
       if (!jwkUsedForVerification) {
         throw new FederationError(
           `JWK with kid '${kidFromTokenHeader}' was not found in signer's JWKS for token at index ${i}, though JWT verification passed.`,
-          { tokenIndex: i, kid: kidFromTokenHeader }
+          { kid: kidFromTokenHeader, tokenIndex: i },
         );
       }
 
@@ -148,7 +256,7 @@ function createValidateTrustChain({
         jwkUsedForVerification.x5c.length === 0
       ) {
         throw new MissingX509CertsError(
-          `JWK with kid '${kidFromTokenHeader}' does not contain an X.509 certificate chain (x5c) for token at index ${i}.`
+          `JWK with kid '${kidFromTokenHeader}' does not contain an X.509 certificate chain (x5c) for token at index ${i}.`,
         );
       }
 
@@ -165,18 +273,18 @@ function createValidateTrustChain({
         await verifyCertificateChain(
           certChainBase64,
           x509TrustAnchorCertBase64,
-          x509Options
+          x509Options,
         );
 
       if (!x509ValidationResult.isValid) {
         throw new X509ValidationError(
           `X.509 certificate chain validation failed for token at index ${i} (kid: ${kidFromTokenHeader}). Status: ${x509ValidationResult.validationStatus}. Error: ${x509ValidationResult.errorMessage}`,
           {
-            tokenIndex: i,
             kid: kidFromTokenHeader,
-            x509ValidationStatus: x509ValidationResult.validationStatus,
+            tokenIndex: i,
             x509ErrorMessage: x509ValidationResult.errorMessage,
-          }
+            x509ValidationStatus: x509ValidationResult.validationStatus,
+          },
         );
       }
       return parsedToken;
@@ -185,109 +293,3 @@ function createValidateTrustChain({
     return Promise.all(validationPromises);
   };
 }
-
-/**
- * Factory function to create `renewTrustChain`.
- * @param config Version specific Entity shapes
- * @returns `renewTrustChain` function
- */
-function createRenewTrustChain({
-  EntityStatementShape,
-  EntityConfigurationShape,
-}: BuilderConfig) {
-  /**
-   * Given a trust chain, obtain a new trust chain by fetching each element's fresh version
-   *
-   * @param chain The original chain
-   * @param appFetch (optional) fetch api implementation
-   * @returns A list of signed token that represent the trust chain, in the same order of the provided chain
-   * @throws {FederationError} If the chain is not valid
-   */
-  return async function renewTrustChain(
-    chain: string[],
-    appFetch: GlobalFetch["fetch"] = fetch
-  ): Promise<string[]> {
-    return Promise.all(
-      chain.map(async (token, index) => {
-        const decoded = decode(token);
-
-        const entityStatementResult = EntityStatementShape.safeParse(decoded);
-        const entityConfigurationResult =
-          EntityConfigurationShape.safeParse(decoded);
-
-        if (entityConfigurationResult.success) {
-          return getSignedEntityConfiguration(
-            entityConfigurationResult.data.payload.iss,
-            { appFetch }
-          );
-        }
-        if (entityStatementResult.success) {
-          const entityStatement = entityStatementResult.data;
-
-          const parentBaseUrl = entityStatement.payload.iss;
-          const parentECJwt = await getSignedEntityConfiguration(
-            parentBaseUrl,
-            { appFetch }
-          );
-          const parentEC = EntityConfigurationShape.parse(decode(parentECJwt));
-
-          const federationFetchEndpoint =
-            parentEC.payload.metadata.federation_entity
-              .federation_fetch_endpoint;
-          if (!federationFetchEndpoint) {
-            throw new MissingFederationFetchEndpointError(
-              `Parent EC at ${parentBaseUrl} is missing federation_fetch_endpoint, cannot renew ES for ${entityStatement.payload.sub}.`,
-              {
-                entityBaseUrl: entityStatement.payload.sub,
-                missingInEntityUrl: parentBaseUrl,
-              }
-            );
-          }
-          return getSignedEntityStatement(
-            federationFetchEndpoint,
-            entityStatement.payload.sub,
-            { appFetch }
-          );
-        }
-        throw new TrustChainRenewalError(
-          `Failed to renew trust chain. Reason: element #${index} failed to parse.`,
-          { originalChain: chain }
-        );
-      })
-    );
-  };
-}
-
-/**
- * Factory function to create `verifyTrustChain`.
- * @param config Version specific Entity shapes
- * @returns `verifyTrustChain` function compliant with the public API
- */
-export function createVerifyTrustChain(
-  config: BuilderConfig
-): TrustApi["verifyTrustChain"] {
-  return async function verifyTrustChain(
-    trustAnchorEntity,
-    chain,
-    x509Options = {
-      connectTimeout: 10000,
-      readTimeout: 10000,
-      requireCrl: true,
-    },
-    { appFetch = fetch, renewOnFail = true } = {}
-  ) {
-    const validateTrustChain = createValidateTrustChain(config);
-    const renewTrustChain = createRenewTrustChain(config);
-
-    try {
-      return await validateTrustChain(trustAnchorEntity, chain, x509Options);
-    } catch (error) {
-      if (renewOnFail) {
-        const renewedChain = await renewTrustChain(chain, appFetch);
-        return validateTrustChain(trustAnchorEntity, renewedChain, x509Options);
-      } else {
-        throw error;
-      }
-    }
-  };
-}

package/src/trust/v1.0.0/build-chain.ts

@@ -3,6 +3,6 @@ import { EntityStatement } from "../common/types";
 import { EntityConfiguration } from "./types";
 
 export const buildTrustChain = createBuildTrustChain({
-  EntityStatementShape: EntityStatement,
   EntityConfigurationShape: EntityConfiguration,
+  EntityStatementShape: EntityStatement,
 });

package/src/trust/v1.0.0/entities.ts

@@ -1,16 +1,18 @@
+import type { z } from "zod";
+
 import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
+
+import {
+  type FetchOptions,
+  getSignedEntityConfiguration,
+} from "../common/utils";
 import {
-  WalletProviderEntityConfiguration,
   CredentialIssuerEntityConfiguration,
   EntityConfiguration,
   RelyingPartyEntityConfiguration,
   TrustAnchorEntityConfiguration,
+  WalletProviderEntityConfiguration,
 } from "./types";
-import type { z } from "zod";
-import {
-  getSignedEntityConfiguration,
-  type FetchOptions,
-} from "../common/utils";
 
 /**
  * Fetch and parse the entity configuration document for a given federation entity.
@@ -33,7 +35,7 @@ import {
 async function fetchAndParseEntityConfiguration<T extends EntityConfiguration>(
   entityBaseUrl: string,
   schema: z.ZodType<T>,
-  { appFetch = fetch }: FetchOptions = {}
+  { appFetch = fetch }: FetchOptions = {},
 ): Promise<T> {
   const responseText = await getSignedEntityConfiguration(entityBaseUrl, {
     appFetch,
@@ -48,46 +50,46 @@ async function fetchAndParseEntityConfiguration<T extends EntityConfiguration>(
 
 export const getWalletProviderEntityConfiguration = (
   entityBaseUrl: string,
-  options?: FetchOptions
+  options?: FetchOptions,
 ) =>
   fetchAndParseEntityConfiguration(
     entityBaseUrl,
     WalletProviderEntityConfiguration,
-    options
+    options,
   );
 
 export const getCredentialIssuerEntityConfiguration = (
   entityBaseUrl: string,
-  options?: FetchOptions
+  options?: FetchOptions,
 ) =>
   fetchAndParseEntityConfiguration(
     entityBaseUrl,
     CredentialIssuerEntityConfiguration,
-    options
+    options,
   );
 
 export const getTrustAnchorEntityConfiguration = (
   entityBaseUrl: string,
-  options?: FetchOptions
+  options?: FetchOptions,
 ) =>
   fetchAndParseEntityConfiguration(
     entityBaseUrl,
     TrustAnchorEntityConfiguration,
-    options
+    options,
   );
 
 export const getRelyingPartyEntityConfiguration = (
   entityBaseUrl: string,
-  options?: FetchOptions
+  options?: FetchOptions,
 ) =>
   fetchAndParseEntityConfiguration(
     entityBaseUrl,
     RelyingPartyEntityConfiguration,
-    options
+    options,
   );
 
 export const getEntityConfiguration = (
   entityBaseUrl: string,
-  options?: FetchOptions
+  options?: FetchOptions,
 ) =>
   fetchAndParseEntityConfiguration(entityBaseUrl, EntityConfiguration, options);

package/src/trust/v1.0.0/index.ts

@@ -1,15 +1,16 @@
 import type { TrustApi } from "../api";
-import { getTrustAnchorEntityConfiguration } from "./entities";
+
 import { withMapperAsync } from "../../utils/mappers";
-import { mapToTrustAnchorConfig } from "./mappers";
 import { buildTrustChain } from "./build-chain";
+import { getTrustAnchorEntityConfiguration } from "./entities";
+import { mapToTrustAnchorConfig } from "./mappers";
 import { verifyTrustChain } from "./verify-chain";
 
 export const Trust: TrustApi = {
+  buildTrustChain,
   getTrustAnchorEntityConfiguration: withMapperAsync(
     mapToTrustAnchorConfig,
-    getTrustAnchorEntityConfiguration
+    getTrustAnchorEntityConfiguration,
   ),
-  buildTrustChain,
   verifyTrustChain,
 };