@pagopa/io-wallet-oid4vp 1.2.0 → 1.3.0

package/dist/index.js

@@ -72,36 +72,40 @@ var import_io_wallet_utils = require("@pagopa/io-wallet-utils");
 
 // src/errors.ts
 var Oid4vpError = class extends Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "Oid4vpError";
+    this.statusCode = options?.statusCode;
   }
 };
 var ParseAuthorizeRequestError = class extends Oid4vpError {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "ParseAuthorizeRequestError";
+    this.statusCode = options?.statusCode;
   }
 };
 var FetchAuthorizationResponseError = class extends Oid4vpError {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "FetchAuthorizationResponseError";
+    this.statusCode = options?.statusCode;
   }
 };
 var CreateAuthorizationResponseError = class extends Oid4vpError {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "CreateAuthorizationResponseError";
+    this.statusCode = options?.statusCode;
   }
 };
 var InvalidRequestUriMethodError = class extends Oid4vpError {
-  constructor(message) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "InvalidRequestUriMethodError";
   }
 };
@@ -388,6 +392,7 @@ async function parseAuthorizeRequest(options) {
   try {
     const headerSchema = options.config.isVersion(import_io_wallet_utils3.ItWalletSpecsVersion.V1_0) ? zOpenid4vpAuthorizationRequestHeaderV1_0 : zOpenid4vpAuthorizationRequestHeaderV1_3;
     const decoded = (0, import_io_wallet_oauth23.decodeJwt)({
+      errorMessagePrefix: "Error decoding authorization request JWT:",
       headerSchema,
       jwt: options.requestObjectJwt,
       payloadSchema: zOpenid4vpAuthorizationRequestPayload
@@ -420,7 +425,7 @@ async function parseAuthorizeRequest(options) {
 }
 
 // src/authorization-response/create-authorization-response.ts
-var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
 
 // src/jarm/jarm-extract-jwks.ts
 function extractEncryptionJwkFromJwks(jwks, {
@@ -441,13 +446,83 @@ function extractEncryptionJwkFromJwks(jwks, {
   return encFiltered.length > 0 ? encFiltered[0] : jwks.keys[0];
 }
 
-// src/jarm/parse-jarm-authorization-response.ts
-var import_io_wallet_oauth26 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
-var import_zod7 = __toESM(require("zod"));
+// src/authorization-response/create-authorization-response.ts
+async function createAuthorizationResponse(options) {
+  try {
+    const encryptionAlg = options.authorization_encrypted_response_alg ?? "ECDH-ES";
+    const encryptionEnc = options.authorization_encrypted_response_enc ?? "A256GCM";
+    const { requestObject } = options;
+    const clientMetadata = requestObject.client_metadata;
+    const clientIdPrefix = extractClientIdPrefix(requestObject.client_id);
+    if (clientIdPrefix === "x509_hash" /* X509_HASH */ && !clientMetadata) {
+      throw new CreateAuthorizationResponseError(
+        "clientMetadata is required when client_id uses x509_hash prefix"
+      );
+    }
+    const effectiveClientMetadata = clientIdPrefix === "openid_federation" /* OPENID_FEDERATION */ ? void 0 : clientMetadata;
+    const authorizationResponsePayload = {
+      state: requestObject.state,
+      vp_token: options.vp_token
+    };
+    const encryptionJwks = effectiveClientMetadata ? effectiveClientMetadata.jwks : options.rpJwks.jwks;
+    const encryptionJwk = extractEncryptionJwkFromJwks(encryptionJwks, {
+      supportedAlgValues: [encryptionAlg]
+    });
+    if (!encryptionJwk) {
+      throw new CreateAuthorizationResponseError(
+        "No encryption JWK found in metadata"
+      );
+    }
+    const encValuesSupported = effectiveClientMetadata?.encrypted_response_enc_values_supported ?? options.rpJwks.encrypted_response_enc_values_supported;
+    let enc;
+    if (encValuesSupported) {
+      if (options.authorization_encrypted_response_enc !== void 0) {
+        enc = encValuesSupported.find(
+          (e) => e === options.authorization_encrypted_response_enc
+        ) ?? encValuesSupported[0] ?? options.authorization_encrypted_response_enc;
+      } else {
+        enc = encValuesSupported[0] ?? encryptionEnc;
+      }
+    } else {
+      enc = encryptionEnc;
+    }
+    const alg = encryptionJwk.alg ?? encryptionAlg;
+    const nonceBytes = await options.callbacks.generateRandom(32);
+    const jweEncryptor = {
+      alg,
+      apu: (0, import_io_wallet_utils4.encodeToBase64Url)(nonceBytes),
+      apv: (0, import_io_wallet_utils4.encodeToBase64Url)(requestObject.nonce),
+      enc,
+      method: "jwk",
+      publicJwk: encryptionJwk
+    };
+    const plaintext = JSON.stringify(authorizationResponsePayload);
+    const { encryptionJwk: usedJwk, jwe } = await options.callbacks.encryptJwe(
+      jweEncryptor,
+      plaintext
+    );
+    return {
+      authorizationResponsePayload,
+      jarm: {
+        encryptionJwk: usedJwk,
+        responseJwe: jwe
+      }
+    };
+  } catch (error) {
+    if (error instanceof CreateAuthorizationResponseError) {
+      throw error;
+    }
+    throw new CreateAuthorizationResponseError(
+      `Unexpected error during authorization response creation: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
 
-// src/vp-token/parse-vp-token.ts
-var import_io_wallet_utils4 = require("@pagopa/io-wallet-utils");
+// src/authorization-response/fetch-authorization-response.ts
+var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
+
+// src/authorization-response/z-authorization-response.ts
+var import_zod4 = __toESM(require("zod"));
 
 // src/vp-token/z-vp-token.ts
 var import_zod3 = require("zod");
@@ -459,11 +534,64 @@ var zVpToken = import_zod3.z.record(
   }
 );
 
+// src/authorization-response/z-authorization-response.ts
+var zOpenid4vpAuthorizationResponse = import_zod4.default.object({
+  state: import_zod4.default.string(),
+  vp_token: zVpToken
+});
+var zOpenid4vpAuthorizationResponseResult = import_zod4.default.object({
+  redirect_uri: import_zod4.default.url().optional()
+});
+
+// src/authorization-response/fetch-authorization-response.ts
+async function fetchAuthorizationResponse(options) {
+  try {
+    const fetch = (0, import_io_wallet_utils5.createFetcher)(options.callbacks.fetch);
+    const authorizationResponseResult = await fetch(
+      options.presentationResponseUri,
+      {
+        body: new URLSearchParams({
+          response: options.authorizationResponseJarm
+        }),
+        headers: {
+          [import_io_wallet_utils5.HEADERS.CONTENT_TYPE]: import_io_wallet_utils5.CONTENT_TYPES.FORM_URLENCODED
+        },
+        method: "POST"
+      }
+    );
+    await (0, import_io_wallet_utils5.hasStatusOrThrow)(
+      200,
+      import_io_wallet_utils5.UnexpectedStatusCodeError
+    )(authorizationResponseResult);
+    const authorizationResponseResultJson = await authorizationResponseResult.json();
+    return (0, import_io_wallet_utils5.parseWithErrorHandling)(
+      zOpenid4vpAuthorizationResponseResult,
+      authorizationResponseResultJson
+    );
+  } catch (error) {
+    if (error instanceof import_io_wallet_utils5.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils5.ValidationError) {
+      throw error;
+    }
+    throw new FetchAuthorizationResponseError(
+      `Unexpected error sending authorization response: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+
+// src/authorization-response/parse-authorization-response.ts
+var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
+
+// src/jarm/parse-jarm-authorization-response.ts
+var import_io_wallet_oauth26 = require("@pagopa/io-wallet-oauth2");
+var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
+var import_zod7 = __toESM(require("zod"));
+
 // src/vp-token/parse-vp-token.ts
+var import_io_wallet_utils6 = require("@pagopa/io-wallet-utils");
 function parseVpToken(vpToken) {
-  return (0, import_io_wallet_utils4.parseWithErrorHandling)(
+  return (0, import_io_wallet_utils6.parseWithErrorHandling)(
     zVpToken,
-    (0, import_io_wallet_utils4.parseIfJson)(vpToken),
+    (0, import_io_wallet_utils6.parseIfJson)(vpToken),
     "Could not parse dcql vp_token. Expected an object where the values are encoded presentations"
   );
 }
@@ -481,20 +609,10 @@ function validateOpenid4vpAuthorizationResponsePayload(options) {
   };
 }
 
-// src/authorization-response/z-authorization-response.ts
-var import_zod4 = __toESM(require("zod"));
-var zOpenid4vpAuthorizationResponse = import_zod4.default.object({
-  state: import_zod4.default.string(),
-  vp_token: zVpToken
-});
-var zOpenid4vpAuthorizationResponseResult = import_zod4.default.object({
-  redirect_uri: import_zod4.default.url().optional()
-});
-
 // src/jarm/verify-jarm-authorization-response.ts
 var import_oauth23 = require("@openid4vc/oauth2");
 var import_io_wallet_oauth25 = require("@pagopa/io-wallet-oauth2");
-var import_io_wallet_utils5 = require("@pagopa/io-wallet-utils");
+var import_io_wallet_utils7 = require("@pagopa/io-wallet-utils");
 var import_zod6 = __toESM(require("zod"));
 
 // src/jarm/z-jarm.ts
@@ -586,6 +704,7 @@ async function verifyJarmAuthorizationResponse(options) {
   let jarmAuthorizationResponse;
   if (responseIsSigned) {
     const { header: jwsProtectedHeader, payload: jwsPayload } = (0, import_io_wallet_oauth25.decodeJwt)({
+      errorMessagePrefix: "Error decoding JARM authorization response JWT:",
       headerSchema: import_zod6.default.object({ ...import_io_wallet_oauth25.zJwtHeader.shape, kid: import_zod6.default.string() }),
       jwt: decryptedRequestData.payload
     });
@@ -624,7 +743,7 @@ async function verifyJarmAuthorizationResponse(options) {
     }
     jarmAuthorizationResponse = response;
   } else {
-    const jsonRequestData = (0, import_io_wallet_utils5.stringToJsonWithErrorHandling)(
+    const jsonRequestData = (0, import_io_wallet_utils7.stringToJsonWithErrorHandling)(
       decryptedRequestData.payload,
       "Unable to parse decrypted JARM JWE body to JSON"
     );
@@ -643,7 +762,7 @@ async function verifyJarmAuthorizationResponse(options) {
 // src/jarm/parse-jarm-authorization-response.ts
 async function parseJarmAuthorizationResponse(options) {
   const { authorizationRequestPayload, callbacks, jarmResponseJwt, now } = options;
-  const jarmAuthorizationResponseJwt = (0, import_io_wallet_utils6.parseWithErrorHandling)(
+  const jarmAuthorizationResponseJwt = (0, import_io_wallet_utils8.parseWithErrorHandling)(
     import_zod7.default.union([import_io_wallet_oauth26.zCompactJwt, import_io_wallet_oauth26.zCompactJwe]),
     jarmResponseJwt,
     "Invalid jarm authorization response jwt."
@@ -658,7 +777,7 @@ async function parseJarmAuthorizationResponse(options) {
     headerSchema: zJarmHeader,
     jwt: jarmAuthorizationResponseJwt
   });
-  const authorizationResponsePayload = (0, import_io_wallet_utils6.parseWithErrorHandling)(
+  const authorizationResponsePayload = (0, import_io_wallet_utils8.parseWithErrorHandling)(
     zOpenid4vpAuthorizationResponse,
     verifiedJarmResponse.jarmAuthorizationResponse,
     "Failed to parse openid4vp authorization response."
@@ -675,116 +794,7 @@ async function parseJarmAuthorizationResponse(options) {
   };
 }
 
-// src/authorization-response/create-authorization-response.ts
-async function createAuthorizationResponse(options) {
-  try {
-    const encryptionAlg = options.authorization_encrypted_response_alg ?? "ECDH-ES";
-    const encryptionEnc = options.authorization_encrypted_response_enc ?? "A256GCM";
-    const { requestObject } = options;
-    const clientMetadata = requestObject.client_metadata;
-    const clientIdPrefix = extractClientIdPrefix(requestObject.client_id);
-    if (clientIdPrefix === "x509_hash" /* X509_HASH */ && !clientMetadata) {
-      throw new CreateAuthorizationResponseError(
-        "clientMetadata is required when client_id uses x509_hash prefix"
-      );
-    }
-    const effectiveClientMetadata = clientIdPrefix === "openid_federation" /* OPENID_FEDERATION */ ? void 0 : clientMetadata;
-    const authorizationResponsePayload = {
-      state: requestObject.state,
-      vp_token: options.vp_token
-    };
-    const encryptionJwks = effectiveClientMetadata ? effectiveClientMetadata.jwks : options.rpJwks.jwks;
-    const encryptionJwk = extractEncryptionJwkFromJwks(encryptionJwks, {
-      supportedAlgValues: [encryptionAlg]
-    });
-    if (!encryptionJwk) {
-      throw new CreateAuthorizationResponseError(
-        "No encryption JWK found in metadata"
-      );
-    }
-    const encValuesSupported = effectiveClientMetadata?.encrypted_response_enc_values_supported ?? options.rpJwks.encrypted_response_enc_values_supported;
-    let enc;
-    if (encValuesSupported) {
-      if (options.authorization_encrypted_response_enc !== void 0) {
-        enc = encValuesSupported.find(
-          (e) => e === options.authorization_encrypted_response_enc
-        ) ?? encValuesSupported[0] ?? options.authorization_encrypted_response_enc;
-      } else {
-        enc = encValuesSupported[0] ?? encryptionEnc;
-      }
-    } else {
-      enc = encryptionEnc;
-    }
-    const alg = encryptionJwk.alg ?? encryptionAlg;
-    const nonceBytes = await options.callbacks.generateRandom(32);
-    const jweEncryptor = {
-      alg,
-      apu: (0, import_io_wallet_utils7.encodeToBase64Url)(nonceBytes),
-      apv: (0, import_io_wallet_utils7.encodeToBase64Url)(requestObject.nonce),
-      enc,
-      method: "jwk",
-      publicJwk: encryptionJwk
-    };
-    const plaintext = JSON.stringify(authorizationResponsePayload);
-    const { encryptionJwk: usedJwk, jwe } = await options.callbacks.encryptJwe(
-      jweEncryptor,
-      plaintext
-    );
-    return {
-      authorizationResponsePayload,
-      jarm: {
-        encryptionJwk: usedJwk,
-        responseJwe: jwe
-      }
-    };
-  } catch (error) {
-    if (error instanceof CreateAuthorizationResponseError) {
-      throw error;
-    }
-    throw new CreateAuthorizationResponseError(
-      `Unexpected error during authorization response creation: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-
-// src/authorization-response/fetch-authorization-response.ts
-var import_io_wallet_utils8 = require("@pagopa/io-wallet-utils");
-async function fetchAuthorizationResponse(options) {
-  try {
-    const fetch = (0, import_io_wallet_utils8.createFetcher)(options.callbacks.fetch);
-    const authorizationResponseResult = await fetch(
-      options.presentationResponseUri,
-      {
-        body: new URLSearchParams({
-          response: options.authorizationResponseJarm
-        }),
-        headers: {
-          [import_io_wallet_utils8.HEADERS.CONTENT_TYPE]: import_io_wallet_utils8.CONTENT_TYPES.FORM_URLENCODED
-        },
-        method: "POST"
-      }
-    );
-    await (0, import_io_wallet_utils8.hasStatusOrThrow)(
-      200,
-      import_io_wallet_utils8.UnexpectedStatusCodeError
-    )(authorizationResponseResult);
-    const authorizationResponseResultJson = await authorizationResponseResult.json();
-    return (0, import_io_wallet_utils8.parseWithErrorHandling)(
-      zOpenid4vpAuthorizationResponseResult,
-      authorizationResponseResultJson
-    );
-  } catch (error) {
-    if (error instanceof import_io_wallet_utils8.UnexpectedStatusCodeError || error instanceof import_io_wallet_utils8.ValidationError) {
-      throw error;
-    }
-    throw new FetchAuthorizationResponseError(
-      `Unexpected error sending authorization response: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-
 // src/authorization-response/parse-authorization-response.ts
-var import_io_wallet_utils9 = require("@pagopa/io-wallet-utils");
 async function parseAuthorizationResponse(options) {
   const { authorizationRequestPayload, authorizationResponse, callbacks } = options;
   if (authorizationResponse.response) {