@pagopa/io-wallet-oid4vp 1.2.0 → 1.3.0

package/dist/index.mjs

@@ -15,36 +15,40 @@ import {
 
 // src/errors.ts
 var Oid4vpError = class extends Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "Oid4vpError";
+    this.statusCode = options?.statusCode;
   }
 };
 var ParseAuthorizeRequestError = class extends Oid4vpError {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "ParseAuthorizeRequestError";
+    this.statusCode = options?.statusCode;
   }
 };
 var FetchAuthorizationResponseError = class extends Oid4vpError {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "FetchAuthorizationResponseError";
+    this.statusCode = options?.statusCode;
   }
 };
 var CreateAuthorizationResponseError = class extends Oid4vpError {
-  constructor(message, statusCode) {
-    super(message);
-    this.statusCode = statusCode;
+  statusCode;
+  constructor(message, options) {
+    super(message, options);
     this.name = "CreateAuthorizationResponseError";
+    this.statusCode = options?.statusCode;
   }
 };
 var InvalidRequestUriMethodError = class extends Oid4vpError {
-  constructor(message) {
-    super(message);
+  constructor(message, options) {
+    super(message, options);
     this.name = "InvalidRequestUriMethodError";
   }
 };
@@ -348,6 +352,7 @@ async function parseAuthorizeRequest(options) {
   try {
     const headerSchema = options.config.isVersion(ItWalletSpecsVersion2.V1_0) ? zOpenid4vpAuthorizationRequestHeaderV1_0 : zOpenid4vpAuthorizationRequestHeaderV1_3;
     const decoded = decodeJwt({
+      errorMessagePrefix: "Error decoding authorization request JWT:",
       headerSchema,
       jwt: options.requestObjectJwt,
       payloadSchema: zOpenid4vpAuthorizationRequestPayload
@@ -401,17 +406,91 @@ function extractEncryptionJwkFromJwks(jwks, {
   return encFiltered.length > 0 ? encFiltered[0] : jwks.keys[0];
 }
 
-// src/jarm/parse-jarm-authorization-response.ts
+// src/authorization-response/create-authorization-response.ts
+async function createAuthorizationResponse(options) {
+  try {
+    const encryptionAlg = options.authorization_encrypted_response_alg ?? "ECDH-ES";
+    const encryptionEnc = options.authorization_encrypted_response_enc ?? "A256GCM";
+    const { requestObject } = options;
+    const clientMetadata = requestObject.client_metadata;
+    const clientIdPrefix = extractClientIdPrefix(requestObject.client_id);
+    if (clientIdPrefix === "x509_hash" /* X509_HASH */ && !clientMetadata) {
+      throw new CreateAuthorizationResponseError(
+        "clientMetadata is required when client_id uses x509_hash prefix"
+      );
+    }
+    const effectiveClientMetadata = clientIdPrefix === "openid_federation" /* OPENID_FEDERATION */ ? void 0 : clientMetadata;
+    const authorizationResponsePayload = {
+      state: requestObject.state,
+      vp_token: options.vp_token
+    };
+    const encryptionJwks = effectiveClientMetadata ? effectiveClientMetadata.jwks : options.rpJwks.jwks;
+    const encryptionJwk = extractEncryptionJwkFromJwks(encryptionJwks, {
+      supportedAlgValues: [encryptionAlg]
+    });
+    if (!encryptionJwk) {
+      throw new CreateAuthorizationResponseError(
+        "No encryption JWK found in metadata"
+      );
+    }
+    const encValuesSupported = effectiveClientMetadata?.encrypted_response_enc_values_supported ?? options.rpJwks.encrypted_response_enc_values_supported;
+    let enc;
+    if (encValuesSupported) {
+      if (options.authorization_encrypted_response_enc !== void 0) {
+        enc = encValuesSupported.find(
+          (e) => e === options.authorization_encrypted_response_enc
+        ) ?? encValuesSupported[0] ?? options.authorization_encrypted_response_enc;
+      } else {
+        enc = encValuesSupported[0] ?? encryptionEnc;
+      }
+    } else {
+      enc = encryptionEnc;
+    }
+    const alg = encryptionJwk.alg ?? encryptionAlg;
+    const nonceBytes = await options.callbacks.generateRandom(32);
+    const jweEncryptor = {
+      alg,
+      apu: encodeToBase64Url(nonceBytes),
+      apv: encodeToBase64Url(requestObject.nonce),
+      enc,
+      method: "jwk",
+      publicJwk: encryptionJwk
+    };
+    const plaintext = JSON.stringify(authorizationResponsePayload);
+    const { encryptionJwk: usedJwk, jwe } = await options.callbacks.encryptJwe(
+      jweEncryptor,
+      plaintext
+    );
+    return {
+      authorizationResponsePayload,
+      jarm: {
+        encryptionJwk: usedJwk,
+        responseJwe: jwe
+      }
+    };
+  } catch (error) {
+    if (error instanceof CreateAuthorizationResponseError) {
+      throw error;
+    }
+    throw new CreateAuthorizationResponseError(
+      `Unexpected error during authorization response creation: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+
+// src/authorization-response/fetch-authorization-response.ts
 import {
-  decodeJwtHeader as decodeJwtHeader2,
-  zCompactJwe as zCompactJwe2,
-  zCompactJwt as zCompactJwt2
-} from "@pagopa/io-wallet-oauth2";
-import { parseWithErrorHandling as parseWithErrorHandling3 } from "@pagopa/io-wallet-utils";
-import z7 from "zod";
+  CONTENT_TYPES,
+  HEADERS,
+  UnexpectedStatusCodeError as UnexpectedStatusCodeError2,
+  ValidationError as ValidationError4,
+  createFetcher as createFetcher2,
+  hasStatusOrThrow as hasStatusOrThrow2,
+  parseWithErrorHandling as parseWithErrorHandling2
+} from "@pagopa/io-wallet-utils";
 
-// src/vp-token/parse-vp-token.ts
-import { parseIfJson, parseWithErrorHandling as parseWithErrorHandling2 } from "@pagopa/io-wallet-utils";
+// src/authorization-response/z-authorization-response.ts
+import z4 from "zod";
 
 // src/vp-token/z-vp-token.ts
 import { z as z3 } from "zod";
@@ -423,9 +502,66 @@ var zVpToken = z3.record(
   }
 );
 
+// src/authorization-response/z-authorization-response.ts
+var zOpenid4vpAuthorizationResponse = z4.object({
+  state: z4.string(),
+  vp_token: zVpToken
+});
+var zOpenid4vpAuthorizationResponseResult = z4.object({
+  redirect_uri: z4.url().optional()
+});
+
+// src/authorization-response/fetch-authorization-response.ts
+async function fetchAuthorizationResponse(options) {
+  try {
+    const fetch = createFetcher2(options.callbacks.fetch);
+    const authorizationResponseResult = await fetch(
+      options.presentationResponseUri,
+      {
+        body: new URLSearchParams({
+          response: options.authorizationResponseJarm
+        }),
+        headers: {
+          [HEADERS.CONTENT_TYPE]: CONTENT_TYPES.FORM_URLENCODED
+        },
+        method: "POST"
+      }
+    );
+    await hasStatusOrThrow2(
+      200,
+      UnexpectedStatusCodeError2
+    )(authorizationResponseResult);
+    const authorizationResponseResultJson = await authorizationResponseResult.json();
+    return parseWithErrorHandling2(
+      zOpenid4vpAuthorizationResponseResult,
+      authorizationResponseResultJson
+    );
+  } catch (error) {
+    if (error instanceof UnexpectedStatusCodeError2 || error instanceof ValidationError4) {
+      throw error;
+    }
+    throw new FetchAuthorizationResponseError(
+      `Unexpected error sending authorization response: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+
+// src/authorization-response/parse-authorization-response.ts
+import { parseWithErrorHandling as parseWithErrorHandling5 } from "@pagopa/io-wallet-utils";
+
+// src/jarm/parse-jarm-authorization-response.ts
+import {
+  decodeJwtHeader as decodeJwtHeader2,
+  zCompactJwe as zCompactJwe2,
+  zCompactJwt as zCompactJwt2
+} from "@pagopa/io-wallet-oauth2";
+import { parseWithErrorHandling as parseWithErrorHandling4 } from "@pagopa/io-wallet-utils";
+import z7 from "zod";
+
 // src/vp-token/parse-vp-token.ts
+import { parseIfJson, parseWithErrorHandling as parseWithErrorHandling3 } from "@pagopa/io-wallet-utils";
 function parseVpToken(vpToken) {
-  return parseWithErrorHandling2(
+  return parseWithErrorHandling3(
     zVpToken,
     parseIfJson(vpToken),
     "Could not parse dcql vp_token. Expected an object where the values are encoded presentations"
@@ -445,16 +581,6 @@ function validateOpenid4vpAuthorizationResponsePayload(options) {
   };
 }
 
-// src/authorization-response/z-authorization-response.ts
-import z4 from "zod";
-var zOpenid4vpAuthorizationResponse = z4.object({
-  state: z4.string(),
-  vp_token: zVpToken
-});
-var zOpenid4vpAuthorizationResponseResult = z4.object({
-  redirect_uri: z4.url().optional()
-});
-
 // src/jarm/verify-jarm-authorization-response.ts
 import { jwtSignerFromJwt } from "@openid4vc/oauth2";
 import {
@@ -557,6 +683,7 @@ async function verifyJarmAuthorizationResponse(options) {
   let jarmAuthorizationResponse;
   if (responseIsSigned) {
     const { header: jwsProtectedHeader, payload: jwsPayload } = decodeJwt2({
+      errorMessagePrefix: "Error decoding JARM authorization response JWT:",
       headerSchema: z6.object({ ...zJwtHeader2.shape, kid: z6.string() }),
       jwt: decryptedRequestData.payload
     });
@@ -614,7 +741,7 @@ async function verifyJarmAuthorizationResponse(options) {
 // src/jarm/parse-jarm-authorization-response.ts
 async function parseJarmAuthorizationResponse(options) {
   const { authorizationRequestPayload, callbacks, jarmResponseJwt, now } = options;
-  const jarmAuthorizationResponseJwt = parseWithErrorHandling3(
+  const jarmAuthorizationResponseJwt = parseWithErrorHandling4(
     z7.union([zCompactJwt2, zCompactJwe2]),
     jarmResponseJwt,
     "Invalid jarm authorization response jwt."
@@ -629,7 +756,7 @@ async function parseJarmAuthorizationResponse(options) {
     headerSchema: zJarmHeader,
     jwt: jarmAuthorizationResponseJwt
   });
-  const authorizationResponsePayload = parseWithErrorHandling3(
+  const authorizationResponsePayload = parseWithErrorHandling4(
     zOpenid4vpAuthorizationResponse,
     verifiedJarmResponse.jarmAuthorizationResponse,
     "Failed to parse openid4vp authorization response."
@@ -646,124 +773,7 @@ async function parseJarmAuthorizationResponse(options) {
   };
 }
 
-// src/authorization-response/create-authorization-response.ts
-async function createAuthorizationResponse(options) {
-  try {
-    const encryptionAlg = options.authorization_encrypted_response_alg ?? "ECDH-ES";
-    const encryptionEnc = options.authorization_encrypted_response_enc ?? "A256GCM";
-    const { requestObject } = options;
-    const clientMetadata = requestObject.client_metadata;
-    const clientIdPrefix = extractClientIdPrefix(requestObject.client_id);
-    if (clientIdPrefix === "x509_hash" /* X509_HASH */ && !clientMetadata) {
-      throw new CreateAuthorizationResponseError(
-        "clientMetadata is required when client_id uses x509_hash prefix"
-      );
-    }
-    const effectiveClientMetadata = clientIdPrefix === "openid_federation" /* OPENID_FEDERATION */ ? void 0 : clientMetadata;
-    const authorizationResponsePayload = {
-      state: requestObject.state,
-      vp_token: options.vp_token
-    };
-    const encryptionJwks = effectiveClientMetadata ? effectiveClientMetadata.jwks : options.rpJwks.jwks;
-    const encryptionJwk = extractEncryptionJwkFromJwks(encryptionJwks, {
-      supportedAlgValues: [encryptionAlg]
-    });
-    if (!encryptionJwk) {
-      throw new CreateAuthorizationResponseError(
-        "No encryption JWK found in metadata"
-      );
-    }
-    const encValuesSupported = effectiveClientMetadata?.encrypted_response_enc_values_supported ?? options.rpJwks.encrypted_response_enc_values_supported;
-    let enc;
-    if (encValuesSupported) {
-      if (options.authorization_encrypted_response_enc !== void 0) {
-        enc = encValuesSupported.find(
-          (e) => e === options.authorization_encrypted_response_enc
-        ) ?? encValuesSupported[0] ?? options.authorization_encrypted_response_enc;
-      } else {
-        enc = encValuesSupported[0] ?? encryptionEnc;
-      }
-    } else {
-      enc = encryptionEnc;
-    }
-    const alg = encryptionJwk.alg ?? encryptionAlg;
-    const nonceBytes = await options.callbacks.generateRandom(32);
-    const jweEncryptor = {
-      alg,
-      apu: encodeToBase64Url(nonceBytes),
-      apv: encodeToBase64Url(requestObject.nonce),
-      enc,
-      method: "jwk",
-      publicJwk: encryptionJwk
-    };
-    const plaintext = JSON.stringify(authorizationResponsePayload);
-    const { encryptionJwk: usedJwk, jwe } = await options.callbacks.encryptJwe(
-      jweEncryptor,
-      plaintext
-    );
-    return {
-      authorizationResponsePayload,
-      jarm: {
-        encryptionJwk: usedJwk,
-        responseJwe: jwe
-      }
-    };
-  } catch (error) {
-    if (error instanceof CreateAuthorizationResponseError) {
-      throw error;
-    }
-    throw new CreateAuthorizationResponseError(
-      `Unexpected error during authorization response creation: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-
-// src/authorization-response/fetch-authorization-response.ts
-import {
-  CONTENT_TYPES,
-  HEADERS,
-  UnexpectedStatusCodeError as UnexpectedStatusCodeError2,
-  ValidationError as ValidationError4,
-  createFetcher as createFetcher2,
-  hasStatusOrThrow as hasStatusOrThrow2,
-  parseWithErrorHandling as parseWithErrorHandling4
-} from "@pagopa/io-wallet-utils";
-async function fetchAuthorizationResponse(options) {
-  try {
-    const fetch = createFetcher2(options.callbacks.fetch);
-    const authorizationResponseResult = await fetch(
-      options.presentationResponseUri,
-      {
-        body: new URLSearchParams({
-          response: options.authorizationResponseJarm
-        }),
-        headers: {
-          [HEADERS.CONTENT_TYPE]: CONTENT_TYPES.FORM_URLENCODED
-        },
-        method: "POST"
-      }
-    );
-    await hasStatusOrThrow2(
-      200,
-      UnexpectedStatusCodeError2
-    )(authorizationResponseResult);
-    const authorizationResponseResultJson = await authorizationResponseResult.json();
-    return parseWithErrorHandling4(
-      zOpenid4vpAuthorizationResponseResult,
-      authorizationResponseResultJson
-    );
-  } catch (error) {
-    if (error instanceof UnexpectedStatusCodeError2 || error instanceof ValidationError4) {
-      throw error;
-    }
-    throw new FetchAuthorizationResponseError(
-      `Unexpected error sending authorization response: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-
 // src/authorization-response/parse-authorization-response.ts
-import { parseWithErrorHandling as parseWithErrorHandling5 } from "@pagopa/io-wallet-utils";
 async function parseAuthorizationResponse(options) {
   const { authorizationRequestPayload, authorizationResponse, callbacks } = options;
   if (authorizationResponse.response) {