@pagopa/io-wallet-oid4vp 1.5.8 → 2.0.0-launchpad

package/dist/index.mjs

@@ -1,13 +1,13 @@
 // src/authorization-request/create-authorization-request.ts
 import {
   createJarRequest,
-  jwtHeaderFromJwtSigner,
   signedAuthorizationRequestJwtHeaderTyp
 } from "@pagopa/io-wallet-oauth2";
 import {
   ItWalletSpecsVersion,
   ValidationError,
   createVersionDispatcher,
+  jwtHeaderFromJwtSigner,
   objectToQueryParams,
   parseWithErrorHandling
 } from "@pagopa/io-wallet-utils";
@@ -129,14 +129,14 @@ function getLeafCertificate(certificateChain) {
 }
 
 // src/authorization-request/z-authorization-request.ts
+import { zSignedAuthorizationRequestJwtHeaderTyp } from "@pagopa/io-wallet-oauth2";
+import { itWalletCredentialVerifierMetadataV1_3 } from "@pagopa/io-wallet-oid-federation";
 import {
   zAlgValueNotNone,
   zCertificateChain,
   zJwtPayload,
-  zSignedAuthorizationRequestJwtHeaderTyp,
   zTrustChain
-} from "@pagopa/io-wallet-oauth2";
-import { itWalletCredentialVerifierMetadataV1_3 } from "@pagopa/io-wallet-oid-federation";
+} from "@pagopa/io-wallet-utils";
 import { z } from "zod";
 var zOpenid4vpCredentialVerifierMetadata = itWalletCredentialVerifierMetadataV1_3.partial({
   application_type: true,
@@ -272,8 +272,8 @@ function validateJarSignerForAuthorizationRequest(specsVersion, jwtSigner, paylo
 }
 
 // src/authorization-request/fetch-authorization-request.ts
-import { Oauth2JwtParseError } from "@openid4vc/oauth2";
 import {
+  JwtParseError,
   UnexpectedStatusCodeError,
   ValidationError as ValidationError2,
   createFetcher,
@@ -474,7 +474,7 @@ async function fetchAuthorizationRequest(options) {
       sendBy: parsedQrCode.request ? "value" : "reference"
     };
   } catch (error) {
-    if (error instanceof ValidationError2 || error instanceof Oauth2JwtParseError || error instanceof Oid4vpError || error instanceof UnexpectedStatusCodeError) {
+    if (error instanceof ValidationError2 || error instanceof JwtParseError || error instanceof Oid4vpError || error instanceof UnexpectedStatusCodeError) {
       throw error;
     }
     throw new Oid4vpError(
@@ -484,16 +484,14 @@ async function fetchAuthorizationRequest(options) {
 }
 
 // src/authorization-request/parse-authorization-request.ts
-import {
-  Oauth2JwtParseError as Oauth2JwtParseError2,
-  verifyJwt
-} from "@openid4vc/oauth2";
-import { decodeJwt } from "@pagopa/io-wallet-oauth2";
 import {
   ItWalletSpecsVersion as ItWalletSpecsVersion2,
   ItWalletSpecsVersionError,
+  JwtParseError as JwtParseError2,
   ValidationError as ValidationError3,
-  dispatchByVersion
+  decodeJwt,
+  dispatchByVersion,
+  verifyJwt
 } from "@pagopa/io-wallet-utils";
 function getPublicKeyForVerification(options) {
   const { header, payload } = options;
@@ -587,7 +585,7 @@ async function parseAuthorizeRequest(options) {
       }
     };
   } catch (error) {
-    if (error instanceof ItWalletSpecsVersionError || error instanceof ValidationError3 || error instanceof Oauth2JwtParseError2 || error instanceof Oid4vpError)
+    if (error instanceof ItWalletSpecsVersionError || error instanceof ValidationError3 || error instanceof JwtParseError2 || error instanceof Oid4vpError)
       throw error;
     throw new ParseAuthorizeRequestError(
       `Unexpected error during Request Object parsing: ${error instanceof Error ? error.message : String(error)}`
@@ -602,7 +600,9 @@ import {
 } from "@pagopa/io-wallet-utils";
 
 // src/authorization-response/build-jarm-response.ts
-import { encodeToBase64Url as encodeToBase64Url2 } from "@pagopa/io-wallet-utils";
+import {
+  encodeToBase64Url as encodeToBase64Url2
+} from "@pagopa/io-wallet-utils";
 
 // src/jarm/jarm-extract-jwks.ts
 function extractEncryptionJwkFromJwks(jwks, {
@@ -756,15 +756,235 @@ async function createAuthorizationResponse3(options) {
   return dispatchCreateAuthorizationResponse(options);
 }
 
+// src/authorization-response/create-openid4vp-authorization-response.ts
+import { Oauth2Error } from "@pagopa/io-wallet-oauth2";
+import {
+  ContentType,
+  UnexpectedStatusCodeError as UnexpectedStatusCodeError2,
+  addSecondsToDate,
+  dateToSeconds,
+  encodeToBase64Url as encodeToBase64Url3,
+  hasStatusOrThrow as hasStatusOrThrow2,
+  jwtHeaderFromJwtSigner as jwtHeaderFromJwtSigner2,
+  parseWithErrorHandling as parseWithErrorHandling2,
+  zJwkSet
+} from "@pagopa/io-wallet-utils";
+var jarmResponseModes = /* @__PURE__ */ new Set([
+  "jwt",
+  "query.jwt",
+  "fragment.jwt",
+  "form_post.jwt",
+  "direct_post.jwt",
+  "dc_api.jwt"
+]);
+function assertValueSupported(options) {
+  const { actual, errorMessage, supported } = options;
+  const found = supported.find((value) => value === actual);
+  if (!found) {
+    throw new Oauth2Error(errorMessage);
+  }
+  return found;
+}
+function assertClientJarmMetadataSupported(clientMetadata, serverMetadata) {
+  const {
+    authorization_encrypted_response_alg: encryptedAlg,
+    authorization_encrypted_response_enc: encryptedEnc,
+    authorization_signed_response_alg: signedAlg
+  } = clientMetadata;
+  if (encryptedAlg) {
+    assertValueSupported({
+      actual: encryptedAlg,
+      errorMessage: `Invalid authorization_encrypted_response_alg ${encryptedAlg}`,
+      supported: serverMetadata.authorization_encryption_alg_values_supported
+    });
+  }
+  if (encryptedEnc) {
+    assertValueSupported({
+      actual: encryptedEnc,
+      errorMessage: `Invalid authorization_encrypted_response_enc ${encryptedEnc}`,
+      supported: serverMetadata.authorization_encryption_enc_values_supported
+    });
+  }
+  if (signedAlg && serverMetadata.authorization_signed_response_alg_values_supported) {
+    assertValueSupported({
+      actual: signedAlg,
+      errorMessage: `Invalid authorization_signed_response_alg ${signedAlg}`,
+      supported: serverMetadata.authorization_signed_response_alg_values_supported
+    });
+  }
+}
+async function fetchJwks(jwksUrl, fetchCallback) {
+  if (!fetchCallback) {
+    throw new Oauth2Error(
+      `Missing fetch callback required to resolve jwks_uri '${jwksUrl}'.`
+    );
+  }
+  const response = await fetchCallback(jwksUrl, {
+    headers: {
+      Accept: `${ContentType.JwkSet}, ${ContentType.Json};q=0.9`
+    }
+  });
+  await hasStatusOrThrow2(200, UnexpectedStatusCodeError2)(response);
+  return parseWithErrorHandling2(
+    zJwkSet,
+    await response.json(),
+    `Validation of JWKs from jwks_uri '${jwksUrl}' failed`
+  );
+}
+async function createJarmAuthorizationResponse(options) {
+  const { callbacks, jarmAuthorizationResponse, jweEncryptor, jwtSigner } = options;
+  if (!jwtSigner && jweEncryptor) {
+    const { encryptionJwk: encryptionJwk2, jwe: jwe2 } = await callbacks.encryptJwe(
+      jweEncryptor,
+      JSON.stringify(jarmAuthorizationResponse)
+    );
+    return {
+      encryptionJwk: encryptionJwk2,
+      jarmAuthorizationResponseJwt: jwe2
+    };
+  }
+  if (jwtSigner && !jweEncryptor) {
+    const { jwt } = await callbacks.signJwt(jwtSigner, {
+      header: jwtHeaderFromJwtSigner2(jwtSigner),
+      payload: jarmAuthorizationResponse
+    });
+    return {
+      jarmAuthorizationResponseJwt: jwt
+    };
+  }
+  if (!jwtSigner || !jweEncryptor) {
+    throw new Oauth2Error(
+      "JWT signer and/or encryptor are required to create a JARM auth response."
+    );
+  }
+  const signed = await callbacks.signJwt(jwtSigner, {
+    header: jwtHeaderFromJwtSigner2(jwtSigner),
+    payload: jarmAuthorizationResponse
+  });
+  const { encryptionJwk, jwe } = await callbacks.encryptJwe(
+    jweEncryptor,
+    signed.jwt
+  );
+  return {
+    encryptionJwk,
+    jarmAuthorizationResponseJwt: jwe
+  };
+}
+async function createOpenid4vpAuthorizationResponse(options) {
+  const { authorizationRequestPayload, jarm } = options;
+  const authorizationResponsePayload = {
+    ...options.authorizationResponsePayload,
+    state: authorizationRequestPayload.state
+  };
+  const { prefix: clientIdPrefix } = extractClientIdPrefix(
+    authorizationRequestPayload.client_id
+  );
+  if (authorizationRequestPayload.response_mode && jarmResponseModes.has(authorizationRequestPayload.response_mode) && !jarm) {
+    throw new Oauth2Error(
+      `Missing jarm options for creating Jarm response with response mode '${authorizationRequestPayload.response_mode}'`
+    );
+  }
+  if (!jarm) {
+    return { authorizationResponsePayload };
+  }
+  if ((clientIdPrefix === "openid_federation" /* OPENID_FEDERATION */ || clientIdPrefix === "none" /* NONE */) && !options.clientMetadata) {
+    throw new Oauth2Error(
+      "When OpenID Federation is used as the client id prefix (https/openid_federation), passing externally fetched and verified 'clientMetadata' to 'createOpenid4vpAuthorizationResponse' is required."
+    );
+  }
+  const clientMetadata = options.clientMetadata ?? authorizationRequestPayload.client_metadata;
+  if (!clientMetadata) {
+    throw new Oauth2Error(
+      "Missing client metadata in the request params to assert Jarm metadata support."
+    );
+  }
+  const jwks = clientMetadata.jwks ? clientMetadata.jwks : clientMetadata.jwks_uri ? await fetchJwks(clientMetadata.jwks_uri, options.callbacks.fetch) : void 0;
+  if (!jwks) {
+    throw new Oauth2Error(
+      "Missing 'jwks' or 'jwks_uri' in client metadata. Cannot extract encryption JWK."
+    );
+  }
+  assertClientJarmMetadataSupported(clientMetadata, jarm.serverMetadata);
+  const encryptionJwk = jarm.encryption?.jwk ?? extractEncryptionJwkFromJwks(jwks, {
+    supportedAlgValues: jarm.serverMetadata.authorization_encryption_alg_values_supported ?? (clientMetadata.authorization_encrypted_response_alg ? [clientMetadata.authorization_encrypted_response_alg] : void 0)
+  });
+  if (!encryptionJwk) {
+    throw new Oauth2Error(
+      "No encryption JWK provided and could not extract encryption JWK from client metadata. Failed to create JARM response."
+    );
+  }
+  const enc = clientMetadata.encrypted_response_enc_values_supported ? jarm.serverMetadata.authorization_encryption_enc_values_supported.find(
+    (value) => clientMetadata.encrypted_response_enc_values_supported?.includes(
+      value
+    )
+  ) ?? clientMetadata.encrypted_response_enc_values_supported[0] ?? "A128GCM" : clientMetadata.authorization_encrypted_response_enc ?? "A128GCM";
+  assertValueSupported({
+    actual: enc,
+    errorMessage: `Invalid 'enc' value ${enc}. Supported values are ${jarm.serverMetadata.authorization_encryption_enc_values_supported.join(", ")}`,
+    supported: jarm.serverMetadata.authorization_encryption_enc_values_supported
+  });
+  const alg = encryptionJwk.alg ?? clientMetadata.authorization_encrypted_response_alg ?? "ECDH-ES";
+  assertValueSupported({
+    actual: alg,
+    errorMessage: `Invalid 'alg' value ${alg}. Supported values are ${jarm.serverMetadata.authorization_encryption_alg_values_supported.join(", ")}`,
+    supported: jarm.serverMetadata.authorization_encryption_alg_values_supported
+  });
+  if (clientMetadata.authorization_signed_response_alg && jarm.jwtSigner && clientMetadata.authorization_signed_response_alg !== jarm.jwtSigner.alg) {
+    throw new Oauth2Error(
+      `Invalid signed response alg value ${jarm.jwtSigner.alg}. Expected ${clientMetadata.authorization_signed_response_alg}.`
+    );
+  }
+  const additionalJwtPayload = jarm.jwtSigner ? {
+    aud: jarm.audience ?? (() => {
+      throw new Oauth2Error(
+        "Missing required aud in JARM configuration for creating OpenID4VP authorization response."
+      );
+    })(),
+    exp: jarm.expiresInSeconds ? dateToSeconds(addSecondsToDate(/* @__PURE__ */ new Date(), jarm.expiresInSeconds)) : dateToSeconds(addSecondsToDate(/* @__PURE__ */ new Date(), 600)),
+    iss: jarm.authorizationServer ?? (() => {
+      throw new Oauth2Error(
+        "Missing required iss in JARM configuration for creating OpenID4VP authorization response."
+      );
+    })()
+  } : void 0;
+  const jarmResponsePayload = {
+    ...authorizationResponsePayload,
+    ...additionalJwtPayload
+  };
+  const { encryptionJwk: usedEncryptionJwk, jarmAuthorizationResponseJwt } = await createJarmAuthorizationResponse({
+    callbacks: {
+      encryptJwe: options.callbacks.encryptJwe,
+      signJwt: options.callbacks.signJwt
+    },
+    jarmAuthorizationResponse: jarmResponsePayload,
+    jweEncryptor: jarm.encryption ? {
+      alg,
+      apu: jarm.encryption.nonce ? encodeToBase64Url3(jarm.encryption.nonce) : void 0,
+      apv: encodeToBase64Url3(authorizationRequestPayload.nonce),
+      enc,
+      method: "jwk",
+      publicJwk: encryptionJwk
+    } : void 0,
+    jwtSigner: jarm.jwtSigner
+  });
+  return {
+    authorizationResponsePayload: jarmResponsePayload,
+    jarm: {
+      encryptionJwk: usedEncryptionJwk,
+      responseJwt: jarmAuthorizationResponseJwt
+    }
+  };
+}
+
 // src/authorization-response/fetch-authorization-response.ts
 import {
   CONTENT_TYPES,
   HEADERS,
-  UnexpectedStatusCodeError as UnexpectedStatusCodeError2,
+  UnexpectedStatusCodeError as UnexpectedStatusCodeError3,
   ValidationError as ValidationError4,
   createFetcher as createFetcher2,
-  hasStatusOrThrow as hasStatusOrThrow2,
-  parseWithErrorHandling as parseWithErrorHandling2
+  hasStatusOrThrow as hasStatusOrThrow3,
+  parseWithErrorHandling as parseWithErrorHandling3
 } from "@pagopa/io-wallet-utils";
 
 // src/authorization-response/z-authorization-response.ts
@@ -814,12 +1034,12 @@ async function fetchAuthorizationResponse(options) {
         method: "POST"
       }
     );
-    await hasStatusOrThrow2(
+    await hasStatusOrThrow3(
       200,
-      UnexpectedStatusCodeError2
+      UnexpectedStatusCodeError3
     )(authorizationResponseResult);
     const authorizationResponseResultJson = await authorizationResponseResult.json();
-    const parsedAuthorizationResponseResult = parseWithErrorHandling2(
+    const parsedAuthorizationResponseResult = parseWithErrorHandling3(
       zOpenid4vpAuthorizationResponseResult,
       authorizationResponseResultJson
     );
@@ -837,7 +1057,7 @@ async function fetchAuthorizationResponse(options) {
     }
     return parsedAuthorizationResponseResult;
   } catch (error) {
-    if (error instanceof UnexpectedStatusCodeError2 || error instanceof ValidationError4 || error instanceof FetchAuthorizationResponseError) {
+    if (error instanceof UnexpectedStatusCodeError3 || error instanceof ValidationError4 || error instanceof FetchAuthorizationResponseError) {
       throw error;
     }
     throw new FetchAuthorizationResponseError(
@@ -847,21 +1067,23 @@ async function fetchAuthorizationResponse(options) {
 }
 
 // src/authorization-response/parse-authorization-response.ts
-import { parseWithErrorHandling as parseWithErrorHandling5 } from "@pagopa/io-wallet-utils";
+import {
+  parseWithErrorHandling as parseWithErrorHandling6
+} from "@pagopa/io-wallet-utils";
 
 // src/jarm/parse-jarm-authorization-response.ts
 import {
   decodeJwtHeader as decodeJwtHeader2,
+  parseWithErrorHandling as parseWithErrorHandling5,
   zCompactJwe as zCompactJwe2,
   zCompactJwt as zCompactJwt2
-} from "@pagopa/io-wallet-oauth2";
-import { parseWithErrorHandling as parseWithErrorHandling4 } from "@pagopa/io-wallet-utils";
+} from "@pagopa/io-wallet-utils";
 import z7 from "zod";
 
 // src/vp-token/parse-vp-token.ts
-import { parseIfJson, parseWithErrorHandling as parseWithErrorHandling3 } from "@pagopa/io-wallet-utils";
+import { parseIfJson, parseWithErrorHandling as parseWithErrorHandling4 } from "@pagopa/io-wallet-utils";
 function parseVpToken(vpToken) {
-  return parseWithErrorHandling3(
+  return parseWithErrorHandling4(
     zVpToken,
     parseIfJson(vpToken),
     "Could not parse dcql vp_token. Expected an object where the values are encoded presentations"
@@ -882,20 +1104,20 @@ function validateOpenid4vpAuthorizationResponsePayload(options) {
 }
 
 // src/jarm/verify-jarm-authorization-response.ts
-import { jwtSignerFromJwt } from "@openid4vc/oauth2";
+import { Oauth2Error as Oauth2Error2 } from "@pagopa/io-wallet-oauth2";
 import {
-  Oauth2Error,
   decodeJwt as decodeJwt2,
   decodeJwtHeader,
+  jwtSignerFromJwt,
+  stringToJsonWithErrorHandling,
   zCompactJwe,
   zCompactJwt,
   zJwtHeader as zJwtHeader2
-} from "@pagopa/io-wallet-oauth2";
-import { stringToJsonWithErrorHandling } from "@pagopa/io-wallet-utils";
+} from "@pagopa/io-wallet-utils";
 import z6 from "zod";
 
 // src/jarm/z-jarm.ts
-import { zJwtHeader, zJwtPayload as zJwtPayload2 } from "@pagopa/io-wallet-oauth2";
+import { zJwtHeader, zJwtPayload as zJwtPayload2 } from "@pagopa/io-wallet-utils";
 import { z as z5 } from "zod";
 var zJarmHeader = z5.object({
   ...zJwtHeader.shape,
@@ -951,7 +1173,7 @@ var decryptJarmAuthorizationResponseJwt = async (options) => {
     jwk: encryptionJwk
   });
   if (!result.decrypted) {
-    throw new Oauth2Error("Failed to decrypt jarm auth response.");
+    throw new Oauth2Error2("Failed to decrypt jarm auth response.");
   }
   return {
     decryptionJwk: result.decryptionJwk,
@@ -976,7 +1198,7 @@ async function verifyJarmAuthorizationResponse(options) {
     decryptedRequestData.payload
   ).success;
   if (!requestDataIsEncrypted && !responseIsSigned) {
-    throw new Oauth2Error(
+    throw new Oauth2Error2(
       "Jarm Auth Response must be either encrypted, signed, or signed and encrypted."
     );
   }
@@ -998,27 +1220,27 @@ async function verifyJarmAuthorizationResponse(options) {
       payload: jwsPayload
     });
     if (!verificationResult.verified) {
-      throw new Oauth2Error("Jarm Auth Response is not valid.");
+      throw new Oauth2Error2("Jarm Auth Response is not valid.");
     }
     const expectedAudience = authorizationRequestPayload.client_id;
     const expectedIssuer = authorizationRequestPayload.iss;
     if (response.aud !== expectedAudience) {
-      throw new Oauth2Error(
+      throw new Oauth2Error2(
         `Jarm Auth Response contains 'aud' value '${response.aud}', but expected '${expectedAudience}'.`
       );
     }
     if (expectedIssuer && response.iss !== expectedIssuer) {
-      throw new Oauth2Error(
+      throw new Oauth2Error2(
         `Jarm Auth Response contains 'iss' value '${response.iss}', but expected '${expectedIssuer}'.`
       );
     }
     const now = options.now ?? /* @__PURE__ */ new Date();
     const nowSeconds = Math.floor(now.getTime() / 1e3);
     if (response.exp < nowSeconds) {
-      throw new Oauth2Error("Jarm Auth Response has expired.");
+      throw new Oauth2Error2("Jarm Auth Response has expired.");
     }
     if (response.nbf !== void 0 && response.nbf > nowSeconds) {
-      throw new Oauth2Error("Jarm Auth Response is not active yet.");
+      throw new Oauth2Error2("Jarm Auth Response is not active yet.");
     }
     jarmAuthorizationResponse = response;
   } else {
@@ -1041,7 +1263,7 @@ async function verifyJarmAuthorizationResponse(options) {
 // src/jarm/parse-jarm-authorization-response.ts
 async function parseJarmAuthorizationResponse(options) {
   const { authorizationRequestPayload, callbacks, jarmResponseJwt, now } = options;
-  const jarmAuthorizationResponseJwt = parseWithErrorHandling4(
+  const jarmAuthorizationResponseJwt = parseWithErrorHandling5(
     z7.union([zCompactJwt2, zCompactJwe2]),
     jarmResponseJwt,
     "Invalid jarm authorization response jwt."
@@ -1056,7 +1278,7 @@ async function parseJarmAuthorizationResponse(options) {
     headerSchema: zJarmHeader,
     jwt: jarmAuthorizationResponseJwt
   });
-  const authorizationResponsePayload = parseWithErrorHandling4(
+  const authorizationResponsePayload = parseWithErrorHandling5(
     zOpenid4vpAuthorizationResponse,
     verifiedJarmResponse.jarmAuthorizationResponse,
     "Failed to parse openid4vp authorization response."
@@ -1088,7 +1310,7 @@ async function parseAuthorizationResponse(options) {
       jarmResponseJwt: authorizationResponse.response
     });
   }
-  const authorizationResponsePayload = parseWithErrorHandling5(
+  const authorizationResponsePayload = parseWithErrorHandling6(
     zOpenid4vpAuthorizationResponse,
     authorizationResponse,
     "Failed to parse openid4vp authorization response."
@@ -1103,11 +1325,6 @@ async function parseAuthorizationResponse(options) {
     expectedNonce: authorizationRequestPayload.nonce
   };
 }
-
-// src/index.ts
-import {
-  createOpenid4vpAuthorizationResponse
-} from "@openid4vc/openid4vp";
 export {
   ClientIdPrefix,
   CreateAuthorizationResponseError,