fix(wallet): restore mobile EHIC integration coverage

Author: szijpeter

waltid-applications/waltid-wallet-demo-ios/iosApp/iosAppTests/EudiTestBackend.swift

@@ -6,25 +6,25 @@ import TestHelpers
 actor EudiTestBackend {
     static let shared = EudiTestBackend()
 
-    /// Pinned `PID Issuer CA - UT 02` test-PKI anchor used by the EUDI verifier.
+    /// Pinned `PID Issuer CA 02` test-PKI anchor used by the EUDI verifier.
     static let verifierTrustAnchorPEM = """
     -----BEGIN CERTIFICATE-----
-    MIIC3TCCAoOgAwIBAgIUEwybFc9Jw+az3r188OiHDaxCfHEwCgYIKoZIzj0EAwMw
-    XDEeMBwGA1UEAwwVUElEIElzc3VlciBDQSAtIFVUIDAyMS0wKwYDVQQKDCRFVURJ
-    IFdhbGxldCBSZWZlcmVuY2UgSW1wbGVtZW50YXRpb24xCzAJBgNVBAYTAlVUMB4X
-    DTI1MDMyNDIwMjYxNFoXDTM0MDYyMDIwMjYxM1owXDEeMBwGA1UEAwwVUElEIElz
-    c3VlciBDQSAtIFVUIDAyMS0wKwYDVQQKDCRFVURJIFdhbGxldCBSZWZlcmVuY2Ug
-    SW1wbGVtZW50YXRpb24xCzAJBgNVBAYTAlVUMFkwEwYHKoZIzj0CAQYIKoZIzj0D
-    AQcDQgAEesDKj9rCIcrGj0wbSXYvCV953bOPSYLZH5TNmhTz2xa7VdlvQgQeGZRg
-    1PrF5AFwt070wvL9qr1DUDdvLp6a1qOCASEwggEdMBIGA1UdEwEB/wQIMAYBAf8C
-    AQAwHwYDVR0jBBgwFoAUYseURyi9D6IWIKeawkmURPEB08cwEwYDVR0lBAwwCgYI
-    K4ECAgAAAQcwQwYDVR0fBDwwOjA4oDagNIYyaHR0cHM6Ly9wcmVwcm9kLnBraS5l
-    dWRpdy5kZXYvY3JsL3BpZF9DQV9VVF8wMi5jcmwwHQYDVR0OBBYEFGLHlEcovQ+i
-    FiCnmsJJlETxAdPHMA4GA1UdDwEB/wQEAwIBBjBdBgNVHRIEVjBUhlJodHRwczov
-    L2dpdGh1Yi5jb20vZXUtZGlnaXRhbC1pZGVudGl0eS13YWxsZXQvYXJjaGl0ZWN0
-    dXJlLWFuZC1yZWZlcmVuY2UtZnJhbWV3b3JrMAoGCCqGSM49BAMDA0gAMEUCIQCe
-    4R9rO4JhFp821kO8Gkb8rXm4qGG/e5/Oi2XmnTQqOQIgfFs+LDbnP2/j1MB4rwZ1
-    FgGdpr4oyrFB9daZyRIcP90=
+    MIIC0zCCAnmgAwIBAgIUXRXxkLbUM6+njr/XT0IIw/HA/uowCgYIKoZIzj0EAwMw
+    VzEZMBcGA1UEAwwQUElEIElzc3VlciBDQSAwMjEtMCsGA1UECgwkRVVESSBXYWxs
+    ZXQgUmVmZXJlbmNlIEltcGxlbWVudGF0aW9uMQswCQYDVQQGEwJFVTAeFw0yNTA0
+    MDkwMDAzMzBaFw0zNDA3MDYwMDAzMjlaMFcxGTAXBgNVBAMMEFBJRCBJc3N1ZXIg
+    Q0EgMDIxLTArBgNVBAoMJEVVREkgV2FsbGV0IFJlZmVyZW5jZSBJbXBsZW1lbnRh
+    dGlvbjELMAkGA1UEBhMCRVUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARkqdLm
+    wIlv+SSWr00tAIrt7EAMztgd3w9qA6qEm16yVfsLcyx2f4oIWuH45wa37J9GoNWp
+    deo27VoSoNMCzxOYo4IBITCCAR0wEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSME
+    GDAWgBRCUFC+ELgQ8J1EXI2/qxAI7ifcSTATBgNVHSUEDDAKBggrgQICAAABBzBD
+    BgNVHR8EPDA6MDigNqA0hjJodHRwczovL3ByZXByb2QucGtpLmV1ZGl3LmRldi9j
+    cmwvcGlkX0NBX0VVXzAyLmNybDAdBgNVHQ4EFgQUQlBQvhC4EPCdRFyNv6sQCO4n
+    3EkwDgYDVR0PAQH/BAQDAgEGMF0GA1UdEgRWMFSGUmh0dHBzOi8vZ2l0aHViLmNv
+    bS9ldS1kaWdpdGFsLWlkZW50aXR5LXdhbGxldC9hcmNoaXRlY3R1cmUtYW5kLXJl
+    ZmVyZW5jZS1mcmFtZXdvcmswCgYIKoZIzj0EAwMDSAAwRQIhAIavYfC5o0VVLKfg
+    TKkzzWgc09hzDMsCl3O2le2sQfG7AiA2soqAN5gtUOLQKWK00DUz22EW79rvaV+V
+    JPvfdQeokA==
     -----END CERTIFICATE-----
     """
 

waltid-applications/waltid-wallet-demo-ios/iosApp/iosAppTests/MobileWalletIntegrationTests.swift

@@ -204,18 +204,10 @@ final class MobileWalletIntegrationTests: XCTestCase {
     }
 
     func testReceiveAndPresentEudiEhicSdJwtAgainstEudi() async throws {
-        try XCTSkipIf(
-            true,
-            "Pending native iOS PKIX/x509_hash Request Object authentication and EUDI trust-anchor refresh; tracked by https://github.com/walt-id/waltid-identity/pull/1940"
-        )
         try await receiveAndPresentEudiCredential(credentialID: Self.eudiEhicSdJwtCredentialID)
     }
 
     func testPreviewAndSubmitEudiEhicSdJwtAgainstEudi() async throws {
-        try XCTSkipIf(
-            true,
-            "Pending native iOS PKIX/x509_hash Request Object authentication and EUDI trust-anchor refresh; tracked by https://github.com/walt-id/waltid-identity/pull/1940"
-        )
         try await previewAndSubmitEudiCredential(credentialID: Self.eudiEhicSdJwtCredentialID)
     }
 

waltid-libraries/crypto/waltid-x509/src/iosMain/kotlin/id/walt/X590Ios.kt

@@ -1,7 +1,42 @@
 package id.walt.x509
 
-actual val platformSupportsPkixCertificatePathValidation: Boolean = false
+import kotlinx.cinterop.COpaquePointer
+import kotlinx.cinterop.ExperimentalForeignApi
+import kotlinx.cinterop.MemScope
+import kotlinx.cinterop.addressOf
+import kotlinx.cinterop.alloc
+import kotlinx.cinterop.memScoped
+import kotlinx.cinterop.ptr
+import kotlinx.cinterop.reinterpret
+import kotlinx.cinterop.usePinned
+import kotlinx.cinterop.value
+import platform.CoreFoundation.CFArrayAppendValue
+import platform.CoreFoundation.CFArrayCreateMutable
+import platform.CoreFoundation.CFArrayRef
+import platform.CoreFoundation.CFDataCreate
+import platform.CoreFoundation.CFErrorRefVar
+import platform.CoreFoundation.CFRelease
+import platform.CoreFoundation.kCFAllocatorDefault
+import platform.Foundation.CFBridgingRelease
+import platform.Foundation.NSError
+import platform.Security.SecCertificateCreateWithData
+import platform.Security.SecCertificateRef
+import platform.Security.SecPolicyCreateBasicX509
+import platform.Security.SecPolicyCreateRevocation
+import platform.Security.SecPolicyRef
+import platform.Security.SecTrustCreateWithCertificates
+import platform.Security.SecTrustEvaluateWithError
+import platform.Security.SecTrustRef
+import platform.Security.SecTrustRefVar
+import platform.Security.SecTrustSetAnchorCertificates
+import platform.Security.SecTrustSetAnchorCertificatesOnly
+import platform.Security.errSecSuccess
+import platform.Security.kSecRevocationUseAnyAvailableMethod
 
+@OptIn(ExperimentalForeignApi::class)
+actual val platformSupportsPkixCertificatePathValidation: Boolean = true
+
+@OptIn(ExperimentalForeignApi::class)
 @Throws(X509ValidationException::class)
 actual fun validateCertificateChain(
     leaf: CertificateDer,
@@ -10,18 +45,133 @@ actual fun validateCertificateChain(
     enableTrustedChainRoot: Boolean,
     enableSystemTrustAnchors: Boolean,
     enableRevocation: Boolean
-) {
-    if (enableSystemTrustAnchors) {
-        throw X509ValidationException("System trust anchors are not supported for iOS certificate validation.")
+) = memScoped {
+    val certificateReferences = mutableListOf<SecCertificateRef>()
+    val policyReferences = mutableListOf<SecPolicyRef>()
+    val arrayReferences = mutableListOf<CFArrayRef>()
+    var trustReference: SecTrustRef? = null
+
+    try {
+        val anchorDers = buildList {
+            addAll(trustAnchors.orEmpty())
+            if (enableTrustedChainRoot) {
+                addAll(chain.filter { certificate ->
+                    runCatching {
+                        PlatformX509Certificate.parse(certificate).isSelfSigned()
+                    }.getOrDefault(false)
+                })
+            }
+        }.distinct()
+        val certificateDers = (listOf(leaf) + chain)
+            .distinct()
+
+        if (anchorDers.isEmpty() && !enableSystemTrustAnchors) {
+            throw X509ValidationException(
+                "No trust anchors available: provide trustAnchors, include a trusted root, or enable system trust anchors."
+            )
+        }
+
+        certificateReferences += certificateDers.mapIndexed { index, certificate ->
+            certificate.toSecCertificate("certificate at position $index")
+        }
+        val certificates = if (certificateReferences.size == 1) {
+            certificateReferences.single()
+        } else {
+            createCFArray(certificateReferences).also(arrayReferences::add)
+        }
+
+        policyReferences += SecPolicyCreateBasicX509()
+            ?: throw X509ValidationException("Certificate validation failed: could not create the X.509 policy.")
+        if (enableRevocation) {
+            policyReferences += SecPolicyCreateRevocation(kSecRevocationUseAnyAvailableMethod)
+                ?: throw X509ValidationException("Certificate validation failed: could not create the revocation policy.")
+        }
+        val policies = if (policyReferences.size == 1) {
+            policyReferences.single()
+        } else {
+            createCFArray(policyReferences).also(arrayReferences::add)
+        }
+
+        val trust = alloc<SecTrustRefVar>().apply { value = null }
+        checkStatus(
+            operation = "create the certificate trust object",
+            status = SecTrustCreateWithCertificates(certificates, policies, trust.ptr),
+        )
+        trustReference = trust.value
+            ?: throw X509ValidationException("Certificate validation failed: trust object was not created.")
+
+        if (anchorDers.isNotEmpty()) {
+            certificateReferences += anchorDers.mapIndexed { index, certificate ->
+                certificate.toSecCertificate("trust anchor at position $index")
+            }
+            val anchorsArray = createCFArray(
+                certificateReferences.takeLast(anchorDers.size)
+            ).also(arrayReferences::add)
+
+            checkStatus(
+                operation = "set certificate trust anchors",
+                status = SecTrustSetAnchorCertificates(trustReference, anchorsArray),
+            )
+            checkStatus(
+                operation = "configure certificate trust anchors",
+                status = SecTrustSetAnchorCertificatesOnly(trustReference, !enableSystemTrustAnchors),
+            )
+        }
+
+        val error = alloc<CFErrorRefVar>().apply { value = null }
+        if (!SecTrustEvaluateWithError(trustReference, error.ptr)) {
+            val description = error.value?.let {
+                (CFBridgingRelease(it) as NSError).localizedDescription
+            } ?: "unknown Security framework error"
+            throw X509ValidationException(
+                "Certificate path invalid: $description"
+            )
+        }
+    } catch (cause: X509ValidationException) {
+        throw cause
+    } catch (cause: Exception) {
+        throw X509ValidationException("Certificate validation failed: ${cause.message}", cause)
+    } finally {
+        trustReference?.let(::CFRelease)
+        arrayReferences.forEach(::CFRelease)
+        policyReferences.forEach(::CFRelease)
+        certificateReferences.forEach(::CFRelease)
     }
-    if (enableRevocation) {
-        throw X509ValidationException("Revocation checking is not supported for iOS certificate validation.")
+}
+
+@OptIn(ExperimentalForeignApi::class)
+private fun CertificateDer.toSecCertificate(description: String): SecCertificateRef {
+    val byteArray = bytes.toByteArray()
+    val data = byteArray.usePinned { pinned ->
+        CFDataCreate(
+            allocator = kCFAllocatorDefault,
+            bytes = pinned.addressOf(0).reinterpret(),
+            length = byteArray.size.toLong(),
+        )
+    } ?: throw X509ValidationException("Certificate validation failed: could not create certificate data.")
+    return try {
+        SecCertificateCreateWithData(kCFAllocatorDefault, data)
+            ?: throw X509ValidationException(
+                "Certificate chain validation failed: invalid X.509 DER in $description."
+            )
+    } finally {
+        CFRelease(data)
     }
+}
 
-    validateCertificateChainWithExplicitTrust(
-        leaf = leaf,
-        chain = chain,
-        trustAnchors = trustAnchors,
-        enableTrustedChainRoot = enableTrustedChainRoot,
-    )
+@OptIn(ExperimentalForeignApi::class)
+private fun MemScope.createCFArray(values: List<COpaquePointer>): CFArrayRef {
+    val array = CFArrayCreateMutable(
+        allocator = kCFAllocatorDefault,
+        capacity = values.size.toLong(),
+        callBacks = null,
+    ) ?: throw X509ValidationException("Certificate validation failed: could not create a Core Foundation array.")
+    values.forEach { value -> CFArrayAppendValue(array, value) }
+    return array
+}
+
+private fun checkStatus(operation: String, status: Int) {
+    if (status != errSecSuccess) {
+        throw X509ValidationException("Certificate validation failed: could not $operation (OSStatus $status).")
+    }
 }