fix: add try/catch for play integrity call

.changeset/crisp-steaks-kneel.md

@@ -0,0 +1,5 @@
+---
+"io-wallet-user-func": patch
+---
+
+Fixed HTTP status for Google Play Integrity API failures: external service errors now return 500 instead of 409

apps/io-wallet-user-func/src/infra/http/handlers/__test__/create-wallet-attestation.spec.ts

@@ -23,6 +23,7 @@ import { describe, expect, it } from "vitest";
 
 import { AttestationService } from "@/attestation-service";
 import { CertificateRepository } from "@/certificates";
+import { ExternalServiceError } from "@/infra/mobile-attestation-service/android/assertion";
 import { iOSMockData } from "@/infra/mobile-attestation-service/ios/__test__/config";
 import { NonceRepository } from "@/nonce";
 import { WalletInstanceRepository } from "@/wallet-instance";
@@ -742,4 +743,57 @@ describe("CreateWalletAttestationHandler", async () => {
       }),
     });
   });
+
+  it("should return a 500 HTTP response when validateAssertion returns ExternalServiceError", async () => {
+    const mockAttestationServiceExternalServiceError: AttestationService = {
+      getHardwarePublicTestKey: () => TE.left(new Error("not implemented")),
+      validateAssertion: () => TE.left(new ExternalServiceError("foo")),
+      validateAttestation: () =>
+        TE.right({
+          deviceDetails: { platform: "ios" },
+          hardwareKey: {
+            crv: "P-256",
+            kid: "ea693e3c-e8f6-436c-ac78-afdf9956eecb",
+            kty: "EC",
+            x: "01m0xf5ujQ5g22FvZ2zbFrvyLx9bgN2AiLVFtca2BUE",
+            y: "7ZIKVr_WCQgyLOpTysVUrBKJz1LzjNlK3DD4KdOGHjo",
+          },
+        }),
+    };
+    const req = {
+      ...H.request("https://wallet-provider.example.org"),
+      body: {
+        assertion: walletAttestationRequest,
+        fiscal_code: mockFiscalCode,
+      },
+      method: "POST",
+    };
+    const handler = CreateWalletAttestationHandler({
+      attestationService: mockAttestationServiceExternalServiceError,
+      certificateRepository,
+      federationEntity,
+      input: req,
+      inputDecoder: H.HttpRequest,
+      logger,
+      nonceRepository,
+      signer,
+      walletAttestationConfig,
+      walletInstanceRepository,
+    });
+
+    await expect(handler()).resolves.toEqual({
+      _tag: "Right",
+      right: expect.objectContaining({
+        body: {
+          detail: "ExternalServiceError",
+          status: 500,
+          title: "Internal Server Error",
+        },
+        headers: expect.objectContaining({
+          "Content-Type": "application/problem+json",
+        }),
+        statusCode: 500,
+      }),
+    });
+  });
 });

apps/io-wallet-user-func/src/infra/mobile-attestation-service/android/assertion.ts

@@ -39,6 +39,10 @@ export interface VerifyAssertionParams {
 
 export const playintegrity = google.playintegrity("v1");
 
+export class ExternalServiceError extends Error {
+  name = "ExternalServiceError";
+}
+
 export const verifyAssertion = async (
   params: VerifyAssertionParams,
 ): Promise<ValidationResult> => {
@@ -85,12 +89,17 @@ export const verifyAssertion = async (
   let responseValidated;
 
   for (const packageName of bundleIdentifiers) {
-    const result = await playintegrity.v1.decodeIntegrityToken({
-      packageName,
-      requestBody: {
-        integrityToken: integrityAssertion,
-      },
-    });
+    let result;
+    try {
+      result = await playintegrity.v1.decodeIntegrityToken({
+        packageName,
+        requestBody: {
+          integrityToken: integrityAssertion,
+        },
+      });
+    } catch {
+      throw new ExternalServiceError();
+    }
 
     const token = result.data.tokenPayloadExternal;
 

apps/io-wallet-user-func/src/infra/mobile-attestation-service/index.ts

@@ -24,6 +24,7 @@ import {
   validateAndroidAssertion,
   validateAndroidAttestation,
 } from "./android";
+import { ExternalServiceError } from "./android/assertion";
 import {
   parseIosAssertion,
   parseIosAttestation,
@@ -123,9 +124,14 @@ export class MobileAttestationService implements AttestationService {
                 ),
               ),
               TE.orElseW((androidErr) =>
-                TE.left(
-                  new IntegrityCheckError([iosErr.message, androidErr.message]),
-                ),
+                androidErr instanceof ExternalServiceError
+                  ? TE.left(androidErr)
+                  : TE.left(
+                      new IntegrityCheckError([
+                        iosErr.message,
+                        androidErr.message,
+                      ]),
+                    ),
               ),
             ),
           ),