feat(wallet-api): add OpenID4VP 1.0 holder support with draft compatibility (includes holder-bound key selection alignment)#1655
Conversation
fix(wallet-api): remove core-wallet classpath collision
Fixed 1 file(s) based on 1 unresolved review comment. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
… deep-link bootstrap
Both demo and dev wallet presentation-init pages currently do encodeURI(decodeURI(fixRequest(...))) before base64url-wrapping the request.
This is unsafe for already URL-encoded OpenID4VP query payloads (dcql_query/request object parameters): decode+re-encode can alter percent-encoded content and change request semantics, which can surface as failed credential matching for otherwise valid requests.
In this flow the input already comes from window.location.search (encoded query string), and we immediately pass the normalized request through encodeRequest() (base64url). Additional URI normalization is redundant and introduces risk.
Change made (consistently in both apps):
- replace encodeURI(decodeURI(fixRequest('openid://' + window.location.search)))
- with fixRequest('openid://' + window.location.search)
Files:
- waltid-demo-wallet src/pages/api/siop/initiatePresentation.vue
- waltid-dev-wallet src/pages/api/siop/initiatePresentation.vue
Scope intentionally minimal: no wallet-api/protocol behavior changes, only safer request forwarding from web wallet entrypoint.
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 53 minutes and 53 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (21)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
1 participant
Summary
This PR adds OpenID4VP 1.0 holder-flow support to wallet-api and wallet web flow, while preserving existing draft OpenID4VC presentation compatibility.
It also includes holder-bound key selection alignment in the same PR so task-1 is reviewable as one coherent unit.
Why
The stack already has OpenID4VP 1.0 libraries and verifier2 support, but wallet-api still primarily followed draft-centric handling.
This PR bridges that gap by wiring wallet-api + wallet UI to the v1 holder path without breaking legacy draft behavior.
What this PR changes
request_uri, unsignedrequest, signed request-object path) through shared resolver logic.In scope / out of scope
transaction_datafeature set (covered by follow-up PR).References
x5cDER -> PEM not being converted #1272