feat(wallet): finalize authenticated OpenID4VP presentation flow

* feat(verifier2): expose authenticated request objects

* feat(wallet): finalize authenticated OpenID4VP presentation flow

Author: szijpeter

waltid-applications/mobile-e2e-fixtures/ios/TestHelpers/DemoBackend.swift

@@ -192,6 +192,9 @@ public final class DemoBackend {
                 "credentials": [scenario.verifierCredentialQuery],
             ],
         ]
+        if !bindClientIDToResponseURI {
+            coreFlow["signed_request"] = true
+        }
         if let requestedSessionID {
             let responseURI = Self.verifierBaseURL
                 .appendingPathComponent("verification-session")
@@ -229,16 +232,66 @@ public final class DemoBackend {
                 userInfo: [NSLocalizedDescriptionKey: "Public demo verifier2 did not preserve the requested session ID"]
             )
         }
-        let requestURL = response["bootstrapAuthorizationRequestUrl"] as? String
-            ?? response["authorizationRequestUrl"] as? String
-            ?? response["fullAuthorizationRequestUrl"] as? String
-        guard let requestURL, !requestURL.isEmpty else {
+        guard let inlineRequestURL = response["fullAuthorizationRequestUrl"] as? String,
+              let inlineComponents = URLComponents(string: inlineRequestURL) else {
             throw NSError(
                 domain: "WalletE2E",
                 code: 302,
-                userInfo: [NSLocalizedDescriptionKey: "Missing authorization request URL in public demo verifier2 response: \(response)"]
+                userInfo: [NSLocalizedDescriptionKey: "Public demo verifier2 response is missing fullAuthorizationRequestUrl: \(response)"]
             )
         }
+        guard let requestURL = response["bootstrapAuthorizationRequestUrl"] as? String,
+              let bootstrapComponents = URLComponents(string: requestURL) else {
+            throw NSError(
+                domain: "WalletE2E",
+                code: 303,
+                userInfo: [NSLocalizedDescriptionKey: "Public demo verifier2 response is missing bootstrapAuthorizationRequestUrl: \(response)"]
+            )
+        }
+
+        let inlineQuery = inlineComponents.queryItems ?? []
+        let bootstrapQuery = bootstrapComponents.queryItems ?? []
+        if bindClientIDToResponseURI {
+            let expectedResponseURI = Self.verifierBaseURL
+                .appendingPathComponent("verification-session")
+                .appendingPathComponent(sessionID)
+                .appendingPathComponent("response")
+                .absoluteString
+            let clientID = inlineQuery.first(where: { $0.name == "client_id" })?.value
+            let responseURI = inlineQuery.first(where: { $0.name == "response_uri" })?.value
+            guard clientID == "redirect_uri:\(expectedResponseURI)", responseURI == expectedResponseURI else {
+                throw NSError(
+                    domain: "WalletE2E",
+                    code: 309,
+                    userInfo: [NSLocalizedDescriptionKey: "Public demo verifier2 response-bound client_id/response_uri mismatch: \(response)"]
+                )
+            }
+            guard bootstrapQuery.contains(where: { $0.name == "request_uri" && !($0.value ?? "").isEmpty }) else {
+                throw NSError(
+                    domain: "WalletE2E",
+                    code: 310,
+                    userInfo: [NSLocalizedDescriptionKey: "Public demo verifier2 response-bound bootstrap URL is missing request_uri: \(response)"]
+                )
+            }
+        } else {
+            guard let inlineRequest = inlineQuery.first(where: { $0.name == "request" })?.value,
+                  !inlineRequest.isEmpty,
+                  inlineQuery.contains(where: { $0.name == "request_uri" }) == false else {
+                throw NSError(
+                    domain: "WalletE2E",
+                    code: 302,
+                    userInfo: [NSLocalizedDescriptionKey: "Public demo verifier2 has not deployed the signed inline Request Object contract: fullAuthorizationRequestUrl must contain request and must not contain request_uri. Deploy the verifier2 change before running mobile E2E tests. Response: \(response)"]
+                )
+            }
+            guard bootstrapQuery.contains(where: { $0.name == "request_uri" && !($0.value ?? "").isEmpty }),
+                  bootstrapQuery.contains(where: { $0.name == "request_uri_method" && $0.value == "post" }) else {
+                throw NSError(
+                    domain: "WalletE2E",
+                    code: 303,
+                    userInfo: [NSLocalizedDescriptionKey: "Public demo verifier2 has not deployed the signed POST bootstrap contract: bootstrapAuthorizationRequestUrl must contain request_uri and request_uri_method=post. Deploy the verifier2 change before running mobile E2E tests. Response: \(response)"]
+                )
+            }
+        }
 
         return DemoVerifierSession(sessionID: sessionID, authorizationRequestUri: requestURL)
     }

waltid-applications/mobile-e2e-fixtures/ios/TestHelpers/X509RequestObjectFixture.swift

@@ -0,0 +1,39 @@
+import Foundation
+
+public enum X509RequestObjectFixture {
+    /// SHA-256 Base64URL hash of the leaf certificate in `signedRequestObject`.
+    public static let clientID = "x509_hash:IT2EMOaIMUTx1zj0yteLZyOgkXF6Siw2t_K42tsKT_I"
+
+    /// Test-only CA for the leaf in `signedRequestObject`, valid until July 2036.
+    public static let trustAnchorPEM = """
+    -----BEGIN CERTIFICATE-----
+    MIIB6zCCAZGgAwIBAgIUSFgRXRcRirEjuPvPM38K5ZGrPpcwCgYIKoZIzj0EAwIw
+    QzEvMC0GA1UEAwwmd2FsdC5pZCBBcHAtSG9zdGVkIFg1MDkgSGFzaCBUZXN0IFJv
+    b3QxEDAOBgNVBAoMB3dhbHQuaWQwHhcNMjYwNzI3MDkyMDIwWhcNMzYwNzI0MDky
+    MDIwWjBDMS8wLQYDVQQDDCZ3YWx0LmlkIEFwcC1Ib3N0ZWQgWDUwOSBIYXNoIFRl
+    c3QgUm9vdDEQMA4GA1UECgwHd2FsdC5pZDBZMBMGByqGSM49AgEGCCqGSM49AwEH
+    A0IABFqSCpC466BkSl98zsxgt63FTIjBltCCxhDCHcTZ1+T8ljrbYGHxEVWAiq/T
+    XFvAE971gsSm/3lZSgE0lk5pfrijYzBhMB0GA1UdDgQWBBTk0sEWqbKG1u+e8nSa
+    +01kr6XitDAfBgNVHSMEGDAWgBTk0sEWqbKG1u+e8nSa+01kr6XitDAPBgNVHRMB
+    Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNIADBFAiBPP37V
+    E9U0V2Uax6E9uI00qAtm+feze/eCEtuMs3fRlwIhAP96ce+J+6kuWRvUSZPYISuf
+    2JhW6xQPYQbAK6L6nIeR
+    -----END CERTIFICATE-----
+    """
+
+    /// Fixed ES256 `x509_hash` Request Object with a matching `x5c` leaf.
+    public static let signedRequestObject = [
+        "eyJhbGciOiJFUzI1NiIsInR5cCI6Im9hdXRoLWF1dGh6LXJlcStqd3QiLCJ4NWMiOlsiTUlJQjdUQ0NBWktnQXdJQkFnSVVMQ3QwbGllc2tseVpnMGxsLyt2M0NVWXAwQ2N3Q2dZSUtvWkl6ajBFQXdJd1F6RXZNQzBHQTFVRUF3d21kMkZzZEM1cFpDQkJjSEF0U0c5emRHVmtJRmcxTURrZ1NHRnphQ0JVWlhOMElGSnZiM1F4RURBT0JnTlZCQW9NQjNkaGJIUXVhV1F3SGhjTk1qWXdOekkzTURreU1ESXdXaGNOTXpZd056STBNRGt5TURJd1dqQkhNVE13TVFZRFZRUUREQ3AzWVd4MExtbGtJRUZ3Y0MxSWIzTjBaV1FnV0RVd09TQklZWE5vSUZSbGMzUWdWbVZ5YVdacFpYSXhFREFPQmdOVkJBb01CM2RoYkhRdWFXUXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBVEk1c2VTWGRSRUZnS1lLWnl5SVU4RStqajRjaDdoQUlyanA2YUl6eXBhQ2FvUC9XNmM3TGMwR04rY3o4RTF1YU1POFZjdmNGN1ZQUE9lUDkxWDAzWGlvMkF3WGpBTUJnTlZIUk1CQWY4RUFqQUFNQTRHQTFVZER3RUIvd1FFQXdJSGdEQWRCZ05WSFE0RUZnUVVTZUlNb05saUdQY29aUG1nT0Z6MlhTYUJqM3N3SHdZRFZSMGpCQmd3Rm9BVTVOTEJGcW15aHRidm52SjBtdnROWksrbDRyUXdDZ1lJS29aSXpqMEVBd0lEU1FBd1JnSWhBTjBUVGhlZW1aa1pYUk5jSFhUdENjaVJOc0o5czBWckpQR1J2V2I2UnlGU0FpRUEwTHhla09hK2pxRjhKTHArbzNXNzBMaDlCY253ZDRzRkFuQWJ5WFRNUHFFPSJdfQ",
+        ".eyJhdWQiOiJodHRwczovL3NlbGYtaXNzdWVkLm1lL3YyIiwiZXhwIjoyMDgyNzU4NDAwLCJjbGllbnRfaWQiOiJ4NTA5X2hhc2g6SVQyRU1PYUlNVVR4MXpqMHl0ZUxaeU9na1hGNlNpdzJ0X0s0MnRzS1RfSSIsInJlc3BvbnNlX3R5cGUiOiJ2cF90b2tlbiIsInJlc3BvbnNlX21vZGUiOiJkaXJlY3RfcG9zdCIsInJlc3BvbnNlX3VyaSI6Imh0dHBzOi8vdmVyaWZpZXIuZXhhbXBsZS5jb20vcmVzcG9uc2UiLCJub25jZSI6ImFwcC1ob3N0ZWQteDUwOS1oYXNoLXRlc3QiLCJzdGF0ZSI6ImFwcC1ob3N0ZWQteDUwOS1oYXNoLXRlc3QiLCJkY3FsX3F1ZXJ5Ijp7ImNyZWRlbnRpYWxzIjpbeyJpZCI6InRlc3RfY3JlZGVudGlhbCIsImZvcm1hdCI6ImRjK3NkLWp3dCIsIm1ldGEiOnsidmN0X3ZhbHVlcyI6WyJ1cm46ZXhhbXBsZTp0ZXN0Il19fV0sImNyZWRlbnRpYWxfc2V0cyI6W3sib3B0aW9ucyI6W1sidGVzdF9jcmVkZW50aWFsIl1dLCJyZXF1aXJlZCI6ZmFsc2V9XX0sImNsaWVudF9tZXRhZGF0YSI6e319",
+        ".2qQUOrCDfL2SVBHa4z-KbkhjrzRFUft-jto17Mq3p4XhSyUOhlcl_FQlGNGJLHrLri06MGnVoO8dM8mCUofRPg",
+    ].joined()
+
+    public static let authorizationRequestURL: URL = {
+        var components = URLComponents(string: "openid4vp://authorize")!
+        components.queryItems = [
+            URLQueryItem(name: "client_id", value: clientID),
+            URLQueryItem(name: "request", value: signedRequestObject),
+        ]
+        return components.url!
+    }()
+}

waltid-applications/waltid-wallet-demo-ios/iosApp/iosAppTests/MobileWalletIntegrationTests.swift

@@ -132,6 +132,46 @@ final class MobileWalletIntegrationTests: XCTestCase {
 
     // MARK: - Tests (mirror Android MobileWalletIntegrationTest.kt)
 
+    func testAppHostedWalletValidatesSignedRequestObjectCertificateChain() async throws {
+        let wallet = try await Wallet(
+            configuration: WalletConfiguration(
+                walletID: testWalletId,
+                clientIDTrustConfiguration: WalletClientIDTrustConfiguration(
+                    x509TrustAnchorsPEM: [X509RequestObjectFixture.trustAnchorPEM]
+                )
+            )
+        )
+        _ = try await wallet.bootstrap()
+
+        let result = try await wallet.previewPresentation(request: X509RequestObjectFixture.authorizationRequestURL)
+        guard case let .ready(preview) = result else {
+            XCTFail("The pinned X.509 Request Object should authenticate and produce a preview: \(result)")
+            return
+        }
+        XCTAssertTrue(preview.credentialOptions.isEmpty)
+        XCTAssertTrue(preview.credentialRequirements.isEmpty)
+    }
+
+    func testAppHostedWalletRejectsUntrustedSignedRequestObjectCertificateChain() async throws {
+        let wallet = try await Wallet(
+            configuration: WalletConfiguration(
+                walletID: testWalletId,
+                clientIDTrustConfiguration: WalletClientIDTrustConfiguration(
+                    x509TrustAnchorsPEM: [EudiTestBackend.verifierTrustAnchorPEM]
+                )
+            )
+        )
+
+        do {
+            _ = try await wallet.previewPresentation(request: X509RequestObjectFixture.authorizationRequestURL)
+            XCTFail("Expected the signed Request Object to be rejected without the pinned trust anchor")
+        } catch {
+            let description = String(describing: error)
+            XCTAssertFalse(description.contains("No matches found for required credential queries"), description)
+            XCTAssertTrue(description.contains("InvalidSignature"), description)
+        }
+    }
+
     func testBootstrapCreatesKeyAndDid() async throws {
         let wallet = try await makeWallet()
 

waltid-libraries/credentials/waltid-dcql/src/commonMain/kotlin/id/walt/dcql/CredentialModel.kt

@@ -21,6 +21,9 @@ data class DcqlDisclosure(
     val name: String?,
     val value: JsonElement,
 
+    /** Full SD-JWT Claim Path locating this disclosure within the credential. */
+    val location: List<JsonElement>? = null,
+
     // A place to pass a reference to the original (using which this class was created)
     //val original: Any? = null // no longer needed?
 )

waltid-libraries/credentials/waltid-dcql/src/commonMain/kotlin/id/walt/dcql/DcqlMatchException.kt

@@ -1,4 +1,13 @@
 package id.walt.dcql
 
 // Custom exception for match failures
-class DcqlMatchException(message: String) : Exception(message)
+open class DcqlMatchException(message: String) : Exception(message)
+
+/** A well-formed request asks for a credential that is not available locally. */
+class RequiredCredentialUnavailableException(
+    val queryIds: List<String>,
+    message: String,
+) : DcqlMatchException(message)
+
+/** The request contains a constraint that this matcher cannot evaluate safely. */
+class UnsupportedDcqlConstraintException(message: String) : DcqlMatchException(message)