[WAL-896] feat(verifier2): expose authenticated request objects

[szijpeter]

Summary

This PR isolates the verifier-side OpenID4VP Request Object changes needed by the WAL-896 stack. Signed cross-device sessions now expose an authenticated compact Request Object on the full authorization URL, while request_uri POST retrieval stays available for nonce-bound bootstrap.

It is rebased onto current main after walt-id/waltid-identity#2031 (WAL-1261 kid handling). The dependent wallet PR is walt-id/waltid-identity#1885. Enterprise CI companion: walt-id/waltid-identity-enterprise#604.

What Changed

• Signed inline cross-device sessions now expose the authenticated compact Request Object in the full authorization URL and drop request_uri from that URL.
• DC API sessions keep request_uri-based authorizationRequestUrl construction.
• The bootstrap URL remains the request_uri entry point for wallets that need nonce-bound POST retrieval.
• Request URI POST coverage verifies the Request Object with Verifier2RequestObjectKid.forClient and the original signing key, rather than comparing Crypto2 key IDs to kid.

Architecture Notes

• This branch contains verifier producer behavior only. Wallet resolver, wallet presentation, DC API, response-encryption, mobile-model, iOS, and Enterprise product changes remain in the dependent PRs.
• WAL-1261 already landed on main: Verifier2RequestObjectKid, request_uri POST requireMatchingKeyId, and setup.withCoreKeyIfMissing. This PR does not replace that kid contract.
• Signed-URL inlining is limited to cross-device so DC API sessions are not rewritten onto a compact request JWT.

Caveats and Follow-Ups

• Merge order: this PR with Enterprise fix: allow unknown keys in json for interoperability #604, then walt-id/waltid-identity#1885 with walt-id/waltid-identity-enterprise#553, then walt-id/waltid-identity#2091.
• Transport-scheme policy is unchanged; broader HTTPS enforcement remains outside this scope.

Breaking

• No public API or wire-format removal is introduced; the signed Request Object behavior is made consistent with the OpenID4VP contract.

[linear-code]

WAL-896

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c092aa45-9fc9-4ae5-b5ea-e413a25df683

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[JakeFernandes98]

Superseded by folding the WAL-896 identity stack into #2091, which now targets main and includes this verifier work plus the wallet and DC API follow-ups.