test(verifier): repair origin-bound DC API fixture

[szijpeter]

Summary

Repairs the static DC API verifier vector for the canonical origin https://portal2.demo.walt.id.

The request object, x509 client authentication, required static-discovery audience, DCQL query, and mdoc response now form one cryptographically coherent transaction.

What Changed

Request authentication and coherence

• Replaces the placeholder x509_hash with the SHA-256 hash of the request leaf certificate's DER.
• Uses a real client-auth certificate chain in the signed request object and asserts authentication against its trust anchor.
• Includes the required static-discovery audience https://self-issued.me/v2 in the signed Request Object.
• Aligns the canonical origin and nonce across session metadata, request URL, signed request object, and expected_origins.
• Preserves the age_over_21 DCQL claim and compares the request's response type, client ID, response mode, audience, nonce, expected origins, DCQL, and client metadata.

mdoc verification

• Uses verifier-side DC API session-transcript reconstruction for DeviceAuth verification.
• Uses a verifier-supported ES256 device signature and a static mdoc containing all requested claims.
• Keeps direct-post success coverage and rejects an issuer-auth algorithm outside the request metadata.

Test-fixture boundaries

• Keeps MdlTestFixture local to verifier-api2.
• Removes the verifier test's unnecessary wallet and service-commons-test dependencies.
• Production protocol behavior is unchanged.

Caveats and Follow-Ups

The vector intentionally omits state: DC API JSON responses do not echo it, and the production DC API session shape already uses null.

Breaking

None.

[linear-code]

WAL-752

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ef719e47-ff72-4ba0-b50d-a2109d00b31d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud