WAL-1321 - #2158
Draft
waltkb wants to merge 17 commits into
Draft
Conversation
Verifier2Service.registerRoute registered the whole verifier surface, so every deployment also exposed the management routes: POST verification-session/create accepts a caller-supplied DCQL query and verification policy list, and POST vical/fetch makes the server fetch a caller-supplied URL. Add Verifier2RouteSurface so a deployment selects the groups it needs. The routes are left out of the routing tree entirely rather than guarded, so an unused surface answers 404 instead of depending on a check being correct. Defaults to the full set, so verifier-api2 and its tests are unchanged.
Same problem as the verifier surface: OpenId4VciController registered everything, so a deployment that issues only through the pre-authorized code flow still exposed the authorization code endpoints, the external login redirect and its OAuth callback, and offer retrieval by reference. Add Issuer2RouteSurface with METADATA, ISSUANCE, CREDENTIAL_OFFER_BY_REFERENCE, AUTHORIZATION_CODE and EXTERNAL_LOGIN, plus a preAuthorizedCodeOnly convenience. Unregistered groups are absent from the routing tree and answer 404 rather than depending on a guard or a gateway rule. Excluding EXTERNAL_LOGIN also removes the only reason a deployment needs the "auth-oauth" authentication provider installed, since that is the sole authenticate() block in the controller. Defaults to the full set, so issuer-api2 and its tests are unchanged.
Contributor
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
# Conflicts: # waltid-services/waltid-issuer-api2/src/main/kotlin/id/walt/issuer2/controller/OpenId4VciController.kt
Verifier2Service.registerRoute registered the whole verifier surface, so every deployment also exposed the management routes: POST verification-session/create accepts a caller-supplied DCQL query and verification policy list, and POST vical/fetch makes the server fetch a caller-supplied URL. Add Verifier2RouteSurface so a deployment selects the groups it needs. The routes are left out of the routing tree entirely rather than guarded, so an unused surface answers 404 instead of depending on a check being correct. Defaults to the full set, so verifier-api2 and its tests are unchanged.
Same problem as the verifier surface: OpenId4VciController registered everything, so a deployment that issues only through the pre-authorized code flow still exposed the authorization code endpoints, the external login redirect and its OAuth callback, and offer retrieval by reference. Add Issuer2RouteSurface with METADATA, ISSUANCE, CREDENTIAL_OFFER_BY_REFERENCE, AUTHORIZATION_CODE and EXTERNAL_LOGIN, plus a preAuthorizedCodeOnly convenience. Unregistered groups are absent from the routing tree and answer 404 rather than depending on a guard or a gateway rule. Excluding EXTERNAL_LOGIN also removes the only reason a deployment needs the "auth-oauth" authentication provider installed, since that is the sole authenticate() block in the controller. Defaults to the full set, so issuer-api2 and its tests are unchanged.
JakeFernandes98
force-pushed
the
feat/wal-1321
branch
from
September 1, 2026 08:21
6c52eb9 to
59e2f9a
Compare
… in token failures
… wallet cannot echo it
# Conflicts: # waltid-libraries/credentials/waltid-mdoc-credentials2/src/jvmTest/kotlin/MdocIssuanceTest.kt
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This adds
Issuer2RouteSurfaceandVerifier2RouteSurfaceso a deployment can register only the OpenID4VCI and OpenID4VP routes it actually exposes. The license operations server is the first consumer: it issues through the pre-authorized code flow and only receives wallet presentations for heartbeats, so it must not publish session-create, VICAL fetch, authorization-code, or external-login endpoints on an internet-facing process.Unregistered groups stay out of the Ktor routing tree and answer 404. They are not hidden behind a guard or a gateway rule. Defaults remain the full set, so
issuer-api2,verifier-api2, and their existing tests are unchanged.Ticket: WAL-1321.
Related PRs:
What Changed
Verifier route surfaces
Verifier2Service.registerRoutenow takes asurfacesset.SESSION_MANAGEMENTis the operator surface (POST create, session info, SSE). It accepts a caller-supplied DCQL query and verification policies.CLIENTis the wallet-facing request/response surface.TRANSACTION_DATA_PROFILESandVICAL(POST vical/fetchpulls a caller-supplied URL) are optional independently.clientOnlyis the convenience set for a deployment that only needs to receive presentations.Issuer route surfaces
OpenId4VciController.registernow takes asurfacesset.METADATA,ISSUANCE,CREDENTIAL_OFFER_BY_REFERENCE,AUTHORIZATION_CODE, andEXTERNAL_LOGIN.preAuthorizedCodeOnlyis metadata plus token/nonce/credential: enough to redeem a by-value pre-authorized offer.EXTERNAL_LOGINalso removes the onlyauthenticate("auth-oauth")block in the controller, so that provider does not need to be installed.Architecture Notes
clientOnly/preAuthorizedCodeOnly. That wiring lives in walt-id/waltid-identity-enterprise-license#11, not in this repository.Caveats and Follow-Ups
issuer-api2/verifier-api2images keep the full surface until a deployment opts in.Breaking