fix(portal2): keep simple PID signing materials off the browser

[JakeFernandes98]

Summary

This stops Portal2 from shipping German, France Identité, and EUDI Reference Wallet private keys and certificates in the browser bundle. Simple PID create now sends only a material id plus a secret-free payload; Portal2 injects the signing materials from server-only env and redacts key, x5c, and verifier_info from that create response.

Fixes WAL-1382. The keys were previously hardcoded in simplePidVerificationRequests.ts and visible in page JS and the Network tab.

What Changed

Simple PID client

• PID presets keep labels, DCQL, and signed/encrypted flags only.
• Simple verify posts to /api/pid-verification-session/create with a material id. basic-pid stays unsigned and sends no material.
• Advanced verify is unchanged and may still send user-supplied or NUXT_PUBLIC_VERIFIER_* keys directly to verifier2.

Portal2 server

• New Nitro route loads NUXT_PID_* materials, strips any client-supplied secrets, injects key/x5c/clientId/verifierInfo, and forwards to verifier2.
• Forward target is NUXT_VERIFIER_PROXY_TARGET, otherwise an absolute NUXT_PUBLIC_VERIFIER_BASE.
• Only this PID create response is redacted. SSE and session info still use the public verifier base.

Deploy

• README and .env.example document empty NUXT_PID_* placeholders.
• Helm portal2.env adds the same placeholders. Live key material is not in this PR.

Architecture Notes

• Scope is simple PID presets only. Forcing all verifier traffic through /verifier-api would hide advanced keys as well and was intentionally avoided.
• The signed OpenID4VP request may still carry the public certificate; the private key must not appear in the PID client bundle, PID create request, or PID create response.

Caveats and Follow-Ups

• These keys remain in git history and should be treated as rotated/replaced in deployment secrets.
• Signed PID presets fail closed with a 502 when the matching NUXT_PID_* env is unset.
• Helm values are empty placeholders. Production/demo need a Kubernetes secret overlay before signed PID wallets work again.
• Advanced verifier key/x5c UI and swagger examples are unchanged and may still appear in the Network tab.

Breaking

• Portal2 signed PID presets now require server-only NUXT_PID_* environment variables. Unsigned basic-pid is unchanged.

[linear-code]

WAL-1382

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: df5da655-1c02-4746-bb13-93885587008e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud