feat(wallet): add Compose web demo against wallet-api2 auth

[JakeFernandes98]

Summary

This adds a no-install Compose Multiplatform web wallet demo against wallet-api2 with auth enabled, so a reviewer can run the docker identity stack (issuer2, verifier2, wallet-api2) and complete issuance and presentation in the browser.

The Wasm host is a custodial wallet-api2 client (email/password JWT, isolated /wallet HTTP). It does not run the mobile wallet SDK and it does not replace waltid-web-wallet (wallet-api v1). Android and iOS continue to use the SDK, PIN, and platform keys.

Ticket: WAL-1198

What Changed

wallet-api2

• Register the ktor-authnz Authentication provider before WebService installs the plugin. Without that, enabling auth fails at startup with a missing ktor-authnz configuration.
• CORS now allows GET, POST, PUT, DELETE, PATCH, HEAD, and OPTIONS so a browser client can call .../keys/{id}/set-default and .../dids/{did}/set-default.

Docker identity profile

• Enable the auth feature on wallet-api2 and add a demo auth.conf JWT signing key (local compose only; same pattern as the other identity demo keys).
• Document that published stable (0.23.0) cannot load this auth.conf. Use latest or a locally built 1.0.0-SNAPSHOT image for wallet-api2 when auth is on.

Compose web demo

• Email/password register and login (POST /auth/register, POST /auth/emailpass). JWT in localStorage; wallet id in localStorage and a cookie.
• After login the wallet opens unlocked (no PIN/biometrics) and bootstraps immediately: reuse the default key/DID, or generate a secp256r1 JWK and did:jwk.
• Receive/present via pasted OpenID4VCI offer and OpenID4VP request URLs. Pre-authorized issuance uses .../receive; authorization-code issuance uses authorization-url plus .../receive/authorized and the current page origin as redirect_uri. Presentation is /preview → /build-vp-token → /send-response.
• Wasm-safe JSON serializers for JsonObject/JsonElement, and index.html now loads webApp.js so the webpack host actually boots.
• Settings hides lock, signing protection, and DC API when PIN is disabled, and Sign out is wired.

enableWalletDemoComposeWeb stays false by default.

Architecture Notes

• Web is wasmJs. Protocol work stays on wallet-api2 HTTP rather than embedding the mobile SDK in the browser.
• Shared WalletDemoController gains skipPin and issuanceRedirectUri so Android/iOS keep the existing PIN default.
• Authorization-code issuance persists the pending session across the issuer redirect/reload.

Screenshots

Compose web against docker identity issuer2, verifier2, and wallet-api2 with auth. Pre-authorized OpenID4VCI (jwt_vc_json / OpenBadgeCredential) and OpenID4VP. Wasm card titles currently show the credential format (jwt_vc_json) rather than the OpenBadge display name.

Sign in	Empty wallet	Offer review

Stored credential	Presentation review	Presentation sent

Caveats and Follow-Ups

• QR scanning, Digital Credentials API, BLE/NFC, and hardware-backed keys are not available on web; paste URLs instead.
• Authorization-code issuance is implemented but was not exercised in this gallery (pre-authorized only).
• Android and iOS demo builds were not re-verified in this change.
• wallet-api2 auth accounts are in-memory in the current OSS auth module.

Breaking

• wallet-api2 CORS now allows PUT and DELETE, which browser clients need for default key/DID setup.

[linear-code]

WAL-1198

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 17d3eafa-3dfe-4d24-adaa-59576119cefa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud