fix(types): replace vp_token any with OpenID4VP payload type

[cynox-66]

Summary

Replace the vp_token DTO property type from any with the upstream Credo OpenID4VP payload type.

Changes

• Import OpenId4VpAuthorizationResponsePayload from @credo-ts/openid4vc
• Replace vp_token?: any with vp_token?: OpenId4VpAuthorizationResponsePayload['vp_token']
• Remove the outdated TODO comment associated with the any type

Motivation

The DTO currently uses any for vp_token, which bypasses compile-time type checking and can hide type-related issues.

Using the existing upstream Credo type improves type safety, aligns the DTO with the OpenID4VP authorization response structure, and removes an unnecessary any usage without changing runtime behavior.

Testing

• TypeScript compilation succeeds
• No runtime behavior changes introduced
• Change is limited to type definitions

Summary by CodeRabbit

• Refactor
  • Strengthened type validation for OpenID4VP (OpenID for Verifiable Presentations) authorization responses to ensure improved protocol compliance and reliability in credential verification operations.

[coderabbitai]

📝 Walkthrough

Walkthrough

The authorization response payload DTO imports the upstream OpenID4VP authorization response payload type and uses it to strengthen the vp_token field contract from an untyped any placeholder to a precise type projection, aligning the DTO with the upstream OpenID4VC library's type definitions.

Changes

OpenID4VP Authorization Response Payload Typing

Layer / File(s)	Summary
Import and apply upstream vp_token type heka-identity-service/src/openid4vc/verification-sessions/dto/authorization-response-payload.dto.ts	Add type-only import for OpenId4VpAuthorizationResponsePayload and tighten the vp_token field from any to OpenId4VpAuthorizationResponsePayload['vp_token'], aligning the DTO's contract with the upstream Credo library type.

Estimated Code Review Effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A token type strengthened with care,
From any to structured, so fair!
One field now knows
The shape that it shows—
Type safety, beyond compare! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely summarizes the main change: replacing an untyped any field with a specific OpenID4VP payload type for better type safety.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[lfdt-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@heka-identity-service/src/openid4vc/verification-sessions/dto/authorization-response-payload.dto.ts`:
- Around line 319-321: The vp_token property on AuthorizationResponsePayloadDto
is only marked optional and lacks runtime validation; update the vp_token
declaration to include appropriate class-validator decorators that match
OpenId4VpAuthorizationResponsePayload['vp_token'] — if vp_token is a JWT string
add `@IsString`() (and keep `@IsOptional`()), otherwise if it is an object/array
restore `@ValidateNested`() plus `@Type`(() => YourVpTokenDto) and validate the
nested DTO fields; ensure the decorator set is applied to the
AuthorizationResponsePayloadDto.vp_token property and the nested DTO (if used)
contains the correct validators for the vp_token shape.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 58d677e8-ae3e-4e8c-b64c-eb5b4a260b74

📥 Commits

Reviewing files that changed from the base of the PR and between bbf9dce and 3594766.

📒 Files selected for processing (1)

• heka-identity-service/src/openid4vc/verification-sessions/dto/authorization-response-payload.dto.ts