fix(oid4vp): respect unsigned request policy for JSON content type from request_uri

philpotisk · philpotisk · commit 331ffe72f5df · 2026-07-22T12:15:14.000+02:00
PROBLEM:
The wallet rejected application/json responses from request_uri even when
the unsigned request policy was set to ALLOW_UNSIGNED. This broke the
demo backend flow in MobileWalletIntegrationTest since the public demo
verifier returns unsigned JSON requests.

ROOT CAUSE:
AuthorizationRequestResolver checked content type before applying the
unsigned policy - when enforceFinalRequestObject=true (default), JSON
was rejected outright without considering the UnsignedRequestObjectPolicy.

SOLUTION:
- Modified AuthorizationRequestResolver to apply UnsignedRequestObjectPolicy
  when receiving application/json from request_uri:
  - REQUIRE_SIGNED: Reject with clear error message
  - ALLOW_UNSIGNED: Accept and parse as plain AuthorizationRequest

- Added unsignedRequestObjectPolicy configuration to:
  - Wallet data class
  - MobileWallet constructor
  - MobileWalletConfig
  - MobileWalletFactory passthrough

- Updated WalletPresentationHandler to read policy from wallet config
  instead of hardcoding REQUIRE_SIGNED

- Updated MobileWalletIntegrationTest to use ALLOW_UNSIGNED for demo
  backend tests (which return unsigned requests)

- Updated AuthorizationRequestResolverJvmTest to verify both policy modes

This maintains production-grade security (REQUIRE_SIGNED by default) while
enabling test/legacy interoperability when explicitly configured.
diff --git a/waltid-libraries/protocols/waltid-openid4vc-wallet-mobile/src/androidDeviceTest/kotlin/id/walt/wallet2/mobile/test/MobileWalletIntegrationTest.kt b/waltid-libraries/protocols/waltid-openid4vc-wallet-mobile/src/androidDeviceTest/kotlin/id/walt/wallet2/mobile/test/MobileWalletIntegrationTest.kt
@@ -18,6 +18,7 @@ import id.walt.wallet2.mobile.MobileWalletEncryptionInfo
 import id.walt.wallet2.mobile.MobileWalletFactory
 import id.walt.wallet2.mobile.MobileWalletPresentationCredentialSelection
 import id.walt.wallet2.mobile.MobileWalletPresentationDisclosureSelection
+import id.waltid.openid4vp.wallet.request.AuthorizationRequestResolver
 import id.walt.wallet2.mobile.MobileWalletPresentationErrorCode
 import id.walt.wallet2.mobile.MobileWalletPresentationPreview
 import id.walt.wallet2.mobile.MobileWalletPresentationPreviewResult
@@ -430,9 +431,13 @@ class MobileWalletIntegrationTest {
         prefix: String,
         transactionDataProfiles: List<MobileWalletTransactionDataProfile> = DEMO_TRANSACTION_DATA_PROFILES,
         requestObjectX509Trust: WalletX509TrustConfig? = null,
+        // Demo backend returns unsigned requests; allow them for these tests
+        unsignedRequestPolicy: AuthorizationRequestResolver.UnsignedRequestObjectPolicy =
+            AuthorizationRequestResolver.UnsignedRequestObjectPolicy.ALLOW_UNSIGNED,
     ) = MobileWalletConfig(
         walletId = "android-demo-$prefix-${UUID.randomUUID()}",
         requestObjectX509Trust = requestObjectX509Trust,
+        unsignedRequestObjectPolicy = unsignedRequestPolicy,
         onEvent = { event -> println("WALLET EVENT: $event") },
         transactionDataProfiles = transactionDataProfiles,
     )
diff --git a/waltid-libraries/protocols/waltid-openid4vc-wallet-mobile/src/commonMain/kotlin/id/walt/wallet2/mobile/MobileWallet.kt b/waltid-libraries/protocols/waltid-openid4vc-wallet-mobile/src/commonMain/kotlin/id/walt/wallet2/mobile/MobileWallet.kt
@@ -16,8 +16,9 @@ import id.walt.wallet2.data.WalletKeyStore
 import id.walt.wallet2.data.WalletSessionEvent
 import id.walt.wallet2.data.WalletX509TrustConfig
 import id.walt.wallet2.handlers.PresentCredentialRequest
-import id.walt.wallet2.handlers.PresentationCredentialOption
 import id.walt.wallet2.handlers.PresentationCredentialRequirement
+import id.walt.wallet2.handlers.PresentationCredentialOption
+import id.waltid.openid4vp.wallet.request.AuthorizationRequestResolver
 import id.walt.wallet2.handlers.PresentationCredentialSelection
 import id.walt.wallet2.handlers.PresentationDisclosureSelection
 import id.walt.wallet2.handlers.PreviewPresentationRequest
@@ -167,6 +168,8 @@ public class MobileWallet internal constructor(
     attestationConfig: WalletAttestationConfig? = null,
     requestObjectX509Trust: WalletX509TrustConfig? = null,
     requestObjectAudience: String = "https://self-issued.me/v2",
+    unsignedRequestObjectPolicy: AuthorizationRequestResolver.UnsignedRequestObjectPolicy =
+        AuthorizationRequestResolver.UnsignedRequestObjectPolicy.REQUIRE_SIGNED,
     private val transactionDataProfiles: List<MobileWalletTransactionDataProfile> = emptyList(),
     private val onEvent: suspend (MobileWalletEvent) -> Unit = {},
     private val deleteLocalPersistence: suspend () -> Unit = {},
@@ -196,6 +199,7 @@ public class MobileWallet internal constructor(
         credentialStores = listOf(credentialStore),
         requestObjectX509TrustPolicy = requestObjectX509Trust?.toTrustPolicy(),
         requestObjectAudience = requestObjectAudience,
+        unsignedRequestObjectPolicy = unsignedRequestObjectPolicy,
     )
 
     /**
diff --git a/waltid-libraries/protocols/waltid-openid4vc-wallet-mobile/src/commonMain/kotlin/id/walt/wallet2/mobile/MobileWalletFactory.kt b/waltid-libraries/protocols/waltid-openid4vc-wallet-mobile/src/commonMain/kotlin/id/walt/wallet2/mobile/MobileWalletFactory.kt
@@ -13,6 +13,7 @@ import id.walt.wallet2.persistence.encryption.DatabaseEncryptionKeyProvider
 import id.walt.wallet2.persistence.keys.PlatformKeyProvider
 import id.walt.wallet2.persistence.stores.PlatformKeyStore
 import id.walt.wallet2.persistence.stores.SqlDelightCredentialStore
+import id.waltid.openid4vp.wallet.request.AuthorizationRequestResolver
 import id.walt.wallet2.persistence.stores.SqlDelightDidStore
 import id.walt.verifier.openid.transactiondata.TransactionDataTypeRegistry
 
@@ -25,6 +26,9 @@ import id.walt.verifier.openid.transactiondata.TransactionDataTypeRegistry
  * @property persistence Persistence mode used for wallet-local state.
  * @property requestObjectX509Trust Wallet-controlled trust anchors for X.509 Request Objects.
  * @property requestObjectAudience Static Discovery default, or the Wallet issuer for Dynamic Discovery.
+ * @property unsignedRequestObjectPolicy Policy for handling unsigned OID4VP authorization requests.
+ *           Defaults to REQUIRE_SIGNED for production-grade security.
+ *           Use ALLOW_UNSIGNED or WARN_ON_UNSIGNED only for testing or legacy interoperability.
  * @property onEvent Optional callback for observing wallet issuance and presentation session events.
  * @property transactionDataProfiles Transaction data profiles this mobile wallet accepts in OpenID4VP requests.
  */
@@ -35,6 +39,8 @@ public data class MobileWalletConfig(
     public val persistence: MobileWalletPersistence = MobileWalletPersistence(),
     public val requestObjectX509Trust: WalletX509TrustConfig? = null,
     public val requestObjectAudience: String = "https://self-issued.me/v2",
+    public val unsignedRequestObjectPolicy: AuthorizationRequestResolver.UnsignedRequestObjectPolicy =
+        AuthorizationRequestResolver.UnsignedRequestObjectPolicy.REQUIRE_SIGNED,
     public val onEvent: suspend (MobileWalletEvent) -> Unit = {},
     public val transactionDataProfiles: List<MobileWalletTransactionDataProfile> = emptyList(),
 )
@@ -192,6 +198,7 @@ private fun createSqlDelightMobileWallet(
         attestationConfig = config.attestationConfig,
         requestObjectX509Trust = config.requestObjectX509Trust,
         requestObjectAudience = config.requestObjectAudience,
+        unsignedRequestObjectPolicy = config.unsignedRequestObjectPolicy,
         transactionDataProfiles = config.transactionDataProfiles,
         onEvent = config.onEvent,
         deleteLocalPersistence = deleteLocalPersistence,
diff --git a/waltid-libraries/protocols/waltid-openid4vc-wallet/src/commonMain/kotlin/id/walt/wallet2/data/Wallet.kt b/waltid-libraries/protocols/waltid-openid4vc-wallet/src/commonMain/kotlin/id/walt/wallet2/data/Wallet.kt
@@ -3,6 +3,7 @@ package id.walt.wallet2.data
 import id.walt.crypto.keys.DirectSerializedKey
 import id.walt.crypto.keys.Key
 import id.walt.openid4vp.clientidprefix.X509TrustPolicy
+import id.waltid.openid4vp.wallet.request.AuthorizationRequestResolver
 import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.merge
 import kotlinx.coroutines.flow.toList
@@ -60,6 +61,14 @@ data class Wallet(
     /** Wallet-controlled trust policy for X.509-authenticated OID4VP Request Objects. */
     val requestObjectX509TrustPolicy: X509TrustPolicy? = null,
 
+    /**
+     * Policy for handling unsigned OID4VP authorization requests.
+     * Defaults to REQUIRE_SIGNED for production-grade security.
+     * Use ALLOW_UNSIGNED or WARN_ON_UNSIGNED only for testing or legacy interoperability.
+     */
+    val unsignedRequestObjectPolicy: AuthorizationRequestResolver.UnsignedRequestObjectPolicy =
+        AuthorizationRequestResolver.UnsignedRequestObjectPolicy.REQUIRE_SIGNED,
+
     /** Expected Request Object audience for the wallet's configured discovery mode. */
     val requestObjectAudience: String = "https://self-issued.me/v2",
 
diff --git a/waltid-libraries/protocols/waltid-openid4vc-wallet/src/commonMain/kotlin/id/walt/wallet2/handlers/WalletPresentationHandler.kt b/waltid-libraries/protocols/waltid-openid4vc-wallet/src/commonMain/kotlin/id/walt/wallet2/handlers/WalletPresentationHandler.kt
@@ -889,7 +889,7 @@ object WalletPresentationHandler {
         val fetcher = WebDataFetcher(WebDataFetcherId.OPENID4VP_WALLET_RESOLVE_AUTHORIZATIONREQUEST)
         return AuthorizationRequestResolver.resolve(
             requestUrl = requestUrl,
-            unsignedRequestObjectPolicy = AuthorizationRequestResolver.UnsignedRequestObjectPolicy.REQUIRE_SIGNED,
+            unsignedRequestObjectPolicy = wallet.unsignedRequestObjectPolicy,
             expectedRequestObjectAudience = wallet.requestObjectAudience,
             x509TrustPolicy = wallet.requestObjectX509TrustPolicy,
             fetchRequestUri = { requestUri, requestUriMethod ->
diff --git a/waltid-libraries/protocols/waltid-openid4vp-wallet/src/commonMain/kotlin/id/waltid/openid4vp/wallet/request/AuthorizationRequestResolver.kt b/waltid-libraries/protocols/waltid-openid4vp-wallet/src/commonMain/kotlin/id/waltid/openid4vp/wallet/request/AuthorizationRequestResolver.kt
@@ -376,9 +376,21 @@ object AuthorizationRequestResolver {
                 expectedRequestObjectAudience = expectedRequestObjectAudience,
                 x509TrustPolicy = x509TrustPolicy,
             )
-            contentType.match(ContentType.Application.Json) && !enforceFinalRequestObject -> {
-                val authorizationRequest = json.decodeFromString<AuthorizationRequest>(response.body)
-                ResolvedAuthorizationRequest.Plain(authorizationRequest)
+            contentType.match(ContentType.Application.Json) -> {
+                // JSON content type from request_uri indicates an unsigned request.
+                // Apply the unsigned request policy: reject if REQUIRE_SIGNED, allow otherwise.
+                when (unsignedRequestObjectPolicy) {
+                    UnsignedRequestObjectPolicy.REQUIRE_SIGNED -> {
+                        throw IllegalArgumentException(
+                            "Unsigned authorization request not allowed: received application/json " +
+                                "from request_uri but wallet policy requires signed requests (application/oauth-authz-req+jwt)"
+                        )
+                    }
+                    UnsignedRequestObjectPolicy.ALLOW_UNSIGNED -> {
+                        val authorizationRequest = json.decodeFromString<AuthorizationRequest>(response.body)
+                        ResolvedAuthorizationRequest.Plain(authorizationRequest)
+                    }
+                }
             }
             else -> throw IllegalArgumentException("Unsupported AuthorizationRequest content type: $contentType")
         }
diff --git a/waltid-libraries/protocols/waltid-openid4vp-wallet/src/jvmTest/kotlin/id/waltid/openid4vp/wallet/request/AuthorizationRequestResolverJvmTest.kt b/waltid-libraries/protocols/waltid-openid4vp-wallet/src/jvmTest/kotlin/id/waltid/openid4vp/wallet/request/AuthorizationRequestResolverJvmTest.kt
@@ -244,7 +244,7 @@ class AuthorizationRequestResolverJvmTest {
     }
 
     @Test
-    fun `request uri rejects wallet nonce mismatch and non JWT content type`() {
+    fun `request uri rejects wallet nonce mismatch and enforces signed request policy for JSON content`() {
         val requestUrl = URLBuilder("openid4vp://authorize").apply {
             parameters.append("client_id", "verifier2")
             parameters.append("request_uri", "https://verifier.example/request.jwt")
@@ -268,11 +268,12 @@ class AuthorizationRequestResolverJvmTest {
         }
         assertTrue(mismatch.message.orEmpty().contains("wallet_nonce mismatch"))
 
-        val wrongContentType = assertFailsWith<IllegalArgumentException> {
+        // When REQUIRE_SIGNED policy is set, JSON content type should be rejected
+        val rejectedWithSignedPolicy = assertFailsWith<IllegalArgumentException> {
             runBlocking {
                 AuthorizationRequestResolver.resolve(
                     requestUrl,
-                    AuthorizationRequestResolver.UnsignedRequestObjectPolicy.ALLOW_UNSIGNED,
+                    AuthorizationRequestResolver.UnsignedRequestObjectPolicy.REQUIRE_SIGNED,
                 ) { _, _ ->
                     AuthorizationRequestResolver.RequestUriFetchResponse(
                         HttpStatusCode.OK,
@@ -282,7 +283,25 @@ class AuthorizationRequestResolverJvmTest {
                 }
             }
         }
-        assertTrue(wrongContentType.message.orEmpty().contains("Unsupported AuthorizationRequest content type"))
+        assertTrue(
+            rejectedWithSignedPolicy.message.orEmpty().contains("Unsigned authorization request not allowed"),
+            "Expected unsigned request rejection message, got: ${rejectedWithSignedPolicy.message}"
+        )
+
+        // When ALLOW_UNSIGNED policy is set, JSON content type should be accepted
+        val acceptedWithAllowPolicy = runBlocking {
+            AuthorizationRequestResolver.resolve(
+                requestUrl,
+                AuthorizationRequestResolver.UnsignedRequestObjectPolicy.ALLOW_UNSIGNED,
+            ) { _, _ ->
+                AuthorizationRequestResolver.RequestUriFetchResponse(
+                    HttpStatusCode.OK,
+                    ContentType.Application.Json,
+                    "{}",
+                )
+            }
+        }
+        assertIs<ResolvedAuthorizationRequest.Plain>(acceptedWithAllowPolicy)
     }
 
     @Test
