[WAL-995] feat(mobile): add mobile OpenID4VCI authorization-code issuance

[szijpeter]

Summary

Adds production OpenID4VCI 1.0 authorization-code credential issuance to the Android and iOS mobile wallet SDK for WAL-995. A durable KMP issuance-session API now serves authorization-code and existing pre-authorized flows, so applications can resolve an offer, present a typed preview, hand authorization to the browser, safely continue from the callback, and consume typed issuance outcomes without parsing protocol JSON.

This PR is stacked on #1937, which independently owns the WAL-1158 OpenID4VCI 1.0 strict nonce_endpoint correction.

What Changed

Shared issuance and protocol handling

• Adds typed offer, issuer, credential, transaction-code, authorization, callback, PKCE, deferred-result, and error models.
• Introduces one session service for authorization-code and pre-authorized grants with single-use callback/session binding and replay protection.
• Validates issuer, authorization-server selection, HTTPS endpoints, redirect URI, callback parameters, state, and optional authorization-response iss before continuing.
• Uses issuer metadata to select PAR and DPoP behavior; DPoP is applied only when metadata supports the selected grant, with nonce challenges, ath, fresh proof identifiers, and exact target binding.
• Requests a credential-proof nonce only when current issuer metadata advertises nonce_endpoint; proofs otherwise omit the JWT nonce claim and never use token-response c_nonce or the access token as a fallback.
• Binds credential proofs and DPoP to the selected holder key; a DID kid is used only when its stored public JWK matches that key, otherwise proof binding falls back to JWK.
• Follows token endpoint redirects only for same-origin 307/308 responses, preventing grant material from being re-posted after 303 or across origins.
• Handles immediate, deferred, cancelled, and failed outcomes for SD-JWT VC, mdoc, and W3C JWT credentials.

Mobile SDKs

• Exposes the typed session lifecycle through the public mobile KMP API and generated ABI surface.
• Persists active authorization continuations and deferred handles in the encrypted mobile wallet database so sessions survive service and process recreation.
• Adds equivalent Swift value types and async facade methods through the KMP bridge.
• Preserves the existing resolveOffer and receive APIs for pre-authorized integrations while routing them through the shared engine.

Reference applications and security

• Wires typed browser authorization, callback continuation, deferred resume, and lifecycle cancellation into the Compose and native iOS reference wallets.
• Registers the mobile callback scheme on Android and iOS.
• Enforces HTTPS for issuer protocol endpoints, including nonce_endpoint, without a loopback exception.
• Keeps the PKCE verifier inside encrypted continuation state; public KMP and Swift models expose only the challenge and method.
• Removes credential, proof, nonce, token, and callback material from issuance logging and disables HTTP header logging for these flows.
• Keeps deferred handles opaque so access tokens and credential material do not cross the public API boundary.

Architecture Notes

• Protocol state, callback validation, token exchange, nonce acquisition, proof construction, credential parsing, and storage remain in the shared wallet layer. Reference applications only drive typed session transitions.
• Session and deferred state transitions are mutex-protected, persisted atomically, and terminal transitions are single-use.
• The selected holder key is carried through token-bound DPoP and credential proof construction instead of being reselected by platform code.
• Nonce acquisition reuses the typed, metadata-driven client introduced by [WAL-1158] fix(openid4vci): align wallet nonce handling with 1.0 #1937; this PR does not duplicate WAL-1158 behavior.

Caveats and Follow-Ups

• [WAL-1158] fix(openid4vci): align wallet nonce handling with 1.0 #1937 must land first.
• No issuer or verifier server changes are included.
• Completing a live authorization-code issuance still requires the issuer's interactive browser identity step; the SDK owns the callback continuation after that step.

Breaking Changes

None relative to the WAL-1158 prerequisite. Existing pre-authorized issuance entry points remain available.

[linear-code]

WAL-995

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b1c556f7-6e41-4a5d-bbb3-999f0ecd1938

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud