[WAL-1206] feat(wallet): support x509_hash request authentication on iOS

[szijpeter]

Summary

Follow-up to #1885 that restores its disabled native iOS EHIC integration coverage. The corresponding Android scenarios are now re-enabled directly in #1885.

The iOS failure is not an intermittent EUDI verifier limitation: iOS did not advertise or authenticate the verifier's x509_hash client ID because PKIX certificate-path validation was marked unsupported. This draft implements native validation with Security.framework, updates the stale iOS EUDI trust anchor, and re-enables the native iOS EHIC scenarios.

Changes

• validate iOS certificate paths with SecTrust, including explicit, chain-provided, and system trust anchors plus optional revocation policy
• expose system trust-anchor support through the Kotlin/Swift bridge and Swift WalletConfiguration
• add deterministic app-hosted XCTest coverage that accepts a trusted signed Request Object and rejects the same object with an unrelated anchor
• keep SecTrust-dependent common tests on supported runners while excluding them from the standalone iOS Kotlin/Native executable, where Apple trust evaluation returns OSStatus -26276
• update the native iOS EUDI fixture to the current PID Issuer CA 02 anchor
• re-enable the EHIC receive/present and preview/submit scenarios on native iOS; the equivalent Android scenarios remain blocking in Feature/wal 896 #1885

Coordination

This overlaps with the broader X.509 utility work in #1901. That PR currently does not provide the iOS SecTrust path, so this draft is intended as a concrete implementation and integration proof that can either be incorporated there or kept as the focused follow-up to #1885.

Caveat

SecTrust evaluation does not work reliably from the standalone Kotlin/Native .kexe, so the affected common tests are excluded there. Equivalent trusted and untrusted Request Object validation is covered by app-hosted XCTest in the native iOS demo, through the public Swift WalletSDK facade. This remains a draft while the ownership split with #1901 is agreed.

[linear-code]

WAL-896

WAL-1206

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3b5f8531-1fce-49c8-a20f-5157fe94d9ab

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud