feat: WMP (Wallet Messaging Protocol) integration

[leifj]

Summary

Adds Wallet Messaging Protocol (WMP) support as an alternative transport to WebSocket, enabling HTTP+SSE-based communication for mobile and web wallet clients.

Key Changes

Architecture & Transport

• Extract SessionTransport interface from Session for transport-agnostic engine
• Implement wsTransport (gorilla/websocket) and sseTransport (HTTP+SSE with ring buffer, event replay)
• Add WMPAdapter wrapping the engine for JSON-RPC 2.0 over HTTP with SSE server-push

WMP Protocol

• JSON-RPC 2.0 request/response via POST /api/v2/wallet/rpc
• SSE notification stream via GET /api/v2/wallet/events
• Session resumption with cryptographic token rotation (§4.5.2)
• Capability negotiation per WMP spec
• Nested sign/match sub-flows (wmp.flow.start / wmp.flow.complete)

Configuration

• CORS: allow Wmp-Session-Id header
• Wire WMP adapter routes in EngineProvider

Documentation

• WMP migration analysis with design decisions (Q1–Q5)

Testing

• HTTP+SSE endpoint and transport unit tests
• Conformance tested with OIDF Conformance Suite on both WebSocket and WMP transports
• Transport does not affect conformance results — failures are identical on both transports
• See sirosid-tests triage report for details

Related

• RFC 8615 well-known URI fix split to PR fix: RFC 8615 well-known URI construction for issuer metadata #164

[Copilot]

Pull request overview

Adds Wallet Messaging Protocol (WMP) support as an alternative transport to the existing v2 WebSocket engine. Introduces a transport-agnostic SessionTransport interface and new HTTP+SSE / WMP JSON-RPC adapters mounted at /api/v2/wallet/{rpc,events}. Also fixes well-known URI construction for issuer metadata across three places (RFC 8615) and allows the Wmp-Session-Id header through CORS.

Changes:

• New WMP adapter (wmphandler.go, wmphttp.go) bridging engine flows to JSON-RPC over HTTP+SSE, including session create/resume and capability negotiation.
• Engine refactored to use a SessionTransport interface; new HTTP+SSE handler (httpsse.go) added alongside the WS handler.
• RFC 8615 well-known URI construction in pkg/issuermetadata/resolver.go, internal/metadata/issuer.go, internal/engine/oid4vci.go; CORS updated; capability list updated.

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 20 comments.

Show a summary per file

File	Description
pkg/issuermetadata/resolver.go	RFC 8615 well-known URI construction (path-aware).
pkg/config/config.go	Allow Wmp-Session-Id CORS header.
internal/server/providers.go	Wire /api/v2/wallet/{rpc,events} to new WMP adapter.
internal/metadata/issuer.go	RFC 8615 well-known URI construction.
internal/engine/wmphttp.go	HTTP/SSE entrypoints for WMP RPC and event stream.
internal/engine/wmphandler.go	Core WMP adapter: sessions, peers, flow bridging, sub-flows.
internal/engine/wmphandler_test.go	Tests for WMP adapter behavior.
internal/engine/transport.go	New SessionTransport interface; WS and SSE implementations.
internal/engine/session.go	Session refactor to use transport abstraction.
internal/engine/oid4vci.go	RFC 8615 well-known URI construction for OAuth AS metadata.
internal/engine/match_test.go	Update test to new session struct fields.
internal/engine/httpsse.go	HTTP+SSE engine handlers (handshake, RPC, events).
internal/engine/httpsse_test.go	Tests for HTTP+SSE handlers and SSE transport.
internal/api/version.go	Advertise wmp engine capability.
go.mod / go.sum	Add go-wmp dependency.
docs/wmp-migration-analysis.md	Design/migration analysis document.
configs/config.yaml	Add Wmp-Session-Id allowed CORS header.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate failed

Failed conditions
7.6% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[leifj]

Rebased on main (post-AS merge). Key resolution points:

• session.go: Merged transport abstraction (SessionTransport interface) with main's anonymous session guard (UserID != "" check) and pre-computed sessionID/logLabel variables. Adapted pingLoop to type-assert *wsTransport since ping/pong is WebSocket-specific.
• match_test.go: Updated test helper to use newWSTransport(conn) and added stopPing channel.
• go.mod: Dropped local go-wmp replace directive (uses published module), kept main's updated virtualwebauthn and g119612 versions.
• Skipped now-redundant commit that removed the local replace (already resolved in rebase).

Build verified clean.

[codecov]

Codecov Report

❌ Patch coverage is 70.15614% with 841 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/service/native_attestation.go	50.69%	85 Missing and 22 partials ⚠️
pkg/r2ps/client.go	0.00%	99 Missing ⚠️
internal/storage/mongodb/wallet_instance.go	0.00%	93 Missing ⚠️
internal/api/admin_r2ps_handlers.go	0.00%	74 Missing ⚠️
internal/engine/wmphandler.go	90.04%	56 Missing and 17 partials ⚠️
internal/server/providers.go	8.95%	60 Missing and 1 partial ⚠️
pkg/audit/audit.go	0.00%	44 Missing ⚠️
internal/service/wia_challenge_mongo.go	0.00%	40 Missing ⚠️
internal/server/server.go	6.25%	29 Missing and 1 partial ⚠️
internal/engine/wmphttp.go	75.72%	19 Missing and 6 partials ⚠️
... and 17 more

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
21 New issues
0 Accepted issues

Measures
0 Security Hotspots
92.8% Coverage on New Code
0.9% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 81 out of 82 changed files in this pull request and generated 1 comment.

Suppressed comments (4)

internal/api/admin_instance_handlers.go:66

• Tenant scoping is not enforced when updating instance status. UpdateStatus is executed by instance ID only, so an admin for tenant A could suspend/revoke an instance belonging to tenant B if they know the instance ID. Fetch and verify the instance's TenantID matches :id (or update via a tenant+id filter) before applying the status change.

func (h *AdminHandlers) UpdateWalletInstanceStatus(c *gin.Context) {
	instanceID := c.Param("instance_id")

	var req updateInstanceStatusRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request: status must be active, suspended, or revoked"})
		return
	}

	status := domain.InstanceStatus(req.Status)

	if err := h.store.WalletInstances().UpdateStatus(c.Request.Context(), instanceID, status, req.Reason); err != nil {
		if errors.Is(err, storage.ErrNotFound) {

internal/api/admin_instance_handlers.go:98

• Tenant scoping is not enforced on delete: Delete is called by instance ID only, allowing cross-tenant deletion if an admin can supply another tenant's instance ID. Verify the instance belongs to the :id tenant before deleting.

func (h *AdminHandlers) DeleteWalletInstance(c *gin.Context) {
	instanceID := c.Param("instance_id")

	if err := h.store.WalletInstances().Delete(c.Request.Context(), instanceID); err != nil {
		if errors.Is(err, storage.ErrNotFound) {
			c.JSON(http.StatusNotFound, gin.H{"error": "wallet instance not found"})
			return
		}
		h.logger.Error("failed to delete wallet instance", zap.Error(err))
		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to delete wallet instance"})
		return
	}

	h.emitAudit(set.EventWIDeactivated, instanceID, map[string]any{"action": "deleted"})
	c.Status(http.StatusNoContent)

internal/server/providers.go:49

• NewAuthProvider now starts background workers immediately via services.Start(), but the owning BackendProvider.Close() does not call p.auth.Close()/services.Stop(). Since cmd/server/main.go only closes the BackendProvider resource, this leaves WIA/challenge cleanup (and any future workers) running until process exit and can also leak resources in tests that construct a BackendProvider. Ensure BackendProvider.Close() stops the auth provider's services (and ideally call p.auth.Close() before closing the store).
  internal/service/wallet_provider.go:32
• The comment claims multi-instance uniqueness is achieved via a startup-time-derived offset, but statusIndexCounter is never initialized to a non-zero offset. As implemented it starts at 0 in every process, so multiple pods using the same status list URI will reuse the same indices and can collide. Either implement the offset/range allocation logic or adjust the comment to avoid stating a guarantee that the code does not provide.

[Copilot]

Pull request overview

Copilot reviewed 86 out of 87 changed files in this pull request and generated no new comments.

Suppressed comments (7)

internal/engine/wmphttp.go:43

• io.LimitReader will silently truncate bodies larger than maxWMPRPCBodyBytes, which can turn an oversized request into a confusing parse failure (or partially processed JSON-RPC). Use http.MaxBytesReader so oversized payloads reliably fail with 413 instead of being truncated.
  internal/engine/httpsse.go:41
• HandleRPC reads the request body with io.LimitReader, which silently truncates bodies beyond the limit. For request bodies, prefer http.MaxBytesReader so oversized payloads reliably fail (413) rather than being parsed as truncated JSON.

	// Read request body (bounded).
	body, err := io.ReadAll(io.LimitReader(r.Body, MaxHTTPResponseBodyBytes))
	if err != nil {
		http.Error(w, "failed to read body", http.StatusBadRequest)
		return

internal/engine/wmphttp.go:186

• HandleWMPConfiguration advertises endpoints under /wmp/*, but the router wires WMP under /api/v2/wallet/rpc and /api/v2/wallet/events. Clients using this discovery response will call the wrong paths.
  pkg/audit/audit.go:68
• NewFromFile is documented as loading a PEM-encoded EC private key, but the algorithm selection defaults to EdDSA for any non-ECDSA key type. That will mis-handle RSA keys and hides configuration errors. If only ECDSA is supported here, fail fast with a clear error instead of guessing an algorithm.
  internal/server/providers.go:49
• NewAuthProvider now starts background workers via services.Start(), and a Close() method was added to stop them, but BackendProvider.Close() (the one actually called from cmd/server/main.go resource cleanup) does not call p.auth.Close(). In backend mode this means WIA/cleanup workers can keep running past shutdown and may leak goroutines/resources during tests or graceful shutdown.
  internal/engine/httpsse.go:16
• The comment says "Authorization: ******" which looks like an accidental redaction. This is a public developer-facing doc comment; it should describe the real scheme (Bearer token) consistently with the rest of the code.

// HandleRPC handles POST requests for JSON-RPC style messages over HTTP.
// Authentication is via Authorization: Bearer <jwt> header — same token
// validation as the WebSocket handshake.
func (m *Manager) HandleRPC(w http.ResponseWriter, r *http.Request) {

internal/service/services.go:55

• The MongoDB WIA challenge store fallback check (store.(interface{ Database() *mongo.Database })) will never succeed with the current backend wrappers: internal/backend.mongoBackend embeds a *mongodb.Store but does not expose Database(). As a result, even in MongoDB deployments the service will silently fall back to the in-memory challenge store, breaking cross-pod single-use/expiry guarantees.