kych

handlers.rs (49052B)

---

 use axum::{
     Json,
     extract::{Path, Query, State},
     http::{StatusCode, header},
     response::IntoResponse,
     Form,
 };
 use chrono::Utc;
 use serde_json::json;
 use std::collections::HashSet;
 
 use crate::{crypto, db::sessions::SessionStatus, models::*, state::AppState};
 
 const HTML_CSP: &str = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'";
 
 fn is_safe_url(url: &str) -> bool {
     url.to_lowercase().starts_with("https://")
 }
 
 fn is_safe_deeplink(url: &str) -> bool {
     if url.is_empty() {
         return true;
     }
     let url_lower = url.to_lowercase();
     url_lower.starts_with("swiyu-verify://") || url_lower.starts_with("https://")
 }
 
 fn json_encode_string(s: &str) -> String {
     serde_json::to_string(s).unwrap_or_else(|_| "\"\"".to_string())
 }
 
 fn parse_accepted_issuer_dids(raw: &str) -> Result<Vec<String>, &'static str> {
     let trimmed = raw.trim();
     if trimmed.is_empty() {
         return Err("ACCEPTED_ISSUER_DIDS must contain at least one DID");
     }
 
     let trimmed = trimmed.strip_prefix('{').unwrap_or(trimmed);
     let trimmed = trimmed.strip_suffix('}').unwrap_or(trimmed);
 
     let dids: Vec<String> = trimmed
         .split(',')
         .map(|s| s.trim())
         .filter(|s| !s.is_empty())
         .map(|s| s.to_string())
         .collect();
 
     if dids.is_empty() {
         return Err("ACCEPTED_ISSUER_DIDS must contain at least one DID");
     }
 
     Ok(dids)
 }
 
 fn validate_scope_claims(scope: &str, valid_claims: &HashSet<String>) -> Result<(), String> {
     for claim in scope.split_whitespace() {
         if !valid_claims.contains(claim) {
             return Err(format!("invalid claim in scope: {}", claim));
         }
     }
     Ok(())
 }
 
 pub async fn config(
     State(state): State<AppState>,
 ) -> impl IntoResponse {
     tracing::info!("Config request received");
 
     let mut claims: Vec<String> = state.config.vc.vc_claims.iter().cloned().collect();
     claims.sort();
 
     PrettyJson(ConfigResponse {
         name: "kych-oauth2-gateway".to_string(),
         version: env!("CARGO_PKG_VERSION").to_string(),
         status: "healthy".to_string(),
         vc_type: state.config.vc.vc_type.clone(),
         vc_format: state.config.vc.vc_format.clone(),
         vc_algorithms: state.config.vc.vc_algorithms.clone(),
         vc_claims: claims,
     })
 }
 
 // POST /setup/{clientId}
 pub async fn setup(
     State(state): State<AppState>,
     Path(client_id): Path<String>,
     headers: axum::http::HeaderMap,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!("Setup request for client: {}", client_id);
 
     let auth_header = headers
         .get(header::AUTHORIZATION)
         .and_then(|h| h.to_str().ok());
 
     let bearer_token = match auth_header {
         Some(h) if h.starts_with("Bearer ") => &h[7..],
         _ => {
             tracing::warn!(
                 "Missing or malformed Authorization header for client: {}",
                 client_id
             );
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("unauthorized")),
             ));
         }
     };
 
     let secret_hash = crate::db::clients::get_client_secret_hash(&state.pool, &client_id)
         .await
         .map_err(|e| {
             tracing::error!("DB error fetching client secret: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
     let secret_hash = match secret_hash {
         Some(hash) => hash,
         None => {
             tracing::warn!("Client not found: {}", client_id);
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("unauthorized")),
             ));
         }
     };
 
     let is_valid = bcrypt::verify(bearer_token, &secret_hash).map_err(|e| {
         tracing::error!("Bcrypt verification error: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     if !is_valid {
         tracing::warn!("Invalid bearer token for client: {}", client_id);
         return Err((
             StatusCode::UNAUTHORIZED,
             Json(ErrorResponse::new("unauthorized")),
         ));
     }
 
     let nonce = crypto::generate_nonce(state.config.crypto.nonce_bytes);
 
     tracing::debug!("Generated nonce: {}", nonce);
 
     let session = crate::db::sessions::create_session(&state.pool, &client_id, &nonce, 15)
         .await
         .map_err(|e| {
             tracing::error!("Failed to create session: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
     let session = match session {
         Some(s) => s,
         None => {
             tracing::warn!("Client not found: {}", client_id);
             return Err((
                 StatusCode::NOT_FOUND,
                 Json(ErrorResponse::new("client_not_found")),
             ));
         }
     };
 
     tracing::info!(
         "Created session {} for client {} with nonce {}",
         session.id,
         client_id,
         nonce
     );
 
     Ok((StatusCode::OK, Json(SetupResponse { nonce })))
 }
 
 // GET /authorize/{nonce}?response_type=code&client_id={client_id}&redirect_uri={uri}&state={state}
 pub async fn authorize(
     State(state): State<AppState>,
     Path(nonce): Path<String>,
     Query(params): Query<AuthorizeQuery>,
     headers: axum::http::HeaderMap,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!(
         "Authorize request for client: {}, nonce: {}, state: {}, redirect_uri: {}, scope: {}",
         params.client_id,
         nonce,
         params.state,
         params.redirect_uri,
         params.scope
     );
 
     if params.response_type != "code" {
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_request")),
         ));
     }
 
     let session_data = crate::db::sessions::get_session_for_authorize(
         &state.pool,
         &nonce,
         &params.client_id,
         &params.scope,
         &params.redirect_uri,
         &params.state,
     )
     .await
     .map_err(|e| {
         tracing::error!("DB error in authorize: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     let data = match session_data {
         Some(d) => d,
         None => {
             tracing::warn!("Session not found for nonce: {}", nonce);
             return Err((
                 StatusCode::NOT_FOUND,
                 Json(ErrorResponse::new("session_not_found")),
             ));
         }
     };
 
     // Validate redirect_uri against client's registered URIs
     let redirect_uri_valid = data
         .allowed_redirect_uris
         .as_ref()
         .map(|uris| {
             uris.split(',')
                 .map(|s| s.trim())
                 .any(|uri| uri == params.redirect_uri)
         })
         .unwrap_or(false);
 
     if !redirect_uri_valid {
         tracing::warn!(
             "Invalid redirect_uri for client {}: {}",
             params.client_id,
             params.redirect_uri
         );
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_redirect_uri")),
         ));
     }
 
     // Backend validation
     if data.expires_at < Utc::now() {
         tracing::warn!("Session expired: {}", data.session_id);
         return Err((
             StatusCode::GONE,
             Json(ErrorResponse::new("session_expired")),
         ));
     }
 
     // Check status for idempotency
     match data.status {
         SessionStatus::Authorized => {
             tracing::info!(
                 "Session {} already authorized, returning cached response",
                 data.session_id
             );
 
             let verification_id = data
                 .request_id
                 .and_then(|id| uuid::Uuid::parse_str(&id).ok())
                 .unwrap_or(uuid::Uuid::nil());
 
             let accept_html = headers
                 .get(header::ACCEPT)
                 .and_then(|h| h.to_str().ok())
                 .map_or(false, |v| v.contains("text/html"));
 
             if accept_html {
                 use askama::Template;
 
                 #[derive(Template)]
                 #[template(path = "authorize.html")]
                 struct AuthorizeTemplate {
                     verification_url: String,
                     verification_deeplink: String,
                     verification_id_json: String,
                     verification_url_json: String,
                     state_json: String,
                 }
 
                 let verification_url = data.verification_url.clone().unwrap_or_default();
                 let verification_deeplink = data.verification_deeplink.clone().unwrap_or_default();
 
                 if !is_safe_url(&verification_url) {
                     tracing::error!("Invalid verification_url scheme: {}", verification_url);
                     return Err((
                         StatusCode::BAD_GATEWAY,
                         Json(ErrorResponse::new("invalid_verification_url")),
                     ));
                 }
 
                 if !is_safe_deeplink(&verification_deeplink) {
                     tracing::error!("Invalid verification_deeplink scheme: {}", verification_deeplink);
                     return Err((
                         StatusCode::BAD_GATEWAY,
                         Json(ErrorResponse::new("invalid_verification_deeplink")),
                     ));
                 }
 
                 let template = AuthorizeTemplate {
                     verification_url: verification_url.clone(),
                     verification_deeplink,
                     verification_id_json: json_encode_string(&verification_id.to_string()),
                     verification_url_json: json_encode_string(&verification_url),
                     state_json: json_encode_string(&params.state),
                 };
 
                 let html = template.render().map_err(|e| {
                     tracing::error!("Template render error: {}", e);
                     (
                         StatusCode::INTERNAL_SERVER_ERROR,
                         Json(ErrorResponse::new("internal_error")),
                     )
                 })?;
 
                 return Ok((
                     StatusCode::OK,
                     [
                         (header::CONTENT_TYPE, "text/html; charset=utf-8"),
                         (header::CONTENT_SECURITY_POLICY, HTML_CSP),
                     ],
                     html,
                 ).into_response());
             }
 
             return Ok(PrettyJson(AuthorizeResponse {
                 verification_id,
                 verification_url: data.verification_url.clone().unwrap_or_default(),
                 verification_deeplink: data.verification_deeplink,
                 state: params.state.clone()
             }).into_response());
         }
 
         SessionStatus::Pending => {
             // Proceed with authorization
         }
 
         _ => {
             tracing::warn!(
                 "Session {} in invalid status: {:?}",
                 data.session_id,
                 data.status
             );
             return Err((
                 StatusCode::CONFLICT,
                 Json(ErrorResponse::new("invalid_session_status")),
             ));
         }
     }
 
     if let Some(allowed_scopes) = state.config.allowed_scopes.as_ref() {
         let allowed_set: std::collections::HashSet<&str> =
             allowed_scopes.iter().map(String::as_str).collect();
         let invalid_scopes: Vec<&str> = data
             .scope
             .split_whitespace()
             .filter(|scope| !allowed_set.contains(*scope))
             .collect();
 
         if !invalid_scopes.is_empty() {
             tracing::warn!(
                 "Rejected invalid scopes for client {}: {:?}",
                 params.client_id,
                 invalid_scopes
             );
             return Err((
                 StatusCode::BAD_REQUEST,
                 Json(ErrorResponse::new("invalid_scope")),
             ));
         }
     }
 
     if let Err(e) = validate_scope_claims(&data.scope, &state.config.vc.vc_claims) {
         tracing::warn!(
             "Rejected invalid scope claims for client {}: {}",
             params.client_id,
             e
         );
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new(&e)),
         ));
     }
 
     let dcql_query = build_dcql_query(
         &data.scope,
         &state.config.vc.vc_type,
         &state.config.vc.vc_format,
     );
 
     // Call Swiyu Verifier
     let verifier_url = format!("{}{}", data.verifier_url, data.verifier_management_api_path);
 
     let accepted_issuer_dids = match data.accepted_issuer_dids.as_deref() {
         Some(raw) => parse_accepted_issuer_dids(raw).map_err(|message| {
             tracing::error!("Invalid accepted issuer DIDs for client {}: {}", params.client_id, message);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("invalid_accepted_issuer_dids")),
             )
         })?,
         None => {
             tracing::error!(
                 "Accepted issuer DIDs not configured for client {}",
                 params.client_id
             );
             return Err((
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("accepted_issuer_dids_not_configured")),
             ));
         }
     };
 
     let verifier_request = SwiyuCreateVerificationRequest {
         accepted_issuer_dids,
         jwt_secured_authorization_request: Some(true),
         response_mode: ResponseMode::DirectPost,
         dcql_query,
         configuration_override: ConfigurationOverride::default(),
     };
 
     tracing::debug!(
         "Swiyu verifier request: {}",
         serde_json::to_string_pretty(&verifier_request).unwrap()
     );
     tracing::debug!("Calling Swiyu verifier at: {}", verifier_url);
 
     let verifier_response = state
         .http_client
         .post(&verifier_url)
         .json(&verifier_request)
         .send()
         .await
         .map_err(|e| {
             tracing::error!("Failed to call Swiyu verifier: {}", e);
             (
                 StatusCode::BAD_GATEWAY,
                 Json(ErrorResponse::new("verifier_unavailable")),
             )
         })?;
 
     if !verifier_response.status().is_success() {
         let status = verifier_response.status();
         let body = verifier_response.text().await.unwrap_or_default();
         tracing::error!("Swiyu verifier returned error {}: {}", status, body);
         return Err((
             StatusCode::BAD_GATEWAY,
             Json(ErrorResponse::new("verifier_error")),
         ));
     }
 
     let swiyu_response: SwiyuManagementResponse = verifier_response.json().await.map_err(|e| {
         tracing::error!("Failed to parse Swiyu response: {}", e);
         (
             StatusCode::BAD_GATEWAY,
             Json(ErrorResponse::new("verifier_invalid_response")),
         )
     })?;
 
     // Update session with verifier data
     let result = crate::db::sessions::update_session_authorized(
         &state.pool,
         data.session_id,
         &swiyu_response.verification_url,
         swiyu_response.verification_deeplink.as_deref(),
         &swiyu_response.id.to_string(),
         swiyu_response.request_nonce.as_deref(),
     )
     .await
     .map_err(|e| {
         tracing::error!("Failed to update session: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     tracing::info!(
         "Session {} authorized, verification_id: {}",
         data.session_id,
         swiyu_response.id
     );
 
     let accept_html = headers
         .get(header::ACCEPT)
         .and_then(|h| h.to_str().ok())
         .map_or(false, |v| v.contains("text/html"));
 
     let verification_url = result.verification_url.clone();
     let verification_deeplink = swiyu_response.verification_deeplink.clone().unwrap_or_default();
 
     if !is_safe_url(&verification_url) {
         tracing::error!("Invalid verification_url scheme: {}", verification_url);
         return Err((
             StatusCode::BAD_GATEWAY,
             Json(ErrorResponse::new("invalid_verification_url")),
         ));
     }
 
     if !is_safe_deeplink(&verification_deeplink) {
         tracing::error!("Invalid verification_deeplink scheme: {}", verification_deeplink);
         return Err((
             StatusCode::BAD_GATEWAY,
             Json(ErrorResponse::new("invalid_verification_deeplink")),
         ));
     }
 
     if accept_html {
         use askama::Template;
 
         #[derive(Template)]
         #[template(path = "authorize.html")]
         struct AuthorizeTemplate {
             verification_url: String,
             verification_deeplink: String,
             verification_id_json: String,
             verification_url_json: String,
             state_json: String,
         }
 
         let template = AuthorizeTemplate {
             verification_url: verification_url.clone(),
             verification_deeplink: verification_deeplink.clone(),
             verification_id_json: json_encode_string(&swiyu_response.id.to_string()),
             verification_url_json: json_encode_string(&verification_url),
             state_json: json_encode_string(&params.state),
         };
 
         let html = template.render().map_err(|e| {
             tracing::error!("Template render error: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
         return Ok((
             StatusCode::OK,
             [
                 (header::CONTENT_TYPE, "text/html; charset=utf-8"),
                 (header::CONTENT_SECURITY_POLICY, HTML_CSP),
             ],
             html,
         ).into_response());
     }
 
     Ok(PrettyJson(AuthorizeResponse {
         verification_id: swiyu_response.id,
         verification_url,
         verification_deeplink: swiyu_response.verification_deeplink,
         state: params.state.clone()
     }).into_response())
 }
 
 /// Build the DCQL query for a verification.
 ///
 /// The OAuth 2.0 scope is the list of claims to disclose: one claims query per
 /// scope token, each a single-element claims path pointer, since every claim of
 /// the Beta-ID credential is top-level.  `vc_type` constrains the credential's
 /// `vct`, so a wallet holding several credentials can tell which one is asked
 /// for.
 ///
 /// A scope that names no claim at all yields a credential query without a
 /// `claims` member -- the verifier rejects an empty `claims` array, and leaving
 /// it out means "no claim in particular", which is what an empty scope asks
 /// for.
 fn build_dcql_query(scope: &str, vc_type: &str, vc_format: &str) -> DcqlQuery {
     let attributes: Vec<&str> = scope.split_whitespace().collect();
 
     tracing::debug!("Building DCQL query for attributes: {:?}", attributes);
 
     let claims: Option<Vec<DcqlClaim>> = if attributes.is_empty() {
         None
     } else {
         Some(
             attributes
                 .iter()
                 .map(|attr| DcqlClaim {
                     path: vec![(*attr).to_string()],
                 })
                 .collect(),
         )
     };
 
     DcqlQuery {
         credentials: vec![DcqlCredential {
             id: DCQL_CREDENTIAL_ID.to_string(),
             format: vc_format.to_string(),
             meta: DcqlCredentialMeta {
                 vct_values: vec![vc_type.to_string()],
             },
             claims,
             require_cryptographic_holder_binding: true,
         }],
     }
 }
 
 /// Pick the disclosed claims out of the verifier's `wallet_response` and return
 /// them as the flat `{claim: value}` object that `GET /info` is documented to
 /// serve (see `core/api-kych.rst`).
 ///
 /// Since 5.0.0 the claims arrive under `dcql_response`, keyed first by the
 /// credential query id and then by claim id or claims path, with each value
 /// wrapped in an array.  The deprecated `credential_subject_data` is still sent
 /// by default and is read as a fallback; it is keyed the same way in recent
 /// releases but was a flat map of claims in older ones, so both shapes are
 /// accepted.
 ///
 /// `None` means there was nothing to extract -- a failed verification, for
 /// instance, where `wallet_response` carries `error_code` instead of claims.
 /// The caller then stores the response unchanged, so that the reason survives
 /// in the session for the operator to look at.
 fn extract_disclosed_claims(wallet_response: &serde_json::Value) -> Option<serde_json::Value> {
     let per_credential = wallet_response
         .get("dcql_response")
         .and_then(|v| v.as_object())
         .or_else(|| {
             wallet_response
                 .get("credential_subject_data")
                 .and_then(|v| v.as_object())
         })?;
 
     // Our own credential query first; fall back to the sole entry, so that a
     // verifier which keys the map differently still works.
     let claims = per_credential
         .get(DCQL_CREDENTIAL_ID)
         .or_else(|| {
             if per_credential.len() == 1 {
                 per_credential.values().next()
             } else {
                 None
             }
         })
         .and_then(|v| v.as_object());
 
     let claims = match claims {
         Some(claims) => claims,
         // Older verifiers put the claims directly into
         // `credential_subject_data` without a credential-query level.  That is
         // this map, as long as it holds no nested objects.
         None if per_credential.values().all(|v| !v.is_object()) => per_credential,
         None => {
             tracing::warn!(
                 "No claims for credential query '{}' in verifier response",
                 DCQL_CREDENTIAL_ID
             );
             return None;
         }
     };
 
     let flattened: serde_json::Map<String, serde_json::Value> = claims
         .iter()
         .map(|(claim, value)| {
             // DCQL reports every value as an array, since a claim may occur
             // more than once; a single value is unwrapped to keep the /info
             // contract unchanged.
             let value = match value.as_array() {
                 Some(values) if values.len() == 1 => values[0].clone(),
                 _ => value.clone(),
             };
             (claim.clone(), value)
         })
         .collect();
 
     if flattened.is_empty() {
         return None;
     }
 
     Some(serde_json::Value::Object(flattened))
 }
 
 // POST /token
 pub async fn token(
     State(state): State<AppState>,
     Form(request): Form<TokenRequest>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!("Token request for code: {}", request.code);
 
     // Validate grant_type
     if request.grant_type != "authorization_code" {
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("unsupported_grant_type")),
         ));
     }
 
     // Authenticate client
     let client = crate::db::clients::authenticate_client(
         &state.pool,
         &request.client_id,
         &request.client_secret,
     )
     .await
     .map_err(|e| {
         tracing::error!("DB error during client authentication: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     let client = match client {
         Some(c) => c,
         None => {
             tracing::warn!("Client authentication failed for {}", request.client_id);
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("invalid_client")),
             ));
         }
     };
 
     // Fetch code (idempotent)
     let code_data =
         crate::db::authorization_codes::get_code_for_token_exchange(&state.pool, &request.code)
             .await
             .map_err(|e| {
                 tracing::error!("DB error in token exchange: {}", e);
                 (
                     StatusCode::INTERNAL_SERVER_ERROR,
                     Json(ErrorResponse::new("internal_error")),
                 )
             })?;
 
     let data = match code_data {
         Some(d) => d,
         None => {
             tracing::warn!("Authorization code not found or expired: {}", request.code);
             return Err((
                 StatusCode::BAD_REQUEST,
                 Json(ErrorResponse::new("invalid_grant")),
             ));
         }
     };
 
     // Verify the authorization code belongs to the client
     if data.client_id != client.id {
         tracing::warn!(
             "Authorization code {} does not belong to the client {}",
             request.code,
             request.client_id
         );
 
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_grant")),
         ));
     }
 
     // RFC 6749 Section 4.1.3: If redirect_uri was included in the authorization request,
     // it MUST be present and match exactly in the token request
     match &data.redirect_uri {
         Some(stored_uri) if stored_uri != &request.redirect_uri => {
             tracing::warn!(
                 "redirect_uri mismatch for code {}: expected '{}', got '{}'",
                 request.code,
                 stored_uri,
                 request.redirect_uri
             );
             return Err((
                 StatusCode::BAD_REQUEST,
                 Json(ErrorResponse::new("invalid_grant")),
             ));
         }
         None => {
             tracing::warn!(
                 "redirect_uri provided in token request but was not stored during authorization for code {}",
                 request.code
             );
             return Err((
                 StatusCode::BAD_REQUEST,
                 Json(ErrorResponse::new("invalid_grant")),
             ));
         }
         Some(_) => {}
     }
 
     // Check for existing token
     if let Some(existing_token) = data.existing_token {
         tracing::info!(
             "Token already exists for session {}, returning cached response",
             data.session_id
         );
         return Ok((
             StatusCode::OK,
             Json(TokenResponse {
                 access_token: existing_token,
                 token_type: "Bearer".to_string(),
                 expires_in: 3600,
             }),
         ));
     }
 
     // Check if code was already used
     if data.was_already_used {
         tracing::warn!("Authorization code {} was already used", request.code);
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_grant")),
         ));
     }
 
     // Validate session status
     if data.session_status != SessionStatus::Verified {
         tracing::warn!(
             "Session {} not in verified status: {:?}",
             data.session_id,
             data.session_status
         );
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_grant")),
         ));
     }
 
     // Generate new token and complete session
     let access_token = crypto::generate_token(state.config.crypto.token_bytes);
     let token = crate::db::tokens::create_token_and_complete_session(
         &state.pool,
         data.session_id,
         &access_token,
         3600, // 1 hour
     )
     .await
     .map_err(|e| {
         tracing::error!("Failed to create token: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     tracing::info!("Token created for session {}", data.session_id);
 
     Ok((
         StatusCode::OK,
         Json(TokenResponse {
             access_token: token.token,
             token_type: "Bearer".to_string(),
             expires_in: 3600,
         }),
     ))
 }
 
 // GET /info
 pub async fn info(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!("Info request received");
 
     // Extract token from Authorization header
     let auth_header = headers
         .get(header::AUTHORIZATION)
         .and_then(|h| h.to_str().ok());
 
     let token = match auth_header {
         Some(h) if h.starts_with("Bearer ") => &h[7..],
         _ => {
             tracing::warn!("Missing or malformed Authorization header");
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("invalid_token")),
             ));
         }
     };
 
     // Fetch token with session data (idempotent)
     let token_data = crate::db::tokens::get_token_with_session(&state.pool, token)
         .await
         .map_err(|e| {
             tracing::error!("DB error in info: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
     let data = match token_data {
         Some(d) => d,
         None => {
             tracing::warn!("Token not found or expired");
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("invalid_token")),
             ));
         }
     };
 
     // Validate token
     if data.revoked {
         tracing::warn!("Token {} is revoked", data.token_id);
         return Err((
             StatusCode::UNAUTHORIZED,
             Json(ErrorResponse::new("invalid_token")),
         ));
     }
 
     if data.session_status != SessionStatus::Completed {
         tracing::warn!("Session not completed: {:?}", data.session_status);
         return Err((
             StatusCode::UNAUTHORIZED,
             Json(ErrorResponse::new("invalid_token")),
         ));
     }
 
     // Return verifiable credential
     let credential = VerifiableCredential {
         data: data.verifiable_credential.unwrap_or(json!({})),
     };
 
     tracing::info!("Returning credential for token {}", data.token_id);
 
     Ok((StatusCode::OK, Json(credential)))
 }
 
 // POST /notification
 // Always returns 200 OK to Swiyu - errors are logged internally
 pub async fn notification_webhook(
     State(state): State<AppState>,
     Json(webhook): Json<NotificationRequest>,
 ) -> impl IntoResponse {
     tracing::info!(
         "Webhook received from Swiyu: verification_id={}, timestamp={}",
         webhook.verification_id,
         webhook.timestamp
     );
 
     // Lookup session by request_id (verification_id)
     let session_data = match crate::db::sessions::get_session_for_notification(
         &state.pool,
         &webhook.verification_id.to_string(),
     )
     .await
     {
         Ok(Some(data)) => data,
         Ok(None) => {
             tracing::warn!(
                 "Session not found for verification_id: {}",
                 webhook.verification_id
             );
             return StatusCode::OK;
         }
         Err(e) => {
             tracing::error!("DB error looking up session: {}", e);
             return StatusCode::OK;
         }
     };
 
     // Validate session status
     if session_data.status != SessionStatus::Authorized {
         tracing::warn!(
             "Session {} not in authorized status: {:?}",
             session_data.session_id,
             session_data.status
         );
         return StatusCode::OK;
     }
 
     // Call Swiyu verifier to get verification result
     let verifier_url = format!(
         "{}{}/{}",
         session_data.verifier_url,
         session_data.verifier_management_api_path,
         webhook.verification_id
     );
 
     tracing::debug!("Fetching verification result from: {}", verifier_url);
 
     let verifier_response = match state.http_client.get(&verifier_url).send().await {
         Ok(resp) => resp,
         Err(e) => {
             tracing::error!("Failed to call Swiyu verifier: {}", e);
             return StatusCode::OK;
         }
     };
 
     if !verifier_response.status().is_success() {
         let status = verifier_response.status();
         tracing::error!("Swiyu verifier returned error: {}", status);
         return StatusCode::OK;
     }
 
     let swiyu_result: SwiyuManagementResponse = match verifier_response.json().await {
         Ok(r) => r,
         Err(e) => {
             tracing::error!("Failed to parse Swiyu response: {}", e);
             return StatusCode::OK;
         }
     };
 
     // Determine status based on verification result
     let (new_status, status_str) = match swiyu_result.state {
         SwiyuVerificationStatus::Success => (SessionStatus::Verified, "verified"),
         SwiyuVerificationStatus::Failed => (SessionStatus::Failed, "failed"),
         SwiyuVerificationStatus::Pending => {
             tracing::info!(
                 "Verification {} still pending, ignoring webhook",
                 webhook.verification_id
             );
             return StatusCode::OK;
         }
     };
 
     // What ends up in the session as the verifiable credential, and is handed
     // to the client by /info: the disclosed claims on success, and otherwise
     // the verifier's response unchanged, which is where its error_code is.
     let credential = swiyu_result.wallet_response.as_ref().map(|response| {
         match extract_disclosed_claims(response) {
             Some(claims) => claims,
             None => {
                 tracing::warn!(
                     "No disclosed claims in verifier response for verification {}, storing it unchanged",
                     webhook.verification_id
                 );
                 response.clone()
             }
         }
     });
 
     // Generate authorization code
     let authorization_code = crypto::generate_authorization_code(state.config.crypto.authorization_code_bytes);
 
     // Construct GET request URL: redirect_uri?code=XXX&state=YYY
     let auth_code_ttl = state.config.crypto.authorization_code_ttl_minutes;
 
     // Update session and create auth code 
     match crate::db::sessions::verify_session_and_issue_code(
         &state.pool,
         session_data.session_id,
         new_status,
         &authorization_code,
         auth_code_ttl,
         session_data.client_id,
         "",  // Empty body for GET request
         credential.as_ref(),
     )
     .await
     {
         Ok(code) => {
             tracing::info!(
                 "Session {} updated to {}, auth code created",
                 session_data.session_id,
                 status_str
             );
             tracing::debug!("Generated authorization code: {}", code);
         }
         Err(e) => {
             tracing::error!("Failed to update session with authorization code: {}", e);
         }
     }
 
     StatusCode::OK
 }
 
 pub async fn status(
     State(state): State<AppState>,
     Path(verification_id): Path<String>,
     Query(params): Query<crate::models::StatusQuery>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!(
         "Status check for verification_id: {}, state: {}",
         verification_id,
         params.state
     );
 
     let session_data = crate::db::sessions::get_session_for_status(
         &state.pool,
         &verification_id,
     )
     .await
     .map_err(|e| {
         tracing::error!("DB error in status: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     let data = match session_data {
         Some(d) => d,
         None => {
             tracing::warn!("Session not found for verification_id: {}", verification_id);
             return Err((
                 StatusCode::NOT_FOUND,
                 Json(ErrorResponse::new("session_not_found")),
             ));
         }
     };
 
     if data.state.as_deref() != Some(&params.state) {
         tracing::warn!(
             "State mismatch for verification_id: {} (expected: {:?}, got: {})",
             verification_id,
             data.state,
             params.state
         );
         return Err((
             StatusCode::FORBIDDEN,
             Json(ErrorResponse::new("invalid_state")),
         ));
     }
 
     let status_str = match data.status {
         crate::db::sessions::SessionStatus::Pending => "pending",
         crate::db::sessions::SessionStatus::Authorized => "authorized",
         crate::db::sessions::SessionStatus::Verified => "verified",
         crate::db::sessions::SessionStatus::Failed => "failed",
         crate::db::sessions::SessionStatus::Expired => "expired",
         crate::db::sessions::SessionStatus::Completed => "completed",
     };
 
     let response = crate::models::StatusResponse {
         status: status_str.to_string(),
     };
 
     tracing::info!(
         "Status check for verification_id {} returned: {}",
         verification_id,
         status_str
     );
 
     Ok((StatusCode::OK, Json(response)))
 }
 
 pub async fn finalize(
     State(state): State<AppState>,
     Path(verification_id): Path<String>,
     Query(params): Query<crate::models::StatusQuery>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!(
         "Finalize request for verification_id: {}, state: {}",
         verification_id,
         params.state
     );
 
     let session_data = crate::db::sessions::get_session_for_status(&state.pool, &verification_id)
         .await
         .map_err(|e| {
             tracing::error!("DB error in finalize: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
     let data = match session_data {
         Some(d) => d,
         None => {
             tracing::warn!(
                 "Session not found for verification_id: {}",
                 verification_id
             );
             return Err((
                 StatusCode::NOT_FOUND,
                 Json(ErrorResponse::new("session_not_found")),
             ));
         }
     };
 
     if data.state.as_deref() != Some(&params.state) {
         tracing::warn!(
             "State mismatch for verification_id: {} (expected: {:?}, got: {})",
             verification_id,
             data.state,
             params.state
         );
         return Err((
             StatusCode::FORBIDDEN,
             Json(ErrorResponse::new("invalid_state")),
         ));
     }
 
     if data.status != crate::db::sessions::SessionStatus::Verified {
         tracing::warn!(
             "Session {} not verified, status: {:?}",
             verification_id,
             data.status
         );
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("not_verified")),
         ));
     }
 
     let authorization_code = match data.authorization_code {
         Some(code) => code,
         None => {
             tracing::error!(
                 "Session {} verified but no authorization code found",
                 verification_id
             );
             return Err((
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             ));
         }
     };
 
     let redirect_uri = match data.redirect_uri {
         Some(uri) => uri,
         None => {
             tracing::error!(
                 "Session {} has no redirect_uri",
                 verification_id
             );
             return Err((
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             ));
         }
     };
 
     let separator = if redirect_uri.contains('?') { '&' } else { '?' };
     let redirect_url = format!(
         "{}{}code={}&state={}",
         redirect_uri,
         separator,
         authorization_code,
         urlencoding::encode(&params.state)
     );
 
     tracing::info!(
         "Finalize: redirecting to {} for verification_id {}",
         redirect_uri,
         verification_id
     );
 
     Ok((
         StatusCode::FOUND,
         [(header::LOCATION, redirect_url)],
         "",
     ))
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
     fn test_is_safe_url() {
         assert!(is_safe_url("https://example.com"));
         assert!(is_safe_url("HTTPS://EXAMPLE.COM"));
         assert!(!is_safe_url("http://example.com"));
         assert!(!is_safe_url("javascript:alert(1)"));
     }
 
     #[test]
     fn test_is_safe_deeplink() {
         assert!(is_safe_deeplink(""));
         assert!(is_safe_deeplink("swiyu-verify://wallet/open"));
         assert!(is_safe_deeplink("https://example.com/callback"));
         assert!(!is_safe_deeplink("http://example.com"));
         assert!(!is_safe_deeplink("file:///etc/passwd"));
     }
 
     #[test]
     fn test_json_encode_string() {
         let raw = "a\"b";
         let encoded = json_encode_string(raw);
         let expected = serde_json::to_string(raw).unwrap();
         assert_eq!(encoded, expected);
     }
 
     #[test]
     fn test_parse_accepted_issuer_dids() {
         let dids = parse_accepted_issuer_dids("{did:example:1, did:example:2}").unwrap();
         assert_eq!(dids, vec!["did:example:1", "did:example:2"]);
 
         assert!(parse_accepted_issuer_dids("").is_err());
         assert!(parse_accepted_issuer_dids("  ").is_err());
         assert!(parse_accepted_issuer_dids("{ }").is_err());
     }
 
     #[test]
     fn test_validate_scope_claims_valid() {
         let valid_claims: HashSet<String> = ["family_name", "age_over_18"]
             .iter()
             .map(|s| s.to_string())
             .collect();
         assert!(validate_scope_claims("family_name age_over_18", &valid_claims).is_ok());
     }
 
     #[test]
     fn test_validate_scope_claims_invalid() {
         let valid_claims: HashSet<String> = ["family_name", "age_over_18"]
             .iter()
             .map(|s| s.to_string())
             .collect();
         let result = validate_scope_claims("invalid_claim", &valid_claims);
         assert!(result.is_err());
         assert!(result.unwrap_err().contains("invalid_claim"));
     }
 
     #[test]
     fn test_validate_scope_claims_mixed() {
         let valid_claims: HashSet<String> = ["family_name", "age_over_18"]
             .iter()
             .map(|s| s.to_string())
             .collect();
         let result = validate_scope_claims("family_name bogus", &valid_claims);
         assert!(result.is_err());
         assert!(result.unwrap_err().contains("bogus"));
     }
 
     #[test]
     fn test_validate_scope_claims_empty() {
         let valid_claims: HashSet<String> = ["family_name"]
             .iter()
             .map(|s| s.to_string())
             .collect();
         assert!(validate_scope_claims("", &valid_claims).is_ok());
     }
 
     #[test]
     fn test_build_dcql_query_single_attribute() {
         let query = build_dcql_query("age_over_18", "betaid-sdjwt", "dc+sd-jwt");
 
         assert_eq!(query.credentials.len(), 1);
         let credential = &query.credentials[0];
         assert_eq!(credential.id, DCQL_CREDENTIAL_ID);
         assert_eq!(credential.format, "dc+sd-jwt");
         assert_eq!(credential.meta.vct_values, vec!["betaid-sdjwt"]);
         assert!(credential.require_cryptographic_holder_binding);
 
         let claims = credential.claims.as_ref().unwrap();
         assert_eq!(claims.len(), 1);
         assert_eq!(claims[0].path, vec!["age_over_18"]);
     }
 
     #[test]
     fn test_build_dcql_query_multiple_attributes() {
         let query = build_dcql_query(
             "first_name last_name date_of_birth",
             "betaid-sdjwt",
             "dc+sd-jwt",
         );
 
         let claims = query.credentials[0].claims.as_ref().unwrap();
         assert_eq!(claims.len(), 3);
         assert_eq!(claims[0].path, vec!["first_name"]);
         assert_eq!(claims[1].path, vec!["last_name"]);
         assert_eq!(claims[2].path, vec!["date_of_birth"]);
     }
 
     #[test]
     fn test_build_dcql_query_extra_whitespace() {
         let query = build_dcql_query("first_name  last_name", "betaid-sdjwt", "dc+sd-jwt");
 
         let claims = query.credentials[0].claims.as_ref().unwrap();
         assert_eq!(claims.len(), 2);
         assert_eq!(claims[0].path, vec!["first_name"]);
         assert_eq!(claims[1].path, vec!["last_name"]);
     }
 
     /// An empty scope must not produce `"claims": []`, which the verifier
     /// rejects; the member is left out instead.
     #[test]
     fn test_build_dcql_query_empty_scope() {
         let query = build_dcql_query("", "betaid-sdjwt", "dc+sd-jwt");
 
         assert_eq!(query.credentials.len(), 1);
         assert!(query.credentials[0].claims.is_none());
         let json = serde_json::to_value(&query).unwrap();
         assert!(json["credentials"][0].get("claims").is_none());
     }
 
     #[test]
     fn test_build_dcql_query_custom_vc_config() {
         let query = build_dcql_query("age_over_18", "custom-type", "vc+sd-jwt");
 
         let credential = &query.credentials[0];
         assert_eq!(credential.format, "vc+sd-jwt");
         assert_eq!(credential.meta.vct_values, vec!["custom-type"]);
     }
 
     /// The wire format the verifier expects, as in
     /// `swiyu-verifier/api_requests/request_over_18_dcql.json`.
     #[test]
     fn test_build_dcql_query_serialises_to_expected_json() {
         let query = build_dcql_query("age_over_18", "betaid-sdjwt", "dc+sd-jwt");
 
         assert_eq!(
             serde_json::to_value(&query).unwrap(),
             serde_json::json!({
                 "credentials": [{
                     "id": "kych_verification",
                     "format": "dc+sd-jwt",
                     "meta": { "vct_values": ["betaid-sdjwt"] },
                     "claims": [{ "path": ["age_over_18"] }],
                     "require_cryptographic_holder_binding": true
                 }]
             })
         );
     }
 
     #[test]
     fn test_extract_disclosed_claims_from_dcql_response() {
         let wallet_response = serde_json::json!({
             "dcql_response": {
                 "kych_verification": {
                     "age_over_18": [true],
                     "given_name": ["Max"]
                 }
             }
         });
 
         let claims = extract_disclosed_claims(&wallet_response).unwrap();
         assert_eq!(claims["age_over_18"], serde_json::json!(true));
         assert_eq!(claims["given_name"], serde_json::json!("Max"));
     }
 
     /// A claim disclosed more than once keeps its array.
     #[test]
     fn test_extract_disclosed_claims_keeps_multiple_values() {
         let wallet_response = serde_json::json!({
             "dcql_response": {
                 "kych_verification": { "nationality": ["CH", "DE"] }
             }
         });
 
         let claims = extract_disclosed_claims(&wallet_response).unwrap();
         assert_eq!(claims["nationality"], serde_json::json!(["CH", "DE"]));
     }
 
     /// A response keyed by some other credential-query id is still read, as
     /// long as it is the only one.
     #[test]
     fn test_extract_disclosed_claims_from_single_other_credential() {
         let wallet_response = serde_json::json!({
             "dcql_response": {
                 "some_other_query": { "age_over_18": [true] }
             }
         });
 
         let claims = extract_disclosed_claims(&wallet_response).unwrap();
         assert_eq!(claims["age_over_18"], serde_json::json!(true));
     }
 
     #[test]
     fn test_extract_disclosed_claims_falls_back_to_credential_subject_data() {
         let wallet_response = serde_json::json!({
             "credential_subject_data": {
                 "kych_verification": { "age_over_18": [true] }
             }
         });
 
         let claims = extract_disclosed_claims(&wallet_response).unwrap();
         assert_eq!(claims["age_over_18"], serde_json::json!(true));
     }
 
     /// Older verifiers put the claims straight into `credential_subject_data`,
     /// without a credential-query level.
     #[test]
     fn test_extract_disclosed_claims_flat_credential_subject_data() {
         let wallet_response = serde_json::json!({
             "credential_subject_data": {
                 "age_over_18": true,
                 "given_name": "Max"
             }
         });
 
         let claims = extract_disclosed_claims(&wallet_response).unwrap();
         assert_eq!(claims["age_over_18"], serde_json::json!(true));
         assert_eq!(claims["given_name"], serde_json::json!("Max"));
     }
 
     /// A failed verification carries an error instead of claims, and must not
     /// be mistaken for a disclosure.
     #[test]
     fn test_extract_disclosed_claims_none_on_error_response() {
         let wallet_response = serde_json::json!({
             "error_code": "authorization_request_object_not_found",
             "error_description": "no such request"
         });
 
         assert!(extract_disclosed_claims(&wallet_response).is_none());
     }
 
     #[test]
     fn test_extract_disclosed_claims_none_when_empty() {
         assert!(extract_disclosed_claims(&serde_json::json!({})).is_none());
         assert!(
             extract_disclosed_claims(&serde_json::json!({ "dcql_response": {} })).is_none()
         );
         assert!(
             extract_disclosed_claims(
                 &serde_json::json!({ "dcql_response": { "kych_verification": {} } })
             )
             .is_none()
         );
     }
 }