From c077a32f21b829f35c4039deeabb3b1a7a718fd3 Mon Sep 17 00:00:00 2001 From: Rein Krul Date: Wed, 10 Jun 2026 13:54:58 +0200 Subject: [PATCH] refactor(auth): remove non-conformant Display from issuer metadata The `display` field on OpenIDCredentialIssuerMetadata was not conform the OpenID4VCI spec (section 12.2.4). Its values were never consumed and it caused issues with the AET integration. Since nothing reads it, removal is safe. Assisted by AI --- auth/api/iam/openid4vci_test.go | 2 -- auth/openid4vci/types.go | 9 ++++----- 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/auth/api/iam/openid4vci_test.go b/auth/api/iam/openid4vci_test.go index 50803d4065..a2768239e3 100644 --- a/auth/api/iam/openid4vci_test.go +++ b/auth/api/iam/openid4vci_test.go @@ -44,7 +44,6 @@ func TestWrapper_RequestOpenid4VCICredentialIssuance(t *testing.T) { CredentialIssuer: "issuer", CredentialEndpoint: "endpoint", AuthorizationServers: []string{authServer}, - Display: nil, } authzMetadata := oauth.AuthorizationServerMetadata{ AuthorizationEndpoint: "https://auth.server/authorize", @@ -126,7 +125,6 @@ func TestWrapper_RequestOpenid4VCICredentialIssuance(t *testing.T) { CredentialIssuer: "issuer", CredentialEndpoint: "endpoint", AuthorizationServers: []string{}, // empty - Display: nil, } ctx.openid4vciClient.EXPECT().OpenIDCredentialIssuerMetadata(nil, issuerClientID).Return(&metadata, nil) ctx.iamClient.EXPECT().AuthorizationServerMetadata(nil, issuerClientID).Return(nil, assert.AnError) diff --git a/auth/openid4vci/types.go b/auth/openid4vci/types.go index c763664246..6f0833bf73 100644 --- a/auth/openid4vci/types.go +++ b/auth/openid4vci/types.go @@ -43,11 +43,10 @@ const JWTTypeOpenID4VCIProof = "openid4vci-proof+jwt" // (Section 12.2). The document is OpenID4VCI-defined; it is not an OAuth // authorization-server metadata document. type OpenIDCredentialIssuerMetadata struct { - CredentialIssuer string `json:"credential_issuer"` - CredentialEndpoint string `json:"credential_endpoint"` - NonceEndpoint string `json:"nonce_endpoint,omitempty"` - AuthorizationServers []string `json:"authorization_servers,omitempty"` - Display []map[string]string `json:"display,omitempty"` + CredentialIssuer string `json:"credential_issuer"` + CredentialEndpoint string `json:"credential_endpoint"` + NonceEndpoint string `json:"nonce_endpoint,omitempty"` + AuthorizationServers []string `json:"authorization_servers,omitempty"` } // NonceResponse is the body returned by the Nonce Endpoint (Section 7.2).