kych

handlers.rs (43785B)

---

 use axum::{
     Json,
     extract::{Path, Query, State},
     http::{StatusCode, header},
     response::IntoResponse,
     Form,
 };
 use chrono::Utc;
 use serde_json::json;
 use std::collections::HashSet;
 
 use crate::{crypto, db::sessions::SessionStatus, models::*, state::AppState};
 
 const HTML_CSP: &str = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'";
 
 fn is_safe_url(url: &str) -> bool {
     url.to_lowercase().starts_with("https://")
 }
 
 fn is_safe_deeplink(url: &str) -> bool {
     if url.is_empty() {
         return true;
     }
     let url_lower = url.to_lowercase();
     url_lower.starts_with("swiyu-verify://") || url_lower.starts_with("https://")
 }
 
 fn json_encode_string(s: &str) -> String {
     serde_json::to_string(s).unwrap_or_else(|_| "\"\"".to_string())
 }
 
 fn parse_accepted_issuer_dids(raw: &str) -> Result<Vec<String>, &'static str> {
     let trimmed = raw.trim();
     if trimmed.is_empty() {
         return Err("ACCEPTED_ISSUER_DIDS must contain at least one DID");
     }
 
     let trimmed = trimmed.strip_prefix('{').unwrap_or(trimmed);
     let trimmed = trimmed.strip_suffix('}').unwrap_or(trimmed);
 
     let dids: Vec<String> = trimmed
         .split(',')
         .map(|s| s.trim())
         .filter(|s| !s.is_empty())
         .map(|s| s.to_string())
         .collect();
 
     if dids.is_empty() {
         return Err("ACCEPTED_ISSUER_DIDS must contain at least one DID");
     }
 
     Ok(dids)
 }
 
 fn validate_scope_claims(scope: &str, valid_claims: &HashSet<String>) -> Result<(), String> {
     for claim in scope.split_whitespace() {
         if !valid_claims.contains(claim) {
             return Err(format!("invalid claim in scope: {}", claim));
         }
     }
     Ok(())
 }
 
 pub async fn config(
     State(state): State<AppState>,
 ) -> impl IntoResponse {
     tracing::info!("Config request received");
 
     let mut claims: Vec<String> = state.config.vc.vc_claims.iter().cloned().collect();
     claims.sort();
 
     PrettyJson(ConfigResponse {
         name: "kych-oauth2-gateway".to_string(),
         version: env!("CARGO_PKG_VERSION").to_string(),
         status: "healthy".to_string(),
         vc_type: state.config.vc.vc_type.clone(),
         vc_format: state.config.vc.vc_format.clone(),
         vc_algorithms: state.config.vc.vc_algorithms.clone(),
         vc_claims: claims,
     })
 }
 
 // POST /setup/{clientId}
 pub async fn setup(
     State(state): State<AppState>,
     Path(client_id): Path<String>,
     headers: axum::http::HeaderMap,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!("Setup request for client: {}", client_id);
 
     let auth_header = headers
         .get(header::AUTHORIZATION)
         .and_then(|h| h.to_str().ok());
 
     let bearer_token = match auth_header {
         Some(h) if h.starts_with("Bearer ") => &h[7..],
         _ => {
             tracing::warn!(
                 "Missing or malformed Authorization header for client: {}",
                 client_id
             );
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("unauthorized")),
             ));
         }
     };
 
     let secret_hash = crate::db::clients::get_client_secret_hash(&state.pool, &client_id)
         .await
         .map_err(|e| {
             tracing::error!("DB error fetching client secret: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
     let secret_hash = match secret_hash {
         Some(hash) => hash,
         None => {
             tracing::warn!("Client not found: {}", client_id);
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("unauthorized")),
             ));
         }
     };
 
     let is_valid = bcrypt::verify(bearer_token, &secret_hash).map_err(|e| {
         tracing::error!("Bcrypt verification error: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     if !is_valid {
         tracing::warn!("Invalid bearer token for client: {}", client_id);
         return Err((
             StatusCode::UNAUTHORIZED,
             Json(ErrorResponse::new("unauthorized")),
         ));
     }
 
     let nonce = crypto::generate_nonce(state.config.crypto.nonce_bytes);
 
     tracing::debug!("Generated nonce: {}", nonce);
 
     let session = crate::db::sessions::create_session(&state.pool, &client_id, &nonce, 15)
         .await
         .map_err(|e| {
             tracing::error!("Failed to create session: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
     let session = match session {
         Some(s) => s,
         None => {
             tracing::warn!("Client not found: {}", client_id);
             return Err((
                 StatusCode::NOT_FOUND,
                 Json(ErrorResponse::new("client_not_found")),
             ));
         }
     };
 
     tracing::info!(
         "Created session {} for client {} with nonce {}",
         session.id,
         client_id,
         nonce
     );
 
     Ok((StatusCode::OK, Json(SetupResponse { nonce })))
 }
 
 // GET /authorize/{nonce}?response_type=code&client_id={client_id}&redirect_uri={uri}&state={state}
 pub async fn authorize(
     State(state): State<AppState>,
     Path(nonce): Path<String>,
     Query(params): Query<AuthorizeQuery>,
     headers: axum::http::HeaderMap,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!(
         "Authorize request for client: {}, nonce: {}, state: {}, redirect_uri: {}, scope: {}",
         params.client_id,
         nonce,
         params.state,
         params.redirect_uri,
         params.scope
     );
 
     if params.response_type != "code" {
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_request")),
         ));
     }
 
     let session_data = crate::db::sessions::get_session_for_authorize(
         &state.pool,
         &nonce,
         &params.client_id,
         &params.scope,
         &params.redirect_uri,
         &params.state,
     )
     .await
     .map_err(|e| {
         tracing::error!("DB error in authorize: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     let data = match session_data {
         Some(d) => d,
         None => {
             tracing::warn!("Session not found for nonce: {}", nonce);
             return Err((
                 StatusCode::NOT_FOUND,
                 Json(ErrorResponse::new("session_not_found")),
             ));
         }
     };
 
     // Validate redirect_uri against client's registered URIs
     let redirect_uri_valid = data
         .allowed_redirect_uris
         .as_ref()
         .map(|uris| {
             uris.split(',')
                 .map(|s| s.trim())
                 .any(|uri| uri == params.redirect_uri)
         })
         .unwrap_or(false);
 
     if !redirect_uri_valid {
         tracing::warn!(
             "Invalid redirect_uri for client {}: {}",
             params.client_id,
             params.redirect_uri
         );
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_redirect_uri")),
         ));
     }
 
     // Backend validation
     if data.expires_at < Utc::now() {
         tracing::warn!("Session expired: {}", data.session_id);
         return Err((
             StatusCode::GONE,
             Json(ErrorResponse::new("session_expired")),
         ));
     }
 
     // Check status for idempotency
     match data.status {
         SessionStatus::Authorized => {
             tracing::info!(
                 "Session {} already authorized, returning cached response",
                 data.session_id
             );
 
             let verification_id = data
                 .request_id
                 .and_then(|id| uuid::Uuid::parse_str(&id).ok())
                 .unwrap_or(uuid::Uuid::nil());
 
             let accept_html = headers
                 .get(header::ACCEPT)
                 .and_then(|h| h.to_str().ok())
                 .map_or(false, |v| v.contains("text/html"));
 
             if accept_html {
                 use askama::Template;
 
                 #[derive(Template)]
                 #[template(path = "authorize.html")]
                 struct AuthorizeTemplate {
                     verification_url: String,
                     verification_deeplink: String,
                     verification_id_json: String,
                     verification_url_json: String,
                     state_json: String,
                 }
 
                 let verification_url = data.verification_url.clone().unwrap_or_default();
                 let verification_deeplink = data.verification_deeplink.clone().unwrap_or_default();
 
                 if !is_safe_url(&verification_url) {
                     tracing::error!("Invalid verification_url scheme: {}", verification_url);
                     return Err((
                         StatusCode::BAD_GATEWAY,
                         Json(ErrorResponse::new("invalid_verification_url")),
                     ));
                 }
 
                 if !is_safe_deeplink(&verification_deeplink) {
                     tracing::error!("Invalid verification_deeplink scheme: {}", verification_deeplink);
                     return Err((
                         StatusCode::BAD_GATEWAY,
                         Json(ErrorResponse::new("invalid_verification_deeplink")),
                     ));
                 }
 
                 let template = AuthorizeTemplate {
                     verification_url: verification_url.clone(),
                     verification_deeplink,
                     verification_id_json: json_encode_string(&verification_id.to_string()),
                     verification_url_json: json_encode_string(&verification_url),
                     state_json: json_encode_string(&params.state),
                 };
 
                 let html = template.render().map_err(|e| {
                     tracing::error!("Template render error: {}", e);
                     (
                         StatusCode::INTERNAL_SERVER_ERROR,
                         Json(ErrorResponse::new("internal_error")),
                     )
                 })?;
 
                 return Ok((
                     StatusCode::OK,
                     [
                         (header::CONTENT_TYPE, "text/html; charset=utf-8"),
                         (header::CONTENT_SECURITY_POLICY, HTML_CSP),
                     ],
                     html,
                 ).into_response());
             }
 
             return Ok(PrettyJson(AuthorizeResponse {
                 verification_id,
                 verification_url: data.verification_url.clone().unwrap_or_default(),
                 verification_deeplink: data.verification_deeplink,
                 state: params.state.clone()
             }).into_response());
         }
 
         SessionStatus::Pending => {
             // Proceed with authorization
         }
 
         _ => {
             tracing::warn!(
                 "Session {} in invalid status: {:?}",
                 data.session_id,
                 data.status
             );
             return Err((
                 StatusCode::CONFLICT,
                 Json(ErrorResponse::new("invalid_session_status")),
             ));
         }
     }
 
     if let Some(allowed_scopes) = state.config.allowed_scopes.as_ref() {
         let allowed_set: std::collections::HashSet<&str> =
             allowed_scopes.iter().map(String::as_str).collect();
         let invalid_scopes: Vec<&str> = data
             .scope
             .split_whitespace()
             .filter(|scope| !allowed_set.contains(*scope))
             .collect();
 
         if !invalid_scopes.is_empty() {
             tracing::warn!(
                 "Rejected invalid scopes for client {}: {:?}",
                 params.client_id,
                 invalid_scopes
             );
             return Err((
                 StatusCode::BAD_REQUEST,
                 Json(ErrorResponse::new("invalid_scope")),
             ));
         }
     }
 
     if let Err(e) = validate_scope_claims(&data.scope, &state.config.vc.vc_claims) {
         tracing::warn!(
             "Rejected invalid scope claims for client {}: {}",
             params.client_id,
             e
         );
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new(&e)),
         ));
     }
 
     let presentation_definition = build_presentation_definition(
         &data.scope,
         &state.config.vc.vc_type,
         &state.config.vc.vc_format,
         &state.config.vc.vc_algorithms,
     );
 
     // Call Swiyu Verifier
     let verifier_url = format!("{}{}", data.verifier_url, data.verifier_management_api_path);
 
     let accepted_issuer_dids = match data.accepted_issuer_dids.as_deref() {
         Some(raw) => parse_accepted_issuer_dids(raw).map_err(|message| {
             tracing::error!("Invalid accepted issuer DIDs for client {}: {}", params.client_id, message);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("invalid_accepted_issuer_dids")),
             )
         })?,
         None => {
             tracing::error!(
                 "Accepted issuer DIDs not configured for client {}",
                 params.client_id
             );
             return Err((
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("accepted_issuer_dids_not_configured")),
             ));
         }
     };
 
     let verifier_request = SwiyuCreateVerificationRequest {
         accepted_issuer_dids,
         trust_anchors: None,
         jwt_secured_authorization_request: Some(true),
         response_mode: ResponseMode::DirectPost,
         response_type: "vp_token".to_string(),
         presentation_definition,
         configuration_override: ConfigurationOverride::default(),
         dcql_query: None,
     };
 
     tracing::debug!(
         "Swiyu verifier request: {}",
         serde_json::to_string_pretty(&verifier_request).unwrap()
     );
     tracing::debug!("Calling Swiyu verifier at: {}", verifier_url);
 
     let verifier_response = state
         .http_client
         .post(&verifier_url)
         .json(&verifier_request)
         .send()
         .await
         .map_err(|e| {
             tracing::error!("Failed to call Swiyu verifier: {}", e);
             (
                 StatusCode::BAD_GATEWAY,
                 Json(ErrorResponse::new("verifier_unavailable")),
             )
         })?;
 
     if !verifier_response.status().is_success() {
         let status = verifier_response.status();
         let body = verifier_response.text().await.unwrap_or_default();
         tracing::error!("Swiyu verifier returned error {}: {}", status, body);
         return Err((
             StatusCode::BAD_GATEWAY,
             Json(ErrorResponse::new("verifier_error")),
         ));
     }
 
     let swiyu_response: SwiyuManagementResponse = verifier_response.json().await.map_err(|e| {
         tracing::error!("Failed to parse Swiyu response: {}", e);
         (
             StatusCode::BAD_GATEWAY,
             Json(ErrorResponse::new("verifier_invalid_response")),
         )
     })?;
 
     // Update session with verifier data
     let result = crate::db::sessions::update_session_authorized(
         &state.pool,
         data.session_id,
         &swiyu_response.verification_url,
         swiyu_response.verification_deeplink.as_deref(),
         &swiyu_response.id.to_string(),
         swiyu_response.request_nonce.as_deref(),
     )
     .await
     .map_err(|e| {
         tracing::error!("Failed to update session: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     tracing::info!(
         "Session {} authorized, verification_id: {}",
         data.session_id,
         swiyu_response.id
     );
 
     let accept_html = headers
         .get(header::ACCEPT)
         .and_then(|h| h.to_str().ok())
         .map_or(false, |v| v.contains("text/html"));
 
     let verification_url = result.verification_url.clone();
     let verification_deeplink = swiyu_response.verification_deeplink.clone().unwrap_or_default();
 
     if !is_safe_url(&verification_url) {
         tracing::error!("Invalid verification_url scheme: {}", verification_url);
         return Err((
             StatusCode::BAD_GATEWAY,
             Json(ErrorResponse::new("invalid_verification_url")),
         ));
     }
 
     if !is_safe_deeplink(&verification_deeplink) {
         tracing::error!("Invalid verification_deeplink scheme: {}", verification_deeplink);
         return Err((
             StatusCode::BAD_GATEWAY,
             Json(ErrorResponse::new("invalid_verification_deeplink")),
         ));
     }
 
     if accept_html {
         use askama::Template;
 
         #[derive(Template)]
         #[template(path = "authorize.html")]
         struct AuthorizeTemplate {
             verification_url: String,
             verification_deeplink: String,
             verification_id_json: String,
             verification_url_json: String,
             state_json: String,
         }
 
         let template = AuthorizeTemplate {
             verification_url: verification_url.clone(),
             verification_deeplink: verification_deeplink.clone(),
             verification_id_json: json_encode_string(&swiyu_response.id.to_string()),
             verification_url_json: json_encode_string(&verification_url),
             state_json: json_encode_string(&params.state),
         };
 
         let html = template.render().map_err(|e| {
             tracing::error!("Template render error: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
         return Ok((
             StatusCode::OK,
             [
                 (header::CONTENT_TYPE, "text/html; charset=utf-8"),
                 (header::CONTENT_SECURITY_POLICY, HTML_CSP),
             ],
             html,
         ).into_response());
     }
 
     Ok(PrettyJson(AuthorizeResponse {
         verification_id: swiyu_response.id,
         verification_url,
         verification_deeplink: swiyu_response.verification_deeplink,
         state: params.state.clone()
     }).into_response())
 }
 
 fn build_presentation_definition(
     scope: &str,
     vc_type: &str,
     vc_format: &str,
     vc_algorithms: &[String],
 ) -> PresentationDefinition {
     use std::collections::HashMap;
     use uuid::Uuid;
 
     let attributes: Vec<&str> = scope.split_whitespace().collect();
 
     tracing::debug!(
         "Building presentation definition for attributes: {:?}",
         attributes
     );
 
     let vct_field = Field {
         path: vec!["$.vct".to_string()],
         id: None,
         name: None,
         purpose: None,
         filter: Some(Filter {
             filter_type: "string".to_string(),
             const_value: Some(vc_type.to_string()),
         }),
     };
 
     let mut fields: Vec<Field> = vec![vct_field];
     for attr in &attributes {
         fields.push(Field {
             path: vec![format!("$.{}", attr)],
             id: None,
             name: None,
             purpose: None,
             filter: None,
         });
     }
 
     let mut format = HashMap::new();
     format.insert(
         vc_format.to_string(),
         FormatAlgorithm {
             sd_jwt_alg_values: vc_algorithms.to_vec(),
             kb_jwt_alg_values: vc_algorithms.to_vec(),
         },
     );
 
     let input_descriptor = InputDescriptor {
         id: Uuid::new_v4().to_string(),
         name: None,
         purpose: None,
         format: Some(format),
         constraints: Constraint { fields },
     };
 
     PresentationDefinition {
         id: Uuid::new_v4().to_string(),
         name: Some("Over 18 Verification".to_string()),
         purpose: Some("Verify age is over 18".to_string()),
         format: None,
         input_descriptors: vec![input_descriptor],
     }
 }
 
 // POST /token
 pub async fn token(
     State(state): State<AppState>,
     Form(request): Form<TokenRequest>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!("Token request for code: {}", request.code);
 
     // Validate grant_type
     if request.grant_type != "authorization_code" {
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("unsupported_grant_type")),
         ));
     }
 
     // Authenticate client
     let client = crate::db::clients::authenticate_client(
         &state.pool,
         &request.client_id,
         &request.client_secret,
     )
     .await
     .map_err(|e| {
         tracing::error!("DB error during client authentication: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     let client = match client {
         Some(c) => c,
         None => {
             tracing::warn!("Client authentication failed for {}", request.client_id);
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("invalid_client")),
             ));
         }
     };
 
     // Fetch code (idempotent)
     let code_data =
         crate::db::authorization_codes::get_code_for_token_exchange(&state.pool, &request.code)
             .await
             .map_err(|e| {
                 tracing::error!("DB error in token exchange: {}", e);
                 (
                     StatusCode::INTERNAL_SERVER_ERROR,
                     Json(ErrorResponse::new("internal_error")),
                 )
             })?;
 
     let data = match code_data {
         Some(d) => d,
         None => {
             tracing::warn!("Authorization code not found or expired: {}", request.code);
             return Err((
                 StatusCode::BAD_REQUEST,
                 Json(ErrorResponse::new("invalid_grant")),
             ));
         }
     };
 
     // Verify the authorization code belongs to the client
     if data.client_id != client.id {
         tracing::warn!(
             "Authorization code {} does not belong to the client {}",
             request.code,
             request.client_id
         );
 
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_grant")),
         ));
     }
 
     // RFC 6749 Section 4.1.3: If redirect_uri was included in the authorization request,
     // it MUST be present and match exactly in the token request
     match &data.redirect_uri {
         Some(stored_uri) if stored_uri != &request.redirect_uri => {
             tracing::warn!(
                 "redirect_uri mismatch for code {}: expected '{}', got '{}'",
                 request.code,
                 stored_uri,
                 request.redirect_uri
             );
             return Err((
                 StatusCode::BAD_REQUEST,
                 Json(ErrorResponse::new("invalid_grant")),
             ));
         }
         None => {
             tracing::warn!(
                 "redirect_uri provided in token request but was not stored during authorization for code {}",
                 request.code
             );
             return Err((
                 StatusCode::BAD_REQUEST,
                 Json(ErrorResponse::new("invalid_grant")),
             ));
         }
         Some(_) => {}
     }
 
     // Check for existing token
     if let Some(existing_token) = data.existing_token {
         tracing::info!(
             "Token already exists for session {}, returning cached response",
             data.session_id
         );
         return Ok((
             StatusCode::OK,
             Json(TokenResponse {
                 access_token: existing_token,
                 token_type: "Bearer".to_string(),
                 expires_in: 3600,
             }),
         ));
     }
 
     // Check if code was already used
     if data.was_already_used {
         tracing::warn!("Authorization code {} was already used", request.code);
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_grant")),
         ));
     }
 
     // Validate session status
     if data.session_status != SessionStatus::Verified {
         tracing::warn!(
             "Session {} not in verified status: {:?}",
             data.session_id,
             data.session_status
         );
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("invalid_grant")),
         ));
     }
 
     // Generate new token and complete session
     let access_token = crypto::generate_token(state.config.crypto.token_bytes);
     let token = crate::db::tokens::create_token_and_complete_session(
         &state.pool,
         data.session_id,
         &access_token,
         3600, // 1 hour
     )
     .await
     .map_err(|e| {
         tracing::error!("Failed to create token: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     tracing::info!("Token created for session {}", data.session_id);
 
     Ok((
         StatusCode::OK,
         Json(TokenResponse {
             access_token: token.token,
             token_type: "Bearer".to_string(),
             expires_in: 3600,
         }),
     ))
 }
 
 // GET /info
 pub async fn info(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!("Info request received");
 
     // Extract token from Authorization header
     let auth_header = headers
         .get(header::AUTHORIZATION)
         .and_then(|h| h.to_str().ok());
 
     let token = match auth_header {
         Some(h) if h.starts_with("Bearer ") => &h[7..],
         _ => {
             tracing::warn!("Missing or malformed Authorization header");
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("invalid_token")),
             ));
         }
     };
 
     // Fetch token with session data (idempotent)
     let token_data = crate::db::tokens::get_token_with_session(&state.pool, token)
         .await
         .map_err(|e| {
             tracing::error!("DB error in info: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
     let data = match token_data {
         Some(d) => d,
         None => {
             tracing::warn!("Token not found or expired");
             return Err((
                 StatusCode::UNAUTHORIZED,
                 Json(ErrorResponse::new("invalid_token")),
             ));
         }
     };
 
     // Validate token
     if data.revoked {
         tracing::warn!("Token {} is revoked", data.token_id);
         return Err((
             StatusCode::UNAUTHORIZED,
             Json(ErrorResponse::new("invalid_token")),
         ));
     }
 
     if data.session_status != SessionStatus::Completed {
         tracing::warn!("Session not completed: {:?}", data.session_status);
         return Err((
             StatusCode::UNAUTHORIZED,
             Json(ErrorResponse::new("invalid_token")),
         ));
     }
 
     // Return verifiable credential
     let credential = VerifiableCredential {
         data: data.verifiable_credential.unwrap_or(json!({})),
     };
 
     tracing::info!("Returning credential for token {}", data.token_id);
 
     Ok((StatusCode::OK, Json(credential)))
 }
 
 // POST /notification
 // Always returns 200 OK to Swiyu - errors are logged internally
 pub async fn notification_webhook(
     State(state): State<AppState>,
     Json(webhook): Json<NotificationRequest>,
 ) -> impl IntoResponse {
     tracing::info!(
         "Webhook received from Swiyu: verification_id={}, timestamp={}",
         webhook.verification_id,
         webhook.timestamp
     );
 
     // Lookup session by request_id (verification_id)
     let session_data = match crate::db::sessions::get_session_for_notification(
         &state.pool,
         &webhook.verification_id.to_string(),
     )
     .await
     {
         Ok(Some(data)) => data,
         Ok(None) => {
             tracing::warn!(
                 "Session not found for verification_id: {}",
                 webhook.verification_id
             );
             return StatusCode::OK;
         }
         Err(e) => {
             tracing::error!("DB error looking up session: {}", e);
             return StatusCode::OK;
         }
     };
 
     // Validate session status
     if session_data.status != SessionStatus::Authorized {
         tracing::warn!(
             "Session {} not in authorized status: {:?}",
             session_data.session_id,
             session_data.status
         );
         return StatusCode::OK;
     }
 
     // Call Swiyu verifier to get verification result
     let verifier_url = format!(
         "{}{}/{}",
         session_data.verifier_url,
         session_data.verifier_management_api_path,
         webhook.verification_id
     );
 
     tracing::debug!("Fetching verification result from: {}", verifier_url);
 
     let verifier_response = match state.http_client.get(&verifier_url).send().await {
         Ok(resp) => resp,
         Err(e) => {
             tracing::error!("Failed to call Swiyu verifier: {}", e);
             return StatusCode::OK;
         }
     };
 
     if !verifier_response.status().is_success() {
         let status = verifier_response.status();
         tracing::error!("Swiyu verifier returned error: {}", status);
         return StatusCode::OK;
     }
 
     let swiyu_result: SwiyuManagementResponse = match verifier_response.json().await {
         Ok(r) => r,
         Err(e) => {
             tracing::error!("Failed to parse Swiyu response: {}", e);
             return StatusCode::OK;
         }
     };
 
     // Determine status based on verification result
     let (new_status, status_str) = match swiyu_result.state {
         SwiyuVerificationStatus::Success => (SessionStatus::Verified, "verified"),
         SwiyuVerificationStatus::Failed => (SessionStatus::Failed, "failed"),
         SwiyuVerificationStatus::Pending => {
             tracing::info!(
                 "Verification {} still pending, ignoring webhook",
                 webhook.verification_id
             );
             return StatusCode::OK;
         }
     };
 
     // Generate authorization code
     let authorization_code = crypto::generate_authorization_code(state.config.crypto.authorization_code_bytes);
 
     // Construct GET request URL: redirect_uri?code=XXX&state=YYY
     let auth_code_ttl = state.config.crypto.authorization_code_ttl_minutes;
 
     // Update session and create auth code 
     match crate::db::sessions::verify_session_and_issue_code(
         &state.pool,
         session_data.session_id,
         new_status,
         &authorization_code,
         auth_code_ttl,
         session_data.client_id,
         "",  // Empty body for GET request
         swiyu_result.wallet_response.as_ref(),
     )
     .await
     {
         Ok(code) => {
             tracing::info!(
                 "Session {} updated to {}, auth code created",
                 session_data.session_id,
                 status_str
             );
             tracing::debug!("Generated authorization code: {}", code);
         }
         Err(e) => {
             tracing::error!("Failed to update session with authorization code: {}", e);
         }
     }
 
     StatusCode::OK
 }
 
 pub async fn status(
     State(state): State<AppState>,
     Path(verification_id): Path<String>,
     Query(params): Query<crate::models::StatusQuery>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!(
         "Status check for verification_id: {}, state: {}",
         verification_id,
         params.state
     );
 
     let session_data = crate::db::sessions::get_session_for_status(
         &state.pool,
         &verification_id,
     )
     .await
     .map_err(|e| {
         tracing::error!("DB error in status: {}", e);
         (
             StatusCode::INTERNAL_SERVER_ERROR,
             Json(ErrorResponse::new("internal_error")),
         )
     })?;
 
     let data = match session_data {
         Some(d) => d,
         None => {
             tracing::warn!("Session not found for verification_id: {}", verification_id);
             return Err((
                 StatusCode::NOT_FOUND,
                 Json(ErrorResponse::new("session_not_found")),
             ));
         }
     };
 
     if data.state.as_deref() != Some(&params.state) {
         tracing::warn!(
             "State mismatch for verification_id: {} (expected: {:?}, got: {})",
             verification_id,
             data.state,
             params.state
         );
         return Err((
             StatusCode::FORBIDDEN,
             Json(ErrorResponse::new("invalid_state")),
         ));
     }
 
     let status_str = match data.status {
         crate::db::sessions::SessionStatus::Pending => "pending",
         crate::db::sessions::SessionStatus::Authorized => "authorized",
         crate::db::sessions::SessionStatus::Verified => "verified",
         crate::db::sessions::SessionStatus::Failed => "failed",
         crate::db::sessions::SessionStatus::Expired => "expired",
         crate::db::sessions::SessionStatus::Completed => "completed",
     };
 
     let response = crate::models::StatusResponse {
         status: status_str.to_string(),
     };
 
     tracing::info!(
         "Status check for verification_id {} returned: {}",
         verification_id,
         status_str
     );
 
     Ok((StatusCode::OK, Json(response)))
 }
 
 pub async fn finalize(
     State(state): State<AppState>,
     Path(verification_id): Path<String>,
     Query(params): Query<crate::models::StatusQuery>,
 ) -> Result<impl IntoResponse, (StatusCode, Json<ErrorResponse>)> {
     tracing::info!(
         "Finalize request for verification_id: {}, state: {}",
         verification_id,
         params.state
     );
 
     let session_data = crate::db::sessions::get_session_for_status(&state.pool, &verification_id)
         .await
         .map_err(|e| {
             tracing::error!("DB error in finalize: {}", e);
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             )
         })?;
 
     let data = match session_data {
         Some(d) => d,
         None => {
             tracing::warn!(
                 "Session not found for verification_id: {}",
                 verification_id
             );
             return Err((
                 StatusCode::NOT_FOUND,
                 Json(ErrorResponse::new("session_not_found")),
             ));
         }
     };
 
     if data.state.as_deref() != Some(&params.state) {
         tracing::warn!(
             "State mismatch for verification_id: {} (expected: {:?}, got: {})",
             verification_id,
             data.state,
             params.state
         );
         return Err((
             StatusCode::FORBIDDEN,
             Json(ErrorResponse::new("invalid_state")),
         ));
     }
 
     if data.status != crate::db::sessions::SessionStatus::Verified {
         tracing::warn!(
             "Session {} not verified, status: {:?}",
             verification_id,
             data.status
         );
         return Err((
             StatusCode::BAD_REQUEST,
             Json(ErrorResponse::new("not_verified")),
         ));
     }
 
     let authorization_code = match data.authorization_code {
         Some(code) => code,
         None => {
             tracing::error!(
                 "Session {} verified but no authorization code found",
                 verification_id
             );
             return Err((
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             ));
         }
     };
 
     let redirect_uri = match data.redirect_uri {
         Some(uri) => uri,
         None => {
             tracing::error!(
                 "Session {} has no redirect_uri",
                 verification_id
             );
             return Err((
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(ErrorResponse::new("internal_error")),
             ));
         }
     };
 
     let separator = if redirect_uri.contains('?') { '&' } else { '?' };
     let redirect_url = format!(
         "{}{}code={}&state={}",
         redirect_uri,
         separator,
         authorization_code,
         urlencoding::encode(&params.state)
     );
 
     tracing::info!(
         "Finalize: redirecting to {} for verification_id {}",
         redirect_uri,
         verification_id
     );
 
     Ok((
         StatusCode::FOUND,
         [(header::LOCATION, redirect_url)],
         "",
     ))
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
     fn test_is_safe_url() {
         assert!(is_safe_url("https://example.com"));
         assert!(is_safe_url("HTTPS://EXAMPLE.COM"));
         assert!(!is_safe_url("http://example.com"));
         assert!(!is_safe_url("javascript:alert(1)"));
     }
 
     #[test]
     fn test_is_safe_deeplink() {
         assert!(is_safe_deeplink(""));
         assert!(is_safe_deeplink("swiyu-verify://wallet/open"));
         assert!(is_safe_deeplink("https://example.com/callback"));
         assert!(!is_safe_deeplink("http://example.com"));
         assert!(!is_safe_deeplink("file:///etc/passwd"));
     }
 
     #[test]
     fn test_json_encode_string() {
         let raw = "a\"b";
         let encoded = json_encode_string(raw);
         let expected = serde_json::to_string(raw).unwrap();
         assert_eq!(encoded, expected);
     }
 
     #[test]
     fn test_parse_accepted_issuer_dids() {
         let dids = parse_accepted_issuer_dids("{did:example:1, did:example:2}").unwrap();
         assert_eq!(dids, vec!["did:example:1", "did:example:2"]);
 
         assert!(parse_accepted_issuer_dids("").is_err());
         assert!(parse_accepted_issuer_dids("  ").is_err());
         assert!(parse_accepted_issuer_dids("{ }").is_err());
     }
 
     #[test]
     fn test_validate_scope_claims_valid() {
         let valid_claims: HashSet<String> = ["family_name", "age_over_18"]
             .iter()
             .map(|s| s.to_string())
             .collect();
         assert!(validate_scope_claims("family_name age_over_18", &valid_claims).is_ok());
     }
 
     #[test]
     fn test_validate_scope_claims_invalid() {
         let valid_claims: HashSet<String> = ["family_name", "age_over_18"]
             .iter()
             .map(|s| s.to_string())
             .collect();
         let result = validate_scope_claims("invalid_claim", &valid_claims);
         assert!(result.is_err());
         assert!(result.unwrap_err().contains("invalid_claim"));
     }
 
     #[test]
     fn test_validate_scope_claims_mixed() {
         let valid_claims: HashSet<String> = ["family_name", "age_over_18"]
             .iter()
             .map(|s| s.to_string())
             .collect();
         let result = validate_scope_claims("family_name bogus", &valid_claims);
         assert!(result.is_err());
         assert!(result.unwrap_err().contains("bogus"));
     }
 
     #[test]
     fn test_validate_scope_claims_empty() {
         let valid_claims: HashSet<String> = ["family_name"]
             .iter()
             .map(|s| s.to_string())
             .collect();
         assert!(validate_scope_claims("", &valid_claims).is_ok());
     }
 
     #[test]
     fn test_build_presentation_definition_single_attribute() {
         let scope = "age_over_18";
         let pd = build_presentation_definition(
             scope,
             "betaid-sdjwt",
             "vc+sd-jwt",
             &["ES256".to_string()],
         );
 
         assert!(!pd.id.is_empty());
         assert_eq!(pd.name, Some("Over 18 Verification".to_string()));
         assert_eq!(pd.input_descriptors.len(), 1);
 
         let fields = &pd.input_descriptors[0].constraints.fields;
         assert_eq!(fields.len(), 2);
 
         assert_eq!(fields[0].path, vec!["$.vct"]);
         assert!(fields[0].filter.is_some());
         let filter = fields[0].filter.as_ref().unwrap();
         assert_eq!(filter.filter_type, "string");
         assert_eq!(filter.const_value, Some("betaid-sdjwt".to_string()));
 
         assert_eq!(fields[1].path, vec!["$.age_over_18"]);
         assert!(fields[1].filter.is_none());
     }
 
     #[test]
     fn test_build_presentation_definition_multiple_attributes() {
         let scope = "first_name last_name date_of_birth";
         let pd = build_presentation_definition(
             scope,
             "betaid-sdjwt",
             "vc+sd-jwt",
             &["ES256".to_string()],
         );
 
         let fields = &pd.input_descriptors[0].constraints.fields;
         assert_eq!(fields.len(), 4);
 
         assert_eq!(fields[0].path, vec!["$.vct"]);
         assert_eq!(fields[1].path, vec!["$.first_name"]);
         assert_eq!(fields[2].path, vec!["$.last_name"]);
         assert_eq!(fields[3].path, vec!["$.date_of_birth"]);
     }
 
     #[test]
     fn test_build_presentation_definition_extra_whitespace() {
         let scope = "first_name  last_name";
         let pd = build_presentation_definition(
             scope,
             "betaid-sdjwt",
             "vc+sd-jwt",
             &["ES256".to_string()],
         );
 
         let fields = &pd.input_descriptors[0].constraints.fields;
         assert_eq!(fields.len(), 3);
         assert_eq!(fields[0].path, vec!["$.vct"]);
         assert_eq!(fields[1].path, vec!["$.first_name"]);
         assert_eq!(fields[2].path, vec!["$.last_name"]);
     }
 
     #[test]
     fn test_build_presentation_definition_empty_scope() {
         let scope = "";
         let pd = build_presentation_definition(
             scope,
             "betaid-sdjwt",
             "vc+sd-jwt",
             &["ES256".to_string()],
         );
 
         let fields = &pd.input_descriptors[0].constraints.fields;
         assert_eq!(fields.len(), 1);
         assert_eq!(fields[0].path, vec!["$.vct"]);
     }
 
     #[test]
     fn test_build_presentation_definition_no_top_level_format() {
         let scope = "age_over_18";
         let pd = build_presentation_definition(
             scope,
             "betaid-sdjwt",
             "vc+sd-jwt",
             &["ES256".to_string()],
         );
 
         assert!(pd.format.is_none());
     }
 
     #[test]
     fn test_build_presentation_definition_input_descriptor_structure() {
         let scope = "age_over_18";
         let pd = build_presentation_definition(
             scope,
             "betaid-sdjwt",
             "vc+sd-jwt",
             &["ES256".to_string()],
         );
 
         let descriptor = &pd.input_descriptors[0];
 
         assert!(!descriptor.id.is_empty());
 
         assert!(descriptor.name.is_none());
         assert!(descriptor.purpose.is_none());
 
         assert!(descriptor.format.is_some());
         let format = descriptor.format.as_ref().unwrap();
         assert!(format.contains_key("vc+sd-jwt"));
         let alg = &format["vc+sd-jwt"];
         assert_eq!(alg.sd_jwt_alg_values, vec!["ES256"]);
         assert_eq!(alg.kb_jwt_alg_values, vec!["ES256"]);
     }
 
     #[test]
     fn test_build_presentation_definition_custom_vc_config() {
         let scope = "age_over_18";
         let pd = build_presentation_definition(
             scope,
             "custom-type",
             "custom-format",
             &["ES384".to_string(), "ES512".to_string()],
         );
 
         let filter = pd.input_descriptors[0].constraints.fields[0]
             .filter
             .as_ref()
             .unwrap();
         assert_eq!(filter.const_value, Some("custom-type".to_string()));
 
         let format = pd.input_descriptors[0].format.as_ref().unwrap();
         assert!(format.contains_key("custom-format"));
         let alg = &format["custom-format"];
         assert_eq!(alg.sd_jwt_alg_values, vec!["ES384", "ES512"]);
         assert_eq!(alg.kb_jwt_alg_values, vec!["ES384", "ES512"]);
     }
 }