Replace policies endpoint with hardcoded policies, fix sandbox OAuth flow

[antspriggs]

Summary

• Removes the broken /api/public/v3/policies endpoint and replaces it with hardcoded standard policies (Login, NIST AAL2/IAL2, Military) in the demo AuthViewModel
• Adds LOGIN and NIST_AAL2_IAL2 entries to the IDmeScope enum
• Wires up sandbox credentials: client ID hardcoded, client_secret read from local.properties via a BuildConfig field injected in demo/build.gradle.kts
• Includes client_secret in the token exchange request — ID.me sandbox only supports client_secret_post/client_secret_basic auth methods, so it is required even for PKCE flows
• Adds scope to the token exchange request body
• Fixes HTTP POST body writing to use explicit byte array + Content-Length header
• Removes the deprecated policies() method from IDmeAuth and APIEndpoint
• Removes isLoadingPolicies state and the LaunchedEffect policy fetch from LoginScreen

Test plan

• Build and install the demo app (./gradlew :demo:installDebug)
• Verify Login, NIST AAL2/IAL2, and Military policies appear in the UI without any network call
• Select Login policy, tap Login — complete the ID.me sandbox flow and confirm credentials are returned
• Tap "Refresh Credentials" and confirm token refresh succeeds
• Tap "Fetch Payload" and confirm user claims are displayed
• Tap Logout and confirm state resets

🤖 Generated with Claude Code

[idme-secure-pipeline-prod]

Security Gate ⚠️ — scan incomplete

Click Re-scan on the Security Gate check to retry. If it fails again, contact #ask-security.

Not blocking this merge — enforcement activates June 1, 2026.

📋 Scanner status

Scanner	Status
executionplane	✅ completed
executionplane	⏱️ timed out

🔍 32 pre-existing findings in unchanged files — not blocking this PR

These findings exist in files not touched by this PR. They are shown for awareness but do not block merging.

• HIGH .github/workflows/build.yml:14 — unpinned action reference [gha-scan]
• HIGH .github/workflows/build.yml:17 — unpinned action reference [gha-scan]
• HIGH .github/workflows/build.yml:23 — unpinned action reference [gha-scan]
• HIGH .github/workflows/build.yml:28 — unpinned action reference [gha-scan]
• HIGH .github/workflows/publish.yml:33 — code injection via template expansion [gha-scan]
• HIGH .github/workflows/publish.yml:38 — code injection via template expansion [gha-scan]
• HIGH .github/workflows/publish.yml:20 — unpinned action reference [gha-scan]
• HIGH .github/workflows/publish.yml:23 — unpinned action reference [gha-scan]
• HIGH .github/workflows/publish.yml:29 — unpinned action reference [gha-scan]
• HIGH .github/workflows/release.yml:47 — code injection via template expansion [gha-scan]
• HIGH .github/workflows/release.yml:27 — unpinned action reference [gha-scan]
• HIGH .github/workflows/release.yml:32 — unpinned action reference [gha-scan]
• HIGH .github/workflows/release.yml:38 — unpinned action reference [gha-scan]
• HIGH .github/workflows/release.yml:43 — unpinned action reference [gha-scan]
• HIGH .github/workflows/release.yml:75 — unpinned action reference [gha-scan]
• HIGH .github/workflows/release.yml:82 — unpinned action reference [gha-scan]
• HIGH .github/workflows/release.yml:201 — unpinned action reference [gha-scan]
• HIGH .github/workflows/release.yml:43 — runtime artifacts potentially vulnerable to a cache poisoning attack [gha-scan]
• HIGH .github/workflows/stale-prs.yml:28 — unpinned action reference [gha-scan]
• MEDIUM .github/workflows/build.yml:13 — credential persistence through GitHub Actions artifacts [gha-scan]
• MEDIUM .github/workflows/build.yml:10 — overly broad permissions [gha-scan]
• MEDIUM .github/workflows/publish.yml:20 — credential persistence through GitHub Actions artifacts [gha-scan]
• MEDIUM .github/workflows/release.yml:26 — credential persistence through GitHub Actions artifacts [gha-scan]
• MEDIUM .github/workflows/secure-pipeline-ast.yml:16 — overly broad permissions [gha-scan]
• MEDIUM .github/workflows/secure-pipeline-ast.yml:17 — secrets unconditionally inherited by called workflow [gha-scan]
• LOW .github/workflows/release.yml:89 — code injection via template expansion [gha-scan]
• LOW .github/workflows/release.yml:201 — action functionality is already included by the runner [gha-scan]
• INFO /workspace/.github/workflows/publish.yml:33 — Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". [opengrep]
• INFO /workspace/.github/workflows/release.yml:46 — Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". [opengrep]
• INFO /workspace/.github/workflows/release.yml:212 — Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". [opengrep]
• INFO /workspace/demo/src/main/AndroidManifest.xml:13 — The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access to your application's control plane. [opengrep]
• INFO /workspace/demo/src/main/AndroidManifest.xml:24 — The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access to your application's control plane. [opengrep]

📊 master baseline — pre-existing findings, won't block your merge

These findings existed on the target branch before your PR was opened.
None came from your changes. None affect your Security Gate result.
This section is for reviewers assessing pre-existing risk before approving.

Severity	Open	7d	30d
🔴 Critical	0	0	—
🟠 High	19	0	—
🟡 Medium	6	0	—
🔵 Low	2	0	—

_{14d total findings: ▄▄▄▄▄▄▄▄▄▄▄▄▄▄ (oldest → newest)}

Last scanned: 2026-05-05 14:50 UTC · Dashboard ↗

6d3a1a0 · 603.6s · View Details | 🔗 Give Feedback · ℹ️ FAQ · 💬 #ask-security · 🎫 Request Support

[idme-secure-pipeline-prod]

Security Gate ⚠️ — scan incomplete

Click Re-scan on the Security Gate check to retry. If it fails again, contact #ask-security.

Not blocking this merge — enforcement activates June 1, 2026.

📋 Scanner status

Scanner	Status
executionplane	❌ failed

📊 master baseline — pre-existing findings, won't block your merge

These findings existed on the target branch before your PR was opened.
None came from your changes. None affect your Security Gate result.
This section is for reviewers assessing pre-existing risk before approving.

Severity	Open	7d	30d
🔴 Critical	0	0	—
🟠 High	19	0	—
🟡 Medium	6	0	—
🔵 Low	2	0	—

_{14d total findings: ▄▄▄▄▄▄▄▄▄▄▄▄▄▄ (oldest → newest)}

Last scanned: 2026-05-05 14:50 UTC · Dashboard ↗

3af390c · 54.5s · View Details | 🔗 Give Feedback · ℹ️ FAQ · 💬 #ask-security · 🎫 Request Support