feat: add POST /api/v1/datastore/preauth_offer endpoint

[leifj]

Summary

Add a new endpoint POST /api/v1/datastore/preauth_offer that generates a pre-authorized credential offer for a specific document in the datastore.

This restores the capability that was lost when PR #375 removed the old /api/v1/notification endpoint and the QR field from the CompleteDocument model.

Closes #492

What it does

The endpoint accepts {authentic_source, scope, document_id} and:

1. Looks up the document from the datastore
2. Generates a credential offer with a pre-authorized code (via openid4vci.NewCredentialOffer)
3. Creates and persists an authorization context in the cache (5-minute expiry)
4. Caches the document data for the credential endpoint (keyed by pre-auth code)
5. Returns the credential offer, a credential_offer_url, and a QR code

Design

This follows the same pre-authorized code flow pattern used by the OIDC (handlers_oidcrp.go) and SAML (endpoints_saml.go) standalone authentication flows, but sources the document data from the datastore instead of from authentication claims.

The wallet can redeem the offer via the standard token + credential endpoints, just as it would for an OIDC/SAML-initiated offer.

Files changed

• internal/apigw/apiv1/handlers_datastore.go — new handler + request/reply types
• internal/apigw/httpserver/endpoints_datastore.go — HTTP endpoint wrapper
• internal/apigw/httpserver/service.go — route registration
• internal/apigw/httpserver/api.go — interface method
• internal/apigw/apiv1/handlers_datastore_test.go — unit tests (4 test cases)

[s-jairl]

Could you make swagger to get the API docs updated as well?

[s-jairl]

There also seems to be some build errors with the tests:

Error: internal/apigw/httpserver/endpoints_admin_test.go:141:66: cannot use mock (variable of type *adminStatusMock) as Apiv1 value in argument to testSetupAdminStatus: *adminStatusMock does not implement Apiv1 (missing method DatastorePreAuthOffer)

[Copilot]

Pull request overview

This PR adds a new admin/API endpoint for generating OpenID4VCI pre-authorized credential offers backed by documents already stored in the datastore, restoring functionality removed during the earlier API refactor.

Changes:

• Introduces POST /api/v1/datastore/preauth_offer handler + HTTP wiring and registers the route.
• Persists a pre-auth AuthorizationContext and caches the selected datastore document for later /token + /credential redemption.
• Extends issuance logic to recognize the new datastore auth provider and updates Swagger artifacts.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pkg/model/auth_providers.go	Adds AuthProviderDatastore constant.
Makefile	Includes additional package(s) in swagger generation inputs.
internal/apigw/httpserver/service.go	Registers the /datastore/preauth_offer route.
internal/apigw/httpserver/endpoints_datastore.go	Adds HTTP endpoint wrapper calling apiv1 client method.
internal/apigw/httpserver/endpoints_datastore_test.go	Extends unimplemented apiv1 stub with new method.
internal/apigw/httpserver/api.go	Extends Apiv1 interface with DatastorePreAuthOffer.
internal/apigw/apiv1/handlers_issuer.go	Allows datastore data source to have empty identifier; treats datastore as session-based for doc cache lookup.
internal/apigw/apiv1/handlers_issuer_assertion_test.go	Updates tests for the new datastore identifier behavior.
internal/apigw/apiv1/handlers_datastore.go	Implements DatastorePreAuthOffer request/reply types and handler.
internal/apigw/apiv1/handlers_datastore_test.go	Adds unit tests for the new datastore preauth offer behavior.
docs/apigw/swagger.yaml	Updates Swagger YAML with new endpoint and schemas.
docs/apigw/swagger.json	Updates Swagger JSON with new endpoint and schemas.
docs/apigw/docs.go	Updates embedded Swagger template with new endpoint and schemas.

Files not reviewed (1)

• docs/apigw/docs.go: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• docs/apigw/docs.go: Generated file

Comments suppressed due to low confidence (1)

internal/apigw/apiv1/handlers_datastore.go:592

• DatastorePreAuthOffer can generate offers for expired documents. LookupDatastoreByIdentity filters out docs where Meta.ValidNotAfter is in the past; this endpoint should enforce the same rule so issuance can’t happen from stale datastore data (and to keep behavior consistent across datastore issuance paths).

	// Look up the document from the datastore
	doc, err := c.datastoreStore.GetByKey(ctx, req.AuthenticSource, req.Scope, req.DocumentID)
	if err != nil {
		if errors.Is(err, helpers.ErrNoDocumentFound) {
			return nil, helpers.ErrNoDocumentFound
		}
		return nil, fmt.Errorf("failed to retrieve document: %w", err)
	}