auth: forward credential_request_params as overlay on OpenID4VCI Credential Request

[reinkrul]

Closes #4233.

Summary

• Adds optional credential_request_params (JSON object) to POST /internal/auth/v2/{subjectID}/request-credential.
• The object is overlaid on top of the node-built OpenID4VCI Credential Request body — any field set here (including credential_configuration_id / credential_identifier / proofs) overrides the node's default. The caller takes responsibility for the resulting wire shape.
• Persisted on OAuthSession.CredentialRequestParams between the redirect and credential-fetch steps.
• RequestCredentialOpts in auth/openid4vci gains a CredentialRequestParams field; RequestCredential builds the body as map[string]any and overlays the caller's values last.

Lets the wallet talk to issuers that accept additional fields, or override the credential request entirely.

Wire body

Final body sent to the issuer's Credential Endpoint:

node defaults (credential_*, proofs) ⊕ credential_request_params (EHR-provided)

Test plan

• ok - credential_request_params persisted into session asserts the field round-trips through the session store
• ok - credential_request_params from session forwarded to credential endpoint asserts the value reaches the credential client
• CredentialRequestParams overrides node-built defaults asserts the wire body: caller values win over node defaults for spec-defined fields
• go build ./..., go test ./auth/...

Assisted by AI

[qltysh]

❌ 1 blocking issue (3 total)

Tool	Category	Rule	Count
gofmt	Style	Incorrect formatting, autoformat by running qlty fmt.	1	❌
qlty	Structure	Function with many returns (count = 13): RequestOpenid4VCICredentialIssuance	2

@qltysh one-click actions:

• Auto-fix formatting (qlty fmt && git push)

[qltysh]

Coverage Impact

⬇️ Merging this pull request will decrease total coverage on master by 0.03%.

Modified Files with Diff Coverage (2)

Rating	File	% Diff	Uncovered Line #s
	auth/api/iam/openid4vci.go	100.0%
	auth/openid4vci/client.go	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[stevenvegt]

The LSPxNuts spec called this the credential_subject_data field and the contents are limited to information which could/should be put into the subject. Example request to the credential endpoint would look like this:

{
  "credential_configuration_id": "PatientEnrollmentCredential",
  "proof": {
    "proof_type": "jwt",
    "jwt": "eyJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCIsImFsZyI6IkVTMjU2Iiwia2lkIjoiZGlkOndlYjpodWlzYXJ0cy1kZWxpbmRlbi5ubCNhdXRoLWtleS0xIn0.eyJhdWQiOiJodHRwczovL3Nkay1zZXJ2aWNlLmludGVybi56b3JnaW5zdGVsbGluZy5ubCIsImlhdCI6MTc0MDAwMDAwMCwibm9uY2UiOiJhYmMxMjMifQ.kort-handtekening"
  },
  "credential_subject_data": {
    "@context": "http://gis-nl.example/context/v1",
    "@type": "HealthcareProvider",
    "hasEnrollment": {
      "patient": {
        "@type": "Patient",
        "identifier": {
          "@type": "Identifier",
          "system": "http://fhir.nl/fhir/NamingSystem/bsn",
          "value": "999911234"
        }
      }
    }
  }
}

I see why this currently works, since the SDK doesn't implement this API yet, but I'm reluctant to merge this into master just because we need it now, knowing it shape is sub optimal and will change any moment.

[stevenvegt]

Needs docs for the nuts-node.readthedocs.

You dropped the EXPERIMENTAL from the endpoint description, why?

Do I understand correctly that in order to issue the LSP credentials, I can just put this

"credential_details": {
  "credential_subject_data": {
    "@context": "http://gis-nl.example/context/v1",
    "@type": "HealthcareProvider",
    "hasEnrollment": {
      "patient": {
        "@type": "Patient",
        "identifier": {
          "@type": "Identifier",
          "system": "http://fhir.nl/fhir/NamingSystem/bsn",
          "value": "999911234"
        }
      }
    }
  }
}

in the body, and that this will be added to the credential request?

Since this is overwriting any value in the credential request, shouldn't this be named something like credential_request_overwrites?