Auth: Allow enabling/disabling OpenID4VP and OpenID4VCI independently by Copilot · Pull Request #4119 · nuts-foundation/nuts-node

Copilot · 2026-03-25T14:03:54Z

Previously, auth.authorizationendpoint.enabled enabled both OpenID4VP and OpenID4VCI together, making it impossible to use OpenID4VCI without also enabling OpenID4VP.

New configuration

Two separate flags replace the combined flag:

auth:
  openid4vp:
    enabled: true   # OpenID4VP verifier/wallet (authorization endpoint, VP flows)
  openid4vci:
    enabled: true   # OpenID4VCI client (credential issuance requests + callback)

The old auth.authorizationendpoint.enabled is deprecated but remains functional — it still enables both protocols for backward compatibility. A deprecation warning is logged at startup when this flag is set, directing users to the new flags.

Changes

auth/config.go: Added OpenID4VPConfig and OpenID4VCIConfig structs; kept AuthorizationEndpointConfig as deprecated
auth/interface.go: Replaced AuthorizationEndpointEnabled() with OpenID4VPEnabled() and OpenID4VCIEnabled()
auth/auth.go: Both new methods OR with the deprecated flag for backward compat; logs a WARN when the deprecated flag is in use
auth/api/iam/api.go:
- HandleAuthorizeRequest gated on OpenID4VPEnabled()
- Callback enabled when either protocol is enabled
- authorization_endpoint omitted from AS metadata when OpenID4VP is disabled
auth/api/iam/openid4vci.go: RequestOpenid4VCICredentialIssuance gated on OpenID4VCIEnabled()
auth/cmd/cmd.go: New flags registered; old flag marked deprecated with migration hint

Original prompt

This section details on the original issue you should resolve

<issue_title>Auth: Allow enabling/disabling protocols</issue_title>
<issue_description>Currently, we support:

vp_bearer grant type (enabled by default)

OpenID4VP (when AUTHORZATION_ENDPOINT_ENABLED = true)

OpenID4VCI (client) (when AUTHORZATION_ENDPOINT_ENABLED = true)

Authorization Code Flow when OpenID4VP is enabled

Upcoming support:

JWT bearer grant type

Since we have an actual use case for OpenID4VCI, but not for OpenID4VP, we should allow enabling the OpenID4VCI without enabling OpenID4VP at the same time.

Configuration structure:
auth.openid4vp.enabled (true/false)
auth.openid4vci.enabled (true/false)
We can then add sub-items in the future.
</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes Auth: Allow enabling/disabling protocols #4118

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

…arately Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com> Agent-Logs-Url: https://github.com/nuts-foundation/nuts-node/sessions/97962131-050a-4a34-9f6d-efe01eef57ac

reinkrul

Log error when deprecated AuthorizationEndpoint is used, telling to use the other properties.

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com> Agent-Logs-Url: https://github.com/nuts-foundation/nuts-node/sessions/c497969e-5b23-418a-82f4-5e6af4be6b6e

Copilot · 2026-03-25T14:49:26Z

Log error when deprecated AuthorizationEndpoint is used, telling to use the other properties.

Done in 2c4ddd5. When auth.authorizationendpoint.enabled = true is set, Configure() now logs a WARN message: auth.authorizationendpoint.enabled is deprecated, use auth.openid4vp.enabled and auth.openid4vci.enabled instead.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

example.com
- Triggering command: /tmp/go-build2924061989/b1080/iam.test /tmp/go-build2924061989/b1080/iam.test -test.paniconexit0 -test.count=1 -test.timeout=2m0s /tmp/go-build2471165822/b914/vet.cfg IyoLvoTcu rg/x/crypto@v0.4-ifaceassert ux-amd64/pkg/tool/linux_amd64/vet . t/internal/tag mpile ux-amd64/pkg/too/tmp/go-build2471165822/b946/vet.cfg -o om/robfig/cron/v3@v3.0.1/chain.g-errorsas om/robfig/cron/v3@v3.0.1/constan-ifaceassert ux-amd64/pkg/tool/linux_amd64/vet d.go foundation/go-st-atomic mpile ux-amd64/pkg/too-buildtags (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

qltysh · 2026-03-25T14:58:35Z

Coverage Impact

⬆️ Merging this pull request will increase total coverage on master by 0.01%.

Modified Files with Diff Coverage (4)

File	% Diff	Uncovered Line #s
auth/auth.go	75.0%	151-152
auth/cmd/cmd.go	100.0%
auth/api/iam/api.go	100.0%
auth/api/iam/openid4vci.go	100.0%
Total	88.9%

🤖 Increase coverage with AI coding...

In the `copilot/enable-disable-openid4vp-vci` branch, add test coverage for this new code:

- `auth/auth.go` -- Line 151-152

🚦 See full report on Qlty Cloud »

🛟 Help

Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.
Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.
File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)
- Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

auth/auth_test.go

reinkrul · 2026-03-26T12:28:36Z

@copilot the openid4vp e2e tests still specify auth.authorizationendpoint in the YAML files, replace this with the new property

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com> Agent-Logs-Url: https://github.com/nuts-foundation/nuts-node/sessions/eace0514-6d68-46f9-9c5c-b1a1b5b9532e

qltysh · 2026-03-26T12:30:53Z

2 new issues

Tool	Category	Rule	Count
qlty	Structure	Function with many returns (count = 13): RequestOpenid4VCICredentialIssuance	2

…e2e test configs Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com> Agent-Logs-Url: https://github.com/nuts-foundation/nuts-node/sessions/9decfe7c-69e1-48c8-9fb4-02d1217789f2

Copilot · 2026-03-26T12:31:12Z

@copilot the openid4vp e2e tests still specify auth.authorizationendpoint in the YAML files, replace this with the new property

Updated in 3e6f62c. All three e2e test configs now use auth.openid4vp.enabled: true instead of auth.authorizationendpoint.enabled: true:

e2e-tests/browser/openid4vp_employeecredential/config/nuts.yaml
e2e-tests/oauth-flow/openid4vp/node-A/nuts.yaml
e2e-tests/oauth-flow/openid4vp/node-B/nuts.yaml

- Add integrating/openid4vci.rst: how-to guide for requesting credentials over OpenID4VCI (wallet-initiated flow) - Regenerate server_options.rst: replace deprecated auth.authorizationendpoint.enabled with auth.openid4vci.enabled and auth.openid4vp.enabled - Update recommended-deployment.rst to reference the new config keys - Register openid4vci.rst in the docs index Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Initial plan

54efb2b

Copilot AI assigned Copilot and reinkrul Mar 25, 2026

Copilot started work on behalf of reinkrul March 25, 2026 14:04 View session

Auth: Allow enabling/disabling OpenID4VP and OpenID4VCI protocols sep…

1cb2d2b

…arately Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com> Agent-Logs-Url: https://github.com/nuts-foundation/nuts-node/sessions/97962131-050a-4a34-9f6d-efe01eef57ac

Copilot AI changed the title ~~[WIP] Update auth to enable or disable OpenID4VP and OpenID4VCI~~ Auth: Allow enabling/disabling OpenID4VP and OpenID4VCI independently Mar 25, 2026

Copilot AI requested a review from reinkrul March 25, 2026 14:19

Copilot finished work on behalf of reinkrul March 25, 2026 14:19

reinkrul requested changes Mar 25, 2026

View reviewed changes

Copilot started work on behalf of reinkrul March 25, 2026 14:43 View session

Log deprecation warning when auth.authorizationendpoint.enabled is used

2c4ddd5

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com> Agent-Logs-Url: https://github.com/nuts-foundation/nuts-node/sessions/c497969e-5b23-418a-82f4-5e6af4be6b6e

Copilot AI requested a review from reinkrul March 25, 2026 14:51

Copilot finished work on behalf of reinkrul March 25, 2026 14:51

reinkrul requested changes Mar 26, 2026

View reviewed changes

auth/auth_test.go Outdated Show resolved Hide resolved

Copilot started work on behalf of reinkrul March 26, 2026 12:26 View session

reinkrul marked this pull request as ready for review March 26, 2026 12:29

reinkrul requested review from gerardsn, stevenvegt and woutslakhorst as code owners March 26, 2026 12:29

Remove unnecessary test for deprecation warning

521eb5b

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com> Agent-Logs-Url: https://github.com/nuts-foundation/nuts-node/sessions/eace0514-6d68-46f9-9c5c-b1a1b5b9532e

Copilot AI requested a review from reinkrul March 26, 2026 12:30

Copilot finished work on behalf of reinkrul March 26, 2026 12:30

Copilot started work on behalf of reinkrul March 26, 2026 12:30 View session

Replace deprecated auth.authorizationendpoint with auth.openid4vp in …

3e6f62c

…e2e test configs Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com> Agent-Logs-Url: https://github.com/nuts-foundation/nuts-node/sessions/9decfe7c-69e1-48c8-9fb4-02d1217789f2

Copilot finished work on behalf of reinkrul March 26, 2026 12:31

reinkrul and others added 2 commits March 26, 2026 16:25

qlty fmt

dc27500

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Auth: Allow enabling/disabling OpenID4VP and OpenID4VCI independently#4119

Auth: Allow enabling/disabling OpenID4VP and OpenID4VCI independently#4119
Copilot wants to merge 7 commits intomasterfrom
copilot/enable-disable-openid4vp-vci

Copilot AI commented Mar 25, 2026 •

edited

Loading

Uh oh!

reinkrul left a comment

Uh oh!

Copilot AI commented Mar 25, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

qltysh bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

reinkrul commented Mar 26, 2026

Uh oh!

qltysh bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

Copilot AI commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Copilot AI commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New configuration

Changes

Comments on the Issue (you are @copilot in this section)

Uh oh!

reinkrul left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

qltysh bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

reinkrul commented Mar 26, 2026

Uh oh!

qltysh bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2 new issues

Uh oh!

Copilot AI commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Mar 25, 2026 •

edited

Loading

Copilot AI commented Mar 25, 2026 •

edited

Loading

qltysh bot commented Mar 25, 2026 •

edited

Loading

qltysh bot commented Mar 26, 2026 •

edited

Loading