[Zeta201]

Summary

• Sets openid4vp.enabled to true in the default server feature configuration so the OpenID4VP feature is enabled out of the box.

Product issue: wso2/product-is#26472

Test plan

• Verify Console's verifiable presentation feature (which gates on openid4vp.enabled) is visible by default after this change.

[jenkins-is-staging]

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/39232757819

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: wso2/carbon-identity-framework/.coderabbit.yml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 53288fe0-0351-4651-b63e-5cf6b589c713

📥 Commits

Reviewing files that changed from the base of the PR and between 21b50a1 and 94d1990.

📒 Files selected for processing: 1

• features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/org.wso2.carbon.identity.core.server.feature.default.json

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The default value of openid4vp.enabled changed from false to true.

Changes: OpenID4VP default setting

Layer / File(s)	Summary
Update the default value features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/org.wso2.carbon.identity.core.server.feature.default.json	The default for openid4vp.enabled changed from false to `true.

Suggested reviewers: sadilchamishka

Priority: ⬇️ Low

Change: Feature

Merge Risk: ⚪ Minimal · up to 94d19

This change enables OpenID4VP and its configured resources by default on fresh installations. The available evidence does not establish an authorization violation or other actionable merge-blocking risk.

Security architecture risk: 🔵 Low · up to 94d19

The change enables additional protocol endpoints by default while retaining declared authorization requirements for management operations. No authorization bypass or sensitive-data exposure was demonstrated. Runtime enforcement, public status-response contents and rollout behavior remain unverified, so the risk is not assessed as minimal.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — Deployments rendered from the new default include public protocol declarations without a separate feature opt-in. The affected assets include verification sessions and tenant presentation definitions. Actual externally reachable routes and the maximum independently attackable tenant or session scope cannot be established without deployment and handler behavior.

Security Findings and Attack Paths

• inferred — A public caller can target the configured status-polling path, but the available evidence does not establish what it returns, how session identifiers are obtained, or whether it crosses an ownership boundary. Sensitive-data disclosure or unauthorized session access is therefore not demonstrated. The missing handler and enforcement behavior remain coverage gaps rather than findings.

Trust Boundaries and Controls

• observed — The public status rule and broader protected session-GET rule overlap syntactically. The tenant API's view scope also describes status polling. Against treating this as a proven authorization mismatch, the ACL explicitly separates public protocol endpoints from the protected session API. Route binding, matching precedence and response semantics are needed to resolve the effective contract.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description explains the configuration change, links the product issue, and provides a test plan. It omits most required template sections, including goals, release note, documentation, certificat…	Complete the required template sections. Enter “N/A” with a brief explanation where a section does not apply. Mark the proposed test plan as completed only after verification, and include the test results and environment details.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: enabling the OpenID4VP feature by default.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Description check

Explanation

The description explains the configuration change, links the product issue, and provides a test plan. It omits most required template sections, including goals, release note, documentation, certification, automation test details, security checks, migration impact, test environment, and related PRs.

Resolution

Complete the required template sections. Enter “N/A” with a brief explanation where a section does not apply. Mark the proposed test plan as completed only after verification, and include the test results and environment details.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.74%. Comparing base (3a002cf) to head (94d1990).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##             master    #8364   +/-   ##
=========================================
  Coverage     54.74%   54.74%           
  Complexity    22476    22476           
=========================================
  Files          2268     2268           
  Lines        132928   132928           
  Branches      21967    21967           
=========================================
  Hits          72767    72767           
  Misses        51400    51400           
  Partials       8761     8761           

Flag	Coverage Δ
unit	40.19% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jenkins-is-staging]

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/39232757819
Status: success

[jenkins-is-staging]

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/39232757819