Incorrect auth server is used for credential offers

[tnotheis]

Readiness checklist

• I added/updated tests.
• I ensured that the PR title is good enough for the changelog.
• I labeled the PR.
• I self-reviewed the PR.

[Copilot]

Pull request overview

This PR fixes an issue where the incorrect authorization server was being used for credential offers in the OpenID4VC flow. The code was previously using credentialOffer.metadata.authorizationServers[0].issuer (now removed), but has been changed to use credentialOffer.credentialOfferPayload.grants.authorization_code.authorization_server instead.

Changes:

• Replaced the authorization server extraction logic to use the correct source from the credential offer payload's grants section
• Added validation to check if the authorization server exists and show an appropriate error if it doesn't
• Added a new error message for invalid credential offers

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
packages/app-runtime/src/AppStringProcessor.ts	Updated authorization server extraction logic and added validation for missing authorization server in credential offers
packages/app-runtime/src/AppRuntimeErrors.ts	Added new error message for invalid credential offers

Comments suppressed due to low confidence (1)

packages/app-runtime/src/AppStringProcessor.ts:103

• The non-null assertion operators (!) are used on a chain that could potentially be undefined. While line 84 checks for grants?.authorization_code before calling this function, the non-null assertions on line 103 assume that grants, authorization_code, and authorization_server are all defined. However, the subsequent null check on line 104 suggests that authorization_server can be undefined, which makes the non-null assertion misleading. Consider removing the non-null assertion operator on authorization_server to accurately reflect that this value can be undefined, or use optional chaining instead.

        const authorizationServer = credentialOffer.credentialOfferPayload.grants!.authorization_code!.authorization_server!;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.