fix(w3ds-oidc-bridge): support same-phone sign-in via /deeplink-login

[coodos]

Signing in to GitW3 on the same phone as the eID Wallet ended in a 404.

For same-phone logins, the wallet opens new URL("/deeplink-login", redirect) in the browser, carrying ename, session, signature and appVersion as query parameters. The bridge only had the POST /w3ds/callback used by the QR flow.

• The callback logic moves into a shared completeWalletLogin. It applies the same checks and publishes the same SSE events.
• The new GET /deeplink-login sends the browser straight to the client's redirect URI with the code (303). On failure it shows the error page and never redirects.
• The waiting login page still gets the redirect event, which covers a wallet that opened a different browser.

The route lives at the origin root because the wallet drops any path prefix. On GitW3 the reverse proxy routes /deeplink-login to the bridge.

Tests: 4 new flow tests: the redirect exchanges for tokens, the SSE event, no redirect on a bad signature, and single use. All 188 pass. pnpm check shows the same 29 type errors as the base branch, all in older test code.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 47b41eba-5473-4a7e-b519-e48c79ed9d39

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}