Local relying-party test setup

Use this guide to create a local synthetic relying party. For the staging certificate intake and rollout procedure, see the EUDI integration checklist.

Isolated synthetic RP lane

Use this lane when official EUDI RP certificates are not available yet. It is local-only and deliberately cannot write to the shared staging environment. The generated certificates are synthetic test credentials; they are not qualified EUDI certificates and will not be trusted by an unmodified EUDI Wallet.

From apps/gateway:

npm run migrate:synthetic
npm run generate:rp-certs -- \
  --client-id acme-bank \
  --output-dir ./tmp/rp-certs/acme-bank
npm run seed:rp-test-trust -- \
  --root-file ./tmp/rp-certs/acme-bank/synthetic-rp-root.pem \
  --country RS
npm run provision:rp -- \
  --client-id acme-bank \
  --display-name "Acme Bank" \
  --legal-name "Acme Bank plc" \
  --policy-file ./acme-eudi-policy.json \
  --wrpac-file ./tmp/rp-certs/acme-bank/wrpac.json \
  --wrpac-key-file ./tmp/rp-certs/acme-bank/wrpac-private.jwk \
  --wrprc-file ./tmp/rp-certs/acme-bank/wrprc.json \
  --env synthetic

Run the Worker against this isolated local environment with:

npm run dev -- --env synthetic

Never add --remote to the synthetic commands. Use the shared staging environment only after receiving registrar-issued WRPAC/WRPRC material.

The dashboard has a matching browser-test lane for this flow. From the repository root, run:

pnpm --filter dlbr-id-dashboard test:e2e

The Playwright scenarios cover RP selection, OID4VP request creation, registration and authorization failures, WebSocket completion/reconnect, and signed webhook test-delivery feedback. They use deterministic browser doubles; the Gateway tests and the commands above are the executable local synthetic flow.