feat(tracing): add structured tracing instrumentation across workspace

[nanderstabel]

Description of change

This PR introduces structured tracing instrumentation across the entire openid4vc workspace (oid4vc-core, oid4vci, oid4vp, siopv2, and oid4vc-manager) to improve observability and diagnostics.

Key Highlights:

• tracing Integration: Added tracing workspace dependency with attributes, std, and log compatibility features.
• #[tracing::instrument(err)]: Annotated core protocol functions (e.g., in Wallet, VpTokenValidator, Provider, RelyingParty) with #[tracing::instrument]. The err attribute automatically captures and logs returned errors with their full context upon span exit, eliminating redundant "log-and-return" boilerplate (tracing::warn!(...); return Err(...)). Sensitive fields (e.g., keys, tokens, signer structs) are explicitly excluded using skip(...).
• .text() vs .json() in HTTP Calls: Replaced direct response.json::<T>() calls in Wallet with response.text() followed by serde_json::from_str(&text). This ensures that when an endpoint returns a non-200 HTTP status (e.g. 400 Bad Request or 500 Internal Server Error) or an unexpected schema, the full raw server response body is retained in the error context and debug logs instead of failing silently with a generic deserialization error.

Links to any relevant issues

N/A

How the change has been tested

• Formatting: cargo fmt --all -- --check passed cleanly.
• Linter: cargo clippy --all-targets --all-features -- -D warnings passed with 0 warnings.
• Unit & Integration Tests: cargo test --workspace --all-features passed all 121 tests (including doc tests).
• End-to-End Verification: Tested in identity-wallet on Android (adb logcat) verifying structured log output during issuance and verification flows.

Definition of Done checklist

• I have followed the contribution guidelines for this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[codecov-commenter]

Codecov Report

❌ Patch coverage is 20.51282% with 62 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
oid4vci/src/wallet/mod.rs	0.00%	47 Missing ⚠️
oid4vp/src/dcql_evaluation.rs	66.66%	3 Missing ⚠️
oid4vp/src/dcql/claims.rs	33.33%	2 Missing ⚠️
oid4vp/src/dcql/dcql_query.rs	33.33%	2 Missing ⚠️
oid4vp/src/token/vp_token_builder.rs	33.33%	2 Missing ⚠️
siopv2/src/provider.rs	0.00%	2 Missing ⚠️
oid4vc-core/src/jwt.rs	0.00%	1 Missing ⚠️
oid4vci/src/proof.rs	50.00%	1 Missing ⚠️
oid4vp/src/token/vp_token_validator.rs	0.00%	1 Missing ⚠️
siopv2/src/relying_party.rs	0.00%	1 Missing ⚠️

Files with missing lines	Coverage Δ
oid4vc-core/src/authorization_request.rs	76.92% <100.00%> (+0.22%)	⬆️
oid4vc-core/src/utils/did.rs	97.05% <ø> (-2.95%)	⬇️
oid4vc-core/src/verifier.rs	100.00% <ø> (+33.33%)	⬆️
oid4vc-manager/src/managers/provider.rs	57.77% <100.00%> (+3.01%)	⬆️
oid4vc-manager/src/managers/relying_party.rs	90.62% <100.00%> (+0.62%)	⬆️
oid4vc-core/src/jwt.rs	98.18% <0.00%> (+2.12%)	⬆️
oid4vci/src/proof.rs	93.10% <50.00%> (-3.20%)	⬇️
oid4vp/src/token/vp_token_validator.rs	96.22% <0.00%> (-1.01%)	⬇️
siopv2/src/relying_party.rs	94.73% <0.00%> (-5.27%)	⬇️
oid4vp/src/dcql/claims.rs	96.84% <33.33%> (-1.24%)	⬇️
... and 5 more

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR introduces structured tracing instrumentation across the openid4vc Rust workspace to improve observability (spans + contextual fields) and refactors several HTTP client paths to preserve raw response bodies for better diagnostics when requests fail or responses don’t match expected schemas.

Changes:

• Added tracing as a workspace dependency and enabled it in multiple crates.
• Annotated key protocol/validation functions with #[tracing::instrument(..., err, skip(...))] and added targeted debug/info events.
• Refactored oid4vci::Wallet HTTP calls to read response.text() first and then serde_json::from_str, retaining raw bodies in error context.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
Cargo.toml	Adds workspace-level tracing dependency and features.
oid4vc-core/Cargo.toml	Enables tracing for oid4vc-core.
oid4vc-core/src/authorization_request.rs	Adds debug logging during authorization request parsing.
oid4vc-core/src/jwt.rs	Adds instrumentation/logging around JWT header extraction, encode/decode helpers, and improves an error message.
oid4vc-core/src/utils/did.rs	Instruments DID KID normalization/extraction with debug context.
oid4vc-core/src/verifier.rs	Instruments signature verification and logs selected algorithm.
oid4vci/Cargo.toml	Enables tracing for oid4vci.
oid4vci/src/proof.rs	Adds debug logging during proof construction.
oid4vci/src/wallet/mod.rs	Adds instrumentation/logging and changes HTTP handling to preserve raw bodies on failures and parse errors.
oid4vc-manager/Cargo.toml	Enables tracing for oid4vc-manager.
oid4vc-manager/src/managers/provider.rs	Adds debug events around ProviderManager operations.
oid4vc-manager/src/managers/relying_party.rs	Adds debug events around RelyingPartyManager operations.
oid4vp/Cargo.toml	Enables tracing for oid4vp.
oid4vp/src/dcql/claims.rs	Adds instrumentation/logging for DCQL claim validation helpers.
oid4vp/src/dcql/dcql_query.rs	Instruments DCQL query validation and adds debug context.
oid4vp/src/dcql_evaluation.rs	Adds debug logging around DCQL evaluation outcomes.
oid4vp/src/token/vp_token_builder.rs	Adds debug/instrumentation for VP token build and submission validation.
oid4vp/src/token/vp_token_validator.rs	Instruments VP token validation pipeline and adds step-level logs.
siopv2/Cargo.toml	Switches serde_urlencoded to workspace dep and enables tracing.
siopv2/src/provider.rs	Instruments Provider flows and improves diagnostics/logging.
siopv2/src/relying_party.rs	Instruments relying party encode/validate paths and adds debug context.

Suppressed comments (2)

oid4vci/src/wallet/mod.rs:525

• This logs the full credential request JSON at INFO level, which includes the proofs.jwt value (a signed JWT) and may contain sensitive identifiers. It also uses unwrap_or_default() which would silently drop serialization errors.

        let request_body_json = serde_json::to_string(&credential_request).unwrap_or_default();
        tracing::info!(%request_body_json, "Sending credential request body to issuer");

oid4vci/src/wallet/mod.rs:548

• Logging the raw credential response body can leak the issued credential(s) (potentially containing PII) into debug logs. Consider logging only metadata such as status and body length, and keep the raw body only in error context when parsing fails.

        tracing::debug!(%status, %text, "Received raw credential response from issuer");

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.