feat(sdk-core): pass attestation through pending approvals

[mr-neptune]

Summary

• Add WebAuthn attestation to pending-approval approve options.
• Preserve SDK pre-approval and multisig half-signing.
• Support attestation in Express v1 and v2 routes.

Test plan

• Build sdk-core and Express.
• Verify multisig half-signing pass-through.
• Run 69 Express route and codec tests.
• Lint changed files.

WCN-541

[linear-code]

WCN-541

[davidkaplanbitgo]

@claude

[github-actions]

Claude finished @davidkaplanbitgo's task —— View job

---

Code Review Complete

Todo List:

• Read repository guidelines (CLAUDE.md)
• Analyze changed files and understand implementation
• Review SDK core interface changes
• Review Express route implementations
• Review test coverage and quality
• Check for security considerations
• Provide comprehensive feedback

Review Summary

This PR successfully adds WebAuthn attestation support to pending approvals while preserving existing multisig and transaction signing behavior. The implementation is clean, well-tested, and follows BitGoJS conventions.

✅ Strengths

1. Clean Interface Design

• The AttestationPayload type from @bitgo/public-types provides proper type safety
• Optional attestation field in ApproveOptions maintains backward compatibility
• Clear JSDoc documentation explains the field's purpose

2. Consistent Implementation Across Layers

• SDK core interface (iPendingApproval.ts) properly defines the contract
• Implementation (pendingApproval.ts) correctly passes attestation through to API requests
• Express v1 and v2 routes both support the new field with identical interfaces

3. Preserved Multisig Behavior

• The attestation is properly included in the final approval request at pendingApproval.ts:188-190
• Pre-approval transaction rebuilding and half-signing remain unchanged
• The attestation flows through without interfering with existing TSS/multisig logic

4. Comprehensive Test Coverage

• New test case validates attestation pass-through without bypassing multisig half-signing (modules/bitgo/test/v2/unit/pendingApproval.ts:170-190)
• Express v1 and v2 codec tests verify proper serialization/deserialization
• Tests use consistent attestation payload structure across all modules

⚠️ Minor Observations

1. Type Consistency
The attestation payload structure is consistent across test files:

const attestation = {
  signature: 'signature',
  credentialId: 'credential-id', 
  clientDataJSON: 'client-data-json',
  authenticatorData: 'authenticator-data'
};

2. API Request Structure
The implementation correctly builds the approval request body at pendingApproval.ts:187-194:

const approvalParams: ApprovePendingApprovalRequestBody = { 
  state: 'approved', 
  otp: params.otp 
};
if (params.attestation) {
  approvalParams.attestation = params.attestation;
}

🔒 Security Assessment

✅ Proper Optional Field Handling: Attestation is only included when provided, preventing null/undefined injection
✅ Type Safety: Using AttestationPayload from @bitgo/public-types ensures consistent structure
✅ No Bypass Risk: Attestation doesn't affect transaction reconstruction or multisig signing flows
✅ Express Route Validation: Both v1/v2 routes properly validate attestation fields through io-ts codecs

📝 Recommendations

Consider Documentation: While the JSDoc is clear, consider adding examples in the main module documentation showing how attestation integrates with the approval flow.

Test Quality: The test case effectively verifies that attestation passes through without breaking multisig behavior - this is exactly the right test to have.

Final Assessment

This is a well-implemented feature that adds WebAuthn attestation support while maintaining the integrity of existing approval workflows. The changes are minimal, focused, and properly tested. The implementation correctly preserves the critical multisig half-signing behavior while cleanly forwarding attestation data through all layers.

Recommendation: ✅ Approve

---

Job Run • Branch: WCN-541/sdk-attestation-pass-through-multisig