feat(eid-wallet): load the apps ribbon from the marketplace

[Bekiboo]

Deploy note: deploy the marketplace before releasing the wallet. Until /api/apps is live, the wallet keeps showing its bundled list, so the wrong order doesn't break anything.

What

The apps ribbon on the eID wallet's main screen had five apps hard-coded. It now loads the list from the marketplace, so apps added to the marketplace (curated or published through AaaS) show up in the wallet without a new release.

• Marketplace: GET /api/apps. Returns the curated apps.json list plus the live AaaS platforms. When an app is in both, the curated entry wins, which is the same rule the home page uses. If AaaS fails, the curated list is still returned. The response is public (Access-Control-Allow-Origin: *) and cached for 5 minutes.
• Wallet ribbon. Shows the bundled five apps immediately, then replaces them with the marketplace list when it arrives. If the request fails or returns nothing, the bundled list stays.

Design decisions

• The marketplace is the source, not AaaS directly. The AaaS API key is a secret and can't go in the wallet. The marketplace already reads AaaS server-side, so exposing its combined list reuses that.
• Live entries are untrusted. Platforms publish their own profiles, so the wallet cleans names (the same helper used for auth-link branding) and keeps only https links and logos. Apps without a web link, like the wallet's own entry, are skipped.
• Logos. Blabsy, Pictique, eVoting, eCurrency and Dreamsync keep the wallet's own logos. Other apps use the marketplace logo; curated paths such as /charter.png are resolved against the marketplace host. If there is no logo or it fails to load, the card shows the app's first letter.
• No new env var. The wallet calls the production marketplace URL, the same one the "All apps" link already opened.

Known gaps

• Only Social, Governance and Finance categories are translated. Others (Wellness, Productivity, Storage…) show in English until keys are added for every language.
• The marketplace home page still combines the two lists in the browser, so the "curated wins" rule exists in two places. It could switch to /api/apps in a follow-up.

Testing

• Wallet: npm test -- src/lib/utils/ passes 39/39, including 5 new tests for marketplaceApps (mapping, bundled-logo preference, rejecting non-https links and logos, duplicates, malformed payloads, non-2xx responses).
• Wallet: svelte-check reports 0 errors, and biome is clean on the changed files.
• Marketplace: tsc shows no new errors; the only error (missing dotenv types) was already there. Calling listCatalogApps() with no AaaS key returns the 12 curated apps.
• Not done: running the wallet to check the ribbon visually, and calling /api/apps on a running marketplace with AaaS configured.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}