[ceciliaromao]

Description

• SEP-45 now validates home_domain with the same matcher SEP-10 uses (ClientDomainHelper.isDomainNameMatch), in both getChallenge and validate, instead of comparing only URI.getAuthority(). A value that differs from a configured domain by a path, query, fragment, userinfo or backslash is rejected with 400 Invalid home domain.
• getChallenge runs the check before it creates the nonce, simulates the transaction or fetches the client_domain, so nothing is built or server-signed for a rejected value.
• Values are normalized before matching (lower-cased, one leading http:// or https:// removed), so clients that send a scheme or mixed case keep working. The SEP-45 JWT now carries the normalized domain (localhost:8080) in iss and home_domain; the challenge still echoes the value the client sent.
• A wildcard * in home_domains now matches only letters, digits, -, _ and . (it used to be .*). This fixes wildcards never matching a real subdomain in SEP-45, and stops *.example.org from matching values like evil.example/x.example.org in SEP-45 and SEP-10.
• validate rejects an empty (or scheme-only) home_domain and a missing one with 400 Invalid home domain (a missing one used to be an NPE).

Context

• HackerOne report 4108576. Sep45Service accepted and signed a home_domain that SEP-10 rejects, and WebAuthJwtFilter accepts that token on the SEP-24 endpoints, where the home domain is copied into the interactive-URL token.
• The shared matcher alone was not enough: its .* wildcard also let / ? # @ through, so the wildcard is tightened in the shared helper as part of the same change.

Testing

• ./gradlew test
• ./gradlew :core:test: Sep45ServiceTest (27), ClientDomainHelperTest (29), Sep10ServiceTest (73), 0 failures. New tests cover each rejected value, the wildcard accept/reject cases, scheme and case tolerance, the signed claims, and that a rejected challenge creates no nonce and runs no simulation.
• ./gradlew :core:spotlessCheck :essential-tests:spotlessCheck
• ./gradlew :essential-tests:testSep45 (6) and :essential-tests:testSep10 (21 cases) against the local stack: 0 failures. Sep45Tests now expects the bare domain in jwt.iss and jwt.homeDomain.

Documentation

N/A. No new configuration or API; the home_domains comment in anchor-config-default-values.yaml already describes the wildcard form.

Known limitations

• SEP-45 iss and home_domain change from the value the client sent (e.g. http://localhost:8080) to the normalized domain (localhost:8080). Relying parties comparing against the scheme-prefixed form need to match on the bare domain.
• A leading dot (.example.org) still matches *.example.org, as before, because * can match the empty string.
• SEP-10 stays case-sensitive; only SEP-45 compares case-insensitively.
• Sep24End2EndTests (SEP-45 wallet flow over Kafka events) was not run locally.