fix: address Copilot code review comments

- Fix verifyResponse stub to use correct api module pattern
- Fix parameter validation test to properly test missing parameters
- Apply ES6 shorthand property syntax for signingKey
- Revert V4 HMAC logic as token usage is out of scope for this PR

Ticket: CAAS-783

Author: arvind-bg

modules/sdk-api/src/bitgoAPI.ts

@@ -1154,7 +1154,7 @@ export class BitGoAPI implements BitGoBase {
 
     return {
       tokenId: params.tokenId,
-      signingKey: signingKey,
+      signingKey,
     };
   }
 

modules/sdk-api/test/unit/bitgoAPI.ts

@@ -622,12 +622,8 @@ describe('processV4TokenIssuance', function () {
 
   it('should throw error when missing required parameters', function () {
     (() => {
-      bitgo.processV4TokenIssuance({
-        tokenId: '',
-        encryptedToken: '',
-        derivationPath: '',
-        ecdhXprv: '',
-      });
+      // @ts-expect-error - Testing parameter validation with missing required fields
+      bitgo.processV4TokenIssuance({});
     }).should.throw(/tokenId/);
   });
 
@@ -767,7 +763,8 @@ describe('V4 Token Issuance', function () {
     } as any);
 
     // Stub verifyResponse to pass
-    const verifyStub = sinon.stub(bitgo as any, 'verifyResponse').returns(undefined);
+    const verifyResponseStub = sinon.stub().returns(undefined);
+    const verifyStub = sinon.stub(require('../../src/api'), 'verifyResponse').callsFake(verifyResponseStub);
 
     try {
       await bitgo.addAccessToken({

modules/sdk-hmac/src/hmac.ts

@@ -49,12 +49,12 @@ export function calculateHMACSubject<T extends string | Buffer = string>(
   let prefixedText: string;
   if (statusCode !== undefined && isFinite(statusCode) && Number.isInteger(statusCode)) {
     prefixedText =
-      authVersion === 3 || authVersion === 4
+      authVersion === 3
         ? [method.toUpperCase(), timestamp, queryPath, statusCode].join('|')
         : [timestamp, queryPath, statusCode].join('|');
   } else {
     prefixedText =
-      authVersion === 3 || authVersion === 4
+      authVersion === 3
         ? [method.toUpperCase(), timestamp, '3.0', queryPath].join('|')
         : [timestamp, queryPath].join('|');
   }