feat(sdk): comprehensive DPoP nonce handling and verification#939

Draft

dmihalcik-virtru wants to merge 53 commits into

mainfrom

DSPX-3397-web-sdk

Commits on Jun 24, 2026

feat(web-sdk): comprehensive DPoP nonce handling and verification (DSPX-3397)

dmihalcik-virtru
and
claude
committed
docs: add DPoP CLI flags design spec (DSPX-3397)
dmihalcik-virtru
committed
docs: add DPoP CLI flags implementation plan (DSPX-3397)
dmihalcik-virtru
committed
feat(cli): add DPoP key pair helpers (DSPX-3397)

dmihalcik-virtru
and
claude
committed
fix(cli): guard derToPem empty input, warn on RS384/RS512 downgrade
dmihalcik-virtru
committed
feat(cli): change --dpop to string type, add --dpop-key option (DSPX-3397)
dmihalcik-virtru
committed
feat(cli): wire --dpop and --dpop-key into encrypt/decrypt commands (DSPX-3397)
dmihalcik-virtru
committed
🤖 🎨 Autoformat
dmihalcik-virtru
committed
fix(dpop): address code review feedback on nonce retry logic and defensive handling (DSPX-3397)

dmihalcik-virtru
and
claude
committed
test(dpop): add DPoP nonce challenge to mock server and cover retry logic (DSPX-3397)

dmihalcik-virtru
and
claude
committed
🤖 🎨 Autoformat
dmihalcik-virtru
committed
🤖 🎨 Autoformat
dmihalcik-virtru
committed
ci(dpop): upgrade Keycloak to 26.2 and enable DPoP nonce challenges in roundtrip tests (DSPX-3397)

dmihalcik-virtru
and
claude
committed
fix(dpop): add missing CORS headers to mock server for browser test compatibility (DSPX-3397)

dmihalcik-virtru
and
claude
committed
chore(scripts): add local dev helper scripts for DPoP demo

dmihalcik-virtru
and
claude
committed
chore(scripts): add config-demo.sh to provision KC and start dev server

dmihalcik-virtru
and
claude
committed
fix(scripts): create demo user1 in config-demo.sh

dmihalcik-virtru
and
claude
committed
fix(scripts): route OIDC through Vite proxy to avoid CORS

dmihalcik-virtru
and
claude
committed
fix(scripts): route KAS through Vite proxy; drop PLATFORM_URL

dmihalcik-virtru
and
claude
committed
fix(sdk): use DPoP scheme when presenting DPoP-bound tokens

dmihalcik-virtru
and
claude
committed
test(web-app): add Playwright test capturing DPoP-protected headers

dmihalcik-virtru
and
claude
committed
fix(dpop): make nonce challenge handling RFC 9449 compliant (DSPX-3397)
dmihalcik-virtru
committed
fix(cli): harden DPoP key loading and helper utilities (DSPX-3397)
dmihalcik-virtru
committed
refactor(dpop): use ConnectError type and dedupe CLI argv handling (DSPX-3397)
dmihalcik-virtru
committed
test(cli): cover PEM loading, key-path resolution, and CLI argv shape (DSPX-3397)
dmihalcik-virtru
committed
🤖 🎨 Autoformat
dmihalcik-virtru
committed
fix(dpop): send DPoP proof on initial Keycloak token request (DSPX-3397)
dmihalcik-virtru
committed
🤖 🎨 Autoformat
dmihalcik-virtru
committed
fix(dpop): scope DPoP enablement to providers configured with a key (DSPX-3397)
dmihalcik-virtru
committed
fix(dpop): emit raw IEEE P1363 ECDSA sigs in DPoP proofs; strict mock verifier (DSPX-3397)
dmihalcik-virtru
committed
fix(dpop): pass full request URL to AuthProvider.withCreds (DSPX-3397)
dmihalcik-virtru
committed
fix(dpop): nonce-challenge retry on legacy fetch path; strip query from htu (DSPX-3397)
dmihalcik-virtru
committed
🤖 🎨 Autoformat
dmihalcik-virtru
committed
test(dpop): enforce RFC 9449 on RPC endpoints + retry on AuthProvider path (DSPX-3397)
dmihalcik-virtru
committed

Commits on Jun 25, 2026

Commits on Jun 30, 2026

Merge branch 'main' into DSPX-3397-web-sdk
dmihalcik-virtru
committed

Commits on Jul 8, 2026

fix(cli): forward per-client DPoP nonce cache through LoggedAuthProvider
dmihalcik-virtru
committed

Commits on Jul 9, 2026