feat(sdk): add comprehensive DPoP (RFC 9449) support (DSPX-3397)#374

Draft

dmihalcik-virtru wants to merge 36 commits into

mainfrom

DSPX-3397-java-sdk

Commits on Jul 1, 2026

feat(java-sdk): add comprehensive DPoP (RFC 9449) support (DSPX-3397)

dmihalcik-virtru
and
claude
committed
fix(java-sdk): fix DPoP compile errors, nonce caching, and add 401-retry

dmihalcik-virtru
and
claude
committed
feat(java-sdk): add --dpop and --dpop-key CLI flags to encrypt/decrypt

dmihalcik-virtru
and
claude
committed
fix(java-sdk): propagate --dpop flags to subcommand help via ScopeType.INHERIT

dmihalcik-virtru
and
claude
committed
fix(cmdline): replace System.exit in Supports with Callable<Integer>

dmihalcik-virtru
and
claude
committed
test(java-sdk): add TokenSource unit tests and remove unused altindag imports

dmihalcik-virtru
and
claude
committed
docs: DPoP nonce challenge design spec
dmihalcik-virtru
committed
docs: DPoP nonce challenge implementation plan
dmihalcik-virtru
committed
feat(sdk): retry token request with nonce on use_dpop_nonce (RFC 9449 §8)
dmihalcik-virtru
committed
fix(sdk): address DPoP nonce retry quality issues
dmihalcik-virtru
committed
feat(cmdline): declare dpop_nonce_challenge support
dmihalcik-virtru
committed
fix(sdk): harden DPoP retry interceptor
dmihalcik-virtru
committed
fix(sdk): tighten TokenSource error handling and JWK validation
dmihalcik-virtru
committed
fix(cmdline): restore fast-fail validation for credential options
dmihalcik-virtru
committed
fix(cmdline): print stack trace for failures that escape picocli
dmihalcik-virtru
committed
Add verbose logging and DPoP retry exception logging
dmihalcik-virtru
committed
Fall back to Bearer scheme when AS returns non-DPoP-bound token
dmihalcik-virtru
committed
fix(sdk): strip query and fragment from DPoP htu claim
dmihalcik-virtru
committed
test(sdk): advertise DPoP token_type in SDKBuilder mock IdP
dmihalcik-virtru
committed
docs(sdk): correct RFC 9449 section citations and remove stale plan/spec
dmihalcik-virtru
committed
fix(sdk): fail loudly when DPoP is requested but well-known omits platform_issuer
dmihalcik-virtru
committed
fix(cmdline): validate DPoP key options at parse time + add coverage
dmihalcik-virtru
committed
debug(sdk): add DPoP path/method/claims logging to AuthInterceptor
dmihalcik-virtru
committed
fix(sdk): disable Connect-GET on authenticated client (DPoP htm drift)
dmihalcik-virtru
committed
fix(sdk): log malformed DPoP nonce challenge instead of swallowing 401
dmihalcik-virtru
committed
fix(sdk): drop stale DPoP proof header on Bearer-downgrade retry
dmihalcik-virtru
committed
fix(sdk): read token and scheme atomically to close a data race
dmihalcik-virtru
committed
fix(sdk): reject public-only DPoP JWK in central validation
dmihalcik-virtru
committed
refactor(cmdline): validate DpopMaterial in its constructor
dmihalcik-virtru
committed
docs(sdk): correct getAuthHeaders Javadoc for Bearer fallback
dmihalcik-virtru
committed
test(sdk): assert DPoP proof htm claim reflects request method
dmihalcik-virtru
committed
test(sdk): cover AuthInterceptor connect-kotlin request/response path
dmihalcik-virtru
committed
refactor(sdk): model token scheme as an enum, make AuthHeaders static
dmihalcik-virtru
committed
docs(sdk): clarify retry-once semantics and trim redundant helper Javadoc
dmihalcik-virtru
committed

Commits on Jul 2, 2026