feat(core): Adds comprehensive DPoP (RFC 9449) support#3582

Open

dmihalcik-virtru wants to merge 15 commits into

mainfrom

DSPX-3397-platform-service

Commits on Jun 18, 2026

feat(platform): add comprehensive DPoP (RFC 9449) support (DSPX-3397)

dmihalcik-virtru
and
claude
committed
feat(platform): add DPoP well-known fields, opentdf-dpop KC client, nonce action input, and KC26 bump (DSPX-3397)

dmihalcik-virtru
and
claude
committed
fix(platform): well-known []string→[]any + KC26 admin-fine-grained-authz

dmihalcik-virtru
and
claude
committed
fix(auth): address DPoP nonce race condition and Connect header propagation

dmihalcik-virtru
and
claude
committed
fix(auth): address DPoP PR review findings

dmihalcik-virtru
and
claude
committed
fix(auth): refactor DPoP nonce manager to use atomic.Pointer and fix empty nonce validation

dmihalcik-virtru
and
claude
committed
feat(auth): warn when DPoP-bound token sent under Bearer scheme

dmihalcik-virtru
and
claude
committed
fixup test static analysis fixes
dmihalcik-virtru
committed
fix(auth): use full URL for DPoP htu validation in ConnectRPC interceptor

dmihalcik-virtru
and
claude
committed
feat(auth): add strict_htu flag to DPoP htu validation

dmihalcik-virtru
and
claude
committed
fix(auth): use actual HTTP method for DPoP htm validation in Connect interceptor
dmihalcik-virtru
committed
chore(auth): add debug logs for DPoP htm value
dmihalcik-virtru
committed
fix(kas): return 403 for routine PDP denials in rewrap
dmihalcik-virtru
committed
fixup: context clarifications
dmihalcik-virtru
committed
test: address PR review comments on DPoP HTU determinism and platform-ref
dmihalcik-virtru
committed