feat(sdk): DSPX-3848 add DPoP client support with HTTP RoundTripper by dmihalcik-virtru · Pull Request #3581 · opentdf/platform

dmihalcik-virtru · 2026-06-08T15:23:42Z

Summary

Adds RFC 9449 DPoP (Demonstrating Proof-of-Possession) support to the Go SDK, so HTTP/ConnectRPC calls carry a DPoP proof and can use sender-constrained tokens. Part of the Keycloak v26 / DPoP effort tracked in DSPX-62.

What changed

SDK

New DPoPTransport (http.RoundTripper) that adds a DPoP proof to every request — token endpoint and resource calls alike. Composes with any http.Client.
Handles the DPoP-Nonce challenge (RFC 9449 §8): on a 401 carrying a nonce, cache it, re-sign, and retry once; refresh the cached nonce from 2xx responses. Nonce cache is per-origin and thread-safe.
RFC 9449 URI normalization for htu (lowercase scheme/host, strip default ports, drop query/fragment, preserve escaped path bytes).
Key resolution via WithDPoPKeyPEM / WithDPoPAlgorithm / JWK; defaults to an ephemeral EC P-256 (ES256) key when none is supplied.
SupportedFeatures() reports ["dpop", "dpop_nonce_challenge", "connectrpc"] so the xtest harness can probe capabilities.

otdfctl

DPoP is negotiated automatically for authenticated calls — no flags.
Credential validation runs through the DPoP-bound path; the printed/reusable token stays a plain bearer so it works outside otdfctl (DSPX-3998).
--version --json now includes supported_features.

service

Host-header origin normalization for DPoP htu validation.

Testing

go test ./... and cd sdk && go test -run TestREADMECodeBlocks pass; lint clean.
Cross-SDK e2e (go/java/web) via opentdf/tests xtest: 🟢 https://github.com/opentdf/tests/actions/runs/29624686479

Jira: DSPX-3397

coderabbitai · 2026-06-08T15:23:52Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds DPoP configuration, transport, and SDK/client wiring for token-bound requests, plus CLI flag plumbing and host-origin normalization in service auth.

Changes

DPoP Support

Layer / File(s)	Summary
SDK config and key resolution `sdk/options.go`, `sdk/version.go`, `sdk/dpop_key.go`, `sdk/dpop_key_test.go`	Adds DPoP option constructors and config fields, reports supported features, and implements key generation, PEM loading, algorithm validation, key resolution, and tests.
JWK-based token sources `sdk/idp_access_token_source.go`, `sdk/idp_cert_exchange.go`, `sdk/idp_oauth_access_token_source.go`, `sdk/idp_token_exchange_token_source.go`	Adds constructors that build token sources from pre-resolved DPoP JWK keys.
DPoP HTTP transport `sdk/auth/dpop_transport.go`, `sdk/auth/dpop_transport_test.go`, `sdk/dpop_validation_client_test.go`	Adds the DPoP transport, proof generation, nonce retry and body replay handling, client wrapping, and transport tests.
SDK DPoP wiring `sdk/sdk.go`	Wraps SDK HTTP clients with the DPoP transport and routes token-source construction through JWK-based builders when needed.
Handler option plumbing `otdfctl/pkg/handlers/sdk.go`, `otdfctl/cmd/common/common.go`, `otdfctl/pkg/auth/auth.go`	Exports handler option functions, threads extra SDK options into auth validation, and updates handler/auth client construction to accept the new option path.
CLI flags and docs `otdfctl/cmd/tdf/encrypt.go`, `otdfctl/cmd/tdf/decrypt.go`, `otdfctl/cmd/tdf/dpop.go`, `otdfctl/docs/man/...`, `AGENTS.md`	Adds DPoP CLI flag parsing, passes the resulting SDK options into handler creation, updates the command manuals, and adds xtest branch-running instructions.
Host origin normalization `service/internal/auth/authn.go`, `service/internal/auth/authn_test.go`	Adds normalized origin construction from Host headers and updates DPoP origin handling in the HTTP mux, with matching tests.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related issues

DPoP htu validation fails when client sends full URL per RFC 9449 #3216: The changes add DPoP transport and URI/origin normalization that align with the issue’s htu validation and format handling.

Possibly related PRs

opentdf/platform#3479: Also changes DPoP handling in service/internal/auth/authn.go, including validation-related origin and htu paths.

Suggested labels: comp:middleware:auth, docs

Suggested reviewers: elizabethhealy, jakedoublev, alkalescent

Poem

I packed up the proof in a carrot-lit jar,
Hopped through the nonce trail, near and far.
--dpop now sings with a tidy new tune,
And hosts line up under the moon.
🐇

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 54.22% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: adding DPoP client support with an HTTP RoundTripper.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch DSPX-3397-platform-go-sdk

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist · 2026-06-08T15:23:53Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request implements RFC 9449 DPoP (Demonstrating Proof-of-Possession) client support for the OpenTDF Go SDK. By introducing a custom HTTP RoundTripper, the SDK can now generate and attach DPoP proofs to HTTP requests, handle server-side nonce challenges, and perform URI normalization. This work is a key component of the broader Keycloak v26 upgrade, ensuring secure, proof-of-possession-based authentication for HTTP-based interactions within the platform.

Highlights

DPoP Transport Implementation: Introduced DPoPTransport, a new http.RoundTripper implementation that adds RFC 9449 DPoP proof tokens to HTTP requests, including support for server-issued nonce challenges and automatic retries.
SDK Integration: Updated the SDK to automatically wrap HTTP clients with DPoP support during construction, ensuring that resource requests are properly signed with DPoP proofs.
Feature Detection: Added a SupportedFeatures() function to sdk/version.go to allow integration harnesses to programmatically detect DPoP capability.
Testing: Added comprehensive unit tests for DPoP proof generation, nonce challenge flows, and URI normalization to ensure RFC 9449 compliance.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

The proof is shown in token light, With DPoP we do it right. No replay here, the nonce is set, A secure path for the internet.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces RFC 9449 DPoP (Demonstrating Proof-of-Possession) support to the SDK by adding a new DPoPTransport and integrating it into the client setup. The code review identified several critical and high-severity issues in the transport implementation, including a potential bug where request bodies are consumed and not reset on retry, concurrency data races on shared fields like t.Base and t.nonceCache, and the bypass of custom transport configurations when retrieving access tokens. Additionally, optimizations were suggested to cache parsed token endpoint URLs and normalize URL origins to lowercase to prevent cache misses.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

github-actions · 2026-06-08T15:29:43Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	203.008006ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	103.232466ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	423.703616ms
Throughput	236.01 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	50.220444104s
Average Latency	497.588923ms
Throughput	99.56 requests/second

github-actions · 2026-06-08T15:37:38Z

X-Test Results

✅ go@main-pull-3581
✅ go@main-v0.9.0
✅ java@main-pull-3581
✅ java@main-v0.9.0
✅ js@main-v0.9.0
✅ js@main-pull-3581
cukes-report
opentdf~~platform~~TZPEO0.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-0
govulncheck-failure-5
govulncheck-failure-2

github-actions · 2026-06-09T18:01:54Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	270.01327ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	144.386555ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	443.855047ms
Throughput	225.30 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.03497246s
Average Latency	487.426932ms
Throughput	101.97 requests/second

github-actions · 2026-06-09T18:07:57Z

X-Test Failure Report

✅ go@main-pull-3581
✅ java@main-pull-3581
✅ js@main-pull-3581
cukes-report
opentdf~~platform~~LDRYME.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-2
govulncheck-failure-0

github-actions · 2026-06-10T12:32:46Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	183.335287ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	101.378765ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	435.240452ms
Throughput	229.76 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	50.575675367s
Average Latency	503.106935ms
Throughput	98.86 requests/second

github-actions · 2026-06-10T12:33:57Z

X-Test Failure Report

opentdf~~platform~~BA9O94.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-2
govulncheck-failure-0
govulncheck-failure-5

github-actions · 2026-06-10T12:37:51Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	173.859448ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	89.451113ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	443.962682ms
Throughput	225.24 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.774071866s
Average Latency	493.399511ms
Throughput	100.45 requests/second

github-actions · 2026-06-10T12:46:18Z

X-Test Failure Report

✅ go@main-pull-3581
✅ go@main-v0.9.0
✅ java@main-v0.9.0
✅ js@main-pull-3581
✅ js@main-v0.9.0
cukes-report
opentdf~~platform~~XGUH6E.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-0
govulncheck-failure-5
govulncheck-failure-2

github-actions · 2026-06-11T17:53:26Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	189.365241ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	92.807389ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	458.733975ms
Throughput	217.99 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	50.627558901s
Average Latency	502.758805ms
Throughput	98.76 requests/second

github-actions · 2026-06-11T18:01:29Z

X-Test Results

✅ go@main-pull-3581
✅ go@main-v0.9.0
✅ java@main-pull-3581
✅ java@main-v0.9.0
✅ js@main-pull-3581
✅ js@main-v0.9.0
cukes-report
opentdf~~platform~~4GMIHC.dockerbuild
govulncheck-failure-0
govulncheck-failure-1
govulncheck-failure-2
govulncheck-failure-5

github-actions · 2026-06-15T18:28:46Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	174.336781ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	87.925096ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	451.175969ms
Throughput	221.64 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.075520706s
Average Latency	488.0126ms
Throughput	101.88 requests/second

github-actions · 2026-06-15T18:37:21Z

X-Test Results

✅ go@main-pull-3581
✅ go@main-v0.9.0
✅ java@main-pull-3581
✅ java@main-v0.9.0
✅ js@main-pull-3581
✅ js@main-v0.9.0
cukes-report
opentdf~~platform~~2MTSLI.dockerbuild
govulncheck-failure-3
govulncheck-failure-5
govulncheck-failure-0
govulncheck-failure-8
govulncheck-failure-1
govulncheck-failure-2

github-actions · 2026-06-16T18:40:33Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	190.019238ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.783852ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	436.996106ms
Throughput	228.83 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	50.277491194s
Average Latency	498.407616ms
Throughput	99.45 requests/second

github-actions · 2026-06-16T18:48:31Z

X-Test Results

✅ go@main-pull-3581
✅ go@main-v0.9.0
✅ java@main-pull-3581
✅ java@main-v0.9.0
✅ js@main-pull-3581
✅ js@main-v0.9.0
cukes-report
opentdf~~platform~~05V90A.dockerbuild
govulncheck-failure-5
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-0
govulncheck-failure-2

github-actions · 2026-06-18T13:12:58Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	175.765414ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	93.303736ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	446.045553ms
Throughput	224.19 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.725004344s
Average Latency	495.004232ms
Throughput	100.55 requests/second

github-actions · 2026-06-18T13:21:12Z

X-Test Results

✅ go@main-pull-3581
✅ go@main-v0.9.0
✅ java@main-pull-3581
✅ java@main-v0.9.0
✅ js@main-pull-3581
✅ js@main-v0.9.0
cukes-report
opentdf~~platform~~PAKW0F.dockerbuild
govulncheck-failure-0
govulncheck-failure-2
govulncheck-failure-3
govulncheck-failure-5
govulncheck-failure-1
govulncheck-failure-8

github-actions · 2026-06-18T16:09:45Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	193.716094ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.047078ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	418.095248ms
Throughput	239.18 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	50.244870901s
Average Latency	499.255302ms
Throughput	99.51 requests/second

github-actions · 2026-06-18T16:17:47Z

X-Test Results

✅ go@main-pull-3581
✅ go@main-v0.9.0
✅ java@main-pull-3581
✅ js@main-pull-3581
✅ java@main-v0.9.0
✅ js@main-v0.9.0
govulncheck-failure-0
opentdf~~platform~~0RV3K7.dockerbuild
govulncheck-failure-8
govulncheck-failure-5
govulncheck-failure-1
govulncheck-failure-3
govulncheck-failure-2

github-actions · 2026-06-18T16:49:21Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	181.707776ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.144481ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	676.855143ms
Throughput	147.74 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	51.8725193s
Average Latency	515.398407ms
Throughput	96.39 requests/second

github-actions · 2026-07-28T18:32:25Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	164.458713ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	90.039029ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	394.423078ms
Throughput	253.53 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.762555936s
Average Latency	406.806908ms
Throughput	122.66 requests/second

github-actions · 2026-07-28T18:57:25Z

Follow-up to review on #3581: - document that DPoPTransport.TokenEndpoint must not be mutated after first use (the parsed URL is cached) - exercise both RSA and ES256 in the primary DPoP transport tests; generateTestKey now returns the production-default ES256/P-256 key - document the SupportedFeatures stability contract for the xtest harness - use strings.Builder in removeDotSegments to avoid O(n^2) accumulation Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

github-actions · 2026-07-31T13:28:40Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	225.322384ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	113.101141ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	447.821934ms
Throughput	223.30 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.517020711s
Average Latency	444.50134ms
Throughput	112.32 requests/second

github-actions · 2026-07-31T13:36:18Z

Adds Demonstrating Proof-of-Possession (DPoP) support to the Go SDK and platform auth: - SDK DPoP client via an HTTP RoundTripper, with nonce-400 retry and request-body buffering for replay - SigningAlgorithm type and WithDPoPAlgorithm option; centralized DPoP algorithm validation and single-owner headers - Robust DPoP origin/HTU normalization (IPv6 literals, default ports) - Move DPoP enforcement into dpop.enforce service config - Expose supported features via `otdfctl --version --json`

Follow-up to review on #3581: - document that DPoPTransport.TokenEndpoint must not be mutated after first use (the parsed URL is cached) - exercise both RSA and ES256 in the primary DPoP transport tests; generateTestKey now returns the production-default ES256/P-256 key - document the SupportedFeatures stability contract for the xtest harness - use strings.Builder in removeDotSegments to avoid O(n^2) accumulation Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

github-actions · 2026-07-31T21:12:30Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	195.772946ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	104.452637ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	435.688814ms
Throughput	229.52 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.734360558s
Average Latency	436.188331ms
Throughput	114.33 requests/second

github-actions · 2026-07-31T21:21:06Z

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 1 comment.

Follow-up to review on #3581: - honor the token source's declared scheme in DPoPTransport: a bearer token source (AccessTokenCredentialSource reporting a non-DPoP scheme) now gets Authorization: Bearer with no proof, matching the credential interceptor instead of forcing every resource request onto DPoP - document that DPoPTransport.TokenEndpoint must not be mutated after first use (the parsed URL is cached) - exercise both RSA and ES256 in the primary DPoP transport tests; generateTestKey now returns the production-default ES256/P-256 key - document the SupportedFeatures stability contract for the xtest harness - use strings.Builder in removeDotSegments to avoid O(n^2) accumulation Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

github-actions · 2026-08-03T17:03:02Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	185.553596ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	116.404372ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	426.893072ms
Throughput	234.25 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.338670465s
Average Latency	412.427707ms
Throughput	120.95 requests/second

github-actions · 2026-08-03T17:05:00Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-08-03T17:12:27Z

github-actions Bot added comp:sdk A software development kit, including library, for client applications and inter-service communicati size/m labels Jun 8, 2026

gemini-code-assist Bot reviewed Jun 8, 2026

View reviewed changes

dmihalcik-virtru mentioned this pull request Jun 8, 2026

feat(xtest): Adds dpop verification tests opentdf/tests#485

Closed

dmihalcik-virtru force-pushed the DSPX-3397-platform-go-sdk branch from 441af7b to 61316ef Compare June 10, 2026 12:27

dmihalcik-virtru force-pushed the DSPX-3397-platform-go-sdk branch from ebc3e40 to 37ed377 Compare June 11, 2026 17:47

dmihalcik-virtru force-pushed the DSPX-3397-platform-go-sdk branch from 37ed377 to b9dd8d8 Compare June 15, 2026 18:23

dmihalcik-virtru mentioned this pull request Jun 15, 2026

feat(core): Adds comprehensive DPoP (RFC 9449) support #3582

Merged

dmihalcik-virtru force-pushed the DSPX-3397-platform-go-sdk branch from 5c4f57a to 4cec258 Compare June 18, 2026 13:08

dmihalcik-virtru changed the title ~~feat(sdk): add DPoP client support with HTTP RoundTripper (DSPX-3397)~~ feat(sdk): add DPoP client support with HTTP RoundTripper (DSPX-3848) Jul 28, 2026

dmihalcik-virtru commented Jul 28, 2026

View reviewed changes

Comment thread otdfctl/pkg/auth/auth.go Outdated

dmihalcik-virtru force-pushed the DSPX-3397-platform-go-sdk branch from 7f26f61 to 6413b45 Compare July 28, 2026 18:26

dmihalcik-virtru requested a review from sujankota July 29, 2026 18:22

sujankota reviewed Jul 29, 2026

View reviewed changes

Comment thread sdk/auth/dpop_transport.go

sujankota reviewed Jul 29, 2026

View reviewed changes

Comment thread sdk/auth/dpop_transport_test.go

sujankota reviewed Jul 29, 2026

View reviewed changes

Comment thread sdk/version.go

sujankota reviewed Jul 29, 2026

View reviewed changes

Comment thread service/internal/auth/authn.go

sujankota reviewed Jul 29, 2026

View reviewed changes

Comment thread service/internal/auth/dpop_uri.go

dmihalcik-virtru force-pushed the DSPX-3397-platform-go-sdk branch from 6413b45 to dc8cc81 Compare July 31, 2026 13:22

dmihalcik-virtru force-pushed the DSPX-3397-platform-go-sdk branch from dc8cc81 to b38bd4a Compare July 31, 2026 21:07

dmihalcik-virtru changed the title ~~feat(sdk): add DPoP client support with HTTP RoundTripper (DSPX-3848)~~ feat(sdk): DSPX-3848 add DPoP client support with HTTP RoundTripper Jul 31, 2026

dmihalcik-virtru requested review from Copilot and sujankota July 31, 2026 22:34

Copilot started reviewing on behalf of dmihalcik-virtru August 3, 2026 16:24 View session

Copilot AI reviewed Aug 3, 2026

View reviewed changes

Comment thread sdk/auth/dpop_transport.go Outdated

dmihalcik-virtru force-pushed the DSPX-3397-platform-go-sdk branch from b38bd4a to ecee503 Compare August 3, 2026 16:57

Uh oh!

Conversation

dmihalcik-virtru commented Jun 8, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Testing

Uh oh!

coderabbitai Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

gemini-code-assist Bot commented Jun 8, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 8, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jun 8, 2026

X-Test Results

Uh oh!

github-actions Bot commented Jun 9, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jun 9, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Jun 10, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jun 10, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Jun 10, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jun 10, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Jun 11, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

dmihalcik-virtru commented Jun 8, 2026 •

edited by atlassian Bot

Loading

coderabbitai Bot commented Jun 8, 2026 •

edited

Loading