Repository navigation
Conversation
gtema
commented
Oct 22, 2026
gtema
commented
Collaborator
- feat(oauth2): Add effective DPoP mode
- feat(oauth2): Bind client credentials to DPoP key
- feat(oauth2): Bind authorization code to DPoP key
- feat(oauth2): Bind device code grant to DPoP key
- feat(oauth2): Bind refresh tokens to DPoP key
- feat(oauth2): Bind token exchange to DPoP key
Resolve the DPoP mode of a request as the strictest of the global, domain and client levels, as described in ADR 0043 section 1. The client flag means required, and the global value is a floor for the domain setting. Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
Add the shared DPoP handling of the token endpoint: replay cache and nonce generator on the service state, the proof header checks with rate limiting, nonce challenge and error codes, and wire it into the client_credentials grant, which now returns token_type DPoP and a cnf claim when a proof is accepted (ADR 0043 section 3). Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
Accept dpop_jkt on /authorize and keep it on the pre-auth session and the authorization code. The authorization_code grant validates the proof before it redeems the code, requires the code's key when one was announced, and issues a DPoP-typed access token with a cnf claim and a refresh token family bound to the same key (ADR 0043 section 3). Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
Validate the DPoP proof of every device code poll before the grant is fetched, require the key stored with the grant when there is one, and issue a DPoP-typed access token with a cnf claim and a bound refresh token family (ADR 0043 section 3). Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
Require a proof from the family key on every refresh of a bound family and revoke the family when a valid proof from another key is presented, as for a detected reuse. A missing, stale or replayed proof is only a bad request and never ends a session (ADR 0043 section 3.3). Rotated access tokens carry the cnf claim. Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
Check the proof of a token exchange before the subject token and bind the exchanged token to its key, rejecting the request when the effective mode is required and no proof is sent. A subject token that carries a cnf claim is refused rather than exchanged for an unbound token (ADR 0043 section 4). Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
gtema
enabled auto-merge
October 22, 2026 16:23
|
Bencher Report| Project | keystone |
| Branch | dpop |
| Testbed | ubuntu-latest |
🚨 3 Alerts
| Benchmark | Measure Units | View | Benchmark Result (Result Δ%) | Upper Boundary (Limit %) |
|---|---|---|---|---|
| Command_Serde/unpack/delete | Latency nanoseconds (ns) | 📈 plot 🚷 threshold 🚨 alert (🔔) | 218.11 ns(+51.72%)Baseline: 143.76 ns | 215.92 ns (101.02%) |
| Command_Serde/unpack/set_index | Latency nanoseconds (ns) | 📈 plot 🚷 threshold 🚨 alert (🔔) | 188.93 ns(+55.93%)Baseline: 121.17 ns | 179.39 ns (105.32%) |
| get_db | Latency nanoseconds (ns) | 📈 plot 🚷 threshold 🚨 alert (🔔) | 0.40 ns(+34.93%)Baseline: 0.29 ns | 0.38 ns (104.98%) |
Click to view all benchmark results
| Benchmark | Latency | Benchmark Result nanoseconds (ns) (Result Δ%) | Upper Boundary nanoseconds (ns) (Limit %) |
|---|---|---|---|
| Command_Serde/apply/remove | 📈 view plot 🚷 view threshold | 84,236.00 ns(-39.36%)Baseline: 138,920.41 ns | 263,914.11 ns (31.92%) |
| Command_Serde/apply/set | 📈 view plot 🚷 view threshold | 91,185.00 ns(-36.57%)Baseline: 143,767.73 ns | 248,736.11 ns (36.66%) |
| Command_Serde/pack/delete | 📈 view plot 🚷 view threshold | 142.00 ns(+23.86%)Baseline: 114.65 ns | 164.29 ns (86.43%) |
| Command_Serde/pack/delete_index | 📈 view plot 🚷 view threshold | 121.74 ns(+18.13%)Baseline: 103.05 ns | 144.10 ns (84.48%) |
| Command_Serde/pack/set | 📈 view plot 🚷 view threshold | 244.02 ns(+31.06%)Baseline: 186.20 ns | 271.28 ns (89.95%) |
| Command_Serde/pack/set_index | 📈 view plot 🚷 view threshold | 121.93 ns(+17.83%)Baseline: 103.48 ns | 146.33 ns (83.33%) |
| Command_Serde/unpack/delete | 📈 view plot 🚷 view threshold 🚨 view alert (🔔) | 218.11 ns(+51.72%)Baseline: 143.76 ns | 215.92 ns (101.02%) |
| Command_Serde/unpack/delete_index | 📈 view plot 🚷 view threshold | 178.26 ns(+46.69%)Baseline: 121.53 ns | 181.16 ns (98.40%) |
| Command_Serde/unpack/set | 📈 view plot 🚷 view threshold | 296.92 ns(+33.53%)Baseline: 222.36 ns | 341.91 ns (86.84%) |
| Command_Serde/unpack/set_index | 📈 view plot 🚷 view threshold 🚨 view alert (🔔) | 188.93 ns(+55.93%)Baseline: 121.17 ns | 179.39 ns (105.32%) |
| Payload_encryption/pack/remove_cmd | 📈 view plot 🚷 view threshold | 144.17 ns(+35.68%)Baseline: 106.25 ns | 158.58 ns (90.91%) |
| Payload_encryption/pack/set_cmd | 📈 view plot 🚷 view threshold | 269.20 ns(+40.28%)Baseline: 191.90 ns | 292.52 ns (92.03%) |
| Payload_encryption/unpack/remove_cmd | 📈 view plot 🚷 view threshold | 212.51 ns(+45.63%)Baseline: 145.93 ns | 217.43 ns (97.74%) |
| Payload_encryption/unpack/set_cmd | 📈 view plot 🚷 view threshold | 290.10 ns(+27.84%)Baseline: 226.93 ns | 348.96 ns (83.13%) |
| Raft_1Node_Latency/prefix/1node | 📈 view plot 🚷 view threshold | 5,008,800.00 ns(+39.00%)Baseline: 3,603,328.28 ns | 8,713,442.50 ns (57.48%) |
| Raft_1Node_Latency/read/1node | 📈 view plot 🚷 view threshold | 34,923.00 ns(+2.05%)Baseline: 34,222.53 ns | 52,430.36 ns (66.61%) |
| Raft_1Node_Latency/remove/1node | 📈 view plot 🚷 view threshold | 254,330.00 ns(-28.99%)Baseline: 358,162.03 ns | 601,466.39 ns (42.28%) |
| Raft_1Node_Latency/write/1node | 📈 view plot 🚷 view threshold | 285,910.00 ns(-27.37%)Baseline: 393,651.41 ns | 773,437.05 ns (36.97%) |
| build_snapshot/default | 📈 view plot 🚷 view threshold | 2,174.50 ns(+4.68%)Baseline: 2,077.34 ns | 2,810.68 ns (77.37%) |
| fernet token/project | 📈 view plot 🚷 view threshold | 1,703.40 ns(+35.06%)Baseline: 1,261.23 ns | 1,743.97 ns (97.67%) |
| get_data_keyspace | 📈 view plot 🚷 view threshold | 0.36 ns(+22.86%)Baseline: 0.29 ns | 0.38 ns (95.33%) |
| get_db | 📈 view plot 🚷 view threshold 🚨 view alert (🔔) | 0.40 ns(+34.93%)Baseline: 0.29 ns | 0.38 ns (104.98%) |
| get_fernet_token_timestamp/project | 📈 view plot 🚷 view threshold | 180.71 ns(+37.90%)Baseline: 131.04 ns | 183.36 ns (98.56%) |
| get_keyspace | 📈 view plot 🚷 view threshold | 4.55 ns(-32.91%)Baseline: 6.78 ns | 15.89 ns (28.62%) |
|
🧪 Tempest Identity Compatibility Results (advisory, non-blocking) rust Failed test IDs |
|
🦢 Load Test Results Goose Attack ReportPlan Overview
Request Metrics
Response Time Metrics
Status Code Metrics
Transaction Metrics
Scenario Metrics
Error Metrics
|
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.