feat: DPoP (RFC 9449) + dynamic client registration (RFC 7591/7592) - #152

Merged

rsharath merged 14 commits into

mainfrom

feat/dpop-and-dcr

May 19, 2026

Commits on May 18, 2026

feat: DPoP (RFC 9449) + dynamic client registration (RFC 7591/7592)
rsharath
committed
aad90cd
feat: integration tests for DPoP + DCR
rsharath
committed
734a4c3
docs: surface DPoP + DCR in README and OpenAPI
rsharath
committed
7fd2db5
fix: security review on DPoP + DCR — audience binding, request-derived htu, JTI clock-relative expiry, no token-exchange via DCR
rsharath
committed
041ba7c
fix: code review on DPoP + DCR — block cnf injection, DRY DCR validation, fix DPoP test htu
rsharath
committed
e3d4e38
fix: copilot review comments on PR #152
rsharath
committed
5a6f2c1
fix: renumber DPoP + DCR migrations after PR #150 took slot 023
rsharath
committed
5aa47b9
docs: deep-dive reference for DPoP + DCR, README patterns and architecture updates
rsharath
committed
3c57b5f
fix: PR review — DCR insert blocker, DPoP refresh-binding, smaller cleanups
rsharath
committed
a8fe4ff
fix: gofmt — align Tags field in dcrDeleteOp route
rsharath
committed
e194d56
fix: Copilot review round 3 — multi-sig JWS, doc/code drift, UpdateDynamicClient error semantics
rsharath
committed
afb9ecc
test: RFC compliance suites for DPoP + DCR + cross-feature tests
rsharath
committed
5a4a443
fix: Copilot round 4 — RedirectURIs doc, token_exchange test actually exercises the hop
rsharath
committed
24e95ad
fix: detailed self-review — H1/H2/H3 correctness + M1-M5 + L1-L5 cleanups
rsharath
committed
2a2d6ec