server/dpop: emit RejectsBearerScheme as its own check id

SEP-1932 now requires rejecting a DPoP-bound token presented as Bearer, and the traceability row sep-1932-server-reject-bearer-downgrade names that requirement. The result path and the probe-error path both use that id.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: nbarbettini

src/scenarios/server/auth/dpop.test.ts

@@ -244,10 +244,16 @@ describe('DPoP server validation scenario', () => {
       )
     ).toBe(true);
     expect(
-      byId(checks, 'sep-1932-server-validate-proof').find(
+      byId(checks, 'sep-1932-server-validate-proof').some(
         (c) => c.name === 'RejectsBearerScheme'
-      )?.status
-    ).toBe('SUCCESS');
+      )
+    ).toBe(false);
+    expect(
+      byId(checks, 'sep-1932-server-reject-bearer-downgrade').map((c) => [
+        c.name,
+        c.status
+      ])
+    ).toEqual([['RejectsBearerScheme', 'SUCCESS']]);
     expect(
       byId(checks, 'sep-1932-server-iat-window').every(
         (c) => c.status === 'SUCCESS'
@@ -282,6 +288,12 @@ describe('DPoP server validation scenario', () => {
     );
     expect(rejects.length).toBeGreaterThan(0);
     expect(rejects.every((c) => c.status === 'FAILURE')).toBe(true);
+    expect(
+      byId(checks, 'sep-1932-server-reject-bearer-downgrade').map((c) => [
+        c.name,
+        c.status
+      ])
+    ).toEqual([['RejectsBearerScheme', 'FAILURE']]);
 
     expect(byId(checks, 'sep-1932-server-reject-401')[0].status).toBe(
       'FAILURE'
@@ -319,6 +331,7 @@ describe('DPoP server validation scenario', () => {
       ...byId(checks, 'sep-1932-server-validate-proof').filter((c) =>
         c.name.startsWith('Rejects')
       ),
+      ...byId(checks, 'sep-1932-server-reject-bearer-downgrade'),
       ...byId(checks, 'sep-1932-server-iat-window'),
       ...byId(checks, 'sep-1932-asymmetric-alg-only'),
       ...byId(checks, 'sep-1932-server-audience-validation'),
@@ -365,6 +378,7 @@ describe('DPoP server validation scenario', () => {
       ...byId(checks, 'sep-1932-server-validate-proof').filter((c) =>
         c.name.startsWith('Rejects')
       ),
+      ...byId(checks, 'sep-1932-server-reject-bearer-downgrade'),
       ...byId(checks, 'sep-1932-server-iat-window'),
       ...byId(checks, 'sep-1932-asymmetric-alg-only'),
       ...byId(checks, 'sep-1932-server-audience-validation'),
@@ -402,16 +416,14 @@ describe('DPoP server validation scenario', () => {
       testContext(url(ports.bearerReject))
     );
 
-    const bearer = byId(checks, 'sep-1932-server-validate-proof').find(
-      (c) => c.name === 'RejectsBearerScheme'
-    );
-    expect(bearer?.status).toBe('FAILURE');
+    const bearer = byId(checks, 'sep-1932-server-reject-bearer-downgrade');
+    expect(bearer.map((c) => [c.name, c.status])).toEqual([
+      ['RejectsBearerScheme', 'FAILURE']
+    ]);
 
-    // This fixture only mishandles Bearer-scheme presentation — every other
+    // This fixture only mishandles Bearer-scheme presentation — every
     // validate-proof probe still behaves as on the compliant server.
-    const others = byId(checks, 'sep-1932-server-validate-proof').filter(
-      (c) => c.name !== 'RejectsBearerScheme'
-    );
+    const others = byId(checks, 'sep-1932-server-validate-proof');
     expect(others.length).toBeGreaterThan(0);
     expect(others.every((c) => c.status === 'SUCCESS')).toBe(true);
   }, 30000);
@@ -421,19 +433,17 @@ describe('DPoP server validation scenario', () => {
       testContext(url(ports.bearerChallenge))
     );
 
-    const bearer = byId(checks, 'sep-1932-server-validate-proof').find(
-      (c) => c.name === 'RejectsBearerScheme'
-    );
-    expect(bearer?.status).toBe('SUCCESS');
+    const bearer = byId(checks, 'sep-1932-server-reject-bearer-downgrade');
+    expect(bearer.map((c) => [c.name, c.status])).toEqual([
+      ['RejectsBearerScheme', 'SUCCESS']
+    ]);
     // The compliant server challenges with DPoP. This fixture must actually
     // send a Bearer challenge, or SUCCESS would only re-prove the DPoP arm.
-    expect(bearer?.details?.wwwAuthenticate).toBe(
+    expect(bearer[0]?.details?.wwwAuthenticate).toBe(
       'Bearer error="invalid_token"'
     );
 
-    const others = byId(checks, 'sep-1932-server-validate-proof').filter(
-      (c) => c.name !== 'RejectsBearerScheme'
-    );
+    const others = byId(checks, 'sep-1932-server-validate-proof');
     expect(others.length).toBeGreaterThan(0);
     expect(others.every((c) => c.status === 'SUCCESS')).toBe(true);
   }, 30000);

src/scenarios/server/auth/dpop.ts

@@ -414,6 +414,10 @@ algorithms, the 401 challenge format, token audience validation under DPoP, and
       buildDpop: () => Promise<string | string[]>;
       predicate?: (res: Response) => boolean;
       description?: string;
+      // Defaults to sep-1932-server-validate-proof. A case whose requirement
+      // is a separate yaml row sets its own id; the catch path uses the same
+      // id so a probe that throws is still attributed to that requirement.
+      id?: string;
     }> = [
       {
         case: 'tampered-signature',
@@ -505,12 +509,13 @@ algorithms, the 401 challenge format, token audience validation under DPoP, and
           })
       },
       {
-        // A DPoP-bound token presented under the Bearer scheme MUST NOT be
-        // accepted. Count only a real authentication rejection: 401 plus a
-        // Bearer (RFC 6750 §3) or DPoP challenge. A 500/404 with no
-        // WWW-Authenticate is not a rejection of the scheme.
+        // Not an RFC 9449 §4.3 step. SEP-1932 requires rejecting a DPoP-bound
+        // token presented as Bearer with 401 plus a Bearer (RFC 6750 §3) or
+        // DPoP challenge. A 500/404 with no WWW-Authenticate is not that
+        // rejection. Own check id: sep-1932-server-reject-bearer-downgrade.
         case: 'bearer-scheme',
         name: 'RejectsBearerScheme',
+        id: 'sep-1932-server-reject-bearer-downgrade',
         authz: `Bearer ${token}`,
         buildDpop: () => validProof(),
         predicate: bearerSchemeRejected,
@@ -595,13 +600,14 @@ algorithms, the 401 challenge format, token audience validation under DPoP, and
     for (const n of negatives) {
       const description =
         n.description ?? `Server rejects a DPoP request with defect: ${n.case}`;
+      const id = n.id ?? 'sep-1932-server-validate-proof';
       try {
         const dpop = await n.buildDpop();
         const res = await send(n.authz, dpop);
         checks.push(
           rejectionCheck(
             positiveAccepted,
-            'sep-1932-server-validate-proof',
+            id,
             n.name,
             description,
             res,
@@ -611,14 +617,7 @@ algorithms, the 401 challenge format, token audience validation under DPoP, and
         );
       } catch (e) {
         checks.push(
-          probeErrorCheck(
-            positiveAccepted,
-            'sep-1932-server-validate-proof',
-            n.name,
-            description,
-            n.case,
-            e
-          )
+          probeErrorCheck(positiveAccepted, id, n.name, description, n.case, e)
         );
       }
     }