authorization-server/dpop: fix null alg-values hole; extract + test

The round-4 non-array guard carved out `null` (advertised !== null), so
metadata with "dpop_signing_alg_values_supported": null passed the support gate
(which only tests === undefined), skipped the guard, and fell through to the
ES256 fallback — the exact binding mis-score the fix targeted.

Extract the negotiation to an exported pure function negotiateProofAlg(advertised)
and treat ANY present-but-non-array shape (string, null, number, object) as
malformed → null (SKIP). Only an empty array still falls back to ES256. Correct
the docstring (an absent field never reaches here — the support gate SKIPs
upstream). Add unit tests for every shape (array / empty / no-overlap / string /
null / number / object), pinning the fix against a silent refactor regression.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: PieterKas

src/scenarios/authorization-server/dpop.test.ts

@@ -6,7 +6,7 @@ import {
 import { ServerLifecycle } from '../client/auth/helpers/serverLifecycle';
 import { testScenarioContext } from '../../mock-server/testing';
 import type { CheckStatus, ConformanceCheck } from '../../types';
-import { DPoPAuthorizationServerScenario } from './dpop';
+import { DPoPAuthorizationServerScenario, negotiateProofAlg } from './dpop';
 
 const ALL_IDS = [
   'sep-1932-as-metadata-alg-values',
@@ -142,3 +142,27 @@ describe('DPoPAuthorizationServerScenario — skip conditions', () => {
     expect(checks.filter((c) => c.status === 'FAILURE')).toHaveLength(0);
   });
 });
+
+describe('negotiateProofAlg (dpop_signing_alg_values_supported shapes)', () => {
+  it('picks the first supported alg from a non-empty array', () => {
+    expect(negotiateProofAlg(['ES256'])).toBe('ES256');
+    expect(negotiateProofAlg(['RS256', 'ES256'])).toBe('RS256');
+  });
+
+  it('returns null for a non-empty array with no supported alg (→ SKIP)', () => {
+    expect(negotiateProofAlg(['ES256K'])).toBeNull();
+  });
+
+  it('falls back to ES256 only for an empty array', () => {
+    expect(negotiateProofAlg([])).toBe('ES256');
+  });
+
+  it('returns null for a present-but-non-array (malformed) value (→ SKIP)', () => {
+    // Regression guard: a string or JSON null must NOT fall through to the
+    // ES256 fallback, which would mis-score token binding.
+    expect(negotiateProofAlg('RS256')).toBeNull();
+    expect(negotiateProofAlg(null)).toBeNull();
+    expect(negotiateProofAlg(42)).toBeNull();
+    expect(negotiateProofAlg({ 0: 'ES256' })).toBeNull();
+  });
+});

src/scenarios/authorization-server/dpop.ts

@@ -94,6 +94,37 @@ const SUPPORTED_PROOF_ALGS = [
   'EdDSA'
 ];
 
+/**
+ * Pick a proof-signing algorithm the harness can produce that the AS also
+ * advertises (RFC 9449 §5.1), given `dpop_signing_alg_values_supported`.
+ *
+ * Returns null (→ the caller SKIPs the binding check) when the value is a
+ * non-empty array with no algorithm we support, OR any present-but-non-array
+ * shape — a string, `null`, number, or object are all malformed metadata, not
+ * "unspecified", so we must not fall back to ES256 (which the AS would reject,
+ * mis-scoring binding). Only an EMPTY array falls back to ES256 as a best-effort
+ * to still exercise the binding (an empty list is itself flagged by the metadata
+ * check). An absent field never reaches here — the scenario's support gate SKIPs
+ * the whole scenario upstream — but is treated as the empty case for safety.
+ */
+export function negotiateProofAlg(
+  advertised: unknown,
+  supported: readonly string[] = SUPPORTED_PROOF_ALGS
+): string | null {
+  // Any present-but-non-array value (string / null / number / object) is
+  // malformed — SKIP rather than fall back to ES256.
+  if (advertised !== undefined && !Array.isArray(advertised)) {
+    return null;
+  }
+  if (Array.isArray(advertised) && advertised.length > 0) {
+    const match = advertised.find(
+      (a) => typeof a === 'string' && supported.includes(a)
+    );
+    return typeof match === 'string' ? match : null;
+  }
+  return 'ES256';
+}
+
 /** Strip query + fragment from a URL for use as an `htu` (RFC 9449 §4.2). */
 function stripUrlQuery(url: string): string {
   try {
@@ -393,34 +424,9 @@ browser login + callback for login-gated servers.`;
     }
   }
 
-  /**
-   * Pick a proof-signing algorithm the harness can produce that the AS also
-   * advertises (RFC 9449 §5.1). Returns null when the AS advertises a non-empty
-   * list with no algorithm we support, OR a present-but-non-array (malformed)
-   * value — the caller then SKIPs rather than sending an unadvertised alg (e.g.
-   * defaulting to ES256) that the AS would legitimately reject and we'd mis-score
-   * as a binding failure. Only an absent or empty list (itself flagged by the
-   * metadata check) falls back to ES256 as a best effort to still exercise the
-   * binding.
-   */
+  /** See the module-level {@link negotiateProofAlg}. */
   private negotiateProofAlg(metadata: Record<string, any>): string | null {
-    const advertised = metadata.dpop_signing_alg_values_supported;
-    // A present-but-non-array value (e.g. the string "RS256") is malformed
-    // metadata, not "unspecified" — SKIP rather than fall back to ES256.
-    if (
-      advertised !== undefined &&
-      advertised !== null &&
-      !Array.isArray(advertised)
-    ) {
-      return null;
-    }
-    if (Array.isArray(advertised) && advertised.length > 0) {
-      const match = advertised.find(
-        (a) => typeof a === 'string' && SUPPORTED_PROOF_ALGS.includes(a)
-      );
-      return typeof match === 'string' ? match : null;
-    }
-    return 'ES256';
+    return negotiateProofAlg(metadata.dpop_signing_alg_values_supported);
   }
 
   /**