feat(cli): accept a DPoP signing key and algorithm (DSPX-3397) - #991
Draft
dmihalcik-virtru wants to merge 1 commit into
Draft
feat(cli): accept a DPoP signing key and algorithm (DSPX-3397)#991dmihalcik-virtru wants to merge 1 commit into
dmihalcik-virtru wants to merge 1 commit into
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
dmihalcik-virtru
force-pushed
the
dspx-3397-4-ci-keycloak-26
branch
from
August 10, 2026 17:47
3ae0223 to
45582fe
Compare
dmihalcik-virtru
force-pushed
the
dspx-3397-5-cli-dpop-keys
branch
from
August 10, 2026 17:47
e6accca to
435b290
Compare
|
X-Test Failure Report |
`--dpop` was a boolean that always generated an ephemeral RSA key, so the CLI could not exercise ECDSA proofs or reuse a key across invocations. Both are needed to test DPoP against a real IdP. - `--dpop[=ALG]` now optionally takes ES256, ES384, ES512 or RS256 and generates an ephemeral key of that type; bare `--dpop` defaults to ES256. - `--dpopKey <file>` loads a PEM private key and infers its algorithm. Combined with an explicit `--dpop=ALG`, the key is checked against the requested alg so a mismatch fails with a clear message instead of an opaque WebCrypto error at signing time. - `supports <feature>` reports whether this build implements a feature (currently just `dpop`), exiting non-zero when it does not. Cross-SDK test harnesses use this to skip cases a given SDK build cannot run, rather than hard-coding version checks. Replaces the `console.assert` calls in argument validation with thrown CLIErrors. `console.assert` only prints -- it does not halt -- so invalid input was being logged and then used anyway. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>
dmihalcik-virtru
force-pushed
the
dspx-3397-5-cli-dpop-keys
branch
from
August 11, 2026 17:54
435b290 to
e307560
Compare
dmihalcik-virtru
force-pushed
the
dspx-3397-4-ci-keycloak-26
branch
from
August 11, 2026 17:54
45582fe to
41dad28
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack 4/6, split out of #939. Base: #990.
What
--dpopwas a boolean that always generated an ephemeral RSA key, so the CLI could not exercise ECDSA proofs or reuse a key across invocations. Both are needed to test DPoP against a real IdP, and by the cross-SDK harness.Changes
--dpop[=ALG]optionally takesES256,ES384,ES512orRS256and generates an ephemeral key of that type. Bare--dpopdefaults toES256.--dpopKey <file>loads a PEM private key and infers its algorithm. Combined with an explicit--dpop=ALG, the key is checked against the requested alg, so a mismatch fails with a clear message instead of an opaque WebCrypto error at signing time. Bare--dpop --dpopKey k.peminfers from the key and does not conflict.supports <feature>reports whether this build implements a feature (currently justdpop), exiting non-zero when it does not. Cross-SDK test harnesses use this to skip cases a given SDK build cannot run, rather than hard-coding version checks. Nothing in this repo calls it — the consumer is the xtest harness.cli/src/dpop-helpers.tsholds the key generation/loading/validation, kept out ofcli.tsso it is directly unit-testable.Also
Replaces the
console.assertcalls in argument validation with thrownCLIErrors.console.assertonly prints — it does not halt — so invalid input was being logged and then used anyway.Tests
cli/tests/dpop-helpers.spec.ts— 30 cases covering generation per alg, PEM loading, algorithm inference, explicit/inferred conflict resolution, and the--no-dpop/ bare---dpopargument shapes.How to test
cd cli && npm test