Skip to content

Conversation

@subhankarmaiti
Copy link
Contributor

@subhankarmaiti subhankarmaiti commented Dec 4, 2025

Extends DPoP (Demonstrating Proof-of-Possession) support to API calls, enabling sender-constrained tokens for the /userinfo endpoint and Management API operations.

Changes

  • DPoP header generation for userInfo(), getUser(), and patchUser() methods
  • TokenType enum exported for developer use (TokenType.bearer | TokenType.dpop)
  • UserInfoParameters.tokenType - optional parameter to override token type per-request
  • RFC 6750 error handling - properly parse WWW-Authenticate header errors from /userinfo

Usage

import Auth0, { TokenType } from 'react-native-auth0';

const credentials = await auth0.credentialsManager.getCredentials();

// DPoP headers generated automatically when tokenType is 'DPoP'
const user = await auth0.auth.userInfo({ 
  token: credentials.accessToken,
  tokenType: credentials.tokenType 
});

References

RFC 9449 - DPoP

@subhankarmaiti subhankarmaiti requested a review from a team as a code owner December 4, 2025 06:58
@subhankarmaiti subhankarmaiti changed the title Feat/api call with dpop feat: Add DPoP support for /userinfo and Management API calls Dec 4, 2025
@pmathew92 pmathew92 requested a review from Copilot December 4, 2025 10:28
Copilot finished reviewing on behalf of pmathew92 December 4, 2025 10:33
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR extends DPoP (Demonstrating Proof-of-Possession at the application layer) support to API calls beyond authentication, specifically adding DPoP header generation for /userinfo, getUser(), and patchUser() operations. The implementation allows sender-constrained tokens to be used with both the Authentication API's userinfo endpoint and Management API operations.

Key Changes

  • Added DPoP header generation support for userInfo(), getUser(), and patchUser() methods in their respective orchestrators
  • Exported TokenType enum for public use, enabling developers to check and specify token types
  • Implemented RFC 6750 WWW-Authenticate header parsing in HttpClient for proper OAuth 2.0 error handling from protected resources
  • Added tokenType parameter to UserInfoParameters and users() method for per-request token type overrides

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 11 comments.

Show a summary per file
File Description
src/index.ts Exports TokenType enum for public API use
src/types/parameters.ts Adds optional tokenType parameter to UserInfoParameters
src/core/interfaces/IAuth0Client.ts Updates users() signature to accept optional tokenType parameter
src/Auth0.ts Updates users() method signature to support token type override
src/core/services/HttpClient.ts Adds TokenType enum, getBearerHeader() utility, and RFC 6750 WWW-Authenticate header parsing
src/core/services/AuthenticationOrchestrator.ts Implements DPoP header generation for userInfo() with token type parameter support
src/core/services/ManagementApiOrchestrator.ts Implements DPoP header generation for getUser() and patchUser() operations
src/platforms/web/adapters/WebAuth0Client.ts Integrates DPoP configuration into orchestrators and users() method
src/platforms/native/adapters/NativeAuth0Client.ts Integrates DPoP configuration into orchestrators and users() method
src/core/services/__tests__/HttpClient.spec.ts Comprehensive tests for WWW-Authenticate header parsing and error handling
src/core/services/__tests__/AuthenticationOrchestrator.spec.ts Updates mock setup to preserve utilities needed for DPoP testing
src/core/services/__tests__/ManagementApiOrchestrator.spec.ts Updates mock setup to preserve utilities needed for DPoP testing
src/platforms/web/adapters/__tests__/WebAuth0Client.spec.ts Updates tests to verify DPoP parameters are passed to orchestrators

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants