-
Notifications
You must be signed in to change notification settings - Fork 232
feat: Add DPoP support for /userinfo and Management API calls
#1398
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
…Client for token handling
…and Management API orchestrators
/userinfo and Management API calls
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR extends DPoP (Demonstrating Proof-of-Possession at the application layer) support to API calls beyond authentication, specifically adding DPoP header generation for /userinfo, getUser(), and patchUser() operations. The implementation allows sender-constrained tokens to be used with both the Authentication API's userinfo endpoint and Management API operations.
Key Changes
- Added DPoP header generation support for
userInfo(),getUser(), andpatchUser()methods in their respective orchestrators - Exported
TokenTypeenum for public use, enabling developers to check and specify token types - Implemented RFC 6750 WWW-Authenticate header parsing in
HttpClientfor proper OAuth 2.0 error handling from protected resources - Added
tokenTypeparameter toUserInfoParametersandusers()method for per-request token type overrides
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
src/index.ts |
Exports TokenType enum for public API use |
src/types/parameters.ts |
Adds optional tokenType parameter to UserInfoParameters |
src/core/interfaces/IAuth0Client.ts |
Updates users() signature to accept optional tokenType parameter |
src/Auth0.ts |
Updates users() method signature to support token type override |
src/core/services/HttpClient.ts |
Adds TokenType enum, getBearerHeader() utility, and RFC 6750 WWW-Authenticate header parsing |
src/core/services/AuthenticationOrchestrator.ts |
Implements DPoP header generation for userInfo() with token type parameter support |
src/core/services/ManagementApiOrchestrator.ts |
Implements DPoP header generation for getUser() and patchUser() operations |
src/platforms/web/adapters/WebAuth0Client.ts |
Integrates DPoP configuration into orchestrators and users() method |
src/platforms/native/adapters/NativeAuth0Client.ts |
Integrates DPoP configuration into orchestrators and users() method |
src/core/services/__tests__/HttpClient.spec.ts |
Comprehensive tests for WWW-Authenticate header parsing and error handling |
src/core/services/__tests__/AuthenticationOrchestrator.spec.ts |
Updates mock setup to preserve utilities needed for DPoP testing |
src/core/services/__tests__/ManagementApiOrchestrator.spec.ts |
Updates mock setup to preserve utilities needed for DPoP testing |
src/platforms/web/adapters/__tests__/WebAuth0Client.spec.ts |
Updates tests to verify DPoP parameters are passed to orchestrators |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…nterfaces and implementations
Extends DPoP (Demonstrating Proof-of-Possession) support to API calls, enabling sender-constrained tokens for the
/userinfoendpoint and Management API operations.Changes
userInfo(),getUser(), andpatchUser()methodsTokenTypeenum exported for developer use (TokenType.bearer|TokenType.dpop)UserInfoParameters.tokenType- optional parameter to override token type per-requestWWW-Authenticateheader errors from/userinfoUsage
References
RFC 9449 - DPoP