Add dpop signing#82
Draft
sashyo wants to merge 31 commits into
Draft
Conversation
- @tidecloak/js: add signDelegationRequest() to DPoPSignatureProvider and IAMService, signs arbitrary claims with existing DPoP key - @tidecloak/server: new package with TideDelegation class for server-side delegation exchange (packRequest + exchange) - @tidecloak/dpop-server: new package for server-side DPoP proof generation via TideCloak endpoint - @tidecloak/nextjs: add optional dpop flag to token exchange config
TideDelegation now generates its own Ed25519 keypair, includes cnf.jkt in packed requests, generates server DPoP proofs for token exchange and resource requests. exchange() no longer requires browser DPoP proof — server signs its own.
@tidecloak/js: - tidecloak.js: add getDpopProvider() and signDpopApproval() which sends postMessage to ORK enclave for session key signing - IAMService.js: add signDpopApproval() delegating to TideCloak, update signDelegationRequest() to use getDpopProvider() for standard Keycloak adapter mode @tidecloak/server: - delegation.ts: rotate server DPoP key per delegation cycle (rotateServerKey replaces ensureServerKey), add ath claim to DPoP proofs per RFC 9449, fix CJS module resolution, add type:module to package.json, add .js extension to imports
@tidecloak/js: new createTideFetch() wrapper that handles 419 delegation challenges transparently — signs delegation request and DPoP approval, POSTs to delegation endpoint, retries original request from scratch. @tidecloak/server: new handleDelegation() and requireDelegation() Express middleware. requireDelegation sends 419 with pack payload if no cached token, handleDelegation receives browser signatures and caches the delegation token per-user-session.
- Add Authorization header to delegation POST request - Convert relative delegation endpoint to absolute URL - Re-export createTideFetch from package index.js
The delegation fetch helper now supports POST/PUT/DELETE with JSON bodies and FormData for admin API write operations. Handles 204 No Content and empty response bodies.
packRequest() and requireDelegation() now only generate a new server key if none exists. Concurrent 419 responses from multiple routes reuse the same key so the browser's signatures match. Clear server key when cached delegation token expires so the next cycle gets a fresh key.
Deleted the unused dpop-server package and removed its dependency from tidecloak-nextjs. The delegation flow uses @tidecloak/server with the forgetful interrupt pattern instead.
Add scert model
- IAMService.fetch() handles Bearer, DPoP, and delegation automatically - IAMService.setDelegationThumbprint() for one-time init - Replaces separate secureFetch/adminFetch with single entry point - Updated tidecloak-server README for X-Delegation-Request header flow
init() now generates Ed25519 keypair and saves to data/server.key directly. No vault encrypt/decrypt, no doken parameter, no server-key.vault blob.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.