feat(sep-1932): Client check for dpop_jkt

examples/clients/typescript/auth-test-dpop-no-jkt.ts

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+
+import { runDpopClient } from './helpers/dpopClientFlow';
+import { runAsCli } from './helpers/cliRunner';
+
+/**
+ * DPoP client that omits `dpop_jkt` on the authorization request. Isolates a
+ * WARNING of sep-1932-client-dpop-jkt (SEP-1932 / RFC 9449 §10).
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+  await runDpopClient(serverUrl, {
+    scheme: 'DPoP',
+    freshProofPerRequest: true,
+    sendTokenRequestProof: true,
+    handleAsNonce: true,
+    handleRsNonce: true,
+    sendDpopJkt: false
+  });
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-dpop-no-jkt <server-url>');

examples/clients/typescript/auth-test-dpop-refresh-new-key.ts

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+
+import { runDpopClient } from './helpers/dpopClientFlow';
+import { runAsCli } from './helpers/cliRunner';
+
+/**
+ * Broken DPoP client: refreshes with a DPoP proof for a different key than
+ * the one bound at the authorization-code exchange. Isolates a FAILURE of
+ * sep-1932-client-refresh-proof (RFC 9449 §5).
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+  await runDpopClient(serverUrl, {
+    scheme: 'DPoP',
+    freshProofPerRequest: true,
+    sendTokenRequestProof: true,
+    handleAsNonce: true,
+    handleRsNonce: true,
+    sendDpopJkt: true,
+    exerciseRefresh: true,
+    refreshWithNewKey: true
+  });
+}
+
+runAsCli(
+  runClient,
+  import.meta.url,
+  'auth-test-dpop-refresh-new-key <server-url>'
+);

examples/clients/typescript/auth-test-dpop-refresh-no-proof.ts

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+import { runDpopClient } from './helpers/dpopClientFlow';
+import { runAsCli } from './helpers/cliRunner';
+
+/**
+ * Broken DPoP client: refreshes without a DPoP proof. Isolates a FAILURE of
+ * sep-1932-client-refresh-proof (RFC 9449 §5).
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+  await runDpopClient(serverUrl, {
+    scheme: 'DPoP',
+    freshProofPerRequest: true,
+    sendTokenRequestProof: true,
+    handleAsNonce: true,
+    handleRsNonce: true,
+    sendDpopJkt: true,
+    exerciseRefresh: true,
+    sendRefreshProof: false
+  });
+}
+
+runAsCli(
+  runClient,
+  import.meta.url,
+  'auth-test-dpop-refresh-no-proof <server-url>'
+);

examples/clients/typescript/auth-test-dpop-wrong-jkt.ts

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+
+import { runDpopClient } from './helpers/dpopClientFlow';
+import { runAsCli } from './helpers/cliRunner';
+
+/**
+ * Broken DPoP client: sends a `dpop_jkt` that does not match the DPoP proof
+ * key used at the token endpoint. Isolates a FAILURE of
+ * sep-1932-client-dpop-jkt; the test AS rejects the token request with 400
+ * `invalid_grant` (RFC 9449 §10).
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+  await runDpopClient(serverUrl, {
+    scheme: 'DPoP',
+    freshProofPerRequest: true,
+    sendTokenRequestProof: true,
+    handleAsNonce: true,
+    handleRsNonce: true,
+    wrongDpopJkt: true
+  });
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-dpop-wrong-jkt <server-url>');

examples/clients/typescript/auth-test-dpop.ts

@@ -4,16 +4,21 @@ import { runDpopClient } from './helpers/dpopClientFlow';
 import { runAsCli } from './helpers/cliRunner';
 
 /**
- * Well-behaved DPoP client (SEP-1932 / RFC 9449): presents the DPoP-bound token
- * with the `DPoP` Authorization scheme and a fresh proof on every MCP request.
+ * Well-behaved DPoP client (SEP-1932 / RFC 9449): binds the authorization code
+ * to its DPoP key via `dpop_jkt` (RFC 9449 §10), then presents the DPoP-bound
+ * token with the `DPoP` Authorization scheme and a fresh proof on every MCP
+ * request. It also uses the optional refresh token with a proof for the same
+ * key (RFC 9449 §5).
  */
 export async function runClient(serverUrl: string): Promise<void> {
   await runDpopClient(serverUrl, {
     scheme: 'DPoP',
     freshProofPerRequest: true,
     sendTokenRequestProof: true,
     handleAsNonce: true,
-    handleRsNonce: true
+    handleRsNonce: true,
+    sendDpopJkt: true,
+    exerciseRefresh: true
   });
 }