Module dpop_seam 

The narrow interface every caller needs from DPoP verification (RFC 9449).

crate::oauth::dpop does the proof checking, nonce issuance, replay cache and thumbprints. Its verifier implements DpopVerifier, and OAuthState::default wires it in. The rest of this crate holds the verifier through this trait.

RefusingDpopVerifier refuses every proof. Tests use it to check that token exchange refuses rather than mints an unbound token.

Structs

DpopThumbprint

The output of a successful DPoP proof check: the JWK thumbprint (RFC 7638) the proof’s key hashes to, which is what a minted access token is bound to and what a later resource request’s own proof must match.

RefusingDpopVerifier

A verifier that refuses every proof, unconditionally.

VerifiedProof

A proof that checked out, and what DpopVerifier::accept needs to record it against replay.

Enums

DpopError

Why a presented DPoP proof was not accepted.

Traits

DpopVerifier

What the OAuth routes and the resource routes need to bind a request to a client’s key.