feat: reject dpop_key + use_mtls in signin_with_passkey

Author: cschetan77

src/auth0_server_python/auth_server/server_client.py

@@ -3338,6 +3338,12 @@ async def signin_with_passkey(
             raise MissingRequiredArgumentError("auth_session")
         if authn_response is None:
             raise MissingRequiredArgumentError("authn_response")
+        if self._use_mtls and dpop_key is not None:
+            raise ConfigurationError(
+                "dpop_key cannot be combined with use_mtls. DPoP and mTLS bind tokens "
+                "differently; DPoP would take precedence and the token would not be "
+                "certificate-bound."
+            )
 
         try:
             domain = await self._resolve_current_domain(store_options)

src/auth0_server_python/tests/test_server_client.py

@@ -9805,6 +9805,17 @@ async def test_apply_client_auth_mtls_returns_none_and_strips_creds():
     assert "client_assertion_type" not in params
 
 
+@pytest.mark.asyncio
+async def test_signin_with_passkey_rejects_dpop_under_mtls(mocker):
+    client = _mtls_client()
+    with pytest.raises(ConfigurationError):
+        await client.signin_with_passkey(
+            auth_session="sess",
+            authn_response=mocker.Mock(),
+            dpop_key=object(),
+        )
+
+
 @pytest.mark.asyncio
 async def test_complete_interactive_login_uses_mtls_token_endpoint(mocker):
     mock_tx_store = AsyncMock()