Repository navigation

Client-side RFC 7523 JWT Bearer grant with two VPs (#4078) - #4275

Merged

stevenvegt merged 101 commits into

masterfrom

feature/4078-jwt-bearer-two-vp

May 26, 2026

Merged

Client-side RFC 7523 JWT Bearer grant with two VPs (#4078)#4275
stevenvegt merged 101 commits into
masterfrom
feature/4078-jwt-bearer-two-vp

Commits on Apr 13, 2026
- Initialize branch for PR
  stevenvegt
  committed
  8d0fcac
- Rename PresentationDefinitions to FindCredentialProfile
  
  stevenvegt
  and
  claude
  committed
  c7fd6ae
- Add tests for multi-scope parsing in FindCredentialProfile
  
  stevenvegt
  and
  claude
  committed
  2d16cf7
- Add scope_policy config parsing and startup validation tests
  
  stevenvegt
  and
  claude
  committed
  a0edb15
- Apply self-review fixes
  
  stevenvegt
  and
  claude
  committed
  ba9c58b
Commits on Apr 14, 2026
- Initialize branch for PR
  stevenvegt
  committed
  c05eb53
- Add AuthZen client with batch evaluation support
  
  stevenvegt
  and
  claude
  committed
  0c0557f
- Add error handling and edge case tests for AuthZen client
  
  stevenvegt
  and
  claude
  committed
  cb22056
- Apply self-review fixes to AuthZen client
  
  stevenvegt
  and
  claude
  committed
  4f08bcf
- Initialize branch for PR
  stevenvegt
  committed
  cabd34a
- Add PresentationDefinitionResolver with remote PD support
  
  stevenvegt
  and
  claude
  committed
  b64927e
- Add local PD fallback and scope policy enforcement to resolver
  
  stevenvegt
  and
  claude
  committed
  747fd27
- Wire PresentationDefinitionResolver into client-side token flow
  
  stevenvegt
  and
  claude
  committed
  08e0232
- Apply self-review fixes to PresentationDefinitionResolver
  
  stevenvegt
  and
  claude
  committed
  0b190e6
Commits on Apr 15, 2026
- Initialize branch for PR
  stevenvegt
  committed
  f75823a
- Initialize branch for PR
  stevenvegt
  committed
  3facbb0
Commits on Apr 16, 2026
- Rename presentationDefinitionForScope to findCredentialProfile
  
  stevenvegt
  and
  claude
  committed
  9af2ab5
- Enforce profile-only scope policy in server-side token handler
  
  stevenvegt
  and
  claude
  committed
  39377f3
- Add test for passthrough scope policy
  
  stevenvegt
  and
  claude
  committed
  da8a027
- Explicitly derive granted scopes from scope policy
  
  stevenvegt
  and
  claude
  committed
  a7de2c6
- Expose AuthZen evaluator through PDPBackend interface
  
  stevenvegt
  and
  claude
  committed
  e2da404
- Implement dynamic scope policy via AuthZen PDP
  
  stevenvegt
  and
  claude
  committed
  6239847
- Add dynamic scope policy tests: partial denial, profile denial, PDP error
  
  stevenvegt
  and
  claude
  committed
  3c23f41
- Apply self-review fixes
  
  stevenvegt
  and
  claude
  committed
  de5213b
- Initialize branch for PR
  stevenvegt
  committed
  0a236af
- Initialize branch for PR
  stevenvegt
  committed
  358de07
- Initialize branch for PR
  stevenvegt
  committed
  50d47ff
- Add end-to-end integration tests for dynamic scope policy
  
  stevenvegt
  and
  claude
  committed
  85a3e06
- Add introspection tests for multi-scope tokens
  
  stevenvegt
  and
  claude
  committed
  28f442b
- Add introspection test for claims on multi-scope dynamic tokens
  
  stevenvegt
  and
  claude
  committed
  08c3981
- Apply self-review fixes: consolidate integration and introspection tests
  
  stevenvegt
  and
  claude
  committed
  828a1c1
Commits on Apr 21, 2026
- Address review: use core.TestResponseCode, clarify duplicate-ID check
  
  stevenvegt
  and
  claude
  committed
  513810f
- Refactor PD resolver to delegate remote fetch to OpenID4VPClient
  
  stevenvegt
  and
  claude
  committed
  4a920e3
Commits on Apr 24, 2026
Commits on Apr 27, 2026
- Make HTTPErrorHandler idempotent on committed responses
  
  stevenvegt
  and
  claude
  committed
  25c35af
Commits on May 1, 2026
- Initialize branch for PR
  stevenvegt
  committed
  81818a3
- Load client PD block from policy config
  
  stevenvegt
  and
  claude
  committed
  8c73791
- Guard schema validation of the client PD block
  
  stevenvegt
  and
  claude
  committed
  9730996
- Allow client-only credential profiles in policy config
  
  stevenvegt
  and
  claude
  committed
  7f5d69e
- Self-review fixes for client PD support
  
  stevenvegt
  and
  claude
  committed
  f1c1054
- Rename client wallet-owner type to service_provider
  
  stevenvegt
  and
  claude
  committed
  ab3c606
- Reword service_provider doc to state when it applies, not when it doesn't
  
  stevenvegt
  and
  claude
  committed
  156ed6d
Commits on May 4, 2026
- Initialize branch for PR
  stevenvegt
  committed
  fe93b2e
- Plumb serviceProviderSubjectID and the jwt-bearer feature flag
  
  stevenvegt
  and
  claude
  committed
  7df21b3
- Gate the two-VP flow behind the experimental flag
  
  stevenvegt
  and
  claude
  committed
  cfc6d48
- Reject two-VP requests when AS does not advertise jwt-bearer
  
  stevenvegt
  and
  claude
  committed
  ef61c0f
- Reject two-VP requests when no service_provider PD is configured
  
  stevenvegt
  and
  claude
  committed
  df974c9
- Build the jwt-bearer two-VP token request
  
  stevenvegt
  and
  claude
  committed
  ea4bbc3
- Capture VP1 field-id values into VP2 credential_selection
  
  stevenvegt
  and
  claude
  committed
  6fe03d5
- Add PresentationSubmission.ResolveVP for single-VP callers
  
  stevenvegt
  and
  claude
  committed
  2ede2b6
- Tighten the two-VP path: ResolveVP, params.DIDMethods, no client_id
  
  stevenvegt
  and
  claude
  committed
  a0d28ea
- Extract requestVPTokenAccessToken so RequestRFC021AccessToken dispatches
  
  stevenvegt
  and
  claude
  committed
  ad8cff6
- Rename RequestRFC021AccessToken to RequestServiceAccessToken
  
  stevenvegt
  and
  claude
  committed
  7d622df
- Extract loadAndValidateProfile and unit-test the rules directly
  
  stevenvegt
  and
  claude
  committed
  5023f0c
- Fold the single-VP build into buildSubmissionForSubject
  
  stevenvegt
  and
  claude
  committed
  b2ba045
- Populate Envelope.raw in ResolveVP
  
  stevenvegt
  and
  claude
  committed
  d7ed7b4
- Wire DPoP through the jwt-bearer two-VP flow
  
  stevenvegt
  and
  claude
  committed
  c68b7e9
- End-to-end test for cross-VP field-id binding
  
  stevenvegt
  and
  claude
  committed
  ae78489
- Return the resolved scope on the TokenResponse
  
  stevenvegt
  and
  claude
  committed
  b9d3c98
- Doc polish for the jwt-bearer two-VP flow
  
  stevenvegt
  and
  claude
  committed
  c4b817e
- Move JwtBearerClientAssertionType into a dedicated const block
  
  stevenvegt
  and
  claude
  committed
  3f8def8
- Regenerate server_options.rst
  
  stevenvegt
  and
  claude
  committed
  603d432
- Wrap the jwt-bearer flag-flip in a tiny test helper
  
  stevenvegt
  and
  claude
  committed
  c5bd076
- applyCapturedFieldsToSelection allocates a fresh selection map
  
  stevenvegt
  and
  claude
  committed
  fd621f4
- Use typed OAuth2Errors for jwt-bearer rejections
  
  stevenvegt
  and
  claude
  committed
  584425e
- Replace PresentationSubmission.ResolveVP with pe.NewEnvelopeFromVP
  
  stevenvegt
  and
  claude
  committed
  c80a2ee
- Spell out the jwt-bearer URN in the AS-doesn't-advertise error
  
  stevenvegt
  and
  claude
  committed
  4f592ca
- Hoist the VP-assertion lifetime into a named constant
  
  stevenvegt
  and
  claude
  committed
  d88dc8f
- Generate a fresh nonce for VP2 in the jwt-bearer flow
  
  stevenvegt
  and
  claude
  committed
  262aade
- Surface the JSONPath in cross-VP binding errors
  
  stevenvegt
  and
  claude
  committed
  410e67a
- Rename vp1/vp2 locals to organizationVP/serviceProviderVP
  
  stevenvegt
  and
  claude
  committed
  7348a9c
- Rename Client.RequestServiceAccessToken's subjectDID parameter to subjectID
  
  stevenvegt
  and
  claude
  committed
  e898ff3
Commits on May 8, 2026
- Rename auth.experimental.jwt_bearer_client → jwtbearerclient
  
  stevenvegt
  and
  claude
  committed
  1c93225
- Initialize branch for PR
  stevenvegt
  committed
  5bd9994
- Initialize branch for PR
  stevenvegt
  committed
  c208386
- Add service_provider_subject_id to ServiceAccessTokenRequest
  
  stevenvegt
  and
  claude
  committed
  0df279a
- Rename subjectID to organizationSubjectID inside requestJwtBearerAccessToken
  
  stevenvegt
  and
  claude
  committed
  b465d46
- Refactor iam.NewClient to accept a ClientConfig struct
  
  stevenvegt
  and
  claude
  committed
  71e896e
- Use lightweight test context for the feature-disabled gate test
  
  stevenvegt
  and
  claude
  committed
  c19105f
- Add tests for SP-side wallet failures in the two-VP flow
  
  stevenvegt
  and
  claude
  committed
  c28d803
- Validate service_provider_subject_id in the handler
  
  stevenvegt
  and
  claude
  committed
  e01498d
- Address self-review nits: docs and test pinning
  
  stevenvegt
  and
  claude
  committed
  dbfd435
- Document the experimental two-VP flow and cross-VP binding in policy docs
  
  stevenvegt
  and
  claude
  committed
  c9cd139
- Update doc references to the renamed jwtbearerclient flag
  
  stevenvegt
  and
  claude
  committed
  7db8c21
- Initialize branch for PR
  stevenvegt
  committed
  c6d7592
- Initialize branch for PR
  stevenvegt
  committed
  83afb0a
- Initialize branch for PR
  stevenvegt
  committed
  6b711e9
- Initialize branch for PR
  stevenvegt
  committed
  e88e79c
- Initialize branch for PR
  stevenvegt
  committed
  de07e6a
- Add jwt-bearer two-VP happy-path integration test
  
  stevenvegt
  and
  claude
  committed
  72023b8
Commits on May 12, 2026
- test(iam): tighten jwt-bearer two-VP integration test
  stevenvegt
  committed
  d422393
Commits on May 22, 2026

Commits

Commits on Apr 13, 2026

Commits on Apr 14, 2026

Commits on Apr 15, 2026

Commits on Apr 16, 2026

Commits on Apr 21, 2026

Commits on Apr 24, 2026

Commits on Apr 27, 2026

Commits on May 1, 2026

Commits on May 4, 2026

Commits on May 8, 2026

Commits on May 12, 2026

Commits on May 22, 2026