feat: Implement DPoPManager - central coordinator (ENG-4784) by mrudatsprint · Pull Request #202 · FusionAuth/fusionauth-javascript-sdk

mrudatsprint · 2026-07-16T20:41:37Z

Issue:

https://linear.app/fusionauth/issue/ENG-4784/implement-dpopmanager-central-coordinator

Description:

Implement the DPoPManager - responsible for:

key pair creation
generating the thumbprint for the dpop_jkt parameter on /oauth2/authorize
generating the DPoP proof JWT

Note: The framework layers (React, Angular and Vue) will hold a reference to the DPoPManager to expose dpopFetch and generateProof.

- Add `dpop` v2.1.1 runtime dependency and `fake-indexeddb` devDependency to packages/core/package.json - SDKConfig: add optional `useDpop` and `dpopTokenStorage` fields - UrlHelper: add `getAuthorizeUrl(state?, dpopJkt?, codeChallenge?)` targeting FusionAuth /oauth2/authorize directly; update UrlHelperTypes to include response_type, code_challenge, code_challenge_method, dpop_jkt - DPoPStorage: IndexedDB abstraction for ES256 CryptoKeyPair persistence (db: fusionauth-sdk:dpop, store: keypair, keyed by clientId) - DPoPTokenStore: localStorage/memory token storage for DPoP-bound tokens (key: fusionauth-sdk:tokens:<clientId>); includes getAccessToken() and isExpired getter - packages/core/src/DPoP/index.ts re-exports both classes - 54 tests passing (21 DPoPTokenStore, 6 DPoPStorage, 16 UrlHelper, 7 SDKCore, 4 CookieHelpers)

- Remove 'as any' cast in catch block — reject() accepts unknown directly - Add tests for indexedDB unavailable (SSR/non-browser): all three public methods (getKeyPair, setKeyPair, clearKeyPair) reject with a descriptive error - Add test for indexedDB.open() throwing synchronously (e.g. security policy block)

All three DPoPStorage methods (getKeyPair, setKeyPair, clearKeyPair) now resolve on tx.oncomplete and reject on tx.onerror / tx.onabort. Previously, resolving on req.onsuccess meant the caller was told 'success' before the transaction had fully committed — a transaction abort occurring after the request succeeded (e.g. quota exceeded) would go undetected. Applies the same fix consistently to all three methods, including getKeyPair (readonly, lower risk, but now consistent) and setKeyPair (readwrite, same durability concern as clearKeyPair). Adds a test that aborts a clearKeyPair transaction synchronously inside the request onsuccess handler and verifies the promise rejects and the key pair is still present in IndexedDB.

…84/central-coordinator' of github.com:FusionAuth/fusionauth-javascript-sdk into miker/eng-4784/central-coordinator

…ore)

…g object - Export DEFAULT_DPOP_DB_NAME, DEFAULT_DPOP_DB_VERSION, DEFAULT_DPOP_STORE_NAME as named constants (no hardcoded magic strings anywhere in the codebase) - Add DPoPStorageConfig interface with clientId (required) and optional dbName, dbVersion, storeName fields — each defaults to the exported constant - Refactor DPoPStorage constructor from positional (clientId: string) to config object, matching the UrlHelperConfig convention in this monorepo - openDb() and all three public methods now reference instance fields (this.dbName, this.dbVersion, this.storeName) instead of module constants - Add tests: defaults apply when no config overrides provided; custom dbName and storeName land data in the right database; two instances with different dbNames but the same clientId do not share keys; dbVersion downgrade produces a clean rejection (VersionError) - Update AGENTS.md: note the config-object constructor convention and the IndexedDB dbVersion must-only-increase constraint

…n abort.

…central-coordinator

…ENG-4782 refactor

mrudatsprint

self-review

Copilot

Pull request overview

Implements a new DPoPManager in @fusionauth-sdk/core as the central coordinator for DPoP key management, thumbprint generation (for dpop_jkt on /oauth2/authorize), proof JWT generation, and a DPoP-aware fetch wrapper with nonce retry handling. Adds unit coverage for the manager plus a standalone Playwright smoke test configuration and script to validate the flow end-to-end against a local FusionAuth instance (pre-SDKCore wiring).

Changes:

Added DPoPManager to coordinate keypair persistence, token storage integration, proof generation, and nonce caching/retry logic.
Added comprehensive Vitest unit tests for keypair lifecycle, proof claims, fetch header behavior, nonce retry, and clear().
Added standalone Playwright config and a DPoP smoke test that drives FusionAuth hosted login and token flows without requiring the quickstart app.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
playwright.dpop.config.ts	Adds a dedicated Playwright config for running the new DPoP smoke test independently of quickstart.
packages/core/src/DPoP/index.ts	Re-exports `DPoPManager` from the DPoP module barrel.
packages/core/src/DPoP/DPoPManager.ts	Introduces the DPoP coordinator class, including proof generation and a nonce-retrying `fetch`.
packages/core/src/DPoP/DPoPManager.test.ts	Adds unit tests validating `DPoPManager` behavior end-to-end in Node + fake IndexedDB.
e2e/tests/dpop-smoke.test.ts	Adds a Playwright-driven smoke test exercising authorization, token exchange/refresh, and resource calls using DPoP.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

… dropping one (PR #202 review) _resolveHeaders() previously returned early with init.headers whenever it was present, silently discarding any headers already set on a Request object passed as input. This contradicted the _doFetch documentation's promise to never drop caller headers. _resolveHeaders() now returns a merged Headers object: init.headers is the base, and Request.headers are layered on top, winning on any conflicting header name.

…mption (PR #202 Copilot review) fetch() previously passed the same input reference to both the initial attempt and the nonce-triggered retry. If input was a Request with a body, the first attempt consumed it, and the retry would throw a 'body already used' error instead of succeeding. - Clone the Request twice up front (before either is read from) so each attempt gets an independent, unconsumed body. Request.clone() safely tees any internal streaming body per spec, so this also covers a Request built with a ReadableStream body. - A raw ReadableStream passed via init.body (not wrapped in a Request) cannot be cloned this way. On retry, this now throws a clear, actionable error instead of letting native fetch throw an opaque one.

…opilot review) generateProof() documented htu as being 'without query/fragment' but passed it through unmodified. fetch() supplies Request.url, which can include a query string, so proofs generated via dpopFetch() could carry an htu that includes query parameters — a subtle interop bug with strict DPoP verifiers. htm was also not normalised to uppercase, which most DPoP verifiers require. Both are now normalised inside generateProof() itself, so this is correct regardless of whether callers go through fetch() or call generateProof() directly with arbitrary casing/query strings.

…dpop-smoke.test.ts (PR #202 Copilot review) T2-1 declared capturedAuthHeader/capturedDpopHeader that were never assigned and only suppressed via void, alongside a comment claiming Playwright route interception captures DPoPManager.fetch()'s headers — no such interception exists since fetch() runs in the Node test process, not the browser page. Removed the dead variables and replaced the comment with an accurate explanation of how correctness is actually validated (end-to-end via FusionAuth's server-side verification, plus T2-2's direct proof decoding).

wied03

Good job Mike! Some questions.

* feat: add DPoP core storage layer (ENG-4782) - Add `dpop` v2.1.1 runtime dependency and `fake-indexeddb` devDependency to packages/core/package.json - SDKConfig: add optional `useDpop` and `dpopTokenStorage` fields - UrlHelper: add `getAuthorizeUrl(state?, dpopJkt?, codeChallenge?)` targeting FusionAuth /oauth2/authorize directly; update UrlHelperTypes to include response_type, code_challenge, code_challenge_method, dpop_jkt - DPoPStorage: IndexedDB abstraction for ES256 CryptoKeyPair persistence (db: fusionauth-sdk:dpop, store: keypair, keyed by clientId) - DPoPTokenStore: localStorage/memory token storage for DPoP-bound tokens (key: fusionauth-sdk:tokens:<clientId>); includes getAccessToken() and isExpired getter - packages/core/src/DPoP/index.ts re-exports both classes - 54 tests passing (21 DPoPTokenStore, 6 DPoPStorage, 16 UrlHelper, 7 SDKCore, 4 CookieHelpers) * feat: fix file formatting. * fix: DPoPStorage openDb() error handling and test coverage - Remove 'as any' cast in catch block — reject() accepts unknown directly - Add tests for indexedDB unavailable (SSR/non-browser): all three public methods (getKeyPair, setKeyPair, clearKeyPair) reject with a descriptive error - Add test for indexedDB.open() throwing synchronously (e.g. security policy block) * fix: fix copilot warnings. * fix: resolve DPoP transactions on tx.oncomplete, not req.onsuccess All three DPoPStorage methods (getKeyPair, setKeyPair, clearKeyPair) now resolve on tx.oncomplete and reject on tx.onerror / tx.onabort. Previously, resolving on req.onsuccess meant the caller was told 'success' before the transaction had fully committed — a transaction abort occurring after the request succeeded (e.g. quota exceeded) would go undetected. Applies the same fix consistently to all three methods, including getKeyPair (readonly, lower risk, but now consistent) and setKeyPair (readwrite, same durability concern as clearKeyPair). Adds a test that aborts a clearKeyPair transaction synchronously inside the request onsuccess handler and verifies the promise rejects and the key pair is still present in IndexedDB. * feat: the workflow will run regardless of the branch being merged into. * feat: implement DPoPManager central coordinator (ENG-4784) * feat: re-generate lock file. * feat: re-generate lock file. * feat: update lock file. * test: add DPoP smoke tests against real FusionAuth instance (pre-SDKCore) * feat: fix format and lint errors. * refactor: make DPoPStorage IndexedDB constants configurable via config object - Export DEFAULT_DPOP_DB_NAME, DEFAULT_DPOP_DB_VERSION, DEFAULT_DPOP_STORE_NAME as named constants (no hardcoded magic strings anywhere in the codebase) - Add DPoPStorageConfig interface with clientId (required) and optional dbName, dbVersion, storeName fields — each defaults to the exported constant - Refactor DPoPStorage constructor from positional (clientId: string) to config object, matching the UrlHelperConfig convention in this monorepo - openDb() and all three public methods now reference instance fields (this.dbName, this.dbVersion, this.storeName) instead of module constants - Add tests: defaults apply when no config overrides provided; custom dbName and storeName land data in the right database; two instances with different dbNames but the same clientId do not share keys; dbVersion downgrade produces a clean rejection (VersionError) - Update AGENTS.md: note the config-object constructor convention and the IndexedDB dbVersion must-only-increase constraint * feature: delete contrived test to intercept a successful even and then abort. * fix: update DPoPStorage constructor calls to use config object after ENG-4782 refactor * feature: update lock file * feat: implement SDKCore.startLogin() for DPoP authorization code grant (ENG-4786) - Add Pkce module (generateCodeVerifier, generateCodeChallenge) with RFC 7636 Appendix B test vector coverage; runs under @vitest-environment node - Extend RedirectHelper to persist code_verifier as a second colon-delimited segment alongside state; add public getCodeVerifier() getter; add test file - SDKCore: construct DPoPManager when config.useDpop is true; startLogin() is now async — DPoP branch calls getOrCreateKeyPair()/getThumbprint() and generates PKCE params then redirects to /oauth2/authorize directly; isLoggedIn delegates to DPoPManager.isLoggedIn in DPoP mode (not app.at_exp cookie) - SDKCore.test.ts: add DPoP-mode describe block with mocked DPoPManager and Pkce (jsdom lacks crypto.subtle); all existing cookie-mode tests unaffected - e2e/dpop-smoke.test.ts: replace local generatePkce() helper with shared Pkce module; add Tier 0 tests exercising SDKCore.startLogin() in DPoP mode end-to-end (no live FusionAuth required for Tier 0) - Export Pkce from packages/core/src/index.ts Note: yarn test:core cannot run in this sandbox environment due to a missing @rollup/rollup-linux-arm64-gnu native binary (arch mismatch); TypeScript compilation (tsc --noEmit) and ESLint/Prettier are clean. * fix: add @vitest-environment jsdom to SDKCore.test.ts; fix handlePreRedirect assertion Without the explicit jsdom annotation, vitest inherits the 'node' environment from DPoPManager.test.ts when the full suite runs, causing 'document is not defined' and 'window is not defined' failures in all SDKCore tests. Also corrects the handlePreRedirect spy assertion: cookie-mode startLogin() passes one argument (state), not two — the codeVerifier arg is only added in DPoP mode. * fix: suppress cookie console.error noise in Tier 0 e2e tests SDKCore's constructor calls scheduleTokenExpiration() which calls getAccessTokenExpirationMoment(). In a Node/Playwright process document doesn't exist, so CookieHelpers catches the ReferenceError and logs 'Error accessing cookies...' to console.error. The tests still pass, but the stderr noise is confusing. Fix: extract a shared DPOP_CONFIG constant in the Tier 0 describe block that includes a no-op cookieAdapter ({ at_exp: () => undefined }). This causes getAccessTokenExpirationMoment() to take the adapter path and skip document.cookie entirely, eliminating the noise. Also fixes T0-1 where the await core.startLogin() call was accidentally dropped during the previous config refactor. * feat: update lock file. * fix: update Angular onRedirect test to use 3-segment redirect-value format RedirectHelper now stores nonce:codeVerifier:state (three colon-delimited segments) instead of the previous nonce:state (two segments). The Angular sdkcore/ directory is generated by 'yarn get-sdk-core' which copies packages/core/src/ verbatim — so in CI the Angular RedirectHelper picks up the updated parser automatically. The test was writing the old two-segment format 'abc123:/welcome-page', which the new parser splits as [nonce='abc123', codeVerifier='/welcome-page', state=''] — returning undefined for state instead of '/welcome-page'. Fix: write 'abc123::/welcome-page' (empty codeVerifier segment, matching cookie mode where no verifier is stored). * fix: update Vue and React onRedirect tests to use 3-segment redirect-value format RedirectHelper now stores nonce:codeVerifier:state (three colon-delimited segments) instead of nonce:state (two segments). Both sdk-vue and sdk-react import SDKCore directly from @fusionauth-sdk/core (via the @fusionauth-sdk/* tsconfig path alias), so their tests exercise the live, current RedirectHelper — same root cause as the earlier Angular fix. - packages/sdk-vue/src/createFusionAuth/createFusionAuth.test.ts: was seeding the old 2-segment format ('rAnd0mStR1ng:<state>'), causing the new state getter to return undefined instead of the expected state value. Fixed to 'rAnd0mStR1ng::<state>' (empty codeVerifier segment). - packages/sdk-react/src/components/providers/FusionAuthProvider.test.tsx: had the same stale 2-segment seed, but wasn't caught by CI because the assertion only checked toHaveBeenCalled() (no argument check). Fixed the seed format and strengthened the assertion to toHaveBeenCalledWith(stateValue) to restore real coverage of the callback argument. * fix: merge Request and init headers in DPoPManager.fetch() instead of dropping one (PR #202 review) _resolveHeaders() previously returned early with init.headers whenever it was present, silently discarding any headers already set on a Request object passed as input. This contradicted the _doFetch documentation's promise to never drop caller headers. _resolveHeaders() now returns a merged Headers object: init.headers is the base, and Request.headers are layered on top, winning on any conflicting header name. * feat: fix angular and vue tests. * fix: clone Request before retry in fetch() to avoid double body consumption (PR #202 Copilot review) fetch() previously passed the same input reference to both the initial attempt and the nonce-triggered retry. If input was a Request with a body, the first attempt consumed it, and the retry would throw a 'body already used' error instead of succeeding. - Clone the Request twice up front (before either is read from) so each attempt gets an independent, unconsumed body. Request.clone() safely tees any internal streaming body per spec, so this also covers a Request built with a ReadableStream body. - A raw ReadableStream passed via init.body (not wrapped in a Request) cannot be cloned this way. On retry, this now throws a clear, actionable error instead of letting native fetch throw an opaque one. * fix: normalize htu and htm in generateProof() per RFC 9449 (PR #202 Copilot review) generateProof() documented htu as being 'without query/fragment' but passed it through unmodified. fetch() supplies Request.url, which can include a query string, so proofs generated via dpopFetch() could carry an htu that includes query parameters — a subtle interop bug with strict DPoP verifiers. htm was also not normalised to uppercase, which most DPoP verifiers require. Both are now normalised inside generateProof() itself, so this is correct regardless of whether callers go through fetch() or call generateProof() directly with arbitrary casing/query strings. * fix: remove dead captured header variables and misleading comment in dpop-smoke.test.ts (PR #202 Copilot review) T2-1 declared capturedAuthHeader/capturedDpopHeader that were never assigned and only suppressed via void, alongside a comment claiming Playwright route interception captures DPoPManager.fetch()'s headers — no such interception exists since fetch() runs in the Node test process, not the browser page. Removed the dead variables and replaced the comment with an accurate explanation of how correctness is actually validated (end-to-end via FusionAuth's server-side verification, plus T2-2's direct proof decoding). * feat: update approvers. * test: add deterministic nonce-retry smoke test (T2-4) FusionAuth (as the Authorization Server) never issues a use_dpop_nonce challenge itself — per FusionAuth's DPoP docs, nonce enforcement is a Resource Server responsibility implemented by your own APIs, not something FusionAuth's own endpoints (e.g. /oauth2/userinfo) do. This is why the existing T2-3 test can only assert structurally ('either outcome is a pass') against a real FusionAuth instance. T2-4 adds a self-contained, deterministic test that mocks globalThis.fetch to simulate a Resource Server 401 response with a use_dpop_nonce challenge (WWW-Authenticate + DPoP-Nonce headers), then verifies: - exactly one retry occurs (not zero, not more than one) - the first proof has no nonce claim - the retried proof carries the exact server-issued nonce claim - both proofs target the same htu/htm Uses its own fresh DPoPManager (via the existing makeManager() helper) so it does not depend on shared state/order from the Tier 1 tests, and requires no live FusionAuth instance. * fix: revert startLogin() to void, address Copilot PR review comment (ENG-4786) Reverts SDKCore.startLogin()'s signature from 'async ... Promise<void>' back to plain 'void', matching the public SDKContext/framework-wrapper types exactly (SDKContext.ts, FusionAuthProviderContext.ts, Vue's FusionAuth<T>, Angular's SDKContext.ts all still declare startLogin: (state?) => void). Although tsc --noEmit already reported zero errors thanks to TypeScript's void-returning-function compatibility rule, the underlying concern was real: none of the three framework wrappers (React's useRedirecting, Vue's login(), Angular's startLogin()) awaited or caught the promise, so a DPoP async failure (e.g. crypto.subtle unavailable, IndexedDB blocked) would surface as an unhandled promise rejection. - SDKCore.ts: startLogin() is synchronous again. In DPoP mode it fires a new private async startDpopLogin() and catches failures via the new optional SDKConfig.onLoginFailure callback (falls back to console.error), following the existing onAutoRefreshFailure convention. Cookie mode is unchanged. - SDKConfig.ts: add onLoginFailure?: (error: Error) => void. - SDKCore.test.ts: DPoP startLogin() tests now call startLogin() without awaiting it and use vi.waitFor() to wait for window.location.assign before asserting. Added two new tests covering onLoginFailure and the console.error fallback. - e2e/tests/dpop-smoke.test.ts: added a createAssignWaiter() helper (a deferred promise resolved when window.location.assign is called) and reworked T0-1/T0-2/T0-3 to use it instead of awaiting startLogin() directly. T0-3 now explicitly waits for core1's redirect before swapping IndexedDB for core2, preserving the original sequential-completion guarantee that awaiting startLogin() used to provide implicitly. No changes needed to SDKContext.ts, FusionAuthProviderContext.ts, Vue's types, Angular's types/service, or any framework wrapper implementation — zero blast radius outside packages/core, as intended. * docs: fix stale/ambiguous state-reconstruction description in RedirectHelper.ts Addresses a Copilot PR review comment. The class-level doc comment said state is retrieved by joining segments 'after index 1 (skipping the verifier segment)' — phrasing left over from before the codeVerifier segment existed. The storage format is nonce:codeVerifier:state (3 segments), and the actual implementation (line 85) skips both the nonce (index 0) and codeVerifier (index 1) segments, with state starting at index 2 — not just 'the verifier segment' as the old wording implied. Doc-only change; no logic or test changes needed. * fix: preserve state from legacy 2-segment redirect values (Copilot PR review) RedirectHelper.state and getCodeVerifier() always assumed the current 3-segment storage format (nonce:codeVerifier:state). If a user initiates a login redirect on a pre-DPoP SDK version (which wrote the legacy 2-segment nonce:state format) and the app is upgraded to a newer SDK version before they land back — e.g. a deploy that happens while they're on FusionAuth's hosted login page — the leftover legacy value would be misparsed: state would resolve to undefined instead of the real value. Fix: detect the legacy format unambiguously. The current writer (handlePreRedirect) always includes a codeVerifier segment, even when empty, so any value it produces has at least two colons. A stored value with exactly one colon can therefore only be the legacy format. - state getter: if there are exactly 2 segments (1 colon), treat the second segment as the legacy state directly, instead of destructuring past index 1 (which only works for the 3-segment format). - getCodeVerifier(): same legacy-format guard, since a 2-segment value never carried a code_verifier — prevents misreading a fragment of a legacy state value as a verifier. - Documented (as a comment, not a test) the known acceptable limitation: a legacy state value that itself contained a colon is indistinguishable from a current-format value with a non-empty codeVerifier — an inherent ambiguity in a delimiter-based format without a version marker, accepted given the narrow redirect-round-trip window. - RedirectHelper.test.ts: added 4 tests seeding localStorage directly with the legacy format, covering handlePostRedirect's callback value (including empty legacy state), marker cleanup, and getCodeVerifier()'s undefined result. * feat: update comments. * feat: remove redundant comments. * feat: remove file not needed until adding end to end tests. * feat: remove lengthy comment. * feat: remote unnecessary comments. * fix: store DPoP redirect data as JSON, leave hosted backend format untouched Per PR review discussion: instead of patching around the ambiguity between the legacy 2-segment (nonce:state) and current 3-segment (nonce:codeVerifier:state) colon-delimited formats, eliminate the ambiguity entirely by using two structurally distinct, non-overlapping formats under the same fa-sdk-redirect-value key: - Hosted backend mode (no codeVerifier passed to handlePreRedirect): plain string `${randomNonce}:${state ?? ''}` — exactly the format every published SDK version has always written, byte-for-byte unchanged. There is no 'legacy format' to handle anymore because this format itself never changed. - DPoP mode (codeVerifier passed): JSON object { codeVerifier, state }. JSON.parse deterministically throws on the hosted-backend plain string (it never starts with '{', and a bare 'nonce:state' string can never be valid JSON on its own — even an all-digit nonce fails because JSON.parse requires the entire string to be one valid value, and trailing ':state' content after a parsed number is rejected). This makes the two formats provably non-ambiguous, unlike the previous 'count the colons' heuristic which had an acknowledged edge case (a legacy state value containing its own colon was indistinguishable from a new-format value with a real codeVerifier). This also matches the existing convention in DPoPTokenStore, which already uses JSON.stringify/JSON.parse for its persisted data rather than a delimited string. RedirectHelper.ts: - handlePreRedirect/handlePostRedirect/getCodeVerifier signatures unchanged (no SDKCore.ts changes needed) — only the internal storage format changed. - Replaced the private "state" getter with a "parseState(raw)" method that takes the already-fetched raw value (handlePostRedirect previously read the value from storage twice per call; now once). - Removed the now-obsolete 'exactly one colon = legacy' segment-counting logic from getCodeVerifier() and the old state getter. RedirectHelper.test.ts: - Removed the 'legacy 2-segment format backward-compatibility' describe block (4 tests) — no longer applicable, since hosted backend mode's format never changes. - Added a new 'storage format' describe block: hosted backend mode's raw value is verified to still be a plain non-JSON string; DPoP mode's raw value is verified to be the expected JSON shape; switching modes on the same helper instance in either direction doesn't leak data from the previous format; an empty-string codeVerifier still takes the JSON path but getCodeVerifier() correctly returns undefined for it. * feat: remove unnecessary tests and comments. * feat: validate state in the redirect callback in hosted backend mode. * feat: remove verbose comments. * feat: remove verbose comments. * feat: re-organize comments. * refactor: consolidate DPoP/hosted-backend format parsing into parseStoredValue() Follow-up to PR #203 review discussion about relying on a caught JSON.parse() SyntaxError as the primary discriminator between DPoP mode's JSON format and hosted backend mode's plain string format. Although the performance concern doesn't really apply here (this is called at most once or twice per completed redirect, not a hot path, and modern JS engines no longer deoptimize functions containing try/catch), the underlying code smell was worth addressing: hosted backend mode calls hit the catch branch on 100% of calls, not as a rare/exceptional case. Changes: - handlePreRedirect(): named the write-side mode check `isDpopMode = codeVerifier !== undefined` instead of an inline anonymous condition in the ternary. - Replaced parseState() and the duplicated try/catch logic inside getCodeVerifier() with a single parseStoredValue(raw) method that returns both `codeVerifier` and `state` in one pass. The DPoP-vs-hosted-backend distinction is now expressed in exactly one place in the class, via a cheap, deterministic `raw.startsWith('{')` sniff rather than a caught exception — DPoP mode's JSON values always start with `{`; hosted backend mode's plain `nonce:state` strings never do (the nonce is always hex digits), so this is a provably correct discriminator with no exception construction/throwing on the common hosted-backend path at all. - getCodeVerifier() and handlePostRedirect() now both delegate to parseStoredValue() instead of having their own separate parsing logic. Pure internal refactor — no public API or behavior change. All 18 existing RedirectHelper.test.ts tests pass unchanged, confirming no external behavior was affected. * feat: no flow control using a try...catch

…ens (#204) * feat: add DPoP core storage layer (ENG-4782) - Add `dpop` v2.1.1 runtime dependency and `fake-indexeddb` devDependency to packages/core/package.json - SDKConfig: add optional `useDpop` and `dpopTokenStorage` fields - UrlHelper: add `getAuthorizeUrl(state?, dpopJkt?, codeChallenge?)` targeting FusionAuth /oauth2/authorize directly; update UrlHelperTypes to include response_type, code_challenge, code_challenge_method, dpop_jkt - DPoPStorage: IndexedDB abstraction for ES256 CryptoKeyPair persistence (db: fusionauth-sdk:dpop, store: keypair, keyed by clientId) - DPoPTokenStore: localStorage/memory token storage for DPoP-bound tokens (key: fusionauth-sdk:tokens:<clientId>); includes getAccessToken() and isExpired getter - packages/core/src/DPoP/index.ts re-exports both classes - 54 tests passing (21 DPoPTokenStore, 6 DPoPStorage, 16 UrlHelper, 7 SDKCore, 4 CookieHelpers) * feat: fix file formatting. * fix: DPoPStorage openDb() error handling and test coverage - Remove 'as any' cast in catch block — reject() accepts unknown directly - Add tests for indexedDB unavailable (SSR/non-browser): all three public methods (getKeyPair, setKeyPair, clearKeyPair) reject with a descriptive error - Add test for indexedDB.open() throwing synchronously (e.g. security policy block) * fix: fix copilot warnings. * fix: resolve DPoP transactions on tx.oncomplete, not req.onsuccess All three DPoPStorage methods (getKeyPair, setKeyPair, clearKeyPair) now resolve on tx.oncomplete and reject on tx.onerror / tx.onabort. Previously, resolving on req.onsuccess meant the caller was told 'success' before the transaction had fully committed — a transaction abort occurring after the request succeeded (e.g. quota exceeded) would go undetected. Applies the same fix consistently to all three methods, including getKeyPair (readonly, lower risk, but now consistent) and setKeyPair (readwrite, same durability concern as clearKeyPair). Adds a test that aborts a clearKeyPair transaction synchronously inside the request onsuccess handler and verifies the promise rejects and the key pair is still present in IndexedDB. * feat: the workflow will run regardless of the branch being merged into. * feat: implement DPoPManager central coordinator (ENG-4784) * feat: re-generate lock file. * feat: re-generate lock file. * feat: update lock file. * test: add DPoP smoke tests against real FusionAuth instance (pre-SDKCore) * feat: fix format and lint errors. * refactor: make DPoPStorage IndexedDB constants configurable via config object - Export DEFAULT_DPOP_DB_NAME, DEFAULT_DPOP_DB_VERSION, DEFAULT_DPOP_STORE_NAME as named constants (no hardcoded magic strings anywhere in the codebase) - Add DPoPStorageConfig interface with clientId (required) and optional dbName, dbVersion, storeName fields — each defaults to the exported constant - Refactor DPoPStorage constructor from positional (clientId: string) to config object, matching the UrlHelperConfig convention in this monorepo - openDb() and all three public methods now reference instance fields (this.dbName, this.dbVersion, this.storeName) instead of module constants - Add tests: defaults apply when no config overrides provided; custom dbName and storeName land data in the right database; two instances with different dbNames but the same clientId do not share keys; dbVersion downgrade produces a clean rejection (VersionError) - Update AGENTS.md: note the config-object constructor convention and the IndexedDB dbVersion must-only-increase constraint * feature: delete contrived test to intercept a successful even and then abort. * fix: update DPoPStorage constructor calls to use config object after ENG-4782 refactor * feature: update lock file * feat: implement SDKCore.startLogin() for DPoP authorization code grant (ENG-4786) - Add Pkce module (generateCodeVerifier, generateCodeChallenge) with RFC 7636 Appendix B test vector coverage; runs under @vitest-environment node - Extend RedirectHelper to persist code_verifier as a second colon-delimited segment alongside state; add public getCodeVerifier() getter; add test file - SDKCore: construct DPoPManager when config.useDpop is true; startLogin() is now async — DPoP branch calls getOrCreateKeyPair()/getThumbprint() and generates PKCE params then redirects to /oauth2/authorize directly; isLoggedIn delegates to DPoPManager.isLoggedIn in DPoP mode (not app.at_exp cookie) - SDKCore.test.ts: add DPoP-mode describe block with mocked DPoPManager and Pkce (jsdom lacks crypto.subtle); all existing cookie-mode tests unaffected - e2e/dpop-smoke.test.ts: replace local generatePkce() helper with shared Pkce module; add Tier 0 tests exercising SDKCore.startLogin() in DPoP mode end-to-end (no live FusionAuth required for Tier 0) - Export Pkce from packages/core/src/index.ts Note: yarn test:core cannot run in this sandbox environment due to a missing @rollup/rollup-linux-arm64-gnu native binary (arch mismatch); TypeScript compilation (tsc --noEmit) and ESLint/Prettier are clean. * fix: add @vitest-environment jsdom to SDKCore.test.ts; fix handlePreRedirect assertion Without the explicit jsdom annotation, vitest inherits the 'node' environment from DPoPManager.test.ts when the full suite runs, causing 'document is not defined' and 'window is not defined' failures in all SDKCore tests. Also corrects the handlePreRedirect spy assertion: cookie-mode startLogin() passes one argument (state), not two — the codeVerifier arg is only added in DPoP mode. * fix: suppress cookie console.error noise in Tier 0 e2e tests SDKCore's constructor calls scheduleTokenExpiration() which calls getAccessTokenExpirationMoment(). In a Node/Playwright process document doesn't exist, so CookieHelpers catches the ReferenceError and logs 'Error accessing cookies...' to console.error. The tests still pass, but the stderr noise is confusing. Fix: extract a shared DPOP_CONFIG constant in the Tier 0 describe block that includes a no-op cookieAdapter ({ at_exp: () => undefined }). This causes getAccessTokenExpirationMoment() to take the adapter path and skip document.cookie entirely, eliminating the noise. Also fixes T0-1 where the await core.startLogin() call was accidentally dropped during the previous config refactor. * feat: update lock file. * fix: update Angular onRedirect test to use 3-segment redirect-value format RedirectHelper now stores nonce:codeVerifier:state (three colon-delimited segments) instead of the previous nonce:state (two segments). The Angular sdkcore/ directory is generated by 'yarn get-sdk-core' which copies packages/core/src/ verbatim — so in CI the Angular RedirectHelper picks up the updated parser automatically. The test was writing the old two-segment format 'abc123:/welcome-page', which the new parser splits as [nonce='abc123', codeVerifier='/welcome-page', state=''] — returning undefined for state instead of '/welcome-page'. Fix: write 'abc123::/welcome-page' (empty codeVerifier segment, matching cookie mode where no verifier is stored). * fix: update Vue and React onRedirect tests to use 3-segment redirect-value format RedirectHelper now stores nonce:codeVerifier:state (three colon-delimited segments) instead of nonce:state (two segments). Both sdk-vue and sdk-react import SDKCore directly from @fusionauth-sdk/core (via the @fusionauth-sdk/* tsconfig path alias), so their tests exercise the live, current RedirectHelper — same root cause as the earlier Angular fix. - packages/sdk-vue/src/createFusionAuth/createFusionAuth.test.ts: was seeding the old 2-segment format ('rAnd0mStR1ng:<state>'), causing the new state getter to return undefined instead of the expected state value. Fixed to 'rAnd0mStR1ng::<state>' (empty codeVerifier segment). - packages/sdk-react/src/components/providers/FusionAuthProvider.test.tsx: had the same stale 2-segment seed, but wasn't caught by CI because the assertion only checked toHaveBeenCalled() (no argument check). Fixed the seed format and strengthened the assertion to toHaveBeenCalledWith(stateValue) to restore real coverage of the callback argument. * fix: merge Request and init headers in DPoPManager.fetch() instead of dropping one (PR #202 review) _resolveHeaders() previously returned early with init.headers whenever it was present, silently discarding any headers already set on a Request object passed as input. This contradicted the _doFetch documentation's promise to never drop caller headers. _resolveHeaders() now returns a merged Headers object: init.headers is the base, and Request.headers are layered on top, winning on any conflicting header name. * feat: fix angular and vue tests. * fix: clone Request before retry in fetch() to avoid double body consumption (PR #202 Copilot review) fetch() previously passed the same input reference to both the initial attempt and the nonce-triggered retry. If input was a Request with a body, the first attempt consumed it, and the retry would throw a 'body already used' error instead of succeeding. - Clone the Request twice up front (before either is read from) so each attempt gets an independent, unconsumed body. Request.clone() safely tees any internal streaming body per spec, so this also covers a Request built with a ReadableStream body. - A raw ReadableStream passed via init.body (not wrapped in a Request) cannot be cloned this way. On retry, this now throws a clear, actionable error instead of letting native fetch throw an opaque one. * fix: normalize htu and htm in generateProof() per RFC 9449 (PR #202 Copilot review) generateProof() documented htu as being 'without query/fragment' but passed it through unmodified. fetch() supplies Request.url, which can include a query string, so proofs generated via dpopFetch() could carry an htu that includes query parameters — a subtle interop bug with strict DPoP verifiers. htm was also not normalised to uppercase, which most DPoP verifiers require. Both are now normalised inside generateProof() itself, so this is correct regardless of whether callers go through fetch() or call generateProof() directly with arbitrary casing/query strings. * fix: remove dead captured header variables and misleading comment in dpop-smoke.test.ts (PR #202 Copilot review) T2-1 declared capturedAuthHeader/capturedDpopHeader that were never assigned and only suppressed via void, alongside a comment claiming Playwright route interception captures DPoPManager.fetch()'s headers — no such interception exists since fetch() runs in the Node test process, not the browser page. Removed the dead variables and replaced the comment with an accurate explanation of how correctness is actually validated (end-to-end via FusionAuth's server-side verification, plus T2-2's direct proof decoding). * feat: update approvers. * test: add deterministic nonce-retry smoke test (T2-4) FusionAuth (as the Authorization Server) never issues a use_dpop_nonce challenge itself — per FusionAuth's DPoP docs, nonce enforcement is a Resource Server responsibility implemented by your own APIs, not something FusionAuth's own endpoints (e.g. /oauth2/userinfo) do. This is why the existing T2-3 test can only assert structurally ('either outcome is a pass') against a real FusionAuth instance. T2-4 adds a self-contained, deterministic test that mocks globalThis.fetch to simulate a Resource Server 401 response with a use_dpop_nonce challenge (WWW-Authenticate + DPoP-Nonce headers), then verifies: - exactly one retry occurs (not zero, not more than one) - the first proof has no nonce claim - the retried proof carries the exact server-issued nonce claim - both proofs target the same htu/htm Uses its own fresh DPoPManager (via the existing makeManager() helper) so it does not depend on shared state/order from the Tier 1 tests, and requires no live FusionAuth instance. * fix: revert startLogin() to void, address Copilot PR review comment (ENG-4786) Reverts SDKCore.startLogin()'s signature from 'async ... Promise<void>' back to plain 'void', matching the public SDKContext/framework-wrapper types exactly (SDKContext.ts, FusionAuthProviderContext.ts, Vue's FusionAuth<T>, Angular's SDKContext.ts all still declare startLogin: (state?) => void). Although tsc --noEmit already reported zero errors thanks to TypeScript's void-returning-function compatibility rule, the underlying concern was real: none of the three framework wrappers (React's useRedirecting, Vue's login(), Angular's startLogin()) awaited or caught the promise, so a DPoP async failure (e.g. crypto.subtle unavailable, IndexedDB blocked) would surface as an unhandled promise rejection. - SDKCore.ts: startLogin() is synchronous again. In DPoP mode it fires a new private async startDpopLogin() and catches failures via the new optional SDKConfig.onLoginFailure callback (falls back to console.error), following the existing onAutoRefreshFailure convention. Cookie mode is unchanged. - SDKConfig.ts: add onLoginFailure?: (error: Error) => void. - SDKCore.test.ts: DPoP startLogin() tests now call startLogin() without awaiting it and use vi.waitFor() to wait for window.location.assign before asserting. Added two new tests covering onLoginFailure and the console.error fallback. - e2e/tests/dpop-smoke.test.ts: added a createAssignWaiter() helper (a deferred promise resolved when window.location.assign is called) and reworked T0-1/T0-2/T0-3 to use it instead of awaiting startLogin() directly. T0-3 now explicitly waits for core1's redirect before swapping IndexedDB for core2, preserving the original sequential-completion guarantee that awaiting startLogin() used to provide implicitly. No changes needed to SDKContext.ts, FusionAuthProviderContext.ts, Vue's types, Angular's types/service, or any framework wrapper implementation — zero blast radius outside packages/core, as intended. * docs: fix stale/ambiguous state-reconstruction description in RedirectHelper.ts Addresses a Copilot PR review comment. The class-level doc comment said state is retrieved by joining segments 'after index 1 (skipping the verifier segment)' — phrasing left over from before the codeVerifier segment existed. The storage format is nonce:codeVerifier:state (3 segments), and the actual implementation (line 85) skips both the nonce (index 0) and codeVerifier (index 1) segments, with state starting at index 2 — not just 'the verifier segment' as the old wording implied. Doc-only change; no logic or test changes needed. * fix: preserve state from legacy 2-segment redirect values (Copilot PR review) RedirectHelper.state and getCodeVerifier() always assumed the current 3-segment storage format (nonce:codeVerifier:state). If a user initiates a login redirect on a pre-DPoP SDK version (which wrote the legacy 2-segment nonce:state format) and the app is upgraded to a newer SDK version before they land back — e.g. a deploy that happens while they're on FusionAuth's hosted login page — the leftover legacy value would be misparsed: state would resolve to undefined instead of the real value. Fix: detect the legacy format unambiguously. The current writer (handlePreRedirect) always includes a codeVerifier segment, even when empty, so any value it produces has at least two colons. A stored value with exactly one colon can therefore only be the legacy format. - state getter: if there are exactly 2 segments (1 colon), treat the second segment as the legacy state directly, instead of destructuring past index 1 (which only works for the 3-segment format). - getCodeVerifier(): same legacy-format guard, since a 2-segment value never carried a code_verifier — prevents misreading a fragment of a legacy state value as a verifier. - Documented (as a comment, not a test) the known acceptable limitation: a legacy state value that itself contained a colon is indistinguishable from a current-format value with a non-empty codeVerifier — an inherent ambiguity in a delimiter-based format without a version marker, accepted given the narrow redirect-round-trip window. - RedirectHelper.test.ts: added 4 tests seeding localStorage directly with the legacy format, covering handlePostRedirect's callback value (including empty legacy state), marker cleanup, and getCodeVerifier()'s undefined result. * feat: update comments. * feat: SDKCore: implement handlePostRedirect() authorization code exchange (ENG-4800) - UrlHelper.getTokenUrl() targets FusionAuth's /oauth2/token directly. - DPoPManager.getExpiresAt() exposes the stored token's expiry (-1 when none), mirroring CookieHelpers' convention. - SDKCore.handlePostRedirect() branches into handleDpopPostRedirect() in DPoP mode: detects the `code` query param, retrieves the persisted PKCE code_verifier, signs a DPoP proof for the token endpoint (no ath), POSTs the authorization_code grant, stores the returned tokens, and schedules token expiration + (when shouldAutoRefresh) auto-refresh from expiresAt. No-ops silently when code/code_verifier is missing (e.g. a second invocation after a successful exchange). Failures report via onLoginFailure/console.error, mirroring startLogin(). - SDKCore.at_exp generalized to delegate to DPoPManager.getExpiresAt() in DPoP mode so scheduling logic is shared between cookie and DPoP modes. - Unit tests for all of the above; mockWindowLocation extended to accept a search override for simulating the post-redirect landing. - e2e/tests/dpop-smoke.test.ts: extracted shared ensureNodeBrowserPolyfills() helper; updated T1-2 to drive the full authorization code grant through the real SDKCore.startLogin() + handlePostRedirect() against a live FusionAuth instance instead of replicating the exchange manually. * feat: remove references to ENG- linear issues. * feat: remove redundant comments. * feat: remove file not needed until adding end to end tests. * feat: remove lengthy comment. * feat: remote unnecessary comments. * feat: remove verbose comment. * feat: copilot review warnings. * feat: failing smoke test. * feat: minimize verbose comments. * feat: clean up comments. * feat: minimize verbose comments. * feat: copilot recommendation . * feat: cleanup comments. * feat: reduce commenting. * feat: remove verbose comment and non-browser functionality. * feat: only remove the code query string parameter from the DPoP mode callback after calling /oauth2/authorize. This matches the behavior in Hosted Backend mode.

* feat: add DPoP core storage layer (ENG-4782) - Add `dpop` v2.1.1 runtime dependency and `fake-indexeddb` devDependency to packages/core/package.json - SDKConfig: add optional `useDpop` and `dpopTokenStorage` fields - UrlHelper: add `getAuthorizeUrl(state?, dpopJkt?, codeChallenge?)` targeting FusionAuth /oauth2/authorize directly; update UrlHelperTypes to include response_type, code_challenge, code_challenge_method, dpop_jkt - DPoPStorage: IndexedDB abstraction for ES256 CryptoKeyPair persistence (db: fusionauth-sdk:dpop, store: keypair, keyed by clientId) - DPoPTokenStore: localStorage/memory token storage for DPoP-bound tokens (key: fusionauth-sdk:tokens:<clientId>); includes getAccessToken() and isExpired getter - packages/core/src/DPoP/index.ts re-exports both classes - 54 tests passing (21 DPoPTokenStore, 6 DPoPStorage, 16 UrlHelper, 7 SDKCore, 4 CookieHelpers) * feat: fix file formatting. * fix: DPoPStorage openDb() error handling and test coverage - Remove 'as any' cast in catch block — reject() accepts unknown directly - Add tests for indexedDB unavailable (SSR/non-browser): all three public methods (getKeyPair, setKeyPair, clearKeyPair) reject with a descriptive error - Add test for indexedDB.open() throwing synchronously (e.g. security policy block) * fix: fix copilot warnings. * fix: resolve DPoP transactions on tx.oncomplete, not req.onsuccess All three DPoPStorage methods (getKeyPair, setKeyPair, clearKeyPair) now resolve on tx.oncomplete and reject on tx.onerror / tx.onabort. Previously, resolving on req.onsuccess meant the caller was told 'success' before the transaction had fully committed — a transaction abort occurring after the request succeeded (e.g. quota exceeded) would go undetected. Applies the same fix consistently to all three methods, including getKeyPair (readonly, lower risk, but now consistent) and setKeyPair (readwrite, same durability concern as clearKeyPair). Adds a test that aborts a clearKeyPair transaction synchronously inside the request onsuccess handler and verifies the promise rejects and the key pair is still present in IndexedDB. * feat: the workflow will run regardless of the branch being merged into. * feat: implement DPoPManager central coordinator (ENG-4784) * feat: re-generate lock file. * feat: re-generate lock file. * feat: update lock file. * test: add DPoP smoke tests against real FusionAuth instance (pre-SDKCore) * feat: fix format and lint errors. * refactor: make DPoPStorage IndexedDB constants configurable via config object - Export DEFAULT_DPOP_DB_NAME, DEFAULT_DPOP_DB_VERSION, DEFAULT_DPOP_STORE_NAME as named constants (no hardcoded magic strings anywhere in the codebase) - Add DPoPStorageConfig interface with clientId (required) and optional dbName, dbVersion, storeName fields — each defaults to the exported constant - Refactor DPoPStorage constructor from positional (clientId: string) to config object, matching the UrlHelperConfig convention in this monorepo - openDb() and all three public methods now reference instance fields (this.dbName, this.dbVersion, this.storeName) instead of module constants - Add tests: defaults apply when no config overrides provided; custom dbName and storeName land data in the right database; two instances with different dbNames but the same clientId do not share keys; dbVersion downgrade produces a clean rejection (VersionError) - Update AGENTS.md: note the config-object constructor convention and the IndexedDB dbVersion must-only-increase constraint * feature: delete contrived test to intercept a successful even and then abort. * fix: update DPoPStorage constructor calls to use config object after ENG-4782 refactor * feature: update lock file * feat: implement SDKCore.startLogin() for DPoP authorization code grant (ENG-4786) - Add Pkce module (generateCodeVerifier, generateCodeChallenge) with RFC 7636 Appendix B test vector coverage; runs under @vitest-environment node - Extend RedirectHelper to persist code_verifier as a second colon-delimited segment alongside state; add public getCodeVerifier() getter; add test file - SDKCore: construct DPoPManager when config.useDpop is true; startLogin() is now async — DPoP branch calls getOrCreateKeyPair()/getThumbprint() and generates PKCE params then redirects to /oauth2/authorize directly; isLoggedIn delegates to DPoPManager.isLoggedIn in DPoP mode (not app.at_exp cookie) - SDKCore.test.ts: add DPoP-mode describe block with mocked DPoPManager and Pkce (jsdom lacks crypto.subtle); all existing cookie-mode tests unaffected - e2e/dpop-smoke.test.ts: replace local generatePkce() helper with shared Pkce module; add Tier 0 tests exercising SDKCore.startLogin() in DPoP mode end-to-end (no live FusionAuth required for Tier 0) - Export Pkce from packages/core/src/index.ts Note: yarn test:core cannot run in this sandbox environment due to a missing @rollup/rollup-linux-arm64-gnu native binary (arch mismatch); TypeScript compilation (tsc --noEmit) and ESLint/Prettier are clean. * fix: add @vitest-environment jsdom to SDKCore.test.ts; fix handlePreRedirect assertion Without the explicit jsdom annotation, vitest inherits the 'node' environment from DPoPManager.test.ts when the full suite runs, causing 'document is not defined' and 'window is not defined' failures in all SDKCore tests. Also corrects the handlePreRedirect spy assertion: cookie-mode startLogin() passes one argument (state), not two — the codeVerifier arg is only added in DPoP mode. * fix: suppress cookie console.error noise in Tier 0 e2e tests SDKCore's constructor calls scheduleTokenExpiration() which calls getAccessTokenExpirationMoment(). In a Node/Playwright process document doesn't exist, so CookieHelpers catches the ReferenceError and logs 'Error accessing cookies...' to console.error. The tests still pass, but the stderr noise is confusing. Fix: extract a shared DPOP_CONFIG constant in the Tier 0 describe block that includes a no-op cookieAdapter ({ at_exp: () => undefined }). This causes getAccessTokenExpirationMoment() to take the adapter path and skip document.cookie entirely, eliminating the noise. Also fixes T0-1 where the await core.startLogin() call was accidentally dropped during the previous config refactor. * feat: update lock file. * fix: update Angular onRedirect test to use 3-segment redirect-value format RedirectHelper now stores nonce:codeVerifier:state (three colon-delimited segments) instead of the previous nonce:state (two segments). The Angular sdkcore/ directory is generated by 'yarn get-sdk-core' which copies packages/core/src/ verbatim — so in CI the Angular RedirectHelper picks up the updated parser automatically. The test was writing the old two-segment format 'abc123:/welcome-page', which the new parser splits as [nonce='abc123', codeVerifier='/welcome-page', state=''] — returning undefined for state instead of '/welcome-page'. Fix: write 'abc123::/welcome-page' (empty codeVerifier segment, matching cookie mode where no verifier is stored). * fix: update Vue and React onRedirect tests to use 3-segment redirect-value format RedirectHelper now stores nonce:codeVerifier:state (three colon-delimited segments) instead of nonce:state (two segments). Both sdk-vue and sdk-react import SDKCore directly from @fusionauth-sdk/core (via the @fusionauth-sdk/* tsconfig path alias), so their tests exercise the live, current RedirectHelper — same root cause as the earlier Angular fix. - packages/sdk-vue/src/createFusionAuth/createFusionAuth.test.ts: was seeding the old 2-segment format ('rAnd0mStR1ng:<state>'), causing the new state getter to return undefined instead of the expected state value. Fixed to 'rAnd0mStR1ng::<state>' (empty codeVerifier segment). - packages/sdk-react/src/components/providers/FusionAuthProvider.test.tsx: had the same stale 2-segment seed, but wasn't caught by CI because the assertion only checked toHaveBeenCalled() (no argument check). Fixed the seed format and strengthened the assertion to toHaveBeenCalledWith(stateValue) to restore real coverage of the callback argument. * fix: merge Request and init headers in DPoPManager.fetch() instead of dropping one (PR #202 review) _resolveHeaders() previously returned early with init.headers whenever it was present, silently discarding any headers already set on a Request object passed as input. This contradicted the _doFetch documentation's promise to never drop caller headers. _resolveHeaders() now returns a merged Headers object: init.headers is the base, and Request.headers are layered on top, winning on any conflicting header name. * feat: fix angular and vue tests. * fix: clone Request before retry in fetch() to avoid double body consumption (PR #202 Copilot review) fetch() previously passed the same input reference to both the initial attempt and the nonce-triggered retry. If input was a Request with a body, the first attempt consumed it, and the retry would throw a 'body already used' error instead of succeeding. - Clone the Request twice up front (before either is read from) so each attempt gets an independent, unconsumed body. Request.clone() safely tees any internal streaming body per spec, so this also covers a Request built with a ReadableStream body. - A raw ReadableStream passed via init.body (not wrapped in a Request) cannot be cloned this way. On retry, this now throws a clear, actionable error instead of letting native fetch throw an opaque one. * fix: normalize htu and htm in generateProof() per RFC 9449 (PR #202 Copilot review) generateProof() documented htu as being 'without query/fragment' but passed it through unmodified. fetch() supplies Request.url, which can include a query string, so proofs generated via dpopFetch() could carry an htu that includes query parameters — a subtle interop bug with strict DPoP verifiers. htm was also not normalised to uppercase, which most DPoP verifiers require. Both are now normalised inside generateProof() itself, so this is correct regardless of whether callers go through fetch() or call generateProof() directly with arbitrary casing/query strings. * fix: remove dead captured header variables and misleading comment in dpop-smoke.test.ts (PR #202 Copilot review) T2-1 declared capturedAuthHeader/capturedDpopHeader that were never assigned and only suppressed via void, alongside a comment claiming Playwright route interception captures DPoPManager.fetch()'s headers — no such interception exists since fetch() runs in the Node test process, not the browser page. Removed the dead variables and replaced the comment with an accurate explanation of how correctness is actually validated (end-to-end via FusionAuth's server-side verification, plus T2-2's direct proof decoding). * feat: update approvers. * test: add deterministic nonce-retry smoke test (T2-4) FusionAuth (as the Authorization Server) never issues a use_dpop_nonce challenge itself — per FusionAuth's DPoP docs, nonce enforcement is a Resource Server responsibility implemented by your own APIs, not something FusionAuth's own endpoints (e.g. /oauth2/userinfo) do. This is why the existing T2-3 test can only assert structurally ('either outcome is a pass') against a real FusionAuth instance. T2-4 adds a self-contained, deterministic test that mocks globalThis.fetch to simulate a Resource Server 401 response with a use_dpop_nonce challenge (WWW-Authenticate + DPoP-Nonce headers), then verifies: - exactly one retry occurs (not zero, not more than one) - the first proof has no nonce claim - the retried proof carries the exact server-issued nonce claim - both proofs target the same htu/htm Uses its own fresh DPoPManager (via the existing makeManager() helper) so it does not depend on shared state/order from the Tier 1 tests, and requires no live FusionAuth instance. * fix: revert startLogin() to void, address Copilot PR review comment (ENG-4786) Reverts SDKCore.startLogin()'s signature from 'async ... Promise<void>' back to plain 'void', matching the public SDKContext/framework-wrapper types exactly (SDKContext.ts, FusionAuthProviderContext.ts, Vue's FusionAuth<T>, Angular's SDKContext.ts all still declare startLogin: (state?) => void). Although tsc --noEmit already reported zero errors thanks to TypeScript's void-returning-function compatibility rule, the underlying concern was real: none of the three framework wrappers (React's useRedirecting, Vue's login(), Angular's startLogin()) awaited or caught the promise, so a DPoP async failure (e.g. crypto.subtle unavailable, IndexedDB blocked) would surface as an unhandled promise rejection. - SDKCore.ts: startLogin() is synchronous again. In DPoP mode it fires a new private async startDpopLogin() and catches failures via the new optional SDKConfig.onLoginFailure callback (falls back to console.error), following the existing onAutoRefreshFailure convention. Cookie mode is unchanged. - SDKConfig.ts: add onLoginFailure?: (error: Error) => void. - SDKCore.test.ts: DPoP startLogin() tests now call startLogin() without awaiting it and use vi.waitFor() to wait for window.location.assign before asserting. Added two new tests covering onLoginFailure and the console.error fallback. - e2e/tests/dpop-smoke.test.ts: added a createAssignWaiter() helper (a deferred promise resolved when window.location.assign is called) and reworked T0-1/T0-2/T0-3 to use it instead of awaiting startLogin() directly. T0-3 now explicitly waits for core1's redirect before swapping IndexedDB for core2, preserving the original sequential-completion guarantee that awaiting startLogin() used to provide implicitly. No changes needed to SDKContext.ts, FusionAuthProviderContext.ts, Vue's types, Angular's types/service, or any framework wrapper implementation — zero blast radius outside packages/core, as intended. * docs: fix stale/ambiguous state-reconstruction description in RedirectHelper.ts Addresses a Copilot PR review comment. The class-level doc comment said state is retrieved by joining segments 'after index 1 (skipping the verifier segment)' — phrasing left over from before the codeVerifier segment existed. The storage format is nonce:codeVerifier:state (3 segments), and the actual implementation (line 85) skips both the nonce (index 0) and codeVerifier (index 1) segments, with state starting at index 2 — not just 'the verifier segment' as the old wording implied. Doc-only change; no logic or test changes needed. * fix: preserve state from legacy 2-segment redirect values (Copilot PR review) RedirectHelper.state and getCodeVerifier() always assumed the current 3-segment storage format (nonce:codeVerifier:state). If a user initiates a login redirect on a pre-DPoP SDK version (which wrote the legacy 2-segment nonce:state format) and the app is upgraded to a newer SDK version before they land back — e.g. a deploy that happens while they're on FusionAuth's hosted login page — the leftover legacy value would be misparsed: state would resolve to undefined instead of the real value. Fix: detect the legacy format unambiguously. The current writer (handlePreRedirect) always includes a codeVerifier segment, even when empty, so any value it produces has at least two colons. A stored value with exactly one colon can therefore only be the legacy format. - state getter: if there are exactly 2 segments (1 colon), treat the second segment as the legacy state directly, instead of destructuring past index 1 (which only works for the 3-segment format). - getCodeVerifier(): same legacy-format guard, since a 2-segment value never carried a code_verifier — prevents misreading a fragment of a legacy state value as a verifier. - Documented (as a comment, not a test) the known acceptable limitation: a legacy state value that itself contained a colon is indistinguishable from a current-format value with a non-empty codeVerifier — an inherent ambiguity in a delimiter-based format without a version marker, accepted given the narrow redirect-round-trip window. - RedirectHelper.test.ts: added 4 tests seeding localStorage directly with the legacy format, covering handlePostRedirect's callback value (including empty legacy state), marker cleanup, and getCodeVerifier()'s undefined result. * feat: update comments. * feat: SDKCore: implement handlePostRedirect() authorization code exchange (ENG-4800) - UrlHelper.getTokenUrl() targets FusionAuth's /oauth2/token directly. - DPoPManager.getExpiresAt() exposes the stored token's expiry (-1 when none), mirroring CookieHelpers' convention. - SDKCore.handlePostRedirect() branches into handleDpopPostRedirect() in DPoP mode: detects the `code` query param, retrieves the persisted PKCE code_verifier, signs a DPoP proof for the token endpoint (no ath), POSTs the authorization_code grant, stores the returned tokens, and schedules token expiration + (when shouldAutoRefresh) auto-refresh from expiresAt. No-ops silently when code/code_verifier is missing (e.g. a second invocation after a successful exchange). Failures report via onLoginFailure/console.error, mirroring startLogin(). - SDKCore.at_exp generalized to delegate to DPoPManager.getExpiresAt() in DPoP mode so scheduling logic is shared between cookie and DPoP modes. - Unit tests for all of the above; mockWindowLocation extended to accept a search override for simulating the post-redirect landing. - e2e/tests/dpop-smoke.test.ts: extracted shared ensureNodeBrowserPolyfills() helper; updated T1-2 to drive the full authorization code grant through the real SDKCore.startLogin() + handlePostRedirect() against a live FusionAuth instance instead of replicating the exchange manually. * feat: remove references to ENG- linear issues. * feat: remove redundant comments. * feat: remove file not needed until adding end to end tests. * feat: remove lengthy comment. * feat: remote unnecessary comments. * feat: remove verbose comment. * feat: copilot review warnings. * feat: failing smoke test. * feat: minimize verbose comments. * feat: clean up comments. * feat: minimize verbose comments. * feat: SDKCore - implement startLogout() and getAccessToken() for DPoP mode (ENG-4802) - startLogout() in DPoP mode now awaits DPoPManager.clear() (key pair, tokens, nonces) before redirecting, mirroring startLogin()'s fire-and-forget async pattern. Cookie mode is unchanged. - New DPoPManager.getAccessToken() delegate (mirrors getRefreshToken()). - New public SDKCore.getAccessToken(): returns the stored DPoP access token, or throws in cookie mode. - Unit tests for both in SDKCore.test.ts and DPoPManager.test.ts. - e2e dpop-smoke.test.ts: new startLogout() smoke test reusing the logged-in SDKCore from the authorization code grant test. * feat: rebuild the lock file. * feat: remove verbose comments. * feat: remove verbose comments. * feat: copilot recommendation . * feat: cleanup comments. * feat: reduce commenting. * feat: insure logout url is called. * feat: use hosted backend mode versus cookie mode in comments. * feat: remove verbose comments.

* feat: add DPoP core storage layer (ENG-4782) - Add `dpop` v2.1.1 runtime dependency and `fake-indexeddb` devDependency to packages/core/package.json - SDKConfig: add optional `useDpop` and `dpopTokenStorage` fields - UrlHelper: add `getAuthorizeUrl(state?, dpopJkt?, codeChallenge?)` targeting FusionAuth /oauth2/authorize directly; update UrlHelperTypes to include response_type, code_challenge, code_challenge_method, dpop_jkt - DPoPStorage: IndexedDB abstraction for ES256 CryptoKeyPair persistence (db: fusionauth-sdk:dpop, store: keypair, keyed by clientId) - DPoPTokenStore: localStorage/memory token storage for DPoP-bound tokens (key: fusionauth-sdk:tokens:<clientId>); includes getAccessToken() and isExpired getter - packages/core/src/DPoP/index.ts re-exports both classes - 54 tests passing (21 DPoPTokenStore, 6 DPoPStorage, 16 UrlHelper, 7 SDKCore, 4 CookieHelpers) * feat: fix file formatting. * fix: DPoPStorage openDb() error handling and test coverage - Remove 'as any' cast in catch block — reject() accepts unknown directly - Add tests for indexedDB unavailable (SSR/non-browser): all three public methods (getKeyPair, setKeyPair, clearKeyPair) reject with a descriptive error - Add test for indexedDB.open() throwing synchronously (e.g. security policy block) * fix: fix copilot warnings. * fix: resolve DPoP transactions on tx.oncomplete, not req.onsuccess All three DPoPStorage methods (getKeyPair, setKeyPair, clearKeyPair) now resolve on tx.oncomplete and reject on tx.onerror / tx.onabort. Previously, resolving on req.onsuccess meant the caller was told 'success' before the transaction had fully committed — a transaction abort occurring after the request succeeded (e.g. quota exceeded) would go undetected. Applies the same fix consistently to all three methods, including getKeyPair (readonly, lower risk, but now consistent) and setKeyPair (readwrite, same durability concern as clearKeyPair). Adds a test that aborts a clearKeyPair transaction synchronously inside the request onsuccess handler and verifies the promise rejects and the key pair is still present in IndexedDB. * feat: the workflow will run regardless of the branch being merged into. * feat: implement DPoPManager central coordinator (ENG-4784) * feat: re-generate lock file. * feat: re-generate lock file. * feat: update lock file. * test: add DPoP smoke tests against real FusionAuth instance (pre-SDKCore) * feat: fix format and lint errors. * refactor: make DPoPStorage IndexedDB constants configurable via config object - Export DEFAULT_DPOP_DB_NAME, DEFAULT_DPOP_DB_VERSION, DEFAULT_DPOP_STORE_NAME as named constants (no hardcoded magic strings anywhere in the codebase) - Add DPoPStorageConfig interface with clientId (required) and optional dbName, dbVersion, storeName fields — each defaults to the exported constant - Refactor DPoPStorage constructor from positional (clientId: string) to config object, matching the UrlHelperConfig convention in this monorepo - openDb() and all three public methods now reference instance fields (this.dbName, this.dbVersion, this.storeName) instead of module constants - Add tests: defaults apply when no config overrides provided; custom dbName and storeName land data in the right database; two instances with different dbNames but the same clientId do not share keys; dbVersion downgrade produces a clean rejection (VersionError) - Update AGENTS.md: note the config-object constructor convention and the IndexedDB dbVersion must-only-increase constraint * feature: delete contrived test to intercept a successful even and then abort. * fix: update DPoPStorage constructor calls to use config object after ENG-4782 refactor * feature: update lock file * feat: implement SDKCore.startLogin() for DPoP authorization code grant (ENG-4786) - Add Pkce module (generateCodeVerifier, generateCodeChallenge) with RFC 7636 Appendix B test vector coverage; runs under @vitest-environment node - Extend RedirectHelper to persist code_verifier as a second colon-delimited segment alongside state; add public getCodeVerifier() getter; add test file - SDKCore: construct DPoPManager when config.useDpop is true; startLogin() is now async — DPoP branch calls getOrCreateKeyPair()/getThumbprint() and generates PKCE params then redirects to /oauth2/authorize directly; isLoggedIn delegates to DPoPManager.isLoggedIn in DPoP mode (not app.at_exp cookie) - SDKCore.test.ts: add DPoP-mode describe block with mocked DPoPManager and Pkce (jsdom lacks crypto.subtle); all existing cookie-mode tests unaffected - e2e/dpop-smoke.test.ts: replace local generatePkce() helper with shared Pkce module; add Tier 0 tests exercising SDKCore.startLogin() in DPoP mode end-to-end (no live FusionAuth required for Tier 0) - Export Pkce from packages/core/src/index.ts Note: yarn test:core cannot run in this sandbox environment due to a missing @rollup/rollup-linux-arm64-gnu native binary (arch mismatch); TypeScript compilation (tsc --noEmit) and ESLint/Prettier are clean. * fix: add @vitest-environment jsdom to SDKCore.test.ts; fix handlePreRedirect assertion Without the explicit jsdom annotation, vitest inherits the 'node' environment from DPoPManager.test.ts when the full suite runs, causing 'document is not defined' and 'window is not defined' failures in all SDKCore tests. Also corrects the handlePreRedirect spy assertion: cookie-mode startLogin() passes one argument (state), not two — the codeVerifier arg is only added in DPoP mode. * fix: suppress cookie console.error noise in Tier 0 e2e tests SDKCore's constructor calls scheduleTokenExpiration() which calls getAccessTokenExpirationMoment(). In a Node/Playwright process document doesn't exist, so CookieHelpers catches the ReferenceError and logs 'Error accessing cookies...' to console.error. The tests still pass, but the stderr noise is confusing. Fix: extract a shared DPOP_CONFIG constant in the Tier 0 describe block that includes a no-op cookieAdapter ({ at_exp: () => undefined }). This causes getAccessTokenExpirationMoment() to take the adapter path and skip document.cookie entirely, eliminating the noise. Also fixes T0-1 where the await core.startLogin() call was accidentally dropped during the previous config refactor. * feat: update lock file. * fix: update Angular onRedirect test to use 3-segment redirect-value format RedirectHelper now stores nonce:codeVerifier:state (three colon-delimited segments) instead of the previous nonce:state (two segments). The Angular sdkcore/ directory is generated by 'yarn get-sdk-core' which copies packages/core/src/ verbatim — so in CI the Angular RedirectHelper picks up the updated parser automatically. The test was writing the old two-segment format 'abc123:/welcome-page', which the new parser splits as [nonce='abc123', codeVerifier='/welcome-page', state=''] — returning undefined for state instead of '/welcome-page'. Fix: write 'abc123::/welcome-page' (empty codeVerifier segment, matching cookie mode where no verifier is stored). * fix: update Vue and React onRedirect tests to use 3-segment redirect-value format RedirectHelper now stores nonce:codeVerifier:state (three colon-delimited segments) instead of nonce:state (two segments). Both sdk-vue and sdk-react import SDKCore directly from @fusionauth-sdk/core (via the @fusionauth-sdk/* tsconfig path alias), so their tests exercise the live, current RedirectHelper — same root cause as the earlier Angular fix. - packages/sdk-vue/src/createFusionAuth/createFusionAuth.test.ts: was seeding the old 2-segment format ('rAnd0mStR1ng:<state>'), causing the new state getter to return undefined instead of the expected state value. Fixed to 'rAnd0mStR1ng::<state>' (empty codeVerifier segment). - packages/sdk-react/src/components/providers/FusionAuthProvider.test.tsx: had the same stale 2-segment seed, but wasn't caught by CI because the assertion only checked toHaveBeenCalled() (no argument check). Fixed the seed format and strengthened the assertion to toHaveBeenCalledWith(stateValue) to restore real coverage of the callback argument. * fix: merge Request and init headers in DPoPManager.fetch() instead of dropping one (PR #202 review) _resolveHeaders() previously returned early with init.headers whenever it was present, silently discarding any headers already set on a Request object passed as input. This contradicted the _doFetch documentation's promise to never drop caller headers. _resolveHeaders() now returns a merged Headers object: init.headers is the base, and Request.headers are layered on top, winning on any conflicting header name. * feat: fix angular and vue tests. * fix: clone Request before retry in fetch() to avoid double body consumption (PR #202 Copilot review) fetch() previously passed the same input reference to both the initial attempt and the nonce-triggered retry. If input was a Request with a body, the first attempt consumed it, and the retry would throw a 'body already used' error instead of succeeding. - Clone the Request twice up front (before either is read from) so each attempt gets an independent, unconsumed body. Request.clone() safely tees any internal streaming body per spec, so this also covers a Request built with a ReadableStream body. - A raw ReadableStream passed via init.body (not wrapped in a Request) cannot be cloned this way. On retry, this now throws a clear, actionable error instead of letting native fetch throw an opaque one. * fix: normalize htu and htm in generateProof() per RFC 9449 (PR #202 Copilot review) generateProof() documented htu as being 'without query/fragment' but passed it through unmodified. fetch() supplies Request.url, which can include a query string, so proofs generated via dpopFetch() could carry an htu that includes query parameters — a subtle interop bug with strict DPoP verifiers. htm was also not normalised to uppercase, which most DPoP verifiers require. Both are now normalised inside generateProof() itself, so this is correct regardless of whether callers go through fetch() or call generateProof() directly with arbitrary casing/query strings. * fix: remove dead captured header variables and misleading comment in dpop-smoke.test.ts (PR #202 Copilot review) T2-1 declared capturedAuthHeader/capturedDpopHeader that were never assigned and only suppressed via void, alongside a comment claiming Playwright route interception captures DPoPManager.fetch()'s headers — no such interception exists since fetch() runs in the Node test process, not the browser page. Removed the dead variables and replaced the comment with an accurate explanation of how correctness is actually validated (end-to-end via FusionAuth's server-side verification, plus T2-2's direct proof decoding). * feat: update approvers. * test: add deterministic nonce-retry smoke test (T2-4) FusionAuth (as the Authorization Server) never issues a use_dpop_nonce challenge itself — per FusionAuth's DPoP docs, nonce enforcement is a Resource Server responsibility implemented by your own APIs, not something FusionAuth's own endpoints (e.g. /oauth2/userinfo) do. This is why the existing T2-3 test can only assert structurally ('either outcome is a pass') against a real FusionAuth instance. T2-4 adds a self-contained, deterministic test that mocks globalThis.fetch to simulate a Resource Server 401 response with a use_dpop_nonce challenge (WWW-Authenticate + DPoP-Nonce headers), then verifies: - exactly one retry occurs (not zero, not more than one) - the first proof has no nonce claim - the retried proof carries the exact server-issued nonce claim - both proofs target the same htu/htm Uses its own fresh DPoPManager (via the existing makeManager() helper) so it does not depend on shared state/order from the Tier 1 tests, and requires no live FusionAuth instance. * fix: revert startLogin() to void, address Copilot PR review comment (ENG-4786) Reverts SDKCore.startLogin()'s signature from 'async ... Promise<void>' back to plain 'void', matching the public SDKContext/framework-wrapper types exactly (SDKContext.ts, FusionAuthProviderContext.ts, Vue's FusionAuth<T>, Angular's SDKContext.ts all still declare startLogin: (state?) => void). Although tsc --noEmit already reported zero errors thanks to TypeScript's void-returning-function compatibility rule, the underlying concern was real: none of the three framework wrappers (React's useRedirecting, Vue's login(), Angular's startLogin()) awaited or caught the promise, so a DPoP async failure (e.g. crypto.subtle unavailable, IndexedDB blocked) would surface as an unhandled promise rejection. - SDKCore.ts: startLogin() is synchronous again. In DPoP mode it fires a new private async startDpopLogin() and catches failures via the new optional SDKConfig.onLoginFailure callback (falls back to console.error), following the existing onAutoRefreshFailure convention. Cookie mode is unchanged. - SDKConfig.ts: add onLoginFailure?: (error: Error) => void. - SDKCore.test.ts: DPoP startLogin() tests now call startLogin() without awaiting it and use vi.waitFor() to wait for window.location.assign before asserting. Added two new tests covering onLoginFailure and the console.error fallback. - e2e/tests/dpop-smoke.test.ts: added a createAssignWaiter() helper (a deferred promise resolved when window.location.assign is called) and reworked T0-1/T0-2/T0-3 to use it instead of awaiting startLogin() directly. T0-3 now explicitly waits for core1's redirect before swapping IndexedDB for core2, preserving the original sequential-completion guarantee that awaiting startLogin() used to provide implicitly. No changes needed to SDKContext.ts, FusionAuthProviderContext.ts, Vue's types, Angular's types/service, or any framework wrapper implementation — zero blast radius outside packages/core, as intended. * docs: fix stale/ambiguous state-reconstruction description in RedirectHelper.ts Addresses a Copilot PR review comment. The class-level doc comment said state is retrieved by joining segments 'after index 1 (skipping the verifier segment)' — phrasing left over from before the codeVerifier segment existed. The storage format is nonce:codeVerifier:state (3 segments), and the actual implementation (line 85) skips both the nonce (index 0) and codeVerifier (index 1) segments, with state starting at index 2 — not just 'the verifier segment' as the old wording implied. Doc-only change; no logic or test changes needed. * fix: preserve state from legacy 2-segment redirect values (Copilot PR review) RedirectHelper.state and getCodeVerifier() always assumed the current 3-segment storage format (nonce:codeVerifier:state). If a user initiates a login redirect on a pre-DPoP SDK version (which wrote the legacy 2-segment nonce:state format) and the app is upgraded to a newer SDK version before they land back — e.g. a deploy that happens while they're on FusionAuth's hosted login page — the leftover legacy value would be misparsed: state would resolve to undefined instead of the real value. Fix: detect the legacy format unambiguously. The current writer (handlePreRedirect) always includes a codeVerifier segment, even when empty, so any value it produces has at least two colons. A stored value with exactly one colon can therefore only be the legacy format. - state getter: if there are exactly 2 segments (1 colon), treat the second segment as the legacy state directly, instead of destructuring past index 1 (which only works for the 3-segment format). - getCodeVerifier(): same legacy-format guard, since a 2-segment value never carried a code_verifier — prevents misreading a fragment of a legacy state value as a verifier. - Documented (as a comment, not a test) the known acceptable limitation: a legacy state value that itself contained a colon is indistinguishable from a current-format value with a non-empty codeVerifier — an inherent ambiguity in a delimiter-based format without a version marker, accepted given the narrow redirect-round-trip window. - RedirectHelper.test.ts: added 4 tests seeding localStorage directly with the legacy format, covering handlePostRedirect's callback value (including empty legacy state), marker cleanup, and getCodeVerifier()'s undefined result. * feat: update comments. * feat: SDKCore: implement handlePostRedirect() authorization code exchange (ENG-4800) - UrlHelper.getTokenUrl() targets FusionAuth's /oauth2/token directly. - DPoPManager.getExpiresAt() exposes the stored token's expiry (-1 when none), mirroring CookieHelpers' convention. - SDKCore.handlePostRedirect() branches into handleDpopPostRedirect() in DPoP mode: detects the `code` query param, retrieves the persisted PKCE code_verifier, signs a DPoP proof for the token endpoint (no ath), POSTs the authorization_code grant, stores the returned tokens, and schedules token expiration + (when shouldAutoRefresh) auto-refresh from expiresAt. No-ops silently when code/code_verifier is missing (e.g. a second invocation after a successful exchange). Failures report via onLoginFailure/console.error, mirroring startLogin(). - SDKCore.at_exp generalized to delegate to DPoPManager.getExpiresAt() in DPoP mode so scheduling logic is shared between cookie and DPoP modes. - Unit tests for all of the above; mockWindowLocation extended to accept a search override for simulating the post-redirect landing. - e2e/tests/dpop-smoke.test.ts: extracted shared ensureNodeBrowserPolyfills() helper; updated T1-2 to drive the full authorization code grant through the real SDKCore.startLogin() + handlePostRedirect() against a live FusionAuth instance instead of replicating the exchange manually. * feat: remove references to ENG- linear issues. * feat: remove redundant comments. * feat: remove file not needed until adding end to end tests. * feat: remove lengthy comment. * feat: remote unnecessary comments. * feat: remove verbose comment. * feat: copilot review warnings. * feat: failing smoke test. * feat: minimize verbose comments. * feat: clean up comments. * feat: minimize verbose comments. * feat: SDKCore - implement startLogout() and getAccessToken() for DPoP mode (ENG-4802) - startLogout() in DPoP mode now awaits DPoPManager.clear() (key pair, tokens, nonces) before redirecting, mirroring startLogin()'s fire-and-forget async pattern. Cookie mode is unchanged. - New DPoPManager.getAccessToken() delegate (mirrors getRefreshToken()). - New public SDKCore.getAccessToken(): returns the stored DPoP access token, or throws in cookie mode. - Unit tests for both in SDKCore.test.ts and DPoPManager.test.ts. - e2e dpop-smoke.test.ts: new startLogout() smoke test reusing the logged-in SDKCore from the authorization code grant test. * feat: rebuild the lock file. * feat: remove verbose comments. * feat: remove verbose comments. * feat: SDKCore - implement refreshToken() for DPoP mode (ENG-4801) - refreshToken() branches to a new refreshDpopToken() when useDpop is enabled: reads the stored refresh token from DPoPManager, generates a DPoP proof for the token endpoint (no ath), POSTs grant_type=refresh_token to /oauth2/token with a DPoP header, updates DPoPManager's stored tokens on success, and reschedules token expiration / auto-refresh (gated on shouldAutoRefresh) from the new expiresAt. - Throws a descriptive error if no refresh token is stored. - Cookie-mode refreshToken() behavior is unchanged. - Adds unit tests covering the DPoP request shape, token update, error paths, and expiration/auto-refresh rescheduling. - Replaces the pre-SDKCore raw refresh-token-grant e2e smoke test with one that exercises SDKCore.refreshToken() directly against a live FusionAuth instance. * feat: refresh token grant * feat: remove verbose comments. * feat: copilot recommendation . * feat: cleanup comments. * feat: reduce commenting. * feat: insure logout url is called. * feat: use hosted backend mode versus cookie mode in comments. * feat: remove verbose comments. * feat: update from the last merge. * feat: remove comment verbosity. * feat: remove comment verbosity. * fix: address Copilot review comments on refreshDpopToken() (PR #206) - Preserve the existing refresh token when FusionAuth's refresh response omits refresh_token (no rotation), instead of clearing it out and breaking future refreshes. - Read the token response via response.clone().json() so the Response returned to callers still has an unconsumed body. - Test: mockTokenResponse() now returns a fresh Response per fetch() call via mockImplementation, avoiding a 'body already used' error when refreshToken() is invoked more than once in a test (e.g. explicit call + auto-refresh timer firing). - Test: add coverage for the no-rotation case, asserting the original refresh token is still used on a subsequent refresh. * feat: preserve the existing refresh token, if needed. * fix: dpop-smoke.test.ts refresh token test — undefined var + wrong order 'refresh token grant — issues new DPoP-bound tokens' had two compounding bugs after being resurrected via a merge: 1. test.skip(!refreshToken, ...) referenced a variable that was never declared in this file (ReferenceError). Every other test in the file uses the !accessToken skip-guard convention -- switch to that. 2. The test requires core to still be logged in (asserts core.isLoggedIn and calls core.refreshToken()), but it ran *after* 'startLogout() clears DPoP state...', which already logs core out. Move it back to run right after the authorization code grant test and before startLogout(), matching its actual dependency.

mrudatsprint added 18 commits July 15, 2026 19:13

feat: fix file formatting.

9f3e0bc

fix: fix copilot warnings.

d386a32

feat: the workflow will run regardless of the branch being merged into.

d91e5b7

feat: implement DPoPManager central coordinator (ENG-4784)

7eeb367

feat: re-generate lock file.

06a557e

feat: re-generate lock file.

00a0acb

feat: update lock file.

14b9b4a

Merge branches 'miker/eng-4784/central-coordinator' and 'miker/eng-47…

e9a8048

…84/central-coordinator' of github.com:FusionAuth/fusionauth-javascript-sdk into miker/eng-4784/central-coordinator

test: add DPoP smoke tests against real FusionAuth instance (pre-SDKC…

ec6372e

…ore)

feat: fix format and lint errors.

324d970

feature: delete contrived test to intercept a successful even and the…

b7e6feb

…n abort.

Merge branch 'miker/eng-4782/core-storage-layer' into miker/eng-4784/…

2c27865

…central-coordinator

fix: update DPoPStorage constructor calls to use config object after …

b5601e2

…ENG-4782 refactor

feature: update lock file

252322a

mrudatsprint commented Jul 17, 2026

View reviewed changes

Comment thread e2e/tests/dpop-smoke.test.ts

Comment thread packages/core/src/DPoP/DPoPManager.ts

mrudatsprint requested a review from Copilot July 18, 2026 20:28

Copilot started reviewing on behalf of mrudatsprint July 18, 2026 20:28 View session

Copilot AI reviewed Jul 18, 2026

View reviewed changes

Comment thread packages/core/src/DPoP/DPoPManager.ts

Comment thread packages/core/src/DPoP/DPoPManager.ts

Comment thread packages/core/src/DPoP/DPoPManager.ts

Comment thread packages/core/src/DPoP/DPoPManager.test.ts

Comment thread e2e/tests/dpop-smoke.test.ts Outdated

mrudatsprint added 5 commits July 20, 2026 13:54

feat: fix angular and vue tests.

b1567a6

mrudatsprint commented Jul 20, 2026

View reviewed changes

Comment thread packages/core/src/DPoP/DPoPManager.ts

Comment thread packages/core/src/DPoP/DPoPManager.ts

Comment thread packages/core/src/DPoP/DPoPManager.test.ts

Comment thread packages/core/src/DPoP/DPoPManager.test.ts

mrudatsprint marked this pull request as ready for review July 20, 2026 19:42

Base automatically changed from miker/eng-4782/core-storage-layer to parent/dpop-in-the-javascript-sdk July 20, 2026 19:49

mrudatsprint requested review from a team as code owners July 20, 2026 19:49

mrudatsprint added 2 commits July 20, 2026 13:51

feat: update approvers.

098bbfb

feat: fix merge conflict.

13db934

mrudatsprint requested a review from wied03 July 20, 2026 20:07

wied03 reviewed Jul 21, 2026

View reviewed changes

Comment thread packages/core/src/DPoP/DPoPManager.ts Outdated

Comment thread packages/core/src/DPoP/DPoPManager.ts

Comment thread packages/core/src/DPoP/DPoPManager.ts

Comment thread packages/core/src/DPoP/DPoPManager.test.ts Outdated

Comment thread e2e/tests/dpop-smoke.test.ts Outdated

feat: remove redundant comments.

5f517f0

mrudatsprint requested a review from wied03 July 22, 2026 14:09

wied03 approved these changes Jul 22, 2026

View reviewed changes

mrudatsprint merged commit 2ef92aa into parent/dpop-in-the-javascript-sdk Jul 22, 2026
4 checks passed

mrudatsprint deleted the miker/eng-4784/central-coordinator branch July 22, 2026 14:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Implement DPoPManager - central coordinator (ENG-4784) - #202

feat: Implement DPoPManager - central coordinator (ENG-4784)#202
mrudatsprint merged 26 commits into
parent/dpop-in-the-javascript-sdkfrom
miker/eng-4784/central-coordinator

mrudatsprint commented Jul 16, 2026 •

edited

Loading

Uh oh!

mrudatsprint left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wied03 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

mrudatsprint commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue:

Description:

Uh oh!

mrudatsprint left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wied03 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mrudatsprint commented Jul 16, 2026 •

edited

Loading