Merge pull request #104 from prime-framework/bhalsey/eng-3572/rfc-section-4

add DPoPProofProvider

Author: bhalsey

build.savant

@@ -29,7 +29,7 @@ logbackVersion = "1.5.13"
 slf4jVersion = "2.0.13"
 testngVersion = "7.8.0"
 
-project(group: "org.primeframework", name: "prime-mvc", version: "5.8.1", licenses: ["ApacheV2_0"]) {
+project(group: "org.primeframework", name: "prime-mvc", version: "5.8.2", licenses: ["ApacheV2_0"]) {
   workflow {
     fetch {
       // Dependency resolution order:

src/test/java/org/example/action/HeaderValuesAction.java

@@ -45,4 +45,9 @@ public String get() {
     headers.putAll(httpRequest.getHeaders());
     return "success";
   }
+
+  public String post() {
+    headers.putAll(httpRequest.getHeaders());
+    return "success";
+  }
 }

src/test/java/org/primeframework/mvc/GlobalTest.java

@@ -15,6 +15,7 @@
  */
 package org.primeframework.mvc;
 
+import javax.annotation.Nullable;
 import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.IOException;
@@ -49,6 +50,7 @@
 import com.google.inject.Key;
 import com.google.inject.TypeLiteral;
 import freemarker.template.Configuration;
+import io.fusionauth.http.HTTPMethod;
 import io.fusionauth.http.HTTPValues.Headers;
 import io.fusionauth.http.HTTPValues.Methods;
 import org.example.action.JwtAuthorizedAction;
@@ -72,6 +74,7 @@
 import org.primeframework.mvc.security.CBCCipherProvider;
 import org.primeframework.mvc.security.DefaultEncryptor;
 import org.primeframework.mvc.security.Encryptor;
+import org.primeframework.mvc.test.DPoPProofProvider;
 import org.primeframework.mvc.util.URIBuilder;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.DataProvider;
@@ -1554,6 +1557,39 @@ public void headers() throws IOException {
         .assertJSONValuesAt("/foo", List.of("bar", "baz"));
   }
 
+  @Test
+  public void dpopHeader() throws IOException {
+    // Make sure DPoPProofProvider gets invoked with proper values
+    // (a real DPoPProofProvider would generate a signed JWT)
+    DPoPProofProvider provider = (httpMethod, htu, accessToken) -> httpMethod.toString() + ":" + htu + ":" + accessToken;
+
+    simulator.test("/header-values")
+        .withDPoPProofProvider(provider)
+        .get()
+        .assertStatusCode(200)
+        .assertJSONValuesAt("/dpop", List.of("GET:http://localhost:9080/header-values:null"));
+
+    simulator.test("/header-values")
+        .withDPoPProofProvider(provider)
+             .withAuthorizationBearerToken("fake.token")
+        .get()
+        .assertStatusCode(200)
+        .assertJSONValuesAt("/dpop", List.of("GET:http://localhost:9080/header-values:fake.token"));
+
+    simulator.test("/header-values")
+        .withDPoPProofProvider(provider)
+        .post()
+        .assertStatusCode(200)
+        .assertJSONValuesAt("/dpop", List.of("POST:http://localhost:9080/header-values:null"));
+
+    simulator.test("/header-values")
+        .withDPoPProofProvider(provider)
+        .withAuthorizationBearerToken("fake.token")
+        .post()
+        .assertStatusCode(200)
+        .assertJSONValuesAt("/dpop", List.of("POST:http://localhost:9080/header-values:fake.token"));
+  }
+
   @Test
   public void head() {
     simulator.test("/head")

src/test/java/org/primeframework/mvc/test/DPoPProofProvider.java

@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2025, Inversoft Inc., All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+package org.primeframework.mvc.test;
+
+import javax.annotation.Nullable;
+
+import io.fusionauth.http.HTTPMethod;
+
+/**
+ * Interface for generating DPoP Proofs. Allows one to plug in their
+ * own DPoP Proof generation to HTTP requests in a test framework.
+ */
+public interface DPoPProofProvider {
+  /**
+   * Generates a DPoP Proof.
+   * @param httpMethod  The HTTP Method. To be provided as the htm claim.
+   * @param htu         The HTTP URI. To be provided as the htu claim.
+   * @param accessToken (Optional) The access token. To be provided as the hashed ath claim.
+   * @return The DPoP Proof to be used in the DPoP header.
+   */
+  String generateDPoPProof(HTTPMethod httpMethod, String htu, @Nullable String accessToken);
+}

src/test/java/org/primeframework/mvc/test/RequestBuilder.java

@@ -54,6 +54,8 @@
 import io.fusionauth.http.HTTPValues.Headers;
 import io.fusionauth.http.server.HTTPRequest;
 import io.fusionauth.http.server.HTTPResponse;
+import io.fusionauth.jwks.domain.JSONWebKey;
+import io.fusionauth.jwt.Signer;
 import org.primeframework.mock.MockUserAgent;
 import org.primeframework.mvc.config.MVCConfiguration;
 import org.primeframework.mvc.http.FormBodyPublisher;
@@ -94,6 +96,10 @@ public class RequestBuilder {
 
   public boolean useTLS;
 
+  private String bearerToken;
+
+  private DPoPProofProvider dPoPProofProvider;
+
   private byte[] body;
 
   @Inject(optional = true)
@@ -328,6 +334,12 @@ public RequestBuilder usingHTTPS() {
     throw new IllegalStateException("This handling is not implemented yet");
   }
 
+  public RequestBuilder withAuthorizationBearerToken(String encodedJWT) {
+    this.bearerToken = encodedJWT;
+    request.setHeader("Authorization", "Bearer " + encodedJWT);
+    return this;
+  }
+
   /**
    * Adds an Authorization header to the request using the specified value.
    * <p>Shorthand for calling
@@ -491,15 +503,9 @@ public RequestBuilder withCookie(String name, String value) throws Exception {
     return withCookie(name, value, false, false);
   }
 
-  /**
-   * Encrypt the provided value and add a cookie with the encrypted value to the request
-   *
-   * @param name  The name of the cookie.
-   * @param value The unencrypted value of the cookie.
-   * @return This.
-   */
-  public RequestBuilder withEncryptedCookie(String name, String value) throws Exception {
-    return withCookie(name, value, false, true);
+  public RequestBuilder withDPoPProofProvider(DPoPProofProvider dPoPProofProvider) {
+    this.dPoPProofProvider = dPoPProofProvider;
+    return this;
   }
 
   /**
@@ -526,6 +532,17 @@ public RequestBuilder withEncoding(Charset encoding) {
     return this;
   }
 
+  /**
+   * Encrypt the provided value and add a cookie with the encrypted value to the request
+   *
+   * @param name  The name of the cookie.
+   * @param value The unencrypted value of the cookie.
+   * @return This.
+   */
+  public RequestBuilder withEncryptedCookie(String name, String value) throws Exception {
+    return withCookie(name, value, false, true);
+  }
+
   /**
    * Adds a file.
    *
@@ -825,6 +842,10 @@ HTTPResponseWrapper run() {
     request.setHost(requestURI.getHost());
     request.setScheme(requestURI.getScheme());
 
+    if (dPoPProofProvider != null) {
+      request.addHeader("DPoP", dPoPProofProvider.generateDPoPProof(request.getMethod(), requestURI.toString(), this.bearerToken));
+    }
+
     // Now that the cookies are ready, if the CSRF token is enabled and the parameter isn't set, we set it to be consistent
     // since the [@control.form] would normally set that into the form and into the request.
     if (request.getMethod() == HTTPMethod.POST) {
@@ -887,9 +908,12 @@ HTTPResponseWrapper run() {
     var requestBuilder = HttpRequest.newBuilder()
                                     .method(request.getMethod().name(), bodyPublisher);
 
-    if (!locales.isEmpty()) {
-      requestBuilder.setHeader("Accept-Language", locales.stream().map(Locale::toLanguageTag).collect(Collectors.joining(", ")));
+    if (locales.isEmpty()) {
+      // request.getLocale() returns a default locale if none are set by httpRequestConsumer but
+      // we still want to set to the system's default, if none were explicitly set.
+      locales = List.of(Locale.getDefault());
     }
+    requestBuilder.setHeader("Accept-Language", locales.stream().map(Locale::toLanguageTag).collect(Collectors.joining(", ")));
 
     if (contentType != null) {
       requestBuilder.setHeader(Headers.ContentType, contentType + (characterEncoding != null ? "; charset=" + characterEncoding : ""));