feat(oauth): DPoP binding enforcement on the JWT-bearer RS path (#118)

[windischb]

Sixth DPoP slice for #118, and the RS-side twin of #148. #148 enforced the DPoP cnf.jkt binding resource-server-side only for opaque reference tokens (the introspection path). A DPoP-bound JWT was still honoured as a plain bearer token — the sender constraint was never checked on the JwtBearer path. This closes that gap.

What changed

Two composable hooks in ModgudJwtBearerPostConfigure (both preserve any handler the host already set):

• OnMessageReceived — a DPoP-bound token is presented under the Authorization: DPoP … scheme, which JwtBearer's Bearer-only extraction ignores. ExtractDpopSchemeToken lifts the token out so the JWT actually gets validated. Plain Bearer requests are untouched.
• OnTokenValidated — EnforceBinding applies RFC 9449 §7.1: a validated token carrying cnf.jkt MUST arrive under the DPoP scheme with a valid proof whose key thumbprint matches (and whose ath binds the token); a bound token presented as bearer, or the DPoP scheme against an unbound token, is failed → 401. Runs before UserInfo enrichment.

The proof crypto reuses the shared DpopResourceValidator / DpopProofValidator core — identical to the introspection path. Only the JWT-specific glue is new, so no change to the duplicated crypto files (no keep-in-sync impact).

Tests

Modgud.Tests.Unit — the pure decision core EvaluateBinding is pinned across every branch:

token	scheme	proof	→ result
unbound	Bearer	—	Ok
unbound	DPoP	—	rejected (false assertion)
bound	Bearer	—	rejected (must use DPoP)
bound	DPoP	valid+matching	Ok
bound	DPoP	missing / wrong-url / wrong-ath / wrong-key	rejected

Plus ExtractDpopSchemeToken, TryGetBoundJkt (incl. non-jkt cnf like mTLS x5t#S256, and malformed cnf), and the OnTokenValidated → Fail wiring exercised on a real TokenValidatedContext. Full DPoP unit suite green (73).

Consistent with #148, coverage is the exhaustively-tested pure core + the wiring translation; the OnMessageReceived → ctx.Token lift is the standard JwtBearer custom-extraction pattern (same shape SignalR uses for its access_token query param).

Remaining #118 DPoP slices

DPoP-Nonce · refresh-token binding for public clients. The security-model.md "DPoP: Not supported" line gets updated in the final slice once the feature set is complete.

🤖 Generated with Claude Code