feat(DPoP): add API test

tests/api/run.sh

@@ -248,4 +248,28 @@ OPAQUE_HELPER_USERNAME="$username" \
 OPAQUE_HELPER_PASSWORD="$password" \
   "$OPAQUE_HELPER_BIN" || die "OPAQUE crypto handshake failed"
 
+# ── 6. DPoP wire protocol — the parts Hurl can't drive ──────────────────
+# Each proof carries a fresh jti, current iat, htm/htu matching the
+# exact request, an ES256 signature, and a threaded nonce — none of
+# which a declarative .hurl template can compute. See
+# `src/bin/dpop-hurl-helper.rs` for the scenario matrix (happy path,
+# wrong htm/htu/alg/typ, stale nonce, replay, malformed, fail-open
+# when the session is unbound). Runs against the SAME server target
+# the OPAQUE helper used — but the server config must set
+# `OXICLOUD_DPOP_MODE=opportunistic` (or `required`) or the middleware
+# is a pass-through and every failure scenario silently 200s.
+DPOP_HELPER_BIN="$REPO_ROOT/target/$BUILD_TARGET/dpop-hurl-helper"
+if [[ ! -x "$DPOP_HELPER_BIN" ]]; then
+  log "Building dpop-hurl-helper ($BUILD_TARGET)..."
+  case "$BUILD_TARGET" in
+    debug)   (cd "$REPO_ROOT" && cargo build           --bin dpop-hurl-helper 2>&1 | tail -n 20) || die "dpop-hurl-helper build failed" ;;
+    release) (cd "$REPO_ROOT" && cargo build --release --bin dpop-hurl-helper 2>&1 | tail -n 20) || die "dpop-hurl-helper build failed" ;;
+  esac
+fi
+log "Running DPoP wire-protocol helper..."
+DPOP_HELPER_BASE_URL="$base_url" \
+DPOP_HELPER_USERNAME="$username" \
+DPOP_HELPER_PASSWORD="$password" \
+  "$DPOP_HELPER_BIN" || die "DPoP wire-protocol test failed"
+
 log "All tests passed."

tests/common/server.env

@@ -145,3 +145,14 @@ OXICLOUD_AUTH_OPAQUE_KSF_MEMORY_KIB=8
 OXICLOUD_AUTH_OPAQUE_KSF_ITERATIONS=1
 OXICLOUD_AUTH_OPAQUE_KSF_PARALLELISM=1
 
+# DPoP (RFC 9449) — required mode surfaces every verifier /
+# nonce / replay bug as a hard 401 (opportunistic would swallow
+# some cases as warnings). Safe today because unbound sessions —
+# `session.dpop_jkt IS NULL`, which is where the test admin's
+# legacy-login lands — are still exempted at the middleware; the
+# session-level enforcement flip is Gate 9. Once that arrives,
+# every bind-time downgrade path also gets caught here without
+# a config change. `dpop-hurl-helper` needs this on or the
+# middleware is a pass-through and its scenarios all silently 200.
+OXICLOUD_DPOP_MODE=required
+