fix: classify DPoP endpoints from structured URLs #76

Merged

starsetbyte merged 1 commit from fix/dpop-url-classifier into feat/device-trust-foundation

2026-07-11 21:28:02 +00:00

starsetbyte commented

2026-07-11 21:03:41 +00:00

Owner

Continuation from density/P1 handoff

This branch picks up the DPoP classifier item documented in docs/plans/2026-07-11-density-pass-handoff.md.

Changes

Change DpopInterceptor.isPdsApiRequest() to accept structured HttpUrl.
Match /.well-known/ and /oauth/ exclusions against encodedPath only.
Match the PLC identity endpoint using exact host == plc.directory.
Preserve the existing exclusion-list policy and do not introduce path-positive matching.
Add regression fixtures for exclusion text in query parameters and lookalike PLC hosts.

Verification

./gradlew :app:testDebugUnitTest --tests com.peregrine.android.auth.oauth.DpopInterceptorTest --no-daemon
./gradlew :app:testDebugUnitTest :app:lintDebug :app:assembleDebug --no-daemon

Both completed with BUILD SUCCESSFUL.

## Continuation from density/P1 handoff This branch picks up the DPoP classifier item documented in `docs/plans/2026-07-11-density-pass-handoff.md`. ### Changes - Change `DpopInterceptor.isPdsApiRequest()` to accept structured `HttpUrl`. - Match `/.well-known/` and `/oauth/` exclusions against `encodedPath` only. - Match the PLC identity endpoint using exact `host == plc.directory`. - Preserve the existing exclusion-list policy and do not introduce path-positive matching. - Add regression fixtures for exclusion text in query parameters and lookalike PLC hosts. ### Verification - `./gradlew :app:testDebugUnitTest --tests com.peregrine.android.auth.oauth.DpopInterceptorTest --no-daemon` - `./gradlew :app:testDebugUnitTest :app:lintDebug :app:assembleDebug --no-daemon` Both completed with **BUILD SUCCESSFUL**.

starsetbyte added 2 commits

2026-07-11 21:03:41 +00:00