feat(auth): add DPoP support

[kiraWangRuilong]

Summary

Add DPoP support for local bot and user credentials, including platform-backed non-exportable keys, persisted token/key binding, clock synchronization, and fail-closed request signing. Local profiles default to preferred; disabled and required are available through lark-cli config dpop.

Changes

• Add DPoP proof generation, transport binding, clock recovery, and encrypted key metadata storage.
• Add macOS Secure Enclave/Keychain, Windows CNG, Linux TPM, and encrypted software-file signer implementations.
• Bind UAT/TAT issuance, refresh, status, logout, and API requests to the selected DPoP key without Bearer downgrade for bound tokens.
• Add disabled, preferred, and required policy handling plus typed errors, diagnostics, Sidecar propagation, and README guidance.
• Preserve upstream credential/config read failures while restoring DPoP bindings after rebasing onto current main.

Test Plan

• Focused unit tests pass: go test ./internal/auth ./internal/identitydiag ./cmd/auth ./internal/credential ./internal/client ./cmd/config -count=1
• Canonical build passes: make build
• Static checks pass: make vet, make fmt-check
• Windows cross-compilation passes for internal/keychain, internal/auth, and internal/identitydiag
• Three-platform DPoP E2E validation completed before the final rebase:
  • macOS: signed L1/L2/L3 flows passed
  • Windows: default L2 and injected L3 passed; L1 unavailable because the host has no TPM
  • Linux: preferred/disabled Bearer behavior and injected L3 passed; L1 unavailable because /dev/tpmrm0 is absent

The final rebase only resolved overlap with upstream credential/config read-error propagation; the focused tests, build, vet, formatting, and Windows compilation checks were rerun afterward. Full three-platform E2E was not rerun after that rebase.

Known Boundaries

• required requires DPoP, not specifically L1.
• L3 is currently exercised through explicit signer registration; it is not an automatic default-CLI fallback.
• The current resource-server profile does not emit ath; strict RFC 9449 tests intentionally reject it.
• Real Lark/Feishu tenant interoperability and Windows/Linux L1 success on TPM-equipped hosts remain unverified.

Related Issues

• None

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 49.90196% with 1022 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.06%. Comparing base (7264c59) to head (63a41f6).

Files with missing lines	Patch %	Lines
internal/keysigner/signer_tpm_linux.go	4.60%	145 Missing ⚠️
internal/auth/uat_client.go	25.98%	110 Missing and 21 partials ⚠️
internal/dpop/store.go	59.57%	68 Missing and 46 partials ⚠️
internal/credential/tat_fetch.go	20.83%	88 Missing and 7 partials ⚠️
cmd/auth/login.go	15.55%	65 Missing and 11 partials ⚠️
internal/credential/default_provider.go	0.00%	72 Missing ⚠️
internal/dpop/dpop.go	73.43%	44 Missing and 28 partials ⚠️
internal/auth/token_store.go	28.91%	55 Missing and 4 partials ⚠️
internal/keysigner/signer_software.go	63.50%	27 Missing and 23 partials ⚠️
internal/auth/device_flow.go	56.88%	39 Missing and 8 partials ⚠️
... and 16 more

❌ Your patch check has failed because the patch coverage (49.90%) is below the target coverage (60.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2679      +/-   ##
==========================================
- Coverage   76.46%   76.06%   -0.41%     
==========================================
  Files        1122     1134      +12     
  Lines      128352   130268    +1916     
==========================================
+ Hits        98144    99082     +938     
- Misses      22382    23163     +781     
- Partials     7826     8023     +197     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

PR Quality Summary

CI did not complete successfully. Use the failed check links below to decide whether this PR needs a code change or a rerun.

Failed checks

• unit-test — failure — details
• coverage — failure — details
• results — failure — details