feat(auth): add DPoP support

[kiraWangRuilong]

Summary

Add DPoP support for local bot and user credentials, including platform-backed non-exportable keys, persisted token/key binding, clock synchronization, and fail-closed request signing. Local profiles default to preferred; disabled and required are available through lark-cli config dpop.

Changes

• Add DPoP proof generation, transport binding, clock recovery, and encrypted key metadata storage.
• Add macOS Secure Enclave/Keychain, Windows CNG, Linux TPM, and encrypted software-file signer implementations.
• Bind UAT/TAT issuance, refresh, status, logout, and API requests to the selected DPoP key without Bearer downgrade for bound tokens.
• Add disabled, preferred, and required policy handling plus typed errors, diagnostics, Sidecar propagation, and README guidance.
• Preserve upstream credential/config read failures while restoring DPoP bindings after rebasing onto current main.

Test Plan

• Focused unit tests pass: go test ./internal/auth ./internal/identitydiag ./cmd/auth ./internal/credential ./internal/client ./cmd/config -count=1
• Canonical build passes: make build
• Static checks pass: make vet, make fmt-check
• Windows cross-compilation passes for internal/keychain, internal/auth, and internal/identitydiag
• Three-platform DPoP E2E validation completed before the final rebase:
  • macOS: signed L1/L2/L3 flows passed
  • Windows: default L2 and injected L3 passed; L1 unavailable because the host has no TPM
  • Linux: preferred/disabled Bearer behavior and injected L3 passed; L1 unavailable because /dev/tpmrm0 is absent

The final rebase only resolved overlap with upstream credential/config read-error propagation; the focused tests, build, vet, formatting, and Windows compilation checks were rerun afterward. Full three-platform E2E was not rerun after that rebase.

Known Boundaries

• required requires DPoP, not specifically L1.
• L3 is currently exercised through explicit signer registration; it is not an automatic default-CLI fallback.
• The current resource-server profile does not emit ath; strict RFC 9449 tests intentionally reject it.
• Real Lark/Feishu tenant interoperability and Windows/Linux L1 success on TPM-equipped hosts remain unverified.

Related Issues

• None

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 50.53922% with 1009 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.84%. Comparing base (4fddd6b) to head (b27cb47).

Files with missing lines	Patch %	Lines
internal/keysigner/signer_tpm_linux.go	4.60%	145 Missing ⚠️
internal/auth/uat_client.go	25.98%	110 Missing and 21 partials ⚠️
internal/dpop/store.go	59.57%	68 Missing and 46 partials ⚠️
internal/credential/tat_fetch.go	20.83%	88 Missing and 7 partials ⚠️
cmd/auth/login.go	15.55%	65 Missing and 11 partials ⚠️
internal/credential/default_provider.go	0.00%	72 Missing ⚠️
internal/dpop/dpop.go	73.43%	44 Missing and 28 partials ⚠️
internal/auth/token_store.go	28.91%	55 Missing and 4 partials ⚠️
internal/keysigner/signer_software.go	64.23%	26 Missing and 23 partials ⚠️
internal/auth/device_flow.go	56.88%	39 Missing and 8 partials ⚠️
... and 16 more

❌ Your patch check has failed because the patch coverage (50.53%) is below the target coverage (60.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2679      +/-   ##
==========================================
- Coverage   76.23%   75.84%   -0.40%     
==========================================
  Files        1120     1132      +12     
  Lines      127233   129149    +1916     
==========================================
+ Hits        96997    97948     +951     
- Misses      22429    23203     +774     
- Partials     7807     7998     +191     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

PR Quality Summary

The semantic review system could not produce a fully trusted result. This is not reported as a code defect.

System status

• semantic review degraded: model response decode failed (endpoint=https[:]//ark.cn-beijing.volces.com/api/plan/v3/chat/completions model=deepseek-v4-pro response_format=none attempt=3/3): model response content is empty — Action: inspect deterministic quality-gate diagnostics