Lockspire.Protocol.FAPI20EnforcerPlug (lockspire v1.6.1)

Copy Markdown

Boundary fail-fast enforcer for FAPI 2.0 Security Profile.

When the effective security_profile is :fapi_2_0_security, this Plug rejects:

  • GET /authorize requests missing request_uri (the PAR mandate)
  • POST /token requests missing the dpop header (sender constraining)
  • GET-or-POST /userinfo requests missing the dpop header (resource access)

The Plug is exempt for /par (the PAR endpoint by definition has no request_uri) and bypasses any non-FAPI path. On unreachable ServerPolicy it fails CLOSED with 503.

Per-route dispatch table is in 41-02-PLAN.md.

Implementation Notes

  • For /userinfo, enforcement is header-shape only (DPoP header presence + Authorization scheme). No access token decode occurs in the Plug.
  • Per-client opt-in under global :none is supported. A per-client :none override under global :fapi_2_0_security is also supported.
  • The policy_fn opt in init/1 is used in tests to simulate policy unavailability. In production, pass [] or %{} and the default Repository.get_server_policy/0 function is used.