feat: add DPoP sender-constrained token support (RFC 9449)

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
       - name: 🛠️ Setup PHP
         uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
         with:
-          php-version: "8.1"
+          php-version: "8.3"
           tools: composer, cs2pr
 
       - name: 🔍 Validate composer.json and composer.lock

.github/workflows/phpunit.yml

@@ -14,7 +14,7 @@ jobs:
 
     strategy:
       matrix:
-        php-version: [8.1, 7.4]
+        php-version: [8.4, 8.3]
 
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

README.md

@@ -255,6 +255,32 @@ print_r($response);
 6. `DescopeSDK->getClaims($sessionToken)` - will return all of the claims from the JWT in an array format.
 7. `DescopeSDK->getUserDetails($refreshToken)` - will return all of the user information (email, phone, verification status, etc.) using a provided refresh token.
 
+### DPoP Sender-Constrained Tokens (RFC 9449)
+
+When a Descope session token contains a `cnf.jkt` claim it is DPoP-bound, meaning every request must include a signed `DPoP` proof JWT that demonstrates possession of the corresponding private key.
+
+Use `validateDPoP` **after** a successful `verify` call to enforce the sender-constraint:
+
+```php
+// 1. Verify the session token as usual
+$descopeSDK->verify($sessionToken);
+
+// 2. If the token is DPoP-bound, validate the DPoP proof
+//    (does nothing if the token has no cnf.jkt claim)
+$descopeSDK->validateDPoP(
+    $sessionToken,               // the verified session JWT
+    $_SERVER['HTTP_DPOP'] ?? '', // DPoP header sent by the client (empty string if absent)
+    $_SERVER['REQUEST_METHOD'],  // e.g. "GET" or "POST"
+    'https://example.com/api/resource'  // full request URL
+);
+```
+
+`validateDPoP` throws `\Descope\SDK\Exception\TokenException` if:
+
+- The session token is DPoP-bound but no proof is provided.
+- The proof signature, `htm` (method), `htu` (URL), `iat` (timestamp), or `ath` (access token hash) is invalid.
+- The proof key does not match the `cnf.jkt` thumbprint in the session token.
+
 ### User Management Functions
 
 Each of these functions have code examples on how to use them.

composer.json

@@ -15,7 +15,7 @@
     }
   ],
   "require": {
-    "php": "^7.3 || ^8.0",
+    "php": "^8.3",
     "guzzlehttp/guzzle": "7.9.2 as 7.9.3",
     "paragonie/constant_time_encoding": "2.8.2",
     "vlucas/phpdotenv": "^5.6.1"
@@ -34,7 +34,7 @@
       "ignore": ["PKSA-z3gr-8qht-p93v"]
     },
     "platform": {
-      "php": "7.3.0"
+      "php": "8.3.0"
     }
   },
   "scripts": {