fix(sdk): correct disableDPoP flag and add eager DPoP key binding by marythought · Pull Request #883 · opentdf/web-sdk

marythought · 2026-03-17T00:26:46Z

Summary

Fixes the disableDPoP option being inverted in the OpenTDF constructor — !!disableDPoP coerced to boolean without negating, so disableDPoP: true was enabling DPoP
Wires dpopEnabled through to TDF3Client so the flag actually takes effect downstream
Adds a ready promise to OpenTDF that eagerly binds DPoP keys to the auth provider at construction time, so PlatformClient can make gRPC calls without waiting for a TDF operation first

Before

// disableDPoP: true silently enabled DPoP (inverted)
// dpopEnabled was never passed to TDF3Client (no-op)
// PlatformClient failed unless you manually bound keys:
await authProvider.updateClientPublicKey(await client.dpopKeys);

After

const client = new OpenTDF({ authProvider, platformUrl });
await client.ready; // DPoP keys bound to authProvider
const platform = new PlatformClient({ authProvider, platformUrl });
// gRPC calls work immediately

Test plan

Tests for disableDPoP → dpopEnabled mapping (true, false, omitted)
Tests for dpopEnabled propagation to tdf3Client
Tests for ready promise with DPoP enabled and disabled

Fixes #869
Fixes #881

🤖 Generated with Claude Code

`!!disableDPoP` coerces to boolean without negating, so `disableDPoP: true` was enabling DPoP. Change to `!disableDPoP`. Fixes #869 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

gemini-code-assist · 2026-03-17T00:26:59Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical bug in the OpenTDF constructor where the disableDPoP configuration option was inverted. Previously, passing disableDPoP: true would inadvertently enable DPoP due to incorrect boolean coercion. The fix ensures that DPoP is correctly disabled when the disableDPoP flag is set to true, aligning the SDK's behavior with the expected configuration.

Highlights

DPoP Configuration Fix: Corrected an inverted boolean logic in the OpenTDF constructor where the disableDPoP flag was not being applied as intended, leading to DPoP being enabled when it should have been disabled.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

lib/src/opentdf.ts
- Corrected the dpopEnabled assignment from !!disableDPoP to !disableDPoP to properly reflect the disableDPoP flag.

Activity

Provided a detailed summary of the fix and its impact.
Included a comprehensive test plan to verify the correction.
Linked to issue bug: disableDPoP flag is inverted in OpenTDF constructor #869, which this pull request resolves.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

…ctor Verifies that disableDPoP correctly negates to dpopEnabled for true, false, and omitted cases. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

gemini-code-assist

Code Review

This pull request correctly fixes the logic for the disableDPoP flag in the OpenTDF constructor. However, the fix is incomplete because the resulting dpopEnabled property is not used to configure the underlying tdf3Client. As a result, the disableDPoP flag remains ineffective. I've added a comment with more details on this issue.

The TDF3Client defaults dpopEnabled to true when dpopKeys are present, so passing dpopKeys without dpopEnabled: false meant the flag was silently ignored. Now we forward dpopEnabled and only pass dpopKeys when DPoP is enabled. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Ensures the dpopEnabled flag is correctly forwarded so that disableDPoP actually prevents DPoP usage downstream. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-03-17T00:31:18Z

X-Test Failure Report

opentdf-ctl
opentdf-sdk-lib

github-actions · 2026-03-17T00:33:28Z

X-Test Failure Report

opentdf-ctl
opentdf-sdk-lib

github-actions · 2026-03-17T00:33:47Z

X-Test Failure Report

opentdf-ctl
opentdf-sdk-lib

PlatformClient shares an authProvider with OpenTDF but has no way to trigger DPoP key binding itself. Previously, keys were only bound lazily during the first encrypt/decrypt operation, causing gRPC calls to fail if PlatformClient was used before any TDF operation. Now OpenTDF exposes a `ready` promise that resolves once keys are bound. Users can `await client.ready` before creating a PlatformClient. Fixes #881 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

marythought · 2026-03-17T00:42:37Z

/gemini review

gemini-code-assist

Code Review

This pull request correctly inverts the disableDPoP flag logic and introduces an eager DPoP key binding mechanism via a ready promise. The changes are well-supported by new tests. However, I've identified a significant issue where separate DPoP keys could be generated for OpenTDF and TDF3Client instances, leading to inconsistent behavior. I've provided a suggestion to unify the key generation and ensure both instances use the same key.

github-actions · 2026-03-17T00:44:53Z

X-Test Failure Report

✅ go-main
✅ go-v0.9.0
opentdf-ctl
opentdf-sdk-lib

…pair When dpopKeys is not provided, both OpenTDF and TDF3Client were independently generating key pairs, resulting in mismatched DPoP keys. Move dpopKeys initialization before TDF3Client construction so both share the same key pair. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-03-17T00:49:30Z

X-Test Failure Report

opentdf-ctl
opentdf-sdk-lib

…double binding - Add .catch() to prevent unhandled promise rejection when caller doesn't await ready; the error still surfaces via TDF3Client - Add comment explaining the benign double updateClientPublicKey call - Add test for ready rejection propagation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-03-17T00:52:51Z

X-Test Failure Report

opentdf-ctl
opentdf-sdk-lib

github-actions · 2026-03-17T01:21:46Z

X-Test Results

✅ js-main
✅ js-v0.9.0
✅ java-main
✅ java-v0.9.0
✅ go-main
✅ go-v0.9.0
opentdf-ctl
opentdf-sdk-lib

Resolve conflict in platform-client.mdx and replace manual updateClientPublicKey workaround with the new `await client.ready` pattern from opentdf/web-sdk#883 across all JS/TS code samples. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- PlatformClient auth interceptor now catches DPoP-related errors and throws a clear message directing users to `await client.ready` - OpenTDF ready.catch now logs a console.warn instead of silently swallowing DPoP key binding failures Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-03-17T16:34:32Z

X-Test Failure Report

✅ java-main
✅ go-main
✅ java-v0.9.0
✅ go-v0.9.0
opentdf-ctl
opentdf-sdk-lib

github-actions · 2026-03-17T16:45:38Z

X-Test Failure Report

opentdf-ctl
opentdf-sdk-lib

github-actions · 2026-03-17T17:15:17Z

X-Test Results

✅ js-main
✅ js-v0.9.0
✅ java-main
✅ go-main
✅ java-v0.9.0
✅ go-v0.9.0
opentdf-ctl
opentdf-sdk-lib

fix(sdk): correct inverted disableDPoP flag in OpenTDF constructor

68bd3b2

`!!disableDPoP` coerces to boolean without negating, so `disableDPoP: true` was enabling DPoP. Change to `!disableDPoP`. Fixes #869 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

marythought requested a review from a team as a code owner March 17, 2026 00:26

chore(sdk): add tests for disableDPoP flag mapping in OpenTDF constru…

cbfafaa

…ctor Verifies that disableDPoP correctly negates to dpopEnabled for true, false, and omitted cases. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

gemini-code-assist bot reviewed Mar 17, 2026

View reviewed changes

Comment thread lib/src/opentdf.ts

marythought and others added 2 commits March 16, 2026 17:30

chore(sdk): add tests verifying disableDPoP propagates to TDF3Client

d44e1f3

Ensures the dpopEnabled flag is correctly forwarded so that disableDPoP actually prevents DPoP usage downstream. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

marythought changed the title ~~fix(sdk): correct inverted disableDPoP flag in OpenTDF constructor~~ fix(sdk): correct disableDPoP flag and add eager DPoP key binding Mar 17, 2026

gemini-code-assist bot reviewed Mar 17, 2026

View reviewed changes

Comment thread lib/src/opentdf.ts

pflynn-virtru reviewed Mar 17, 2026

View reviewed changes

Comment thread lib/src/opentdf.ts Outdated

pflynn-virtru previously approved these changes Mar 17, 2026

View reviewed changes

eugenioenko reviewed Mar 17, 2026

View reviewed changes

Comment thread lib/src/opentdf.ts

marythought and others added 2 commits March 17, 2026 09:08

Merge branch 'main' into fix/invert-disable-dpop

f64f3f7

marythought dismissed pflynn-virtru’s stale review via 3860193 March 17, 2026 16:30

eugenioenko approved these changes Mar 17, 2026

View reviewed changes

Merge branch 'main' into fix/invert-disable-dpop

1e39b06

marythought merged commit bfb23f8 into main Mar 17, 2026
22 checks passed

marythought deleted the fix/invert-disable-dpop branch March 17, 2026 17:17

opentdf-automation bot mentioned this pull request Mar 17, 2026

chore(sdk): release sdk 0.12.0 #885

Merged

Conversation

marythought commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Before

After

Test plan

Uh oh!

gemini-code-assist bot commented Mar 17, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026

X-Test Failure Report

Uh oh!

github-actions bot commented Mar 17, 2026

X-Test Failure Report

Uh oh!

github-actions bot commented Mar 17, 2026

X-Test Failure Report

Uh oh!

marythought commented Mar 17, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026

X-Test Failure Report

Uh oh!

github-actions bot commented Mar 17, 2026

X-Test Failure Report

Uh oh!

github-actions bot commented Mar 17, 2026

X-Test Failure Report

Uh oh!

github-actions bot commented Mar 17, 2026

X-Test Results

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026

X-Test Failure Report

Uh oh!

github-actions bot commented Mar 17, 2026

X-Test Failure Report

Uh oh!

github-actions bot commented Mar 17, 2026

X-Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

marythought commented Mar 17, 2026 •

edited

Loading