part #2

src/__Libraries/__Tests/StellaOps.Auth.Security.Tests/DpopValidationOptionsTests.cs

@@ -0,0 +1,70 @@
+using System;
+using StellaOps.Auth.Security.Dpop;
+using StellaOps.TestKit;
+using Xunit;
+
+namespace StellaOps.Auth.Security.Tests;
+
+public sealed class DpopValidationOptionsTests
+{
+    [Trait("Category", TestCategories.Unit)]
+    [Fact]
+    public void Validate_ThrowsWhenProofLifetimeNonPositive()
+    {
+        var options = new DpopValidationOptions
+        {
+            ProofLifetime = TimeSpan.Zero
+        };
+
+        Assert.Throws<InvalidOperationException>(() => options.Validate());
+    }
+
+    [Trait("Category", TestCategories.Unit)]
+    [Fact]
+    public void Validate_ThrowsWhenClockSkewOutOfRange()
+    {
+        var options = new DpopValidationOptions
+        {
+            AllowedClockSkew = TimeSpan.FromMinutes(6)
+        };
+
+        Assert.Throws<InvalidOperationException>(() => options.Validate());
+    }
+
+    [Trait("Category", TestCategories.Unit)]
+    [Fact]
+    public void Validate_ThrowsWhenReplayWindowNegative()
+    {
+        var options = new DpopValidationOptions
+        {
+            ReplayWindow = TimeSpan.FromSeconds(-1)
+        };
+
+        Assert.Throws<InvalidOperationException>(() => options.Validate());
+    }
+
+    [Trait("Category", TestCategories.Unit)]
+    [Fact]
+    public void Validate_ThrowsWhenAllowedAlgorithmsEmpty()
+    {
+        var options = new DpopValidationOptions();
+        options.AllowedAlgorithms.Clear();
+
+        Assert.Throws<InvalidOperationException>(() => options.Validate());
+    }
+
+    [Trait("Category", TestCategories.Unit)]
+    [Fact]
+    public void Validate_NormalizesAlgorithms()
+    {
+        var options = new DpopValidationOptions();
+        options.AllowedAlgorithms.Clear();
+        options.AllowedAlgorithms.Add(" es256 ");
+        options.AllowedAlgorithms.Add("Es384");
+
+        options.Validate();
+
+        Assert.Contains("ES256", options.NormalizedAlgorithms);
+        Assert.Contains("ES384", options.NormalizedAlgorithms);
+    }
+}

src/__Libraries/__Tests/StellaOps.Auth.Security.Tests/TASKS.md

@@ -13,3 +13,4 @@ Source of truth: `docs-archived/implplan/2025-12-29-csproj-audit/SPRINT_20251229
 | AUDIT-0785-A | DONE | Waived (test project; revalidated 2026-01-07). |
 | REMED-06 | DONE | SOLID review notes captured for SPRINT_20260130_002. |
 | REMED-08 | DONE | Split tests <= 100 lines; deterministic time/IDs; async naming; helper types separated; ConfigureAwait(false) skipped per xUnit1030; dotnet test passed 2026-02-02 (12 tests). |
+| REMED-05 | DONE | Added DpopValidationOptions unit coverage; dotnet test passed 2026-02-04 (20 tests). |