feat: Initialize Zastava Webhook service with TLS and Authority authentication

- Added Program.cs to set up the web application with Serilog for logging, health check endpoints, and a placeholder admission endpoint.
- Configured Kestrel server to use TLS 1.3 and handle client certificates appropriately.
- Created StellaOps.Zastava.Webhook.csproj with necessary dependencies including Serilog and Polly.
- Documented tasks in TASKS.md for the Zastava Webhook project, outlining current work and exit criteria for each task.

src/StellaOps.Auth.Security/Dpop/DpopProofValidator.cs

@@ -0,0 +1,258 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Linq;
+using System.Text.Json;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+
+namespace StellaOps.Auth.Security.Dpop;
+
+/// <summary>
+/// Validates DPoP proofs following RFC 9449.
+/// </summary>
+public sealed class DpopProofValidator : IDpopProofValidator
+{
+    private static readonly string ProofType = "dpop+jwt";
+    private readonly DpopValidationOptions options;
+    private readonly IDpopReplayCache replayCache;
+    private readonly TimeProvider timeProvider;
+    private readonly ILogger<DpopProofValidator>? logger;
+    private readonly JwtSecurityTokenHandler tokenHandler = new();
+
+    public DpopProofValidator(
+        IOptions<DpopValidationOptions> options,
+        IDpopReplayCache? replayCache = null,
+        TimeProvider? timeProvider = null,
+        ILogger<DpopProofValidator>? logger = null)
+    {
+        ArgumentNullException.ThrowIfNull(options);
+
+        var cloned = options.Value ?? throw new InvalidOperationException("DPoP options must be provided.");
+        cloned.Validate();
+
+        this.options = cloned;
+        this.replayCache = replayCache ?? NullReplayCache.Instance;
+        this.timeProvider = timeProvider ?? TimeProvider.System;
+        this.logger = logger;
+    }
+
+    public async ValueTask<DpopValidationResult> ValidateAsync(string proof, string httpMethod, Uri httpUri, string? nonce = null, CancellationToken cancellationToken = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(proof);
+        ArgumentException.ThrowIfNullOrWhiteSpace(httpMethod);
+        ArgumentNullException.ThrowIfNull(httpUri);
+
+        var now = timeProvider.GetUtcNow();
+
+        if (!TryDecodeSegment(proof, segmentIndex: 0, out var headerElement, out var headerError))
+        {
+            logger?.LogWarning("DPoP header decode failure: {Error}", headerError);
+            return DpopValidationResult.Failure("invalid_header", headerError ?? "Unable to decode header.");
+        }
+
+        if (!headerElement.TryGetProperty("typ", out var typElement) || !string.Equals(typElement.GetString(), ProofType, StringComparison.OrdinalIgnoreCase))
+        {
+            return DpopValidationResult.Failure("invalid_header", "DPoP proof missing typ=dpop+jwt header.");
+        }
+
+        if (!headerElement.TryGetProperty("alg", out var algElement))
+        {
+            return DpopValidationResult.Failure("invalid_header", "DPoP proof missing alg header.");
+        }
+
+        var algorithm = algElement.GetString()?.Trim().ToUpperInvariant();
+        if (string.IsNullOrEmpty(algorithm) || !options.NormalizedAlgorithms.Contains(algorithm))
+        {
+            return DpopValidationResult.Failure("invalid_header", "Unsupported DPoP algorithm.");
+        }
+
+        if (!headerElement.TryGetProperty("jwk", out var jwkElement))
+        {
+            return DpopValidationResult.Failure("invalid_header", "DPoP proof missing jwk header.");
+        }
+
+        JsonWebKey jwk;
+        try
+        {
+            jwk = new JsonWebKey(jwkElement.GetRawText());
+        }
+        catch (Exception ex)
+        {
+            logger?.LogWarning(ex, "Failed to parse DPoP jwk header.");
+            return DpopValidationResult.Failure("invalid_header", "DPoP proof jwk header is invalid.");
+        }
+
+        if (!TryDecodeSegment(proof, segmentIndex: 1, out var payloadElement, out var payloadError))
+        {
+            logger?.LogWarning("DPoP payload decode failure: {Error}", payloadError);
+            return DpopValidationResult.Failure("invalid_payload", payloadError ?? "Unable to decode payload.");
+        }
+
+        if (!payloadElement.TryGetProperty("htm", out var htmElement))
+        {
+            return DpopValidationResult.Failure("invalid_payload", "DPoP proof missing htm claim.");
+        }
+
+        var method = httpMethod.Trim().ToUpperInvariant();
+        if (!string.Equals(htmElement.GetString(), method, StringComparison.Ordinal))
+        {
+            return DpopValidationResult.Failure("invalid_payload", "DPoP htm does not match request method.");
+        }
+
+        if (!payloadElement.TryGetProperty("htu", out var htuElement))
+        {
+            return DpopValidationResult.Failure("invalid_payload", "DPoP proof missing htu claim.");
+        }
+
+        var normalizedHtu = NormalizeHtu(httpUri);
+        if (!string.Equals(htuElement.GetString(), normalizedHtu, StringComparison.Ordinal))
+        {
+            return DpopValidationResult.Failure("invalid_payload", "DPoP htu does not match request URI.");
+        }
+
+        if (!payloadElement.TryGetProperty("iat", out var iatElement) || iatElement.ValueKind is not JsonValueKind.Number)
+        {
+            return DpopValidationResult.Failure("invalid_payload", "DPoP proof missing iat claim.");
+        }
+
+        if (!payloadElement.TryGetProperty("jti", out var jtiElement) || jtiElement.ValueKind != JsonValueKind.String)
+        {
+            return DpopValidationResult.Failure("invalid_payload", "DPoP proof missing jti claim.");
+        }
+
+        long iatSeconds;
+        try
+        {
+            iatSeconds = iatElement.GetInt64();
+        }
+        catch (Exception)
+        {
+            return DpopValidationResult.Failure("invalid_payload", "DPoP proof iat claim is not a valid number.");
+        }
+
+        var issuedAt = DateTimeOffset.FromUnixTimeSeconds(iatSeconds).ToUniversalTime();
+        if (issuedAt - options.AllowedClockSkew > now)
+        {
+            return DpopValidationResult.Failure("invalid_token", "DPoP proof issued in the future.");
+        }
+
+        if (now - issuedAt > options.GetMaximumAge())
+        {
+            return DpopValidationResult.Failure("invalid_token", "DPoP proof expired.");
+        }
+
+        string? actualNonce = null;
+
+        if (nonce is not null)
+        {
+            if (!payloadElement.TryGetProperty("nonce", out var nonceElement) || nonceElement.ValueKind != JsonValueKind.String)
+            {
+                return DpopValidationResult.Failure("invalid_token", "DPoP proof missing nonce claim.");
+            }
+
+            actualNonce = nonceElement.GetString();
+
+            if (!string.Equals(actualNonce, nonce, StringComparison.Ordinal))
+            {
+                return DpopValidationResult.Failure("invalid_token", "DPoP nonce mismatch.");
+            }
+        }
+        else if (payloadElement.TryGetProperty("nonce", out var nonceElement) && nonceElement.ValueKind == JsonValueKind.String)
+        {
+            actualNonce = nonceElement.GetString();
+        }
+
+        var jwtId = jtiElement.GetString()!;
+
+        try
+        {
+            var parameters = new TokenValidationParameters
+            {
+                ValidateAudience = false,
+                ValidateIssuer = false,
+                ValidateLifetime = false,
+                ValidateTokenReplay = false,
+                RequireSignedTokens = true,
+                ValidateIssuerSigningKey = true,
+                IssuerSigningKey = jwk,
+                ValidAlgorithms = options.NormalizedAlgorithms.ToArray()
+            };
+
+            tokenHandler.ValidateToken(proof, parameters, out _);
+        }
+        catch (Exception ex)
+        {
+            logger?.LogWarning(ex, "DPoP proof signature validation failed.");
+            return DpopValidationResult.Failure("invalid_signature", "DPoP proof signature validation failed.");
+        }
+
+        if (!await replayCache.TryStoreAsync(jwtId, issuedAt + options.ReplayWindow, cancellationToken).ConfigureAwait(false))
+        {
+            return DpopValidationResult.Failure("replay", "DPoP proof already used.");
+        }
+
+        return DpopValidationResult.Success(jwk, jwtId, issuedAt, actualNonce);
+    }
+
+    private static string NormalizeHtu(Uri uri)
+    {
+        var builder = new UriBuilder(uri)
+        {
+            Fragment = null,
+            Query = null
+        };
+        return builder.Uri.ToString();
+    }
+
+    private static bool TryDecodeSegment(string token, int segmentIndex, out JsonElement element, out string? error)
+    {
+        element = default;
+        error = null;
+
+        var segments = token.Split('.');
+        if (segments.Length != 3)
+        {
+            error = "Token must contain three segments.";
+            return false;
+        }
+
+        if (segmentIndex < 0 || segmentIndex > 2)
+        {
+            error = "Segment index out of range.";
+            return false;
+        }
+
+        try
+        {
+            var json = Base64UrlEncoder.Decode(segments[segmentIndex]);
+            using var document = JsonDocument.Parse(json);
+            element = document.RootElement.Clone();
+            return true;
+        }
+        catch (Exception ex)
+        {
+            error = ex.Message;
+            return false;
+        }
+    }
+
+    private static class NullReplayCache
+    {
+        public static readonly IDpopReplayCache Instance = new Noop();
+
+        private sealed class Noop : IDpopReplayCache
+        {
+            public ValueTask<bool> TryStoreAsync(string jwtId, DateTimeOffset expiresAt, CancellationToken cancellationToken = default)
+            {
+                ArgumentException.ThrowIfNullOrWhiteSpace(jwtId);
+                return ValueTask.FromResult(true);
+            }
+        }
+    }
+}
+
+file static class DpopValidationOptionsExtensions
+{
+    public static TimeSpan GetMaximumAge(this DpopValidationOptions options)
+        => options.ProofLifetime + options.AllowedClockSkew;
+}

src/StellaOps.Auth.Security/Dpop/DpopValidationOptions.cs

@@ -0,0 +1,77 @@
+using System.Collections.Immutable;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace StellaOps.Auth.Security.Dpop;
+
+/// <summary>
+/// Configures acceptable algorithms and replay windows for DPoP proof validation.
+/// </summary>
+public sealed class DpopValidationOptions
+{
+    private readonly HashSet<string> allowedAlgorithms = new(StringComparer.Ordinal);
+
+    public DpopValidationOptions()
+    {
+        allowedAlgorithms.Add("ES256");
+        allowedAlgorithms.Add("ES384");
+    }
+
+    /// <summary>
+    /// Maximum age a proof is considered valid relative to <see cref="IssuedAt"/>.
+    /// </summary>
+    public TimeSpan ProofLifetime { get; set; } = TimeSpan.FromMinutes(2);
+
+    /// <summary>
+    /// Allowed clock skew when evaluating <c>iat</c>.
+    /// </summary>
+    public TimeSpan AllowedClockSkew { get; set; } = TimeSpan.FromSeconds(30);
+
+    /// <summary>
+    /// Duration a successfully validated proof is tracked to prevent replay.
+    /// </summary>
+    public TimeSpan ReplayWindow { get; set; } = TimeSpan.FromMinutes(5);
+
+    /// <summary>
+    /// Algorithms (JWA) permitted for DPoP proofs.
+    /// </summary>
+    public ISet<string> AllowedAlgorithms => allowedAlgorithms;
+
+    /// <summary>
+    /// Normalised, upper-case representation of allowed algorithms.
+    /// </summary>
+    public IReadOnlySet<string> NormalizedAlgorithms { get; private set; } = ImmutableHashSet<string>.Empty;
+
+    public void Validate()
+    {
+        if (ProofLifetime <= TimeSpan.Zero)
+        {
+            throw new InvalidOperationException("DPoP proof lifetime must be greater than zero.");
+        }
+
+        if (AllowedClockSkew < TimeSpan.Zero || AllowedClockSkew > TimeSpan.FromMinutes(5))
+        {
+            throw new InvalidOperationException("DPoP allowed clock skew must be between 0 seconds and 5 minutes.");
+        }
+
+        if (ReplayWindow < TimeSpan.Zero)
+        {
+            throw new InvalidOperationException("DPoP replay window must be greater than or equal to zero.");
+        }
+
+        if (allowedAlgorithms.Count == 0)
+        {
+            throw new InvalidOperationException("At least one allowed DPoP algorithm must be configured.");
+        }
+
+        NormalizedAlgorithms = allowedAlgorithms
+            .Select(static algorithm => algorithm.Trim().ToUpperInvariant())
+            .Where(static algorithm => algorithm.Length > 0)
+            .ToImmutableHashSet(StringComparer.Ordinal);
+
+        if (NormalizedAlgorithms.Count == 0)
+        {
+            throw new InvalidOperationException("Allowed DPoP algorithms cannot be empty after normalization.");
+        }
+    }
+}

src/StellaOps.Auth.Security/Dpop/DpopValidationResult.cs

@@ -0,0 +1,40 @@
+using Microsoft.IdentityModel.Tokens;
+
+namespace StellaOps.Auth.Security.Dpop;
+
+/// <summary>
+/// Represents the outcome of DPoP proof validation.
+/// </summary>
+public sealed class DpopValidationResult
+{
+    private DpopValidationResult(bool success, string? errorCode, string? errorDescription, SecurityKey? key, string? jwtId, DateTimeOffset? issuedAt, string? nonce)
+    {
+        IsValid = success;
+        ErrorCode = errorCode;
+        ErrorDescription = errorDescription;
+        PublicKey = key;
+        JwtId = jwtId;
+        IssuedAt = issuedAt;
+        Nonce = nonce;
+    }
+
+    public bool IsValid { get; }
+
+    public string? ErrorCode { get; }
+
+    public string? ErrorDescription { get; }
+
+    public SecurityKey? PublicKey { get; }
+
+    public string? JwtId { get; }
+
+    public DateTimeOffset? IssuedAt { get; }
+
+    public string? Nonce { get; }
+
+    public static DpopValidationResult Success(SecurityKey key, string jwtId, DateTimeOffset issuedAt, string? nonce)
+        => new(true, null, null, key, jwtId, issuedAt, nonce);
+
+    public static DpopValidationResult Failure(string code, string description)
+        => new(false, code, description, null, null, null, null);
+}

src/StellaOps.Auth.Security/Dpop/IDpopProofValidator.cs

@@ -0,0 +1,6 @@
+namespace StellaOps.Auth.Security.Dpop;
+
+public interface IDpopProofValidator
+{
+    ValueTask<DpopValidationResult> ValidateAsync(string proof, string httpMethod, Uri httpUri, string? nonce = null, CancellationToken cancellationToken = default);
+}

src/StellaOps.Auth.Security/Dpop/IDpopReplayCache.cs

@@ -0,0 +1,6 @@
+namespace StellaOps.Auth.Security.Dpop;
+
+public interface IDpopReplayCache
+{
+    ValueTask<bool> TryStoreAsync(string jwtId, DateTimeOffset expiresAt, CancellationToken cancellationToken = default);
+}

src/StellaOps.Auth.Security/Dpop/InMemoryDpopReplayCache.cs

@@ -0,0 +1,66 @@
+using System.Collections.Concurrent;
+
+namespace StellaOps.Auth.Security.Dpop;
+
+/// <summary>
+/// In-memory replay cache intended for single-process deployments or tests.
+/// </summary>
+public sealed class InMemoryDpopReplayCache : IDpopReplayCache
+{
+    private readonly ConcurrentDictionary<string, DateTimeOffset> entries = new(StringComparer.Ordinal);
+    private readonly TimeProvider timeProvider;
+
+    public InMemoryDpopReplayCache(TimeProvider? timeProvider = null)
+    {
+        this.timeProvider = timeProvider ?? TimeProvider.System;
+    }
+
+    public ValueTask<bool> TryStoreAsync(string jwtId, DateTimeOffset expiresAt, CancellationToken cancellationToken = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(jwtId);
+
+        var now = timeProvider.GetUtcNow();
+        RemoveExpired(now);
+
+        if (entries.TryAdd(jwtId, expiresAt))
+        {
+            return ValueTask.FromResult(true);
+        }
+
+        while (!cancellationToken.IsCancellationRequested)
+        {
+            if (!entries.TryGetValue(jwtId, out var existing))
+            {
+                if (entries.TryAdd(jwtId, expiresAt))
+                {
+                    return ValueTask.FromResult(true);
+                }
+
+                continue;
+            }
+
+            if (existing > now)
+            {
+                return ValueTask.FromResult(false);
+            }
+
+            if (entries.TryUpdate(jwtId, expiresAt, existing))
+            {
+                return ValueTask.FromResult(true);
+            }
+        }
+
+        return ValueTask.FromResult(false);
+    }
+
+    private void RemoveExpired(DateTimeOffset now)
+    {
+        foreach (var entry in entries)
+        {
+            if (entry.Value <= now)
+            {
+                entries.TryRemove(entry.Key, out _);
+            }
+        }
+    }
+}

src/StellaOps.Auth.Security/README.md

@@ -0,0 +1,3 @@
+# StellaOps.Auth.Security
+
+Shared sender-constraint helpers (DPoP proof validation, replay caches, future mTLS utilities) used by Authority, Scanner, Signer, and other StellaOps services.  This package centralises primitives so services remain deterministic while honouring proof-of-possession guarantees.

src/StellaOps.Auth.Security/StellaOps.Auth.Security.csproj

@@ -0,0 +1,37 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <LangVersion>preview</LangVersion>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+  </PropertyGroup>
+  <PropertyGroup>
+    <Description>Sender-constrained authentication primitives (DPoP, mTLS) shared across StellaOps services.</Description>
+    <PackageId>StellaOps.Auth.Security</PackageId>
+    <Authors>StellaOps</Authors>
+    <Company>StellaOps</Company>
+    <PackageTags>stellaops;dpop;mtls;oauth2;security</PackageTags>
+    <PackageLicenseExpression>AGPL-3.0-or-later</PackageLicenseExpression>
+    <PackageProjectUrl>https://stella-ops.org</PackageProjectUrl>
+    <RepositoryUrl>https://git.stella-ops.org/stella-ops.org/git.stella-ops.org</RepositoryUrl>
+    <RepositoryType>git</RepositoryType>
+    <PublishRepositoryUrl>true</PublishRepositoryUrl>
+    <EmbedUntrackedSources>true</EmbedUntrackedSources>
+    <IncludeSymbols>true</IncludeSymbols>
+    <SymbolPackageFormat>snupkg</SymbolPackageFormat>
+    <PackageReadmeFile>README.md</PackageReadmeFile>
+    <VersionPrefix>1.0.0-preview.1</VersionPrefix>
+  </PropertyGroup>
+  <ItemGroup>
+    <FrameworkReference Include="Microsoft.AspNetCore.App" />
+  </ItemGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.IdentityModel.Tokens" Version="7.2.0" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="7.2.0" />
+    <PackageReference Include="Microsoft.SourceLink.GitLab" Version="8.0.0" PrivateAssets="All" />
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="README.md" Pack="true" PackagePath="" />
+  </ItemGroup>
+</Project>