up

src/__Libraries/StellaOps.Auth.Security/Dpop/MessagingDpopReplayCache.cs

@@ -0,0 +1,43 @@
+using StellaOps.Messaging.Abstractions;
+
+namespace StellaOps.Auth.Security.Dpop;
+
+/// <summary>
+/// DPoP replay cache backed by <see cref="IIdempotencyStore"/>.
+/// Supports any transport (InMemory, Valkey, PostgreSQL) via factory injection.
+/// </summary>
+public sealed class MessagingDpopReplayCache : IDpopReplayCache
+{
+    private readonly IIdempotencyStore _store;
+    private readonly TimeProvider _timeProvider;
+
+    public MessagingDpopReplayCache(
+        IIdempotencyStoreFactory storeFactory,
+        TimeProvider? timeProvider = null)
+    {
+        ArgumentNullException.ThrowIfNull(storeFactory);
+
+        _store = storeFactory.Create("dpop:replay");
+        _timeProvider = timeProvider ?? TimeProvider.System;
+    }
+
+    public async ValueTask<bool> TryStoreAsync(
+        string jwtId,
+        DateTimeOffset expiresAt,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(jwtId);
+
+        var now = _timeProvider.GetUtcNow();
+        var ttl = expiresAt - now;
+
+        if (ttl <= TimeSpan.Zero)
+        {
+            // Already expired, treat as valid to store (won't conflict)
+            return true;
+        }
+
+        var result = await _store.TryClaimAsync(jwtId, jwtId, ttl, cancellationToken).ConfigureAwait(false);
+        return result.IsFirstClaim;
+    }
+}