fix(sdk): DSPX-4607 canonicalize DPoP headers and extract zipstream constants

[dmihalcik-virtru]

Part of the DSPX-4607 lint burndown, following the golangci-lint v2.13.2 bump (#3965). Branched from main, independent of the other burndown PRs.

What

12 findings in sdk:

7 × canonicalheader — cosmetic only

sdk/auth/oauth/oauth.go:74:17:  use "DPoP" instead of "dpop"
sdk/auth/oauth/oauth.go:166:36: use "DPoP-Nonce" instead of "dpop-nonce"
sdk/auth/token_adding_interceptor_test.go:204:44: use "Authorization" instead of "authorization"

No wire behaviour changes. http.Header's Set/Get/Values run every key through textproto.CanonicalMIMEHeaderKey, so "dpop", "DPoP" and "Dpop" all resolve to the same canonical Dpop entry and serialize identically. This is a readability fix, not a protocol fix.

Deliberately not touched: headers.Set("typ", "dpop+jwt") at oauth.go:241 — that's a JWT header, not an HTTP one.

2 → 3 × goconst in the zip segment writer

Reported: "segment" ×20 and "finalize" ×13. Extracted as errTypeSegment and opFinalize.

Also extracted opWriteSegment ("write-segment" ×7), which the linter didn't report: it first occurs on line 57 alongside "segment", and uniq-by-line: true collapses the two. Fixing only the reported pair would have surfaced it as a fresh finding on the next run.

2 × QF1012

builder.WriteString(fmt.Sprintf(...)) → fmt.Fprintf(&builder, ...) in the connect-wrapper generator. Verified byte-identical output: re-ran go run ./sdk/codegen, which rewrites all of sdk/sdkconnect/*.go, and jj status shows no change to any generated file.

1 × SA1019

kas_client_test.go sets the deprecated RewrapResponse.EntityWrappedKey. That's the entire point of the test — upgradeRewrapRequestV1 exists to translate that legacy field — so it's annotated rather than migrated.

Testing

$ cd sdk && golangci-lint run -c ../.golangci.yaml
0 issues.
$ go test ./...            # all pass
$ go test -run TestREADMECodeBlocks ./...
ok  	github.com/opentdf/platform/sdk	1.367s

Clean under both the current main config and the tuned config in #3968.

Given the DPoP surface, this is worth an xtest run before merge even though the header changes are provably cosmetic.

DSPX-4607 burndown index

• chore(ci): DSPX-4607 bump golangci-lint to v2.13.2 #3965 — golangci-lint v2.13.2 bump (merged)
• chore(ci): DSPX-4607 linter cfg: tune goconst; schema updates #3968 — .golangci.yaml goconst tuning + gomodguard_v2 migration (merged)
• Siblings: fix(cli): DSPX-4607 annotate deprecated Action.Value use in migration test #3969 (otdfctl), fix(kas): DSPX-4607 use snake_case slog key in rewrap test fake #3970 (service/kas), chore(core): DSPX-4607 drop stale lib/fixtures nolint directives and reuse keycloakBoolTrue #3971 (lib/fixtures), fix(examples): DSPX-4607 clear goconst and SA1019 lint findings #3974 (examples), fix(ci): DSPX-4607 clear tests-bdd goconst, gosec, nestif and sloglint findings #3975 (tests-bdd), fix(policy): DSPX-4607 clear sloglint and SA1019 lint findings #3977 (service/policy), fix(core): DSPX-4607 clear sloglint, goconst, nolintlint and SA1019 findings #3978 (service core)

[coderabbitai]

Warning

Review limit reached

Next included review available in 42 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 72f791d8-e6bb-4282-a541-f8985548cca3

📥 Commits

Reviewing files that changed from the base of the PR and between d5933ed and cedc25e.

📒 Files selected for processing (5)

• sdk/auth/oauth/oauth.go
• sdk/auth/token_adding_interceptor_test.go
• sdk/codegen/runner/generate.go
• sdk/internal/zipstream/segment_writer.go
• sdk/kas_client_test.go

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	255.925935ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	138.683579ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	430.22284ms
Throughput	232.44 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m0.356693736s
Average Latency	602.51314ms
Throughput	82.84 requests/second

[github-actions]

X-Test Results

✅ go@main-main
✅ go@pull-3973-pull-3973
✅ go@main-pull-3973
✅ go@main-v0.9.0
✅ java@main-pull-3973
cukes-report
✅ java@main-main
✅ go@pull-3973-main
bats-test-results
✅ go@pull-3973-v0.9.0
✅ js@main-pull-3973
✅ js@main-main
✅ js@main-v0.9.0
✅ java@main-v0.9.0
govulncheck-failure-3
opentdfplatformP516S2.dockerbuild
govulncheck-failure-8
govulncheck-failure-1

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	170.589471ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	96.543068ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	346.536819ms
Throughput	288.57 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.924617698s
Average Latency	458.099975ms
Throughput	108.87 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-main
bats-test-results
✅ go@main-pull-3973
✅ go@main-v0.9.0
✅ go@pull-3973-v0.9.0
✅ go@pull-3973-pull-3973
✅ go@pull-3973-main
✅ java@main-pull-3973
cukes-report
✅ js@main-main
✅ java@main-v0.9.0
✅ java@main-main
✅ js@main-pull-3973
✅ js@main-v0.9.0
opentdfplatform4JTIDN.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1