feat(resource): build a VerifyRequest from an http.Request

[osanderson]

Summary

This is the first library addition from the DevX review.

func VerifyRequestFromHTTP(r *http.Request, target *url.URL) VerifyRequest

It fills in every field of the VerifyRequest for r:

• Method;
• the Authorization header;
• every DPoP header (DPoPProofsFromHTTP, so Verify can still refuse more than one);
• the TLS client certificate (PeerCertificateFromHTTP).

Why. Seven call sites built the struct by hand. Leaving a field out still compiles, and then fails only for the clients that need it:

• the four DPoP demos left out PeerCertificate, which refuses every mTLS-bound token;
• payroll-run left out DPoPProofs;
• GETTING_STARTED had the same gap until docs: cover v0.42.0's features and add an examples overview #494.

The server's PushAuthorizationRequestFromHTTP and TokenEndpointRequestFromHTTP exist for exactly this reason; resource had the parts but not the whole.

The URL stays the caller's. target is this endpoint's own fixed external URL (what a DPoP proof's htu names), never one built from r.Host, which the client controls. For a route with path parameters, the doc says to copy a fixed origin and set Path from r.URL.Path, as decoupled-checkout does. target is copied, never aliased.

Adopted:

• all five demos with a resource server;
• cmd/conformance-as's UserInfo and accounts handlers;
• GETTING_STARTED's resource-server step, whose prose now explains what the constructor fills in and what it leaves to the caller.

Tests

• All fields are taken from the request, with both DPoP headers kept in order.
• The URL is the target, not the request's own host, and it doesn't alias target.
• No TLS, no target and no proofs give zero values.
• Other checks:
  • go test -race ./... and golangci-lint pass;
  • the five demo modules and cmd/conformance-as pass their tests and lint;
  • GETTING_STARTED's snippets still compile.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud