Skip to content

Implement OAuth pushed authorization requests (RFC 9126)#2642

Merged
jviotti merged 2 commits into
mainfrom
oauth-par
Jul 20, 2026
Merged

Implement OAuth pushed authorization requests (RFC 9126)#2642
jviotti merged 2 commits into
mainfrom
oauth-par

Conversation

@jviotti

@jviotti jviotti commented Jul 20, 2026

Copy link
Copy Markdown
Member

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

Review in cubic

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
@augmentcode

augmentcode Bot commented Jul 20, 2026

Copy link
Copy Markdown
🤖 Augment PR Summary

Summary: This PR implements OAuth 2.0 Pushed Authorization Requests (PAR) per RFC 9126.

Changes:

  • Added a PAR module (oauth_par.h/.cc) with builders for PAR request bodies and the reference-form authorization URL.
  • Introduced OAuthPARResponse as a lightweight JSON view over PAR responses (request_uri, expires_in).
  • Added helpers to mint request URIs and to construct PAR response JSON documents.
  • Implemented DPoP binding reconciliation for PAR requests (RFC 9449 §10.1) via oauth_par_dpop_binding.
  • Extended server metadata to support PAR discovery fields (pushed_authorization_request_endpoint, require_pushed_authorization_requests).
  • Updated build configuration (CMake) and umbrella include (oauth.h) to expose the new API.
  • Added unit tests covering request/URL building, parsing, response handling, request_uri generation, DPoP binding, and metadata emission/validation.

🤖 Was this summary useful? React with 👍 or 👎

@augmentcode augmentcode Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. 3 suggestions posted.

Fix All in Augment

Comment augment review to trigger a new review at any time.

oauth_append_form_parameter(sink, "dpop_jkt", request.dpop_jkt);
}

for (const auto &resource : request.resources) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oauth_build_par_request is documented as never emitting client_id/request_uri, but the request.resources/request.extra loops will still emit those names if the caller places them there, which could violate RFC 9126 and cause server-side rejection/leakage. Other locations where this applies: src/core/oauth/oauth_par.cc:73

Severity: medium

Generating Fix in Augment link...

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

config.scopes_supported);
// RFC 9126 Section 5: the default is false, so the flag is emitted only when
// the server requires pushed authorization requests
if (config.require_pushed_authorization_requests) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In oauth_make_server_metadata, require_pushed_authorization_requests can be true while pushed_authorization_request_endpoint is empty, which would advertise “PAR required” without an endpoint (likely an invalid discovery document). Consider validating this combination before emitting the flag.

Severity: medium

Generating Fix in Augment link...

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

/// ```
SOURCEMETA_CORE_OAUTH_EXPORT
auto oauth_parse_par_request(
const std::string_view body, std::string &storage,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oauth_parse_par_request decodes all parameters (including potentially client_secret-style ones mentioned in the doc) into a std::string storage arena, which may leave secrets in non-wiping memory. Is a SecureString-backed storage intended here (similar to revocation parsing), or should the API/docs constrain secrets from being parsed this way?

Severity: medium

Generating Fix in Augment link...

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark (macos/llvm)

Details
Benchmark suite Current: 0285b39 Previous: 7581b8c Ratio
Regex_Lower_S_Or_Upper_S_Asterisk 1.6115659229702588 ns/iter 2.021355727333721 ns/iter 0.80
Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar 1.6957032155694034 ns/iter 2.0239395816503394 ns/iter 0.84
Regex_Period_Asterisk 1.6155180944982122 ns/iter 1.9591132057386889 ns/iter 0.82
Regex_Group_Period_Asterisk_Group 1.6082897549551916 ns/iter 2.330775543716137 ns/iter 0.69
Regex_Period_Plus 1.9496457734483938 ns/iter 2.2963491775943528 ns/iter 0.85
Regex_Period 1.9402005297949325 ns/iter 2.28374402006403 ns/iter 0.85
Regex_Caret_Period_Plus_Dollar 1.936274641935102 ns/iter 2.140340317715122 ns/iter 0.90
Regex_Caret_Group_Period_Plus_Group_Dollar 2.1012582889822156 ns/iter 2.3685742629346254 ns/iter 0.89
Regex_Caret_Period_Asterisk_Dollar 1.6373231543627231 ns/iter 2.3293712397654422 ns/iter 0.70
Regex_Caret_Group_Period_Asterisk_Group_Dollar 1.7823838330448671 ns/iter 1.981649050113051 ns/iter 0.90
Regex_Caret_X_Hyphen 6.015385019763924 ns/iter 6.522100062103284 ns/iter 0.92
Regex_Period_Md_Dollar 16.354049189581453 ns/iter 20.332614407154654 ns/iter 0.80
Regex_Caret_Slash_Period_Asterisk 4.507098250619436 ns/iter 7.084772616572609 ns/iter 0.64
Regex_Caret_Period_Range_Dollar 1.9494909877249627 ns/iter 2.5093316310141263 ns/iter 0.78
Regex_Nested_Backtrack 24.986720478365147 ns/iter 34.26836210689075 ns/iter 0.73
JSON_Array_Of_Objects_Unique 335.7921338704715 ns/iter 452.461458936739 ns/iter 0.74
JSON_Parse_1 6365.372383626251 ns/iter 9079.85401615265 ns/iter 0.70
JSON_Parse_Real 6417.994793744559 ns/iter 8068.7801597974 ns/iter 0.80
JSON_Parse_Decimal 7075.941251958328 ns/iter 8779.265214718824 ns/iter 0.81
JSON_Parse_Schema_ISO_Language 4008387.5698310398 ns/iter 5351242.604838776 ns/iter 0.75
JSON_Parse_Integer 4526.198766285091 ns/iter 5856.024883324709 ns/iter 0.77
JSON_Parse_String_NonSSO_Plain 6939.9653244611 ns/iter 8968.267433261863 ns/iter 0.77
JSON_Parse_String_SSO_Plain 2676.4225770299904 ns/iter 3447.4874081238704 ns/iter 0.78
JSON_Parse_String_Escape_Heavy 21096.414038654915 ns/iter 24515.57425450588 ns/iter 0.86
JSON_Parse_Object_Short_Keys 7922.330700389465 ns/iter 9345.642652350067 ns/iter 0.85
JSON_Parse_Object_Scalar_Properties 4155.890705765073 ns/iter 5368.701595757198 ns/iter 0.77
JSON_Parse_Object_Array_Properties 6746.6971487277715 ns/iter 8600.347814399907 ns/iter 0.78
JSON_Parse_Object_Object_Properties 6927.802080722283 ns/iter 9814.42199775518 ns/iter 0.71
JSON_Parse_Nested_Containers 57389.12749626109 ns/iter 71964.67402901176 ns/iter 0.80
JSON_From_String_Copy 22.106656910932944 ns/iter 29.597068219831137 ns/iter 0.75
JSON_From_String_Temporary 18.33920279473458 ns/iter 23.094255926879327 ns/iter 0.79
JSON_Number_To_Double 33.346822081306925 ns/iter 38.42033009834244 ns/iter 0.87
JSON_Object_At_Last_Key/8 3.871080993457326 ns/iter 4.619076609782827 ns/iter 0.84
JSON_Object_At_Last_Key/32 11.937986851671367 ns/iter 13.137221179161974 ns/iter 0.91
JSON_Object_At_Last_Key/128 52.29339655132026 ns/iter 60.240553165468086 ns/iter 0.87
JSON_Object_At_Last_Key/512 191.91342834208263 ns/iter 211.89073492698844 ns/iter 0.91
JSON_Fast_Hash_Helm_Chart_Lock 56.0013281514421 ns/iter 65.35569470484693 ns/iter 0.86
JSON_Equality_Helm_Chart_Lock 149.52880833022516 ns/iter 155.18052388459935 ns/iter 0.96
JSON_Divisible_By_Decimal 190.0458827221551 ns/iter 184.82687412083416 ns/iter 1.03
JSON_String_Equal/10 7.75601442554394 ns/iter 7.701700998107811 ns/iter 1.01
JSON_String_Equal/100 7.386454546016075 ns/iter 7.801156719596839 ns/iter 0.95
JSON_String_Equal_Small_By_Perfect_Hash/10 0.3655120531711213 ns/iter 0.3548235406646821 ns/iter 1.03
JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10 3.1998835052079273 ns/iter 3.3876885016663687 ns/iter 0.94
JSON_String_Fast_Hash/10 2.3502432354886706 ns/iter 3.6523437653901487 ns/iter 0.64
JSON_String_Fast_Hash/100 1.9340336227523134 ns/iter 2.7372261331772707 ns/iter 0.71
JSON_String_Key_Hash/10 1.645787353994362 ns/iter 1.8522357654187611 ns/iter 0.89
JSON_String_Key_Hash/100 2.0000060263600297 ns/iter 2.698994640508091 ns/iter 0.74
JSON_Object_Defines_Miss_Same_Length 2.600563132540143 ns/iter 2.6988862771754945 ns/iter 0.96
JSON_Object_Defines_Miss_Too_Small 2.5815994851653836 ns/iter 2.954381753080798 ns/iter 0.87
JSON_Object_Defines_Miss_Too_Large 2.5966912962503486 ns/iter 3.027333818748909 ns/iter 0.86
Pointer_Object_Traverse 22.702799735868137 ns/iter 27.57516348624494 ns/iter 0.82
Pointer_Object_Try_Traverse 22.079182149415818 ns/iter 26.3490704433295 ns/iter 0.84
Pointer_Push_Back_Pointer_To_Weak_Pointer 152.598065839489 ns/iter 187.51994003457662 ns/iter 0.81
Pointer_Walker_Schema_ISO_Language 2446620.9619383924 ns/iter 2908904.522267107 ns/iter 0.84
Pointer_Maybe_Tracked_Deeply_Nested/0 1251966.054312946 ns/iter 1365923.9764918354 ns/iter 0.92
Pointer_Maybe_Tracked_Deeply_Nested/1 964512.5431168146 ns/iter 1258562.7111111719 ns/iter 0.77
Pointer_Position_Tracker_Get_Deeply_Nested 322.5464471667773 ns/iter 361.7873181602423 ns/iter 0.89
JSONPath_Descendant_Filter_Nested 1199.5164448642024 ns/iter 1464.0795217283853 ns/iter 0.82
URITemplateRouter_Create 23343.5266406776 ns/iter 27951.191520067066 ns/iter 0.84
URITemplateRouter_Match 160.51698535990639 ns/iter 184.58157901885312 ns/iter 0.87
URITemplateRouter_Match_BasePath 188.1960288498319 ns/iter 216.07205529342744 ns/iter 0.87
URITemplateRouterView_Restore 9827.679422638814 ns/iter 12282.31338760501 ns/iter 0.80
URITemplateRouterView_Match 128.49378513178814 ns/iter 144.04618693971256 ns/iter 0.89
URITemplateRouterView_Match_BasePath 145.63600695323882 ns/iter 160.22904624207706 ns/iter 0.91
URITemplateRouterView_Arguments 528.9876702398918 ns/iter 695.9662175845942 ns/iter 0.76
JSONL_Parse_Large 9770777.194439182 ns/iter 14807783.811321778 ns/iter 0.66
JSONL_Parse_Large_GZIP 11287655.593754664 ns/iter 14573985.8749993 ns/iter 0.77
JSONLD_Catalog_Annotation_List_Populate 885128.5252382843 ns/iter 1013173.766816122 ns/iter 0.87
JSONLD_Catalog_Materialize 4218592.373493277 ns/iter 4759620.4379561 ns/iter 0.89
HTML_Build_Table_100000 34365374.99999304 ns/iter 40055949.57894381 ns/iter 0.86
HTML_Render_Table_100000 1555916.3647339854 ns/iter 1879335.011848454 ns/iter 0.83
GZIP_Compress_ISO_Language_Set_3_Locations 24932541.6785788 ns/iter 28246510.416669443 ns/iter 0.88
GZIP_Decompress_ISO_Language_Set_3_Locations 3065633.9517539283 ns/iter 3267612.873239859 ns/iter 0.94
GZIP_Compress_ISO_Language_Set_3_Schema 1475391.5655736832 ns/iter 1560973.4162896788 ns/iter 0.95
GZIP_Decompress_ISO_Language_Set_3_Schema 266438.3320653881 ns/iter 321420.9090543075 ns/iter 0.83
JOSE_VerifySignature_RS256 21210.24034026629 ns/iter 25616.962252058154 ns/iter 0.83
JOSE_VerifySignature_ES512 1066656.7669178953 ns/iter 1193702.1089631852 ns/iter 0.89

This comment was automatically generated by workflow using github-action-benchmark.

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 issues found across 9 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/core/oauth/include/sourcemeta/core/oauth_metadata.h">

<violation number="1" location="src/core/oauth/include/sourcemeta/core/oauth_metadata.h:269">
P1: Server metadata built from this config never publishes the new PAR endpoint, so PAR-capable servers cannot advertise it. Serialize this field as `pushed_authorization_request_endpoint` when non-empty in `oauth_make_server_metadata`.</violation>
</file>

<file name="src/core/oauth/include/sourcemeta/core/oauth_par.h">

<violation number="1" location="src/core/oauth/include/sourcemeta/core/oauth_par.h:42">
P1: Using any new PAR API will fail at link time: this PR adds exported declarations only, with no definitions. Add implementations for these symbols to the OAuth library and include them in its build target.</violation>
</file>

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread src/core/oauth/include/sourcemeta/core/oauth_metadata.h
/// The dynamic client registration endpoint (RFC 8414 Section 2).
std::string_view registration_endpoint;
/// The pushed authorization request endpoint (RFC 9126 Section 5).
std::string_view pushed_authorization_request_endpoint;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Server metadata built from this config never publishes the new PAR endpoint, so PAR-capable servers cannot advertise it. Serialize this field as pushed_authorization_request_endpoint when non-empty in oauth_make_server_metadata.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/core/oauth/include/sourcemeta/core/oauth_metadata.h, line 269:

<comment>Server metadata built from this config never publishes the new PAR endpoint, so PAR-capable servers cannot advertise it. Serialize this field as `pushed_authorization_request_endpoint` when non-empty in `oauth_make_server_metadata`.</comment>

<file context>
@@ -256,6 +265,8 @@ struct OAuthServerMetadataConfig {
   /// The dynamic client registration endpoint (RFC 8414 Section 2).
   std::string_view registration_endpoint;
+  /// The pushed authorization request endpoint (RFC 9126 Section 5).
+  std::string_view pushed_authorization_request_endpoint;
   /// The JWK Set document location (RFC 8414 Section 2).
   std::string_view jwks_uri;
</file context>

/// assert(std::string_view{body}.starts_with("response_type=code"));
/// ```
SOURCEMETA_CORE_OAUTH_EXPORT
auto oauth_build_par_request(const OAuthAuthorizationRequest &request,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Using any new PAR API will fail at link time: this PR adds exported declarations only, with no definitions. Add implementations for these symbols to the OAuth library and include them in its build target.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/core/oauth/include/sourcemeta/core/oauth_par.h, line 42:

<comment>Using any new PAR API will fail at link time: this PR adds exported declarations only, with no definitions. Add implementations for these symbols to the OAuth library and include them in its build target.</comment>

<file context>
@@ -0,0 +1,196 @@
+/// assert(std::string_view{body}.starts_with("response_type=code"));
+/// ```
+SOURCEMETA_CORE_OAUTH_EXPORT
+auto oauth_build_par_request(const OAuthAuthorizationRequest &request,
+                             SecureString &sink) -> void;
+
</file context>

Comment thread src/core/oauth/include/sourcemeta/core/oauth_metadata.h Outdated
Comment thread src/core/oauth/oauth_par.cc
Comment thread src/core/oauth/oauth_par.cc Outdated
Comment thread src/core/oauth/oauth_metadata.cc
Comment thread src/core/oauth/include/sourcemeta/core/oauth_par.h Outdated
Comment thread test/oauth/oauth_par_test.cc Outdated

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark (linux/gcc)

Details
Benchmark suite Current: 0285b39 Previous: 7581b8c Ratio
JOSE_VerifySignature_RS256 21304.244053867806 ns/iter 22323.004981199225 ns/iter 0.95
JOSE_VerifySignature_ES512 480408.0506849534 ns/iter 577672.8036304164 ns/iter 0.83
GZIP_Compress_ISO_Language_Set_3_Locations 26550372.49999955 ns/iter 36531677.57894799 ns/iter 0.73
GZIP_Decompress_ISO_Language_Set_3_Locations 3510104.837438667 ns/iter 4194828.161676178 ns/iter 0.84
GZIP_Compress_ISO_Language_Set_3_Schema 1821319.391644926 ns/iter 2028778.8309035138 ns/iter 0.90
GZIP_Decompress_ISO_Language_Set_3_Schema 337105.39301307057 ns/iter 374683.69662921346 ns/iter 0.90
HTML_Build_Table_100000 49942069.08332899 ns/iter 64283310.27272675 ns/iter 0.78
HTML_Render_Table_100000 2983026.0772534 ns/iter 1922626.4005524977 ns/iter 1.55
JSONLD_Catalog_Annotation_List_Populate 1175519.5317724631 ns/iter 1285175.3860293012 ns/iter 0.91
JSONLD_Catalog_Materialize 5925356.632478064 ns/iter 6681360.158877906 ns/iter 0.89
JSONL_Parse_Large 11334897.46774235 ns/iter 13098748.037734522 ns/iter 0.87
JSONL_Parse_Large_GZIP 12719704.472725755 ns/iter 14456171.395832958 ns/iter 0.88
URITemplateRouter_Create 25990.674976318016 ns/iter 30200.07990001548 ns/iter 0.86
URITemplateRouter_Match 138.5438335398354 ns/iter 149.90079341856986 ns/iter 0.92
URITemplateRouter_Match_BasePath 158.488071039709 ns/iter 172.47201376816636 ns/iter 0.92
URITemplateRouterView_Restore 3091.182923330591 ns/iter 8386.608074364025 ns/iter 0.37
URITemplateRouterView_Match 104.22393079514755 ns/iter 128.883332445361 ns/iter 0.81
URITemplateRouterView_Match_BasePath 123.92191962029835 ns/iter 147.153098189193 ns/iter 0.84
URITemplateRouterView_Arguments 423.493574144175 ns/iter 476.05503372069535 ns/iter 0.89
JSONPath_Descendant_Filter_Nested 1347.2382267976877 ns/iter 1735.8780293991979 ns/iter 0.78
Pointer_Object_Traverse 25.772339004979784 ns/iter 32.92261957423123 ns/iter 0.78
Pointer_Object_Try_Traverse 25.47689580871356 ns/iter 25.7625131215134 ns/iter 0.99
Pointer_Push_Back_Pointer_To_Weak_Pointer 138.31295462481543 ns/iter 154.0513696107115 ns/iter 0.90
Pointer_Walker_Schema_ISO_Language 2323335.840000027 ns/iter 2705359.0197629486 ns/iter 0.86
Pointer_Maybe_Tracked_Deeply_Nested/0 1834067.3753149305 ns/iter 1811890.4248023569 ns/iter 1.01
Pointer_Maybe_Tracked_Deeply_Nested/1 1676653.8503562426 ns/iter 1761950.3876543895 ns/iter 0.95
Pointer_Position_Tracker_Get_Deeply_Nested 423.98872012515164 ns/iter 396.77464587695977 ns/iter 1.07
JSON_Array_Of_Objects_Unique 388.61405074193675 ns/iter 468.74487754888025 ns/iter 0.83
JSON_Parse_1 8111.507819244465 ns/iter 9637.41069906822 ns/iter 0.84
JSON_Parse_Real 6430.388629613957 ns/iter 8015.5842199990475 ns/iter 0.80
JSON_Parse_Decimal 9210.222175311023 ns/iter 12982.311533468692 ns/iter 0.71
JSON_Parse_Schema_ISO_Language 5452650.992366279 ns/iter 6607878.603774078 ns/iter 0.83
JSON_Parse_Integer 4560.353873813001 ns/iter 5872.332665836843 ns/iter 0.78
JSON_Parse_String_NonSSO_Plain 9978.78667886225 ns/iter 12283.736525895009 ns/iter 0.81
JSON_Parse_String_SSO_Plain 4251.650837777125 ns/iter 5328.465327275001 ns/iter 0.80
JSON_Parse_String_Escape_Heavy 21733.88999631823 ns/iter 26075.34427387359 ns/iter 0.83
JSON_Parse_Object_Short_Keys 10779.35141099214 ns/iter 13551.437010634261 ns/iter 0.80
JSON_Parse_Object_Scalar_Properties 5620.379599923131 ns/iter 7012.901501784939 ns/iter 0.80
JSON_Parse_Object_Array_Properties 9864.12154680303 ns/iter 11944.765210275875 ns/iter 0.83
JSON_Parse_Object_Object_Properties 10041.686002520672 ns/iter 11935.945678633832 ns/iter 0.84
JSON_Parse_Nested_Containers 84487.44566624144 ns/iter 97895.73860944877 ns/iter 0.86
JSON_From_String_Copy 16.891280961531088 ns/iter 17.44716095637754 ns/iter 0.97
JSON_From_String_Temporary 13.596728801083742 ns/iter 15.044557395861814 ns/iter 0.90
JSON_Number_To_Double 21.823558275290235 ns/iter 20.60654400741583 ns/iter 1.06
JSON_Object_At_Last_Key/8 4.732310220746368 ns/iter 3.809865022496403 ns/iter 1.24
JSON_Object_At_Last_Key/32 12.721364020097372 ns/iter 12.355947287441895 ns/iter 1.03
JSON_Object_At_Last_Key/128 48.51376353805953 ns/iter 48.88855522856022 ns/iter 0.99
JSON_Object_At_Last_Key/512 203.8835699284794 ns/iter 359.3932741239736 ns/iter 0.57
JSON_Fast_Hash_Helm_Chart_Lock 64.59467181045345 ns/iter 78.10283174060442 ns/iter 0.83
JSON_Equality_Helm_Chart_Lock 125.78187464753205 ns/iter 147.95356760532334 ns/iter 0.85
JSON_Divisible_By_Decimal 236.65347593187641 ns/iter 250.0812436140888 ns/iter 0.95
JSON_String_Equal/10 5.166868551910939 ns/iter 5.373891459418168 ns/iter 0.96
JSON_String_Equal/100 6.6296800002355445 ns/iter 6.001406837951719 ns/iter 1.10
JSON_String_Equal_Small_By_Perfect_Hash/10 0.9350367083222799 ns/iter 0.6234464614983896 ns/iter 1.50
JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10 17.177975961197912 ns/iter 25.193904783361248 ns/iter 0.68
JSON_String_Fast_Hash/10 3.366812106964109 ns/iter 2.5690550784207886 ns/iter 1.31
JSON_String_Fast_Hash/100 3.369337918544195 ns/iter 2.615469370442679 ns/iter 1.29
JSON_String_Key_Hash/10 1.299392158984051 ns/iter 1.247181603139298 ns/iter 1.04
JSON_String_Key_Hash/100 12.996556682232665 ns/iter 12.44216743909656 ns/iter 1.04
JSON_Object_Defines_Miss_Same_Length 3.2182772543985187 ns/iter 3.1158602977179153 ns/iter 1.03
JSON_Object_Defines_Miss_Too_Small 3.278523239163941 ns/iter 3.1151480454865244 ns/iter 1.05
JSON_Object_Defines_Miss_Too_Large 3.0375275208948245 ns/iter 3.1160328032718483 ns/iter 0.97
Regex_Lower_S_Or_Upper_S_Asterisk 0.9686395815153623 ns/iter 0.6233473610274466 ns/iter 1.55
Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar 0.9575344938690832 ns/iter 0.6232013313466838 ns/iter 1.54
Regex_Period_Asterisk 0.9669502619084934 ns/iter 0.6229485921479758 ns/iter 1.55
Regex_Group_Period_Asterisk_Group 0.9661645052535561 ns/iter 0.6228680618199989 ns/iter 1.55
Regex_Period_Plus 0.9622948184245732 ns/iter 0.6227280011884103 ns/iter 1.55
Regex_Period 0.9714585474697466 ns/iter 0.6235087670960742 ns/iter 1.56
Regex_Caret_Period_Plus_Dollar 0.9580495582523194 ns/iter 0.6239776980212614 ns/iter 1.54
Regex_Caret_Group_Period_Plus_Group_Dollar 0.9566308150733185 ns/iter 0.6229612584764008 ns/iter 1.54
Regex_Caret_Period_Asterisk_Dollar 0.9584807167448988 ns/iter 0.6242118947594825 ns/iter 1.54
Regex_Caret_Group_Period_Asterisk_Group_Dollar 0.9679608793290615 ns/iter 0.623248060119843 ns/iter 1.55
Regex_Caret_X_Hyphen 3.3046232646846385 ns/iter 3.7407244662945525 ns/iter 0.88
Regex_Period_Md_Dollar 17.951017328304115 ns/iter 35.42158789640444 ns/iter 0.51
Regex_Caret_Slash_Period_Asterisk 3.3207281332960377 ns/iter 4.048169908525994 ns/iter 0.82
Regex_Caret_Period_Range_Dollar 1.579854762129721 ns/iter 1.2459269764289267 ns/iter 1.27
Regex_Nested_Backtrack 33.40156138939824 ns/iter 42.78421429568107 ns/iter 0.78

This comment was automatically generated by workflow using github-action-benchmark.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark (linux/llvm)

Details
Benchmark suite Current: 0285b39 Previous: 7581b8c Ratio
Regex_Lower_S_Or_Upper_S_Asterisk 2.836373878383949 ns/iter 2.199044093674072 ns/iter 1.29
Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar 2.4615451435348463 ns/iter 1.9087400203177127 ns/iter 1.29
Regex_Period_Asterisk 2.4619121120056016 ns/iter 1.9091012281373303 ns/iter 1.29
Regex_Group_Period_Asterisk_Group 2.811813479895066 ns/iter 2.1815065341818816 ns/iter 1.29
Regex_Period_Plus 4.220723142273031 ns/iter 3.276388997727305 ns/iter 1.29
Regex_Period 3.865665342392376 ns/iter 3.0065742624107337 ns/iter 1.29
Regex_Caret_Period_Plus_Dollar 3.8652838839711987 ns/iter 3.0060242727840683 ns/iter 1.29
Regex_Caret_Group_Period_Plus_Group_Dollar 4.217661719127834 ns/iter 3.2750864159579347 ns/iter 1.29
Regex_Caret_Period_Asterisk_Dollar 3.16295904517874 ns/iter 2.47640428939119 ns/iter 1.28
Regex_Caret_Group_Period_Asterisk_Group_Dollar 2.83841825922252 ns/iter 2.2011635189235306 ns/iter 1.29
Regex_Caret_X_Hyphen 5.624967079477499 ns/iter 5.190774456996379 ns/iter 1.08
Regex_Period_Md_Dollar 26.317659959074305 ns/iter 20.84697400937591 ns/iter 1.26
Regex_Caret_Slash_Period_Asterisk 7.739118121703445 ns/iter 5.460048049963805 ns/iter 1.42
Regex_Caret_Period_Range_Dollar 4.229601444511183 ns/iter 3.27876498635848 ns/iter 1.29
Regex_Nested_Backtrack 38.87590083989014 ns/iter 30.344642414402475 ns/iter 1.28
JSON_Array_Of_Objects_Unique 445.77422807058485 ns/iter 341.63725510746673 ns/iter 1.30
JSON_Parse_1 4790.821891143671 ns/iter 3772.1818591457363 ns/iter 1.27
JSON_Parse_Real 5295.616679453465 ns/iter 4115.910095146376 ns/iter 1.29
JSON_Parse_Decimal 7702.368674832697 ns/iter 5943.475808166351 ns/iter 1.30
JSON_Parse_Schema_ISO_Language 3595315.6358969766 ns/iter 2923844.3025206346 ns/iter 1.23
JSON_Parse_Integer 3923.040463561663 ns/iter 3037.2947060170854 ns/iter 1.29
JSON_Parse_String_NonSSO_Plain 5191.622889429209 ns/iter 4021.635483907345 ns/iter 1.29
JSON_Parse_String_SSO_Plain 2882.306782568686 ns/iter 2332.5783244140184 ns/iter 1.24
JSON_Parse_String_Escape_Heavy 15313.385426884144 ns/iter 11891.697002050314 ns/iter 1.29
JSON_Parse_Object_Short_Keys 8220.32056456246 ns/iter 6549.448068717027 ns/iter 1.26
JSON_Parse_Object_Scalar_Properties 4171.178282385523 ns/iter 3358.3460921901587 ns/iter 1.24
JSON_Parse_Object_Array_Properties 5713.142013942295 ns/iter 4451.865630904816 ns/iter 1.28
JSON_Parse_Object_Object_Properties 5639.819665662639 ns/iter 4404.182836801064 ns/iter 1.28
JSON_Parse_Nested_Containers 45716.04471217554 ns/iter 35716.877374786374 ns/iter 1.28
JSON_From_String_Copy 29.034657341678752 ns/iter 17.752518792672713 ns/iter 1.64
JSON_From_String_Temporary 20.755311271370672 ns/iter 15.577903846269045 ns/iter 1.33
JSON_Number_To_Double 22.975670293851767 ns/iter 17.727678809493074 ns/iter 1.30
JSON_Object_At_Last_Key/8 4.018692041258126 ns/iter 3.1411934563216763 ns/iter 1.28
JSON_Object_At_Last_Key/32 13.086750506976367 ns/iter 10.180383691393248 ns/iter 1.29
JSON_Object_At_Last_Key/128 47.151641955110414 ns/iter 43.42032697324081 ns/iter 1.09
JSON_Object_At_Last_Key/512 368.8023509823853 ns/iter 286.2206670162271 ns/iter 1.29
JSON_Fast_Hash_Helm_Chart_Lock 74.96508030161644 ns/iter 58.09131083723523 ns/iter 1.29
JSON_Equality_Helm_Chart_Lock 188.43329763405708 ns/iter 117.10720958314528 ns/iter 1.61
JSON_Divisible_By_Decimal 249.04061147147726 ns/iter 196.20376706962406 ns/iter 1.27
JSON_String_Equal/10 5.630587951692692 ns/iter 4.366909560445426 ns/iter 1.29
JSON_String_Equal/100 6.329635028168788 ns/iter 5.183624134185742 ns/iter 1.22
JSON_String_Equal_Small_By_Perfect_Hash/10 1.0547512815785833 ns/iter 0.8179912166584775 ns/iter 1.29
JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10 12.339167182576919 ns/iter 9.570157430818377 ns/iter 1.29
JSON_String_Fast_Hash/10 2.8131040132643537 ns/iter 2.183865725123412 ns/iter 1.29
JSON_String_Fast_Hash/100 2.8136889132102927 ns/iter 2.1836471947091045 ns/iter 1.29
JSON_String_Key_Hash/10 2.464562522321205 ns/iter 1.910235945854737 ns/iter 1.29
JSON_String_Key_Hash/100 8.083103513674478 ns/iter 6.271233241451771 ns/iter 1.29
JSON_Object_Defines_Miss_Same_Length 3.876050475565444 ns/iter 3.0012281483678667 ns/iter 1.29
JSON_Object_Defines_Miss_Too_Small 3.2033346577081616 ns/iter 2.473024470982723 ns/iter 1.30
JSON_Object_Defines_Miss_Too_Large 2.9352733006015908 ns/iter 2.2675766473222865 ns/iter 1.29
Pointer_Object_Traverse 30.642253183460586 ns/iter 23.95832429528098 ns/iter 1.28
Pointer_Object_Try_Traverse 33.0802972603237 ns/iter 25.77007406238908 ns/iter 1.28
Pointer_Push_Back_Pointer_To_Weak_Pointer 197.0171732338277 ns/iter 153.71249051089762 ns/iter 1.28
Pointer_Walker_Schema_ISO_Language 2750059.8622048628 ns/iter 2115800.8159508747 ns/iter 1.30
Pointer_Maybe_Tracked_Deeply_Nested/0 1262728.544303817 ns/iter 1004481.4167873 ns/iter 1.26
Pointer_Maybe_Tracked_Deeply_Nested/1 1663796.5568719304 ns/iter 1293911.3247233094 ns/iter 1.29
Pointer_Position_Tracker_Get_Deeply_Nested 707.8448910848225 ns/iter 567.513170110567 ns/iter 1.25
JSONPath_Descendant_Filter_Nested 1598.3661492772276 ns/iter 1242.7642444548949 ns/iter 1.29
URITemplateRouter_Create 30444.953990121972 ns/iter 23165.207986526166 ns/iter 1.31
URITemplateRouter_Match 175.54688362870533 ns/iter 129.32451892132184 ns/iter 1.36
URITemplateRouter_Match_BasePath 206.23186416917 ns/iter 156.1706705234874 ns/iter 1.32
URITemplateRouterView_Restore 10065.813377272525 ns/iter 7674.658583462442 ns/iter 1.31
URITemplateRouterView_Match 147.72259320522306 ns/iter 108.45728136089372 ns/iter 1.36
URITemplateRouterView_Match_BasePath 168.08851403305206 ns/iter 123.10847249372175 ns/iter 1.37
URITemplateRouterView_Arguments 449.9790078703769 ns/iter 363.5459622197544 ns/iter 1.24
JSONL_Parse_Large 9609573.479451682 ns/iter 7881222.62921344 ns/iter 1.22
JSONL_Parse_Large_GZIP 11456180.147541866 ns/iter 9191181.131578669 ns/iter 1.25
JSONLD_Catalog_Annotation_List_Populate 1285895.400365697 ns/iter 985571.2280454366 ns/iter 1.30
JSONLD_Catalog_Materialize 4439199.493590014 ns/iter 3335144.0809524106 ns/iter 1.33
HTML_Build_Table_100000 69342372.99999495 ns/iter 55275079.53845893 ns/iter 1.25
HTML_Render_Table_100000 5012396.834532613 ns/iter 4411443.578616122 ns/iter 1.14
GZIP_Compress_ISO_Language_Set_3_Locations 35657041.89999792 ns/iter 27550123.5999991 ns/iter 1.29
GZIP_Decompress_ISO_Language_Set_3_Locations 4283707.47239251 ns/iter 2920845.107883752 ns/iter 1.47
GZIP_Compress_ISO_Language_Set_3_Schema 2129138.74695106 ns/iter 1633967.3076923448 ns/iter 1.30
GZIP_Decompress_ISO_Language_Set_3_Schema 276434.5041420103 ns/iter 195952.39921614068 ns/iter 1.41
JOSE_VerifySignature_RS256 63815.59173055897 ns/iter 48994.68621147533 ns/iter 1.30
JOSE_VerifySignature_ES512 2629661.0676692748 ns/iter 2161810.1481479886 ns/iter 1.22

This comment was automatically generated by workflow using github-action-benchmark.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark (windows/msvc)

Details
Benchmark suite Current: 0285b39 Previous: 7581b8c Ratio
Regex_Lower_S_Or_Upper_S_Asterisk 5.040397000000212 ns/iter 5.085445535714582 ns/iter 0.99
Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar 4.982265999999527 ns/iter 4.975415999999768 ns/iter 1.00
Regex_Period_Asterisk 4.978624999998666 ns/iter 5.060419000001275 ns/iter 0.98
Regex_Group_Period_Asterisk_Group 5.028350000000046 ns/iter 5.100729999999203 ns/iter 0.99
Regex_Period_Plus 4.648457822875854 ns/iter 4.714029251594058 ns/iter 0.99
Regex_Period 4.6795982247317065 ns/iter 4.637883014427637 ns/iter 1.01
Regex_Caret_Period_Plus_Dollar 4.604159442990777 ns/iter 4.632711149338083 ns/iter 0.99
Regex_Caret_Group_Period_Plus_Group_Dollar 4.629356260334624 ns/iter 4.769745546362288 ns/iter 0.97
Regex_Caret_Period_Asterisk_Dollar 5.149902999999085 ns/iter 5.1642420000007405 ns/iter 1.00
Regex_Caret_Group_Period_Asterisk_Group_Dollar 4.986799085934236 ns/iter 4.955861000000823 ns/iter 1.01
Regex_Caret_X_Hyphen 7.860781250000416 ns/iter 7.929907366072289 ns/iter 0.99
Regex_Period_Md_Dollar 60.263589285714914 ns/iter 69.56868303572402 ns/iter 0.87
Regex_Caret_Slash_Period_Asterisk 7.450134821429597 ns/iter 7.647312499999361 ns/iter 0.97
Regex_Caret_Period_Range_Dollar 5.332065178570084 ns/iter 5.511424107142814 ns/iter 0.97
Regex_Nested_Backtrack 75.25671874998149 ns/iter 77.96043526785265 ns/iter 0.97
JSON_Array_Of_Objects_Unique 779.7417410715062 ns/iter 679.2664062498233 ns/iter 1.15
JSON_Parse_1 9367.379163485371 ns/iter 9157.073405922443 ns/iter 1.02
JSON_Parse_Real 17859.363567169334 ns/iter 18344.12182251855 ns/iter 0.97
JSON_Parse_Decimal 11382.396874999757 ns/iter 11235.832142858726 ns/iter 1.01
JSON_Parse_Schema_ISO_Language 8198208.0000004005 ns/iter 7898348.888887894 ns/iter 1.04
JSON_Parse_Integer 5971.019999999498 ns/iter 5850.181249998952 ns/iter 1.02
JSON_Parse_String_NonSSO_Plain 7885.042410712576 ns/iter 7969.610491070764 ns/iter 0.99
JSON_Parse_String_SSO_Plain 3752.4999062509646 ns/iter 3618.6469045045533 ns/iter 1.04
JSON_Parse_String_Escape_Heavy 21410.045847597634 ns/iter 21495.43750000049 ns/iter 1.00
JSON_Parse_Object_Short_Keys 13184.237499997056 ns/iter 13081.01071428577 ns/iter 1.01
JSON_Parse_Object_Scalar_Properties 6814.577678570442 ns/iter 6666.34017857096 ns/iter 1.02
JSON_Parse_Object_Array_Properties 11606.032142858729 ns/iter 11663.418750000432 ns/iter 1.00
JSON_Parse_Object_Object_Properties 11866.757142854567 ns/iter 11718.243749999856 ns/iter 1.01
JSON_Parse_Nested_Containers 81007.53348213427 ns/iter 81520.0334821599 ns/iter 0.99
JSON_From_String_Copy 62.39849107142195 ns/iter 64.38462053571315 ns/iter 0.97
JSON_From_String_Temporary 83.45267038159244 ns/iter 79.97916294643557 ns/iter 1.04
JSON_Number_To_Double 135.84135714284326 ns/iter 131.04141071429305 ns/iter 1.04
JSON_Object_At_Last_Key/8 7.6464116071426655 ns/iter 7.655683035715351 ns/iter 1.00
JSON_Object_At_Last_Key/32 28.270439285717785 ns/iter 24.949112443402345 ns/iter 1.13
JSON_Object_At_Last_Key/128 98.122455440981 ns/iter 93.0195092401918 ns/iter 1.05
JSON_Object_At_Last_Key/512 431.1893441589657 ns/iter 432.4628041795146 ns/iter 1.00
JSON_Fast_Hash_Helm_Chart_Lock 117.46867779157496 ns/iter 114.72523437500826 ns/iter 1.02
JSON_Equality_Helm_Chart_Lock 205.68181224638465 ns/iter 204.05546874997071 ns/iter 1.01
JSON_Divisible_By_Decimal 403.6383928571752 ns/iter 337.07897454359454 ns/iter 1.20
JSON_String_Equal/10 9.982416919721022 ns/iter 9.94267495561288 ns/iter 1.00
JSON_String_Equal/100 11.371045312500883 ns/iter 11.34979687499893 ns/iter 1.00
JSON_String_Equal_Small_By_Perfect_Hash/10 2.1331037499997763 ns/iter 2.1279996875001927 ns/iter 1.00
JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10 14.682702389811393 ns/iter 15.497687499999659 ns/iter 0.95
JSON_String_Fast_Hash/10 6.411323214286264 ns/iter 6.498386607142541 ns/iter 0.99
JSON_String_Fast_Hash/100 6.429483035712939 ns/iter 6.390623214286962 ns/iter 1.01
JSON_String_Key_Hash/10 4.975429000000986 ns/iter 5.003931249999839 ns/iter 0.99
JSON_String_Key_Hash/100 10.969170312502996 ns/iter 11.169965625001055 ns/iter 0.98
JSON_Object_Defines_Miss_Same_Length 3.87446763392799 ns/iter 3.8895239955356278 ns/iter 1.00
JSON_Object_Defines_Miss_Too_Small 4.372510779298061 ns/iter 4.446716875000334 ns/iter 0.98
JSON_Object_Defines_Miss_Too_Large 3.861472098215048 ns/iter 4.061085096538453 ns/iter 0.95
Pointer_Object_Traverse 77.86106026783963 ns/iter 83.52139508929213 ns/iter 0.93
Pointer_Object_Try_Traverse 70.39680357142483 ns/iter 69.85253571428984 ns/iter 1.01
Pointer_Push_Back_Pointer_To_Weak_Pointer 160.52968749999 ns/iter 160.8657142857136 ns/iter 1.00
Pointer_Walker_Schema_ISO_Language 11339639.28571445 ns/iter 12329875.00000198 ns/iter 0.92
Pointer_Maybe_Tracked_Deeply_Nested/0 2391210.70234186 ns/iter 2544524.1525422884 ns/iter 0.94
Pointer_Maybe_Tracked_Deeply_Nested/1 3569144.1025636983 ns/iter 3731098.3957224945 ns/iter 0.96
Pointer_Position_Tracker_Get_Deeply_Nested 576.677259791672 ns/iter 576.045200893002 ns/iter 1.00
JSONPath_Descendant_Filter_Nested 2562.4603571421694 ns/iter 2573.6550000000793 ns/iter 1.00
URITemplateRouter_Create 39662.382812493444 ns/iter 40147.85156249344 ns/iter 0.99
URITemplateRouter_Match 215.29490556721842 ns/iter 217.82156249997797 ns/iter 0.99
URITemplateRouter_Match_BasePath 244.19183658570088 ns/iter 455.2963739501047 ns/iter 0.54
URITemplateRouterView_Restore 23590.89965513884 ns/iter 26563.040261073646 ns/iter 0.89
URITemplateRouterView_Match 170.40977678571983 ns/iter 182.61442517507174 ns/iter 0.93
URITemplateRouterView_Match_BasePath 195.23729931978528 ns/iter 201.69641287069692 ns/iter 0.97
URITemplateRouterView_Arguments 597.6718749999119 ns/iter 616.4883928570524 ns/iter 0.97
JSONL_Parse_Large 32590647.619047426 ns/iter 33542809.999994464 ns/iter 0.97
JSONL_Parse_Large_GZIP 33197861.904758006 ns/iter 33940434.99999952 ns/iter 0.98
JSONLD_Catalog_Annotation_List_Populate 2711367.424242636 ns/iter 2790214.8594382955 ns/iter 0.97
JSONLD_Catalog_Materialize 8512145.55555594 ns/iter 8934404.00000145 ns/iter 0.95
HTML_Build_Table_100000 90588671.42857707 ns/iter 92688099.99999966 ns/iter 0.98
HTML_Render_Table_100000 7657418.888887453 ns/iter 8049056.666666527 ns/iter 0.95
GZIP_Compress_ISO_Language_Set_3_Locations 37578572.222224064 ns/iter 38902915.78947749 ns/iter 0.97
GZIP_Decompress_ISO_Language_Set_3_Locations 10297667.187501248 ns/iter 10540329.687501071 ns/iter 0.98
GZIP_Compress_ISO_Language_Set_3_Schema 2314520.735786348 ns/iter 2324827.4247493534 ns/iter 1.00
GZIP_Decompress_ISO_Language_Set_3_Schema 553455.6000000066 ns/iter 558359.196428577 ns/iter 0.99
JOSE_VerifySignature_RS256 23761.71694512177 ns/iter 23952.5998593715 ns/iter 0.99
JOSE_VerifySignature_ES512 1522476.3052209853 ns/iter 1531564.508928694 ns/iter 0.99

This comment was automatically generated by workflow using github-action-benchmark.

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
@jviotti
jviotti merged commit 0ec882d into main Jul 20, 2026
12 checks passed
@jviotti
jviotti deleted the oauth-par branch July 20, 2026 23:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant