archetech / archon / 36577400375

87%

push

github

fix(herald): enforce PKCE on the OAuth authorization code flow (#1322)

* fix(herald): enforce PKCE on the OAuth authorization code flow

The spec advertised "Authorization Code with PKCE", but /oauth/authorize
and /oauth/token never read code_challenge or code_verifier, so a code
issued to a PKCE client could be exchanged without the verifier.

Authorize now accepts an S256 code_challenge and stores it with the code,
rejecting plain, incomplete, or malformed challenges. Token requires the
matching code_verifier for such codes, refuses a verifier for a code
issued without a challenge (a stripped-challenge downgrade), and burns
the code on any failure. Both discovery documents advertise S256. PKCE
stays optional for registered confidential clients.

The spec now documents the enforced behaviour and no longer claims
refresh-token support, which the token endpoint never had.

Closes #1312

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KKa3M1JysigmAGqoc3JGHt

* docs(herald): keep the /oauth/clients row inside the endpoint table

The PKCE paragraph was inserted between table rows, so the last row
rendered as raw text. Move the paragraph after the table.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KKa3M1JysigmAGqoc3JGHt

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

66 of 76 branches covered (86.84%)

Branch coverage included in aggregate %.

12 of 14 relevant lines covered (85.71%)

12.57 hits per line