pkce.go

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"fmt"

	"github.com/go-authgate/oauth-cli/tui"
)

// GeneratePKCE generates a cryptographically random code_verifier and computes
// the S256 code_challenge as defined in RFC 7636 §4.1 and §4.2.
//
// The verifier is a 32-byte random value base64url-encoded (43 chars, no padding).
// The challenge is BASE64URL(SHA256(ASCII(verifier))).
func GeneratePKCE() (*tui.PKCEParams, error) {
	b := make([]byte, 32)
	if _, err := rand.Read(b); err != nil {
		return nil, fmt.Errorf("failed to generate random bytes: %w", err)
	}

	verifier := base64.RawURLEncoding.EncodeToString(b)

	sum := sha256.Sum256([]byte(verifier))
	challenge := base64.RawURLEncoding.EncodeToString(sum[:])

	return &tui.PKCEParams{
		Verifier:  verifier,
		Challenge: challenge,
		Method:    "S256",
	}, nil
}

// generateState generates a cryptographically random state value for CSRF protection.
// Returns a 16-byte base64url-encoded string.
func generateState() (string, error) {
	b := make([]byte, 16)
	if _, err := rand.Read(b); err != nil {
		return "", fmt.Errorf("failed to generate state: %w", err)
	}
	return base64.RawURLEncoding.EncodeToString(b), nil
}