Noizu.MCP.Auth.Server.PKCE (Noizu MCP v0.1.6)

Copy Markdown View Source

PKCE (RFC 7636), S256 only.

plain is not implemented and code_challenge_method values other than "S256" are rejected rather than defaulted — OAuth 2.1 requires S256 for every client, and a "default to plain when the method is absent" branch is precisely how a downgrade gets in. The authorization-server metadata advertises code_challenge_methods_supported: ["S256"] to match.

iex> Noizu.MCP.Auth.Server.PKCE.challenge("dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk")
{:ok, "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"}

Summary

Functions

challenge(verifier)

Derive the code_challenge for a verifier: base64url(SHA-256(verifier)), unpadded.

generate_verifier()

A fresh 32-byte verifier, for tests and for the library's own client.

method()

The one supported method.

valid_challenge?(challenge)

Validate a code_challenge as received at the authorization endpoint.

valid_method?(arg1)

Validate a code_challenge_method. Only "S256" passes.

valid_verifier?(verifier)

Validate a code_verifier against the RFC 7636 §4.1 grammar.

verify(verifier, stored_challenge, method \\ "S256")

Check a presented verifier against the stored challenge.

Functions

challenge(verifier)

@spec challenge(String.t()) :: {:ok, String.t()} | {:error, :invalid_verifier}

Derive the code_challenge for a verifier: base64url(SHA-256(verifier)), unpadded.

generate_verifier()

@spec generate_verifier() :: String.t()

A fresh 32-byte verifier, for tests and for the library's own client.

method()

@spec method() :: String.t()

The one supported method.

valid_challenge?(challenge)

@spec valid_challenge?(term()) :: boolean()

Validate a code_challenge as received at the authorization endpoint.

An S256 challenge is exactly 43 unpadded base64url characters — a shorter one is a plain verifier being smuggled through.

valid_method?(arg1)

@spec valid_method?(term()) :: boolean()

Validate a code_challenge_method. Only "S256" passes.

valid_verifier?(verifier)

@spec valid_verifier?(term()) :: boolean()

Validate a code_verifier against the RFC 7636 §4.1 grammar.

verify(verifier, stored_challenge, method \\ "S256")

@spec verify(term(), term(), term()) :: :ok | {:error, :invalid_grant}

Check a presented verifier against the stored challenge.

method must be "S256"; anything else — including nil, which is how a client that skipped PKCE presents — is a rejection.