Method CreatePKCERequestSession

internal/oauth/storage.go:485–506

───────────────────────── PKCERequestStorage ─────────────────────────

(ctx context.Context, signature string, request fosite.Requester)

// ───────────────────────── PKCERequestStorage ─────────────────────────

func (s *Storage) CreatePKCERequestSession(ctx context.Context, signature string, request fosite.Requester) error {
	raw, err := marshalRequest(request)
	if err != nil {
		return err
	}
	// Mirror the auth-code expiry source. PKCE sessions are paired
	// with codes (consumed at the same /token call) so using the same
	// expiry keeps them in lockstep — the reaper won't drop the PKCE
	// row out from under a still-valid code.
	sess, _ := request.GetSession().(*Session)
	expiresAt := request.GetRequestedAt().Add(15 * time.Minute)
	if sess != nil {
		if t := sess.GetExpiresAt(fosite.AuthorizeCode); !t.IsZero() {
			expiresAt = t
		}
	}
	_, err = s.db(ctx).Exec(ctx, `
		INSERT INTO oauth_pkce_requests (signature, request_id, client_id, request, expires_at)
		VALUES ($1, $2, $3, $4, $5)
	`, signature, request.GetID(), request.GetClient().GetID(), raw, expiresAt)
	return err
}

func (s *Storage) GetPKCERequestSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error) {
	var raw []byte