Function GeneratePKCECodes

internal/auth/codex/pkce.go:17–31

GeneratePKCECodes generates a new pair of PKCE (Proof Key for Code Exchange) codes. It creates a cryptographically random code verifier and its corresponding SHA256 code challenge, as specified in RFC 7636. This is a critical security feature for the OAuth 2.0 authorization code flow.

()

// SHA256 code challenge, as specified in RFC 7636. This is a critical security
// feature for the OAuth 2.0 authorization code flow.
func GeneratePKCECodes() (*PKCECodes, error) {
	// Generate code verifier: 43-128 characters, URL-safe
	codeVerifier, err := generateCodeVerifier()
	if err != nil {
		return nil, fmt.Errorf("failed to generate code verifier: %w", err)
	}

	// Generate code challenge using S256 method
	codeChallenge := generateCodeChallenge(codeVerifier)

	return &PKCECodes{
		CodeVerifier:  codeVerifier,
		CodeChallenge: codeChallenge,
	}, nil
}

// generateCodeVerifier creates a cryptographically secure random string to be used
// as the code verifier in the PKCE flow. The verifier is a high-entropy string