loopauth 0.4.0

OAuth 2.0 Authorization Code + PKCE flow for CLI applications
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
use sha2::{Digest, Sha256};

#[expect(
    clippy::struct_field_names,
    reason = "field names intentionally mirror the PKCE spec terminology"
)]
pub struct PkceChallenge {
    pub(crate) code_verifier: String,
    pub(crate) code_challenge: String,
    pub(crate) code_challenge_method: &'static str,
}

impl PkceChallenge {
    #[must_use]
    pub(crate) fn generate() -> Self {
        // 48 random bytes → 64 base64url chars (within RFC 7636 bounds of 43–128)
        // Three UUID v4 values supply OS-level entropy without a direct getrandom dependency.
        use uuid::Uuid;
        let b1 = Uuid::new_v4().into_bytes();
        let b2 = Uuid::new_v4().into_bytes();
        let b3 = Uuid::new_v4().into_bytes();
        let mut bytes = [0_u8; 48];
        bytes[..16].copy_from_slice(&b1);
        bytes[16..32].copy_from_slice(&b2);
        bytes[32..48].copy_from_slice(&b3);
        let code_verifier = URL_SAFE_NO_PAD.encode(bytes);

        let hash = Sha256::digest(code_verifier.as_bytes());
        let code_challenge = URL_SAFE_NO_PAD.encode(hash);

        Self {
            code_verifier,
            code_challenge,
            code_challenge_method: "S256",
        }
    }
}

#[cfg(test)]
mod tests {
    use super::PkceChallenge;

    #[test]
    fn verifier_contains_only_url_safe_chars() {
        let pkce = PkceChallenge::generate();
        assert!(
            pkce.code_verifier
                .chars()
                .all(|c: char| c.is_ascii_alphanumeric() || c == '-' || c == '_'),
            "code_verifier contains non-URL-safe characters: {}",
            pkce.code_verifier
        );
    }

    #[test]
    fn verifier_does_not_contain_plus() {
        let pkce = PkceChallenge::generate();
        assert!(
            !pkce.code_verifier.contains('+'),
            "code_verifier must not contain +"
        );
    }

    #[test]
    fn verifier_does_not_contain_slash() {
        let pkce = PkceChallenge::generate();
        assert!(
            !pkce.code_verifier.contains('/'),
            "code_verifier must not contain /"
        );
    }

    #[test]
    fn verifier_does_not_contain_equals() {
        let pkce = PkceChallenge::generate();
        assert!(
            !pkce.code_verifier.contains('='),
            "code_verifier must not contain ="
        );
    }

    #[test]
    fn verifier_length_within_rfc_bounds() {
        for _ in 0..100 {
            let pkce = PkceChallenge::generate();
            assert!(
                pkce.code_verifier.len() >= 43,
                "code_verifier too short: {}",
                pkce.code_verifier.len()
            );
            assert!(
                pkce.code_verifier.len() <= 128,
                "code_verifier too long: {}",
                pkce.code_verifier.len()
            );
        }
    }

    #[test]
    fn challenge_contains_only_url_safe_chars() {
        let pkce = PkceChallenge::generate();
        assert!(
            !pkce.code_challenge.contains('+'),
            "code_challenge must not contain +"
        );
        assert!(
            !pkce.code_challenge.contains('/'),
            "code_challenge must not contain /"
        );
        assert!(
            !pkce.code_challenge.contains('='),
            "code_challenge must not contain ="
        );
    }

    #[test]
    fn challenge_method_is_s256() {
        let pkce = PkceChallenge::generate();
        assert_eq!(pkce.code_challenge_method, "S256");
    }

    #[test]
    fn challenge_matches_expected_computation() {
        use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
        use sha2::{Digest, Sha256};
        let pkce = PkceChallenge::generate();
        let hash = Sha256::digest(pkce.code_verifier.as_bytes());
        let expected_challenge = URL_SAFE_NO_PAD.encode(hash);
        assert_eq!(
            pkce.code_challenge, expected_challenge,
            "challenge does not match BASE64URL(SHA256(verifier))"
        );
    }
}