oauth-as 0.9.3

An embeddable OAuth 2.1 Authorization Server library: spec-mirroring types (RFC 6749, RFC 8628, RFC 7636), a full device-authorization-grant state machine, and a storage trait the host implements. Deliberately host-agnostic with a tiny dependency set; nothing is allocated until the host constructs an AuthorizationServer, so an embedding host pays zero memory until its config enables the feature.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

// SPDX-License-Identifier: MIT OR Apache-2.0
// Copyright (C) 2026 Matthew Jackson

//! Unit tests for [`crate::pkce`], kept out of the implementation file. These reach
//! private items, so they live in the crate rather than in `tests/`.

use super::*;

#[test]
fn verifier_grammar_bounds() {
    let ok = "a".repeat(43);
    assert!(verifier_is_valid(&ok));
    assert!(verifier_is_valid(&"a".repeat(128)));
    assert!(!verifier_is_valid(&"a".repeat(42)), "below 43 chars");
    assert!(!verifier_is_valid(&"a".repeat(129)), "above 128 chars");
    assert!(
        !verifier_is_valid(&format!("{}+", "a".repeat(43))),
        "'+' outside unreserved set"
    );
}

#[test]
fn challenge_shape() {
    let c = code_challenge_s256(&"x".repeat(43));
    assert_eq!(
        c.len(),
        43,
        "SHA-256 is 32 bytes; unpadded base64url of 32 bytes is 43 chars"
    );
    assert!(!c.contains('='), "no padding per RFC 7636 appendix A");
}