tree 99b964dae231a4b2f079833acd92596cdbc750e6
parent 1ee68cbd415aa4082d0808b6883189f65d1632ed
author David Ostrovsky <david@ostrovsky.org> 1774072419 +0800
committer David Ostrovsky <david@ostrovsky.org> 1776307343 +0200

Discovery OAuth: Add optional PKCE support

Add support for Proof Key for Code Exchange (PKCE) in the Discovery
OAuth provider to improve security of the authorization code flow.

When `enable-pkce = true`:
- Generate a PKCE code verifier/challenge during authorization
- Return verifier alongside the authorization URL
- Include verifier when exchanging the authorization code for a token

This is disabled by default to preserve backward compatibility with
providers that do not support PKCE.

NOTE: This change depends on a Gerrit core update that extends the
OAuthServiceProvider API (OAuthAuthorizationInfo and PKCE-aware
getAccessToken). The plugin will not work with older Gerrit versions.

Also:
- Update configuration and documentation
- Add unit tests covering PKCE authorization and token exchange flows

Contributed-By: Kai Liu <kraml.liu@gmail.com>
Change-Id: I56fa0f4d50333a2c568d95c31c78f2de3afed661