)]}'
{
  "commit": "f255dcc44146a48eb9121133a46dd14cf1b1aeb9",
  "tree": "e0a2cad3e67f0e9e24a0a51cf2b72d1d0f1a0380",
  "parents": [
    "e53ff8dd02d0c818df6ec1a5944b340005e2c194"
  ],
  "author": {
    "name": "David Ostrovsky",
    "email": "david@ostrovsky.org",
    "time": "Sun Mar 22 19:45:41 2026 +0100"
  },
  "committer": {
    "name": "David Ostrovsky",
    "email": "david@ostrovsky.org",
    "time": "Sun Mar 22 21:01:09 2026 +0100"
  },
  "message": "[SAP IAS] Fix thread-safety race condition in PKCE handling\n\nThe previous implementation used a shared AuthorizationUrlBuilder field\nin the SAPIasOAuthService singleton. Calling initPKCE() on this shared\nbuilder meant that concurrent login requests from different users would\noverwrite the code_verifier, leading to intermittent authentication\nfailures.\n\nUse the new OAuthAuthorizationInfo extension point to generate and\nreturn a per-request code_verifier. This allows Gerrit to store the\nverifier in the user\u0027s session and pass it back to the\ngetAccessToken(OAuthVerifier, String) method, ensuring the verifier\nmatches the original challenge for each specific login flow.\n\nThe single-argument getAccessToken(OAuthVerifier) and\ngetAuthorizationUrl() methods are removed as they are now provided by\ndefault implementations in the OAuthServiceProvider interface.\n\nAdd SAPIasOAuthServiceTest to verify the PKCE flow and ensure that the\ncode verifier is correctly extracted from the session and passed to the\nunderlying ScribeJava service.\n\nDepends-On: https://gerrit-review.googlesource.com/c/gerrit/+/564343\nChange-Id: I718ec9d72da1c13ca4ac405563a8d4c4a5636b8e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "9c1e3ca79d47a205b1b6a86665aeb7df0993aa3a",
      "old_mode": 33188,
      "old_path": "BUILD",
      "new_id": "72d61d82cdad13e3450dce6d65ae4bb33ca8372c",
      "new_mode": 33188,
      "new_path": "BUILD"
    },
    {
      "type": "modify",
      "old_id": "7925e6b7948be1bec241498c07d7cf5303694fb1",
      "old_mode": 33188,
      "old_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/sap/SAPIasOAuthService.java",
      "new_id": "1f7f0e1b02a4a5ccd2818b2a792ef5ffa445a165",
      "new_mode": 33188,
      "new_path": "src/main/java/com/googlesource/gerrit/plugins/oauth/sap/SAPIasOAuthService.java"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "a929d54a29931fc3938c00448a0d653488dbda8d",
      "new_mode": 33188,
      "new_path": "src/test/java/com/googlesource/gerrit/plugins/oauth/sap/SAPIasOAuthServiceTest.java"
    }
  ]
}