tree e0a2cad3e67f0e9e24a0a51cf2b72d1d0f1a0380
parent e53ff8dd02d0c818df6ec1a5944b340005e2c194
author David Ostrovsky <david@ostrovsky.org> 1774205141 +0100
committer David Ostrovsky <david@ostrovsky.org> 1774209669 +0100

[SAP IAS] Fix thread-safety race condition in PKCE handling

The previous implementation used a shared AuthorizationUrlBuilder field
in the SAPIasOAuthService singleton. Calling initPKCE() on this shared
builder meant that concurrent login requests from different users would
overwrite the code_verifier, leading to intermittent authentication
failures.

Use the new OAuthAuthorizationInfo extension point to generate and
return a per-request code_verifier. This allows Gerrit to store the
verifier in the user's session and pass it back to the
getAccessToken(OAuthVerifier, String) method, ensuring the verifier
matches the original challenge for each specific login flow.

The single-argument getAccessToken(OAuthVerifier) and
getAuthorizationUrl() methods are removed as they are now provided by
default implementations in the OAuthServiceProvider interface.

Add SAPIasOAuthServiceTest to verify the PKCE flow and ensure that the
code verifier is correctly extracted from the session and passed to the
underlying ScribeJava service.

Depends-On: https://gerrit-review.googlesource.com/c/gerrit/+/564343
Change-Id: I718ec9d72da1c13ca4ac405563a8d4c4a5636b8e