derive_challenge (sso/pkce.rs)

! PKCE (RFC 7636) — Proof Key for Code Exchange. ! ! Public OIDC clients (desktop apps without a confidential secret) ! use PKCE to prevent authorization-code interception. The client ! generates a random `code_verifier`, derives a `code_challenge` from ! it (SHA-256 + base64url)

// Source: https://github.com/thClaws/thClaws | License: Apache-2.0 | Copyright 2026 ThaiGPT Co., Ltd
// Provided via justclaw.it.com; keep this notice with the code.
//! PKCE (RFC 7636) — Proof Key for Code Exchange.
//!
//! Public OIDC clients (desktop apps without a confidential secret)
//! use PKCE to prevent authorization-code interception. The client
//! generates a random `code_verifier`, derives a `code_challenge` from
//! it (SHA-256 + base64url), and ties the two together across the
//! authorize → exchange flow:
//!
//!   1. Authorize request includes `code_challenge` + method `S256`
//!   2. IdP returns an authorization code
//!   3. Token exchange request includes the original `code_verifier`
//!   4. IdP rejects the exchange unless SHA-256(verifier) == challenge
//!
//! This 

... (truncated -- full source via MCP)