generate_pkce_challenge (src/pkce.rs)

Provides cryptographically secure PKCE code verifier and challenge generation for OAuth 2.0 authentication flows.

// Source: https://github.com/vinhnx/vtcode | License: Apache-2.0 | Copyright 2025 Vinh Nguyen
// Provided via justclaw.it.com; keep this notice with the code.
//! PKCE (Proof Key for Code Exchange) utilities for OAuth 2.0.
//!
//! Implements RFC 7636 for secure OAuth flows without client secrets.
//! Uses SHA-256 (S256) code challenge method as recommended by the spec.

use anyhow::{Context, Result};
use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
use ring::rand::{SecureRandom, SystemRandom};
use sha2::{Digest, Sha256};
use std::fmt;

/// PKCE code verifier length (43-128 characters per RFC 7636)
const CODE_VERIFIER_LENGTH: usize = 64;

/// Characters allowed in code verifier (unreserved URI characters)
const CODE_VERIFIER_CHARSET: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcde

... (truncated -- full source via MCP)