This pull request adds support for Proof Key for Code Exchange (PKCE) to the GitHub and OIDC authentication flows. PKCE is an additional security layer for OAuth2, and these changes allow it to be enabled via configuration. The implementation includes updates to configuration files, backend logic for storing and verifying challenges, and comprehensive tests to ensure correct behavior and error handling.

PKCE Support for GitHub and OIDC Authentication

Configuration and Schema Updates:

• Added the use_pkce boolean option to the GitHub and OIDC authentication configuration schemas (config/flipt.schema.cue, config/flipt.schema.json, internal/config/authentication.go). [1] [2] [3]

GitHub Authentication Flow:

• Implemented PKCE challenge generation, storage, and verification in the GitHub OAuth2 flow. The server now generates a verifier, stores it, and includes the challenge in the authorization URL if use_pkce is enabled, and verifies it during the callback. [1] [2] [3]
• Added and updated tests to cover PKCE-enabled flows, error handling (e.g., missing state, missing/expired challenge), and store interactions. Added test utilities for challenge capture and error injection. [1] [2] [3] [4] [5] [6] [7] [8] [9]

OIDC Authentication Flow:

• Added PKCE support to OIDC: when enabled, the server generates and stores a verifier, passing it as the nonce, and verifies it during the callback. [1] [2] [3] [4] [5]

Testing and Validation:

• Updated struct tag validation to special-case the usePKCE field for naming conventions.
• Improved test coverage for PKCE scenarios, including correct challenge round-tripping, error cases, and integration with the authentication store. [1] [2] [3] [4] [5] [6] [7] [8] [9]

These changes collectively enhance the security of the OAuth2 authentication flows by supporting PKCE, and ensure robust handling and testing of the new logic.