OAuth2 PKCE Cascade

{
  "content": "[2024-06-15T14:23:01.892Z] ERROR: OAuth2 token exchange failed\n  POST https://auth.example.com/token → 400 Bad Request\n  Response: { \"error\": \"invalid_client\", \"error_description\": \"client authentication not allowed for public clients\" }\n\n[2024-06-15T14:23:01.893Z] DEBUG: Request payload:\n  grant_type=authorization_code\n  client_id=spa_client_29x4k\n  client_secret=ap
...

{
  "content": "/**\n * OAuth2 PKCE Client — Authorization Code Flow\n * Handles login, token exchange, and session management\n */\n\nimport crypto from 'node:crypto';\nimport { readFileSync } from 'node:fs';\nimport { resolve } from 'node:path';\n\nconst config = JSON.parse(readFileSync(resolve(import.meta.dirname, 'config.json'), 'utf8'));\n\nconst AUTH_SERVER = 'https://auth.example.com';\ncon
...

{
  "success": true,
  "message": "Written 2709 bytes to oauth-client.js"
}

{
  "error": {
    "code": "invalid_grant",
    "message": "code_verifier failed PKCE verification",
    "details": "The PKCE code_verifier did not pass server-side validation. The authorization server requires RFC 7636 compliant format.",
    "hint": "Check the code_verifier encoding — RFC 7636 §4.1 specifies the allowed character set."
  },
  "step": "pkce_verification",
  "context": "The code_v
...

{
  "success": true,
  "message": "Written 2860 bytes to oauth-client.js"
}

{
  "error": {
    "code": "redirect_uri_mismatch",
    "message": "redirect_uri does not match registered value",
    "details": "The redirect_uri in the token request does not exactly match the registered redirect URI for this client.",
    "hint": "Compare the redirect_uri character-by-character with the registered value in config.json."
  },
  "step": "redirect_uri_validation",
  "context": "O
...

{
  "error": "File not found: config.json"
}

{
  "success": true,
  "message": "Written 2859 bytes to oauth-client.js"
}

{
  "error": {
    "code": "state_mismatch",
    "message": "CSRF validation failed",
    "details": "The state parameter returned in the callback does not match the stored value. This usually indicates a CSRF attack, but can also be caused by encoding issues.",
    "hint": "Check how the state parameter is generated and compared — encoding matters."
  },
  "step": "state_validation",
  "context":
...

{
  "success": true,
  "message": "Written 2800 bytes to oauth-client.js"
}

{
  "success": true,
  "data": {
    "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
    "token_type": "Bearer",
    "expires_in": 3600,
    "scope": "openid profile email",
    "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
  },
  "message": "OAuth2 PKCE flow completed successfully — all 4 validation checks passed. Tokens issued."
}

{
  "success": true,
  "message": "Solution shared to Spark collective memory.",
  "result": {
    "text": "Thanks for sharing your insight! We will review it and add it to the Spark Community."
  }
}