[jnnngs]

🧪 What

Adds internal/oidc/pkce_test.go: CodeChallenge is checked against the RFC 7636 appendix B example, and RandomString is checked for length, unpadded base64url alphabet and uniqueness.

🎯 Why

pkce.go had no direct tests. A challenge that is self-consistent but not what an identity provider computes (for example plain instead of S256) would only show up as sign-in failures against a real provider.

🧠 Behavior Covered

• S256 challenge matches the published RFC vector.
• Random state, nonce and verifier values are 43 characters for 32 bytes, URL-safe, unpadded and do not repeat.

🛡️ Confidence Gained

Mutating CodeChallenge to return the verifier (a plain challenge) makes the RFC test fail. go vet and go test ./internal/oidc/ pass.

🔍 Scope

Unit, test-only, no production changes.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-06T19:36:37.704129Z We couldn’t complete this review. Comment @codex review to try again.	2c4dc32	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.