2 Commits

Include renames

Author	SHA1	Message	Date
raucao	a373e577dc	Shorten the authorization code lifetime to 60 seconds ... The code is redeemed by the client immediately in the OAuth callback, so a 60-second window is plenty (and matches common practice; RFC 6749 caps authorization codes at 10 minutes). Part of #254	2026-11-03 08:07:34 +04:00
raucao	8fc7ffdd1d	Add PKCE support to remoteStorage OAuth ... Implements the optional OAuth 2.0 Authorization Code grant with PKCE (RFC 7636) for remoteStorage, as described in the remoteStorage spec (section 10.1). - Advertise the authorization and token endpoints plus the supported code_challenge method (S256) in WebFinger, and bump the advertised spec version to draft-dejong-remotestorage-27 - Add RsAuthorizationCode: a short-lived (5 min), single-use authorization code stored only as a SHA256 digest - Add RsOauthManager services for issuing and exchanging codes, including S256 verification - Add a cross-origin POST /rs/oauth/token endpoint that exchanges a code (and code_verifier) for an access token, with CORS and no CSRF token - Consent dialog now carries response_type / code_challenge through the form and redirects with the code in the query string for the code flow - Remove the existing-token reuse shortcut so every authorization results in a distinct authorization (and token) Part of #254	2026-11-02 16:40:25 +04:00