Claude CodeでOAuth実装 — PKCE・state・リダイレクトURIをテストで固める

import test from 'node:test';
import assert from 'node:assert/strict';
import {
  createCodeVerifier, createCodeChallenge, startAuthorization,
  validateCallback, buildTokenRequest, assertRegisteredRedirectUri,
} from './oauth-client.mjs';
 
const cfg = {
  authorizeEndpoint: 'https://auth.example/authorize',
  tokenEndpoint: 'https://auth.example/token',
  clientId: 'demo-client',
  redirectUri: 'http://127.0.0.1:8080/callback',
};
 
test('RFC 7636 付録Bのベクタと S256 が一致する', () => {
  assert.equal(
    createCodeChallenge('dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'),
    'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM');
});
 
test('code_verifier は43〜128文字の使用可能文字だけで作る', () => {
  const v = createCodeVerifier();
  assert.match(v, /^[A-Za-z0-9\-._~]{43,128}$/);
});
 
test('認可URLに S256 と state が入る', () => {
  const { url, session } = startAuthorization(cfg);
  const q = new URL(url).searchParams;
  assert.equal(q.get('code_challenge_method'), 'S256');
  assert.equal(q.get('state'), session.state);
  assert.equal(q.get('redirect_uri'), cfg.redirectUri);
});
 
test('state が一致しないコールバックは拒否する', () => {
  const session = { state: 'abc', codeVerifier: 'v' };
  assert.throws(() => validateCallback({ code: 'c', state: 'zzz' }, session), /state/);
  assert.throws(() => validateCallback({ code: 'c' }, session), /state/);
});
 
test('使用済みの state は再利用できない', () => {
  const session = { state: 'abc', codeVerifier: 'v' };
  assert.equal(validateCallback({ code: 'c', state: 'abc' }, session), 'c');
  assert.throws(() => validateCallback({ code: 'c', state: 'abc' }, session), /state/);
});
 
test('error 応答は code が付いていても拒否する', () => {
  const session = { state: 'abc', codeVerifier: 'v' };
  assert.throws(() => validateCallback(
    { error: 'access_denied', code: 'c', state: 'abc' }, session), /認可エラー/);
});
 
test('code_verifier が無いとトークン要求を組み立てない', () => {
  assert.throws(() => buildTokenRequest(
    cfg, { code: 'c' }, { state: 'abc' }), /code_verifier/);
});
 
test('トークン要求は redirect_uri を引き継ぎ、client_secret は env からだけ入る', () => {
  const { session } = startAuthorization(cfg);
  const { body } = buildTokenRequest(cfg, { code: 'c' }, session);
  assert.equal(body.get('redirect_uri'), cfg.redirectUri);
  assert.equal(body.get('code_verifier'), session.codeVerifier);
  assert.equal(body.has('client_secret'), false);
  const withSecret = buildTokenRequest(
    cfg, { code: 'c' }, session, { OAUTH_CLIENT_SECRET: 's3' });
  assert.equal(withSecret.body.get('client_secret'), 's3');
});
 
test('登録外の redirect_uri は完全一致でなければ拒否する', () => {
  const registered = [cfg.redirectUri];
  assertRegisteredRedirectUri(cfg.redirectUri, registered);
  for (const bad of [
    'http://127.0.0.1:8080/callback/',
    'http://127.0.0.1:8080/callback?next=https://evil.example',
    'http://127.0.0.1.evil.example/callback',
    'http://127.0.0.1:8080/Callback',
  ]) {
    assert.throws(() => assertRegisteredRedirectUri(bad, registered), /redirect_uri/);
  }
});

import { createHash, randomBytes } from 'node:crypto';
 
export const createCodeVerifier = () => randomBytes(32).toString('base64url');
 
export const createCodeChallenge = (verifier) =>
  createHash('sha256').update(verifier, 'ascii').digest('base64url');
 
export function assertRegisteredRedirectUri(uri, registered) {
  if (!registered.includes(uri)) {
    throw new Error(`redirect_uri が登録値と一致しません: ${uri}`);
  }
}
 
export function startAuthorization(cfg) {
  const state = randomBytes(16).toString('base64url');
  const codeVerifier = createCodeVerifier();
  const url = new URL(cfg.authorizeEndpoint);
  url.search = new URLSearchParams({
    response_type: 'code',
    client_id: cfg.clientId,
    redirect_uri: cfg.redirectUri,
    state,
    code_challenge: createCodeChallenge(codeVerifier),
    code_challenge_method: 'S256',
  }).toString();
  return { url: url.toString(), session: { state, codeVerifier } };
}
 
export function validateCallback(params, session) {
  const expected = session.state;
  session.state = undefined; // 一度きり
  if (!expected || params.state !== expected) {
    throw new Error('state が一致しません');
  }
  if (params.error) throw new Error(`認可エラー: ${params.error}`);
  if (!params.code) throw new Error('code がありません');
  return params.code;
}
 
export function buildTokenRequest(cfg, params, session, env = {}) {
  if (!session.codeVerifier) throw new Error('code_verifier がありません');
  const body = new URLSearchParams({
    grant_type: 'authorization_code',
    code: params.code,
    redirect_uri: cfg.redirectUri,
    client_id: cfg.clientId,
    code_verifier: session.codeVerifier,
  });
  if (env.OAUTH_CLIENT_SECRET) {
    body.set('client_secret', env.OAUTH_CLIENT_SECRET);
  }
  return { url: cfg.tokenEndpoint, body };
}