feat: multi-feature update

web/default/src/features/auth/hooks/use-oauth-login.ts

@@ -31,6 +31,31 @@ import {
 } from '../lib/oauth'
 import type { SystemStatus, CustomOAuthProviderInfo } from '../types'
 
+/**
+ * Generate a random code verifier for PKCE
+ */
+function generateCodeVerifier(): string {
+  const array = new Uint8Array(32)
+  crypto.getRandomValues(array)
+  return btoa(String.fromCharCode(...array))
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '')
+}
+
+/**
+ * Generate code challenge from code verifier using SHA-256
+ */
+async function generateCodeChallenge(verifier: string): Promise<string> {
+  const encoder = new TextEncoder()
+  const data = encoder.encode(verifier)
+  const digest = await crypto.subtle.digest('SHA-256', data)
+  return btoa(String.fromCharCode(...new Uint8Array(digest)))
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '')
+}
+
 type LogoutRequestConfig = AxiosRequestConfig & {
   skipErrorHandler?: boolean
 }
@@ -211,6 +236,16 @@ export function useOAuthLogin(status: SystemStatus | null) {
         url.searchParams.set('scope', provider.scopes)
       }
 
+      // Add PKCE support if enabled
+      if (provider.pkce_enabled) {
+        const codeVerifier = generateCodeVerifier()
+        const codeChallenge = await generateCodeChallenge(codeVerifier)
+        // Store code_verifier in sessionStorage keyed by state
+        sessionStorage.setItem(`pkce_verifier_${state}`, codeVerifier)
+        url.searchParams.set('code_challenge', codeChallenge)
+        url.searchParams.set('code_challenge_method', 'S256')
+      }
+
       window.open(url.toString(), '_self')
     } catch (_error) {
       toast.error(