nx_oauth2_pkce.nx

oauth2_pkce.nx -- Proof Key for Code Exchange (RFC 7636). Mandatory OAuth 2.0 extension for public clients (mobile apps, SPAs, CLI tools) that can't keep a client_secret secret. Also recommended for confidential clients per OAuth 2.1 draft. Flow: 1. Client generates a random 43-128 char verifier. 2. Client sends challenge = BASE64URL(SHA-256(verifier)) to authorize endpoint along with code_challenge_method=S256. 3. Server stores challenge + issues auth code. 4. Client redeems code + sends original verifier to token endpoint. 5. Server re-derives challenge from verifier, compares; if equal, issues access token. This module ships: - pkce_verifier_new(out) -> random 43-char - pkce_challenge(verifier, verifier_len, out) -> challenge Composes rand.nx + sha256.nx + base64.nx (with URL-safe + unpadded normalisation inline). Invariants: PKCE1 Verifier chars drawn from [A-Z a-z 0-9 - . _ ~] per RFC 7636 §4.1 unreserved set. 43 chars default ~= 256 bits of entropy. PKCE2 Challenge = BASE64URL(SHA256(verifier)) without padding ('=' stripped). PKCE3 Output is ASCII only; safe to embed in URLs without further encoding.