bernardo/nocal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add PKCE OAuth boundary

Browse Source 
Introduce provider-neutral HTTP contracts and public-client authorization-code orchestration with PKCE S256, strict HTTPS and loopback validation, constant-time state checks, secure OpenSSL entropy, and single-send token exchange semantics.

Add independent protocol and adversarial suites covering RFC 7636, RFC3986 encoding, callback failures, response redaction, and no-retry behavior. Concrete networking, browser/listener, token parsing, Secret Service, and Graph integration remain separate follow-up slices.
This commit is contained in:
Bernardo Magri
2026-07-18 11:11:28 +01:00
parent 787daf00dd
commit dd6e02cb55
11 changed files with 1572 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
README.md
View File

@@ -120,9 +120,23 @@ committed atomically with the pulled page it represents. Normalized event
instances provide immutable snapshot input, while transactional outbox and
conflict records are reserved for later write synchronization.
This is a persistence prerequisite, not working Office 365 integration. Nocal
does not yet perform OAuth, make Graph requests, or synchronize a remote
calendar. OAuth tokens and other secrets will never be stored in SQLite; they
belong in the Freedesktop Secret Service. The next implementation step is an
injectable HTTP boundary with PKCE authentication and deterministic fake
transports, followed by read-only Microsoft Graph delta synchronization.
The provider boundary models Microsoft sign-in as a public desktop client
using the system browser, the OAuth authorization-code flow, PKCE with `S256`,
and a loopback redirect. Nocal's application registration must be multitenant,
with the intended organizational/personal Microsoft account audience, and the
first read-only synchronization will request only delegated `Calendars.Read`.
This permission normally supports user consent, but an organization's tenant
policy can still require administrator consent or block user consent. An
open-source desktop executable cannot keep a client secret, so none is embedded
or expected.
The generic HTTP boundary uses injected transports and deterministic fakes. It
does not retry requests: provider code must later make retry decisions with the
operation's idempotency and server response in view. This remains foundation,
not working Office 365 integration. There is no concrete HTTP transport,
browser/loopback adapter, token JSON parser, Secret Service backend, Graph call,
or usable account setup yet. OAuth tokens and other secrets will never be
stored in SQLite; they belong in the Freedesktop Secret Service. The next
implementation sequence is concrete desktop, HTTP, and Secret Service adapters,
followed by read-only Microsoft Graph calendar discovery and delta
synchronization.