OAuth2 e OIDC do zero: fluxos e PKCE

1. Client gera code_verifier (random 43-128 chars)
   code_verifier = "ubvfKJsWq...random..."

2. Client calcula code_challenge = BASE64URL(SHA256(code_verifier))

3. Client redireciona pro Authorization Server (/authorize):
   ?response_type=code
   &client_id=abc
   &redirect_uri=https://app.com/callback
   &code_challenge=<hash>
   &code_challenge_method=S256
   &state=<csrf-token>
   &scope=openid profile email

4. User loga, consente. Server redireciona de volta:
   https://app.com/callback?code=<authz_code>&state=<csrf>

5. Client verifica state (CSRF), extrai code.

6. Client troca code por token em /token (POST):
   grant_type=authorization_code
   code=<authz_code>
   code_verifier=<original_verifier>
   client_id=abc
   redirect_uri=...

7. Server valida: SHA256(code_verifier) === code_challenge?
   Se sim, retorna access_token + refresh_token + id_token.

8. Client guarda tokens (ideal: memory + refresh em httpOnly cookie).

// id_token decoded (JWT)
{
  "iss": "https://accounts.google.com",
  "sub": "110169484474386276334",  // user ID único no issuer
  "aud": "abc.apps.googleusercontent.com",  // seu client_id
  "exp": 1735689600,
  "iat": 1735686000,
  "email": "user@example.com",
  "email_verified": true,
  "name": "Ana Silva",
  "picture": "https://..."
}

# Ex: "gh auth login" faz isso
CLI POST /device/authorize
Response: { device_code, user_code: "WGKP-QVNX", verification_uri }

CLI mostra: "Open https://github.com/login/device and enter WGKP-QVNX"
CLI faz polling em /token com device_code.

Quando user aprova no browser, /token retorna access_token.

import * as openid from 'openid-client';

// 1. Discovery
const issuer = await openid.Issuer.discover('https://accounts.google.com');
const client = new issuer.Client({
  client_id: process.env.GOOGLE_CLIENT_ID!,
  client_secret: process.env.GOOGLE_CLIENT_SECRET!,
  redirect_uris: ['https://app.com/callback'],
  response_types: ['code'],
});

// 2. Build authorize URL com PKCE
const codeVerifier = openid.generators.codeVerifier();
const codeChallenge = openid.generators.codeChallenge(codeVerifier);
const state = openid.generators.state();

const url = client.authorizationUrl({
  scope: 'openid profile email',
  code_challenge: codeChallenge,
  code_challenge_method: 'S256',
  state,
});

// 3. No callback: trocar code por tokens
const params = client.callbackParams(req);
const tokenSet = await client.callback(
  'https://app.com/callback',
  params,
  { code_verifier: codeVerifier, state }
);

// tokenSet.id_token (JWT), tokenSet.access_token
const claims = tokenSet.claims();