Implement OAuth2 PKCE for Mobile Backends with Claude Code

@RestController
@RequestMapping("/oauth2/callback")
public class PkceTokenExchangeController {

    @Value("${oauth2.token.url}")
    private String tokenUrl;

    @Value("${oauth2.client.id}")
    private String clientId;

    @Value("${oauth2.client.secret}")
    private String clientSecret; // Note: For PKCE, client secret may not be strictly necessary depending on provider.

    // In a production system, this should be a persistent store (e.g., Redis, database)
    private final Map<String, String> codeChallengeStore = new ConcurrentHashMap<>();
    private final Map<String, String> codeChallengeMethodStore = new ConcurrentHashMap<>();

    private final RestTemplate restTemplate = new RestTemplate();

    @PostMapping("/token")
    public ResponseEntity<?> exchangeCodeForToken(
            @RequestParam("grant_type") String grantType,
            @RequestParam("code") String authorizationCode,
            @RequestParam("redirect_uri") String redirectUri,
            @RequestParam("code_verifier") String codeVerifier) {

        if (!"authorization_code".equals(grantType)) {
            return ResponseEntity.badRequest().body("Invalid grant_type");
        }

        // 1. Retrieve stored code challenge and method
        String storedCodeChallenge = codeChallengeStore.get(authorizationCode);
        String storedChallengeMethod = codeChallengeMethodStore.get(authorizationCode);

        if (storedCodeChallenge == null || storedChallengeMethod == null) {
            return ResponseEntity.badRequest().body("Invalid authorization code or expired request");
        }

        // 2. Dynamically generate expected code challenge
        String generatedCodeChallenge = generateCodeChallenge(codeVerifier, storedChallengeMethod);

        // 3. Compare challenges
        if (!generatedCodeChallenge.equals(storedCodeChallenge)) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Code verifier mismatch");
        }

        // 4. Exchange authorization code for access token
        // This part requires careful construction of the request to the OAuth2 provider's token endpoint.
        // Using MultiValueMap for form-urlencoded POST body.
        MultiValueMap<String, String> tokenRequest = new LinkedMultiValueMap<>();
        tokenRequest.add("grant_type", "authorization_code");
        tokenRequest.add("code", authorizationCode);
        tokenRequest.add("redirect_uri", redirectUri);
        tokenRequest.add("client_id", clientId);
        // If client secret is used by the provider for this flow
        tokenRequest.add("client_secret", clientSecret);
        tokenRequest.add("code_verifier", codeVerifier); // Send verifier for some providers

        HttpHeaders headers = new HttpHeaders();
        headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
        // Add Authorization header if client authentication is needed (e.g., Basic Auth)
        // HttpAuthentication basicAuth = new HttpAuthentication(clientId, clientSecret);
        // headers.setAuthorization(basicAuth.getBasicAuth());

        HttpEntity<MultiValueMap<String, String>> requestEntity = new HttpEntity<>(tokenRequest, headers);

        try {
            ResponseEntity<OAuthTokenResponse> tokenResponse = restTemplate.exchange(
                    tokenUrl,
                    HttpMethod.POST,
                    requestEntity,
                    OAuthTokenResponse.class
            );

            // Clean up stored codes after successful exchange
            codeChallengeStore.remove(authorizationCode);
            codeChallengeMethodStore.remove(authorizationCode);

            // 5. Return tokens to client
            return ResponseEntity.ok(tokenResponse.getBody());

        } catch (RestClientException e) {
            // Handle potential errors from the OAuth provider
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("Error exchanging code for token: " + e.getMessage());
        }
    }

    // Dummy method to store code challenge and method. In reality, associate with authorization code.
    // This would be part of the initial authorization request handling.
    public void storeCodeChallenge(String authorizationCode, String codeChallenge, String method) {
        this.codeChallengeStore.put(authorizationCode, codeChallenge);
        this.codeChallengeMethodStore.put(authorizationCode, method);
    }


    private String generateCodeChallenge(String codeVerifier, String method) {
        try {
            MessageDigest digest = MessageDigest.getInstance(method.toUpperCase()); // e.g., SHA256
            byte[] encodedVerifier = digest.digest(codeVerifier.getBytes(StandardCharsets.US_ASCII));
            return Base64.getUrlEncoder().withoutPadding().encodeToString(encodedVerifier);
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException("Unsupported challenge method: " + method, e);
        }
    }

    // Dummy DTO for OAuth Token Response
    @JsonIgnoreProperties(ignoreUnknown = true)
    public static class OAuthTokenResponse {
        @JsonProperty("access_token")
        private String accessToken;
        @JsonProperty("token_type")
        private String tokenType;
        @JsonProperty("expires_in")
        private Long expiresIn;
        @JsonProperty("refresh_token")
        private String refreshToken;
        // ... other fields
        public String getAccessToken() { return accessToken; }
        public String getRefreshToken() { return refreshToken; }
    }
}