fix(endpoint-auth): bind code exchange to the code’s own claims, not application state

[rmdes]

Fixes #892.

codeValidator took the client an authorization code was issued to from request.app.locals.client. That is application-wide state, holding whichever authorization request last reached the server, so it can be absent (500) or refer to a different client than the one the code was issued to (a code redeemable by another client).

The change

Verify the code first, then compare the request against the claims it carries:

request.verifiedToken = verifyToken(code);

if (!request.verifiedToken.client_id || !request.verifiedToken.redirect_uri) {
  throw IndiekitError.unauthorized(__("UnauthorizedError.invalidToken"));
}

if (getCanonicalUrl(client_id) !== getCanonicalUrl(String(request.verifiedToken.client_id))) { … }
if (redirect_uri !== request.verifiedToken.redirect_uri) { … }

consent.js:82 already signs both into the code, so nothing new has to be recorded. PKCE now keys off the challenge in the code rather than app.locals.usePkce, which removes the last read of application state here.

validateRedirect is no longer called at redemption: redirect_uri is validated against the client's metadata during the authorization request, so what remains is matching the value the code was issued for. That is a behaviour change worth a look — it trades a network-dependent check for an equality one.

Tests

Two added, both failing on main:

• 401-token-grant-no-authorization-request.js — an exchange with no preceding authorization request. main returns 500 with a TypeError.
• 401-token-grant-code-issued-to-other-client.js — a code issued to one client, redeemed by another that began its own authorization request first. main returns 200 with an access token.

Seven existing tests signed codes carrying neither client_id nor redirect_uri, which consent.js cannot produce, so they exercised codes that cannot occur. They now sign the claims a real code carries. Two of them — invalid client_id and invalid redirect_uri — assert the same statuses and messages as before, now reached through the code's claims rather than through app.locals.

node --test in packages/endpoint-auth: 68 tests, 68 passing. Reverting only code.js and keeping the tests fails exactly the two new ones. main is 66/66 before this change.

Relationship to the other open branches

Independent of #884, #887 and #889. This branch is cut from main, as is #891, and both change packages/endpoint-auth/lib/middleware/code.js.

I described that overlap as a trivial rebase when opening this. Having since merged the two locally, that was understated, so to correct it: code.js does merge cleanly — #891 adds a grant_type allowance to the required-parameter list, this one replaces the checks that follow it, and git resolves that without conflict. But the merged result fails a test, and it is #891's own:

200-authorization-profile-no-grant-type.js, added there, signs a code with neither client_id nor redirect_uri — the same gap as the seven fixtures this PR updates. It passes on either branch alone and fails on both together, because this PR starts rejecting codes missing those claims. Adding them to that fixture resolves it, after which the combined branches give 70 tests, 70 passing.

So whichever merges second needs a one-line fixture change as well as the merge, and CI on the second branch will go red until it is made. Nothing structural — but it will not go green on the merge alone, which is what "trivial rebase" implied.

---

Replaces #893, which was opened from a branch on rmdes/indiekit. PRs from a fork do not receive the Localazy readKey secret, so the "Download localisations" step fails and every step after it — install, lint and the whole test suite — is skipped. Same two commits, rebased onto current main, on a branch here so CI actually runs.