Aww man! I was going to implement this, but you beat me to it.

I think it would be a good idea to add a test with the examples in Appendix A and Appendix B.

Appendix B

I'll see If I have time later for this. But feel free to contribute with the tests if you need it right away :)

Appendix B

I'll see If I have time later for this. But feel free to contribute with the tests if you need it right away :)

I'm still new to Elixir, but I may give it a try later :)

Waiting for this to be merged to upstream. A very good PR!

Just one note. use_pkce: true forces PKCE for all applications. There are use cases when you want to enable it for some applications only. For example, I want to force it for javascript apps, but don't for server-side apps. What if instead of using the global config parameter we do these things instead:

1. If code_challenge is present in the authorization request, we assume the client wants PKCE check and enable it.
2. We add a field to the oauth_applications table something like require_pkce, and if it's true, we fail the authorization if the parameters are not present.

What do you think?

@Ross65536 Made a PR to your repo :)
Ross65536#1