Consolidate some of the PKCE logic.

Author: localden

src/ModelContextProtocol/Auth/AuthorizationHandlers.cs

@@ -16,6 +16,31 @@ public class OAuthAuthenticationService
     private static readonly HttpClient _httpClient = new();
     private readonly Func<Uri, Task<string>>? _authorizationHandler;
 
+    /// <summary>
+    /// Represents the PKCE code challenge and verifier for an authorization flow.
+    /// </summary>
+    public class PkceValues
+    {
+        /// <summary>
+        /// The code verifier used to generate the code challenge.
+        /// </summary>
+        public string CodeVerifier { get; }
+        
+        /// <summary>
+        /// The code challenge sent to the authorization server.
+        /// </summary>
+        public string CodeChallenge { get; }
+        
+        /// <summary>
+        /// Initializes a new instance of the <see cref="PkceValues"/> class.
+        /// </summary>
+        public PkceValues(string codeVerifier, string codeChallenge)
+        {
+            CodeVerifier = codeVerifier;
+            CodeChallenge = codeChallenge;
+        }
+    }
+    
     /// <summary>
     /// Initializes a new instance of the <see cref="OAuthAuthenticationService"/> class.
     /// </summary>
@@ -32,6 +57,59 @@ public OAuthAuthenticationService(Func<Uri, Task<string>> authorizationHandler)
         _authorizationHandler = authorizationHandler ?? throw new ArgumentNullException(nameof(authorizationHandler));
     }
 
+    /// <summary>
+    /// Generates new PKCE values.
+    /// </summary>
+    /// <returns>A <see cref="PkceValues"/> instance containing the code verifier and challenge.</returns>
+    public static PkceValues GeneratePkceValues()
+    {
+        var codeVerifier = GenerateCodeVerifier();
+        var codeChallenge = GenerateCodeChallenge(codeVerifier);
+        return new PkceValues(codeVerifier, codeChallenge);
+    }
+    
+    /// <summary>
+    /// Generates a cryptographically random code verifier for PKCE.
+    /// </summary>
+    /// <returns>A base64url encoded string to be used as the code verifier.</returns>
+    public static string GenerateCodeVerifier()
+    {
+        // Generate a cryptographically random code verifier
+        var bytes = new byte[64];
+        using var rng = RandomNumberGenerator.Create();
+        rng.GetBytes(bytes);
+        
+        // Base64url encode the random bytes
+        var base64 = Convert.ToBase64String(bytes);
+        var base64Url = base64
+            .Replace('+', '-')
+            .Replace('/', '_')
+            .Replace("=", "");
+        
+        return base64Url;
+    }
+    
+    /// <summary>
+    /// Generates a code challenge from a code verifier using the S256 method.
+    /// </summary>
+    /// <param name="codeVerifier">The code verifier to generate the challenge from.</param>
+    /// <returns>A base64url encoded SHA256 hash of the code verifier.</returns>
+    public static string GenerateCodeChallenge(string codeVerifier)
+    {
+        // Create code challenge using S256 method
+        using var sha256 = SHA256.Create();
+        var challengeBytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(codeVerifier));
+        
+        // Base64url encode the hash
+        var base64 = Convert.ToBase64String(challengeBytes);
+        var base64Url = base64
+            .Replace('+', '-')
+            .Replace('/', '_')
+            .Replace("=", "");
+        
+        return base64Url;
+    }
+    
     /// <summary>
     /// Handles the OAuth authentication flow when a 401 Unauthorized response is received.
     /// </summary>
@@ -251,16 +329,15 @@ private async Task<OAuthToken> PerformAuthorizationCodeFlowAsync(
         IEnumerable<string> scopes,
         Func<Uri, Task<string>>? authorizationHandler)
     {
-        // Generate PKCE code verifier and challenge
-        var codeVerifier = GenerateCodeVerifier();
-        var codeChallenge = GenerateCodeChallenge(codeVerifier);
+        // Generate PKCE values using our public method
+        var pkceValues = GeneratePkceValues();
 
         // Build authorization URL
         var authorizationUrl = BuildAuthorizationUrl(
             authServerMetadata.AuthorizationEndpoint,
             clientId,
             redirectUri,
-            codeChallenge,
+            pkceValues.CodeChallenge,
             scopes);
 
         // Check if an authorization handler is available
@@ -278,7 +355,7 @@ private async Task<OAuthToken> PerformAuthorizationCodeFlowAsync(
                     clientSecret,
                     redirectUri,
                     authorizationCode,
-                    codeVerifier);
+                    pkceValues.CodeVerifier);
             }
             catch (Exception ex)
             {
@@ -293,39 +370,6 @@ private async Task<OAuthToken> PerformAuthorizationCodeFlowAsync(
             $"You need to handle this redirect and extract the authorization code to complete the flow.");
     }
 
-    private string GenerateCodeVerifier()
-    {
-        // Generate a cryptographically random code verifier
-        var bytes = new byte[64];
-        using var rng = RandomNumberGenerator.Create();
-        rng.GetBytes(bytes);
-        
-        // Base64url encode the random bytes
-        var base64 = Convert.ToBase64String(bytes);
-        var base64Url = base64
-            .Replace('+', '-')
-            .Replace('/', '_')
-            .Replace("=", "");
-        
-        return base64Url;
-    }
-    
-    private string GenerateCodeChallenge(string codeVerifier)
-    {
-        // Create code challenge using S256 method
-        using var sha256 = SHA256.Create();
-        var challengeBytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(codeVerifier));
-        
-        // Base64url encode the hash
-        var base64 = Convert.ToBase64String(challengeBytes);
-        var base64Url = base64
-            .Replace('+', '-')
-            .Replace('/', '_')
-            .Replace("=", "");
-        
-        return base64Url;
-    }
-    
     private string BuildAuthorizationUrl(
         Uri authorizationEndpoint,
         string clientId,

src/ModelContextProtocol/Auth/OAuthAuthenticationService.cs

@@ -38,7 +38,7 @@ public class AuthorizationCodeOptions
     /// <summary>
     /// PKCE values for the authorization flow.
     /// </summary>
-    public PkceUtility.PkceValues PkceValues { get; set; } = null!;
+    public OAuthAuthenticationService.PkceValues PkceValues { get; set; } = null!;
 
     /// <summary>
     /// A state value to protect against CSRF attacks.