Fix PKCE in authentication controller

[john-s-morgan]

This should unblock racetimeGG/racetime-app/191.

There were some subtle issues in the Oauth2 flow and fixed:

• SHA256 method now uses the computed hash
• In refresh_token grant, we do not need verifier code
• verifier code should be generated once per auth attempt

These should all be fixed at this point, and allow racetime to authorize with full pkce

[wooferzfg]

allow racetime to authorize with full pkce

How do we test that?

[john-s-morgan]

allow racetime to authorize with full pkce

How do we test that?

Great question. I can push a change on my fork of racetimeGG/racetime-app that removes the override currently in place.

I put a pull request up in draft mode for now. you can run this locally, navigate to /admin to add an application, and see the auth flow in action

Additionally, the SHA-256 challenge generation now aligns with RFC 7636 (Appendix B), which provides a canonical verifier → challenge test vector. Given the RFC example verifier, the controller now produces the expected challenge value.

I didn’t add a formal test project here since the repo doesn’t currently have one and this targets .NET Framework 4.8, but I’m happy to split that out or add documentation if you’d prefer.

[wooferzfg]

Were you able to test the auth flow locally without the override to verify that it works with the code in this PR? Also, does the code in this PR still work with the override in place?

[john-s-morgan]

I wasn’t able to run a full end-to-end auth flow locally since LiveSplit app requires Windows, and I’m currently on macOS.

What I did validate was the PKCE logic itself: I created a small console project using a netstandard2.0 library, dropped in the controller logic, seeded it with the RFC 7636 Appendix B verifier, and confirmed that the generated challenge from SHA256() matches the canonical RFC value. This validates that the SHA-256 + base64url behavior is now correct.

On the server side, racetime-app currently sidesteps PKCE verification by stripping code_challenge and code_challenge_method during authorization. Because of that, nothing changes from an integration perspective if this PR is merged. The flow will continue to work as it does today. The difference is that this client change makes it possible for PKCE to be enabled on the server in the future without breaking the client.