fix(auth): add PKCE to OpenID Connect login

Generate a per-login verifier, persist it in the Goth session, send an S256 challenge, and include the verifier during the token exchange when explicitly enabled.

Assisted-by: Codex:GPT-5

modules/setting/oauth2.go

@@ -52,18 +52,20 @@ func (accountLinking OAuth2AccountLinkingType) isValid() bool {
 
 // OAuth2Client settings
 var OAuth2Client struct {
-	RegisterEmailConfirm   bool
-	OpenIDConnectScopes    []string
-	EnableAutoRegistration bool
-	Username               OAuth2UsernameType
-	UpdateAvatar           bool
-	AccountLinking         OAuth2AccountLinkingType
+	RegisterEmailConfirm    bool
+	OpenIDConnectScopes     []string
+	EnableOpenIDConnectPKCE bool
+	EnableAutoRegistration  bool
+	Username                OAuth2UsernameType
+	UpdateAvatar            bool
+	AccountLinking          OAuth2AccountLinkingType
 }
 
 func loadOAuth2ClientFrom(rootCfg ConfigProvider) {
 	sec := rootCfg.Section("oauth2_client")
 	OAuth2Client.RegisterEmailConfirm = sec.Key("REGISTER_EMAIL_CONFIRM").MustBool(Service.RegisterEmailConfirm)
 	OAuth2Client.OpenIDConnectScopes = parseScopes(sec, "OPENID_CONNECT_SCOPES")
+	OAuth2Client.EnableOpenIDConnectPKCE = sec.Key("ENABLE_OPENID_CONNECT_PKCE").MustBool()
 	OAuth2Client.EnableAutoRegistration = sec.Key("ENABLE_AUTO_REGISTRATION").MustBool()
 	OAuth2Client.Username = OAuth2UsernameType(sec.Key("USERNAME").MustString(string(OAuth2UsernameNickname)))
 	if !OAuth2Client.Username.isValid() {

modules/setting/oauth2_test.go

@@ -76,3 +76,15 @@ DEFAULT_APPLICATIONS =
 	loadOAuth2From(cfg)
 	assert.Nil(t, OAuth2.DefaultApplications)
 }
+
+func TestOAuth2ClientOpenIDConnectPKCE(t *testing.T) {
+	cfg, _ := NewConfigProviderFromData(``)
+	loadOAuth2ClientFrom(cfg)
+	assert.False(t, OAuth2Client.EnableOpenIDConnectPKCE)
+
+	cfg, _ = NewConfigProviderFromData(`[oauth2_client]
+ENABLE_OPENID_CONNECT_PKCE = true
+`)
+	loadOAuth2ClientFrom(cfg)
+	assert.True(t, OAuth2Client.EnableOpenIDConnectPKCE)
+}