feat: support PKCE code_verifier in exchange_auth_code_for_tokens

lib/auth0/api/authentication_endpoints.rb

@@ -48,20 +48,25 @@ def api_token(
       # @param client_id [string] Client ID for the application
       # @param client_secret [string] Client secret for the application. Ignored if using Client Assertion
       #   Required only if it was set at the GET /authorize endpoint
+      # @param code_verifier [string] Cryptographically random key used to generate the
+      #   code_challenge passed to GET /authorize. Required for the Authorization Code Flow
+      #   with PKCE.
       # @return [Auth0::AccessToken] Returns the access_token and id_token
       def exchange_auth_code_for_tokens(
         code,
         redirect_uri: nil,
         client_id: @client_id,
-        client_secret: @client_secret
+        client_secret: @client_secret,
+        code_verifier: nil
       )
         raise Auth0::InvalidParameter, 'Must provide an authorization code' if code.to_s.empty?
 
         request_params = {
           grant_type: 'authorization_code',
           client_id: client_id,
           code: code,
-          redirect_uri: redirect_uri
+          redirect_uri: redirect_uri,
+          code_verifier: code_verifier
         }
 
         populate_client_assertion_or_secret(request_params, client_id: client_id, client_secret: client_secret)

test/unit/authentication_endpoints_test.rb

@@ -177,6 +177,77 @@ def test_exchange_auth_code_for_tokens_with_client_assertion
     refute_nil result.access_token
   end
 
+  def test_exchange_auth_code_for_tokens_with_code_verifier
+    stub_request(:post, "https://#{@domain}/oauth/token")
+      .with do |req|
+        body = JSON.parse(req.body, symbolize_names: true)
+        body[:grant_type] == "authorization_code" &&
+          body[:code] == "the_auth_code" &&
+          body[:code_verifier] == "the_code_verifier"
+      end
+      .to_return(
+        status: 200,
+        body: { "id_token" => "id_token", "access_token" => "test_access_token", "expires_in" => 86_400 }.to_json,
+        headers: { "Content-Type" => "application/json" }
+      )
+
+    result = @client_secret_instance.send(
+      :exchange_auth_code_for_tokens, "the_auth_code", code_verifier: "the_code_verifier"
+    )
+
+    assert_kind_of Auth0::AccessToken, result
+    refute_nil result.access_token
+  end
+
+  def test_exchange_auth_code_for_tokens_sends_null_code_verifier_when_not_provided
+    stub_request(:post, "https://#{@domain}/oauth/token")
+      .with do |req|
+        body = JSON.parse(req.body, symbolize_names: true)
+        body.key?(:code_verifier) && body[:code_verifier].nil?
+      end
+      .to_return(
+        status: 200,
+        body: { "id_token" => "id_token", "access_token" => "test_access_token", "expires_in" => 86_400 }.to_json,
+        headers: { "Content-Type" => "application/json" }
+      )
+
+    result = @client_secret_instance.send(:exchange_auth_code_for_tokens, "the_auth_code")
+
+    assert_kind_of Auth0::AccessToken, result
+    refute_nil result.access_token
+  end
+
+  def test_exchange_auth_code_for_tokens_with_code_verifier_on_a_public_client
+    public_client = DummyClassForTokens.new(
+      domain: @domain,
+      client_id: @client_id,
+      client_secret: nil,
+      token: "test",
+      api_identifier: @api_identifier
+    )
+
+    stub_request(:post, "https://#{@domain}/oauth/token")
+      .with do |req|
+        body = JSON.parse(req.body, symbolize_names: true)
+        body[:grant_type] == "authorization_code" &&
+          body[:code_verifier] == "the_code_verifier" &&
+          body[:client_secret].nil? &&
+          body[:client_assertion].nil?
+      end
+      .to_return(
+        status: 200,
+        body: { "id_token" => "id_token", "access_token" => "test_access_token", "expires_in" => 86_400 }.to_json,
+        headers: { "Content-Type" => "application/json" }
+      )
+
+    result = public_client.send(
+      :exchange_auth_code_for_tokens, "the_auth_code", code_verifier: "the_code_verifier"
+    )
+
+    assert_kind_of Auth0::AccessToken, result
+    refute_nil result.access_token
+  end
+
   # --- exchange_refresh_token ---
 
   def test_exchange_refresh_token_with_client_secret