deps: bump sha2 from 0.10.9 to 0.11.1

CHANGELOG.md

@@ -5,6 +5,7 @@
 ### Changed
 
 - Updated Rust dependencies (`tokio` 1.54.1, `serde_json` 1.0.154, `uuid` 1.28.0, `webbrowser` 1.2.5) and the CI and release workflows' `Swatinem/rust-cache` pin to v2.9.3. `rust-version` in `Cargo.toml` is now 1.89, the oldest Rust the dependencies build with; it said 1.75.
+- Updated `sha2` to 0.11.1 (it computes the PKCE code challenge for browser login). The challenge is now unit-tested against the RFC 7636 example, so a hashing or encoding change cannot slip through as failed logins.
 
 ### Fixed
 

Cargo.toml

@@ -26,7 +26,7 @@ serde_json = "1"
 toml = "1.1"
 toml_edit = "0.25"
 keyring = { version = "3", features = ["apple-native", "linux-native", "windows-native"] }
-sha2 = "0.10"
+sha2 = "0.11"
 base64 = "0.23"
 getrandom = "0.3"
 hyper = { version = "1", features = ["server", "http1"] }

src/auth/auth_code_pkce.rs

@@ -20,12 +20,16 @@ fn random_urlsafe_bytes(len: usize) -> Result<String> {
 
 fn generate_pkce() -> Result<(String, String)> {
     let verifier = random_urlsafe_bytes(32)?;
+    let challenge = s256_challenge(&verifier);
 
+    Ok((verifier, challenge))
+}
+
+/// The S256 code challenge for a verifier (RFC 7636 section 4.2).
+fn s256_challenge(verifier: &str) -> String {
     let mut hasher = Sha256::new();
     hasher.update(verifier.as_bytes());
-    let challenge = URL_SAFE_NO_PAD.encode(hasher.finalize());
-
-    Ok((verifier, challenge))
+    URL_SAFE_NO_PAD.encode(hasher.finalize())
 }
 
 /// Build the authorization URL for the browser login.
@@ -212,6 +216,26 @@ mod tests {
         assert!(url.contains("&code_challenge_method=S256"));
     }
 
+    #[test]
+    fn s256_challenge_matches_rfc7636_example() {
+        // RFC 7636 Appendix B.
+        assert_eq!(
+            s256_challenge("dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"),
+            "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
+        );
+    }
+
+    #[test]
+    fn generated_verifier_is_43_unreserved_chars() {
+        let (verifier, challenge) = generate_pkce().unwrap();
+
+        assert_eq!(verifier.len(), 43);
+        assert!(verifier
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_'));
+        assert_eq!(challenge, s256_challenge(&verifier));
+    }
+
     #[test]
     fn authorize_url_forces_account_picker() {
         let url = build_authorize_url("client-1", "tenant-1", "User.Read", "s", "c");