testing-proxy/src/lib/oauth/pkce.js

import crypto from 'node:crypto';

/**
 * Generate a PKCE S256 code challenge from a code verifier.
 * @param {string} codeVerifier
 * @returns {string}
 */
export function generateCodeChallenge(codeVerifier) {
  const hash = crypto.createHash('sha256').update(codeVerifier).digest();
  return hash.toString('base64url');
}

/**
 * Verify a PKCE S256 code challenge against a code verifier.
 * @param {string} verifier
 * @param {string} challenge
 * @returns {boolean}
 */
export function verifyCodeChallenge(verifier, challenge) {
  const regenerated = generateCodeChallenge(verifier);
  const a = Buffer.from(regenerated);
  const b = Buffer.from(challenge);
  if (a.length !== b.length) return false;
  return crypto.timingSafeEqual(a, b);
}