P3.2: Classifier — PKCE missing on auth-code flow

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P3
Depends on: P3.1

Goal

Fire a finding when an OAuth/OIDC authorization-code flow construction lacks a visible code_challenge / code_challenge_method parameter or PKCE library call.

Acceptance criteria

• oauth_pkce_missing_review fires when an auth-code flow artifact is detected without code_challenge/code_challenge_method evidence in the same scope.
• Review-required only — some libraries enable PKCE by provider default (next-auth, certain openid-client configs), and SessionScope cannot prove provider-side enforcement.
• Evidence-bound: links the flow artifact and the absence-of-PKCE evidence.

New check IDs

• oauth_pkce_missing_review

Files touched

• crates/sessionscope-classifier/src/oauth_flow.rs (new)

Fixture expectations

• Negative: passport-oauth2 auth-code flow without PKCE.
• Positive: authlib OAuth2Session(..., code_challenge=...) (no fire).
• False-positive: next-auth provider block that doesn't visibly configure PKCE but relies on provider default — fires as review-required with explicit framework_default flag.

Audit-then-decide

• Category: dynamic_review_required, severity medium.
• Feed into the consolidated P4.8 audit.

Doc-update checklist

• docs/USAGE.md check catalog.
• docs/COVERAGE_MATRIX.md row.
• docs/PROVIDER_LIBRARY_COVERAGE.md notes which libraries this applies to.
• CHANGELOG.md unreleased entry.

[bjcorder]

Implemented in 2995073.

Summary:

• Added the OAuth flow classifier module and registered it in the classification pipeline.
• Added oauth_pkce_missing_review for source-visible OAuth/OIDC authorization-code flow artifacts without same-flow PKCE evidence.
• Kept the finding review-required (dynamic_review_required, medium) to account for provider/library PKCE defaults.
• Added focused classifier tests for missing and present PKCE evidence.

Validation:

• cargo test -q -p sessionscope-classifier oauth_flow — passed

Notes / follow-ups:

• User-facing catalog and coverage matrix rows are consolidated in P3.10: Docs — P3 check catalog, OAuth/OIDC flow narrative, matrix rows #86 after all P3 check IDs are stable.

[bjcorder]

Implemented in PR #98: #98

Implementation commits:

• 2995073 — P3.2 PKCE missing classifier

Validation:

• cargo fmt --all -- --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• None.