P3.3: Classifier — OAuth state parameter integrity

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P3
Depends on: P3.1

Goal

Fire findings for missing, static, or unverified state parameters in OAuth flows.

Acceptance criteria

• oauth_state_missing fires when an auth-code flow's authorize-URL builder lacks a state parameter.
• oauth_state_static_review fires when state is assigned from a literal string (not crypto-random).
• oauth_state_unverified_review fires when a callback handler reads state but no comparison against a stored value (session, cache, signed cookie) is visible.
• Evidence-bound — each finding links the relevant flow / handler / state-assignment / state-read evidence IDs.

New check IDs

• oauth_state_missing
• oauth_state_static_review
• oauth_state_unverified_review

Files touched

• crates/sessionscope-classifier/src/oauth_flow.rs

Fixture expectations

• Negative variants for each check.
• Positive: state = crypto.randomBytes(...).toString('hex') with callback comparison present.
• False-positive: state assigned from a function call to a custom CSRF helper — confirm no fire (link evidence as review-required).

Audit-then-decide

• oauth_state_missing: candidate missing_validation_evidence, severity medium.
• oauth_state_static_review: candidate dynamic_review_required, severity medium.
• oauth_state_unverified_review: candidate missing_validation_evidence, severity high.
• Feed into the consolidated P4.8 audit.

Doc-update checklist

• docs/USAGE.md check catalog: three new IDs.
• docs/COVERAGE_MATRIX.md: three rows.
• CHANGELOG.md unreleased entry.

[bjcorder]

Implemented in 52b8c6e.

Summary:

• Added oauth_state_missing for authorization-code flows without source-visible state evidence.
• Added oauth_state_static_review for literal state assignments, with redacted evidence values.
• Added oauth_state_unverified_review when callback state is read without same-flow verification evidence.
• Added focused classifier tests for missing, static, unverified, and verified state cases.

Validation:

• cargo test -q -p sessionscope-classifier oauth_flow — passed

Notes / follow-ups:

• User-facing catalog and coverage matrix rows are consolidated in P3.10: Docs — P3 check catalog, OAuth/OIDC flow narrative, matrix rows #86 after all P3 check IDs are stable.

[bjcorder]

Implemented in PR #98: #98

Implementation commits:

• 52b8c6e — P3.3 OAuth state integrity classifier

Validation:

• cargo fmt --all -- --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• None.