P3.5: Classifier — wildcard redirect_uri matching

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P3
Depends on: P3.1

Goal

Fire a finding when an OAuth client's redirect_uris array literal contains overly permissive entries.

Acceptance criteria

• oauth_redirect_uri_wildcard_review fires when a literal redirect_uris array contains:
  • a * wildcard
  • an empty path with bare host (https://example.com)
  • a top-level-domain-only match (*.example.com form)
• Review-required only — final matching is server-side and SessionScope cannot prove enforcement strictness.
• Evidence-bound — links the array-literal evidence.

New check IDs

• oauth_redirect_uri_wildcard_review

Files touched

• crates/sessionscope-classifier/src/oauth_flow.rs

Fixture expectations

• Negative: literal redirect_uris: ['https://*.example.com/callback'].
• Positive: literal redirect_uris: ['https://app.example.com/auth/callback'].
• False-positive: redirect_uris: [process.env.REDIRECT_URI] — dynamic, no fire (but emits review-required evidence note).

Audit-then-decide

• Category: dynamic_review_required, severity medium.
• Feed into the consolidated P4.8 audit.

Doc-update checklist

• docs/USAGE.md check catalog.
• docs/COVERAGE_MATRIX.md row.
• CHANGELOG.md unreleased entry.

[bjcorder]

Implemented in $(git rev-parse --short HEAD).

Summary:

• Added oauth_redirect_uri_wildcard_review for source-visible broad/wildcard redirect URI evidence.
• Kept the finding review-required (dynamic_review_required, medium) because authorization-server redirect matching is not proven from local source.
• Added classifier tests for broad/wildcard redirect URI evidence and exact redirect URI suppression.

Validation:

• cargo test -q -p sessionscope-classifier oauth_flow — passed

Notes / follow-ups:

• User-facing catalog and coverage matrix rows are consolidated in P3.10: Docs — P3 check catalog, OAuth/OIDC flow narrative, matrix rows #86 after all P3 check IDs are stable.

[bjcorder]

Correction: implemented in 853ce6e.

Summary:

• Added oauth_redirect_uri_wildcard_review for source-visible broad/wildcard redirect URI evidence.
• Kept the finding review-required (dynamic_review_required, medium) because authorization-server redirect matching is not proven from local source.
• Added classifier tests for broad/wildcard redirect URI evidence and exact redirect URI suppression.

Validation:

• cargo test -q -p sessionscope-classifier oauth_flow — passed

Notes / follow-ups:

• User-facing catalog and coverage matrix rows are consolidated in P3.10: Docs — P3 check catalog, OAuth/OIDC flow narrative, matrix rows #86 after all P3 check IDs are stable.

[bjcorder]

Implemented in PR #98: #98

Implementation commits:

• 853ce6e — P3.5 redirect URI wildcard classifier

Validation:

• cargo fmt --all -- --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• None.