Implement P3 OAuth flow and client storage hardening

[bjcorder]

Summary

Implements milestone 13 / P3 OAuth flow + client storage hardening:

• Adds oauth_flow detector and oauth_auth_code_flow artifact type.
• Adds OAuth/OIDC classifiers for missing PKCE, state integrity, nonce validation, and broad redirect URI review.
• Adds client_storage detector/classifier for localStorage, sessionStorage, URL path/fragment token exposure, and browser-path client secrets.
• Extends redaction for OAuth state/nonce/PKCE material and browser storage token values.
• Adds P3 fixtures and documentation/coverage matrix updates.

Implemented issues

• P3.1: Detector — oauth_flow scaffold and registration #77 — P3.1 oauth_flow scaffold and registration
• P3.2: Classifier — PKCE missing on auth-code flow #78 — P3.2 PKCE missing classifier
• P3.3: Classifier — OAuth state parameter integrity #79 — P3.3 OAuth state parameter integrity
• P3.4: Classifier — OIDC nonce missing / unverified #80 — P3.4 OIDC nonce missing / unverified
• P3.5: Classifier — wildcard redirect_uri matching #81 — P3.5 wildcard redirect_uri matching
• P3.6: Detector — client_storage scaffold and registration #82 — P3.6 client_storage detector and registration
• P3.7: Classifier — client storage hygiene findings #83 — P3.7 client storage hygiene findings
• P3.8: Fixtures — OAuth flow + client storage scenarios #84 — P3.8 OAuth flow + client storage fixtures
• P3.9: Redaction extension — OAuth state, nonce, code_verifier, code_challenge #85 — P3.9 OAuth state/nonce/PKCE redaction
• P3.10: Docs — P3 check catalog, OAuth/OIDC flow narrative, matrix rows #86 — P3.10 P3 docs and coverage matrix

Validation

• cargo fmt --all -- --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Review notes

Fresh-context completion, correctness, and security reviews were run. Follow-up fixes addressed OAuth flow scoping, state/nonce verification false positives, and redaction coverage for OAuth/client-storage values, including template literals and report re-sanitization.

Risks / follow-ups

• P3.1 artifact-type audit outcome: this PR adds oauth_auth_code_flow; include this in the P4.8 consolidated audit rollup.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[bjcorder]

Review/remediation update:

Summary:

• Resolved PR Implement P3 OAuth flow and client storage hardening #98 merge conflicts with current origin/main in 6336bb0.
• Narrowed OAuth flow detection to avoid arbitrary register(...) false positives.
• Narrowed URL path/fragment token detection to avoid benign route false positives while keeping explicit token URL evidence.
• Clarified document.cookie token writes as P3 detector evidence only.

Security/regression review:

• Added OAuth nested literal redaction coverage for state/nonce/PKCE excerpts.
• Added detector and core redaction coverage for unquoted camelCase clientSecret values.
• Follow-up fresh-context merge-readiness and security reviews found no remaining blockers.

Merge conflicts:

• Resolved in 6336bb0.

Validation:

• cargo test -q -p sessionscope-detectors oauth_flow — passed
• cargo test -q -p sessionscope-detectors client_storage — passed
• cargo test -q -p sessionscope-classifier client_storage — passed
• cargo test -q -p sessionscope-classifier jwt — passed
• cargo test -q -p sessionscope-testing p3_oauth_and_client_storage_fixtures_emit_expected_findings — passed
• cargo test -q -p sessionscope-testing p3_false_positive_fixtures_stay_clean — passed
• cargo fmt --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Commits pushed:

• 6336bb0 — Address PR Implement P3 OAuth flow and client storage hardening #98 review findings

Remaining notes:

• GitHub checks were queued after push at the time of this update.

[bjcorder]

CI remediation update:

Summary:

• Investigated failing Rust CI jobs on Ubuntu, macOS, and Windows.
• Root cause was cargo fmt --all -- --check failing after commit 7defb93 changed a reporter assertion without rustfmt formatting.
• Applied rustfmt-compatible formatting in 22b0932 and pushed to the PR branch.

Validation:

• cargo fmt --all -- --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Commits pushed:

• 22b0932 — Address PR Implement P3 OAuth flow and client storage hardening #98 review findings

Remaining notes:

• Waiting for GitHub checks from the latest push to complete.