@autional-cn/shared 0.1.0-rc

package/src/auth/__tests__/auth-machine.test.ts

@@ -0,0 +1,157 @@
+/**
+ * AuthMachine 单元测试
+ *
+ * 验证状态机 reducer 的纯函数逻辑:
+ * - 状态转换是否正确
+ * - 边界条件
+ * - 从不合法状态恢复
+ */
+import { describe, it, expect } from 'vitest';
+
+// AuthMachine 的 reducer 逻辑是纯函数，可以直接测试
+type AuthStatus =
+	| 'checking'
+	| 'authenticated'
+	| 'bootstrap'
+	| 'ready'
+	| 'unauthenticated'
+	| 'redirecting';
+
+interface MachineState {
+	status: AuthStatus;
+	hasToken: boolean;
+}
+
+type Action =
+	| { type: 'TOKEN_FOUND' }
+	| { type: 'NO_TOKEN' }
+	| { type: 'BOOTSTRAP_LOADING' }
+	| { type: 'BOOTSTRAP_READY' }
+	| { type: 'BOOTSTRAP_ERROR' }
+	| { type: 'SESSION_EXPIRED' }
+	| { type: 'REDIRECT' };
+
+function authReducer(state: MachineState, action: Action): MachineState {
+	switch (action.type) {
+		case 'TOKEN_FOUND':
+			return { ...state, status: 'authenticated', hasToken: true };
+		case 'NO_TOKEN':
+			return { ...state, status: 'unauthenticated', hasToken: false };
+		case 'BOOTSTRAP_LOADING':
+			return state.status === 'authenticated' ? { ...state, status: 'bootstrap' } : state;
+		case 'BOOTSTRAP_READY':
+			return state.status === 'bootstrap' || state.status === 'authenticated'
+				? { ...state, status: 'ready' }
+				: state;
+		case 'BOOTSTRAP_ERROR':
+			return state.status === 'bootstrap' ? { ...state, status: 'ready' } : state;
+		case 'SESSION_EXPIRED':
+			return { ...state, status: 'unauthenticated', hasToken: false };
+		case 'REDIRECT':
+			return { ...state, status: 'redirecting' };
+		default:
+			return state;
+	}
+}
+
+function createInitialState(): MachineState {
+	return { status: 'checking', hasToken: false };
+}
+
+describe('AuthMachine reducer', () => {
+	it('初始状态为 checking，无 token', () => {
+		const state = createInitialState();
+		expect(state.status).toBe('checking');
+		expect(state.hasToken).toBe(false);
+	});
+
+	it('TOKEN_FOUND → authenticated', () => {
+		const state = authReducer(createInitialState(), { type: 'TOKEN_FOUND' });
+		expect(state.status).toBe('authenticated');
+		expect(state.hasToken).toBe(true);
+	});
+
+	it('NO_TOKEN → unauthenticated', () => {
+		const state = authReducer(createInitialState(), { type: 'NO_TOKEN' });
+		expect(state.status).toBe('unauthenticated');
+		expect(state.hasToken).toBe(false);
+	});
+
+	it('authenticated + BOOTSTRAP_LOADING → bootstrap', () => {
+		const authenticated = authReducer(createInitialState(), { type: 'TOKEN_FOUND' });
+		const state = authReducer(authenticated, { type: 'BOOTSTRAP_LOADING' });
+		expect(state.status).toBe('bootstrap');
+	});
+
+	it('authenticated + BOOTSTRAP_READY → ready（跳过 bootstrap）', () => {
+		const authenticated = authReducer(createInitialState(), { type: 'TOKEN_FOUND' });
+		const state = authReducer(authenticated, { type: 'BOOTSTRAP_READY' });
+		expect(state.status).toBe('ready');
+	});
+
+	it('bootstrap + BOOTSTRAP_READY → ready', () => {
+		const authenticated = authReducer(createInitialState(), { type: 'TOKEN_FOUND' });
+		const bootstrap = authReducer(authenticated, { type: 'BOOTSTRAP_LOADING' });
+		const state = authReducer(bootstrap, { type: 'BOOTSTRAP_READY' });
+		expect(state.status).toBe('ready');
+	});
+
+	it('bootstrap + BOOTSTRAP_ERROR → ready（降级运行）', () => {
+		const authenticated = authReducer(createInitialState(), { type: 'TOKEN_FOUND' });
+		const bootstrap = authReducer(authenticated, { type: 'BOOTSTRAP_LOADING' });
+		const state = authReducer(bootstrap, { type: 'BOOTSTRAP_ERROR' });
+		expect(state.status).toBe('ready');
+	});
+
+	it('SESSION_EXPIRED → unauthenticated（从任何状态）', () => {
+		const ready = authReducer(
+			authReducer(authReducer(createInitialState(), { type: 'TOKEN_FOUND' }), {
+				type: 'BOOTSTRAP_READY',
+			}),
+			{ type: 'SESSION_EXPIRED' },
+		);
+		expect(ready.status).toBe('unauthenticated');
+		expect(ready.hasToken).toBe(false);
+	});
+
+	it('unauthenticated + REDIRECT → redirecting', () => {
+		const unauth = authReducer(createInitialState(), { type: 'NO_TOKEN' });
+		const state = authReducer(unauth, { type: 'REDIRECT' });
+		expect(state.status).toBe('redirecting');
+	});
+
+	it('checking 态下 BOOTSTRAP_LOADING 不应改变状态', () => {
+		const state = authReducer(createInitialState(), { type: 'BOOTSTRAP_LOADING' });
+		expect(state.status).toBe('checking'); // 不变
+	});
+
+	it('checking 态下 BOOTSTRAP_READY 不应改变状态', () => {
+		const state = authReducer(createInitialState(), { type: 'BOOTSTRAP_READY' });
+		expect(state.status).toBe('checking'); // 不变
+	});
+
+	it('完整 happy path: checking → authenticated → bootstrap → ready', () => {
+		let state = createInitialState();
+		expect(state.status).toBe('checking');
+
+		state = authReducer(state, { type: 'TOKEN_FOUND' });
+		expect(state.status).toBe('authenticated');
+
+		state = authReducer(state, { type: 'BOOTSTRAP_LOADING' });
+		expect(state.status).toBe('bootstrap');
+
+		state = authReducer(state, { type: 'BOOTSTRAP_READY' });
+		expect(state.status).toBe('ready');
+	});
+
+	it('完整 unauthenticated path: checking → unauthenticated → redirecting', () => {
+		let state = createInitialState();
+		expect(state.status).toBe('checking');
+
+		state = authReducer(state, { type: 'NO_TOKEN' });
+		expect(state.status).toBe('unauthenticated');
+
+		state = authReducer(state, { type: 'REDIRECT' });
+		expect(state.status).toBe('redirecting');
+	});
+});

package/src/auth/__tests__/build-login-url.test.ts

@@ -0,0 +1,219 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { buildLoginUrl, buildLogoutUrl } from '../roles';
+
+const MOCK_CONFIG = {
+	VITE_PORTAL_CONFIG: {
+		auth: { host: 'auth', base: '' },
+	},
+};
+
+function mockWindow(
+	hostname: string,
+	protocol: string,
+	origin: string,
+	config: any = MOCK_CONFIG,
+): void {
+	vi.stubGlobal('window', {
+		location: { hostname, protocol, origin },
+		__APP_CONFIG__: config,
+	});
+}
+
+describe('buildLoginUrl', () => {
+	beforeEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	describe('basic URL construction', () => {
+		it('builds base login URL pointing to auth domain', () => {
+			mockWindow('app.iam.tianv.local', 'https:', 'https://app.iam.tianv.local');
+			const url = buildLoginUrl();
+			expect(url).toBe('https://auth.iam.tianv.local');
+		});
+
+		it('includes redirect param when returnUrl provided', () => {
+			mockWindow('app.iam.tianv.local', 'https:', 'https://app.iam.tianv.local');
+			const url = buildLoginUrl('https://app.iam.tianv.com/admin');
+			expect(url).toContain('redirect=');
+			expect(url).toContain(encodeURIComponent('https://app.iam.tianv.com/admin'));
+		});
+	});
+
+	describe('fromRequireAuth parameter', () => {
+		it('appends from_requireauth=1 when fromRequireAuth is true', () => {
+			mockWindow('app.iam.tianv.local', 'https:', 'https://app.iam.tianv.local');
+			const url = buildLoginUrl(undefined, true);
+			expect(url).toContain('from_requireauth=1');
+		});
+
+		it('appends from_requireauth=1 with redirect param', () => {
+			mockWindow('app.iam.tianv.local', 'https:', 'https://app.iam.tianv.local');
+			const url = buildLoginUrl('https://app.iam.tianv.com/admin', true);
+			expect(url).toContain('redirect=');
+			expect(url).toContain('from_requireauth=1');
+			expect(url).toContain('&from_requireauth=1');
+		});
+
+		it('does not include from_requireauth when fromRequireAuth is false', () => {
+			mockWindow('app.iam.tianv.local', 'https:', 'https://app.iam.tianv.local');
+			const url = buildLoginUrl('https://app.iam.tianv.com/admin', false);
+			expect(url).not.toContain('from_requireauth');
+		});
+
+		it('does not include from_requireauth when fromRequireAuth is undefined', () => {
+			mockWindow('app.iam.tianv.local', 'https:', 'https://app.iam.tianv.local');
+			const url = buildLoginUrl('https://app.iam.tianv.com/admin');
+			expect(url).not.toContain('from_requireauth');
+		});
+
+		it('returns only from_requireauth=1 when no returnUrl but fromRequireAuth is true', () => {
+			mockWindow('app.iam.tianv.local', 'https:', 'https://app.iam.tianv.local');
+			const url = buildLoginUrl(undefined, true);
+			expect(url).toContain('?from_requireauth=1');
+			expect(url).not.toContain('redirect=');
+		});
+	});
+
+	describe('domain-agnostic', () => {
+		it('works with .com domain', () => {
+			mockWindow('app.iam.tianv.com', 'https:', 'https://app.iam.tianv.com');
+			const url = buildLoginUrl();
+			expect(url).toBe('https://auth.iam.tianv.com');
+		});
+
+		it('works with autional.com domain', () => {
+			mockWindow('app.autional.com', 'https:', 'https://app.autional.com');
+			const url = buildLoginUrl();
+			expect(url).toBe('https://auth.autional.com');
+		});
+	});
+
+	describe('tenant-slug preservation', () => {
+		const AUTH_CONFIG = {
+			VITE_PORTAL_CONFIG: {
+				auth: { host: 'auth', base: '' },
+			},
+		};
+
+		it('redirects to {slug}/login when returnUrl is tenant-scoped on auth domain', () => {
+			mockWindow('auth.autional.local', 'https:', 'https://auth.autional.local', AUTH_CONFIG);
+			const url = buildLoginUrl('https://auth.autional.local/acme-corp/dashboard');
+			expect(url).toBe(
+				'https://auth.autional.local/acme-corp/login?redirect=' +
+					encodeURIComponent('https://auth.autional.local/acme-corp/dashboard'),
+			);
+		});
+
+		it('keeps from_requireauth on tenant-scoped login url', () => {
+			mockWindow('auth.autional.local', 'https:', 'https://auth.autional.local', AUTH_CONFIG);
+			const url = buildLoginUrl('https://auth.autional.local/acme-corp/dashboard', true);
+			expect(url).toBe(
+				'https://auth.autional.local/acme-corp/login?redirect=' +
+					encodeURIComponent('https://auth.autional.local/acme-corp/dashboard') +
+					'&from_requireauth=1',
+			);
+		});
+
+		it('does not treat reserved auth routes as tenant slug', () => {
+			mockWindow('auth.autional.local', 'https:', 'https://auth.autional.local', AUTH_CONFIG);
+			const url = buildLoginUrl('https://auth.autional.local/reset-password');
+			expect(url).toBe(
+				'https://auth.autional.local?redirect=' +
+					encodeURIComponent('https://auth.autional.local/reset-password'),
+			);
+		});
+
+		it('preserves cross-domain returnUrl behavior (app domain)', () => {
+			mockWindow('auth.autional.local', 'https:', 'https://auth.autional.local', AUTH_CONFIG);
+			const url = buildLoginUrl('https://app.autional.com/admin');
+			expect(url).toBe(
+				'https://auth.autional.local?redirect=' +
+					encodeURIComponent('https://app.autional.com/admin'),
+			);
+		});
+
+		it('does not truncate cross-domain returnUrl containing /login substring (regression P1-2)', () => {
+			mockWindow('auth.autional.local', 'https:', 'https://auth.autional.local', AUTH_CONFIG);
+			const url = buildLoginUrl('https://app.autional.com/admin/login');
+			expect(url).toBe(
+				'https://auth.autional.local?redirect=' +
+					encodeURIComponent('https://app.autional.com/admin/login'),
+			);
+		});
+
+		it('truncates auth-domain login page itself (no nested redirect)', () => {
+			mockWindow('auth.autional.local', 'https:', 'https://auth.autional.local', AUTH_CONFIG);
+			const url = buildLoginUrl('https://auth.autional.local/acme-corp/login');
+			expect(url).toBe('https://auth.autional.local/acme-corp/login');
+		});
+	});
+
+	describe('useLogout unification (logout → login redirect)', () => {
+		const AUTH_CONFIG = {
+			VITE_PORTAL_CONFIG: {
+				auth: { host: 'auth', base: '' },
+			},
+		};
+
+		it('logout from auth-domain tenant page keeps tenant slug (bug scenario)', () => {
+			mockWindow('auth.autional.local', 'https:', 'https://auth.autional.local', AUTH_CONFIG);
+			const url = buildLoginUrl('https://auth.autional.local/acme-corp/dashboard');
+			expect(url).toBe(
+				'https://auth.autional.local/acme-corp/login?redirect=' +
+					encodeURIComponent('https://auth.autional.local/acme-corp/dashboard'),
+			);
+		});
+
+		it('logout from auth root (tenant select page) does not add redirect', () => {
+			mockWindow('auth.autional.local', 'https:', 'https://auth.autional.local', AUTH_CONFIG);
+			const url = buildLoginUrl('https://auth.autional.local/');
+			expect(url).toBe('https://auth.autional.local');
+		});
+
+		it('logout from portal domain falls back to generic auth login (no slug misjudge)', () => {
+			// useLogout 在 portal app 中跨域调用：returnUrl origin ≠ auth origin，
+			// 首段 /admin 不会被误判为租户 slug，跳转 {base}?redirect=<portal-url>
+			mockWindow('app.autional.com', 'https:', 'https://app.autional.com', AUTH_CONFIG);
+			const url = buildLoginUrl('https://app.autional.com/admin');
+			expect(url).toBe(
+				'https://auth.autional.com?redirect=' +
+					encodeURIComponent('https://app.autional.com/admin'),
+			);
+		});
+	});
+
+	describe('buildLogoutUrl（F-W5c 登出意图标记）', () => {
+		const AUTH_CONFIG = {
+			VITE_PORTAL_CONFIG: {
+				auth: { host: 'auth', base: '' },
+			},
+		};
+
+		it('门户域登出：auth 裸根 + redirect 回程 + logout=1', () => {
+			mockWindow('app.autional.com', 'https:', 'https://app.autional.com', AUTH_CONFIG);
+			const url = buildLogoutUrl('https://app.autional.com/demo/');
+			expect(url).toBe(
+				'https://auth.autional.com/?redirect=' +
+					encodeURIComponent('https://app.autional.com/demo/') +
+					'&logout=1',
+			);
+		});
+
+		it('auth 域租户页登出也走裸根：不经 /<slug>/login（那里 logout=1 被静默忽略）', () => {
+			mockWindow('auth.autional.local', 'https:', 'https://auth.autional.local', AUTH_CONFIG);
+			const url = buildLogoutUrl('https://auth.autional.local/acme-corp/dashboard');
+			expect(url).toBe(
+				'https://auth.autional.local/?redirect=' +
+					encodeURIComponent('https://auth.autional.local/acme-corp/dashboard') +
+					'&logout=1',
+			);
+			expect(url).not.toContain('/acme-corp/login');
+		});
+
+		it('无回程：auth 裸根 + logout=1', () => {
+			mockWindow('auth.autional.local', 'https:', 'https://auth.autional.local', AUTH_CONFIG);
+			const url = buildLogoutUrl();
+			expect(url).toBe('https://auth.autional.local/?logout=1');
+		});
+	});
+});

package/src/auth/__tests__/get-current-role.test.ts

@@ -0,0 +1,61 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { useAuthStore, getCurrentRole } from '../store';
+
+// 注：node 测试环境下 zustand persist 中间件会打印一条无害的 storage 降级警告
+// （"Unable to update item 'authms-auth-v1'"），这是 store.ts 既有 persist 的
+// 标准降级行为，不影响被测的 getCurrentRole 派生逻辑。
+
+const TENANTS = [
+	{ id: 'tenant-a', name: 'Tenant A', role: 'admin' },
+	{ id: 'tenant-b', name: 'Tenant B', role: 'member' },
+];
+
+/** 重置 store 到初始状态，避免跨用例污染（AC-002 约定） */
+function resetAuthStore(): void {
+	useAuthStore.setState({
+		user: null,
+		accessToken: null,
+		refreshToken: null,
+		tenants: [],
+		currentTenantId: null,
+		permissions: [],
+		isAuthenticated: false,
+	});
+}
+
+describe('getCurrentRole (AC-001 四态派生，userinfo-first)', () => {
+	beforeEach(() => {
+		resetAuthStore();
+	});
+
+	it('① tenants 空 → null', () => {
+		useAuthStore.setState({ tenants: [], currentTenantId: 'tenant-a' });
+		expect(getCurrentRole()).toBeNull();
+	});
+
+	it('② currentTenantId null → null（不猜测）', () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: null });
+		expect(getCurrentRole()).toBeNull();
+	});
+
+	it('③ 命中 → tenants.find(t => t.id === currentTenantId).role', () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: 'tenant-a' });
+		expect(getCurrentRole()).toBe('admin');
+
+		useAuthStore.setState({ currentTenantId: 'tenant-b' });
+		expect(getCurrentRole()).toBe('member');
+	});
+
+	it('④ 租户切换后重查返回新角色（switchTenant）', () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: 'tenant-a' });
+		expect(getCurrentRole()).toBe('admin');
+
+		useAuthStore.getState().switchTenant('tenant-b');
+		expect(getCurrentRole()).toBe('member');
+	});
+
+	it('currentTenantId 指向不存在的租户 → null（不猜测）', () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: 'tenant-ghost' });
+		expect(getCurrentRole()).toBeNull();
+	});
+});

package/src/auth/__tests__/oauth-client-from-slug.test.ts

@@ -0,0 +1,132 @@
+// @vitest-environment jsdom
+import '@testing-library/jest-dom/vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { renderHook, cleanup, waitFor } from '@testing-library/react';
+
+// ============================================================
+// F-W6 判别依据：按 slug 拉取公开 auth-config 的三态
+//  - ok（2xx）
+//  - unknown-slug（**HTTP 404**，租户确定性不存在）→ 门户侧闸门判死
+//  - error（网络/5xx/解析失败）→ 必须 fail-open（not-found，仍走登录漏斗）
+// 契约来源：identity public_handler.go GetTenantAuthConfigBySlug ——
+//  租户不存在 → 404 ErrCodeNotFound；已知租户未配 client → 200（client 空）。
+// ============================================================
+
+import {
+	useOAuthClientIdFromUrl,
+	fetchOAuthClientIdBySlug,
+} from '../oauth-client-from-slug';
+
+function setPath(path: string) {
+	window.history.pushState({}, '', path);
+}
+
+function stubFetch(ok: boolean, status: number, body?: unknown) {
+	vi.stubGlobal(
+		'fetch',
+		vi.fn().mockResolvedValue({
+			ok,
+			status,
+			json: async () => body,
+		}),
+	);
+}
+
+beforeEach(() => {
+	setPath('/acme');
+	delete (window as any).__APP_CONFIG__;
+});
+
+afterEach(() => {
+	cleanup();
+	vi.unstubAllGlobals();
+});
+
+describe('useOAuthClientIdFromUrl（三态判别）', () => {
+	it('HTTP 404 → unknown-slug（确定性不存在，带 slug）', async () => {
+		stubFetch(false, 404);
+		const { result } = renderHook(() => useOAuthClientIdFromUrl());
+
+		await waitFor(() => expect(result.current.status).toBe('unknown-slug'));
+		expect(result.current).toMatchObject({ status: 'unknown-slug', slug: 'acme' });
+		expect(fetch).toHaveBeenCalledWith(expect.stringContaining('by-slug/acme'));
+	});
+
+	it('HTTP 500 → not-found（fail-open，不得判死；回归锁）', async () => {
+		stubFetch(false, 500);
+		const { result } = renderHook(() => useOAuthClientIdFromUrl());
+
+		await waitFor(() => expect(result.current.status).toBe('not-found'));
+	});
+
+	it('网络异常 → not-found（fail-open）', async () => {
+		vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error('network down')));
+		const { result } = renderHook(() => useOAuthClientIdFromUrl());
+
+		await waitFor(() => expect(result.current.status).toBe('not-found'));
+	});
+
+	it('200 + data.oauthClientId（camel）→ resolved', async () => {
+		stubFetch(true, 200, { data: { oauthClientId: 'cid-1', tenantId: 't1' } });
+		const { result } = renderHook(() => useOAuthClientIdFromUrl());
+
+		await waitFor(() => expect(result.current.status).toBe('resolved'));
+		expect(result.current).toMatchObject({
+			status: 'resolved',
+			slug: 'acme',
+			clientId: 'cid-1',
+			config: { tenantId: 't1' },
+		});
+	});
+
+	it('200 + 扁平 oauth_client_id（snake）→ resolved', async () => {
+		stubFetch(true, 200, { oauth_client_id: 'cid-snake' });
+		const { result } = renderHook(() => useOAuthClientIdFromUrl());
+
+		await waitFor(() => expect(result.current.status).toBe('resolved'));
+		expect(result.current).toMatchObject({ status: 'resolved', clientId: 'cid-snake' });
+	});
+
+	it('200 但无 client（已知租户未配）→ not-found（不误判 unknown-slug）', async () => {
+		stubFetch(true, 200, { data: { tenantId: 't1' } });
+		const { result } = renderHook(() => useOAuthClientIdFromUrl());
+
+		await waitFor(() => expect(result.current.status).toBe('not-found'));
+	});
+
+	it('根路径无 slug → not-found 且不发请求', async () => {
+		setPath('/');
+		stubFetch(true, 200, { data: { oauthClientId: 'cid-1' } });
+		const { result } = renderHook(() => useOAuthClientIdFromUrl());
+
+		await waitFor(() => expect(result.current.status).toBe('not-found'));
+		expect(fetch).not.toHaveBeenCalled();
+	});
+
+	it('env 固定 client（admin-console 旁路）→ not-found 且不发请求', async () => {
+		setPath('/users');
+		(window as any).__APP_CONFIG__ = { VITE_OAUTH_CLIENT_ID: 'cid-env' };
+		stubFetch(true, 200, { data: { oauthClientId: 'cid-1' } });
+		const { result } = renderHook(() => useOAuthClientIdFromUrl());
+
+		await waitFor(() => expect(result.current.status).toBe('not-found'));
+		expect(fetch).not.toHaveBeenCalled();
+	});
+});
+
+describe('fetchOAuthClientIdBySlug（非 hook 版本，登录页回源）', () => {
+	it('200 + client → 返回 clientId', async () => {
+		stubFetch(true, 200, { data: { oauthClientId: 'cid-1' } });
+		await expect(fetchOAuthClientIdBySlug('acme')).resolves.toBe('cid-1');
+	});
+
+	it('404 → null', async () => {
+		stubFetch(false, 404);
+		await expect(fetchOAuthClientIdBySlug('acme')).resolves.toBeNull();
+	});
+
+	it('网络异常 → null', async () => {
+		vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error('network down')));
+		await expect(fetchOAuthClientIdBySlug('acme')).resolves.toBeNull();
+	});
+});

package/src/auth/__tests__/pkce-uniformity.test.ts

@@ -0,0 +1,48 @@
+import { describe, it, expect } from 'vitest';
+import { generatePKCE } from '../pkce';
+
+// RFC 7636 verifier charset — must stay in sync with generateRandomString in ../pkce.ts
+const CHARSET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
+const CHAR_SET = new Set(CHARSET.split(''));
+
+describe('generatePKCE (PRNG rejection sampling — no modulo bias)', () => {
+	it('produces RFC 7636-compliant verifier: 64 chars from A-Za-z0-9-._~', async () => {
+		for (let i = 0; i < 50; i++) {
+			const { verifier } = await generatePKCE();
+			expect(verifier).toHaveLength(64);
+			for (const ch of verifier) {
+				expect(CHAR_SET.has(ch), `unexpected char ${ch}`).toBe(true);
+			}
+		}
+	});
+
+	it('verifiers differ across calls (non-deterministic)', async () => {
+		const a = await generatePKCE();
+		const b = await generatePKCE();
+		expect(a.verifier).not.toBe(b.verifier);
+	});
+
+	it('each of the 66 chars is near-uniformly distributed (rejection sampling kills modulo bias)', async () => {
+		// 30k verifiers × 64 chars = 1.92M samples. With uniform distribution the
+		// per-char std dev is ~0.9% of the mean, so ±5% tolerance has ~7σ margin —
+		// never flakes, while a naive `byte % 66` would push chars 58-65 ~22%
+		// below the mean and be caught immediately.
+		const SAMPLES = 30_000;
+		const counts = new Array<number>(66).fill(0);
+		for (let i = 0; i < SAMPLES; i++) {
+			const { verifier } = await generatePKCE();
+			for (const ch of verifier) {
+				counts[CHARSET.indexOf(ch)]++;
+			}
+		}
+		const total = SAMPLES * 64;
+		const expectedFreq = 1 / 66;
+		for (let i = 0; i < 66; i++) {
+			const freq = counts[i] / total;
+			expect(
+				Math.abs(freq - expectedFreq),
+				`char ${CHARSET[i]} deviated ${(((freq - expectedFreq) / expectedFreq) * 100).toFixed(2)}% from uniform`,
+			).toBeLessThan(0.05 * expectedFreq);
+		}
+	}, 30_000);
+});