@hxa-rn/rnaa 8.1.0

package/harmony/rnaa/src/main/ets/OAuthHttpClient.ets

@@ -0,0 +1,293 @@
+/**
+ * OAuth HTTP client built on @ohos.net.http.
+ *
+ * Replaces net.openid.appauth.AuthorizationServiceConfiguration.fetchFromUrl /
+ * AuthorizationService.performTokenRequest / performRegistrationRequest on
+ * HarmonyOS. Supports:
+ *  - GET  OpenID Connect discovery (.well-known/openid-configuration)
+ *  - POST application/x-www-form-urlencoded (token / refresh)
+ *  - POST application/json               (dynamic client registration)
+ *
+ * connectionTimeoutMillis/readTimeout are passed through from the JS layer
+ * (already converted to milliseconds on the Harmony branch).
+ */
+import http from '@ohos.net.http';
+import { util } from '@kit.ArkTS';
+import hilog from '@ohos.hilog';
+import { DiscoveryDocument, OAuthError } from './Types';
+
+const DOMAIN: number = 0x0000;
+const TAG: string = 'RNAppAuth';
+const HTTP_OK = 200;
+
+interface NativeThrownError {
+  code: number;
+  message: string;
+}
+
+export class OAuthHttpClient {
+  /**
+   * Build a query string from a map of form parameters.
+   * Values are URL-encoded with encodeURIComponent (RFC 6749 §2.3.1).
+   */
+  static buildFormBody(parameters: Record<string, string>): string {
+    let parts: string[] = [];
+    let keys: string[] = Object.keys(parameters);
+    for (let key of keys) {
+      let value: string = parameters[key];
+      parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(value)}`);
+    }
+    return parts.join('&');
+  }
+
+  /**
+   * Fetch and parse the OIDC discovery document for an issuer.
+   * Discovery URL = {issuer}/.well-known/openid-configuration
+   * (mirrors AuthorizationServiceConfiguration.WELL_KNOWN_PATH).
+   */
+  async fetchDiscovery(issuer: string, timeoutMillis: number): Promise<DiscoveryDocument> {
+    try {
+      let discoveryUrl: string = OAuthHttpClient.buildConfigurationUriFromIssuer(issuer);
+      let responseBody: Record<string, Object> = await this.requestJson(discoveryUrl,
+        http.RequestMethod.GET, '', {}, timeoutMillis, 'service_configuration_fetch_error');
+      let doc: DiscoveryDocument = {
+        authorizationEndpoint: OAuthHttpClient.asString(responseBody, 'authorization_endpoint'),
+        tokenEndpoint: OAuthHttpClient.asString(responseBody, 'token_endpoint'),
+        registrationEndpoint: OAuthHttpClient.asString(responseBody, 'registration_endpoint'),
+        revocationEndpoint: OAuthHttpClient.asString(responseBody, 'revocation_endpoint'),
+        endSessionEndpoint: OAuthHttpClient.asString(responseBody, 'end_session_endpoint'),
+      };
+      if (doc.authorizationEndpoint.length === 0 || doc.tokenEndpoint.length === 0) {
+        throw new OAuthError('service_configuration_fetch_error',
+          'Invalid discovery document: missing authorization_endpoint or token_endpoint');
+      }
+      return doc;
+    } catch (err) {
+      if (err instanceof OAuthError && err.code === 'service_configuration_fetch_error') {
+        throw err;
+      }
+      throw new OAuthError('service_configuration_fetch_error', OAuthHttpClient.errorMessage(err));
+    }
+  }
+
+  /**
+   * POST application/x-www-form-urlencoded (token / refresh endpoints).
+   * On a non-2xx response, parses the OAuth error code/description and rejects
+   * with the standard OAuth error code.
+   */
+  async postForm(url: string, formParameters: Record<string, string>,
+    headers: Record<string, string>, timeoutMillis: number): Promise<Record<string, Object>> {
+    let body: string = OAuthHttpClient.buildFormBody(formParameters);
+    let formHeaders: Record<string, string> = {
+      'Content-Type': 'application/x-www-form-urlencoded',
+    };
+    let mergedHeaders: Record<string, string> = OAuthHttpClient.mergeHeaders(formHeaders, headers);
+    return await this.requestJson(url, http.RequestMethod.POST, body, mergedHeaders, timeoutMillis);
+  }
+
+  /**
+   * POST application/json (registration endpoint).
+   */
+  async postJson(url: string, bodyObject: Object, headers: Record<string, string>,
+    timeoutMillis: number): Promise<Record<string, Object>> {
+    let body: string = JSON.stringify(bodyObject);
+    let jsonHeaders: Record<string, string> = {
+      'Content-Type': 'application/json',
+    };
+    let mergedHeaders: Record<string, string> = OAuthHttpClient.mergeHeaders(jsonHeaders, headers);
+    return await this.requestJson(url, http.RequestMethod.POST, body, mergedHeaders, timeoutMillis);
+  }
+
+  /**
+   * GET request with no body (used for discovery).
+   */
+  private async requestJson(url: string, method: http.RequestMethod, body: string,
+    headers: Record<string, string>, timeoutMillis: number,
+    fallbackCode: string = 'run_time_exception'): Promise<Record<string, Object>> {
+    let httpRequest: http.HttpRequest | null = null;
+    try {
+      httpRequest = http.createHttp();
+      let options: http.HttpRequestOptions = {
+        method: method,
+        header: headers,
+        connectTimeout: timeoutMillis,
+        readTimeout: timeoutMillis,
+      };
+      if (body.length > 0) {
+        options.extraData = body;
+      }
+      let response: http.HttpResponse = await httpRequest.request(url, options);
+      let code: number = response.responseCode;
+      let resultText: string = OAuthHttpClient.asResponseText(response.result);
+      if (code < HTTP_OK || code >= 300) {
+        throw OAuthHttpClient.buildHttpError(code, resultText);
+      }
+      return OAuthHttpClient.parseJsonObject(resultText);
+    } catch (err) {
+      hilog.error(DOMAIN, TAG, `requestJson failed for ${url}: ${OAuthHttpClient.errorMessage(err)}`);
+      if (err instanceof OAuthError) {
+        throw err;
+      }
+      throw new OAuthError(fallbackCode, OAuthHttpClient.errorMessage(err));
+    } finally {
+      if (httpRequest !== null) {
+        httpRequest.destroy();
+      }
+    }
+  }
+
+  /**
+   * Derive the discovery URL for an issuer, mirroring the Android
+   * AuthorizationServiceConfiguration path construction:
+   * {issuer}/.well-known/openid-configuration
+   */
+  static buildConfigurationUriFromIssuer(issuer: string): string {
+    let base: string = issuer;
+    while (base.length > 0 && base.endsWith('/')) {
+      base = base.substring(0, base.length - 1);
+    }
+    return `${base}/.well-known/openid-configuration`;
+  }
+
+  /**
+   * Map a non-2xx HTTP response to an OAuthError with the standard OAuth
+   * error code from the JSON body when present.
+   */
+  private static buildHttpError(code: number, resultText: string): OAuthError {
+    let errorCode: string = 'run_time_exception';
+    let errorDescription: string = `HTTP ${code}`;
+    if (resultText.length > 0) {
+      try {
+        let body: Record<string, Object> = OAuthHttpClient.parseJsonObject(resultText);
+        let oauthError: string = OAuthHttpClient.asString(body, 'error');
+        if (oauthError.length > 0) {
+          errorCode = oauthError;
+          let desc: string = OAuthHttpClient.asString(body, 'error_description');
+          if (desc.length > 0) {
+            errorDescription = desc;
+          } else {
+            errorDescription = oauthError;
+          }
+        }
+      } catch (err) {
+        errorDescription = resultText.length > 200 ? resultText.substring(0, 200) : resultText;
+      }
+    }
+    return new OAuthError(errorCode, errorDescription);
+  }
+
+  /**
+   * Extract a human-readable message from a thrown value.
+   * HarmonyOS http/BusinessError objects stringify as "[object Object]" with `${err}`.
+   */
+  static errorMessage(err: Object): string {
+    if (err instanceof OAuthError) {
+      let full: string = err.message;
+      let sep: number = full.indexOf('::');
+      if (sep > 0) {
+        return full.substring(sep + 2);
+      }
+      return full;
+    }
+    if (typeof err === 'string') {
+      return err;
+    }
+    let nativeErr = err as NativeThrownError;
+    let nativeMessage: string = nativeErr.message;
+    if (typeof nativeMessage === 'string' && nativeMessage.length > 0 &&
+      nativeMessage !== '[object Object]') {
+      if (nativeErr.code !== undefined && nativeErr.code !== null) {
+        return `${nativeMessage} (code ${nativeErr.code})`;
+      }
+      return nativeMessage;
+    }
+    try {
+      let jsonText: string = JSON.stringify(err);
+      if (jsonText.length > 0 && jsonText !== '{}' && jsonText !== 'null') {
+        return jsonText;
+      }
+    } catch (ignored) {
+    }
+    let fallback: string = `${err}`;
+    if (fallback === '[object Object]') {
+      return 'Network request failed';
+    }
+    return fallback;
+  }
+
+  /**
+   * Normalize http result (string | Object | ArrayBuffer) to a string.
+   * ESObject is used because HttpResponse.result is a dynamic SDK type.
+   */
+  private static asResponseText(result: ESObject): string {
+    if (typeof result === 'string') {
+      return result;
+    }
+    if (result instanceof ArrayBuffer) {
+      try {
+        let decoder: util.TextDecoder = new util.TextDecoder();
+        return decoder.decodeToString(new Uint8Array(result));
+      } catch (err) {
+        hilog.error(DOMAIN, TAG, `TextDecoder decode failed: ${err}`);
+        return '';
+      }
+    }
+    // Object (rare) — best effort JSON serialize
+    try {
+      return JSON.stringify(result);
+    } catch (err) {
+      hilog.error(DOMAIN, TAG, `JSON.stringify result failed: ${err}`);
+      return '';
+    }
+  }
+
+  /**
+   * Parse a JSON string into a string-keyed object map.
+   */
+  static parseJsonObject(text: string): Record<string, Object> {
+    if (text.length === 0) {
+      return {};
+    }
+    return JSON.parse(text) as Record<string, Object>;
+  }
+
+  /**
+   * Extract a string field from a parsed JSON map.
+   */
+  static asString(obj: Record<string, Object>, key: string): string {
+    let value: Object | undefined = obj[key];
+    if (value === undefined || value === null) {
+      return '';
+    }
+    return `${value}`;
+  }
+
+  /**
+   * Extract a number field from a parsed JSON map.
+   */
+  static asNumber(obj: Record<string, Object>, key: string): number {
+    let value: Object | undefined = obj[key];
+    if (value === undefined || value === null) {
+      return 0;
+    }
+    return Number.parseFloat(`${value}`);
+  }
+
+  /**
+   * Merge two header maps (first wins for duplicate keys).
+   */
+  static mergeHeaders(base: Record<string, string>, extra: Record<string, string>): Record<string, string> {
+    let result: Record<string, string> = {};
+    let baseKeys: string[] = Object.keys(base);
+    for (let key of baseKeys) {
+      result[key] = base[key];
+    }
+    let extraKeys: string[] = Object.keys(extra);
+    for (let key of extraKeys) {
+      if (result[key] === undefined) {
+        result[key] = extra[key];
+      }
+    }
+    return result;
+  }
+}

package/harmony/rnaa/src/main/ets/OAuthProtocol.ets

@@ -0,0 +1,293 @@
+/**
+ * OAuth / OIDC protocol helpers (RFC 6749 / 7636 / 7009, OIDC Core /
+ * Discovery / Registration / RP-Initiated Logout).
+ *
+ * Covers authorization request URL construction, redirect callback parsing,
+ * token/refresh/registration request bodies and the end_session URL.
+ */
+import { AuthorizationResponse } from './Types';
+
+export interface AuthorizationUrlParams {
+  authorizationEndpoint: string;
+  clientId: string;
+  redirectUrl: string;
+  scopes: string[];
+  state: string;
+  nonce: string;
+  codeChallenge: string;
+  additionalParameters: Record<string, string>;
+}
+
+export interface EndSessionUrlParams {
+  endSessionEndpoint: string;
+  idTokenHint: string;
+  postLogoutRedirectUri: string;
+  state: string;
+  additionalParameters: Record<string, string>;
+}
+
+export class OAuthProtocol {
+  /**
+   * Build the authorization request URL (response_type=code + PKCE/nonce +
+   * additional parameters). Every value is encodeURIComponent'd.
+   */
+  static buildAuthorizationUrl(params: AuthorizationUrlParams): string {
+    let queryParts: string[] = [];
+    queryParts.push(`client_id=${encodeURIComponent(params.clientId)}`);
+    queryParts.push(`redirect_uri=${encodeURIComponent(params.redirectUrl)}`);
+    queryParts.push('response_type=code');
+    if (params.scopes.length > 0) {
+      queryParts.push(`scope=${encodeURIComponent(params.scopes.join(' '))}`);
+    }
+    if (params.state.length > 0) {
+      queryParts.push(`state=${encodeURIComponent(params.state)}`);
+    }
+    if (params.nonce.length > 0) {
+      queryParts.push(`nonce=${encodeURIComponent(params.nonce)}`);
+    }
+    if (params.codeChallenge.length > 0) {
+      queryParts.push(`code_challenge=${encodeURIComponent(params.codeChallenge)}`);
+      queryParts.push('code_challenge_method=S256');
+    }
+    let keys: string[] = Object.keys(params.additionalParameters);
+    for (let key of keys) {
+      let value: string = params.additionalParameters[key];
+      queryParts.push(`${encodeURIComponent(key)}=${encodeURIComponent(value)}`);
+    }
+    return `${params.authorizationEndpoint}?${queryParts.join('&')}`;
+  }
+
+  /**
+   * Build the RP-Initiated Logout URL (OIDC RP-Initiated Logout 1.0).
+   */
+  static buildEndSessionUrl(params: EndSessionUrlParams): string {
+    let queryParts: string[] = [];
+    if (params.idTokenHint.length > 0) {
+      queryParts.push(`id_token_hint=${encodeURIComponent(params.idTokenHint)}`);
+    }
+    if (params.postLogoutRedirectUri.length > 0) {
+      queryParts.push(`post_logout_redirect_uri=${encodeURIComponent(params.postLogoutRedirectUri)}`);
+    }
+    if (params.state.length > 0) {
+      queryParts.push(`state=${encodeURIComponent(params.state)}`);
+    }
+    let keys: string[] = Object.keys(params.additionalParameters);
+    for (let key of keys) {
+      let value: string = params.additionalParameters[key];
+      queryParts.push(`${encodeURIComponent(key)}=${encodeURIComponent(value)}`);
+    }
+    if (queryParts.length === 0) {
+      return params.endSessionEndpoint;
+    }
+    return `${params.endSessionEndpoint}?${queryParts.join('&')}`;
+  }
+
+  /**
+   * Parse a redirect callback URL (query or fragment) into an
+   * AuthorizationResponse. state mismatches are surfaced by the caller via
+   * the returned state field.
+   */
+  static parseCallbackUrl(url: string): AuthorizationResponse {
+    let params: Record<string, string> = {};
+    OAuthProtocol.mergeUrlParams(params,
+      OAuthProtocol.parseQueryString(OAuthProtocol.extractQuery(url)));
+    OAuthProtocol.mergeUrlParams(params,
+      OAuthProtocol.parseQueryString(OAuthProtocol.extractFragment(url)));
+
+    let response: AuthorizationResponse = {
+      state: OAuthProtocol.getParam(params, 'state'),
+      authorizationCode: OAuthProtocol.getParam(params, 'code'),
+      error: OAuthProtocol.getParam(params, 'error'),
+      errorDescription: OAuthProtocol.getParam(params, 'error_description'),
+      scope: OAuthProtocol.getParam(params, 'scope'),
+      idToken: OAuthProtocol.getParam(params, 'id_token'),
+      accessToken: OAuthProtocol.getParam(params, 'access_token'),
+      tokenType: OAuthProtocol.getParam(params, 'token_type'),
+      accessTokenExpirationTime: 0,
+      additionalParameters: params,
+    };
+    let expiresIn: string = OAuthProtocol.getParam(params, 'expires_in');
+    if (expiresIn.length > 0) {
+      let seconds: number = Number.parseFloat(expiresIn);
+      if (!Number.isNaN(seconds)) {
+        response.accessTokenExpirationTime = Date.now() + seconds * 1000;
+      }
+    }
+    return response;
+  }
+
+  /**
+   * Build the token exchange request body (grant_type=authorization_code).
+   */
+  static buildTokenExchangeParams(code: string, redirectUrl: string, clientId: string,
+    codeVerifier: string, additionalParameters: Record<string, string>): Record<string, string> {
+    let params: Record<string, string> = {
+      'grant_type': 'authorization_code',
+      'code': code,
+      'redirect_uri': redirectUrl,
+      'client_id': clientId,
+    };
+    if (codeVerifier.length > 0) {
+      params.code_verifier = codeVerifier;
+    }
+    OAuthProtocol.mergeParams(params, additionalParameters);
+    return params;
+  }
+
+  /**
+   * Build the refresh token request body (grant_type=refresh_token).
+   */
+  static buildRefreshTokenParams(refreshToken: string, clientId: string,
+    scopes: string[], redirectUrl: string, additionalParameters: Record<string, string>): Record<string, string> {
+    let params: Record<string, string> = {
+      'grant_type': 'refresh_token',
+      'refresh_token': refreshToken,
+      'client_id': clientId,
+    };
+    if (redirectUrl.length > 0) {
+      params.redirect_uri = redirectUrl;
+    }
+    if (scopes.length > 0) {
+      params.scope = scopes.join(' ');
+    }
+    OAuthProtocol.mergeParams(params, additionalParameters);
+    return params;
+  }
+
+  /**
+   * Build the dynamic client registration body (OIDC Registration 1.0).
+   */
+  static buildRegistrationBody(redirectUris: string[], responseTypes: string[],
+    grantTypes: string[], subjectType: string, tokenEndpointAuthMethod: string,
+    additionalParameters: Record<string, string>): Record<string, Object> {
+    let safeRedirectUris: string[] = OAuthProtocol.safeStringArray(redirectUris);
+    let safeResponseTypes: string[] = OAuthProtocol.safeStringArray(responseTypes);
+    let safeGrantTypes: string[] = OAuthProtocol.safeStringArray(grantTypes);
+    let safeSubjectType: string =
+      subjectType !== null && subjectType !== undefined ? subjectType : '';
+    let safeTokenEndpointAuthMethod: string =
+      tokenEndpointAuthMethod !== null && tokenEndpointAuthMethod !== undefined ?
+        tokenEndpointAuthMethod : '';
+    let body: Record<string, Object> = {};
+    body.redirect_uris = safeRedirectUris;
+    if (safeResponseTypes.length > 0) {
+      body.response_types = safeResponseTypes;
+    }
+    if (safeGrantTypes.length > 0) {
+      body.grant_types = safeGrantTypes;
+    }
+    if (safeSubjectType.length > 0) {
+      body.subject_type = safeSubjectType;
+    }
+    if (safeTokenEndpointAuthMethod.length > 0) {
+      body.token_endpoint_auth_method = safeTokenEndpointAuthMethod;
+    }
+    if (additionalParameters === null || additionalParameters === undefined) {
+      return body;
+    }
+    let keys: string[] = Object.keys(additionalParameters);
+    for (let key of keys) {
+      body[key] = additionalParameters[key];
+    }
+    return body;
+  }
+
+  /**
+   * Extract the query string from a URL (part after '?', before '#').
+   */
+  static extractQuery(url: string): string {
+    let queryStart: number = url.indexOf('?');
+    if (queryStart < 0) {
+      return '';
+    }
+    let fragmentStart: number = url.indexOf('#', queryStart);
+    if (fragmentStart < 0) {
+      return url.substring(queryStart + 1);
+    }
+    return url.substring(queryStart + 1, fragmentStart);
+  }
+
+  /**
+   * Extract the fragment string from a URL (part after '#').
+   */
+  static extractFragment(url: string): string {
+    let fragmentStart: number = url.indexOf('#');
+    if (fragmentStart < 0) {
+      return '';
+    }
+    return url.substring(fragmentStart + 1);
+  }
+
+  /**
+   * Parse a query/fragment string into a decoded parameter map.
+   */
+  static parseQueryString(query: string): Record<string, string> {
+    let params: Record<string, string> = {};
+    if (query.length === 0) {
+      return params;
+    }
+    let pairs: string[] = query.split('&');
+    for (let pair of pairs) {
+      if (pair.length === 0) {
+        continue;
+      }
+      let eqIndex: number = pair.indexOf('=');
+      if (eqIndex < 0) {
+        params[OAuthProtocol.safeDecode(pair)] = '';
+      } else {
+        let key: string = OAuthProtocol.safeDecode(pair.substring(0, eqIndex));
+        let value: string = OAuthProtocol.safeDecode(pair.substring(eqIndex + 1));
+        params[key] = value;
+      }
+    }
+    return params;
+  }
+
+  private static mergeUrlParams(target: Record<string, string>,
+    source: Record<string, string>): void {
+    let keys: string[] = Object.keys(source);
+    for (let key of keys) {
+      if (target[key] === undefined) {
+        target[key] = source[key];
+      }
+    }
+  }
+
+  private static mergeParams(target: Record<string, string>,
+    source: Record<string, string>): void {
+    let keys: string[] = Object.keys(source);
+    for (let key of keys) {
+      if (target[key] === undefined) {
+        target[key] = source[key];
+      }
+    }
+  }
+
+  private static getParam(params: Record<string, string>, key: string): string {
+    let value: string | undefined = params[key];
+    if (value === undefined) {
+      return '';
+    }
+    return value;
+  }
+
+  private static safeDecode(value: string): string {
+    try {
+      let plusRegex: RegExp = new RegExp('\\+', 'g');
+      return decodeURIComponent(value.replace(plusRegex, ' '));
+    } catch (err) {
+      return value;
+    }
+  }
+
+  /**
+   * JS may pass null for omitted string[] args. Do not read `.length` on null.
+   */
+  private static safeStringArray(value: string[] | null | undefined): string[] {
+    if (value === null || value === undefined) {
+      let empty: string[] = [];
+      return empty;
+    }
+    return value;
+  }
+}

package/harmony/rnaa/src/main/ets/PKCE.ets

@@ -0,0 +1,105 @@
+/**
+ * PKCE (RFC 7636) helpers and secure random / state / nonce generation.
+ *
+ * - code_verifier: 32 random bytes Base64URL-encoded -> 43 chars (RFC 7636 §4.1).
+ * - code_challenge: SHA-256(code_verifier) Base64URL-encoded, method = S256.
+ * - state / nonce: 32 random bytes Base64URL-encoded.
+ *
+ * Uses @ohos.security.cryptoFramework (Random + SHA-256 Md) and
+ * @ohos.util Base64Helper (BASIC_URL_SAFE, no padding).
+ */
+import { cryptoFramework } from '@kit.CryptoArchitectureKit';
+import { util } from '@kit.ArkTS';
+import hilog from '@ohos.hilog';
+import { OAuthError } from './Types';
+
+const DOMAIN: number = 0x0000;
+const TAG: string = 'RNAppAuth';
+
+export class PKCE {
+  /**
+   * Base64URL (RFC 4648 §5) encode a byte array, no '=' padding.
+   */
+  static base64UrlEncode(data: Uint8Array): string {
+    try {
+      let helper: util.Base64Helper = new util.Base64Helper();
+      return helper.encodeToStringSync(data, util.Type.BASIC_URL_SAFE);
+    } catch (err) {
+      hilog.error(DOMAIN, TAG, `base64UrlEncode failed: ${err}`);
+      return '';
+    }
+  }
+
+  /**
+   * Generate a cryptographically random Base64URL string from `byteLength`
+   * random bytes (default 32 -> 43 chars output).
+   */
+  static generateRandomBase64Url(byteLength: number = 32): string {
+    try {
+      let random: cryptoFramework.Random = cryptoFramework.createRandom();
+      let blob: cryptoFramework.DataBlob = random.generateRandomSync(byteLength);
+      let bytes: Uint8Array = new Uint8Array(blob.data);
+      return PKCE.base64UrlEncode(bytes);
+    } catch (err) {
+      hilog.error(DOMAIN, TAG, `generateRandomBase64Url failed: ${err}`);
+      return '';
+    }
+  }
+
+  /**
+   * Generate a random code_verifier (43 chars, RFC 7636 compliant).
+   */
+  static generateCodeVerifier(): string {
+    let verifier: string = PKCE.generateRandomBase64Url(32);
+    if (verifier.length === 0) {
+      // Last-resort fallback (not cryptographically strong): 43 chars from the
+      // unreserved alphabet, only used if the crypto provider is unavailable.
+      let alphabet: string = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
+      let fallback: string = '';
+      for (let i = 0; i < 43; i++) {
+        fallback += alphabet[i % alphabet.length];
+      }
+      return fallback;
+    }
+    return verifier;
+  }
+
+  /**
+   * Derive the S256 code_challenge from a code_verifier.
+   */
+  static async deriveCodeChallenge(codeVerifier: string): Promise<string> {
+    try {
+      let md: cryptoFramework.Md = cryptoFramework.createMd('SHA256');
+      let verifierBytes: Uint8Array = new util.TextEncoder().encodeInto(codeVerifier);
+      await md.update({ data: verifierBytes });
+      let digest: cryptoFramework.DataBlob = await md.digest();
+      let digestBytes: Uint8Array = new Uint8Array(digest.data);
+      return PKCE.base64UrlEncode(digestBytes);
+    } catch (err) {
+      hilog.error(DOMAIN, TAG, `deriveCodeChallenge failed: ${err}`);
+      throw new OAuthError('run_time_exception', `PKCE derivation failed: ${err}`);
+    }
+  }
+
+  /**
+   * Generate a random OAuth state value.
+   */
+  static generateState(): string {
+    let state: string = PKCE.generateRandomBase64Url(16);
+    if (state.length === 0) {
+      return `rnappauth_${Date.now()}`;
+    }
+    return state;
+  }
+
+  /**
+   * Generate a random OpenID Connect nonce value.
+   */
+  static generateNonce(): string {
+    let nonce: string = PKCE.generateRandomBase64Url(16);
+    if (nonce.length === 0) {
+      return `rnappauth_nonce_${Date.now()}`;
+    }
+    return nonce;
+  }
+}