[eliasjpr]

Summary

Implements a cryptographic Challenge-Response authentication mechanism and custom OAuth2 grant type (challenge_response and urn:ietf:params:oauth:grant-type:challenge) in Authly.

Key Changes

• Challenge Issuance Endpoint (POST /oauth/challenge):
  • Validates the client via AuthorizableClient and accepts optional identifiers (username, owner_id, key_id).
  • Generates a high-entropy random nonce (challenge) and challenge_id using Random::Secure.
  • Persists challenges in Authly::ChallengeStore with a configurable TTL (config.challenge_ttl = 60.seconds) and returns {"challenge_id": "...", "challenge": "...", "expires_in": 60}.
• Challenge Storage & Lifecycle (Authly::Challenge, Authly::ChallengeStore, Authly::InMemoryChallengeStore):
  • Supports store, fetch, atomic single-use consume! / record_attempt!, delete, and automatic + explicit cleanup_expired sweeping.
• Challenge Verification & Token Exchange (POST /oauth/token):
  • Supports grant_type=challenge_response and grant_type=urn:ietf:params:oauth:grant-type:challenge.
  • Adds verify_challenge_response? hooks to AuthorizableOwner (Owners) and AuthorizableClient (Clients).
  • Supports HMAC-SHA256 (with Crypto::Subtle.constant_time_compare) and asymmetric Ed25519, RSA (PKCS#1 v1.5 & RSA-PSS), and ECDSA (DER & IEEE P1363 raw r || s) verification via Authly::ChallengeVerifier.
  • Immediately invalidates challenges upon verification attempt to prevent replay and brute-force attacks.
  • Issues access and refresh tokens using the configured TokenStrategy (:jwt or :opaque).
• Error Handling:
  • Adds Authly::Error.expired_challenge (400 expired_challenge) and Authly::Error.invalid_client (401 invalid_client).

Verification

• crystal spec (617 examples, 0 failures, 0 errors)
• ameba (111 files inspected, 0 failures)
• crystal tool format --check src spec