refactor: Write the split-token wire format and verifier compare once #85

Merged

rosa merged 1 commit from domain/credential-split-token-dedup into main

2026-07-04 03:07:48 +00:00

rosa commented

2026-07-04 03:02:45 +00:00

Owner

SplitToken is the new home for the wire shape — an Identifier/Verifier pair with parse (base64-decode, 32-byte check, 16/16 split) and encode (the inverse). The families' parse/Display delegate, keeping per-credential error context at the wrapper layer.
VerifierHash::matches owns the subtle::ct_eq constant-time comparison; the three record-verify paths call it. The PKCE CodeChallenge comparison is a different shape and deliberately keeps its own.
CONTEXT.md gains a Split Token entry in the Credentials glossary section.

No behaviour changes: the round-trip and verifier-mismatch tests pass unmodified, SplitToken is pub(crate) so nothing outside the domain crate is touched, and the full ci task is green. Explicit wrapper calls were kept over From impls — each conversion has a single call site, so the trait would relocate the plumbing rather than remove it.

Closes #65.

Implements the agent brief on #65: the split-token wire format and the constant-time verifier comparison were triplicated across the three credential families; now they're written once in `credential.rs`, as its module doc always claimed. - **`SplitToken`** is the new home for the wire shape — an `Identifier`/`Verifier` pair with `parse` (base64-decode, 32-byte check, 16/16 split) and `encode` (the inverse). The families' `parse`/`Display` delegate, keeping per-credential error context at the wrapper layer. - **`VerifierHash::matches`** owns the `subtle::ct_eq` constant-time comparison; the three record-verify paths call it. The PKCE `CodeChallenge` comparison is a different shape and deliberately keeps its own. - **CONTEXT.md** gains a **Split Token** entry in the Credentials glossary section. No behaviour changes: the round-trip and verifier-mismatch tests pass unmodified, `SplitToken` is `pub(crate)` so nothing outside the domain crate is touched, and the full `ci` task is green. Explicit wrapper calls were kept over `From` impls — each conversion has a single call site, so the trait would relocate the plumbing rather than remove it. Closes #65.

rosa added 1 commit

2026-07-04 03:02:45 +00:00

refactor: Write the split-token wire format and verifier compare once

ci/woodpecker/push/test Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

d1e9a96d38

The 32-byte base64url split-token parse and Display were copy-pasted
verbatim across AccessToken, AuthorizationCode, and ConfirmationToken,
and the constant-time subtle::ct_eq verifier comparison was likewise
triplicated — despite credential.rs documenting itself as the place the
shared logic is written once.

Introduce SplitToken in credential.rs as the minted wire shape (an
Identifier/Verifier pair; parse decodes and splits, encode is the
inverse) and give VerifierHash a constant-time matches method. The three
families' parse, Display, and verify paths now delegate, keeping their
per-credential error variants and context at the wrapper layer. Anchor
Split Token in the glossary's Credentials section.

The PKCE CodeChallenge comparison keeps its own ct_eq — it is a
different shape and was never part of the triplication. Wire format and
comparison semantics are unchanged; the round-trip and
verifier-mismatch tests pass unmodified.

Closes #65.

rosa merged commit 8cf24a72b9 into main

2026-07-04 03:07:48 +00:00

rosa referenced this pull request from a commit

2026-07-04 03:07:50 +00:00

Merge pull request 'refactor: Write the split-token wire format and verifier compare once' (#85) from domain/credential-split-token-dedup into main