From 541f0e119fe64a6d92a7b8f0934aeef29ff442aa Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 3 Feb 2026 06:54:13 +0000
Subject: [PATCH] Default PKCE method when missing

Co-authored-by: HFO4 <16058869+HFO4@users.noreply.github.com>
---
 service/oauth/oauth.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/service/oauth/oauth.go b/service/oauth/oauth.go
index d15bd94b..dcf56f2b 100644
--- a/service/oauth/oauth.go
+++ b/service/oauth/oauth.go
@@ -60,6 +60,9 @@ func (s *GrantService) Get(c *gin.Context) (*GrantResponse, error) {
 	user := inventory.UserFromContext(c)
 	kv := dep.KV()
 	oAuthClient := dep.OAuthClientClient()
+	if s.CodeChallenge != "" && s.CodeChallengeMethod == "" {
+		s.CodeChallengeMethod = "S256"
+	}
 
 	// 1. Get app registration and grant
 	app, err := oAuthClient.GetByGUIDWithGrants(c, s.ClientID, user.ID)