Repository: jazzband/django-oauth-toolkit

Issue:
code_challenge_methods_supported is not included in the auto discovery information
The default value of `PKCE_REQUIRED` is [true](https://django-oauth-toolkit.readthedocs.io/en/latest/settings.html#pkce-required) and so I would expect the  ConnectDiscoveryInfoView to return the corresponding metadata, i.e.
```
...
"code_challenge_methods_supported": [ "S256"  ]
...
```

But this currently is not the case.


code_challenge_methods_supported is not included in the auto discovery information
The default value of `PKCE_REQUIRED` is [true](https://django-oauth-toolkit.readthedocs.io/en/latest/settings.html#pkce-required) and so I would expect the  ConnectDiscoveryInfoView to return the corresponding metadata, i.e.
```
...
"code_challenge_methods_supported": [ "S256"  ]
...
```

But this currently is not the case.




Discussion:

Resolving patch:
diff --git a/oauth2_provider/views/oidc.py b/oauth2_provider/views/oidc.py
--- a/oauth2_provider/views/oidc.py
+++ b/oauth2_provider/views/oidc.py
@@ -26,6 +26,7 @@
 from ..forms import ConfirmLogoutForm
 from ..http import OAuth2ResponseRedirect
 from ..models import (
+    AbstractGrant,
     get_access_token_model,
     get_application_model,
     get_id_token_model,
@@ -96,6 +97,7 @@ def get(self, request, *args, **kwargs):
             "token_endpoint_auth_methods_supported": (
                 oauth2_settings.OIDC_TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED
             ),
+            "code_challenge_methods_supported": [key for key, _ in AbstractGrant.CODE_CHALLENGE_METHODS],
             "claims_supported": oidc_claims,
         }
         if oauth2_settings.OIDC_RP_INITIATED_LOGOUT_ENABLED:


Test patch:
diff --git a/tests/test_oidc_views.py b/tests/test_oidc_views.py
--- a/tests/test_oidc_views.py
+++ b/tests/test_oidc_views.py
@@ -48,6 +48,7 @@ def test_get_connect_discovery_info(self):
             "subject_types_supported": ["public"],
             "id_token_signing_alg_values_supported": ["RS256", "HS256"],
             "token_endpoint_auth_methods_supported": ["client_secret_post", "client_secret_basic"],
+            "code_challenge_methods_supported": ["plain", "S256"],
             "claims_supported": ["sub"],
         }
         response = self.client.get("/o/.well-known/openid-configuration")
@@ -74,6 +75,7 @@ def test_get_connect_discovery_info_deprecated(self):
             "subject_types_supported": ["public"],
             "id_token_signing_alg_values_supported": ["RS256", "HS256"],
             "token_endpoint_auth_methods_supported": ["client_secret_post", "client_secret_basic"],
+            "code_challenge_methods_supported": ["plain", "S256"],
             "claims_supported": ["sub"],
         }
         response = self.client.get("/o/.well-known/openid-configuration/")
@@ -100,6 +102,7 @@ def expect_json_response_with_rp_logout(self, base):
             "subject_types_supported": ["public"],
             "id_token_signing_alg_values_supported": ["RS256", "HS256"],
             "token_endpoint_auth_methods_supported": ["client_secret_post", "client_secret_basic"],
+            "code_challenge_methods_supported": ["plain", "S256"],
             "claims_supported": ["sub"],
             "end_session_endpoint": f"{base}/logout/",
         }
@@ -133,6 +136,7 @@ def test_get_connect_discovery_info_without_issuer_url(self):
             "subject_types_supported": ["public"],
             "id_token_signing_alg_values_supported": ["RS256", "HS256"],
             "token_endpoint_auth_methods_supported": ["client_secret_post", "client_secret_basic"],
+            "code_challenge_methods_supported": ["plain", "S256"],
             "claims_supported": ["sub"],
         }
         response = self.client.get(reverse("oauth2_provider:oidc-connect-discovery-info"))