From f0d7c1f474c188e5b37309d47e1df4e61c624417 Mon Sep 17 00:00:00 2001
From: sHa <sha@shadoll.dev>
Date: Tue, 22 Sep 2026 02:39:14 +0300
Subject: [PATCH] traefik-forward-auth: send PKCE code_challenge, default on

Pocket ID rejects the authorization request outright when its OIDC client
has PKCE required -- "This client requires PKCE, but the 'code_challenge'
parameter is missing" -- which is the default for clients created in recent
Pocket ID versions. Every app behind the portal fails at login, not just
the one being tested.

Upstream supports this via the pocketID provider's enablePKCE flag; the
chart never emitted it, so it stayed at its false default. Adds it to the
normalised portal shape (per-portal override via portals[].pocketID.enablePKCE)
and defaults it on, since PKCE is harmless when the client does not require it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 traefik-forward-auth/Chart.yaml               | 2 +-
 traefik-forward-auth/templates/_helpers.tpl   | 2 ++
 traefik-forward-auth/templates/configmap.yaml | 1 +
 traefik-forward-auth/values.yaml              | 6 ++++++
 4 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/traefik-forward-auth/Chart.yaml b/traefik-forward-auth/Chart.yaml
index f61c0a3..625a01f 100644
--- a/traefik-forward-auth/Chart.yaml
+++ b/traefik-forward-auth/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: traefik-forward-auth
 description: Forward auth for Traefik (ItalyPaleAle/traefik-forward-auth) with Pocket ID provider
 type: application
-version: 0.2.0
+version: 0.2.1
 appVersion: "4.14.1"
 annotations:
   version-source: github-release:ItalyPaleAle/traefik-forward-auth
diff --git a/traefik-forward-auth/templates/_helpers.tpl b/traefik-forward-auth/templates/_helpers.tpl
index bb2cb02..9d2b369 100644
--- a/traefik-forward-auth/templates/_helpers.tpl
+++ b/traefik-forward-auth/templates/_helpers.tpl
@@ -29,6 +29,7 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 - name: {{ .name | quote }}
   endpoint: {{ .pocketID.endpoint | quote }}
   clientID: {{ .pocketID.clientID | quote }}
+  enablePKCE: {{ if hasKey .pocketID "enablePKCE" }}{{ .pocketID.enablePKCE }}{{ else }}true{{ end }}
   existingSecret: {{ required "each portal needs an existingSecret" .existingSecret | quote }}
   secretKey: {{ .secretKey | default "client-secret" | quote }}
   middlewareName: {{ .middlewareName | default (printf "%s-%s" $.Release.Name .name) | quote }}
@@ -37,6 +38,7 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 - name: {{ .Values.portal.name | quote }}
   endpoint: {{ .Values.pocketID.endpoint | quote }}
   clientID: {{ .Values.pocketID.clientID | quote }}
+  enablePKCE: {{ if hasKey .Values.pocketID "enablePKCE" }}{{ .Values.pocketID.enablePKCE }}{{ else }}true{{ end }}
   existingSecret: {{ required "existingSecret is required" .Values.existingSecret | quote }}
   secretKey: "client-secret"
   middlewareName: {{ include "tfa.middlewareName" . | quote }}
diff --git a/traefik-forward-auth/templates/configmap.yaml b/traefik-forward-auth/templates/configmap.yaml
index d82d659..801016e 100644
--- a/traefik-forward-auth/templates/configmap.yaml
+++ b/traefik-forward-auth/templates/configmap.yaml
@@ -27,6 +27,7 @@ data:
           - pocketID:
               endpoint: {{ .endpoint | quote }}
               clientID: {{ .clientID | quote }}
+              enablePKCE: {{ .enablePKCE }}
               clientSecretFile: "{{ include "tfa.secretDir" $ }}/{{ .name }}/client-secret"
       {{- end }}
     {{- with .Values.extraConfig }}
diff --git a/traefik-forward-auth/values.yaml b/traefik-forward-auth/values.yaml
index 3509389..27c1798 100644
--- a/traefik-forward-auth/values.yaml
+++ b/traefik-forward-auth/values.yaml
@@ -41,11 +41,17 @@ portals: []
   #   pocketID:
   #     endpoint: https://id.example.com
   #     clientID: "..."
+  #     enablePKCE: true
 
 # Single-portal shorthand, used when `portals` is empty.
 pocketID:
   endpoint: ""
   clientID: ""
+  # Send a PKCE code_challenge on the authorization request. Pocket ID rejects
+  # the request outright ("This client requires PKCE") when its OIDC client has
+  # PKCE required, which is the default for new clients. Harmless when the
+  # client does not require it, so this defaults on.
+  enablePKCE: true
 
 # Secret containing the client secret. Must define key `client-secret`.
 # Use sealed-secrets to provide this in cluster overlays.