From 9715180ae39445f494ec628fdefb6b02d598366c Mon Sep 17 00:00:00 2001
From: Tony James <me@tony.codes>
Date: Mon, 3 Aug 2026 08:52:47 +0100
Subject: [PATCH] fix: default omitted PKCE method to S256

---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 5f8c2e2..875c7d0 100644
--- a/server.js
+++ b/server.js
@@ -33,7 +33,7 @@ http.createServer(async (req, res) => {
     endpoints: { catalog: '/v1/catalog', stream: '/v1/stream', pairStart: '/v1/pair/start', pairStatus: '/v1/pair/{sessionId}', pairToken: '/v1/pair/token' }
   });
   if (req.method === 'POST' && url.pathname === '/v1/pair/start') {
-    const body = await readJson(req); if (body.codeChallengeMethod !== 'S256' || !body.codeChallenge) return json(res, 400, { error: 'PKCE S256 required' });
+    const body = await readJson(req); if ((body.codeChallengeMethod || 'S256') !== 'S256' || !body.codeChallenge) return json(res, 400, { error: 'PKCE S256 required' });
     const sessionId = id(); sessions.set(sessionId, { challenge: body.codeChallenge, expires: Date.now() + 300000 });
     return json(res, 200, { sessionId, approvalUri: `${approvalBaseUrl}/pair/approve?session=${sessionId}`, expiresAt: new Date(Date.now() + 300000).toISOString(), pollIntervalSeconds: 2 });
   }