[osanderson]

Summary

This is the second library addition from the DevX review. It's separate from #504, with which it shares no logic.

func BeginAuthorizationRequestFromHTTP(r *http.Request) (BeginAuthorizationRequest, error)

It reads the client_id and request_uri a client sends the browser to the authorization endpoint with after PAR (RFC 9126 §4).

Why. Every embedder (the five demos and cmd/conformance-as) read them with r.URL.Query().Get, which silently takes the first of a repeated parameter. RFC 6749 §3.1 says request parameters "MUST NOT be included more than once". FAPIgo's other endpoints already refuse duplicates (that's what FormRequestFromHTTP is for); the authorization endpoint was the one place every integrator hand-rolled the parsing.

Behaviour:

• Refused: a repeated client_id or request_uri, or a malformed query, gets an invalid_request *Error. The doc says to render it locally, never as a redirect: the request hasn't yet named a redirect URI it can be trusted with.
• Passed through: a missing value is left empty for BeginAuthorization to answer, as it does any unrecognised request_uri or client_id today.
• Ignored: other parameters, as before. With PAR, the request's real parameters come from the pushed request.

Adopted:

• the five demos with an authorization server;
• cmd/conformance-as, whose suite-only error-redirect path still reads redirect_uri and state from the raw query, but now takes client_id from the strictly parsed request;
• GETTING_STARTED's login step.

Tests

• Both values are read, and an unrelated parameter is ignored.
• No parameters give empty values and no error.
• A repeated request_uri, a repeated client_id and a malformed query each get invalid_request.
• Other checks:
  • go test -race ./... and golangci-lint pass;
  • the five demo modules and cmd/conformance-as pass their tests and lint;
  • GETTING_STARTED's snippets compile.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud