Fix PKCE code verifier not generated for initial OAuth flow

[isair]

Summary

• Fixes (invalid_grant) Missing code verifier error during OAuth callback token exchange
• Adds autogenerate_code_verifier=True in the else branch of create_oauth_flow() so the initial auth flow generates a proper PKCE verifier

Problem

When create_oauth_flow() is called without an explicit code_verifier (during start_auth_flow()), the function never sets autogenerate_code_verifier=True.

oauthlib 3.2+ automatically adds code_challenge to the authorization URL at the session level, so Google expects a matching code_verifier during the token exchange. However, Flow.code_verifier remains None, gets stored as None in the session store, and is later passed back during the callback — causing Google to reject the exchange with (invalid_grant) Missing code verifier.

Fix

Add autogenerate_code_verifier=True in the else branch of create_oauth_flow() so the Flow object generates and exposes a proper PKCE code verifier that gets stored and reused during the callback.

Test plan

• Start the MCP server in stdio mode
• Trigger an OAuth flow (e.g. via a calendar tool call)
• Complete the Google consent screen
• Verify the callback succeeds without "Missing code verifier" error
• Verify credentials are saved and subsequent API calls work

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Fixed PKCE handling in Google sign-in so a saved code verifier is preserved, automatic verifier generation occurs when none is present, and re-generation is prevented during the callback flow—improves reliability across configurations.

• Tests

  • Added regression tests covering automatic verifier generation, preservation of provided verifiers, file-based config behavior, and disabling auto-generation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 3361ed2 and 662383b.

📒 Files selected for processing (2)

• auth/google_auth.py
• tests/auth/test_google_auth_pkce.py

---

📝 Walkthrough

Walkthrough

Added an autogenerate_code_verifier parameter to create_oauth_flow and adjusted flow creation and callback paths so the PKCE code_verifier is only auto-generated when explicitly allowed, preserving any provided verifier and preventing regeneration during OAuth callbacks.

Changes

Cohort / File(s)	Summary
Google auth PKCE logic auth/google_auth.py	Added autogenerate_code_verifier: bool = True param to create_oauth_flow; pass autogenerate_code_verifier into flow kwargs when no code_verifier is provided; ensure callback path calls create_oauth_flow(..., autogenerate_code_verifier=False) to avoid regenerating the verifier.
PKCE tests tests/auth/test_google_auth_pkce.py	Added tests covering autogeneration when missing, preserving provided code_verifier, file-based client config behavior, and disabling autogeneration without a verifier; uses mocks to assert correct PKCE-related args passed to Flow creation.

Sequence Diagram(s)

(omitted)

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

• OAuth callback fails with invalid_grant: Missing code verifier (PKCE lost between auth start and callback) #519: Same PKCE code_verifier lifecycle concern—preserving/verifying verifier across flow creation and callback.
• PKCE code_verifier lost between auth flow steps (stdio mode) #518: Addresses preventing verifier regeneration during callback and maintaining original verifier.

Possibly related PRs

• fix: pcke #520: Modifies create_oauth_flow PKCE handling and flow lifecycle similarly.

Suggested labels

bug

Poem

🐰 In a hop and a whisker I found the key,
A verifier safe from regenility,
I tuck it away, where callbacks can't find,
Now flows exchange tokens without being blind. ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description provides a comprehensive summary with problem statement and solution, and includes a test plan; however, the author did not check any checkboxes from the required template (Description, Type of Change, Testing, Checklist, Additional Notes sections).	Complete the required template by selecting the appropriate Type of Change checkbox (Bug fix applies here), marking Testing checkboxes where applicable, and checking all Checklist items including the mandatory 'Allow edits from maintainers' requirement.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main fix: addressing PKCE code verifier generation for the initial OAuth flow, which directly aligns with the changeset's core purpose.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}