Add Vercel Connect OAuth conformance coverage

[masnwilliams]

Summary

• add a reusable route-level OAuth conformance fixture for public S256 PKCE clients
• cover Vercel Connect discovery, dynamic registration, organization/project grants, code exchange, refresh rotation, and scope preservation
• cover invalid PKCE, redirect, client identity, client authentication, and scope-escalation requests
• document the Vercel contract sources, local rerun command, and live connector confirmation procedure

Why

Vercel Connect owns its OAuth client registration, PKCE, state, callback, and refresh behavior. Exercising its documented Custom OAuth request shape in required CI prevents OAuth server changes from remaining compatible with existing consumers while breaking this integration.

Testing

• bun test (205 tests)
• bunx tsc --noEmit --incremental false
• bun run build with the required OAuth client IDs and Clerk build-time configuration
• Prettier check on all changed files

---

Note

Low Risk
Test and documentation only; no production OAuth route logic changes in the diff, so risk is limited to CI maintenance.

Overview
Adds required CI coverage for Kernel’s hosted OAuth server against the Vercel Connect Custom OAuth shape (public client, S256 PKCE, auth code + refresh).

A reusable route-level harness (oauth-client-fixture + defineOAuthClientConformance) exercises discovery, dynamic registration, org/project authorization, code exchange, refresh rotation, and scope/org preservation on refresh. Negative cases cover bad PKCE, redirect mismatch, wrong client on refresh, and invalid public-client Basic auth without persisting token context; authorize tests assert state, redirect URI, and PKCE survive the Kernel→Clerk redirect.

vercel-connect.test.ts wires the Vercel contract (optional VERCEL_CONNECT_REDIRECT_URI for staging). docs/oauth-conformance.md documents the contract, local run, and live connector checks; README tells contributors to run this suite when touching OAuth discovery, registration, authorize, token, refresh, or scopes.

^{Reviewed by Cursor Bugbot for commit 220822a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mcp	Ready	Preview	Aug 13, 2026 4:57pm

[hiroTamada]

reviewed — overall looks good. two suggestions to strengthen the conformance coverage:

Suggestions

• src/app/oauth-conformance/oauth-client-fixture.ts:109-137 — consider asserting the provider URL, POST/form encoding, and required forwarded parameters. The fake currently accepts missing or malformed authorization-code exchange fields, so request-shape regressions could pass the conformance suite.
• src/app/oauth-conformance/oauth-client-fixture.ts:174-191 — consider asserting response_types, scope, and a non-empty client_id in the registration response since these are part of the declared Vercel contract.

[masnwilliams]

added both suggestions in 06faca8: the provider fixture now asserts the exact token endpoint, POST/form body, authorization-code/refresh parameters, client identity, redirect, and PKCE fields; registration now asserts response type, scope, and a non-empty client ID.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit feeb13b. Configure here.}