refactor: 统一 PKCE 挑战值生成逻辑

apps/api/internal/oidcsession/login_transaction.go

@@ -2,7 +2,6 @@ package oidcsession
 
 import (
 	"crypto/rand"
-	"crypto/sha256"
 	"encoding/base64"
 	"errors"
 	"net/url"
@@ -22,25 +21,23 @@ type LoginTransaction struct {
 	CreatedAt    time.Time `json:"createdAt"`
 }
 
-func NewLoginTransaction(returnTo string, now time.Time) (LoginTransaction, string, error) {
+func NewLoginTransaction(returnTo string, now time.Time) (LoginTransaction, error) {
 	if !ValidReturnTo(returnTo) {
-		return LoginTransaction{}, "", errors.New("returnTo must be a same-origin relative path")
+		return LoginTransaction{}, errors.New("returnTo must be a same-origin relative path")
 	}
 	state, err := randomBase64URL(32)
 	if err != nil {
-		return LoginTransaction{}, "", err
+		return LoginTransaction{}, err
 	}
 	nonce, err := randomBase64URL(32)
 	if err != nil {
-		return LoginTransaction{}, "", err
+		return LoginTransaction{}, err
 	}
 	verifier, err := randomBase64URL(32)
 	if err != nil {
-		return LoginTransaction{}, "", err
+		return LoginTransaction{}, err
 	}
-	challengeHash := sha256.Sum256([]byte(verifier))
-	return LoginTransaction{State: state, Nonce: nonce, PKCEVerifier: verifier, ReturnTo: returnTo, CreatedAt: now.UTC()},
-		base64.RawURLEncoding.EncodeToString(challengeHash[:]), nil
+	return LoginTransaction{State: state, Nonce: nonce, PKCEVerifier: verifier, ReturnTo: returnTo, CreatedAt: now.UTC()}, nil
 }
 
 func (c *Cipher) EncodeLoginTransaction(transaction LoginTransaction) (string, error) {