fix(security): require OAuth state verification + refresh deps

[tirthpatell]

Summary

Two security-related changes ported from the threads-go fixes:

1. CSRF: enforce OAuth state in exchange_code_for_token (src/auth.rs)

   • Signature now requires stored_state (from get_auth_url) + received_state (from callback)
   • Constant-time compare via small private helper; empty values fail closed
   • Mismatch / empty → AuthenticationError (401) before any network call
   • Three new unit tests cover empty-stored, empty-received, and mismatch
   • README example updated

2. Dependency hygiene (resolves cargo audit findings)

   • reqwest 0.12 → 0.13 (added form, query features split out in 0.13)
   • rand 0.9 → 0.10 (Rng → RngExt for random())
   • rustls-webpki bumped transitively to 0.103.12 — fixes RUSTSEC-2026-0098 / RUSTSEC-2026-0099
   • rand bump also addresses RUSTSEC-2026-0097 unsoundness warning

Breaking API change to exchange_code_for_token. Callers migrate:

- client.exchange_code_for_token("CODE").await?;
+ let (auth_url, state) = client.get_auth_url(&[]);
+ // persist state, redirect user, then on callback:
+ client.exchange_code_for_token("CODE", &state, received_state).await?;

Test plan

• cargo fmt
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-features (173 tests + doctest pass)
• cargo audit (zero vulnerabilities, was 2 + 1 unsound warning)

[greptile-apps]

Greptile Summary

This PR enforces OAuth CSRF state verification in exchange_code_for_token (now requiring both stored_state and received_state with constant-time comparison via the subtle crate), and upgrades reqwest to 0.13, rand to 0.10, and adds subtle = "2" to address outstanding cargo audit advisories. The previous concern about a hand-rolled XOR loop has been fully addressed by switching to subtle::ConstantTimeEq.

Confidence Score: 5/5

Safe to merge — security fix is correctly implemented, prior subtle feedback is addressed, and no new issues found.

All changes are correctness improvements (CSRF enforcement, constant-time state comparison, CVE-covering dep bumps). The previous P1 comment about the hand-rolled XOR loop has been resolved by adopting subtle::ConstantTimeEq. No new logic bugs, security issues, or broken contracts were found.

No files require special attention.

Important Files Changed

Filename	Overview
src/auth.rs	CSRF state enforcement added with correct constant-time comparison via subtle::ConstantTimeEq; three new unit tests cover all fail-closed paths; empty/mismatch checks happen before any network call.
Cargo.toml	reqwest bumped to 0.13 with correct form/query feature split; rand to 0.10; subtle = "2" added for constant-time comparisons.
README.md	Authentication example updated to reflect the new three-argument exchange_code_for_token signature with correct state persistence guidance.
Cargo.lock	Lock file reflects dependency upgrades; new transitive deps (aws-lc-rs, subtle, webpki-root-certs) are expected for reqwest 0.13/rustls.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[App calls get_auth_url] --> B[Client generates random state\nand builds authorize URL]
    B --> C[App persists state in session\nand redirects user]
    C --> D[User grants access on Threads]
    D --> E[Threads redirects to callback\nwith params in URI]
    E --> F[App calls exchange_code_for_token\nstored_state + received_state]
    F --> G{State checks}
    G -->|empty stored or received| H[401 AuthenticationError\nstate missing]
    G -->|states differ\nconstant-time compare| I[401 AuthenticationError\nstate mismatch]
    G -->|states match| J[POST /oauth/access_token]
    J --> K[Store TokenInfo in client]
    K --> L[Ok]

Loading

_{Reviews (2): Last reviewed commit: "chore: replace hand-rolled constant_time..." | Re-trigger Greptile}