Perfect-Authentication 2.0.0: instance config, PKCE, bounded NIO transport, security fixes

.github/workflows/ci.yml

@@ -0,0 +1,68 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  linux:
+    name: Linux (Swift ${{ matrix.swift }}, ${{ matrix.configuration }})
+    runs-on: ubuntu-24.04
+    container: swift:${{ matrix.swift }}-noble
+    timeout-minutes: 30
+    env:
+      SWIFT_BACKTRACE: enable=no
+    strategy:
+      fail-fast: false
+      matrix:
+        # The oldest supported Swift (swift-tools-version 6.2) and the newest.
+        swift: ["6.2", "6.4"]
+        configuration: [debug, release]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Toolchain
+        run: swift --version
+
+      - name: Build (warnings are errors)
+        run: |
+          flags="-c ${{ matrix.configuration }} -Xswiftc -warnings-as-errors"
+          # @testable imports need testing enabled in an optimized build.
+          [ "${{ matrix.configuration }}" = release ] && flags="$flags -Xswiftc -enable-testing"
+          echo "FLAGS=$flags" >> "$GITHUB_ENV"
+          swift build --build-tests $flags
+
+      - name: Test
+        run: swift test $FLAGS
+
+  macos:
+    name: macOS (Xcode ${{ matrix.xcode }}, ${{ matrix.configuration }})
+    runs-on: macos-26
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        # The oldest Xcode with Swift 6.2, and the runner's default.
+        xcode: ["26.0.1", "26.6"]
+        configuration: [debug, release]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Select Xcode
+        run: |
+          sudo xcode-select -s /Applications/Xcode_${{ matrix.xcode }}.app
+          swift --version
+
+      - name: Build (warnings are errors)
+        run: |
+          flags="-c ${{ matrix.configuration }} -Xswiftc -warnings-as-errors"
+          # @testable imports need testing enabled in an optimized build.
+          [ "${{ matrix.configuration }}" = release ] && flags="$flags -Xswiftc -enable-testing"
+          echo "FLAGS=$flags" >> "$GITHUB_ENV"
+          swift build --build-tests $flags
+
+      - name: Test
+        run: swift test $FLAGS

.gitignore

@@ -4,3 +4,4 @@
 /*.xcodeproj
 /config/ApplicationConfiguration.json
 Package.pins
+Package.resolved

Package.swift

@@ -7,15 +7,41 @@ let package = Package(
     products: [
         .library(name: "PerfectOAuth2", targets: ["PerfectOAuth2"]),
     ],
+    dependencies: [
+        // SHA-256 for PKCE (RFC 7636 S256) and HMAC-SHA256 for Facebook's appsecret_proof.
+        // The range overlaps Perfect-SMTP (4.0.0..<5.0.0) and Perfect-NIO (3.0.0..<5.0.0).
+        .package(url: "https://github.com/apple/swift-crypto.git", "3.0.0"..<"5.0.0"),
+        // The default transport, NIOTransport: an HTTP/1.1 client with hard size and time bounds on
+        // every platform (corelibs URLSession can't be bounded on Linux). Same floors as
+        // Perfect-SMTP 6.0.0: nio 2.86.0, nio-ssl 2.31.0 (public `peerCertificate`, read by the
+        // DNS-subjectAltName check), swift-asn1 1.2.0 (the subjectAltName parser).
+        .package(url: "https://github.com/apple/swift-nio.git", from: "2.86.0"),
+        .package(url: "https://github.com/apple/swift-nio-ssl.git", from: "2.31.0"),
+        .package(url: "https://github.com/apple/swift-asn1.git", from: "1.2.0"),
+    ],
     targets: [
         .target(
             name: "PerfectOAuth2",
+            dependencies: [
+                .product(name: "Crypto", package: "swift-crypto"),
+                .product(name: "NIOCore", package: "swift-nio"),
+                .product(name: "NIOPosix", package: "swift-nio"),
+                .product(name: "NIOHTTP1", package: "swift-nio"),
+                .product(name: "NIOTLS", package: "swift-nio"),
+                .product(name: "NIOSSL", package: "swift-nio-ssl"),
+                .product(name: "SwiftASN1", package: "swift-asn1"),
+            ],
             path: "Sources/PerfectOAuth2",
             swiftSettings: [.swiftLanguageMode(.v6)]
         ),
         .testTarget(
             name: "PerfectOAuth2Tests",
-            dependencies: ["PerfectOAuth2"],
+            dependencies: [
+                "PerfectOAuth2",
+                .product(name: "NIOCore", package: "swift-nio"),
+                .product(name: "NIOPosix", package: "swift-nio"),
+                .product(name: "NIOSSL", package: "swift-nio-ssl"),
+            ],
             path: "Tests/PerfectOAuth2Tests",
             swiftSettings: [.swiftLanguageMode(.v6)]
         ),