wso2 login: browser Authorization Code + PKCE end to end

[kanushka]

Parent

Part of #17.

What to build

wso2 login end to end for a browser identity: resolve the selected context and its identity, discover the issuer (requiring S256), bind the first free loopback callback port of 10425–10428, always print the authorization URL while opening the browser best-effort, run Authorization Code + PKCE, verify the ID token, store the session in the OS secure store under the identity's credential reference, and report the authenticated subject, email, and the product namespaces the identity claims to reach — never any token material.

Refusals, each a stable typed problem: no context selected; non-interactive mode (flag or environment) for an interactive kind; client-credentials or development-credential kind (login not required — access is acquired inline); device or PAT kind (not implemented); discovery failure or missing S256.

Detailed steps: implementation plan docs/superpowers/plans/2026-08-05-login-first-slice.md, Tasks 6–7.

Acceptance criteria

• Against the fake issuer, wso2 login completes PKCE and the stored session holds the issuer, a refresh token, and expiry under the identity's credential reference
• The authorization URL is printed even when the browser cannot open, and login still completes when driven from the printed URL
• A state mismatch on the callback does not complete the login
• Every refusal row above produces its stable code, the auth-policy exit class, and actionable recovery text
• Login output contains the subject, email, and product namespaces, and contains no access or refresh token material
• go test ./... -race passes

Blocked by

• Context schema v2: identities, compatibility read, and selection #18
• Deterministic auth test bed: fake OIDC issuer and keychain session store #19

[kanushka]

This was generated by AI during triage.

Implemented by PR #26, merged into feature/login (full stack landed; feature/login tip is the PR #29 merge). Auto-close did not fire because closing keywords only act on merges to the default branch — closed manually.