{
  "context": "Tests whether the response correctly maps application types to appropriate OAuth2 flows.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Server-side app: Authorization Code flow",
      "description": "Recommends Authorization Code flow (with client secret) for the server-side web app since it can securely store the client secret",
      "max_score": 12
    },
    {
      "name": "SPA: Authorization Code with PKCE",
      "description": "Recommends Authorization Code flow with PKCE for the SPA since it cannot store a client secret (NOT the deprecated Implicit flow)",
      "max_score": 12
    },
    {
      "name": "CLI: Device Authorization flow",
      "description": "Recommends Device Authorization flow (or Authorization Code with localhost redirect) for the CLI tool",
      "max_score": 12
    },
    {
      "name": "Explains security rationale",
      "description": "Explains why different flows exist: client secret confidentiality, redirect URI validation, token exposure in browser",
      "max_score": 10
    },
    {
      "name": "No incorrect information",
      "description": "OAuth2 flow names, mechanics, and security properties are technically correct",
      "max_score": 12
    }
  ]
}