{
  "context": "Tests whether the agent implements the Fastify OAuth2 authorization code flow using the prescribed plugin, security options, and token handling patterns. Criteria focus on package choices, PKCE configuration, CSRF protection via state, and safe token storage — not general correctness.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "@fastify/oauth2 package",
      "description": "Uses @fastify/oauth2 as the OAuth2 plugin (imports or requires '@fastify/oauth2'), not an alternative library such as passport or oauth2-server",
      "max_score": 10
    },
    {
      "name": "fastify-plugin wrapping",
      "description": "The oauth plugin file wraps the plugin function with fp() from 'fastify-plugin' (e.g. export default fp(async function...))",
      "max_score": 10
    },
    {
      "name": "PKCE S256 method",
      "description": "PKCE is configured with exactly 'S256' as the method (pkce: 'S256') in the oauth2 registration options",
      "max_score": 15
    },
    {
      "name": "State generation uses randomUUID",
      "description": "generateStateFunction uses crypto.randomUUID() to generate the state value and stores it in the session (req.session.state or equivalent)",
      "max_score": 10
    },
    {
      "name": "State validation in checkStateFunction",
      "description": "checkStateFunction compares req.query.state to the session-stored state and calls callback with an Error on mismatch",
      "max_score": 10
    },
    {
      "name": "getAccessTokenFromAuthorizationCodeFlow",
      "description": "The callback route uses fastify.oauth2.getAccessTokenFromAuthorizationCodeFlow(request) to exchange the authorization code",
      "max_score": 10
    },
    {
      "name": "HTTPS callbackUri",
      "description": "The callbackUri value (in config or environment usage) references an https:// scheme, not http://",
      "max_score": 10
    },
    {
      "name": "Tokens stored in session",
      "description": "Both access token and refresh token are stored in the server-side session (request.session.set or request.session.*), NOT assigned to any client-side storage mechanism",
      "max_score": 10
    },
    {
      "name": "No raw token logging",
      "description": "No console.log, fastify.log, request.log, or similar logger call passes the raw access_token or refresh_token string directly as an argument or interpolated string",
      "max_score": 10
    },
    {
      "name": "No implicit flow",
      "description": "The implementation does NOT use response_type=token or implement the implicit grant flow anywhere in the code",
      "max_score": 5
    }
  ]
}