{
  "context": "Tests whether the agent correctly sets up the @fastify/oauth2 plugin with proper PKCE, state validation, and token handling. The agent must use the right packages, configure PKCE with S256, implement CSRF-safe state management, and use the correct API method to exchange the authorization code.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "@fastify/oauth2 package",
      "description": "Uses @fastify/oauth2 as the OAuth plugin (present in package.json or import statements), not an alternative like passport, grant, or a custom implementation",
      "max_score": 10
    },
    {
      "name": "fastify-plugin wrapper",
      "description": "The oauth plugin file wraps the registration function with fastify-plugin (fp), ensuring decorators are not encapsulated",
      "max_score": 10
    },
    {
      "name": "PKCE S256 method",
      "description": "Sets pkce: 'S256' in the @fastify/oauth2 registration options (not 'plain', not omitted)",
      "max_score": 15
    },
    {
      "name": "State generation",
      "description": "Implements generateStateFunction that stores a random value (e.g. crypto.randomUUID()) in the session",
      "max_score": 10
    },
    {
      "name": "State validation",
      "description": "Implements checkStateFunction that compares the returned state against the session-stored value and calls back with an error on mismatch",
      "max_score": 10
    },
    {
      "name": "Authorization code exchange method",
      "description": "Uses getAccessTokenFromAuthorizationCodeFlow(request) to exchange the code in the callback route",
      "max_score": 15
    },
    {
      "name": "No raw token logging",
      "description": "The callback route does NOT log or expose the raw token object (no console.log(tokenResponse) or similar)",
      "max_score": 10
    },
    {
      "name": "Session token storage",
      "description": "Stores accessToken and refreshToken in the Fastify session (not in a response body or cookie set manually)",
      "max_score": 10
    },
    {
      "name": "Correct dependency set",
      "description": "package.json (or equivalent) includes @fastify/cookie and @fastify/session in addition to @fastify/oauth2 and fastify-plugin",
      "max_score": 10
    }
  ]
}