{
  "context": "Tests whether the agent implements OAuth 2.0 with authorization code + PKCE in a Fastify application using the correct packages, security configuration, JWT validation requirements, and token storage practices specified in the skill.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "@fastify/oauth2 used",
      "description": "The implementation imports or installs '@fastify/oauth2' (not a different OAuth library like 'simple-oauth2' or 'passport')",
      "max_score": 10
    },
    {
      "name": "PKCE S256 configured",
      "description": "The OAuth plugin registration includes pkce: 'S256' (not 'plain' or absent)",
      "max_score": 10
    },
    {
      "name": "fastify-plugin wrapper used",
      "description": "The OAuth plugin file wraps the async function with fp() from 'fastify-plugin'",
      "max_score": 8
    },
    {
      "name": "JWT validates exp claim",
      "description": "The JWT verification middleware explicitly checks the 'exp' (expiration) claim and rejects expired tokens",
      "max_score": 8
    },
    {
      "name": "JWT validates iss claim",
      "description": "The JWT verification middleware explicitly checks the 'iss' (issuer) claim",
      "max_score": 8
    },
    {
      "name": "JWT validates aud claim",
      "description": "The JWT verification middleware explicitly checks the 'aud' (audience) claim",
      "max_score": 8
    },
    {
      "name": "Asymmetric signing used",
      "description": "JWT is configured to use RS256 or ES256 (NOT HS256) for token verification",
      "max_score": 8
    },
    {
      "name": "Tokens not in localStorage",
      "description": "The implementation does NOT store tokens in localStorage — tokens are stored in server-side session or HttpOnly cookies",
      "max_score": 10
    },
    {
      "name": "No implicit flow",
      "description": "The code does NOT use response_type=token or the OAuth implicit flow — uses authorization code flow only",
      "max_score": 10
    },
    {
      "name": "Refresh token rotation",
      "description": "The refresh token handler replaces the stored refresh token with the newly issued one (using newToken.token.refresh_token ?? oldRefreshToken pattern)",
      "max_score": 10
    },
    {
      "name": "State validation present",
      "description": "The implementation includes state generation and validation functions to prevent CSRF",
      "max_score": 10
    }
  ]
}