---
id: w6/m6/t006
title: OAuth/OIDC audit — PKCE, audience, scope enforcement
worker: worker6
status: done
estimate: 30m
depends_on: []
---

## Objective

Verify PKCE enforcement, token-audience checks, and scope enforcement match `docs/ADR012-auth.md` §7 as actually implemented, not just documented.

## Context

- `docs/ADR012-auth.md` §7 documents OAuth 2.1 discovery for MCP/agent clients: `BEX_OAUTH_ISSUER`, `BEX_OAUTH_RESOURCE`, RFC 9728 metadata, 401 `resource_metadata` hints, token-audience check.
- Hydra is the OAuth2 provider; bex-api introspects tokens via `BEX_HYDRA_ADMIN_URL`.

## Steps

1. Trace the token-audience check in bex-api's introspection path; confirm it actually rejects tokens issued for a different resource.
2. Confirm PKCE is enforced on the authorization-code flow (not just documented as required) — check Hydra client configuration and any bex-side enforcement.
3. Confirm scope enforcement: that granted OAuth scopes actually gate the MCP tools / REST verbs they're supposed to, not just checked at token-issuance time.
4. Record findings for t007.

## Files

- `lego/backend/internal/**` (auth/introspection middleware)
- `docs/ADR012-auth.md`

## Acceptance criteria

- [ ] Token-audience check confirmed enforced (or fixed).
- [ ] PKCE confirmed enforced end-to-end.
- [ ] Scope enforcement confirmed to gate actual verb/tool access.

## Out of scope

- Kratos session-based first-party auth (already covered by DO_NOT_DO's session-vs-OAuth boundary; not in scope here).
