agent foundation

lib/Service/Auth/MicrosoftOidcService.php

@@ -7,6 +7,7 @@ use MintyPHP\I18n;
 
 class MicrosoftOidcService
 {
+    // 120s tolerance on exp/nbf checks to handle minor clock drift between systems.
     private const CLOCK_SKEW = 120;
 
     public function __construct(
@@ -30,6 +31,7 @@ class MicrosoftOidcService
         }
         $metadata = $oidc['config'] ?? [];
 
+        // PKCE flow: store code_verifier in session, send only the SHA-256 challenge to the AS.
         $state = self::randomString(32);
         $nonce = self::randomString(32);
         $codeVerifier = self::randomString(64);
@@ -461,6 +463,8 @@ class MicrosoftOidcService
         return is_string($decoded) ? $decoded : '';
     }
 
+    // Builds a PEM public key from a JWK RSA key (n, e) by constructing the ASN.1 DER structure manually.
+    // PHP's openssl extension doesn't support importing JWK directly, so we encode it ourselves.
     private static function jwkToPem(array $jwk): ?string
     {
         $n = self::base64UrlDecode((string) ($jwk['n'] ?? ''));