test: add failing tests for direct OAuth authorization flow

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

test/e2e.test.js

···
         'Should show full access warning',
       );
     });
+
+    it('supports direct authorization without PAR', async () => {
+      const clientId = 'http://localhost:3000';
+      const redirectUri = 'http://localhost:3000/callback';
+      const codeVerifier = 'test-verifier-for-direct-auth-flow-min-43-chars!!';
+      const challengeBuffer = await crypto.subtle.digest(
+        'SHA-256',
+        new TextEncoder().encode(codeVerifier),
+      );
+      const codeChallenge = Buffer.from(challengeBuffer).toString('base64url');
+      const state = 'test-direct-auth-state';
+
+      // Step 1: GET authorize with direct parameters (no PAR)
+      const authorizeUrl = new URL(`${BASE}/oauth/authorize`);
+      authorizeUrl.searchParams.set('client_id', clientId);
+      authorizeUrl.searchParams.set('redirect_uri', redirectUri);
+      authorizeUrl.searchParams.set('response_type', 'code');
+      authorizeUrl.searchParams.set('scope', 'atproto');
+      authorizeUrl.searchParams.set('code_challenge', codeChallenge);
+      authorizeUrl.searchParams.set('code_challenge_method', 'S256');
+      authorizeUrl.searchParams.set('state', state);
+      authorizeUrl.searchParams.set('login_hint', DID);
+
+      const getRes = await fetch(authorizeUrl.toString());
+      assert.strictEqual(getRes.status, 200, 'Direct authorize GET should succeed');
+
+      const html = await getRes.text();
+      assert.ok(html.includes('Authorize'), 'Should show consent page');
+      assert.ok(html.includes('request_uri'), 'Should include request_uri in form');
+    });
+
+    it('completes full direct authorization flow', async () => {
+      const clientId = 'http://localhost:3000';
+      const redirectUri = 'http://localhost:3000/callback';
+      const codeVerifier = 'test-verifier-for-direct-auth-flow-min-43-chars!!';
+      const challengeBuffer = await crypto.subtle.digest(
+        'SHA-256',
+        new TextEncoder().encode(codeVerifier),
+      );
+      const codeChallenge = Buffer.from(challengeBuffer).toString('base64url');
+      const state = 'test-direct-auth-state';
+
+      // Step 1: GET authorize with direct parameters
+      const authorizeUrl = new URL(`${BASE}/oauth/authorize`);
+      authorizeUrl.searchParams.set('client_id', clientId);
+      authorizeUrl.searchParams.set('redirect_uri', redirectUri);
+      authorizeUrl.searchParams.set('response_type', 'code');
+      authorizeUrl.searchParams.set('scope', 'atproto');
+      authorizeUrl.searchParams.set('code_challenge', codeChallenge);
+      authorizeUrl.searchParams.set('code_challenge_method', 'S256');
+      authorizeUrl.searchParams.set('state', state);
+      authorizeUrl.searchParams.set('login_hint', DID);
+
+      const getRes = await fetch(authorizeUrl.toString());
+      assert.strictEqual(getRes.status, 200);
+      const html = await getRes.text();
+
+      // Extract request_uri from the form
+      const requestUriMatch = html.match(/name="request_uri" value="([^"]+)"/);
+      assert.ok(requestUriMatch, 'Should have request_uri in form');
+      const requestUri = requestUriMatch[1];
+
+      // Step 2: POST to authorize (user approval)
+      const authRes = await fetch(`${BASE}/oauth/authorize`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          request_uri: requestUri,
+          client_id: clientId,
+          password: PASSWORD,
+        }).toString(),
+        redirect: 'manual',
+      });
+
+      assert.strictEqual(authRes.status, 302, 'Should redirect after approval');
+      const location = authRes.headers.get('location');
+      assert.ok(location, 'Should have Location header');
+      const locationUrl = new URL(location);
+      const code = locationUrl.searchParams.get('code');
+      assert.ok(code, 'Should have authorization code');
+      assert.strictEqual(locationUrl.searchParams.get('state'), state);
+
+      // Step 3: Exchange code for tokens
+      const dpop = await DpopClient.create();
+      const dpopProof = await dpop.createProof('POST', `${BASE}/oauth/token`);
+
+      const tokenRes = await fetch(`${BASE}/oauth/token`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          DPoP: dpopProof,
+        },
+        body: new URLSearchParams({
+          grant_type: 'authorization_code',
+          code,
+          redirect_uri: redirectUri,
+          client_id: clientId,
+          code_verifier: codeVerifier,
+        }).toString(),
+      });
+
+      assert.strictEqual(tokenRes.status, 200, 'Token exchange should succeed');
+      const tokenData = await tokenRes.json();
+      assert.ok(tokenData.access_token, 'Should have access_token');
+      assert.strictEqual(tokenData.token_type, 'DPoP');
+    });
   });
 
   describe('Foreign DID proxying', () => {