OAUTH-001C1H: add one-use Strava OAuth state

.github/lint-baseline.json

@@ -31,7 +31,7 @@
     ".ts": 0,
     ".tsx": 6
   },
-  "fingerprint": "sha256:f6d14c2fd59a703cf4c69f45f80ea93f02ee33484980f9dd028cb37f149ca671",
+  "fingerprint": "sha256:56b52a74434e910548d72c741ab21b634274d3cc9c36fe9983d8942b34eebddf",
   "scannedFiles": [
     "src/App.jsx",
     "src/App.test.jsx",
@@ -200,9 +200,9 @@
     },
     {
       "file": "src/pages/account/StravaSection.tsx",
-      "line": 305,
+      "line": 358,
       "column": 11,
-      "endLine": 305,
+      "endLine": 358,
       "endColumn": 42,
       "severity": 2,
       "ruleId": "react/jsx-no-bind",
@@ -213,10 +213,10 @@
     },
     {
       "file": "src/pages/account/StravaSection.tsx",
-      "line": 310,
-      "column": 23,
-      "endLine": 310,
-      "endColumn": 48,
+      "line": 364,
+      "column": 11,
+      "endLine": 364,
+      "endColumn": 36,
       "severity": 2,
       "ruleId": "react/jsx-no-bind",
       "message": "JSX props should not use functions",

SECURITY.md

@@ -129,6 +129,7 @@ These entries are implementation evidence, not a production risk-acceptance deci
 | Part of RISK-014 | SUPPLY-001D6 [#381](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/381) resolves the sole root `picomatch` 2.x node from 2.3.1 to the patched 2.3.2 release without changing `package.json`; the existing `jest-util` `^2.2.3` and `micromatch` `^2.3.1` ranges already admit it. The exact lock change touches only that node's version, public-registry URL, and integrity while its non-development classification, MIT license, `>=8.6` engine, parent ranges, and the separate development-only `tinyglobby` picomatch 4.0.4 copy stay fixed. A dependency-free Node test pins those identities and ranges; deterministic public-API regressions prove that inherited POSIX names cannot inject host method text into a compiled expression while ordinary `[[:alpha:]]` matching remains compatible. A fresh 2026-07-19 UTC Node 20.19.5/npm 10.8.2 full audit falls from 65 findings (1 critical, 32 high) to 64 (1 critical, 31 high), and the production-only snapshot falls from 6 findings (0 critical, 3 high, 2 moderate, 1 low) to 5 (0 critical, 2 high, 2 moderate, 1 low), removing GHSA-3v7f-55p6-f55p and GHSA-c2c7-rcm5-vvqj from the sole affected node. | No application source imports `picomatch`, and clean before/after optimized builds on the same toolchain are byte-identical: the same 59 files and 19,475,953 bytes. The sorted per-file SHA-256 manifest has aggregate SHA-256 `57f2db4d6217de2f4e158d357aa928cb0af2b6a18238d61d3d866ffd53f234ba`. `npm ls picomatch --all` still reports the pre-existing hoisted `fdir` `^3 || ^4` mismatch; this patch neither introduces nor repairs that separate build-tool layout debt. The remaining root critical `protobufjs` finding is in the old development-only `firebase-tools` chain and requires a separate major CLI, emulator, and protected-release compatibility review; all other root and Functions findings also remain unresolved and are not accepted as safe. This source/test change does not publish the website, deploy Firebase, change a provider, inspect production data, or prove live behavior. |
 | Part of RISK-014 | SUPPLY-001D7 [#385](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/385) resolves the sole root, non-development `yaml` 1.x node from 1.10.2 to the patched 1.10.3 release without changing `package.json`; the existing `cosmiconfig` `^1.10.0`, `cssnano` `^1.10.2`, and nested `cosmiconfig` `^1.7.2` ranges already admit it. The exact lock change touches only that node's version, public-registry URL, and integrity while the three separate development-only `yaml` 2.x copies remain fixed. A dependency-free Node test pins all four locked identities and development classifications, the three unchanged parent ranges, and the installed root version. Its fixed 601-byte collection input runs in a bounded child process with a reduced stack and proves the patched public `parseDocument` API reports one parser-owned `YAMLSemanticError` instead of exposing raw `RangeError` failures. A fresh 2026-07-19 UTC Node 20.20.2/npm 10.8.2 full audit remains 64 findings (1 critical, 31 high, 19 moderate, 13 low) because vulnerable development-only `yaml` 2.7.1 and 2.8.0 copies remain; the production-only snapshot falls from 5 findings (2 high, 2 moderate, 1 low) to 4 (2 high, 1 moderate, 1 low). | No application source imports `yaml`, and clean before/after optimized builds on the same toolchain are byte-identical: the same 59 files and 19,489,263 bytes. The sorted per-file SHA-256 manifest has aggregate SHA-256 `0207e35601232cd74febaa6e72b9e2322f2159276f32d9ce046f8b050f0f40ed`. The two affected development-only `yaml` 2.x copies and all other root and Functions findings remain unresolved and are not accepted as safe; they require separate compatibility review rather than widening this lock-only production patch. Source, tests, and any merge do not publish the website, deploy Firebase, change a provider, inspect production data, or prove live behavior. |
 | Part of RISK-024 | SEC-001 protects token documents from every browser client. | OAUTH-001 must still add transactional refresh/versioning, scope/account binding, disconnect/revocation, IAM/encryption decision, and redacted lifecycle audit. |
+| RISK-009, part of RISK-024 | OAUTH-001C1H [#441](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/441) replaces browser-generated/session-storage-authoritative Strava OAuth state with a 32-byte server-issued challenge. Source stores only a SHA-256 digest in one browser-denied per-UID secret record, binds it to exact UID and decoded Auth `auth_time`, expires it after ten minutes, and transactionally deletes one match before provider exchange or connection writes. A later begin overwrites the older record; mismatch, expiry, replay, and the concurrent loser stop with one fixed result before Strava. Synthetic tests use mocks and no real callback or provider value. | This source does not deploy either Function or the website, configure Strava, prove the custom App Check guard is enabled, enable native runtime App Check enforcement, inspect production data, or prove live OAuth behavior. The initial capability callback still suppresses browser App Check startup, so fail-closed exchange enforcement also needs a separately reviewed clean-page handoff. Scope/account policy, refresh concurrency, provider/local reconciliation, revoke/audit, IAM/encryption, and provider/live evidence remain open under [#88](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/88). |
 | Part of RISK-027 | #99 blocks App Check, Firebase Analytics, and Sentry in local/test and on initial capability-callback startup. OBS-001A1 [#134](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/134) source disables Sentry replay, tracing, browser session tracking, client reports, member user context, breadcrumbs, attachments, transactions, and unapproved default integrations. OBS-001A2 [#139](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/139) source removes every application runtime Firebase Analytics import, initialization, and emission, preserves existing wrapper calls as provider-free no-ops, and removes the direct Waiver SDK bypass. OBS-001A3 [#142](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/142) source routes the remaining render, Auth-email, members-only, and App Check browser diagnostics through five fixed outcome identifiers and prohibits direct console calls elsewhere in application/public runtime source. Synthetic tests use mocks/canaries and make no provider call. | #110/#111 still own any future approved telemetry purpose, consent, event/parameter schema, provider settings, and residual hosted boundary. Source/tests and merge evidence do not prove website publication, the exact `runmprc.com` revision, provider transport/collection, IP/cookie behavior, console history, historical data deletion, retention, access, consent, deletion, or vendor terms. Sentry provider behavior is likewise unverified. Callback protected handoffs remain with ABUSE-001A, DATA-001A, and OAUTH-001C in #88. |
 | Part of RISK-035 | The Jest environment is repaired, #124 adds the complete frontend suite as a named blocking hosted step, and #126 adds the standalone SPA callback suite. CI-001B3 [#167](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/167) merged the lockfile-bound Node 20/Java 17 `Commerce command journal emulator` job using exact demo project `demo-pay002b2-test`, Firestore only, and explicit opt-in. CI-001B4 [#186](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/186) merged through [PR #189](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/189) as `bec7d5e365eacb418563a172029f241f660d9768`, adding the no-new-dependency exact-record checker, named blocking lint step, and clean-checkout step. Exact PR run `29291402007` and post-merge run `29291515653` passed every GitHub job. The checker now scans 108 frontend files; CI-001B4A [#227](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/227) and CI-001B4B [#239](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/239) each retire exactly one reviewed finding. PAY-004C1 [#359](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/359) retires two label errors and one prompt warning by removing those unsafe controls. | The reviewable lint baseline deliberately records 121 configured errors and 6 warnings as individual file/line/column/rule/message records; it is not a clean-lint claim. Any added, removed, moved, or changed record requires review, every fatal parser/configuration failure rejects with a fixed diagnostic, and the baseline must not be regenerated just to pass. The clean check covers tracked and non-ignored untracked files; ignored dependency/build outputs are outside this proof. Hosted source checks do not configure branch protection, deploy Firebase, or prove Stripe/live behavior. #169, #173, #182, #206, #226, #232, and #238 expand the focused commerce suite; configure/prove branch-required checks and add the broader TEST-001 suite. |
 | DATA-001A3 / registration confidentiality | DATA-001A3 [#374](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/374) limits the My Account registration callable to one exact stored-UID query. Source no longer reads token email or verification claims and no longer searches registrations by runner email. Matching-email records with no UID or another account's UID are excluded; exact-UID records retain their existing sanitized summary, event lookup, and sort. The page's empty result says only that no upcoming registration is linked and that a signed-out registration may not appear. Synthetic tests use getter and Proxy canaries and make no write or provider call. | This source containment is not deployed or live and does not associate, migrate, repair, or change a registration. Anonymous, historical, mistyped-email, shared-email, and differently owned records stay hidden until a separately approved, audited server association under [#115](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/115). Keep the email index until separate inventory and migration review. Complete protected Function deployment/readback, website publication, exact `runmprc.com` verification, and a made-up account check before describing the boundary as live. |