[DEV-3974] Enable PKCE by default and allow credential omission

[jcsawyer123]

Summary

• Enable PKCE by default.
• Make the MLH API base configurable.
• Narrow OAuth error rescue behavior.
• Allow consumers to omit persisted OAuth credentials.
• Prepare version 4.2.0 for the dependent Forem integration.

Dependency

This is the standalone cross-fork dependency for the Forem DEV-3974 stack. GitHub native stacks cannot cross repositories.

Status

Draft only. Do not publish the gem or merge the dependent Forem layer until focused review and release checks are complete.

Security review

The complete committed delta was audited. No tracked environment file, literal credential, token, private key, credential-bearing URL, real identity fixture, or generated secret artifact was found.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-11T20:03:34.776374Z	bf3f933	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟡 Changes recommended

Two unresolved strategy issues affect OAuth client configuration and expand_fields handling.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR updates the MLH OmniAuth strategy with default PKCE, configurable API access, optional credential persistence, narrower error handling, and version 4.2.0.

Changes:

• Adds PKCE and configurable API endpoints.
• Supports omitting persisted OAuth credentials.
• Updates tests and version metadata.

File summaries

File	Summary
spec/omni_auth/strategies/mlh_spec.rb	Tests the updated strategy behavior.
spec/omni_auth/mlh_spec.rb	Updates the expected version.
lib/omniauth/strategies/mlh.rb	Implements the strategy changes. Critical issue (2 votes): replacing client_options can drop OAuth defaults. Moderate issue (3 votes): expand_fields: nil or false can raise an error.
lib/omniauth-mlh/version.rb	Sets the version to 4.2.0.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The OAuth, PKCE, API configuration, credential handling, and release changes require final human review.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite