refactor(10.2-01): nest framework packages under modules

- Move remaining beach packages and embedded admin assets\n- Rewrite framework, example, build, and gate paths

modules/wristband/client_issue.go

@@ -0,0 +1,40 @@
+// Shared client-issuing primitives used by both RFC 7591 registration
+// (register.go) and the app-owned fonoteka:oauth-client operator command
+// (08-CONTEXT.md D-19; T-08-SECRET-TIMING: "Shared hash/validation path and
+// one-time secret"). Exporting these rather than letting the command
+// re-derive its own random-id/hash/redirect-URI-validation logic keeps
+// exactly one code path responsible for how an OAuth client secret is
+// generated and hashed.
+package wristband
+
+// IssueClientCredentials mints a random opaque client_id (16 raw bytes,
+// base64url) and, for every token_endpoint_auth_method other than "none", a
+// client_secret (32 raw bytes) plus its sha256 hex hash -- the identical
+// fixed transform RFC 7591 registration uses (D-04). secret is "" and
+// secretHash is nil for a public ("none") client. The raw secret is
+// returned exactly once; only secretHash is meant to be persisted.
+func IssueClientCredentials(authMethod string) (clientID, secret string, secretHash *string, err error) {
+	clientID, err = randomBase64URL(16)
+	if err != nil {
+		return "", "", nil, err
+	}
+	if authMethod == "none" {
+		return clientID, "", nil, nil
+	}
+	secret, err = randomBase64URL(32)
+	if err != nil {
+		return "", "", nil, err
+	}
+	h := sha256Hex(secret)
+	return clientID, secret, &h, nil
+}
+
+// RejectRedirectURI is the exported form of the redirect-URI validation
+// RFC 7591 registration already enforces (PHP OAuthClient::rejectRedirectUri):
+// at most 512 characters, a valid URL with scheme+host, https:// or loopback
+// http://127.0.0.1 / http://localhost. It returns "" when uri is accepted,
+// or a human-readable rejection reason otherwise. The operator command
+// shares this exact rule with DCR rather than re-deriving it (D-19).
+func RejectRedirectURI(uri string) string {
+	return rejectRedirectURI(uri)
+}