What is the 'authorization code PKCE flow' complete step-by-step for a Single Page Application?

• A.SPA sends username and password directly to the authorization server; the server returns tokens
• B.SPA exchanges the code using client_secret; the code_verifier replaces the secret in PKCE
• C.PKCE flow for SPAs is identical to client credentials flow with additional CSRF protection
• D.1. SPA generates code_verifier (random 32-96 bytes) and code_challenge = base64url(sha256(verifier)). 2. Redirect to IdP: /authorize?client_id=...&code_challenge=...&code_challenge_method=S256&state=csrf&redirect_uri=... 3. User authenticates at IdP. 4. IdP redirects back to SPA: /callback?code=abc&state=csrf. 5. SPA validates state matches. 6. SPA exchanges: POST /token {code=abc, code_verifier=..., client_id=...}. 7. IdP verifies sha256(verifier)==challenge, returns access+ID+refresh tokens