feat: implement OAuth Client ID Metadata Document (#1525) (#1526)

Co-authored-by: Elias Schneider <login@eliasschneider.com>

backend/internal/controller/well_known_controller_test.go

@@ -0,0 +1,57 @@
+package controller
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/lestrrat-go/jwx/v3/jwa"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/pocket-id/pocket-id/backend/internal/common"
+	"github.com/pocket-id/pocket-id/backend/internal/service"
+	jwkutils "github.com/pocket-id/pocket-id/backend/internal/utils/jwk"
+)
+
+func newMinimalJwtService(t *testing.T) *service.JwtService {
+	t.Helper()
+
+	key, err := jwkutils.GenerateKey(jwa.RS256().String(), "")
+	require.NoError(t, err, "failed to generate test JWK key")
+
+	svc := &service.JwtService{}
+	require.NoError(t, svc.SetKey(key), "failed to set JWK key on JwtService")
+	return svc
+}
+
+func TestClientIDMetadataDocumentDiscoveryFollowsAllowlist(t *testing.T) {
+	origURL := common.EnvConfig.AppURL
+	t.Cleanup(func() {
+		common.EnvConfig.AppURL = origURL
+	})
+
+	common.EnvConfig.AppURL = "https://test.example.com"
+	jwtSvc := newMinimalJwtService(t)
+	cimdURLAllowlist := []string(nil)
+	wkc := &WellKnownController{
+		jwtService: jwtSvc,
+		getCIMDURLAllowlist: func() []string {
+			return cimdURLAllowlist
+		},
+	}
+
+	parse := func(t *testing.T) map[string]any {
+		t.Helper()
+		raw, err := wkc.computeOIDCConfiguration()
+		require.NoError(t, err)
+		var cfg map[string]any
+		require.NoError(t, json.Unmarshal(raw, &cfg))
+		return cfg
+	}
+
+	cimdURLAllowlist = []string{"https://client.example.com/**"}
+	assert.Equal(t, true, parse(t)["client_id_metadata_document_supported"])
+
+	cimdURLAllowlist = nil
+	assert.Equal(t, false, parse(t)["client_id_metadata_document_supported"])
+}