feat: implement OAuth Client ID Metadata Document (#1525) (#1526)

Co-authored-by: Elias Schneider <login@eliasschneider.com>

backend/internal/middleware/client_id_param_test.go

@@ -0,0 +1,69 @@
+package middleware
+
+import (
+	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+)
+
+func TestClientIDParamMiddleware(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	const cimdURL = "https://claude.ai/oauth/claude-code-client-metadata"
+	encoded := "~" + base64.RawURLEncoding.EncodeToString([]byte(cimdURL))
+
+	tests := []struct {
+		name  string
+		param string
+		want  string
+	}{
+		{"plain client ID unchanged", "my-client_id.1", "my-client_id.1"},
+		{"uuid unchanged", "550e8400-e29b-41d4-a716-446655440000", "550e8400-e29b-41d4-a716-446655440000"},
+		{"encoded CIMD URL decoded", encoded, cimdURL},
+		{"invalid base64 left as-is", "~!!!", "~!!!"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := gin.New()
+			router.Use(NewClientIDParamMiddleware().Add())
+
+			var got string
+			router.GET("/oidc/clients/:id/meta", func(c *gin.Context) {
+				got = c.Param("id")
+				c.Status(http.StatusOK)
+			})
+
+			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/oidc/clients/"+tt.param+"/meta", http.NoBody)
+			w := httptest.NewRecorder()
+			router.ServeHTTP(w, req)
+
+			require.Equal(t, http.StatusOK, w.Code)
+			require.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestClientIDParamMiddlewareIgnoresNonClientParams(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	router := gin.New()
+	router.Use(NewClientIDParamMiddleware().Add())
+
+	var got string
+	// "~"-prefixed value on a non-client param key must pass through untouched.
+	router.GET("/users/:userId", func(c *gin.Context) {
+		got = c.Param("userId")
+		c.Status(http.StatusOK)
+	})
+
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/users/~abc", http.NoBody)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	require.Equal(t, "~abc", got)
+}