From a58ccea6cec3aaa17a643921c5df461fc0886320 Mon Sep 17 00:00:00 2001
From: Elias Schneider <git@eliasschneider.com>
Date: Fri, 9 Oct 2026 22:56:01 +0200
Subject: [PATCH] fix: remove unused oidc client `/meta` endpoint

---
 .../internal/controller/oidc_controller.go    | 27 -------------
 .../middleware/client_id_param_test.go        | 39 -------------------
 frontend/src/lib/services/oidc-service.ts     |  5 ---
 3 files changed, 71 deletions(-)

diff --git a/backend/internal/controller/oidc_controller.go b/backend/internal/controller/oidc_controller.go
index c1b348c3..0d5001a3 100644
--- a/backend/internal/controller/oidc_controller.go
+++ b/backend/internal/controller/oidc_controller.go
@@ -31,7 +31,6 @@ func NewOidcController(r *authz.Router, fileSizeLimitMiddleware *middleware.File
 	r.GET("/oidc/clients", authz.OidcClientsRead, httpserver.Handle(oc.listClientsHandler))
 	r.POST("/oidc/clients", authz.OidcClientsWrite, httpserver.Handle(oc.createClientHandler))
 	r.GET("/oidc/clients/:id", authz.OidcClientsRead, httpserver.Handle(oc.getClientHandler))
-	r.Public().GET("/oidc/clients/:id/meta", httpserver.Handle(oc.getClientMetaDataHandler))
 	r.PUT("/oidc/clients/:id", authz.OidcClientsWrite, httpserver.Handle(oc.updateClientHandler))
 	r.POST("/oidc/clients/:id/refresh", authz.OidcClientsWrite, httpserver.Handle(oc.refreshClientMetadataHandler))
 	r.DELETE("/oidc/clients/:id", authz.OidcClientsWrite, httpserver.Handle(oc.deleteClientHandler))
@@ -61,32 +60,6 @@ type OidcController struct {
 	appConfigService appconfig.AppConfigResolver
 }
 
-// getClientMetaDataHandler godoc
-// @Summary Get client metadata
-// @Description Get OIDC client metadata for discovery and configuration
-// @Tags OIDC
-// @Produce json
-// @Param id path string true "Client ID"
-// @Success 200 {object} dto.OidcClientMetaDataDto "Client metadata"
-// @Failure default {object} dto.ErrorDto "Error"
-// @Router /api/oidc/clients/{id}/meta [get]
-func (oc *OidcController) getClientMetaDataHandler(c *gin.Context) error {
-	clientId := c.Param("id")
-	client, err := oc.oidcService.GetClient(c.Request.Context(), clientId)
-	if err != nil {
-		return err
-	}
-
-	clientDto := dto.OidcClientMetaDataDto{}
-	if err := dto.MapStruct(client, &clientDto); err != nil {
-		return err
-	}
-
-	clientDto.HasDarkLogo = client.HasDarkLogo()
-	c.JSON(http.StatusOK, clientDto)
-	return nil
-}
-
 // getClientHandler godoc
 // @Summary Get OIDC client
 // @Description Get detailed information about an OIDC client
diff --git a/backend/internal/middleware/client_id_param_test.go b/backend/internal/middleware/client_id_param_test.go
index e5670643..ec79d86d 100644
--- a/backend/internal/middleware/client_id_param_test.go
+++ b/backend/internal/middleware/client_id_param_test.go
@@ -1,7 +1,6 @@
 package middleware
 
 import (
-	"encoding/base64"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -10,44 +9,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestClientIDParamMiddleware(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-
-	const cimdURL = "https://claude.ai/oauth/claude-code-client-metadata"
-	encoded := "~" + base64.RawURLEncoding.EncodeToString([]byte(cimdURL))
-
-	tests := []struct {
-		name  string
-		param string
-		want  string
-	}{
-		{"plain client ID unchanged", "my-client_id.1", "my-client_id.1"},
-		{"uuid unchanged", "550e8400-e29b-41d4-a716-446655440000", "550e8400-e29b-41d4-a716-446655440000"},
-		{"encoded CIMD URL decoded", encoded, cimdURL},
-		{"invalid base64 left as-is", "~!!!", "~!!!"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			router := gin.New()
-			router.Use(NewClientIDParamMiddleware().Add())
-
-			var got string
-			router.GET("/oidc/clients/:id/meta", func(c *gin.Context) {
-				got = c.Param("id")
-				c.Status(http.StatusOK)
-			})
-
-			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/oidc/clients/"+tt.param+"/meta", http.NoBody)
-			w := httptest.NewRecorder()
-			router.ServeHTTP(w, req)
-
-			require.Equal(t, http.StatusOK, w.Code)
-			require.Equal(t, tt.want, got)
-		})
-	}
-}
-
 func TestClientIDParamMiddlewareIgnoresNonClientParams(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 
diff --git a/frontend/src/lib/services/oidc-service.ts b/frontend/src/lib/services/oidc-service.ts
index ee4bd892..e09d2ce6 100644
--- a/frontend/src/lib/services/oidc-service.ts
+++ b/frontend/src/lib/services/oidc-service.ts
@@ -9,7 +9,6 @@ import type {
 	OidcClientCreate,
 	OidcClientCreated,
 	OidcClientLogoPreset,
-	OidcClientMetaData,
 	OidcClientSecret,
 	OidcClientSecretCreated,
 	OidcClientUpdate,
@@ -54,10 +53,6 @@ class OidcService extends APIService {
 		(await this.api.get(`/oidc/clients/${encodeClientIdParam(id)}`))
 			.data as OidcClientWithAllowedUserGroups;
 
-	getClientMetaData = async (id: string) =>
-		(await this.api.get(`/oidc/clients/${encodeClientIdParam(id)}/meta`))
-			.data as OidcClientMetaData;
-
 	updateClient = async (id: string, client: OidcClientUpdate) =>
 		(await this.api.put(`/oidc/clients/${encodeClientIdParam(id)}`, client)).data as OidcClient;