Fix oauth well-known paths to retain path and query

[ihrpr]

Background #733

[selcuktemizsoy]

Thank you!

[ochafik]

Thanks @ihrpr !

[ochafik]

I think we should have a fallback to the non-path-suffixed well-known path, as we do for the AS (see discoverOAuthMetadata), otherwise this will be a breaking change.

RFC9728 does mention the path suffix, but also states "By default, the well-known URI string used is /.well-known/oauth-protected-resource".

[ihrpr]

I'm Okay with the breaking changes if it means it's spec compliant. But yeah ""By default, the well-known URI string used is /.well-known/oauth-protected-resource". - this is still compliant, let me add fallback

[ochafik]

maybe this whole block w/ try suffix else fallback could be factored out / reused for both cases

[ochafik]

Looks great, thanks @ihrpr !

[MTG2000]

Hey @ihrpr

For the case where discoverMetadataWithFallback is called with:

serverUrl = URL (with a pathname)
wellKnownType = "oauth-authorization-server"
opts = { metadataServerUrl: URL (without the pathname) }

This line here is making the fallback attempt on the issuer URL when it should be done on the opts?.metadataServerUrl ?? issuer, right?

typescript-sdk/src/client/auth.ts

Line 573 in 16ea277

if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) {

Might be related to this issue: #744