feat(oauth): authorization server metadata, JWKS, and OIDC discovery endpoints

[EsTharian]

Closes #148.

Summary

• Adds /.well-known/oauth-authorization-server (RFC 8414), /.well-known/jwks.json (RFC 7517), and /.well-known/openid-configuration (OIDC Discovery 1.0), each unauthenticated and cacheable (Cache-Control: public, max-age=3600).
• Introduces a jwks helper in libs/server/jwt and extends the JWT Fastify plugin with getIssuer / getJwks / keyId.
• Discovery metadata is composed from JWT_ISSUER (no new env vars). registration_endpoint and refresh_token are advertised per the issue (sibling PRs wire the actual backing).

Caveats for reviewers

• scopes_supported is a compile-time default (openid profile email offline_access). Realm-aware lookup is flagged as a TODO — appropriate follow-up once the authorize route consults a realm-level scope registry.
• Response zod schemas intentionally omitted on discovery routes so the wire body can carry unknown fields (RFC 8414 / OIDC both permit extensions).
• JWKS round-trip verification test lives in libs/server/jwt (+ JWT plugin), not in the route test — kept jose out of auth-server's direct deps.

Test plan

• pnpm nx test — 3 projects, 136 tests passing (17 new)
• pnpm nx lint / pnpm nx build auth-server
• Manual: hit /.well-known/oauth-authorization-server and verify RFC 8414 shape via a public validator
• Manual: fetch /.well-known/jwks.json, verify a qauth-issued JWT against it using jose

[nx-cloud]

View your CI Pipeline Execution ↗ for commit a662efc

Command	Status	Duration	Result
nx affected -t lint test build	✅ Succeeded	2s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-04-24 08:42:12 UTC

[gemini-code-assist]

Code Review

This pull request implements OAuth 2.0 and OpenID Connect discovery endpoints, including metadata builders and a JWKS provider. The changes update the JWT plugin to expose necessary issuer and key information and include comprehensive tests for the new functionality. Feedback suggests using a regular expression for more robust trailing slash removal in the issuer URL and optimizing the discovery routes by pre-calculating static metadata and refining the JWKS content-type header for RFC compliance.

[gemini-code-assist]

The current implementation of stripTrailingSlash only removes a single trailing slash. Using a regular expression is more robust and ensures compliance with RFC 8414 §2, which recommends that the issuer identifier does not include a trailing slash, even if multiple are accidentally provided in the configuration.

Suggested change

	function stripTrailingSlash(url: string): string {
	return url.endsWith('/') ? url.slice(0, -1) : url;
	}
	function stripTrailingSlash(url: string): string {
	return url.replace(/\/+$/, '');
	}

[gemini-code-assist]

The discovery metadata and OIDC configuration are static based on the server configuration. Re-building these objects on every request is inefficient. Pre-calculating them during route registration improves performance. Additionally, the charset=utf-8 parameter is removed from the application/jwk-set+json content type as it is not defined for that media type in RFC 7517.

  const issuer = fastify.jwtUtils.getIssuer();
  const asMetadata = buildAuthorizationServerMetadata({ issuer });
  const oidcConfig = buildOpenIdConfiguration({ issuer });

  fastify.get(
    '/.well-known/oauth-authorization-server',
    {
      schema: {
        description:
          'OAuth 2.0 Authorization Server Metadata (RFC 8414). Unauthenticated, cacheable.',
        tags: ['Discovery'],
      },
    },
    async (_request, reply) => {
      return reply
        .header('Cache-Control', DISCOVERY_CACHE_CONTROL)
        .send(asMetadata);
    }
  );

  fastify.get(
    '/.well-known/openid-configuration',
    {
      schema: {
        description:
          'OpenID Connect Discovery 1.0 document. Superset of RFC 8414 AS metadata with OIDC-specific fields. Unauthenticated, cacheable.',
        tags: ['Discovery'],
      },
    },
    async (_request, reply) => {
      return reply
        .header('Cache-Control', DISCOVERY_CACHE_CONTROL)
        .send(oidcConfig);
    }
  );

  fastify.get(
    '/.well-known/jwks.json',
    {
      schema: {
        description:
          'JSON Web Key Set (RFC 7517) containing the active EdDSA public signing key(s). Used by clients and resource servers to verify JWT signatures.',
        tags: ['Discovery'],
      },
    },
    async (_request, reply) => {
      const jwks = await fastify.jwtUtils.getJwks();
      return reply
        .header('Cache-Control', DISCOVERY_CACHE_CONTROL)
        .header('Content-Type', 'application/jwk-set+json')
        .send(jwks);
    }
  );