supabase / auth / 27373392588

71%

Build Type

push

github

Committed by web-flow

Commit Message

feat(custom-oidc): support non-standard discovery URLs (#2573)

## What kind of change does this PR introduce?

Feature

## What is the current behavior?

`discoveryUrl` is only validated during provider creation (admin
endpoint)

## What is the new behavior?

use `discoveryUrl` while making the actual OIDC discovery too

## Summary
- Adds `OIDCProviderCache.GetProviderFromURL` so custom OIDC providers
can fetch their discovery document from any URL, not just
`{issuer}/.well-known/openid-configuration`.
- Custom OIDC providers now always route through this path; the URL is
sourced from `CustomOAuthProvider.GetDiscoveryURL()` (which falls back
to the standard path when no override is configured).
- Bounds discovery fetches with a 10s HTTP timeout and verifies the
document's `issuer` matches the configured one before constructing the
provider.

Coverage Stats

81 of 98 new or added lines in 5 files covered. (82.65%)

1 existing line in 1 file now uncovered.

17732 of 24889 relevant lines covered (71.24%)

650.68 hits per line