Update MSC2965 OIDC Discovery implementation

[t3chguy]

https://github.com/sandhose/matrix-doc/blob/msc/sandhose/oidc-discovery/proposals/2965-oidc-discovery.md

Switches from m.authentication in .well-known/matrix/client to GET /auth_issuer API as the MSC has done.

Requires #4074

---

Here's what your changelog entry will look like:

✨ Features

• Update MSC2965 OIDC Discovery implementation (#4064).

[richvdh]

Help me out here. This is a chunky change, and is going to be time-consuming to review without any context.

What is the actual change in behaviour here, in more detail than "update"? I see the link to the MSC doc, but that in itself is a chunky document, and presumably some of it was previously implemented?

Is it possible to break up the change a bit, to make it easier to review (eg, it looks like one of the changes is to strip out support for m.authentication? I don't really understand why that's happening, given the MSC still seems to talk about it, but can you pull that out to its own commit or its own PR?)

[t3chguy]

What is the actual change in behaviour here, in more detail than "update"?

I don't really understand why that's happening, given the MSC still seems to talk about it, but can you pull that out to its own commit or its own PR?)

The MSC moved from advertising the OIDC issuer via .well-known/matrix/client to a dedicated API GET /auth_issuer - the references in the MSC to m.authentication are in the Alternatives section for this reason. Its quite entangled so not sure how to sanely split this out without the individual commits not being atomic.

[richvdh]

Its quite entangled so not sure how to sanely split this out without the individual commits not being atomic.

A few ideas to kick you off:

• OidcClientConfig is moving to a new file. Pull out the move to its own commit.
• There seems to be a formatting change to spec/unit/oidc/authorize.spec.ts ? Let's separate formatting cleanups from functional changes.
• Make adding support for account_management_endpoint its own commit.
• validateDiscoveryAuthenticationConfig isn't currently used anywhere afaict? Make ripping it out its own commit.

Those are just a few ideas I found quickly. I'm sure there are others; like I say, I'm finding it hard to follow at the moment so I'm not in the best place to advise. It doesn't matter if some of those commits end up being trivial; it all helps to reduce the amount of state a reviewer has to keep in their head at once.

[richvdh]

I realise a lot of this is marked @experimental, but surely there is something using it somewhere that is going to be broken? What's the plan for managing that?

[richvdh]

A few drive-by comments

[richvdh]

I appreciate these tests don't really apply any more, but it worries me to see tests being ripped out without new ones to replace them. Shouldn't we have similar tests for the new endpoint?

[t3chguy]

We have a test for the new endpoint now, it landed as its own PR.

As for the rest of it, its just removing code and changing types, given tests have been updated with stubs matching the new types I'd consider that tested

[t3chguy]

Have split out #4071 - will rebase this PR and split into sane commits afterwards

[t3chguy]

What's the plan for managing that?

matrix-org/matrix-react-sdk#12245

[richvdh]

Seems generally sensible. A nit, and a question.

[richvdh]

Was there an answer to my question at #4064 (comment)?

Also would like to see a mention of .well-known/openid-configuration somewhere in the doc-comments, per #4064 (comment).

LGTM otherwise