Fixes for OIDC

[N00byKing]

These changes allow connection to the newly added OIDC support in Continuwuity.
I tested the change by building FluffyChat, which worked (After setting the oidc flag).

Currently, login fails because:

• OIDC-only logins make the sdk throw an exception
  • First patch modifies the logic so that the exception only occurs if both legacy and oidc login are unavailable
• Continuwuity returns code 200 on successful registration, but 201 is expected by the sdk
  • Continuwuity is not standard-conformant here and 201 is correct. I've submitted a patch there to fix the return code.
  • Since this is not really an error, for stability I modified the logic to allow 200 as well
• Continuwuity will reject oidc registration for loopback addresses if a port is specified. (See code snippet from continuwuity)
  • I'm not sure which is standard conformant here. The standard only says that "The authorization server MUST allow any port to be specified at the time of the request", i.e. at authorization, but not registration.

The third patch may or may not be correct here, I'm really not sure. Let me know what you think.

NOTE: I've never written dart code, extra scrutiny is appreciated

EDIT: Patch 1 and 2 superseded by #2412

[cursor]

PR Summary

Medium Risk
Touches OIDC client registration and alters registered redirect URIs relative to what the app may use at authorization time, which could break redirect matching if the server enforces exact URI equality.

Overview
registerOidcClient now sends port-stripped redirect URIs for native apps using http on loopback hosts (localhost, 127.0.0.1, [::1]), while validation still uses the caller’s original URIs.

Loopback host names are hoisted to a shared loopbackHosts constant (replacing the inline allowedHosts in the native branch). The registration JSON uses a derived registrationRedirectUris list instead of redirectUris directly, documented as a workaround for homeservers that reject loopback registrations when a port is present.

^{Reviewed by Cursor Bugbot for commit f34f894. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit 12f89ab. Configure here.}

[cursor]

Registration auth redirect mismatch

Medium Severity

registerOidcClient posts loopback native redirect_uris with ports removed, while the documented OIDC flow still uses the original redirectUri (including port) in authorization and token requests. Servers that validate redirect_uri by exact match to registered values may reject login after successful registration.

 

^{Reviewed by Cursor Bugbot for commit 12f89ab. Configure here.}

[N00byKing]

This is intended. At registration, no port is specified, and at authorization all ports MUST be accepted

[codecov]

Codecov Report

❌ Patch coverage is 93.75000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 59.64%. Comparing base (53a6a79) to head (f34f894).

Files with missing lines	Patch %	Lines
...ion/msc_2966_oidc_dynamic_client_registration.dart	93.75%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2411      +/-   ##
==========================================
+ Coverage   59.62%   59.64%   +0.02%     
==========================================
  Files         161      161              
  Lines       20329    20342      +13     
==========================================
+ Hits        12121    12134      +13     
  Misses       8208     8208              

Files with missing lines	Coverage Δ
...ion/msc_2966_oidc_dynamic_client_registration.dart	75.00% <93.75%> (+4.33%)	⬆️

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 53a6a79...f34f894. Read the comment docs.

[krille-chan]

So this is just removing the port from the redirectUrl, but is this then still working on for example Linux Desktop? There the port is used to find the application iirc

[N00byKing]

I was testing on desktop, so yes :P
The port is still forwarded, but not at registration.
Its still present in the authorization