add metadataServerUrl to discoverMetadataWithFallback to allow external AS

Author: ochafik

src/client/auth.test.ts

@@ -1753,7 +1753,7 @@ describe("OAuth Authorization", () => {
  mockFetch.mockImplementation((url) => {
  const urlString = url.toString();
 
- if (urlString === "https://my.resource.com/.well-known/oauth-protected-resource") {
+ if (urlString === "https://my.resource.com/.well-known/oauth-protected-resource/path/name") {
  return Promise.resolve({
  ok: true,
  status: 200,
@@ -1800,7 +1800,7 @@ describe("OAuth Authorization", () => {
  const calls = mockFetch.mock.calls;
 
  // First call should be to PRM
- expect(calls[0][0].toString()).toBe("https://my.resource.com/.well-known/oauth-protected-resource");
+ expect(calls[0][0].toString()).toBe("https://my.resource.com/.well-known/oauth-protected-resource/path/name");
 
  // Second call should be to AS metadata with the path from serverUrl
  expect(calls[1][0].toString()).toBe("https://auth.example.com/.well-known/oauth-authorization-server/path/name");

src/client/auth.ts

@@ -471,7 +471,7 @@ function shouldAttemptFallback(response: Response | undefined, pathname: string)
 async function discoverMetadataWithFallback(
  serverUrl: string | URL,
  wellKnownType: 'oauth-authorization-server' | 'oauth-protected-resource',
- opts?: { protocolVersion?: string; metadataUrl?: string | URL },
+ opts?: { protocolVersion?: string; metadataUrl?: string | URL, metadataServerUrl?: string | URL },
 ): Promise<Response | undefined> {
  const issuer = new URL(serverUrl);
  const protocolVersion = opts?.protocolVersion ?? LATEST_PROTOCOL_VERSION;
@@ -482,7 +482,7 @@ async function discoverMetadataWithFallback(
  } else {
  // Try path-aware discovery first
  const wellKnownPath = buildWellKnownPath(wellKnownType, issuer.pathname);
- url = new URL(wellKnownPath, issuer);
+ url = new URL(wellKnownPath, opts?.metadataServerUrl ?? issuer);
  url.search = issuer.search;
  }
 
@@ -525,9 +525,13 @@ export async function discoverOAuthMetadata(
  protocolVersion ??= LATEST_PROTOCOL_VERSION;
 
  const response = await discoverMetadataWithFallback(
- authorizationServerUrl,
+ issuer,
+ // authorizationServerUrl,
  'oauth-authorization-server',
- {protocolVersion},
+ {
+ protocolVersion,
+ metadataServerUrl: authorizationServerUrl,
+ },
  );
 
  if (!response || response.status === 404) {