impl MSC2965: self-advertise as OIDC authentication provider

MSC2965 proposes to let the homeserver advertise its current OIDC authentication
issuer. These changes let conduwuit advertise itself as the issuer when
[global.auth.enable_oidc_login] is set. It also advertises its account management
endpoint if [global.auth.enable_oidc_account_management] is set.

None of these endpoints are implemented. This commit only implements the bare
advertisement, as requested by the MSC.

src/api/client/oidc/discovery.rs

@@ -0,0 +1,89 @@
+/// Manual implementation of [MSC2965]'s OIDC server discovery.
+///
+/// [MSC2965]: https://github.com/matrix-org/matrix-spec-proposals/pull/2965
+use axum::extract::State;
+use conduwuit::Result;
+use ruma::serde::Raw;
+use ruma::api::client::{
+	error::{
+		Error as ClientError,
+		ErrorKind as ClientErrorKind,
+		ErrorBody as ClientErrorBody,
+	},
+	discovery::get_authorization_server_metadata::{
+		self,
+		msc2965::{
+			AccountManagementAction,
+			AuthorizationServerMetadata,
+			CodeChallengeMethod,
+			GrantType,
+			Prompt,
+			ResponseMode,
+			ResponseType,
+			Response,
+		},
+	},
+};
+use crate::{conduwuit::Error, Ruma, RumaResponse};
+
+/// # `GET /_matrix/client/unstable/org.matrix.msc2965/auth_metadata`
+///
+/// If `globals.auth.enable_oidc_login` is set, advertise this homeserver's OAuth2 endpoints.
+/// Otherwise, MSC2965 requires that the homeserver responds with 404/M_UNRECOGNIZED.
+pub(crate) async fn get_auth_metadata(
+	State(services): State<crate::State>,
+	_body: Ruma<get_authorization_server_metadata::msc2965::Request>,
+) -> Result<RumaResponse<Response>> {
+	let unrecognized_error = Err(Error::Ruma(
+		ClientError::new(
+			http::StatusCode::NOT_FOUND,
+			ClientErrorBody::Standard {
+				kind: ClientErrorKind::Unrecognized,
+				message: "This homeserver doesn't do OIDC authentication.".to_string()
+			}
+		)
+	));
+	let Some(ref auth) = services.server.config.auth else {
+		return unrecognized_error;
+	};
+	if ! auth.enable_oidc_login {
+		return unrecognized_error;
+	};
+	// Advertise this homeserver's access URL as the issuer URL.
+	// Unwrap all Url::parse() calls because the issuer URL is validated at startup.
+	let issuer = services.server.config.well_known.client.as_ref().unwrap();
+	let account_management_uri = auth
+		.enable_oidc_account_management
+		.then_some(issuer.join("/_matrix/client/unstable/org.matrix.msc2964/account").unwrap());
+
+	let metadata = AuthorizationServerMetadata {
+		issuer: issuer.clone(),
+		authorization_endpoint:
+			issuer.join("/_matrix/client/unstable/org.matrix.msc2964/authorize").unwrap(),
+		device_authorization_endpoint:
+			Some(issuer.join("/_matrix/client/unstable/org.matrix.msc2964/device").unwrap()),
+		token_endpoint:
+			issuer.join("/_matrix/client/unstable/org.matrix.msc2964/token").unwrap(),
+		registration_endpoint:
+			Some(issuer.join("/_matrix/client/unstable/org.matrix.msc2964/device/register").unwrap()),
+		revocation_endpoint:
+			issuer.join("_matrix/client/unstable/org.matrix.msc2964/revoke").unwrap(),
+		response_types_supported: [ResponseType::Code].into(),
+		grant_types_supported: [GrantType::AuthorizationCode, GrantType::RefreshToken].into(),
+		response_modes_supported: [ResponseMode::Fragment, ResponseMode::Query].into(),
+		code_challenge_methods_supported: [CodeChallengeMethod::S256].into(),
+		account_management_uri,
+		account_management_actions_supported: [
+			AccountManagementAction::Profile,
+			AccountManagementAction::SessionView,
+			AccountManagementAction::SessionEnd,
+		].into(),
+		prompt_values_supported: match services.server.config.allow_registration {
+			| true => vec![Prompt::Create],
+			| false => vec![]
+		}
+	};
+	let metadata = Raw::new(&metadata).expect("authorization server metadata should serialize");
+
+	Ok(RumaResponse(Response::new(metadata)))
+}