discoverAuthorizationServer method

Future<AuthServerMetadata> discoverAuthorizationServer(String authorizationServer)

Discover authorization-server metadata for the issuer authorizationServer: RFC 8414 and OpenID Connect Discovery at each well-known location in turn (path insertion first). The document must name authorizationServer as its issuer exactly, or it is refused.

Sets the client's cached metadata so the PKCE/token flow targets it.

Implementation

Future<AuthServerMetadata> discoverAuthorizationServer(
    String authorizationServer) async {
  OAuthError? lastError;
  for (final url in authorizationServerMetadataUrls(authorizationServer)) {
    final http.Response response;
    try {
      response = await _httpClient.get(url, headers: {'Accept': 'application/json'});
    } catch (e) {
      lastError = OAuthError(error: 'as_discovery_failed', errorDescription: 'AS metadata ($url): $e');
      continue;
    }
    if (response.statusCode != 200) {
      lastError = OAuthError(
          error: 'as_discovery_failed', errorDescription: 'AS metadata ($url): ${response.statusCode}');
      continue;
    }
    final json = jsonDecode(response.body) as Map<String, dynamic>;
    if (json['issuer'] != authorizationServer) {
      throw OAuthError(
        error: 'invalid_issuer',
        errorDescription: 'Metadata at $url names issuer ${json['issuer']}, not $authorizationServer',
      );
    }
    final metadata = AuthServerMetadata.fromJson(json);
    _metadata = metadata;
    return metadata;
  }
  throw lastError ??
      OAuthError(
        error: 'as_discovery_failed',
        errorDescription: 'No authorization-server metadata found for $authorizationServer',
      );
}