fix(auth): separate pkce and headless trusted rp config

backend/internal/domain/hydra_models.go

@@ -1,6 +1,16 @@
 package domain
 
-import "time"
+import (
+	"strings"
+	"time"
+)
+
+const (
+	MetadataHeadlessLoginEnabled            = "headless_login_enabled"
+	MetadataHeadlessTokenEndpointAuthMethod = "headless_token_endpoint_auth_method"
+	MetadataHeadlessJWKSURI                 = "headless_jwks_uri"
+	MetadataHeadlessJWKS                    = "headless_jwks"
+)
 
 type HydraClient struct {
 	ClientID                string                 `json:"client_id"`
@@ -20,11 +30,42 @@ type HydraClient struct {
 func (c *HydraClient) IsTrustedRP() bool {
 	// A Trusted RP must have a public key registered (URI or Inline)
 	// and use private_key_jwt for token endpoint authentication.
-	hasPublicKey := c.JWKSUri != "" || c.JWKS != nil
-	isPrivateKeyJwt := c.TokenEndpointAuthMethod == "private_key_jwt"
+	hasPublicKey := c.HeadlessJWKSURI() != "" || c.HeadlessJWKS() != nil
+	isPrivateKeyJwt := c.HeadlessTokenEndpointAuthMethod() == "private_key_jwt"
 	return hasPublicKey && isPrivateKeyJwt
 }
 
+func (c *HydraClient) HeadlessTokenEndpointAuthMethod() string {
+	if c.Metadata != nil {
+		if raw, ok := c.Metadata[MetadataHeadlessTokenEndpointAuthMethod].(string); ok {
+			if value := strings.TrimSpace(raw); value != "" {
+				return value
+			}
+		}
+	}
+	return strings.TrimSpace(c.TokenEndpointAuthMethod)
+}
+
+func (c *HydraClient) HeadlessJWKSURI() string {
+	if c.Metadata != nil {
+		if raw, ok := c.Metadata[MetadataHeadlessJWKSURI].(string); ok {
+			if value := strings.TrimSpace(raw); value != "" {
+				return value
+			}
+		}
+	}
+	return strings.TrimSpace(c.JWKSUri)
+}
+
+func (c *HydraClient) HeadlessJWKS() interface{} {
+	if c.Metadata != nil {
+		if value, ok := c.Metadata[MetadataHeadlessJWKS]; ok && value != nil {
+			return value
+		}
+	}
+	return c.JWKS
+}
+
 func (c *HydraClient) IsHeadlessLoginEnabled() bool {
 	if !c.IsTrustedRP() {
 		return false
@@ -32,7 +73,7 @@ func (c *HydraClient) IsHeadlessLoginEnabled() bool {
 	if c.Metadata == nil {
 		return false
 	}
-	val, ok := c.Metadata["headless_login_enabled"]
+	val, ok := c.Metadata[MetadataHeadlessLoginEnabled]
 	if !ok {
 		return false
 	}