fix(auth): separate pkce and headless trusted rp config

backend/internal/handler/dev_handler.go

@@ -891,6 +891,13 @@ func (h *DevHandler) CreateClient(c *fiber.Ctx) error {
 			tokenAuthMethod = "client_secret_basic"
 		}
 	}
+	tokenAuthMethod, jwksURI, jwks, metadata := normalizeHeadlessClientConfig(
+		clientType,
+		tokenAuthMethod,
+		valueOr(req.JwksUri, ""),
+		req.Jwks,
+		metadata,
+	)
 
 	clientReq := domain.HydraClient{
 		ClientID:                clientID,
@@ -900,8 +907,8 @@ func (h *DevHandler) CreateClient(c *fiber.Ctx) error {
 		ResponseTypes:           responseTypes,
 		Scope:                   strings.Join(scopes, " "),
 		TokenEndpointAuthMethod: tokenAuthMethod,
-		JWKSUri:                 valueOr(req.JwksUri, ""),
-		JWKS:                    req.Jwks,
+		JWKSUri:                 jwksURI,
+		JWKS:                    jwks,
 		Metadata:                metadata,
 	}
 
@@ -1044,6 +1051,23 @@ func (h *DevHandler) UpdateClient(c *fiber.Ctx) error {
 		}
 		metadata["status"] = status
 	}
+	resolvedClientType := currentSummary.Type
+	if clientType != "" {
+		resolvedClientType = clientType
+	}
+	resolvedTokenAuthMethod := resolveTokenAuthMethod(tokenAuthMethod, current.TokenEndpointAuthMethod)
+	resolvedJWKSURI := valueOr(req.JwksUri, current.JWKSUri)
+	resolvedJWKS := req.Jwks
+	if req.Jwks == nil {
+		resolvedJWKS = current.JWKS
+	}
+	resolvedTokenAuthMethod, resolvedJWKSURI, resolvedJWKS, metadata = normalizeHeadlessClientConfig(
+		resolvedClientType,
+		resolvedTokenAuthMethod,
+		resolvedJWKSURI,
+		resolvedJWKS,
+		metadata,
+	)
 
 	updated := domain.HydraClient{
 		ClientID:                current.ClientID,
@@ -1052,14 +1076,11 @@ func (h *DevHandler) UpdateClient(c *fiber.Ctx) error {
 		GrantTypes:              derefSlice(req.GrantTypes, current.GrantTypes),
 		ResponseTypes:           derefSlice(req.ResponseTypes, current.ResponseTypes),
 		Scope:                   buildScope(valueOrSlice(req.Scopes, strings.Fields(current.Scope))),
-		TokenEndpointAuthMethod: resolveTokenAuthMethod(tokenAuthMethod, current.TokenEndpointAuthMethod),
-		JWKSUri:                 valueOr(req.JwksUri, current.JWKSUri),
-		JWKS:                    req.Jwks,
+		TokenEndpointAuthMethod: resolvedTokenAuthMethod,
+		JWKSUri:                 resolvedJWKSURI,
+		JWKS:                    resolvedJWKS,
 		Metadata:                metadata,
 	}
-	if req.Jwks == nil {
-		updated.JWKS = current.JWKS
-	}
 	if err := validateReservedSystemClientName(updated.ClientID, updated.ClientName); err != nil {
 		return errorJSON(c, fiber.StatusForbidden, err.Error())
 	}
@@ -1676,6 +1697,70 @@ func (h *DevHandler) mapClientSummary(client domain.HydraClient) clientSummary {
 	}
 }
 
+func readMetadataStringValue(metadata map[string]interface{}, key string) string {
+	if metadata == nil {
+		return ""
+	}
+	raw, _ := metadata[key].(string)
+	return strings.TrimSpace(raw)
+}
+
+func readMetadataBoolValue(metadata map[string]interface{}, key string) bool {
+	if metadata == nil {
+		return false
+	}
+	value, _ := metadata[key].(bool)
+	return value
+}
+
+func normalizeHeadlessClientConfig(
+	clientType string,
+	tokenAuthMethod string,
+	jwksURI string,
+	jwks interface{},
+	metadata map[string]interface{},
+) (string, string, interface{}, map[string]interface{}) {
+	if metadata == nil {
+		metadata = map[string]interface{}{}
+	}
+
+	headlessEnabled := readMetadataBoolValue(metadata, domain.MetadataHeadlessLoginEnabled)
+	if clientType == "pkce" && headlessEnabled {
+		headlessTokenAuthMethod := readMetadataStringValue(metadata, domain.MetadataHeadlessTokenEndpointAuthMethod)
+		if headlessTokenAuthMethod == "" && !strings.EqualFold(strings.TrimSpace(tokenAuthMethod), "none") {
+			headlessTokenAuthMethod = strings.TrimSpace(tokenAuthMethod)
+		}
+		if headlessTokenAuthMethod == "" {
+			headlessTokenAuthMethod = "private_key_jwt"
+		}
+		metadata[domain.MetadataHeadlessTokenEndpointAuthMethod] = headlessTokenAuthMethod
+
+		headlessJWKSURI := readMetadataStringValue(metadata, domain.MetadataHeadlessJWKSURI)
+		if headlessJWKSURI == "" && strings.TrimSpace(jwksURI) != "" {
+			headlessJWKSURI = strings.TrimSpace(jwksURI)
+		}
+		if headlessJWKSURI != "" {
+			metadata[domain.MetadataHeadlessJWKSURI] = headlessJWKSURI
+		} else {
+			delete(metadata, domain.MetadataHeadlessJWKSURI)
+		}
+
+		if _, ok := metadata[domain.MetadataHeadlessJWKS]; !ok && jwks != nil {
+			metadata[domain.MetadataHeadlessJWKS] = jwks
+		}
+		if metadata[domain.MetadataHeadlessJWKS] == nil {
+			delete(metadata, domain.MetadataHeadlessJWKS)
+		}
+
+		return "none", "", nil, metadata
+	}
+
+	delete(metadata, domain.MetadataHeadlessTokenEndpointAuthMethod)
+	delete(metadata, domain.MetadataHeadlessJWKSURI)
+	delete(metadata, domain.MetadataHeadlessJWKS)
+	return tokenAuthMethod, jwksURI, jwks, metadata
+}
+
 func defaultClientScopes() []string {
 	return []string{"openid", "profile", "email"}
 }