fix(headless-login): simplify jwks policy checks

backend/internal/handler/dev_handler_test.go

@@ -693,7 +693,8 @@ func TestCreateClient_HeadlessLoginPayloadMapping(t *testing.T) {
 	assert.Equal(t, "https://rp.example.com/.well-known/jwks.json", captured.Metadata["headless_jwks_uri"])
 	assert.True(t, captured.IsHeadlessLoginEnabled())
 	assert.Equal(t, true, captured.Metadata["headless_login_enabled"])
-	assert.Equal(t, "RS256", captured.Metadata["request_object_signing_alg"])
+	_, hasRequestObjectAlg := captured.Metadata["request_object_signing_alg"]
+	assert.False(t, hasRequestObjectAlg)
 }
 
 func TestCreateClient_HeadlessLoginRejectsInlineJWKS(t *testing.T) {
@@ -773,10 +774,11 @@ func TestUpdateClient_HeadlessLoginPayloadMapping(t *testing.T) {
 				"scope":                      "openid profile",
 				"token_endpoint_auth_method": "none",
 				"metadata": map[string]any{
-					"status":                 "active",
-					"headless_jwks":          map[string]any{"keys": []map[string]any{}},
-					"headless_jwks_uri":      "https://stale.example.com/old.json",
-					"headless_login_enabled": true,
+					"status":                     "active",
+					"headless_jwks":              map[string]any{"keys": []map[string]any{}},
+					"headless_jwks_uri":          "https://stale.example.com/old.json",
+					"headless_login_enabled":     true,
+					"request_object_signing_alg": "RS256",
 				},
 			}), nil
 		}
@@ -838,10 +840,100 @@ func TestUpdateClient_HeadlessLoginPayloadMapping(t *testing.T) {
 	assert.Equal(t, "https://rp.example.com/.well-known/jwks.json", captured.Metadata["headless_jwks_uri"])
 	_, hasInlineJWKS := captured.Metadata["headless_jwks"]
 	assert.False(t, hasInlineJWKS)
+	_, hasRequestObjectAlg := captured.Metadata["request_object_signing_alg"]
+	assert.False(t, hasRequestObjectAlg)
 	assert.True(t, captured.IsHeadlessLoginEnabled())
 	assert.Equal(t, true, captured.Metadata["headless_login_enabled"])
 }
 
+func TestUpdateClient_HeadlessLoginIgnoresExistingTopLevelJWKS(t *testing.T) {
+	var captured domain.HydraClient
+
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if r.Method == http.MethodGet && r.URL.Path == "/clients/client-headless-login" {
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"client_id":                  "client-headless-login",
+				"client_name":                "Headless Login Before",
+				"redirect_uris":              []string{"https://before.example.com/callback"},
+				"grant_types":                []string{"authorization_code", "refresh_token"},
+				"response_types":             []string{"code"},
+				"scope":                      "openid profile",
+				"token_endpoint_auth_method": "none",
+				"jwks": map[string]any{
+					"keys": []map[string]any{{
+						"kty": "RSA",
+						"alg": "RS256",
+						"n":   "AQIDBAUGBw",
+						"e":   "AQAB",
+					}},
+				},
+				"metadata": map[string]any{
+					"status":                     "active",
+					"headless_login_enabled":     true,
+					"headless_jwks_uri":          "https://stale.example.com/old.json",
+					"request_object_signing_alg": "RS256",
+				},
+			}), nil
+		}
+		if r.Method == http.MethodPut && r.URL.Path == "/clients/client-headless-login" {
+			body, err := io.ReadAll(r.Body)
+			assert.NoError(t, err)
+			err = json.Unmarshal(body, &captured)
+			assert.NoError(t, err)
+
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"client_id":                  captured.ClientID,
+				"client_name":                captured.ClientName,
+				"redirect_uris":              captured.RedirectURIs,
+				"grant_types":                captured.GrantTypes,
+				"response_types":             captured.ResponseTypes,
+				"scope":                      captured.Scope,
+				"token_endpoint_auth_method": captured.TokenEndpointAuthMethod,
+				"jwks_uri":                   captured.JWKSUri,
+				"metadata":                   captured.Metadata,
+			}), nil
+		}
+		return httpJSONAny(r, http.StatusNotFound, nil), nil
+	})
+
+	h := &DevHandler{
+		Hydra: &service.HydraAdminService{
+			AdminURL:   "http://hydra.test",
+			PublicURL:  "http://hydra.public",
+			HTTPClient: &http.Client{Transport: transport},
+		},
+		Keto: new(devMockKetoService),
+	}
+
+	app := fiber.New()
+	app.Use(func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{ID: "test-user", Role: domain.RoleSuperAdmin})
+		return c.Next()
+	})
+	app.Put("/api/v1/dev/clients/:id", h.UpdateClient)
+
+	body, _ := json.Marshal(map[string]any{
+		"name":                    "Headless Login After",
+		"type":                    "pkce",
+		"tokenEndpointAuthMethod": "private_key_jwt",
+		"jwksUri":                 "https://rp.example.com/.well-known/jwks.json",
+		"metadata": map[string]any{
+			"headless_login_enabled":     true,
+			"request_object_signing_alg": "RS256",
+		},
+	})
+	req := httptest.NewRequest(http.MethodPut, "/api/v1/dev/clients/client-headless-login", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, _ := app.Test(req, -1)
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Nil(t, captured.JWKS)
+	assert.Equal(t, "", captured.JWKSUri)
+	assert.Equal(t, "https://rp.example.com/.well-known/jwks.json", captured.Metadata["headless_jwks_uri"])
+	_, hasRequestObjectAlg := captured.Metadata["request_object_signing_alg"]
+	assert.False(t, hasRequestObjectAlg)
+}
+
 func TestRefreshHeadlessJWKSCache_ReturnsUpdatedCacheState(t *testing.T) {
 	privateKey, jwks := mustHeadlessRSAJWK(t)
 	_ = privateKey