------------------------------------------------------------------
== OpenID Connect discovery: GET /.well-known/openid-configuration
------------------------------------------------------------------
$ curl -s http://localhost:9000/.well-known/openid-configuration
{
    "issuer": "http://localhost:9000",
    "authorization_endpoint": "http://localhost:9000/oauth2/authorize",
    "token_endpoint": "http://localhost:9000/oauth2/token",
    "token_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post",
        "client_secret_jwt",
        "private_key_jwt",
        "tls_client_auth",
        "self_signed_tls_client_auth"
    ],
    "jwks_uri": "http://localhost:9000/oauth2/jwks",
    "userinfo_endpoint": "http://localhost:9000/userinfo",
    "end_session_endpoint": "http://localhost:9000/connect/logout",
    "response_types_supported": [
        "code"
    ],
    "grant_types_supported": [
        "authorization_code",
        "client_credentials",
        "refresh_token",
        "urn:ietf:params:oauth:grant-type:token-exchange"
    ],
    "revocation_endpoint": "http://localhost:9000/oauth2/revoke",
    "revocation_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post",
        "client_secret_jwt",
        "private_key_jwt",
        "tls_client_auth",
        "self_signed_tls_client_auth"
    ],
    "introspection_endpoint": "http://localhost:9000/oauth2/introspect",
    "introspection_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post",
        "client_secret_jwt",
        "private_key_jwt",
        "tls_client_auth",
        "self_signed_tls_client_auth"
    ],
    "code_challenge_methods_supported": [
        "S256"
    ],
    "tls_client_certificate_bound_access_tokens": true,
    "dpop_signing_alg_values_supported": [
        "RS256",
        "RS384",
        "RS512",
        "PS256",
        "PS384",
        "PS512",
        "ES256",
        "ES384",
        "ES512"
    ],
    "subject_types_supported": [
        "public"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "scopes_supported": [
        "openid"
    ]
}

------------------------------------------------------------------
== OAuth2 metadata: GET /.well-known/oauth-authorization-server
------------------------------------------------------------------
Present even with .oidc(...) switched off. The OIDC document above is the one
that additionally advertises userinfo_endpoint and id_token signing algorithms.
$ curl -s http://localhost:9000/.well-known/oauth-authorization-server
{
    "issuer": "http://localhost:9000",
    "authorization_endpoint": "http://localhost:9000/oauth2/authorize",
    "token_endpoint": "http://localhost:9000/oauth2/token",
    "token_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post",
        "client_secret_jwt",
        "private_key_jwt",
        "tls_client_auth",
        "self_signed_tls_client_auth"
    ],
    "jwks_uri": "http://localhost:9000/oauth2/jwks",
    "response_types_supported": [
        "code"
    ],
    "grant_types_supported": [
        "authorization_code",
        "client_credentials",
        "refresh_token",
        "urn:ietf:params:oauth:grant-type:token-exchange"
    ],
    "revocation_endpoint": "http://localhost:9000/oauth2/revoke",
    "revocation_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post",
        "client_secret_jwt",
        "private_key_jwt",
        "tls_client_auth",
        "self_signed_tls_client_auth"
    ],
    "introspection_endpoint": "http://localhost:9000/oauth2/introspect",
    "introspection_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post",
        "client_secret_jwt",
        "private_key_jwt",
        "tls_client_auth",
        "self_signed_tls_client_auth"
    ],
    "code_challenge_methods_supported": [
        "S256"
    ],
    "tls_client_certificate_bound_access_tokens": true,
    "dpop_signing_alg_values_supported": [
        "RS256",
        "RS384",
        "RS512",
        "PS256",
        "PS384",
        "PS512",
        "ES256",
        "ES384",
        "ES512"
    ]
}

------------------------------------------------------------------
== JWK Set: GET /oauth2/jwks
------------------------------------------------------------------
Public keys only. No 'd' member - if you ever see one here, stop the server.
{
    "keys": [
        {
            "kty": "RSA",
            "e": "AQAB",
            "kid": "262bd550-3657-46c4-bafc-cce4c6f4e0cb",
            "n": "pFCIstpVnGQm7Mp8bskE_-_Rz-oI6mPaiyQLiWMBuVip4fkKYwapZVbsZf9fmy1w1KXWIdtXOhe-fqa3-KqYzsrje-o2u6_D27rqR1Z0I9ezbDfw2A4Gsj5AlmnXzWMLnNMzSueSf8luRk04MHO4bGzXLqQ1gOltnqMkMAQzhCqWFZmKxNJeaB4FlXOtxqzcso0eeKsPzRjZvTamgU5TvGUZmQ4LTKTkoYzB3kjvCspVpZAbdVR01RlmzfTJB0tVIc0ioMk1YZHUx27TPN1W8Nw1AaAYmV9URaf2fgz2Ja3y_Lj8hmXuQAcPOGBmoVWX0QkW4DTSAPW0xiPHqpjw9Q"
        }
    ]
}

------------------------------------------------------------------
== Resolved endpoint settings, read back from AuthorizationServerSettings
------------------------------------------------------------------
{
    "settings.authorization-server.client-registration-endpoint": "/oauth2/register",
    "settings.authorization-server.authorization-endpoint": "/oauth2/authorize",
    "settings.authorization-server.token-endpoint": "/oauth2/token",
    "settings.authorization-server.device-verification-endpoint": "/oauth2/device_verification",
    "settings.authorization-server.oidc-user-info-endpoint": "/userinfo",
    "settings.authorization-server.pushed-authorization-request-endpoint": "/oauth2/par",
    "settings.authorization-server.oidc-client-registration-endpoint": "/connect/register",
    "settings.authorization-server.oidc-logout-endpoint": "/connect/logout",
    "settings.authorization-server.issuer": "http://localhost:9000",
    "settings.authorization-server.multiple-issuers-allowed": false,
    "settings.authorization-server.device-authorization-endpoint": "/oauth2/device_authorization",
    "settings.authorization-server.jwk-set-endpoint": "/oauth2/jwks",
    "settings.authorization-server.token-revocation-endpoint": "/oauth2/revoke",
    "settings.authorization-server.token-introspection-endpoint": "/oauth2/introspect"
}

------------------------------------------------------------------
== Registered clients, as the server actually holds them
------------------------------------------------------------------
[
    {
        "clientId": "demo-web",
        "authenticationMethods": [
            "client_secret_basic"
        ],
        "grantTypes": [
            "refresh_token",
            "authorization_code"
        ],
        "redirectUris": [
            "http://127.0.0.1:8080/login/oauth2/code/demo-web"
        ],
        "scopes": [
            "orders.write",
            "openid",
            "profile",
            "orders.read"
        ],
        "requireProofKey": true,
        "requireAuthorizationConsent": true,
        "accessTokenFormat": "self-contained",
        "accessTokenTtlSeconds": 300,
        "reuseRefreshTokens": false
    },
    {
        "clientId": "demo-spa",
        "authenticationMethods": [
            "none"
        ],
        "grantTypes": [
            "refresh_token",
            "authorization_code"
        ],
        "redirectUris": [
            "http://127.0.0.1:8080/authorized"
        ],
        "scopes": [
            "openid",
            "orders.read"
        ],
        "requireProofKey": true,
        "requireAuthorizationConsent": true,
        "accessTokenFormat": "self-contained",
        "accessTokenTtlSeconds": 300,
        "reuseRefreshTokens": true
    },
    {
        "clientId": "demo-service",
        "authenticationMethods": [
            "client_secret_basic"
        ],
        "grantTypes": [
            "client_credentials"
        ],
        "redirectUris": [],
        "scopes": [
            "orders.read"
        ],
        "requireProofKey": true,
        "requireAuthorizationConsent": false,
        "accessTokenFormat": "self-contained",
        "accessTokenTtlSeconds": 600,
        "reuseRefreshTokens": true
    }
]