adds an "issuer_secret" to config.auth that lets the issuer persist tokens
between continuwuity restarts

@@ -0,0 +13,4 @@
+/// A Web response that can be processed by the OIDC authentication flow before
+/// being sent over.
+#[derive(Default, Clone, Debug)]
+pub struct OidcResponse {

@@ -58,6 +58,10 @@
 #
 #port = 8008
 
+# This item is undocumented. Please contribute documentation for it.

@@ -0,0 +77,4 @@
+/// Authorize the device based on the user's consent. If the user allows
+/// it to access their data, the client may request a token at the
+/// [super::token::token] endpoint.
+pub(crate) async fn authorize_consent(

@@ -0,0 +34,4 @@
+		http::StatusCode::NOT_FOUND,
+		ClientErrorBody::Standard {
+			kind: ClientErrorKind::Unrecognized,
+			message: "This homeserver doesn't do OIDC authentication.".to_owned(),

@@ -0,0 +71,4 @@
+				.unwrap(),
+		),
+		revocation_endpoint: issuer
+			.join("_matrix/client/unstable/org.matrix.msc2964/revoke")

@@ -117,6 +117,21 @@ pub fn build(router: Router<State>, server: &Server) -> Router<State> {
 		.ruma_route(&client::get_protocols_route)
 		.route("/_matrix/client/unstable/thirdparty/protocols",
 			get(client::get_protocols_route_unstable))
+		// MSC2965 route.

@@ -274,0 +275,4 @@
+		if auth.enable_oidc_login && config.well_known.client.is_none() {
+			return Err!(Config(
+				"auth.enable_oidc_login",
+				"Oidc authentication is enabled but the well-known client is not set."

@@ -1882,0 +1892,4 @@
+	/// The URL where the user is able to access the account management
+	/// capabilities of the homeserver. Only used if `enable_oidc_login` is set.
+	/// Unset by default.
+	pub enable_oidc_account_management: bool,

@@ -111,6 +111,7 @@ webpage.workspace = true
 webpage.optional = true
 blurhash.workspace = true
 blurhash.optional = true
+oxide-auth.workspace = true

@@ -0,0 +48,4 @@
+	pub fn preconfigured() -> Self {
+		Self {
+			registrar: Mutex::new(
+				vec![Client::public(

@@ -118,2 +118,4 @@
 		.route("/_matrix/client/unstable/thirdparty/protocols",
 			get(client::get_protocols_route_unstable))
+		// MSC2965: OAuth 2.0 Authorization Server Metadata discovery.
+		.route("/_matrix/client/unstable/org.matrix.msc2965/auth_metadata",

@@ -0,0 +9,4 @@
+	pub redirect_uri: Url,
+	pub scope: String,
+	pub state: String,
+	pub code_challenge: String,

@@ -107,0 +107,4 @@
+	// external structure; separate section
+	pub auth: Option<AuthConfig>,
+
+	/// The UNIX socket conduwuit will listen on.

@@ -0,0 +32,4 @@
+	fn try_from(value: OidcRequest) -> Result<Self, LoginError> {
+		let body = value.body().expect("body in OidcRequest");
+
+		let Some(username) = body.unique_value("username") else {

@@ -436,1 +436,4 @@
 	},
+    Descriptor {
+        name: "client_registrar",
+        ..descriptor::RANDOM