Add support for ID-JAG authorization grant profile in OIDC metadata

[sajitha-tj]

Purpose

Advertise support for the Identity Assertion JWT Authorization Grant (ID-JAG) profile in the OIDC discovery metadata when the JWT Bearer grant type is enabled.

Approach

Adds a new authorization_grant_profiles_supported field to the OIDC provider metadata. The discovery service populates it with urn:ietf:params:oauth:grant-profile:id-jag whenever the JWT Bearer grant type is among the supported grant types; the field is omitted entirely when it isn't.

Related Issues

• Advertise ID-JAG discovery metadata in the well-known documents #4663

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
  • Ran Vale and fixed all errors and warnings
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

New Features

• OIDC and OAuth 2.0 discovery metadata now advertises supported authorization grant profiles.
• The Identity Assertion JWT Authorization Grant profile is advertised when JWT Bearer grants are enabled.
• Added the optional authorization_grant_profiles_supported discovery field, which is omitted when unsupported.

Documentation

• Updated discovery API documentation and examples to include the supported authorization grant profiles field.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8b2097a9-016d-47ff-b0fb-940de1b597b2

📥 Commits

Reviewing files that changed from the base of the PR and between 3a8f60b and 1a70151.

📒 Files selected for processing (1)

• backend/internal/oauth/oauth2/discovery/discovery_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• backend/internal/oauth/oauth2/discovery/discovery_test.go

---

📝 Walkthrough

Walkthrough

OIDC and OAuth 2.0 discovery metadata now include the ID-JAG authorization grant profile when JWT Bearer is supported. The metadata model, API schema, service logic, constant, and endpoint tests cover supported and unsupported configurations.

Changes

ID-JAG discovery support

Layer / File(s)	Summary
Metadata contract and profile advertising backend/internal/oauth/oauth2/constants/constants.go, backend/internal/oauth/oauth2/discovery/model.go, backend/internal/oauth/oauth2/discovery/service.go, api/discovery.yaml	Adds the ID-JAG profile constant and the optional authorization_grant_profiles_supported field. The discovery service advertises the profile only when JWT Bearer is supported. The API schema and examples define the field.
Discovery behavior validation backend/internal/oauth/oauth2/discovery/discovery_test.go	Tests profile inclusion, omission when JWT Bearer is disabled, JSON serialization, and OIDC and OAuth 2.0 endpoint exposure.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related issues

• Advertise ID-JAG discovery metadata in the well-known documents #4663 — Directly covers ID-JAG discovery metadata across the model, service, tests, and API schema.

Possibly related PRs

• thunder-id/thunderid#3893 — Modifies OAuth 2.0 discovery metadata for ID-JAG profile advertising.
• thunder-id/thunderid#4296 — Changes related OAuth discovery service and supported grant metadata.

Suggested reviewers: thamindudilshan, thiva-k

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: adding ID-JAG authorization grant profile support in OIDC metadata.
Description check	✅ Passed	The description covers the purpose, approach, issue, tests, and security checks, but it leaves manual testing, documentation, and integration testing unchecked.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!