feat: support Client ID Metadata Document (CIMD) for OAuth (#8550)

crates/goose/src/oauth/mod.rs

@@ -17,6 +17,7 @@ use tracing::warn;
 use crate::oauth::persist::GooseCredentialStore;
 
 const CALLBACK_TEMPLATE: &str = include_str!("oauth_callback.html");
+const CLIENT_METADATA_URL: &str = "https://goose-docs.ai/oauth/client-metadata.json";
 
 #[derive(Clone)]
 struct AppState {
@@ -79,9 +80,14 @@ pub async fn oauth_flow(
 
     let mut oauth_state = OAuthState::new(mcp_server_url, None).await?;
 
-    let redirect_uri = format!("http://localhost:{}/oauth_callback", used_addr.port());
+    let redirect_uri = format!("http://127.0.0.1:{}/oauth_callback", used_addr.port());
     oauth_state
-        .start_authorization(&[], redirect_uri.as_str(), Some("goose"))
+        .start_authorization_with_metadata_url(
+            &[],
+            redirect_uri.as_str(),
+            Some("goose"),
+            Some(CLIENT_METADATA_URL),
+        )
         .await?;
 
     let authorization_url = oauth_state.get_authorization_url().await?;

documentation/static/oauth/client-metadata.json

@@ -0,0 +1,12 @@
+{
+  "client_id": "https://goose-docs.ai/oauth/client-metadata.json",
+  "client_name": "goose",
+  "redirect_uris": [
+    "http://127.0.0.1/oauth_callback",
+    "http://[::1]/oauth_callback"
+  ],
+  "grant_types": ["authorization_code", "refresh_token"],
+  "response_types": ["code"],
+  "token_endpoint_auth_method": "none",
+  "code_challenge_methods_supported": ["S256"]
+}