pub async fn fetch_as_metadata(
http: &Client,
issuer: &str,
) -> Result<AuthServerMetadata, OAuthError>Expand description
Fetch RFC 8414 authorization-server metadata. Per RFC 8414 §3.1 / RFC 8615
the well-known segment goes after the authority and before any issuer
path (https://host/tenant → https://host/.well-known/oauth-authorization-server/tenant),
not naively appended. The advertised issuer is verified to match (§3.3),
and every endpoint the AS advertises is scheme/host-guarded before we POST
secrets to it.