- config.ts: resolve authorize/token/userinfo/end-session/jwks endpoints from
the issuer's OIDC discovery document (cached per session) instead of
hardcoding the production host; non-default issuers now resolve all
endpoints from their own discovery document, and discovery failures surface
a clear ConfigError with no silent fallback.
- auth/oidc.ts: all flows (buildAuthorizeUrl, handleCallback,
refreshAccessToken, logout) resolve endpoints via discovery; logout is now
async.
- AppRoutes.tsx: remove the dead response.status === 403 branch in probeApi
(apiFetch already throws ApiForbiddenError) and surface ConfigError as the
configuration error screen.
- api/client.ts: post-refresh retry maps only 401 to ApiUnauthorizedError and
preserves other statuses (e.g. 500) on the returned response.
Tests: add discovery resolution tests (config.test.ts), discovery-based
authorize URL test (oidc.test.ts), and retry-500 labeling test
(client.test.ts); adapt logout test to the async signature.
overseer
dev_agent