normalize issuer as a sanity check

Inexperienced devs/users may not know whether to include a final
slash (/) at the end of their issuer field in their metadata endpoint.
Also, it seems some OIDC/OAuth modules may require there to NOT
be a final slash (/) at the end of the issuer.

This change is intended to make it less error prone overall.

Author: carrvo

src/IndieAuth/Client.php

@@ -535,7 +535,7 @@ public static function validateIssuerMatch($params, $expected_issuer = '') {
       return new ErrorResponse('missing_iss', 'The authorization server did not return the iss parameter');
     }
 
-    if ($params['iss'] !== $expected_issuer) {
+    if (self::normalizeMeURL($params['iss']) !== self::normalizeMeURL($expected_issuer)) {
       return new ErrorResponse('invalid_iss', 'The authorization server returned an invalid iss parameter');
     }
   }

tests/ClientTest.php

@@ -75,6 +75,14 @@ public function testValidateIssuer()
     $this->assertNull($response);
   }
 
+  public function testValidateIssuerNormalizes()
+  {
+    $expected_issuer = 'https://issuer.example.com';
+    $params = ['iss' => $expected_issuer];
+    $response = Client::validateIssuerMatch($params, $expected_issuer.'/');
+    $this->assertNull($response);
+  }
+
   public function testValidateIssuerMissing()
   {
     $expected_issuer = 'https://issuer.example.com/';