fix(RFC8414): strip any terminating "/" when pathname is present

Author: panva

src/index.ts

@@ -1206,7 +1206,7 @@ function prependWellKnown(url: URL, wellKnown: string) {
   if (url.pathname === '/') {
     url.pathname = wellKnown
   } else {
-    url.pathname = replaceDoubleSlash(`${wellKnown}/${url.pathname}`)
+    url.pathname = replaceDoubleSlash(`${wellKnown}/${url.pathname.replace(/(\/)$/, '')}`)
   }
   return url
 }

test/discovery.test.ts

@@ -96,6 +96,20 @@ test('discoveryRequest() - oauth2 with a pathname', async (t) => {
   t.pass()
 })
 
+test('discoveryRequest() - oauth2 with a pathname and issuer terminating "/"', async (t) => {
+  const data = { issuer: 'https://op.example.com/path/' }
+  t.context
+    .intercept({
+      path: '/.well-known/oauth-authorization-server/path',
+      method: 'GET',
+    })
+    .reply(200, data)
+
+  const url = new URL(data.issuer)
+  await lib.discoveryRequest(url, { algorithm: 'oauth2' })
+  t.pass()
+})
+
 test('processDiscoveryResponse()', async (t) => {
   const expected = new URL('https://op.example.com')