oauth url nonsense

crates/jacquard-oauth/src/client.rs

···
                 let client_data = ClientSessionData {
                     account_did: token_set.sub.clone(),
                     session_id: auth_req_info.state,
-                    host_url: token_set.iss.clone(),
+                    host_url: token_set.aud.clone(),
                     authserver_url: auth_req_info.authserver_url.to_cowstr(),
                     authserver_token_endpoint: auth_req_info.authserver_token_endpoint,
                     authserver_revocation_endpoint: auth_req_info.authserver_revocation_endpoint,
···
                     },
                     token_set,
                 };
+
+                dbg!(&client_data);
 
                 self.create_session(client_data).await
             }

crates/jacquard-oauth/src/request.rs

···
         };
         let auth_req_data = AuthRequestData {
             state,
-            authserver_url: url::Url::parse(&metadata.server_metadata.issuer)
-                .expect("Failed to parse issuer URL"),
+            authserver_url: metadata.server_metadata.issuer.clone(),
             account_did: None,
             scopes,
             request_uri: par_response.request_uri.to_cowstr().into_static(),

crates/jacquard-oauth/src/resolver.rs

···
         .await
         .map_err(|e| ResolverError::transport(e))?;
     if res.status() == StatusCode::OK {
-        let mut metadata = serde_json::from_slice::<OAuthAuthorizationServerMetadata>(res.body())?;
+        let metadata = serde_json::from_slice::<OAuthAuthorizationServerMetadata>(res.body())?;
         // https://datatracker.ietf.org/doc/html/rfc8414#section-3.3
         // Accept semantically equivalent issuer (normalize to the requested URL form)
         if issuer_equivalent(&metadata.issuer, server.as_str()) {
-            metadata.issuer = server.as_str().into();
+            // if equivalent, keep the canonical form
             Ok(metadata.into_static())
         } else {
             Err(ResolverError::authorization_server_metadata(
···
         .await
         .map_err(|e| ResolverError::transport(e))?;
     if res.status() == StatusCode::OK {
-        let mut metadata = serde_json::from_slice::<OAuthProtectedResourceMetadata>(res.body())?;
+        let metadata = serde_json::from_slice::<OAuthProtectedResourceMetadata>(res.body())?;
         // https://datatracker.ietf.org/doc/html/rfc8414#section-3.3
         // Accept semantically equivalent resource URL (normalize to the requested URL form)
         if issuer_equivalent(&metadata.resource, server.as_str()) {
-            metadata.resource = server.as_str().into();
+            // if equivalent, keep the canonical form
             Ok(metadata.into_static())
         } else {
             Err(ResolverError::authorization_server_metadata(

crates/jacquard-oauth/src/session.rs

···
 use serde::{Deserialize, Serialize};
 use smol_str::{SmolStr, format_smolstr};
 use tokio::sync::Mutex;
-use url::Url;
 
 pub trait DpopDataSource {
     fn key(&self) -> &Key;
···
     pub state: CowStr<'s>,
 
     // URL of the auth server (eg, PDS or entryway)
-    pub authserver_url: Url,
+    pub authserver_url: CowStr<'s>,
 
     // If the flow started with an account identifier (DID or handle), it should be persisted, to verify against the initial token response.
     #[serde(skip_serializing_if = "std::option::Option::is_none")]
···
             pkce_verifier: self.pkce_verifier.into_static(),
             dpop_data: self.dpop_data.into_static(),
             state: self.state.into_static(),
-            authserver_url: self.authserver_url,
+            authserver_url: self.authserver_url.into_static(),
             account_did: self.account_did.into_static(),
             scopes: self.scopes.into_static(),
         }

crates/jacquard/src/client/token.rs

···
     pub dpop_authserver_nonce: Option<String>,
 }
 
-impl From<AuthRequestData<'_>> for OAuthState {
-    fn from(value: AuthRequestData) -> Self {
-        OAuthState {
-            authserver_url: value.authserver_url,
+impl TryFrom<AuthRequestData<'_>> for OAuthState {
+    type Error = url::ParseError;
+
+    fn try_from(value: AuthRequestData) -> Result<Self, Self::Error> {
+        Ok(OAuthState {
+            authserver_url: Url::parse(&value.authserver_url)?,
             account_did: value.account_did.map(|s| s.to_string()),
             scopes: value.scopes.into_iter().map(|s| s.to_string()).collect(),
             request_uri: value.request_uri.to_string(),
···
             dpop_key: value.dpop_data.dpop_key,
             dpop_authserver_nonce: value.dpop_data.dpop_authserver_nonce.map(|s| s.to_string()),
             state: value.state.to_string(),
-        }
+        })
     }
 }
 
 impl From<OAuthState> for AuthRequestData<'_> {
     fn from(value: OAuthState) -> Self {
         AuthRequestData {
-            authserver_url: value.authserver_url,
+            authserver_url: value.authserver_url.to_cowstr(),
             state: value.state.to_cowstr(),
             account_did: value.account_did.map(|s| Did::from(s).into_static()),
             authserver_revocation_endpoint: value
···
         auth_req_info: &AuthRequestData<'_>,
     ) -> Result<(), SessionStoreError> {
         let key = format!("authreq_{}", auth_req_info.state);
-        self.0
-            .set(key, StoredSession::OAuthState(auth_req_info.clone().into()))
-            .await?;
+        let state = auth_req_info
+            .clone()
+            .try_into()
+            .map_err(|e: url::ParseError| SessionStoreError::Other(Box::new(e)))?;
+        self.0.set(key, StoredSession::OAuthState(state)).await?;
         Ok(())
     }