Client ID Metadata Documents - CIMD (draft-ietf-oauth-client-id-metadata-document-01, IETF OAuth WG).

CIMD lets a client identify itself with no prior registration by using an HTTPS URL as its client_id. The authorization server dereferences that URL to fetch a JSON client metadata document - the RFC 7591 Dynamic Client Registration metadata field set - and uses it as the client.

This module is the pure, conn-free, HTTP-free half of that feature: it decides whether a client_id is a CIMD URL (client_id_url?/1), validates the URL against the draft §2 grammar (validate_client_id/1), and validates a fetched document against the draft §2 content rules, normalizing it into the client shape attesto's resolution expects (validate_document/2). The load-bearing network half - the SSRF-guarded GET, redirect refusal, size cap, and caching - lives in the Phoenix layer; this module never touches a socket and pulls in no dependencies, the same discipline as Attesto.AuthorizationRequest.

URL grammar (draft §2)

A CIMD client_id MUST:

• use the https scheme;
• have a path component;
• NOT contain a fragment;
• NOT contain userinfo (a user:password@ component);
• NOT contain single-dot (.) or double-dot (..) path segments.

Ports are allowed; a query is discouraged but allowed. A client_id that is not a binary, or does not parse as a URL, is not a CIMD client_id - it is an opaque identifier the host resolves through its own registry.

Document content (draft §2)

The fetched document's fields are the OAuth Dynamic Client Registration Metadata registry values (RFC 7591 §2). On top of that field set the draft requires:

• a client_id member equal to the URL by simple string comparison (mismatch -> {:error, :client_id_mismatch});
• NO shared symmetric secret: client_secret / client_secret_expires_at MUST NOT be present ({:error, :symmetric_secret}), and token_endpoint_auth_method MUST NOT be one of client_secret_basic, client_secret_post, or client_secret_jwt ({:error, :symmetric_auth_method}) - a CIMD client authenticates as a public client (none + PKCE) or with private_key_jwt.

RFC 9700 requires registered redirect URIs, so a CIMD document MUST carry a non-empty redirect_uris array of strings ({:error, :invalid_redirect_uris} otherwise).

Normalized client shape

validate_document/2 returns a string-keyed map carrying the RFC 7591 §2 client-metadata members the document supplied (client_id, redirect_uris, and any of grant_types, response_types, scope, jwks, jwks_uri, client_name, client_uri, logo_uri, token_endpoint_auth_method, contacts). The shape matches the validated metadata the RFC 7591 registration path persists, so a CIMD client is consumed downstream (scope resolution, redirect match, JARM, DPoP) exactly like a registered one. Absent members are omitted rather than rendered as nil; an out-of-shape member (e.g. a redirect_uris that is not a list of strings) is a validation error, never silently dropped.