Add CIMD storage decorator for embedded AS

[amirejaz]

Summary

Phase 2 PR 2 of CIMD embedded AS support — depends on PR #5320 (merged).

The embedded authorization server currently requires clients to call /oauth/register (DCR) before the authorization flow. With this PR, clients can present an HTTPS URL as client_id and the server fetches and validates the CIMD document on demand, with no prior registration.

• CIMDStorageDecorator wraps storage.Storage, overrides only GetClient, and delegates all other methods transparently. When fosite calls GetClient("https://vscode.dev/oauth/client-metadata.json"), the decorator fetches the document via pkg/oauthproto/cimd.FetchClientMetadataDocument, builds a fosite.Client, caches it with a configurable TTL via hashicorp/golang-lru/v2, and deduplicates concurrent fetches for the same URL via singleflight.
• Unwrap() exposes the underlying storage so the DCRCredentialStore and RedisStorage type assertions in server_impl.go still reach the concrete backend through the decorator layer.
• runLegacyMigration helper extracted from newServer to keep cyclomatic complexity under the lint limit after the Unwrap additions.

Type of change

• New feature (non-breaking)

Test plan

• Unit tests: go test ./pkg/authserver/storage/... — all pass including cache hit/miss, singleflight deduplication, TTL expiry, Unwrap, disabled path, DCR client unaffected
• Full authserver suite: go test ./pkg/authserver/... — 13 packages pass

Special notes for reviewers

• NewCIMDStorageDecorator returns base unchanged when enabled=false — no allocation, no behavior change for existing deployments
• LoopbackClient wraps clients whose redirect_uris contain loopback addresses, enabling RFC 8252 §7.3 dynamic port matching for native app clients

Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 86.11111% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.77%. Comparing base (391f4f2) to head (52fe1dd).

Files with missing lines	Patch %	Lines
pkg/authserver/storage/cimd_decorator.go	90.36%	4 Missing and 4 partials ⚠️
pkg/authserver/server_impl.go	63.15%	4 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5343      +/-   ##
==========================================
+ Coverage   68.72%   68.77%   +0.04%     
==========================================
  Files         625      626       +1     
  Lines       63422    63520      +98     
==========================================
+ Hits        43588    43687      +99     
+ Misses      16585    16580       -5     
- Partials     3249     3253       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Large PR Detected

This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.

How to unblock this PR:

Add a section to your PR description with the following format:

## Large PR Justification

[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformation

Alternative:

Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.

See our Contributing Guidelines for more details.

---

This review will be automatically dismissed once you add the justification section.

PR size has been reduced below the XL threshold. Thank you for splitting this up!

[github-actions]

✅ PR size has been reduced below the XL threshold. The size review has been dismissed and this PR can now proceed with normal review. Thank you for splitting this up!

[Copilot]

Pull request overview

Adds a storage-layer decorator to enable CIMD (Client ID Metadata Document) client resolution for the embedded authorization server, allowing client_id values that are HTTPS URLs to be fetched/validated on-demand instead of requiring pre-registration via DCR.

Changes:

• Introduces CIMDStorageDecorator that intercepts GetClient for HTTPS client_ids, fetches CIMD documents, and caches the resulting fosite.Client with LRU + TTL and singleflight deduplication.
• Adds unit tests covering constructor behavior, delegation for opaque IDs, cache hit/miss/TTL/LRU eviction, singleflight behavior, and loopback redirect wrapping.
• Updates server construction to support decorator-wrapped storages via Unwrap(), and extracts Redis legacy migration logic into runLegacyMigration.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 9 comments.

File	Description
pkg/authserver/storage/cimd_decorator.go	Adds the CIMD-aware Storage decorator, caching, and CIMD→fosite client conversion logic (including loopback redirect handling).
pkg/authserver/storage/cimd_decorator_test.go	Adds comprehensive unit tests for decorator behavior (caching, concurrency, unwrap, and client building).
pkg/authserver/server_impl.go	Adds Unwrap() handling for storage type assertions and extracts Redis legacy migration into a helper.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jhrozek]

One question on the token_endpoint_auth_method handling.