fix oauth

apps/api-gateway/src/lib/oauth-issuer.ts

@@ -84,6 +84,21 @@ export function buildOpenIdConfiguration(issuer: string) {
     token_endpoint_auth_methods_supported: ['client_secret_post', 'client_secret_basic'],
     grant_types_supported: ['authorization_code', 'refresh_token'],
     code_challenge_methods_supported: ['S256', 'plain'],
-    claims_supported: ['sub', 'email', 'phone', 'name', 'picture']
+    claims_supported: [
+      'sub',
+      'iss',
+      'aud',
+      'iat',
+      'exp',
+      'auth_time',
+      'nonce',
+      'email',
+      'email_verified',
+      'phone_number',
+      'phone_number_verified',
+      'name',
+      'preferred_username',
+      'picture'
+    ]
   };
 }

apps/api-gateway/src/lib/oauth-params.ts

@@ -133,6 +133,33 @@ export function mapTokenResponseToStandard(result: {
   };
 }
 
+export function mapUserInfoToOidc(result: {
+  sub?: string;
+  email?: string;
+  phone?: string;
+  name?: string;
+  picture?: string;
+  emailVerified?: boolean;
+  preferredUsername?: string;
+  phoneNumber?: string;
+  phoneNumberVerified?: boolean;
+}) {
+  const claims: Record<string, unknown> = { sub: result.sub };
+  if (result.name) claims.name = result.name;
+  if (result.picture) claims.picture = result.picture;
+  if (result.preferredUsername) claims.preferred_username = result.preferredUsername;
+  if (result.email) {
+    claims.email = result.email;
+    if (result.emailVerified !== undefined) claims.email_verified = result.emailVerified;
+  }
+  const phoneNumber = result.phoneNumber ?? result.phone;
+  if (phoneNumber) {
+    claims.phone_number = phoneNumber;
+    if (result.phoneNumberVerified !== undefined) claims.phone_number_verified = result.phoneNumberVerified;
+  }
+  return claims;
+}
+
 export function mergeTokenCredentials(
   body: NormalizedTokenBody,
   authorization?: string