Still working on getting client credential flow complete, most of the request works but still working on generating the JWT.

IdentityShroud.Api/Apis/OpenIdEndpoints.cs

@@ -1,7 +1,11 @@
+using IdentityShroud.Api.Apis;
+using IdentityShroud.Api.Apis.ISResults;
+using IdentityShroud.Api.Helpers;
 using IdentityShroud.Api.Mappers;
 using IdentityShroud.Core.Contracts;
 using IdentityShroud.Core.Messages;
 using IdentityShroud.Core.Model;
+using IdentityShroud.Core.Services.OpenId;
 using Microsoft.AspNetCore.Http.HttpResults;
 using Microsoft.AspNetCore.Mvc;
 
@@ -11,8 +15,6 @@ public static class OpenIdEndpoints
 {
     // openid: auth/realms/{realmSlug}/.well-known/openid-configuration
     // openid: auth/realms/{realmSlug}/openid-connect/(auth|token|jwks)
-    
-    
     public static void MapEndpoints(this IEndpointRouteBuilder erp)
     {
         var realmsGroup = erp.MapGroup("/auth/realms");
@@ -56,17 +58,79 @@ public static class OpenIdEndpoints
     {
         Realm realm = context.GetValidatedRealm();
         await realmService.LoadActiveKeys(realm);
-        return TypedResults.Ok(keyMapper.KeyListToJsonWebKeySet(realm.Keys));
+        return TypedResults.Ok(keyMapper.KeyListToJsonWebKeySet(realm.TokenSigningKeys));
     }
 
-    private static Task OpenIdConnectToken(HttpContext context)
+    private static async  Task<Results<
+            Ok<TokenResponse>,
+            BadRequest<ErrorDto>,
+            ISUnauthorizedHttpResult
+    >> OpenIdConnectToken(
+        string realmSlug,
+        [FromServices] IClientService clientService,
+        HttpContext context,
+        CancellationToken ct)
     {
-        throw new NotImplementedException();
+        IFormCollection form = await context.Request.ReadFormAsync();
+        
+        string grantType = form["grant_type"].ToString();
+        string clientId = form["client_id"].ToString();
+        string scope = form["scope"].ToString();
+
+        if (grantType == "client_credentials")
+        {
+            string? clientSecret = null;
+            bool withAuthHeader = false;
+            if (HeaderHelpers.TryGetBasicAuth(context, out string? user, out string? password))
+            {
+                withAuthHeader = true;
+                clientId = user;
+                clientSecret = password;
+            }
+            clientSecret ??= form["client_secret"].ToString();
+
+            if (string.IsNullOrEmpty(clientId) ||
+                string.IsNullOrEmpty(clientSecret))
+            {
+                return CreateBadRequest("invalid_request");
+            }
+            
+            Realm realm = context.GetValidatedRealm();
+            Client? client = await clientService.GetByClientId(realm.Id, clientId, ct);
+            if (client is null)
+            {
+                if (withAuthHeader)
+                {
+                    return new ISUnauthorizedHttpResult([$"Basic realm=\"{realm.Slug}\""]);
+                }
+                return CreateBadRequest("invalid_client");
+            }
+            
+            if (!client.AllowClientCredentialsFlow)
+                return CreateBadRequest("unauthorized_client");
+
+        }
+        else
+            return CreateBadRequest("unsupported_grant_type");
+
+        context.Response.Headers.CacheControl = "no-store";
+        context.Response.Headers.Pragma = "no-cache";
+
+        return TypedResults.Ok(new TokenResponse()
+        {
+            AccessToken = "token",
+            TokenType = "bearer",
+            ExpiresIn = 3600,
+        });
     }
 
+    private static BadRequest<ErrorDto> CreateBadRequest(string error) =>
+        TypedResults.BadRequest(new ErrorDto(error));
+
+        
+    
     private static Task OpenIdConnectAuth(HttpContext context)
     {
         throw new NotImplementedException();
     }
-
 }