fix: non-oidc sessions using oidc device management (#1256)

<!-- Please read
https://github.com/SableClient/Sable/blob/dev/CONTRIBUTING.md before
submitting your pull request -->

### Description

<!-- Please include a summary of the change. Please also include
relevant motivation and context. List any dependencies that are required
for this change. -->

title

#### Type of change

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] This change requires a documentation update

### Checklist:

- [ ] My code follows the style guidelines of this project
- [ ] I have performed a self-review of my own code
- [ ] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the documentation
- [ ] My changes generate no new warnings

### AI disclosure:

- [ ] Partially AI assisted (clarify which code was AI assisted and
briefly explain what it does).
- [ ] Fully AI generated (explain what all the generated code does in
moderate detail).
<!-- Write any explanation required here, but do not generate the
explanation using AI!! You must prove you understand what the code in
this PR does. -->

Author: 7w1

src/app/hooks/useAuthMetadata.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, it } from 'vitest';
+import type { ValidatedAuthMetadata } from '$types/matrix-sdk';
+import type { Session } from '$state/sessions';
+import { getSessionAuthMetadata } from './useAuthMetadata';
+
+const metadata = {
+  issuer: 'https://auth.example.org/',
+  authorization_endpoint: 'https://auth.example.org/authorize',
+  token_endpoint: 'https://auth.example.org/token',
+  registration_endpoint: 'https://auth.example.org/register',
+  response_types_supported: ['code'],
+  response_modes_supported: ['query'],
+  grant_types_supported: ['authorization_code', 'refresh_token'],
+  code_challenge_methods_supported: ['S256'],
+  account_management_uri: 'https://auth.example.org/account',
+} as ValidatedAuthMetadata;
+
+const session: Session = {
+  baseUrl: 'https://matrix.example.org',
+  userId: '@alice:example.org',
+  deviceId: 'DEVICE',
+  accessToken: 'access-token',
+};
+
+describe('getSessionAuthMetadata', () => {
+  it('does not expose delegated account management to non-OIDC sessions', () => {
+    expect(getSessionAuthMetadata(metadata, session)).toBeUndefined();
+  });
+
+  it('exposes delegated account management to OIDC sessions', () => {
+    const oidcSession: Session = {
+      ...session,
+      oidc: {
+        issuer: metadata.issuer,
+        clientId: 'client-id',
+      },
+    };
+
+    expect(getSessionAuthMetadata(metadata, oidcSession)).toBe(metadata);
+  });
+
+  it('does not invent metadata when an OIDC session has no discovered metadata', () => {
+    const oidcSession: Session = {
+      ...session,
+      oidc: {
+        issuer: metadata.issuer,
+        clientId: 'client-id',
+      },
+    };
+
+    expect(getSessionAuthMetadata(undefined, oidcSession)).toBeUndefined();
+  });
+});

src/app/hooks/useAuthMetadata.ts

@@ -1,10 +1,16 @@
 import type { ValidatedAuthMetadata } from '$types/matrix-sdk';
+import type { Session } from '$state/sessions';
 import { createContext, useContext } from 'react';
 
 const AuthMetadataContext = createContext<ValidatedAuthMetadata | undefined>(undefined);
 
 export const AuthMetadataProvider = AuthMetadataContext.Provider;
 
+export const getSessionAuthMetadata = (
+  metadata: ValidatedAuthMetadata | undefined,
+  session: Session | undefined
+): ValidatedAuthMetadata | undefined => (session?.oidc ? metadata : undefined);
+
 export const useAuthMetadata = (): ValidatedAuthMetadata | undefined => {
   const metadata = useContext(AuthMetadataContext);
 

src/app/pages/client/ClientRoot.tsx

@@ -35,7 +35,7 @@ import { MatrixClientProvider } from '$hooks/useMatrixClient';
 import { AsyncStatus, useAsyncCallback } from '$hooks/useAsyncCallback';
 import { useSyncState } from '$hooks/useSyncState';
 import { stopPropagation } from '$utils/keyboard';
-import { AuthMetadataProvider } from '$hooks/useAuthMetadata';
+import { AuthMetadataProvider, getSessionAuthMetadata } from '$hooks/useAuthMetadata';
 import {
   sessionsAtom,
   activeSessionIdAtom,
@@ -480,7 +480,9 @@ export function ClientRoot({ children }: ClientRootProps) {
                 {(serverConfigs) => (
                   <CapabilitiesProvider value={serverConfigs.capabilities ?? {}}>
                     <MediaConfigProvider value={serverConfigs.mediaConfig ?? {}}>
-                      <AuthMetadataProvider value={serverConfigs.authMetadata}>
+                      <AuthMetadataProvider
+                        value={getSessionAuthMetadata(serverConfigs.authMetadata, activeSession)}
+                      >
                         {children}
                       </AuthMetadataProvider>
                     </MediaConfigProvider>