working a bit

lib/helpers/api_helper.dart

@@ -21,9 +21,26 @@ class ApiHelper {
     final password = data["password"];
     final redirectUri = data["redirect_uri"];
     final state = data["state"] ?? "";
+    final clientId = data["client_id"];
+    final scope = data["scope"];
+    final nonce = data["nonce"];
 
+    // Basic validation
+    if ([
+      username,
+      password,
+      redirectUri,
+      clientId,
+      nonce,
+      scope,
+    ].any((v) => v == null)) {
+      return Response(400, body: "Missing required field(s)");
+    }
+
+    // Matrix login
     final loginRes = await http.post(
       Uri.https(settings.homeserver, "_matrix/client/v3/login"),
+      headers: {"Content-Type": "application/json"},
       body: json.encode({
         "type": "m.login.password",
         "identifier": {"type": "m.id.user", "user": username},
@@ -39,10 +56,11 @@ class ApiHelper {
     final userId = loginData["user_id"];
     final accessToken = loginData["access_token"];
 
+    // Request OpenID token from Matrix
     final openidRes = await http.post(
       Uri.https(
         settings.homeserver,
-        "_matrix/client/v3/user/$userId/openid/request",
+        "_matrix/client/v3/user/${Uri.encodeComponent(userId)}/openid/request",
       ),
       headers: {"Authorization": "Bearer $accessToken"},
     );
@@ -55,13 +73,19 @@ class ApiHelper {
 
     final openidToken = json.decode(openidRes.body)["access_token"];
 
+    // Generate and store authorization code
     final code = base64Url.encode(
       List<int>.generate(16, (_) => DateTime.now().millisecond % 256),
     );
+
     ref
         .read(AuthCodeController.provider.notifier)
-        .set(code, MatrixUser(userId: userId, matrixToken: openidToken));
+        .set(
+          code,
+          MatrixUser(userId: userId, matrixToken: openidToken, nonce: nonce!),
+        );
 
+    // Redirect back to client
     return Response.found("$redirectUri?code=$code&state=$state");
   }
 
@@ -133,10 +157,16 @@ class ApiHelper {
       );
     }
 
-    return Response.ok(matrixResp.body);
+    return Response.ok(
+      matrixResp.body,
+      headers: {"content-type": "application/json"},
+    );
   }
 
-  Response jwks(_) => Response.ok(json.encode({"keys": []}));
+  Response jwks(_) => Response.ok(
+    json.encode({"keys": []}),
+    headers: {"content-type": "application/json"},
+  );
 
   Response openidConfiguration(_) {
     final settings = ref.read(SettingsController.provider)!;
@@ -145,7 +175,7 @@ class ApiHelper {
         "issuer": settings.issuer,
         "authorization_endpoint": settings.authorizeEndpoint,
         "token_endpoint": "${settings.issuer}/token",
-        "userinfo_endpoint": "${settings.issuer}/userInfo",
+        "userinfo_endpoint": "${settings.issuer}/userinfo",
         "jwks_uri": "${settings.issuer}/jwks.json",
         "response_types_supported": ["code"],
         "subject_types_supported": ["public"],