config rewrite to fix oidc issues

init/scripts/config_link.sh

@@ -22,13 +22,32 @@ TEMP_FILTER=$(mktemp)
 trap "rm -f $TEMP_FILTER" EXIT
 
 cat > "$TEMP_FILTER" <<EOF
-.oidc.providers += [{"id": "synapse", "client_id": "${CLIENT_ID}", "client_secret": "${CLIENT_SECRET}", "scopes": ["openid", "profile", "email"], "issuer": "http://mas:8000"}]
+clients:
+  - client_id: "${CLIENT_ID}"
+    client_secret: "${CLIENT_SECRET}"
+    redirect_uris:
+      - "https://${HOMESERVER_FQDN}/_synapse/client/oidc/callback"
+    grant_types:
+      - "authorization_code"
+      - "refresh_token"
+    response_types:
+      - "code"
+    scopes:
+      - "openid"
+      - "profile"
+      - "email"
+    application_type: "web"
 EOF
 
-yq -y -i "$(cat "$TEMP_FILTER")" "$MAS_CFG" || { log_error "Failed to update MAS config"; exit 1; }
+EXISTING_CLIENT=$(yq '.clients[] | select(.client_id == "'"${CLIENT_ID}"'")' "$MAS_CFG" 2>/dev/null || echo "")
 
-CLIENT_ID=$(yq '.oidc.providers[0].client_id' "$MAS_CFG" | tr -d '"')
-CLIENT_SECRET=$(yq '.oidc.providers[0].client_secret' "$MAS_CFG" | tr -d '"')
+if [[ -z "$EXISTING_CLIENT" ]]; then
+    # Append new client to MAS config
+    yq -y -i "$(cat "$TEMP_FILTER")" "$MAS_CFG" || { log_error "Failed to register Synapse client in MAS"; exit 1; }
+    log_info "  -> Registered Synapse as OIDC client in MAS"
+else
+    log_info "  -> Synapse client already registered in MAS, skipping"
+fi
 
 ISSUER_URL="https://${MAS_FQDN}"