Fix compatibility with external CIMD URLs

[Meldiron]

Original prompt

Appwrite APIs no longer support CIMD URL for apps.get() apps.list() and others. Simply, appId is now just ID, never URL.

Update the Console to account for this change. Instead, as needed, fetch the data directly from CIMD URL

What changed

The API no longer resolves CIMD (Client ID Metadata Document) URLs passed as appId, so the console now resolves them itself:

• New $lib/helpers/oauth2-cimd.ts with getOAuth2App(appId): plain IDs go through sdk.forConsole.apps.get() as before; URL-shaped client IDs (https, or http on loopback for local dev) are fetched directly from the browser and the RFC 7591 metadata document is mapped onto Models.App (client_name → name, logo_uri → logoUri, policy_uri/tos_uri → privacy/terms links, device-code grant → deviceFlow, etc.).
• Per the CIMD spec, the document's client_id must equal the URL it was fetched from; mismatching or malformed documents are rejected. URI fields are sanitized to http(s) before being rendered in src/href.
• Fetch/validation failures degrade to hostname-only branding instead of blocking the flow — the server still validates the client during authorization, so this only affects display.
• Routed all four apps.get() call sites through the helper: OAuth2 consent page (grant load + already-consented redirect), device flow page, and the account Applications list.
• Unit tests for client-ID detection and document mapping/validation.

Testing

• bun run test:unit — new oauth2-cimd.test.ts passes (7 tests)
• bun run format, bun run lint on touched files — clean
• bun run check — only pre-existing failure (dompurify types in modal.svelte), unrelated

🤖 Generated with Claude Code

[appwrite]

Console (appwrite/console)

Project ID: 688b7bf400350cbd60e9

Sites (1)

Site	Status	Logs	Preview	QR
console-stage 688b7cf6003b1842c9dc	Ready	View Logs	Preview URL

Tip

Schedule functions to run as often as every minute with cron expressions

[greptile-apps]

Greptile Summary

The PR adds browser-side resolution of URL-shaped CIMD client IDs after the API stopped resolving them.

• Fetches and validates external client metadata, maps it to the existing application model, and falls back to hostname-only branding on failure.
• Routes OAuth consent, device authorization, and connected-application metadata lookups through the new helper.
• Adds unit coverage for client-ID detection, metadata validation, mapping, and unsafe URI rejection.
• Updates nanoid and its resolved transitive versions.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/lib/helpers/oauth2-cimd.ts	Adds CIMD URL detection, metadata fetching and validation, application-model mapping, URI filtering, and graceful branding fallback.
src/lib/helpers/oauth2-cimd.test.ts	Covers supported client-ID forms, metadata mapping, identity matching, malformed documents, fallback naming, and unsafe URI values.
src/routes/(public)/oauth2/consent/+page.svelte	Uses the CIMD-aware application resolver when loading resumed grants and non-web authorization outcomes.
src/routes/(public)/oauth2/device/+page.svelte	Uses the CIMD-aware resolver for application metadata returned by device-grant creation.
src/routes/(console)/account/applications/+page.ts	Resolves connected OAuth2 applications through the CIMD-aware helper while preserving null handling.
package.json	Raises the nanoid dependency floor within the existing major version.
bun.lock	Records deterministic direct and transitive nanoid patch updates.

_{Reviews (2): Last reviewed commit: "chore(deps): raise the nanoid floor past..." | Re-trigger Greptile}