fix(auth): filter Telegram JWKS for Supabase OIDC

Supabase Auth go-jose rejects secp256k1 in Telegram JWKS
(github.com/supabase/auth/issues/2534). Serve filtered discovery.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ssshojaei

public/oidc/telegram-discovery.json

@@ -0,0 +1,45 @@
+{
+  "issuer": "https://oauth.telegram.org",
+  "authorization_endpoint": "https://oauth.telegram.org/auth",
+  "token_endpoint": "https://oauth.telegram.org/token",
+  "jwks_uri": "https://frontchapter.ir/oidc/telegram-jwks.json",
+  "response_types_supported": [
+    "code"
+  ],
+  "token_endpoint_auth_methods_supported": [
+    "client_secret_basic",
+    "client_secret_post"
+  ],
+  "subject_types_supported": [
+    "public"
+  ],
+  "id_token_signing_alg_values_supported": [
+    "RS256",
+    "ES256",
+    "EdDSA"
+  ],
+  "scopes_supported": [
+    "openid",
+    "phone",
+    "profile",
+    "telegram:bot_access"
+  ],
+  "claims_supported": [
+    "aud",
+    "preferred_username",
+    "phone_number",
+    "exp",
+    "iat",
+    "iss",
+    "name",
+    "picture",
+    "sub"
+  ],
+  "code_challenge_methods_supported": [
+    "plain",
+    "S256"
+  ],
+  "grant_types_supported": [
+    "authorization_code"
+  ]
+}

public/oidc/telegram-jwks.json

@@ -0,0 +1,32 @@
+{
+  "keys": [
+    {
+      "alg": "RS256",
+      "e": "AQAB",
+      "ext": true,
+      "key_ops": [
+        "verify"
+      ],
+      "kty": "RSA",
+      "n": "5RneLtsKvVcxdv6gu6gxEQu30Cru5NiMQnY6SNr9ZyZFZ4ya-pfHNuaZXJ6QPG0JSFwoxeOkEO2-eZN_REVPm448PvjjsR1eQdZ5QpEkNxnItFcmxkHH91v5cgf52_EI9BGO-MT6f1vaBSg3uWHFlDxI7J2AYxNvd1_Nf3TkgrrR7gyJFTmEIai5RefGnA0KGNYDlRIGUzrz2F05n6gTaHFT_iHL5UHatTZA4GCiUSjIOuwqu5pE5uZge20TFv3cxXMQaFw_xv1pgQt_Rq8eoCN7TS0RQ0zjWKiad-W286BcFectXsUm03p5Nq_kY4mf_7rqwX_B8yy_bBreyKn7RQ",
+      "kid": "oidc-1"
+    },
+    {
+      "alg": "ES256",
+      "kty": "EC",
+      "x": "ahVYrohhX6YA7w0P2gUNSwMFbaabCgBZFkeq9bWdmwU",
+      "y": "Ea8nKJ34VQMA7zv8aYDfzcBhXEjnWQ9C06jVke_eUV0",
+      "crv": "P-256",
+      "kid": "oidc-es256-1",
+      "use": "sig"
+    },
+    {
+      "alg": "EdDSA",
+      "crv": "Ed25519",
+      "x": "i6BEafXMEe4osXgUTffpKAm6Cn6F2bhqPZoclunTAV4",
+      "kty": "OKP",
+      "kid": "oidc-eddsa-1",
+      "use": "sig"
+    }
+  ]
+}

scripts/refresh-telegram-oidc.py

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+"""Refresh filtered Telegram JWKS (drops secp256k1 — breaks Supabase Auth go-jose).
+
+Run: python3 scripts/refresh-telegram-oidc.py
+Then deploy. Point Supabase custom:telegram Discovery URL at:
+  https://frontchapter.ir/oidc/telegram-discovery.json
+Issuer stays: https://oauth.telegram.org
+"""
+from __future__ import annotations
+
+import gzip
+import json
+import ssl
+from pathlib import Path
+from urllib.request import Request, urlopen
+
+ROOT = Path(__file__).resolve().parents[1] / "public" / "oidc"
+OUT_DISC = ROOT / "telegram-discovery.json"
+OUT_JWKS = ROOT / "telegram-jwks.json"
+SITE_JWKS = "https://frontchapter.ir/oidc/telegram-jwks.json"
+
+
+def get(url: str) -> dict:
+    req = Request(url, headers={"Accept": "application/json", "Accept-Encoding": "gzip"})
+    with urlopen(req, context=ssl.create_default_context(), timeout=30) as r:
+        data = r.read()
+        if r.headers.get("Content-Encoding") == "gzip" or data[:2] == b"\x1f\x8b":
+            data = gzip.decompress(data)
+        return json.loads(data.decode("utf-8"))
+
+
+def main() -> None:
+    disc = get("https://oauth.telegram.org/.well-known/openid-configuration")
+    jwks = get("https://oauth.telegram.org/.well-known/jwks.json")
+    filtered = {
+        "keys": [
+            k
+            for k in jwks["keys"]
+            if k.get("crv") != "secp256k1" and k.get("alg") != "ES256K"
+        ]
+    }
+    disc = dict(disc)
+    disc["jwks_uri"] = SITE_JWKS
+    disc["id_token_signing_alg_values_supported"] = [
+        a
+        for a in disc.get("id_token_signing_alg_values_supported", [])
+        if a != "ES256K"
+    ]
+    ROOT.mkdir(parents=True, exist_ok=True)
+    OUT_DISC.write_text(json.dumps(disc, indent=2) + "\n")
+    OUT_JWKS.write_text(json.dumps(filtered, indent=2) + "\n")
+    print("kept", [k.get("kid") for k in filtered["keys"]])
+    print("wrote", OUT_DISC, OUT_JWKS)
+
+
+if __name__ == "__main__":
+    main()