R82: req discovery endpoints, single-use code retry

metadata_cache.go

@@ -146,6 +146,14 @@ func (mc *MetadataCache) GetProviderMetadata(ctx context.Context, providerURL st
 		return nil, fmt.Errorf("failed to decode metadata: %w", err)
 	}
 
+	// Require the core endpoints. An incomplete discovery document (missing
+	// authorization_endpoint / token_endpoint) would otherwise be accepted,
+	// cached, and adopted as the working auth/token URL, failing at runtime
+	// (wrong authorize redirect, token-exchange failure) instead of at startup.
+	if metadata.AuthURL == "" || metadata.TokenURL == "" {
+		return nil, fmt.Errorf("discovery document missing required endpoints (authorization_endpoint or token_endpoint)")
+	}
+
 	// Pin the advertised issuer to the configured provider host. The issuer is
 	// the trust anchor for JWT issuer validation; rejecting a mismatch here
 	// ensures a poisoned discovery document advertising an attacker-chosen