Fix Kobo sync failure with newer firmware: add OIDC discovery endpoint and fix OAuth routes (#82)

Newer Kobo firmware performs a full OIDC authentication flow before syncing.
It calls /oauth/.well-known/openid-configuration expecting a standard OIDC
discovery document. Without a dedicated handler, the catch-all /oauth/<path>
route intercepts it and returns OAuth tokens instead, causing an infinite
retry loop.

Changes:
- Add HandleOidcDiscovery() route for /oauth/.well-known/openid-configuration
  that returns a proper OIDC discovery document with issuer, token_endpoint,
  authorization_endpoint, etc.
- Add /oauth/authorize route to HandleOauthRequest to prevent 308 redirect loop
- Fix make_calibre_web_oauth_response() to return current_user.id instead of
  reading user_id from request body (which is always empty on GET requests)

Tested on Kobo firmware 4.45.23640 behind an nginx reverse proxy.

Co-authored-by: new-usemame <248195428+new-usemame@users.noreply.github.com>

Author: new-usemame

cps/kobo.py

@@ -1300,7 +1300,7 @@ def make_calibre_web_oauth_response():
         "token_type": "Bearer",
         "expires_in": 3600,
         "scope": content.get("scope", ""),
-        "user_id": content.get("user_id", ""),
+        "user_id": str(current_user.id) if current_user and not current_user.is_anonymous else content.get("user_id", ""),
         # Include legacy field names used by some Kobo requests
         "AccessToken": access_token,
         "RefreshToken": refresh_token,
@@ -1322,8 +1322,28 @@ def HandleAuthRequest():
     return make_calibre_web_auth_response()
 
 
+
+@csrf.exempt
+@kobo.route('/oauth/.well-known/openid-configuration', methods=['GET', 'POST'])
+@requires_kobo_auth
+def HandleOidcDiscovery():
+    base_url = url_for("kobo.HandleOauthRequest",
+                       auth_token=get_auth_token(),
+                       _external=True).rsplit("/oauth", 1)[0]
+    payload = {
+        'issuer': base_url,
+        'authorization_endpoint': base_url + '/oauth/authorize',
+        'token_endpoint': base_url + '/oauth/token',
+        'userinfo_endpoint': base_url + '/oauth/userinfo',
+        'response_types_supported': ['code'],
+        'subject_types_supported': ['public'],
+        'id_token_signing_alg_values_supported': ['RS256'],
+    }
+    return make_response(jsonify(payload))
+
 @csrf.exempt
 @kobo.route("/oauth/token", methods=["GET", "POST"])
+@kobo.route("/oauth/authorize", methods=["GET", "POST"])
 @kobo.route("/oauth/refresh", methods=["GET", "POST"])
 @kobo.route("/oauth/<path:subpath>", methods=["GET", "POST"])
 @requires_kobo_auth