Switch OIDC to response_mode=fragment (#33100)

* Refactor: kill off `parseQs` in favour of URLSearchParams

* Consolidate app-load url parameter handling

* Switch to responseMode=fragment

apps/web/src/utils/oidc/authorize.ts

@@ -7,13 +7,13 @@ Please see LICENSE files in the repository root for full details.
 */
 
 import { completeAuthorizationCodeGrant, generateOidcAuthorizationUrl } from "matrix-js-sdk/src/oidc/authorize";
-import { type QueryDict } from "matrix-js-sdk/src/utils";
 import { type OidcClientConfig } from "matrix-js-sdk/src/matrix";
 import { secureRandomString } from "matrix-js-sdk/src/randomstring";
 import { type IdTokenClaims } from "oidc-client-ts";
 
 import { OidcClientError } from "./error";
 import PlatformPeg from "../../PlatformPeg";
+import { type URLParams } from "../../vector/url_utils.ts";
 
 /**
  * Start OIDC authorization code flow
@@ -47,22 +47,23 @@ export const startOidcLogin = async (
         nonce,
         prompt,
         urlState: PlatformPeg.get()?.getOidcClientState(),
+        responseMode: "fragment",
     });
 
     window.location.href = authorizationUrl;
 };
 
 /**
- * Gets `code` and `state` query params
+ * Gets `code` and `state` response params
  *
- * @param queryParams
+ * @param urlParams - the parameters to read
  * @returns code and state
  * @throws when code and state are not valid strings
  */
-const getCodeAndStateFromQueryParams = (queryParams: QueryDict): { code: string; state: string } => {
-    const code = queryParams["code"];
-    const state = queryParams["state"];
-
+const getCodeAndStateFromParams = ({
+    code,
+    state,
+}: NonNullable<URLParams["oidc"]>): { code: string; state: string } => {
     if (!code || typeof code !== "string" || !state || typeof state !== "string") {
         throw new Error(OidcClientError.InvalidQueryParameters);
     }
@@ -89,14 +90,16 @@ type CompleteOidcLoginResponse = {
 };
 /**
  * Attempt to complete authorization code flow to get an access token
- * @param queryParams the query-parameters extracted from the real query-string of the starting URI.
+ * @param urlParams the parameters extracted from the app-load URI.
  * @returns Promise that resolves with a CompleteOidcLoginResponse when login was successful
  * @throws When we failed to get a valid access token
  */
-export const completeOidcLogin = async (queryParams: QueryDict): Promise<CompleteOidcLoginResponse> => {
-    const { code, state } = getCodeAndStateFromQueryParams(queryParams);
+export const completeOidcLogin = async (
+    urlParams: NonNullable<URLParams["oidc"]>,
+): Promise<CompleteOidcLoginResponse> => {
+    const { code, state } = getCodeAndStateFromParams(urlParams);
     const { homeserverUrl, tokenResponse, idTokenClaims, identityServerUrl, oidcClientSettings } =
-        await completeAuthorizationCodeGrant(code, state);
+        await completeAuthorizationCodeGrant(code, state, "fragment");
 
     return {
         homeserverUrl,