fix: mark any callback url as valid if they contain a wildcard (#1006)

backend/internal/dto/validations.go

@@ -67,14 +67,12 @@ func ValidateClientID(clientID string) bool {
 
 // ValidateCallbackURL validates callback URLs with support for wildcards
 func ValidateCallbackURL(raw string) bool {
-	if raw == "*" {
+	// Don't validate if it contains a wildcard
+	if strings.Contains(raw, "*") {
 		return true
 	}
 
-	// Replace all '*' with 'x' to check if the rest is still a valid URI
+	u, err := url.Parse(raw)
-	test := strings.ReplaceAll(raw, "*", "x")
-
-	u, err := url.Parse(test)
 	if err != nil {
 		return false
 	}

frontend/src/lib/utils/zod-util.ts

@@ -14,9 +14,11 @@ export const callbackUrlSchema = z
 	.nonempty()
 	.refine(
 		(val) => {
-			if (val === '*') return true;
+			if (val.includes('*')) {
+				return true;
+			}
 			try {
-				new URL(val.replace(/\*/g, 'x'));
+				new URL(val);
 				return true;
 			} catch {
 				return false;