fix: send authorization_details as JSON in pushed_authorization_request

[RaphaelFakhri]

Changes

PushedAuthorizationRequests.pushed_authorization_request() sends its body as application/x-www-form-urlencoded. When authorization_details is passed as a list, urlencode() writes the Python repr of the list ([{'type': 'money_transfer', ...}], single-quoted) instead of JSON. That is not the JSON array that RFC 9396 requires for authorization_details.

This change serializes a list authorization_details with json.dumps() before the request is sent, the same way BackChannelLogin.back_channel_login() already does (#695). String values pass through unchanged.

• Methods changed: PushedAuthorizationRequests.pushed_authorization_request() (no signature change)
• test_with_authorization_details now expects the JSON string.
• New test_authorization_details_sent_as_json checks the encoded request body that reaches requests.request.

References

• Fixes pushed_authorization_request sends list authorization_details as a Python repr #903
• PAR switched to form-encoded bodies in Fix: Unauthorized Access Error For PAR #671; the list case was added in Adding Support For RAR and JAR Requests #659 when the body was still JSON.
• Same fix for back-channel login: fix: handle authorization_details in back_channel_login #695
• RFC 9396, section 2: authorization_details is a JSON array.

Testing

poetry run pytest tests/authentication/test_pushed_authorization_requests.py: 5 passed. Without the source change, test_with_authorization_details and test_authorization_details_sent_as_json fail. poetry run pytest tests/authentication: 113 passed.

Not tested against a live tenant.

• This change adds unit test coverage
• This change adds integration test coverage