feat: derive OAuth2 client type from token_endpoint_auth_method (#28043)

Adds an OAuth2 client type (public vs confidential, RFC 7591 §2) derived
from the requested auth method instead of hardcoded confidential. The
type is stored and guarded here, but no endpoint enforces on it yet;
public behavior at the token endpoint follows in the next PR in the
stack.

- Client type is derived once and reused by both registration and
redirect URI validation, so they can't disagree
- IsPublic() fails closed: an unrecognized or missing value reads as
confidential
- RFC 7592 update (PUT) now rejects moving a client between public and
confidential (400) instead of silently flipping it when the auth method
is omitted
- Discovery still doesn't advertise "none"; follows once the token
endpoint honors it

### Behavior by client shape

`client_type` is derived from `token_endpoint_auth_method` at POST and
pinned at PUT. RFC 7592 GET/PUT authenticate with the registration
access token, not the client secret, so neither endpoint reads a secret.

| Registered with | Stored `client_type` / method | GET reports | PUT
that flips the method |

|------------------------------------|---------------------------------------|-----------------------|-----------------------------------------|
| omitted, or `client_secret_basic` | `confidential` /
`client_secret_basic` | `client_secret_basic` | `none` → 400
`invalid_client_metadata` |
| `none` (new) | `public` / `none` | `none` | `client_secret_*` → 400
`invalid_client_metadata` |
| `none` (before this PR) | `confidential` / `none` | `none` | either →
200, type stays `confidential` |

- PUT still replaces every other RFC 7591 field. `client_type` is the
only pinned one; the method may move within a type
(`client_secret_basic` ↔ `client_secret_post`).
- Row 3 is the only shape where the two columns disagree. The guard
fires only on a method change that crosses the type line, so those
clients keep managing themselves instead of being locked out of their
own configuration endpoint.
- The token endpoint does not consult `client_type` yet, so every client
still authenticates with a secret and registration still issues one.

Split out of #27873, second in the stack (on top of #28041).
Refs
https://linear.app/codercom/issue/ENG-3029/oauth2-support-public-client

coderd/database/constants.go

@@ -10,3 +10,23 @@ import (
 // for use as a uuid.UUID. Both must agree; tests pin the value to the
 // codersdk constant so the two cannot drift.
 var PrebuildsSystemUserID = uuid.MustParse(codersdk.PrebuildsSystemUserID)
+
+// Values stored in oauth2_provider_apps.client_type, as plain strings for
+// comparison against the sqlc-generated string column.
+//
+// Converted from the codersdk constants rather than redeclared, so the value
+// registration writes and the value OAuth2ProviderApp.IsPublic reads back
+// cannot disagree. That divergence would fail closed anyway (the app would read
+// as confidential and demand a secret it was never issued), but it would fail
+// visibly to a client rather than here.
+//
+// What this does not protect against is the two constants colliding on the same
+// value, which would make IsPublic true for confidential apps. Nothing in the
+// type system can catch that; the tests that pin these spellings to the wire
+// values do, so do not delete them as redundant:
+// TestOAuth2ClientRegistrationRequest_DetermineClientType (codersdk) and
+// TestOAuth2ProviderAppIsPublic (coderd/database).
+const (
+	OAuth2ProviderAppClientTypeConfidential = string(codersdk.OAuth2ClientTypeConfidential)
+	OAuth2ProviderAppClientTypePublic       = string(codersdk.OAuth2ClientTypePublic)
+)

coderd/database/modelmethods.go

@@ -685,6 +685,14 @@ func (OAuth2ProviderApp) RBACObject() rbac.Object {
 	return rbac.ResourceOauth2App
 }
 
+// IsPublic reports whether the app is a public (secretless, PKCE-only)
+// OAuth2 client per RFC 7591 §2 / OAuth 2.1 §2.1, as opposed to confidential.
+// An unset or unrecognized client type reads as confidential, so an app can
+// never skip client authentication by accident.
+func (a OAuth2ProviderApp) IsPublic() bool {
+	return a.ClientType == OAuth2ProviderAppClientTypePublic
+}
+
 func (a GetOAuth2ProviderAppsByUserIDRow) RBACObject() rbac.Object {
 	return a.OAuth2ProviderApp.RBACObject()
 }

coderd/database/modelmethods_internal_test.go

@@ -221,6 +221,38 @@ func TestWorkspaceACLDisabled(t *testing.T) {
 	})
 }
 
+// TestOAuth2ProviderAppIsPublic pins IsPublic's contract directly, since it is
+// what decides whether the token endpoint validates a client secret at all.
+// Only the exact string "public" may read as public: anything else, including
+// an unset column or a differently-cased value, must read as confidential so
+// that a garbled value cannot silently skip client authentication.
+func TestOAuth2ProviderAppIsPublic(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name       string
+		clientType string
+		want       bool
+	}{
+		{name: "Public", clientType: "public", want: true},
+		{name: "Confidential", clientType: "confidential", want: false},
+		{name: "Empty", clientType: "", want: false},
+		{name: "MixedCasePublic", clientType: "Public", want: false},
+		{name: "AllCapsPublic", clientType: "PUBLIC", want: false},
+		{name: "LeadingSpace", clientType: " public", want: false},
+		{name: "TrailingSpace", clientType: "public ", want: false},
+		{name: "Bogus", clientType: "bogus", want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			app := OAuth2ProviderApp{ClientType: tt.clientType}
+			require.Equal(t, tt.want, app.IsPublic())
+		})
+	}
+}
+
 // Helpers
 func requirePermission(t *testing.T, s rbac.Scope, resource string, action policy.Action) {
 	t.Helper()

coderd/oauth2provider/apps.go

@@ -92,7 +92,7 @@ func CreateApp(db database.Store, accessURL *url.URL, auditor *audit.Auditor, lo
 			Icon:                    req.Icon,
 			CallbackURL:             req.CallbackURL,
 			RedirectUris:            []string{},
-			ClientType:              "confidential",
+			ClientType:              database.OAuth2ProviderAppClientTypeConfidential,
 			DynamicallyRegistered:   sql.NullBool{Bool: false, Valid: true},
 			ClientIDIssuedAt:        sql.NullTime{},
 			ClientSecretExpiresAt:   sql.NullTime{},

coderd/oauth2provider/registration.go

@@ -101,7 +101,7 @@ func CreateDynamicClientRegistration(db database.Store, accessURL *url.URL, audi
 			Icon:                    req.LogoURI,
 			CallbackURL:             req.RedirectURIs[0], // Primary redirect URI
 			RedirectUris:            req.RedirectURIs,
-			ClientType:              req.DetermineClientType(),
+			ClientType:              string(req.DetermineClientType()),
 			DynamicallyRegistered:   sql.NullBool{Bool: true, Valid: true},
 			ClientIDIssuedAt:        sql.NullTime{Time: now, Valid: true},
 			ClientSecretExpiresAt:   sql.NullTime{}, // No expiration for now
@@ -311,17 +311,49 @@ func UpdateClientConfiguration(db database.Store, auditor *audit.Auditor, logger
 			return
 		}
 
+		// A client's type is fixed at registration (RFC 7592 §2.2 permits
+		// rejecting metadata the server will not accept). Flipping it would
+		// either drop the secret requirement for a client that has one, or mark
+		// a client confidential when it has no secret and no way to be issued
+		// one.
+		//
+		// Requiring authMethodChanged means an update that leaves the auth
+		// method alone is never rejected, so a legacy row whose two columns
+		// disagree can still manage itself. IsPublic is the reader for the
+		// stored column so an unrecognized value is treated as confidential
+		// here exactly as it is at the token endpoint.
+		storedMethod := codersdk.OAuth2TokenEndpointAuthMethod(existingApp.TokenEndpointAuthMethod.String)
+		authMethodChanged := req.TokenEndpointAuthMethod != storedMethod
+		clientTypeChanged := (req.DetermineClientType() == codersdk.OAuth2ClientTypePublic) != existingApp.IsPublic()
+		if authMethodChanged && clientTypeChanged {
+			logger.Warn(ctx, "rejected oauth2 client type change",
+				slog.F("client_id", clientID.String()),
+				slog.F("stored_token_endpoint_auth_method", existingApp.TokenEndpointAuthMethod.String),
+				slog.F("requested_token_endpoint_auth_method", string(req.TokenEndpointAuthMethod)),
+				slog.F("stored_client_type", existingApp.ClientType))
+			writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest,
+				"invalid_client_metadata",
+				fmt.Sprintf("token_endpoint_auth_method cannot move an existing client between public and confidential (stored %q, requested %q); the client type is fixed at registration, so register a new client instead",
+					existingApp.TokenEndpointAuthMethod.String, string(req.TokenEndpointAuthMethod)))
+			return
+		}
+
 		// Update app in database
 		now := dbtime.Now()
 		//nolint:gocritic // OAuth2 system context — RFC 7592 client configuration endpoint
 		updatedApp, err := db.UpdateOAuth2ProviderAppByClientID(dbauthz.AsSystemOAuth2(ctx), database.UpdateOAuth2ProviderAppByClientIDParams{
-			ID:                      clientID,
-			UpdatedAt:               now,
-			Name:                    req.GenerateClientName(),
-			Icon:                    req.LogoURI,
-			CallbackURL:             req.RedirectURIs[0], // Primary redirect URI
-			RedirectUris:            req.RedirectURIs,
-			ClientType:              req.DetermineClientType(),
+			ID:           clientID,
+			UpdatedAt:    now,
+			Name:         req.GenerateClientName(),
+			Icon:         req.LogoURI,
+			CallbackURL:  req.RedirectURIs[0], // Primary redirect URI
+			RedirectUris: req.RedirectURIs,
+			// Carried through unchanged. The guard above rejects a request that
+			// would change the type, so re-deriving it here could only ever
+			// differ for a legacy row whose stored type and auth method
+			// disagree, silently converting it to public while it still holds a
+			// secret.
+			ClientType:              existingApp.ClientType,
 			ClientSecretExpiresAt:   sql.NullTime{}, // No expiration for now
 			GrantTypes:              slice.ToStrings(req.GrantTypes),
 			ResponseTypes:           slice.ToStrings(req.ResponseTypes),

coderd/oauth2provider/registration_test.go

@@ -2,16 +2,22 @@ package oauth2provider_test
 
 import (
 	"bytes"
+	"context"
+	"database/sql"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"testing"
 
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog/v3/sloggers/slogtest"
 	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
 	"github.com/coder/coder/v2/coderd/database/dbtestutil"
 	"github.com/coder/coder/v2/coderd/oauth2provider"
 	"github.com/coder/coder/v2/coderd/tracing"
@@ -97,3 +103,268 @@ func TestCreateDynamicClientRegistration_DCREnabled(t *testing.T) {
 		})
 	}
 }
+
+// TestUpdateClientConfiguration_ClientTypeIsImmutable verifies that an
+// RFC 7592 update cannot move a registered client between public and
+// confidential. Allowing it would either drop the secret requirement for a
+// client that has a secret, or mark a client confidential when it has no
+// secret and no way to be issued one, permanently breaking its token
+// exchange. Switching between the two confidential auth methods stays
+// allowed, since it changes nothing about how the client authenticates.
+func TestUpdateClientConfiguration_ClientTypeIsImmutable(t *testing.T) {
+	t.Parallel()
+
+	accessURL, err := url.Parse("https://oauth2-registration-immutable-type-test.example.com")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name       string
+		registerAs codersdk.OAuth2TokenEndpointAuthMethod
+		updateTo   codersdk.OAuth2TokenEndpointAuthMethod
+		// omitAuthMethod sends the update with no token_endpoint_auth_method at
+		// all, which ApplyDefaults rewrites to client_secret_basic before the
+		// guard sees it. updateTo is ignored when set.
+		omitAuthMethod    bool
+		wantStatus        int
+		wantFinalCallback string
+		// wantClientType is deliberately a bare literal rather than the
+		// database constant: it pins the value actually stored in the column,
+		// so it must fail if that spelling ever changes. Fixtures that set
+		// state use the constant instead.
+		wantClientType string
+	}{
+		{
+			name:           "ConfidentialToPublicIsRejected",
+			registerAs:     codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic,
+			updateTo:       codersdk.OAuth2TokenEndpointAuthMethodNone,
+			wantStatus:     http.StatusBadRequest,
+			wantClientType: "confidential",
+		},
+		{
+			name:           "PublicToConfidentialIsRejected",
+			registerAs:     codersdk.OAuth2TokenEndpointAuthMethodNone,
+			updateTo:       codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic,
+			wantStatus:     http.StatusBadRequest,
+			wantClientType: "public",
+		},
+		{
+			// RFC 7592 makes PUT a full replacement, so an omitted auth method
+			// defaults to client_secret_basic and moves a public client to
+			// confidential, which is rejected. The rejection is correct; what
+			// matters is that it is reported in terms the caller can act on,
+			// since they never sent the field named in the error.
+			name:           "PublicWithOmittedAuthMethodIsRejected",
+			registerAs:     codersdk.OAuth2TokenEndpointAuthMethodNone,
+			omitAuthMethod: true,
+			wantStatus:     http.StatusBadRequest,
+			wantClientType: "public",
+		},
+		{
+			// Both are confidential, so the guard must not fire.
+			name:              "BasicToPostIsAllowed",
+			registerAs:        codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic,
+			updateTo:          codersdk.OAuth2TokenEndpointAuthMethodClientSecretPost,
+			wantStatus:        http.StatusOK,
+			wantFinalCallback: "https://example.com/updated-callback",
+			wantClientType:    "confidential",
+		},
+		{
+			// A confidential client omitting the field is unaffected, because
+			// the default it lands on is also confidential. Pinned so the
+			// asymmetry with the public case above stays visible.
+			name:              "ConfidentialWithOmittedAuthMethodIsAllowed",
+			registerAs:        codersdk.OAuth2TokenEndpointAuthMethodClientSecretPost,
+			omitAuthMethod:    true,
+			wantStatus:        http.StatusOK,
+			wantFinalCallback: "https://example.com/updated-callback",
+			wantClientType:    "confidential",
+		},
+		{
+			name:              "PublicToPublicIsAllowed",
+			registerAs:        codersdk.OAuth2TokenEndpointAuthMethodNone,
+			updateTo:          codersdk.OAuth2TokenEndpointAuthMethodNone,
+			wantStatus:        http.StatusOK,
+			wantFinalCallback: "https://example.com/updated-callback",
+			wantClientType:    "public",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			db, _ := dbtestutil.NewDB(t)
+			require.NoError(t, db.UpsertOAuth2DCREnabled(ctx, true))
+
+			logger := slogtest.Make(t, nil)
+			auditor := audit.NewNop()
+
+			// Register the client first, so the update runs against a real
+			// persisted client_type rather than a hand-built fixture.
+			createHandler := tracing.StatusWriterMiddleware(oauth2provider.CreateDynamicClientRegistration(db, accessURL, &auditor, logger))
+			createBody, err := json.Marshal(codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs:            []string{"https://example.com/callback"},
+				TokenEndpointAuthMethod: tt.registerAs,
+			})
+			require.NoError(t, err)
+
+			createReq := httptest.NewRequest(http.MethodPost, "/oauth2/register", bytes.NewReader(createBody)).WithContext(ctx)
+			createReq.Header.Set("Content-Type", "application/json")
+			createRW := httptest.NewRecorder()
+			createHandler.ServeHTTP(createRW, createReq)
+			require.Equal(t, http.StatusCreated, createRW.Code)
+
+			var created codersdk.OAuth2ClientRegistrationResponse
+			require.NoError(t, json.Unmarshal(createRW.Body.Bytes(), &created))
+			clientID, err := uuid.Parse(created.ClientID)
+			require.NoError(t, err)
+
+			updateHandler := tracing.StatusWriterMiddleware(oauth2provider.UpdateClientConfiguration(db, &auditor, logger))
+			updateReqBody := codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs: []string{"https://example.com/updated-callback"},
+			}
+			if !tt.omitAuthMethod {
+				updateReqBody.TokenEndpointAuthMethod = tt.updateTo
+			}
+			updateBody, err := json.Marshal(updateReqBody)
+			require.NoError(t, err)
+
+			// The handler reads client_id via chi.URLParam, which normally
+			// comes from the router in coderd.go.
+			rctx := chi.NewRouteContext()
+			rctx.URLParams.Add("client_id", clientID.String())
+			updateCtx := context.WithValue(ctx, chi.RouteCtxKey, rctx)
+
+			updateReq := httptest.NewRequest(http.MethodPut, "/oauth2/clients/"+clientID.String(), bytes.NewReader(updateBody)).WithContext(updateCtx)
+			updateReq.Header.Set("Content-Type", "application/json")
+			updateRW := httptest.NewRecorder()
+			updateHandler.ServeHTTP(updateRW, updateReq)
+			require.Equal(t, tt.wantStatus, updateRW.Code)
+
+			app, err := db.GetOAuth2ProviderAppByClientID(ctx, clientID)
+			require.NoError(t, err)
+
+			// client_type is what IsPublic() reads to decide whether the token
+			// endpoint validates a secret, so it must be unchanged whether the
+			// update was accepted or rejected.
+			require.Equal(t, tt.wantClientType, app.ClientType)
+
+			if tt.wantStatus != http.StatusOK {
+				var errResp map[string]string
+				require.NoError(t, json.Unmarshal(updateRW.Body.Bytes(), &errResp))
+				require.Equal(t, "invalid_client_metadata", errResp["error"])
+				// The error code alone cannot distinguish this guard from
+				// req.Validate() failing, which returns the same one, and
+				// neither can the untouched row below. The description is the
+				// only field that tells them apart, so assert on it: a change
+				// that made "none" fail validation outright would otherwise
+				// leave these cases green while testing something else.
+				require.Contains(t, errResp["error_description"], "cannot move an existing client between public and confidential")
+				// It must also name what the server actually compared, since
+				// the caller may never have sent the field.
+				require.Contains(t, errResp["error_description"], "client_secret_basic")
+				// The rejection must leave the whole update unapplied, not
+				// just the client_type field.
+				require.Equal(t, "https://example.com/callback", app.CallbackURL)
+				return
+			}
+
+			require.Equal(t, tt.wantFinalCallback, app.CallbackURL)
+			wantMethod := tt.updateTo
+			if tt.omitAuthMethod {
+				// ApplyDefaults substitutes the RFC 7591 default.
+				wantMethod = codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic
+			}
+			require.Equal(t, string(wantMethod), app.TokenEndpointAuthMethod.String)
+		})
+	}
+}
+
+// TestUpdateClientConfiguration_LegacyAuthMethodMismatch covers clients that
+// registered before client_type was derived from token_endpoint_auth_method.
+// Registration persisted whatever auth method was requested while hardcoding
+// client_type to "confidential", and "none" has always passed validation, so
+// apps stored as confidential with an auth method of "none" exist in any
+// deployment where a native or MCP client self-registered. That is the exact
+// population public clients are for.
+//
+// Such a client must still be able to manage its registration. Comparing only
+// the derived client type would reject it forever, including when it resends
+// the metadata GET reports, leaving re-registration as the only recovery. It
+// must also not be silently converted to public, since it holds a secret that
+// would stop being required.
+func TestUpdateClientConfiguration_LegacyAuthMethodMismatch(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		updateTo codersdk.OAuth2TokenEndpointAuthMethod
+	}{
+		{
+			// The read-modify-write shape: echo back what GET reports.
+			name:     "ResendingStoredAuthMethodIsAccepted",
+			updateTo: codersdk.OAuth2TokenEndpointAuthMethodNone,
+		},
+		{
+			// Moving to a secret-based method matches the stored confidential
+			// type, so it is allowed and repairs the divergence.
+			name:     "MovingToSecretBasedMethodIsAccepted",
+			updateTo: codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			db, _ := dbtestutil.NewDB(t)
+			require.NoError(t, db.UpsertOAuth2DCREnabled(ctx, true))
+
+			legacy := dbgen.OAuth2ProviderApp(t, db, database.OAuth2ProviderApp{
+				CallbackURL:             "https://example.com/callback",
+				RedirectUris:            []string{"https://example.com/callback"},
+				ClientType:              database.OAuth2ProviderAppClientTypeConfidential,
+				TokenEndpointAuthMethod: sql.NullString{String: "none", Valid: true},
+				DynamicallyRegistered:   sql.NullBool{Bool: true, Valid: true},
+			})
+			// Registration issued a secret unconditionally back then.
+			_ = dbgen.OAuth2ProviderAppSecret(t, db, database.OAuth2ProviderAppSecret{AppID: legacy.ID})
+
+			logger := slogtest.Make(t, nil)
+			auditor := audit.NewNop()
+			handler := tracing.StatusWriterMiddleware(oauth2provider.UpdateClientConfiguration(db, &auditor, logger))
+
+			body, err := json.Marshal(codersdk.OAuth2ClientRegistrationRequest{
+				RedirectURIs:            []string{"https://example.com/updated-callback"},
+				TokenEndpointAuthMethod: tt.updateTo,
+			})
+			require.NoError(t, err)
+
+			rctx := chi.NewRouteContext()
+			rctx.URLParams.Add("client_id", legacy.ID.String())
+			r := httptest.NewRequest(http.MethodPut, "/oauth2/clients/"+legacy.ID.String(),
+				bytes.NewReader(body)).WithContext(context.WithValue(ctx, chi.RouteCtxKey, rctx))
+			r.Header.Set("Content-Type", "application/json")
+			rw := httptest.NewRecorder()
+
+			handler.ServeHTTP(rw, r)
+			require.Equal(t, http.StatusOK, rw.Code, "body: %s", rw.Body.String())
+
+			app, err := db.GetOAuth2ProviderAppByClientID(ctx, legacy.ID)
+			require.NoError(t, err)
+			require.Equal(t, "https://example.com/updated-callback", app.CallbackURL)
+			require.Equal(t, string(tt.updateTo), app.TokenEndpointAuthMethod.String)
+
+			// The update must not convert the client to public. It still holds
+			// a secret, and IsPublic() reading "public" here would stop the
+			// token endpoint from requiring it.
+			require.Equal(t, "confidential", app.ClientType)
+			require.False(t, app.IsPublic())
+			secrets, err := db.GetOAuth2ProviderAppSecretsByAppID(ctx, legacy.ID)
+			require.NoError(t, err)
+			require.Len(t, secrets, 1)
+		})
+	}
+}

coderd/oauth2provider/tokens.go

@@ -288,7 +288,7 @@ func authorizationCodeGrant(ctx context.Context, db database.Store, app database
 	// The secret must belong to the app identified by the request's
 	// client_id, which is otherwise unauthenticated at this point (it is
 	// parsed straight from the request with no verification). Without this
-	// check, a valid secret for one app could mint a token attributed to a
+	// check, a valid secret for one app could issue a token attributed to a
 	// different app.
 	if dbSecret.AppID != app.ID {
 		return codersdk.OAuth2TokenResponse{}, errBadSecret