fix(oauth): allow public clients to exchange + refresh tokens without a secret

The token endpoint declared `client_secret` as a required parameter, so a
public client (SPA / native app, `confidential: false`) that authenticates
with PKCE — Backoffice, for example — was rejected with a 422
"missing required parameter 'client_secret'" before any OAuth logic ran.

Doorkeeper made `client_secret` optional for public clients and skipped
client-secret validation for them. This restores that:

- `token` now takes `client_secret : String? = nil`.
- `AuthlyAdapter::Client#authorized?` returns true for public clients
  (they authenticate via PKCE); confidential clients still require a
  constant-time secret match.
- `allowed_grant_type?` denies `client_credentials` to public clients, so
  the secret bypass can't be used to mint owner-scoped tokens from a
  (public) client_id.
- Discovery advertises `token_endpoint_auth_methods_supported: [..., "none"]`.

PKCE is left optional (matching Doorkeeper); enforcement can be enabled
later via `Authly.config.enforce_pkce`.

Specs updated: fixtures that authenticate with a real secret now model a
confidential client, and a new "public client" block covers the
no-secret code exchange + refresh and the client_credentials denial.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: camreeves

spec/controllers/oauth_alias_spec.cr

@@ -19,6 +19,7 @@ module PlaceOS::Auth
       app.redirect_uri = redirect
       app.scopes = scopes
       app.owner_id = user.id.as(String)
+      app.confidential = true
       app.save!
       {user, app}
     }

spec/controllers/oauth_spec.cr

@@ -20,6 +20,10 @@ module PlaceOS::Auth
       app.redirect_uri = redirect
       app.scopes = scopes
       app.owner_id = user.id.as(String)
+      # These fixtures authenticate with a real client_secret, so they
+      # model a confidential client. Public clients are covered separately
+      # (see the "public client" describe block below).
+      app.confidential = true
       app.save!
       {user, app}
     }
@@ -189,6 +193,92 @@ module PlaceOS::Auth
       end
     end
 
+    # ---- POST /auth/token — public clients (no client_secret) ---------
+    #
+    # SPAs / native apps (`confidential: false`) can't hold a secret; they
+    # authenticate via PKCE. Doorkeeper let them exchange a code and refresh
+    # without a `client_secret`, and Backoffice relies on exactly this. See
+    # `AuthlyAdapter::Client#authorized?`.
+    describe "POST /auth/token (public client)" do
+      # Public variant of `new_application`: confidential is left false and
+      # no secret is ever presented at the token endpoint.
+      new_public_application = ->(redirect : String, scopes : String) {
+        authority = ::PlaceOS::Model::Authority.find_by_domain("localhost").not_nil!
+        user = ::PlaceOS::Model::Generator.user(authority)
+        password = "bcrypt-please-#{Random.rand(99999)}"
+        user.password = password
+        user.save!
+        app = ::PlaceOS::Model::DoorkeeperApplication.new
+        app.name = "public-test-#{Random.rand(99999)}"
+        app.redirect_uri = redirect
+        app.scopes = scopes
+        app.owner_id = user.id.as(String)
+        app.confidential = false
+        app.save!
+        {user, app, password}
+      }
+
+      it "exchanges a code and refreshes with no client_secret" do
+        user, app, password = new_public_application.call("https://spa.example/cb", "public")
+        cookie = Spec.signin!(client, user, password)
+
+        authorize_result = client.get(
+          "/auth/authorize?response_type=code" \
+          "&client_id=#{URI.encode_www_form(app.uid.as(String))}" \
+          "&redirect_uri=#{URI.encode_www_form("https://spa.example/cb")}" \
+          "&scope=public",
+          headers: HTTP::Headers{"Host" => "localhost", "Cookie" => cookie},
+        )
+        authorize_result.status_code.should eq 302
+        location = authorize_result.headers["Location"]
+        code = URI::Params.parse(location.split('?', 2).last)["code"]
+
+        # Token exchange WITHOUT client_secret — this is the drop-in fix.
+        token_result = form_post.call("/auth/token", {
+          "grant_type"   => "authorization_code",
+          "client_id"    => app.uid.as(String),
+          "code"         => code,
+          "redirect_uri" => "https://spa.example/cb",
+        })
+        token_result.status_code.should eq 200
+        token_body = JSON.parse(token_result.body)
+        token_body["access_token"].as_s.should_not be_empty
+        refresh_token = token_body["refresh_token"].as_s
+        refresh_token.should_not be_empty
+
+        # Refresh, again with no client_secret.
+        refresh_result = form_post.call("/auth/token", {
+          "grant_type"    => "refresh_token",
+          "client_id"     => app.uid.as(String),
+          "refresh_token" => refresh_token,
+        })
+        refresh_result.status_code.should eq 200
+        JSON.parse(refresh_result.body)["access_token"].as_s.should_not be_empty
+      ensure
+        app.try &.destroy
+        user.try &.destroy
+      end
+
+      it "denies the client_credentials grant to a public client" do
+        user, app, _password = new_public_application.call("https://spa.example/cb2", "public")
+
+        # Even presenting the app's real secret, a public client must not be
+        # able to mint client-credentials tokens — the grant is confidential
+        # only, so a leaked (public) client_id can't be used as a principal.
+        result = form_post.call("/auth/token", {
+          "grant_type"    => "client_credentials",
+          "client_id"     => app.uid.as(String),
+          "client_secret" => app.secret,
+          "scope"         => "public",
+        })
+        result.status_code.should eq 401
+        JSON.parse(result.body)["error"].as_s.should eq "unauthorized_client"
+      ensure
+        app.try &.destroy
+        user.try &.destroy
+      end
+    end
+
     # ---- GET /auth/authorize -----------------------------------------
 
     describe "GET /auth/authorize" do

spec/controllers/oauth_token_claims_spec.cr

@@ -32,6 +32,7 @@ module PlaceOS::Auth
       app.redirect_uri = "https://app.example/cb"
       app.scopes = scopes
       app.owner_id = user.id.as(String)
+      app.confidential = true
       app.save!
 
       cookie = Spec.signin!(client, user, password)
@@ -149,6 +150,7 @@ module PlaceOS::Auth
         app.redirect_uri = "https://app.example/cb"
         app.scopes = "public"
         app.owner_id = user.id.as(String)
+        app.confidential = true
         app.save!
 
         headers = HTTP::Headers{

spec/controllers/token_meta_spec.cr

@@ -17,6 +17,7 @@ module PlaceOS::Auth
       app.redirect_uri = "https://app.example/cb/#{UUID.random}"
       app.scopes = scopes
       app.owner_id = user.id.as(String)
+      app.confidential = true
       app.save!
       {user, app}
     }

src/placeos-auth/authly_adapter/client.cr

@@ -52,6 +52,12 @@ module PlaceOS::Auth::AuthlyAdapter
     def authorized?(client_id : String, client_secret : String) : Bool
       app = find_app(client_id)
       return false unless app
+      # Public clients (SPAs / native apps, `confidential: false`) don't
+      # authenticate with a secret — they use PKCE. Doorkeeper skipped
+      # client-secret validation for them, so we do too; `client_credentials`
+      # is still denied to public clients in `allowed_grant_type?` below, so
+      # this bypass can't be used to mint tokens without proof of possession.
+      return true unless app.confidential
       Crypto::Subtle.constant_time_compare(app.secret, client_secret)
     end
 
@@ -72,7 +78,14 @@ module PlaceOS::Auth::AuthlyAdapter
     # `Authly.config.clients` must implement it.
     def allowed_grant_type?(client_id : String, grant_type : String) : Bool
       return false unless ALLOWED_GRANT_TYPES.includes?(grant_type)
-      !find_app(client_id).nil?
+      app = find_app(client_id)
+      return false unless app
+      # `client_credentials` authenticates purely by secret, so it is only
+      # ever valid for a confidential client. A public client that reached
+      # `authorized?` via the secret bypass above must not be able to fall
+      # through to a client-credentials grant.
+      return false if grant_type == "client_credentials" && !app.confidential
+      true
     end
 
     # Returns the owning user's ID for use as the `sub` claim of

src/placeos-auth/controllers/oauth.cr

@@ -110,7 +110,13 @@ module PlaceOS::Auth
     def token(
       grant_type : String,
       client_id : String,
-      client_secret : String,
+      # Public clients (SPAs / native apps registered with
+      # `confidential: false`) cannot hold a secret — they authenticate
+      # via PKCE. Doorkeeper made `client_secret` optional for them, so a
+      # required param here would 422 every Backoffice token exchange
+      # before any OAuth logic ran. The client adapter enforces the secret
+      # only for confidential clients (see `AuthlyAdapter::Client`).
+      client_secret : String? = nil,
       code : String? = nil,
       redirect_uri : String? = nil,
       refresh_token : String? = nil,
@@ -129,7 +135,7 @@ module PlaceOS::Auth
                        ::Authly.access_token(
                          grant_type: grant_type,
                          client_id: client_id,
-                         client_secret: client_secret,
+                         client_secret: client_secret || "",
                          scope: scope,
                        )
                      when "authorization_code"
@@ -138,7 +144,7 @@ module PlaceOS::Auth
                        ::Authly.access_token(
                          grant_type: grant_type,
                          client_id: client_id,
-                         client_secret: client_secret,
+                         client_secret: client_secret || "",
                          code: code,
                          redirect_uri: redirect_uri,
                          verifier: code_verifier || "",
@@ -148,7 +154,7 @@ module PlaceOS::Auth
                        ::Authly.access_token(
                          grant_type: grant_type,
                          client_id: client_id,
-                         client_secret: client_secret,
+                         client_secret: client_secret || "",
                          refresh_token: refresh_token,
                        )
                      else
@@ -574,7 +580,9 @@ module PlaceOS::Auth
         @grant_types_supported = ["authorization_code", "client_credentials", "refresh_token"]
         @subject_types_supported = ["public"]
         @id_token_signing_alg_values_supported = ["RS256"]
-        @token_endpoint_auth_methods_supported = ["client_secret_post"]
+        # `none` advertises that public clients may authenticate the token
+        # endpoint with PKCE alone (no client_secret) — see the token action.
+        @token_endpoint_auth_methods_supported = ["client_secret_post", "none"]
         @code_challenge_methods_supported = ["S256"]
         @claims_supported = ["sub", "iss", "aud", "exp", "iat", "email", "full_name", "given_name", "family_name", "nickname", "phone_number", "preferred_username"]
       end