fix(auth-oauth1): sign with the token secret when no access token is set

[gschier]

Summary

A token secret without an access token was silently dropped from the OAuth 1.0 signing key: the token object was only built when tokenKey was set, so the signature used cs& where RFC 5849 §3.4.4 calls for cs&ts. This affects every signature method that uses the signing key (PLAINTEXT and the HMAC family). Found while reviewing #605.

The fix passes a token carrying only the secret; leaving key off the object keeps oauth_token out of the Authorization header (oauth-1.0a gates that param on token.key !== undefined).

Tests

New test asserts the signature is cs&ts with only a token secret configured and that no oauth_token parameter is emitted. Fails on main (expected 'cs&' to be 'cs&ts'), passes with the fix; 4/4 suite green.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR preserves an OAuth 1.0 token secret in the signing key when no access-token key is configured.

• Adds a secret-only token representation while continuing to omit oauth_token from the Authorization header.
• Adds a PLAINTEXT regression test covering the resulting signature and header.

Confidence Score: 5/5

The PR appears safe to merge, with no actionable correctness or security issues identified.

The secret-only token is consumed by the OAuth library’s signing-key path while the absent token key prevents oauth_token from being emitted, matching the intended behavior.

Important Files Changed

Filename	Overview
plugins/auth-oauth1/src/index.ts	Adds the secret-only token path needed to sign requests without incorrectly emitting an access-token parameter.
plugins/auth-oauth1/tests/plaintext.test.ts	Adds focused regression coverage for the corrected signing key and omitted oauth_token field.

_{Reviews (1): Last reviewed commit: "fix(auth-oauth1): sign with the token se..." | Re-trigger Greptile}